Adversarial review pass

An adversarial review pass runs a second language model against a completed draft and asks it to act as a skeptical QA reviewer, not a collaborator. The goal is to surface gaps, unsupported claims, weak logic, and missing edge cases that the primary executor did not catch.

The critique is advisory. Staff still decide what to accept, reject, or send back for revision. The second model does not overwrite the draft or auto-approve quality.

If the draft output is missing, this pass returns empty output and does not invent critique content.

Use an adversarial pass when the draft is high-stakes enough that a friendly rewrite pass is not enough. Typical cases:

• External-facing summaries, exception narratives, or status updates that will be read by customers or auditors
• Internal packets where a missed caveat creates operational risk
• Multi-step outputs assembled from several sources, where consistency and completeness matter more than tone

It pairs well after draft output generation and before or alongside criteria-based output scoring and policy compliance scan. Scoring and policy checks answer “does this meet the bar?” An adversarial pass answers “what would a careful skeptic attack?”

Skip it for trivial drafts, pure formatting tasks, or when no draft exists yet. Without a draft, there is nothing to stress-test.

Treat the second model as a reviewer with a fixed brief. Keep the executor’s system prompt and tools out of the critique context so the reviewer cannot simply restate the same assumptions.

A practical review brief covers:

1. Role — skeptical operations QA reviewer; prefer false positives that staff can dismiss over silent misses.
2. Inputs — the draft only, plus any non-negotiable constraints (audience, required fields, known facts). Do not feed the executor’s chain-of-thought unless staff explicitly want that reviewed.
3. Attack angles — unsupported assertions, missing counters, ambiguous owners or next steps, internal contradictions, and places where a reader could reasonably misinterpret the output.
4. Output shape — structured findings (severity, location, issue, suggested fix or question), not a rewritten essay unless staff ask for one later.

Severity labels help triage: blocker (must fix before release), major (should fix), minor (nit or style). Keep labels few and stable so reviewers across shifts apply them the same way.

Human-in-the-loop is mandatory. The second model critiques; people decide.

A tight loop looks like this:

1. Confirm a draft exists. If not, stop with empty output.
2. Run the adversarial pass and collect structured findings.
3. Staff accept findings that are valid, reject noise or overreach, and mark unclear items for follow-up.
4. Feed accepted items back into revision (human edit or a controlled rewrite), then re-check only what changed if the stakes warrant it.

Do not treat “the critic said so” as proof. Critics invent issues when the brief is vague or the draft is short. Rejection with a one-line reason improves the next prompt more than silent discard.

When the critic and a criteria score disagree (high score, many blockers), trust neither blindly. Re-read the draft against the original request. Scoring and adversarial review optimize for different failure modes; both can be wrong.

Independence. Prefer a different model or at least a different temperature and system prompt from the executor. Same-model self-critique still helps, but shared training priors can hide the same blind spots twice.

No silent rewrite. Critique-only keeps the audit trail clear: original draft, critique findings, human decisions. Merging rewrite into critique muddies who changed what.

Bounded scope. Ask for a capped number of findings (for example, top issues by severity) so the pass does not dump dozens of nits. Staff can always request a deeper pass on a section.

Empty when empty. Missing draft means empty critique. That keeps downstream automations from treating “no findings” as a clean bill of health when nothing was reviewed.

Complement, do not replace, policy and criteria checks. Adversarial review finds rhetorical and logical weakness. Policy compliance scan checks rules. Criteria-based output scoring scores against explicit rubrics. Use all three when the release bar requires it.

• Critique theater — long, confident findings that do not map to the draft. Require citations to draft spans or section labels.
• Overfitting to hostility — every sentence flagged. Cap findings and require severity justification.
• Rubber-stamping — staff accepting all findings without reading. Log accept/reject rates; spikes in 100% accept usually mean the review is unread.
• Circular rewrite — critic and rewriter thrashing on style. Freeze acceptance criteria before the second pass.
• False clear — empty critique because the draft was never supplied. Surface “no draft / empty review” explicitly in the run record so dashboards do not show green.

Used this way, an adversarial review pass is a disciplined second opinion: structured skepticism for QA, with humans retaining the accept-or-reject gate before anything ships.