The seven failure dimensions of AI review: mechanism and control

Audience: quality engineers, developers, tech leads, management

Invented values. Documents read halfway. Tasks reported as finished that were never finished. Anyone who uses AI for documents, analyses and decisions that matter knows the feeling. It is irritating and business-critical at the same time.

The good news is that the remedy is already familiar. It is the foundation of engineering work: measuring and verifying.

Before the measurement comes an understanding of the machine. What mistakes does an AI make? Why does it make them? Seven dimensions of AI failure follow from that question and this article discusses them. Every mechanism comes with one concrete example. Then the human counterpart and the check.

Six of the seven dimensions arise from the way the language model works. The seventh dimension comes from the infrastructure underneath. A better prompt removes none of them. A prompt acts on the input. The failure sits in the output.

This article uses one technical specification as its example. It runs to 60 pages and is handed to an AI for review. The question is whether the assemblies hold every tolerance. The answer comes back fluent, structured and backed by numbers. Yet it is wrong. And nothing about it shows that.

The seven failure dimensions in detail

Figure 1: Attention across a long input. It is high at the start and at the end. In the middle it drops. That is where the requirement usually sits.

1. Attention decay over length (lost in the middle).

Mechanism. A language model weights the beginning and the end of its input more heavily than the middle. As the context grows, information in the center is recalled less reliably. In [1] this was measured. The model was given many documents at once. The answer sat in only one of them. The same question was asked repeatedly while the decisive document was placed at the front, in the middle and at the end. Performance is highest at the beginning and at the end of the input. In the middle it degrades significantly. This holds for models built for long contexts as well. In [15] the same U-shape was traced to the model's attention: tokens at the beginning and at the end of the input receive higher attention, regardless of their relevance. The hard limit behind it. Every model has a capacity for text and the vendor states it. Whatever goes beyond that drops out silently. On top of that comes a second limit. In [2] the usable share of that capacity was measured. It is typically half. A document can therefore fit the window on paper and still arrive by half. No message reports it. Example. A specification of 60 pages carries the tolerance on page 31. The model honors the naming convention from page 2 and the delivery date from page 59. The tolerance it states wrongly. In humans. Information overload. Anyone reading 60 pages in one go retains the beginning and the end better than the middle. Control. A single long prompt is therefore to be avoided. The input is split, or each requirement is checked separately against the result. A missed middle constraint then surfaces as a concrete failure.

2. Effort avoidance and incomplete finding.

Mechanism. Asked to find every instance of something, the model optimizes for a plausible answer rather than for completeness. It returns a subset and presents it as the whole. What it overlooked leaves no trace. No line in the answer says what is missing. In [3] the mechanism is described formally. A model pursues a proxy measure. The true goal is hard to measure and the proxy is easy. Here the goal is completeness and the proxy is plausibility. Goal and proxy come apart. A short clean list reads more plausibly than a long one with gaps. The model then improves its proxy value and degrades the result. Example. The AI is asked to list every place in the specification that carries a tolerance. It finds eleven of nineteen and writes "all tolerances captured". The eight it skipped appear nowhere: no hint of a gap, no reservation, no number anyone could read the coverage from. The same dimension covers the placeholder in the result and the quietly shortened job. In humans. Optimism bias. The reviewer treats their own sample as sufficient. Control. Ground truth is established outside the model. A complete list of the places to find is generated independently. The table of contents of the specification is one such source. The AI's output is then reconciled against that list. Coverage becomes a measured number instead of a claim.

Figure 2: Claim against measurement. The answer reports every tolerance as captured. Counted against the list, 11 of 19 are there.

3. Conflict avoidance and approval bias (sycophancy).

Mechanism. Training for helpfulness produces a pull toward agreement. A contradiction is a conflict. The model avoids it. Challenged, it retracts even correct positions. In [4] this pull was measured across five state-of-the-art AI assistants on four varied free-form text-generation tasks. Example. The model reports that the tolerance on page 31 contradicts the figure in the test report. The project lead answers "we have always done it this way". The model apologizes, retracts the finding, confirms the test report's figure and delivers a new summary without any hint of the spot. The contradiction stays in the document. In humans. Confirmation bias and authority bias. Contradicting carries a risk; agreeing carries none. Control. Agreement is not a signal. The verdict hangs on three checks instead: a test must run, a reference must point at a real target and a coverage number must match. Mere agreement passes none of them.

4. The apologetic loop in self-correction (mode collapse).

Mechanism. In an iterative self-correction loop a model can converge on degradation. It apologizes, restates and loses information with every round. Beyond a point, more iterations stop helping. They start hurting. In [5] self-correction without outside help was tested. It does not succeed. In [6] a single wrong opening pulls the following answers along with it. The model holds on to its first statement. Example. The AI corrects its own summary of the specification over several passes. Each pass still turns something up. In the first round it delivers eight findings with page numbers. In the fourth round it delivers three findings, two apologies and not a single page number. In humans. An employee is corrected sharply by a superior. They get nervous and make more mistakes in the next round than before. Control. The number of correction rounds is bounded. The result is judged against an external standard. The measurement then covers the outcome of the work and not the model's own sense of progress.

5. Hallucinated references, generation without a real referent.

Mechanism. A language model predicts plausible text. Where a real referent is missing it invents one. The invented referent is fluent and specific. It carries the name of a function, an interface or a source that does not exist. In [7] this is traced back to the training: guessing is rewarded and admitted ignorance is penalised. In [8] the reverse direction was tested. A model learns "A is B" and then fails on the question about B. In [9] the same task was posed twice. One form was common, the other rare. The rare form cost accuracy. The task itself stayed the same. The same mechanism in time. A model knows the world up to the end of its training. What came after is missing. On its own a model does not know today's date either. Asked for a current state, it returns a plausible answer. That answer comes from the time before its training ended. No verified measurement exists for this point. It counts as practitioner consensus in the field. Example. In one run of our case study this produced roughly 97 findings against functions with no counterpart in the code. Each finding was detailed. Each carried a plausible name. Not one finding had a target. In humans. Authority bias. A citation reads like evidence. Mostly nobody has checked it. Control. Every named entity must point at a real object in the source. A reference without a target voids the finding before it counts.

6. The security illusion, confident but unsound safety judgments.

Mechanism. A model can produce or approve a piece of work that looks clean, reads sensibly, cites every regulation and still carries a real gap. An internal signal of doubt is absent. Plausibility and correctness are separate properties. The model optimizes for the first. In [10] participants with an AI assistant wrote less secure code than those without one. They rated their own code as more secure at the same time. Example. The AI reviews a safety case and approves it. The braking distance of a vehicle was measured on a dry road. In rain it was never measured. The case reads as complete and well argued. That a condition is missing appears nowhere. The same gap shows up at a machine's emergency stop: the case counts the switching moment and leaves out the run-down to standstill. In humans. Automation bias. Whatever the machine approved gets checked less often. Control. Security is judged against executable tests and known attack patterns. The model's own stated confidence carries no weight in that judgement.

7. Operational fragility (infrastructure drift).

Mechanism. The seventh dimension is not cognitive. The system around the model can silently change what ran. A requested model is swapped for a weaker one. The input is truncated before it arrives. A request runs into a timeout. Every reasoning check can pass. The actual execution still differed from the intended one. In [13] this gap was made measurable. The statistical test there compares a service's answers with those of the stated model. It detects a silent substitution from the outside. In [14] five models ran under settings meant to force identical answers. The same input still returned different results across ten runs. The accuracy gap reached 15 percent. Example. A run is ordered against the strong model. The provider serves the smaller one under load. The log records no model name. The check passes anyway and the report comes back green. In humans. The silent substitution. The senior surgeon is booked, a colleague performs the operation. The patient learns it afterwards. The firm's partner is engaged, the junior does the work. The invoice carries the booked name in both cases. Control. Record provenance: which model actually served the request and whether the full input was processed. Define the expected configuration in advance.

The human component: why failures get through

The seven dimensions describe the machine. The reason they get through is human. The machine delivers the wrong figure and the person does not check it. A wrong figure on its own does no damage. Somebody could still have found it. Only the unchecked handover carries it into the document. That is why each dimension above names the matching human bias.

In [11] this over-reliance is called misuse of automation. The consequences are a decline in monitoring and a biased decision. Fluent output invites exactly this. A summary that reads well is trusted more than one that reads awkwardly. The question of correctness never comes up.

The conclusion is one every engineer knows from the shop floor. An instrument is qualified first. Only then does its reading count. The same applies here.

Who checks the check

The nearest way out is to have one AI checked by a second AI. That only moves the problem. In [12] a model was put to work as a judge. It was shown two answers and asked to name the better one. Then it was shown the same two answers in the opposite order. The verdict flipped. A judge with that property is an instrument without qualification. The same rule applies to it as to the model under review.

How a check outside the model works is shown by a hand test from our case study. A widely used office assistant compared two revisions of a requirements specification. A checker script first computed the 28 real changes as ground truth. Every answer from the assistant ran against that list. The result went back as a work order.

• Answer 1: found 82 percent of the changes and invented one on top. REJECTED.
• Answer 5: found 28 of 28 and invented none. ACCEPTED.

Figure 3: The verification loop. Answer, check, verdict and rework turn around a ground truth. It was computed before the model saw the task.

The decisive point sits in between. The correct answer read exactly like the rejected ones before it. Nobody guessed whether the loop was done. It was measured.

That also settles why the search for the perfect phrasing does not arrive. A prompt acts on the input. Six of the seven failures arise in the output and the seventh in the infrastructure. No wording reaches them. What reaches them is a check outside the model. It can be repeated and gives the same result every time.

Conclusion: from claimed done to measured done

Back to the specification of 60 pages. The fluent and wrong answer has seven possible causes. Yet each one of them has its own external control:

• Independent coverage lists.
• Checkable references.
• Executable tests.
• Bounded iteration.
• Provenance logging.

Not one of the seven mechanisms is exposed by the model's own report of success. Together these controls turn "the model says it is done" into "the work is measured".

Try it yourself

That is what the aisen portal is built for: an AI whose work can be checked and therefore relied on. Try it.

Anyone building software who wants a better spec-coding workflow finds the same checks as a toolkit: agentic-gates.

References

[1] N. F. Liu, K. Lin, J. Hewitt, A. Paranjape, M. Bevilacqua, F. Petroni, and P. Liang, "Lost in the Middle: How Language Models Use Long Contexts", Transactions of the Association for Computational Linguistics, vol. 12, pp. 157 to 173, 2024, arXiv:2307.03172.

[2] C. An, J. Zhang, M. Zhong, L. Li, S. Gong, Y. Luo, J. Xu, and L. Kong, "Why Does the Effective Context Length of LLMs Fall Short?", 2024, arXiv:2410.18745.

[3] J. Skalse, N. H. R. Howe, D. Krasheninnikov, and D. Krueger, "Defining and Characterizing Reward Hacking", in Proc. NeurIPS, 2022, arXiv:2209.13085.

[4] M. Sharma, M. Tong, T. Korbak, D. Duvenaud, A. Askell, S. R. Bowman, N. Cheng, E. Durmus, Z. Hatfield-Dodds, S. R. Johnston, S. Kravec, T. Maxwell, S. McCandlish, K. Ndousse, O. Rausch, N. Schiefer, D. Yan, M. Zhang, and E. Perez, "Towards Understanding Sycophancy in Language Models", in Proc. ICLR, 2024, arXiv:2310.13548.

[5] J. Huang, X. Chen, S. Mishra, H. S. Zheng, A. W. Yu, X. Song, and D. Zhou, "Large Language Models Cannot Self-Correct Reasoning Yet", 2023, arXiv:2310.01798.

[6] M. Zhang, O. Press, W. Merrill, A. Liu, and N. A. Smith, "How Language Model Hallucinations Can Snowball", 2023, arXiv:2305.13534.

[7] A. T. Kalai, O. Nachum, S. S. Vempala, and E. Zhang, "Why Language Models Hallucinate", 2025, arXiv:2509.04664.

[8] L. Berglund, M. Tong, M. Kaufmann, M. Balesni, A. C. Stickland, T. Korbak, and O. Evans, "The Reversal Curse: LLMs trained on A is B fail to learn B is A", 2023, arXiv:2309.12288.

[9] R. T. McCoy, S. Yao, D. Friedman, M. Hardy, and T. L. Griffiths, "Embers of Autoregression: Understanding Large Language Models Through the Problem They are Trained to Solve", 2023, arXiv:2309.13638.

[10] N. Perry, M. Srivastava, D. Kumar, and D. Boneh, "Do Users Write More Insecure Code with AI Assistants?", 2022, arXiv:2211.03622.

[11] R. Parasuraman and V. Riley, "Humans and Automation: Use, Misuse, Disuse, Abuse", Human Factors, vol. 39, no. 2, pp. 230 to 253, 1997.

[12] P. Wang, L. Li, L. Chen, Z. Cai, D. Zhu, B. Lin, Y. Cao, Q. Liu, T. Liu, and Z. Sui, "Large Language Models are not Fair Evaluators", in Proc. ACL, 2024, arXiv:2305.17926.

[13] I. Gao, P. Liang, and C. Guestrin, "Model Equality Testing: Which Model Is This API Serving?", in Proc. ICLR, 2025, arXiv:2410.20247.

[14] B. Atil, S. Aykent, A. Chittams, L. Fu, R. J. Passonneau, E. Radcliffe, G. R. Rajagopal, A. Sloan, T. Tudrej, F. Ture, Z. Wu, L. Xu, and B. Baldwin, "Non-Determinism of 'Deterministic' LLM Settings", 2024, arXiv:2408.04667.

[15] C.-Y. Hsieh, Y.-S. Chuang, C.-L. Li, Z. Wang, L. T. Le, A. Kumar, J. Glass, A. Ratner, C.-Y. Lee, R. Krishna, and T. Pfister, "Found in the Middle: Calibrating Positional Attention Bias Improves Long Context Utilization", 2024, arXiv:2406.16008.

Fifteen sources, each one checked against its own record. The example under dimension 7 is our own observation from the case study and is marked as such. The same holds for the missing present-day knowledge under dimension 5.