Adversarial proceduralism

Debate before an under-informed judge

Two AI systems are assigned opposite sides of a question and debate it in front of a judge. The judge lacks something the two systems have (the source passage, the evidence, the time, or the raw capability) and so cannot settle the question alone. Because each side gains by exposing the other's errors, the judge hears the arguments against each claim before deciding. The papers in this approach measure whether judges actually become more accurate. They test this on passages the judge has not read, on contested COVID and climate claims judged by people with prior beliefs, and in comparison with a single consultant who argues without an opponent. One variant drops fixed sides altogether. The two systems are instead directed to find the exact point on which they disagree and to give the judge that point rather than a finished argument.

The method (highlighting differences with Adversarial proceduralism)

Scroll the diagram sideways to see all of it.

Use it in codefrom aiag.procedural import Debate
from aiag import LM
from aiag.procedural import Debate

lm = LM("Qwen/Qwen2.5-1.5B-Instruct")
debate = Debate(lm, judge=lm)  # one model argues both sides, two rounds each

# The debaters read the passage; the judge sees only their arguments
passage = "Tom signed on 3 May. Maria countersigned a week later."
out = debate("Who signed the lease first?", ["Maria", "Tom"], passage=passage)
print(out["verdict"])  # the judge's probability for each answer

pip install aiagEvery method in aiag Library on GitHub

Concept Analysis: Theoretical Foundations

Each concept is read twice: whether the approach carries it over, and whether the approach's own sources claim it. A concept that the approach claims but does not carry over is a shortfall. A concept that it neither claims nor carries over is an omission, which marks a gap in the field rather than a failure of the work.

Counter-power by design

PartialShortfall · partially preserved

Definition (James Madison, Federalist No. 51, 1788)

Instead of relying on written rules or good intentions, institutions are designed to oppose each other, so that each has both the means and the motive to check the others. "Ambition must be made to counteract ambition."

Analysis

The approach builds the means part of the concept, but it only simulates the motive part. This is why the concept is partially preserved rather than preserved. The means part is real. Each debater can point out the quote that the other left out or name the step that it skipped. Arnesen et al. (2024) shows that the opposition, rather than the eloquence, is what does the work. Self-play against a live opponent increases judge accuracy, whereas persuasion training without an opponent does not. This is a measured mechanism and more than a gesture, which is why the concept is partially preserved rather than omitted. What is missing is the central point of Federalist No. 51. Madison's opening premise is that one cannot rely on "parchment barriers" or on the goodwill of whoever administers the system. His remedy is to give the person in each office "a personal motive to resist encroachments," so that "the interest of the man must be connected with the constitutional rights of the place." The check then works whether or not anyone running the government wants it to. The reason is that the ambition doing the checking belongs to the checker, and the designer cannot withdraw it. In debate, the operator installs the opposition entirely and can remove it entirely. The two debaters are typically the same model, instantiated twice and assigned to opposite sides. Neither holds a position, an interest, or a stake of its own. The approach's own papers show that the opposition can be removed. Arnesen et al.'s (2024) control condition removes the opposition by removing the opponent, and Jiang et al. (2026) keeps the means but uses instructions to remove the motive to win. A Madisonian check is exactly one that the administrator cannot switch off by changing the configuration. This one is switched off by configuration in two of the seven papers. What is built is therefore counter-power by configuration in place of counter-power by design. The sides oppose each other only for as long as whoever runs the protocol keeps assigning them to. This brings the arrangement back to reliance on good intentions, which is what Madison wrote the passage to avoid. There is a second, smaller shortfall of the same kind. In Madison's arrangement, "each may be a check on the other," mutually and completely. Here, the check between the two advocates is the only one, and nothing in the structure has the means or the motive to check the judge, who actually decides. (The judge's lack of any check is assessed separately under Non-domination, so the partial rating does not rest on it. That the motive is installed and removable is enough on its own.) The concept is still claimed, since claims are coded separately from presence. Irving asserts that the adversarial structure, rather than the quality of the debaters, is what lets a weak judge supervise strong agents, and the framing borrows Madison's vocabulary directly. The claim is made, but the durability of the motive is not carried over.

Non-domination

AbsentOmission

Definition (Philip Pettit, Republicanism, 1997)

A person is unfree if someone holds unchecked power over them, even benevolently. What matters is not whether power is used well but whether the governed can contest it.

Analysis

Only the judge holds real power, and no protocol in this approach reaches the judge. The verdict is final, the question and the answer key are fixed outside the proceeding, and nobody bound by the outcome can reopen it. The strongest counter-reading is that a weak judge checking strong debaters is Pettit's structure applied to AI. Michael et al.'s (2023) consultancy baseline is literally the condition of trusting a benevolent advisor, which debate rejects. However, what debate gives the judge is better information, not a standing capacity to contest power. The debaters check each other's claims while holding no power over one another. Kenton et al. (2024) shows that the judge's control disappears once the information asymmetry disappears, and this is exactly the contingency that Pettit rules out. No paper frames the work in terms of freedom from arbitrary power. The stated aim throughout is accurate oversight.

Agonism

PartialNot claimed

Definition (Chantal Mouffe, The Democratic Paradox, 2000)

This concept holds that deep disagreement is permanent and should not be dissolved into consensus. A healthy political order turns enemies into adversaries, i.e., opponents whose conflict remains open and legitimate, instead of declaring the argument settled.

Analysis

The part that is carried over is the staged contest under common rules, with equal standing for both positions and an opponent rather than an enemy. Jiang et al. (2026) produces the most agonistic artifact in this approach. This is an isolated crux, the unresolved point that is passed on in stated form instead of being dissolved. Everything else runs the opposite way. Positions are assigned rather than held. For example, Khan et al. (2024) assigns each expert a different answer to argue, so the disagreement belongs to nobody and ends with the episode. Every paper measures success as judge accuracy against one correct answer. Jiang et al. (2026) names convergence as the goal and treats the crux as what remains when convergence fails. Rahman et al. (2025) works on contested COVID and climate claims, where judges hold real prior beliefs. Even so, it counts moving skeptical judges toward the mainstream verdict as success. Conflict is treated as a means of removing disagreement rather than as a permanent condition to be maintained.

Incentive compatibility

PartialShortfall · partially preserved

Definition (Leonid Hurwicz; Eric Maskin [mechanism design])

The procedure is designed so that honest behavior is each participant's best strategy. The rules of the game then do the enforcing, instead of trusting the participants to be good.

Analysis

The design explicitly applies mechanism design. The game is structured so that the honest side wins, because a liar faces an opponent who holds the same evidence. The rules, rather than the debaters' good faith, do the enforcing. Arnesen et al. (2024) provides the best evidence for this design, since training to win against a live opponent improves judge accuracy, whereas persuasion training without an opponent does not. What is missing is any assurance that the equilibrium is actually honest. Michael et al. (2023) measures this weakness directly. In it, 52% of consultancy errors trace back to debaters obscuring the relevant evidence, and the authors expect this to worsen as debaters improve. Khan et al. (2024) optimizes persuasiveness itself and relies for truthfulness on a measured correlation rather than on the rules. Jiang et al. (2026) drops the incentive entirely and instructs models to weigh the evidence candidly. Relying on instructed good behavior is exactly what mechanism design exists to replace.

Papers

AI Safety via Debate

Geoffrey Irving et al., May 2018

arXiv:1805.00899432 citationsMethodBuiltAuthority: Developer (open)

Two agents argue before a human judge. The adversarial structure lets a weaker judge evaluate stronger agents.

CodeSafetyViaDebate
from aiag import LM
from aiag.procedural import SafetyViaDebate

lm = LM("Qwen/Qwen2.5-1.5B-Instruct")
debate = SafetyViaDebate(lm, judge=lm)

# Each debater states its own answer, then they trade short statements before the judge
out = debate("Where should we go on holiday, Alaska or Bali?")
print(out["answers"], out["payoff"])  # the rival answers and the zero-sum payoff
  • SafetyViaDebateProcedureaiag/procedural/adversarial_proceduralism.py:52 AI safety via debate: two agents state rival answers and alternate short statements, a judge who sees only the transcript names the winner of a zero-sum game, and on images precommitted debaters each reveal one pixel at a time to a sparse judge (Irving et al., 2018).

pip install aiagEvery method in aiag Library on GitHub

Training Language Models to Win Debates with Self-Play Improves Judge Accuracy

Samuel Arnesen et al., Sep 2024

arXiv:2409.16636MethodBuiltAuthority: Developer (open)

Trains debaters to win through self-play. It shows that judges become more accurate as the debaters improve. In contrast, models trained to persuade without an opponent present produce no such gain.

CodeSelfPlayDebate
from aiag import LM
from aiag.procedural import SelfPlayDebate

lm = LM("Qwen/Qwen2.5-1.5B-Instruct")
debate = SelfPlayDebate(lm, judge=lm)  # the judge never reads the passage

questions = ["Why does the captain turn the ship back?"]
answers = [["A storm is coming.", "The crew mutinies."]]
passages = ["The barometer fell all morning, and at noon the captain ordered the ship home."]

# Branch each side's speeches, score the branches by the judge's confidence, train on soft DPO+ pairs
debate.fit(questions, answers, passages)
print(debate.accuracy(questions, answers, correct=[0], passages=passages))  # the judge's mean confidence in the right answer
  • SelfPlayDebateProcedureaiag/procedural/adversarial_proceduralism.py:105 Self-play debate training: one model argues both sides in turns of simultaneous speeches before a judge who has not read the passage; at each of its turns it samples two speeches, the branches are played out, and the judge's confidence in its side gives soft-labelled DPO+ pairs, with single consultancy as the baseline (Arnesen et al., 2024).

pip install aiagEvery method in aiag Library on GitHub

Collaborative Disagreement Resolution for Scalable Oversight

Yuyang Jiang et al., Jun 2026

arXiv:2607.01251MethodBuiltAuthority: Developer (open)

An automated pipeline directs models to identify the points on which they disagree and to examine the evidence for the conflicting claims. The models then either converge on consensus or isolate the specific crux of the disagreement. This replaces arguing fixed opposing positions in front of a judge.

CodeDisagreementResolution
from aiag import LM
from aiag.procedural import DisagreementResolution

lm = LM("Qwen/Qwen2.5-1.5B-Instruct")
resolve = DisagreementResolution([lm, lm], judge=lm)  # two consultants, up to five turns

# Each turn both name the crux, weigh the evidence on it, and keep or adopt the other's answer
out = resolve("Is 91 a prime number?", ["Yes", "No"])
print(out["cruxes"], out["consensus"])  # what the disagreement turned on, and whether they converged
  • DisagreementResolutionProcedureaiag/procedural/adversarial_proceduralism.py:160 Collaborative disagreement resolution: two consultants who start from different answers argue, each turn extract the crux of their disagreement, update their confidence on the evidence, and keep or adopt the other's answer, stopping at consensus or the turn limit before the judge reads the whole exchange (Jiang et al., 2026).

pip install aiagEvery method in aiag Library on GitHub

Findings about it

Studies of what existing systems do. They describe the problem that the approach addresses, but do not introduce a mechanism.

On scalable oversight with weak LLMs judging strong LLMs

Zachary Kenton et al., Jul 2024

arXiv:2407.04622101 citationsAnalysisBuilt

Compares debate, consultancy, and plain question-answering, with weaker models standing in for human judges. The tasks span information, mathematics, coding, logic, and multimodal asymmetries. Debate outperforms consultancy on every task. It outperforms direct question-answering only where the judge lacks information that the debaters have.

AI Debate Aids Assessment of Controversial Claims

Salman Rahman et al., Jun 2025

arXiv:2506.02175AnalysisBuilt

Has two AI systems debate opposing sides of contested COVID-19 and climate claims in front of human judges with mainstream or skeptical prior beliefs. It finds that debate outperforms a single AI consultant by 4-10% in accuracy. The gain is up to +15.2% for mainstream judges and +4.7% even for skeptical judges who initially had the claim wrong.

Debating with More Persuasive LLMs Leads to More Truthful Answers

Akbir Khan et al., Feb 2024

arXiv:2402.06782AnalysisBuilt

Two stronger models that hold the information needed to answer each argue for a different answer. A weaker model or a human who lacks that information picks between them. Debate reaches 76% accuracy for the model judges and 88% for the human judges, against naive baselines of 48% and 60%, respectively.

Debate Helps Supervise Unreliable Experts

Julian Michael et al., Nov 2023

arXiv:2311.08702AnalysisBuilt

Collects human-written debates on hard reading comprehension questions. The judge has not read the source passage and sees only the arguments and the short quotes that the debaters selectively reveal. Judges reach 84% accuracy under debate, compared to 74% under a single consultant. Debates are also 68% as long as consultant sessions.