Why Independent AI Audits Need Independence

Highlights

Six leading AI companies have pledged to work with independent auditors, but the agreement does not specify who selects auditors, what they may inspect, or whether results must be disclosed. Past corporate failures and weak results from earlier voluntary AI commitments illustrate the risks of leaving oversight to the companies being reviewed. New privacy-preserving testing methods may allow auditors to examine advanced models without receiving copies or seeing sensitive data. For audits to be credible, companies should not control the questions or scope of the examination. The article argues for transparent auditor selection, meaningful reporting, and external accountability for those who review audit findings.

Sentiment Analysis

• The article takes a cautiously critical view of the White House accord. It welcomes the commitment to outside review but emphasizes that voluntary promises alone may not ensure rigorous oversight.
• Historical comparisons, including the Enron and Arthur Andersen collapse, support concern about conflicts of interest when a company chooses and pays its own auditor. The discussion of earlier AI commitments also suggests that pledges can be inadequately fulfilled.
• The tone is not wholly pessimistic. A double-blind testing approach developed by Google DeepMind with Singapore's AI Safety Institute and other groups is presented as a practical way to protect both model security and evaluator independence.
• Overall, sentiment is mixed, leaning cautionary: technical options for stronger scrutiny exist, but credible governance, public accountability, and safeguards against conflicts remain unresolved.

Article Text

Six major artificial intelligence companies recently agreed to cooperate with outside reviewers under an accord presented to the White House. On Sept. 29, Nvidia, OpenAI, Anthropic, Google, Meta and xAI signed the agreement concerning their most advanced AI models. U.S. President Donald Trump described it as “morally binding.” The companies said they would partner with an independent external auditor or evaluator, while independent board members would review reports and ensure that identified problems are addressed.

External scrutiny can help identify risks that companies might otherwise miss or have little incentive to disclose. However, the accord leaves important questions unanswered. It does not define who chooses the auditors, which parts of a model or development process they can examine, or whether findings must be made public. Nor does it establish a penalty for failing to follow through. Under the arrangement as described, a company selects its own auditor and determines the auditor’s access.

The article compares this structure with the accounting scandal involving Enron and Arthur Andersen. In 2000, Enron paid Arthur Andersen $25 million to audit its books and another $27 million for tax and consulting services. Within two years, both firms had collapsed. Congress responded with the Sarbanes-Oxley Act, which removed auditor selection from management, restricted the sale of many other services to audit clients, and created a public board to inspect auditors. The account argues that Andersen’s failure was not simply a shortage of expertise; financial incentives can weaken an auditor’s willingness to challenge a client.

Voluntary AI commitments have also produced uneven results. In 2023, leading AI companies promised the White House, among other things, that outside experts could test systems before release. Researchers at Stanford, Harvard and Brown later evaluated 16 companies against those commitments. Their average score was 53%, and eight of the 16 received zero for their promise to help outsiders find and report problems. These results raise doubts about relying on commitments without clear standards or enforcement.

Even where external testing occurs, the company developing a model may set limits on what evaluators can examine. METR, a nonprofit that tests AI models, said its pre-release evaluation of OpenAI’s o3 model lasted only three weeks, involved limited information, and did not provide access to the model’s step-by-step reasoning. OpenAI did permit the assessment, but the example illustrates how the value of a review depends on the access and conditions a developer grants.

Model security creates a genuine complication. A trained AI model consists of a very large file of numbers and can cost more than $100 million to produce. Giving an outside party a copy may expose valuable technology or create security risks. Google DeepMind has described the resulting dilemma: evaluators could reveal their questions in advance, allowing the company to see the test, or the developer could give evaluators access to the model.

In August, Google DeepMind demonstrated a different approach with Singapore’s AI Safety Institute and three other outside groups. The collaboration conducted what it described as the world’s first double-blind test of an AI model, drawing on the principle used in double-blind drug trials. Testing ran on sealed computer hardware. Evaluators did not see the model, and Google did not see their questions. Google says each side can mathematically verify that its material remained private. This approach suggests that independent testing can be separated from handing auditors a copy of a model.

Sealed hardware is not risk-free. Researchers breached this type of hardware last year using less than $1,000 of equipment, although the attack required physical access to the server. The article treats this vulnerability as significant but more manageable than a blanket refusal to let evaluators near a model. Careful control over the machines could reduce the risk.

A report titled “Alternatives to Concentrated AI,” published this week by the Decentralization Research Center, drew on interviews with 36 people and mapped nearly 30 working alternatives to concentrated control over AI. Its central finding is that outsiders can scrutinize advanced AI without taking possession of the model or its data. The article therefore recommends that auditors, rather than the companies they assess, choose what to test. Companies should identify their auditors and explain the scope of audits, even if detailed results remain confidential. It also argues that board committees reviewing reports should be accountable to parties outside the company. The accord does not establish an independent inspector for auditors, leaving Congress to determine how that accountability gap should be addressed.

Key Insights Table