Closes the substantive net-new findings Opus round-2 surfaced. All
fixes are structural or disclosure improvements; no empirical
content changes.
N1 — Denominator inconsistency disclosure: §IV-M.4 per-firm D2 ICCR
listing (line 325) now explains the $n = 19{,}501$ Firm C
denominator versus §IV-J Table XIX's single-firm-only $19{,}122$.
The 379 mixed-firm PDFs all resolve to Firm C under Script 45's
mode-of-firms (majority firm) tie-break — empirically Firm C is
the majority firm in every mixed-firm PDF, not a tie-break
artefact. Footnote reconciles both totals (75,233 vs 74,854).
N2 — §III-M validation table completeness: composition-decomposition
diagnostic (§III-I.4; Scripts 39b–39e) — the foundational v4
evidence cited in Abstract / §I item 4 / §VI item 1 — added as
the first row of the §III-M validation table. Updated:
- §I item 8 (Phase 4 line 57): "nine partial-evidence
diagnostics" → "ten partial-evidence diagnostics (§III-M
Table XXVII)"
- §VI item 8 (Phase 4 line 147): "nine-tool unsupervised-
validation collection (§III-M)" → "ten-tool unsupervised-
validation collection (§III-M Table XXVII)"
- Phase 4 internal draft note still says "nine-tool" but is
internal-strip-at-splice; deliberately not edited.
N3 — Table number assigned: §III-M validation table is now
Table XXVII (continues sequential numbering after §IV-M.6's
Table XXVI). Caption: "Ten-tool unsupervised-validation
collection with disclosed untested assumptions."
N4 — Cross-firm hit matrix assumption row rewritten: replaced the
"None — direct descriptive observation" understatement with the
actual dependency disclosure — same-pair joint event yields
97.0–99.96% within-firm at all four firms versus any-pair
76.7–98.8% — plus the §IV-M.4 mode-of-firms tie-break
cross-reference.
Net result: all three substantive Opus round-2 net-new findings
plus N4 closed. N5 (firm-dependent within-firm violation in §V-H)
and N6 (§IV-I stub cross-reference) deferred as low-priority
optional copy-edits.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
**Minor Revision (corroborates codex round-8).** The empirical core is sound and reproducible. Round-2 (b884d39) closed my round-1 M1–M4 cleanly, and round-3 (4a6f9c5) closed codex round-8's three concrete splice blockers (abstract trim 247 w; §IV-J n=150,442 vs 150,453 footnote correctly distinguishing descriptor-complete vs vector-complete; §IV-I "§IV-M Tables XXI-XXVI" replacing the stale "Table XVI"). I dissent on **readiness for splice**: a fresh round-2 pass surfaces three net-new findings that the panel collectively missed — a denominator inconsistency between §IV-J Table XIX and §IV-M.4 per-firm doc counts (379-doc mixed-firm-PDF mode-of-firms tie-break), the absence of the composition-decomposition diagnostic from the §III-M nine-tool validation table that anchors the v4 narrative, and the unnumbered status of the §III-M table itself. None of the three is empirical-blocker grade; they are substantive copy-edit / structural fixes that should be patched in a single round-4 pass before splice.
I align with codex round-8 on the disposition and on M1-M4 closure judgments. I do NOT corroborate Gemini round-2 directly (parallel; not read).
## Cross-reviewer convergence summary
Post-round-3 (4a6f9c5):
| Theme | codex r8 | Opus r2 (this) |
|---|---|---|
| Overall disposition | Minor Revision | Minor Revision (corroborate) |
| Opus M1 K=3 mechanism-label reversion | CLOSED (Table XI residue → fixed in r3 to "replication-dominated vs less-replication-dominated") | **CLOSED.** Verified by grep: `hand-leaning` returns 0 matches in §IV body; the only 2 §III matches are internal-checklist open-question text (line 445) and an unrelated $\Delta$BIC line, both stripped at splice. |
| Opus M2 Table XV-B cascade | CLOSED in public body | **CLOSED.** Tables XV→XIX, §IV-M cascades XX-XXVI correctly. Only "XV-B" residue is in internal draft notes (lines 3, 370) that strip at splice. |
| Opus M3 within-firm any-pair vs same-pair | CLOSED in body; abstract uses rounded any-pair 77-99% | **CLOSED.** Abstract line 11 "77-99%" rounds the deployed-rule any-pair range (76.7-98.8%). §I item 6 (line 53), §V-C (line 87), §V-H limitation 2 (line 115), §VI item 4 (line 147), §VI future work (line 149) all give the correct any-pair 76.7-83.7% / 98.8% split plus same-pair 97.0-99.96% subrange. |
| Opus M4 duplicate §V-G | CLOSED | **CLOSED.** §V headings now run A-H sequentially (lines 73/77/83/89/95/99/105/109). |
| Gemini Table XV sample-size footnote | CLOSED in r3 | **CLOSED.** §IV-J line 177 footnote now correctly groups §IV-M.2/M.3/M.5 (Scripts 40b/43/44) as vector-complete 150,453. |
| Codex r8 splice blockers | r8 status open; r3 fixed | **CLOSED.** Abstract 247 w (verified `wc -w` on line 11); §IV-I (line 161) now points to "§IV-M Tables XXI-XXVI"; binary-collapse label is "replication-dominated vs less-replication-dominated" (§III line 131, §IV Table XI line 104). |
| Internal draft notes | OPEN (splice-strip pending) | **OPEN.** Three draft-note blocks + three close-out checklists + §III cross-reference index + §III open-questions block still present and must strip at splice. |
Provenance grep `hand-leaning` returns only 2 matches in §III, both non-substantive:
-`paper_a_methodology_v4_section_iii.md:90` — false positive ("lower than $K{=}2$ by $3.48$", the term "leaning" never appears).
-`paper_a_methodology_v4_section_iii.md:445` — Open-question item 2 in the §III internal checklist ("Firm C is the firm most concentrated in C1 hand-leaning at 23.5%"). This is in the **author working notes** at lines 441-447, scheduled for splice-strip per Gemini m1 / codex Opus minor 2.
§IV body is entirely cleansed: Table IX (line 85-87) "less-replication-dominated rate"; Table X (line 93) "mean Paper A less-replication-dominated rate"; Table XI (line 104) "binary collapse, replication-dominated vs less-replication-dominated" (round-3 fix); Table XIV (line 147) "Misclassified as less-replication-dominated"; Table XVI (line 219) "C1 (low-cos / high-dHash) | C2 (central) | C3 (high-cos / low-dHash)"; Table XVII (line 238) "C1 (low-cos / high-dHash)" / "C3 (high-cos / low-dHash)"; Table XVIII (line 244-246) "Paper A operational less-replication-dominated rate"; §IV-F prose (line 102) "the most replication-dominated"; §IV-K reading (line 254) "non-templated CPAs". All match §III-J line 90's intent.
**One residual concern (low priority):** the K=3 LOOO upstream Script 37 report file at `/Volumes/NV2/PDF-Processing/signature-analysis/reports/v4_big4/k3_loo_check/k3_loo_report.md` still uses "C1 hand-leaning / C2 mixed / C3 replicated" labels (lines 7-9). This is in the empirical pipeline output, not the manuscript; it doesn't affect the published paper but does mean a reviewer following the data trail will see legacy labels. Worth noting in author working notes that the script report file naming convention has not been updated.
### M2 — Table-numbering cascade: CLOSED
Verified the cascade: §IV-J Table XV (line 167, five-way per-sig), Table XVI (line 217, K=3 cross-tab), Table XVII (line 234, full-vs-Big-4 K=3 drift), Table XVIII (line 244, Spearman full-vs-Big-4), Table XIX (line 192, document-level worst-case), Table XX (line 266, composition decomposition), Table XXI (line 280, per-comparison ICCR), Table XXII (line 300, pool-normalised per-sig ICCR), Table XXIII (line 317, document-level ICCR), Table XXIV (line 329, logistic regression), Table XXV (line 340, cross-firm hit matrix), Table XXVI (line 353, alert-rate sensitivity).
In-text §IV cross-references all consistent:
- §IV-D line 23 "tabulated in §IV-M below" — non-specific, OK.
The Abstract (line 11) uses the rounded any-pair-only range "77-99% of inter-CPA collisions concentrate within the source firm — consistent with firm-level template-like reuse". 76.7-98.8% rounds to 77-99% (lossy at the boundary but defensible as a 2-significant-figure summary).
I verified by grepping "98-100\\|98–100" — zero matches in §III/§IV/Phase 4. The legacy framing is fully removed. The corrected pattern (any-pair + same-pair subrange disclosure) appears at:
- §III-J line 99: "within-firm collision concentration is $98.8\\%$ at Firm A and $76.7$–$83.7\\%$ at Firms B/C/D (the stricter same-pair joint event saturates at $97.0$–$99.96\\%$ within-firm across all four firms)"
- §III-L.4 line 283: same body text in primary methodology location.
- §V-C line 87 (Phase 4): same pattern + the v3.x byte-level evidence cross-reference.
- §V-H limitation 2 line 115 (Phase 4): correctly attributes the partial-violation framing.
- §VI item 4 line 147 (Phase 4): same pattern.
- §VI future work line 149: "(any-pair $76.7$–$98.8\\%$ across Big-4; same-pair joint $97.0$–$99.96\\%$)" — full precision.
§I contribution 6 (line 53) also gives the any-pair 98.8% / 76.7-83.7% + same-pair 97.0-99.96% split.
### M4 — Duplicate §V-G heading: CLOSED
`grep -n '^## [A-Z]\\.'` on Phase 4 prose shows §V sub-sections A-H in correct order: A (line 73), B (77), C (83), D (89), E (95), F (99), G (105 "Pixel-Identity..."), H (109 "Limitations"). One cross-reference to §V-G in the close-out checklist (line 160) is internal-strip-at-splice; §V-H line 111 "inherited from v3.20.0 §V-G" correctly cites the original v3.x letter.
## Net-new findings (fresh look post-round-3)
### N1. Denominator inconsistency between §IV-J Table XIX per-firm document counts and §IV-M.4 per-firm D2 counts — **discoverable in 30s by a careful reader**.
*Issue.* §IV-J Table XIX (lines 207-211) reports per-firm document-level breakdown **"single-firm PDFs only; mixed-firm PDFs $n = 379$ excluded"**: Firm A 30,226 / Firm B 17,127 / Firm C **19,122** / Firm D 8,379. §IV-M.4 line 325 reports per-firm D2 document-level ICCR with denominators: Firm A 30,226 / Firm B 17,127 / Firm C **19,501** / Firm D 8,379.
The Firm A/B/D denominators are identical between the two tables; only Firm C differs by exactly 379, the mixed-firm count. The full sum 75,233 reconciles in §IV-M.4 but not in §IV-J (74,854 = 75,233 - 379).
*Root cause (verified against Script 45 source).* Script 45 (`signature_analysis/45_doc_level_far_full_5way.py`) lines 250-260 assigns each PDF to its firms-mode via `np.unique(firms[idxs], return_counts=True); doc_firm[pdf] = str(vals[np.argmax(counts)])`. For mixed-firm PDFs with a 1:1 firm tie, `np.argmax` returns the first index, which under `np.unique`'s alphabetical sort means tie-break order A < B < C < D. So if a PDF has signatures from {Firm A, Firm C}, the mode-of-firms is Firm A by tie-break, not Firm C. Yet all 379 mixed-firm PDFs land in Firm C in the output — meaning Firm C is the genuine majority firm in every mixed-firm PDF, not a tie-break artefact. This is empirically plausible (Firm C may dominate joint audits) but the manuscript does not disclose it.
*Severity.* Medium. The §IV-M.4 Firm C ICCR of 0.1635 is computed on 19,501 docs (including 379 mixed-firm), while the §IV-J Table XIX Firm C 5-way distribution is on 19,122 docs (single-firm only). A reader who tries to compose §IV-J + §IV-M.4 to reason about Firm C will see two different denominators with no inline reconciliation.
*Fix.* Add a one-line footnote to §IV-M.4 Table XXIII clarifying that "per-firm document counts use Script 45's mode-of-firms assignment, which assigns mixed-firm PDFs to their majority firm; the 379 mixed-firm PDFs all resolve to Firm C and are excluded from §IV-J Table XIX's single-firm-only breakdown." Alternatively, harmonise on a single rule (mode-of-firms throughout, or single-firm-only throughout).
### N2. The §III-M nine-tool validation table **omits the composition-decomposition diagnostic** that anchors the v4 narrative.
*Issue.* The §III-M table (lines 318-329) lists 9 tools: per-comparison ICCR, per-signature ICCR, per-document ICCR, firm-heterogeneity logistic regression, cross-firm hit matrix, alert-rate sensitivity sweep, convergent score Spearman ranking, pixel-identical conservative positive capture, LOOO firm-level reproducibility. The §III-I.4 composition-decomposition diagnostic (Scripts 39b-39e), which is the most novel v4 contribution and is foregrounded in:
- Abstract line 11 ("dissolves under joint firm-mean centring and integer-tie jitter")
- §I contribution 4 ("2×2 factorial diagnostic ... fully attributable to between-firm location shifts and integer mass-point artefacts")
- §VI conclusion item 1 ("composition decomposition (Scripts 39b-39e) that establishes the absence of a within-population bimodal antimode")
- §V-B (Phase 4 line 81)
...is **not in the nine-tool table**. The reader is told the system has a "multi-tool collection of partial-evidence diagnostics" and the table claims to enumerate them, but the most distinctive v4 diagnostic is absent. The omission is structurally awkward because the composition decomposition is what justifies the entire anchor-based-rather-than-distributional pivot.
*Reasoning.* This is not just nomenclature — §III-M is the manuscript's explicit answer to "what validates this in the unsupervised setting?" Omitting the composition decomposition from §III-M Table reads as if the v4 authors do not consider it part of the validation collection. But §I item 4 + §VI item 1 + Abstract all rely on it as the foundation for the anchor-based pivot.
*Fix.* Add a row: "Composition decomposition (§III-I.4; Scripts 39b-39e) | Demonstrates that Big-4 dip-test rejection is attributable to between-firm location shift + integer-tie artefact, not within-population bimodality | Assumes within-firm signature-level distribution is the appropriate unit; bootstrap resolution $n_{\\text{boot}} = 2000$ bounds $p$-value precision at $5 \\times 10^{-4}$".
This converts the framing from "nine-tool" to "ten-tool". The "nine" appears in §I contribution 8 (line 57), §VI item 8 (line 147), and §III-M's framing. All three would need to update to "ten-tool". Alternatively, fold the composition decomposition into an existing row (e.g., merge with "Convergent score Spearman" as a "Distributional / convergent diagnostic" row) — but that obscures the v4 pivot.
*Tag.***All three prior reviewers missed this. Highest-priority net-new finding.**
### N3. The §III-M nine-tool table is structurally **unnumbered**.
This was flagged in my round-1 as new-issue #3 (low priority) and codex r8 reflagged it as Opus-new-issue-3. It remains unfixed in round-3. The other §III tables (lines 60-66 factorial; the K=3 component table in §III-J at line 83-87) are inline tables also unnumbered. But §III-M's table is referenced from §I (line 57 "a multi-tool unsupervised validation strategy") and §VI (line 147 "nine-tool unsupervised-validation collection (§III-M)") as a load-bearing artefact. If the journal style requires every numbered display object to have a Table N: header, this needs Table XXVII (the next number after §IV-M.6's Table XXVI).
*Fix.* Either assign "Table XXVII" to the §III-M table, or restate §I item 8 / §VI item 8 to "a nine-tool collection (see §III-M)" without table-numbered cross-reference.
### N4. §III-M row 5 ("Cross-firm hit matrix") **understates the untested assumption** as "None — direct descriptive observation".
*Issue.* Line 324: "Cross-firm hit matrix (§III-L.4; Script 44) | Concentration of inter-CPA collisions within source firm | None — direct descriptive observation".
This is too strong. The cross-firm hit matrix is computed under the deployed any-pair rule, against an inter-CPA candidate pool drawn from non-same-CPA signatures. The "concentration within source firm" depends on (a) the deployed-rule semantics (any-pair vs same-pair: §V-H limitation 2's whole point is that the rate differs across the two semantics), (b) the candidate-pool construction (all non-same-CPA across all firms; the report doc shows this draws on 168,755 total signatures), and (c) for the per-document version, the mode-of-firms tie-breaking surfaced in N1.
*Fix.* Replace "None" with something like: "Reflects deployed any-pair rule semantics (the stricter same-pair joint event yields 97-99.96% within-firm across all four firms; §III-L.4); per-document per-firm assignment uses Script 45's mode-of-firms rule (§IV-M.4 N1)."
*Tag.* Net-new.
### N5. The §V-H limitations list (14 items) does **not include a limitation about within-firm collision firm-dependence**.
*Issue.* The §V-H list at line 113-139 covers 9 v4-specific limitations and 5 inherited from v3.20.0. Item 2 (line 115) covers the assumption-violation but not the firm-dependent fact: under the deployed any-pair rule, Firm A is 98.8% within-firm but Firms B/C/D are only 76.7-83.7% within-firm. This means the inter-CPA-as-negative assumption is more violated at Firm A than at Firms B/C/D — so per-firm ICCRs at Firm A are most contaminated by within-firm sharing, while per-firm ICCRs at B/C/D are closer to clean specificity. The implication is that the headline pooled rate (per-document HC+MC 0.34) is over-influenced by Firm A's higher within-firm contamination, and the per-firm B/C/D rates of 0.09-0.16 are more nearly a clean specificity estimate.
This nuance is not in §V-H but matters for a reader interpreting "per-firm rates differ by an order of magnitude" as evidence of differential template-sharing rates rather than as a confound on the inter-CPA proxy itself.
*Severity.* Low. §V-H item 2 implicitly covers it; the question is whether to spell it out as a separate "interpretive caveat" item.
*Fix.* Optional. Add to limitation 2 a sentence: "The within-firm violation is firm-dependent (Firm A 98.8%, Firms B/C/D 76.7-83.7% any-pair), so per-firm ICCRs at Firm A are more contaminated by within-firm sharing than at Firms B/C/D."
*Tag.* Net-new (low priority).
### N6. §III-K item 4 line 149 cross-references "§III-L.1 (Big-4 sample) and the v3.x §IV-I corpus-wide version" but §IV-I has been substantially shrunk in v4.
*Issue.* §III-K.4 line 149 says "The corresponding signature-level inter-CPA negative-anchor ICCR evidence is developed in §III-L.1 (Big-4 sample) and the v3.x §IV-I corpus-wide version (reported under prior 'FAR' terminology)". §IV-I in v4 (lines 157-161) is a 3-paragraph stub that mostly redirects to §IV-M Tables XXI-XXVI. It is no longer a "corpus-wide v3.x version" but a v4 reframing pointer.
*Severity.* Cosmetic. The cross-reference still works for an informed reader.
*Fix.* Update §III-K.4 line 149 to "§III-L.1 (Big-4 v4 sample) and the inherited corpus-wide v3.x version cited at §IV-I (reported under prior 'FAR' terminology)".
## Provenance spot-checks (three fresh)
I selected three claims not previously verified by codex r7/8 or my round-1.
### S3. §IV-M.4 Table XXIII D1 rate 0.1797, Wilson 95% CI [0.1770, 0.1825]. — **VERIFIED, with N1 caveat**
Script 45 report at `/.../doc_level_far_full/doc_far_full_report.md`: "D1 | any sig HC | 0.1797 | 13,519 / 75,233". 13,519/75,233 = 0.17968 → rounds to 0.1797 ✓.
Wilson 95% CI on $\\hat{p} = 0.1797$ at $n = 75{,}233$:
**N1 caveat:** the Firm C denominator 19,501 differs from §IV-J Table XIX's 19,122 by exactly 379 mixed-firm PDFs that Script 45 mode-of-firms assigns to Firm C (verified against Script 45 line 256). Not a bug; not disclosed in §IV-M.4.
## Phase 5 splice readiness
**Partial.** Empirical core is splice-ready: no script reruns required; M1–M4 closed; codex r8 splice blockers fixed in round-3; all spot-checked numbers reconcile against upstream report files.
Outstanding for round-4 (the merge-to-master copy-edit pass):
1.**[Substantive — recommended before splice]** Patch N1: add inline footnote to §IV-M.4 Table XXIII reconciling the 19,122 vs 19,501 Firm C denominator with the §IV-J Table XIX 379-mixed-PDF exclusion.
2.**[Substantive — recommended before splice]** Patch N2: add the composition-decomposition row to the §III-M validation table and update "nine-tool" → "ten-tool" in §I item 8, §VI item 8, and §III-M framing. **OR** weaken §III-M to "primary-tool collection (the composition decomposition that anchors the framework is treated as foundational rather than as a validation tool)" — but this re-introduces the framing problem the round-3 reframe was supposed to solve.
3.**[Structural — splice-time]** Patch N3: assign Table XXVII to the §III-M validation table.
4.**[Editorial — splice-time]** Patch N4: rewrite the §III-M cross-firm hit matrix row's "None" assumption to disclose any-pair-vs-same-pair semantics + mode-of-firms tie-breaking.
5.**[Editorial — optional]** Patch N5: add the firm-dependent within-firm violation nuance to §V-H limitation 2.
6.**[Splice-strip — required]** Remove all internal draft notes + close-out checklists + §III cross-reference index + §III open-questions block (already on codex r8 + Gemini m1 list).
7.**[Splice-time]** Verify v3.x §IV-F.1 letter resolves correctly in master manuscript.
## Recommended next-step actions
Numbered, prioritised, distinguishing empirical from copy-edit.
**Empirical / substantive:**
1.**N2 (§III-M omits composition decomposition).** Add the composition-decomposition row to the validation table or restate the framing. This affects the §I / §VI claims of "nine-tool" / "multi-tool unsupervised validation framework" — if the v4 pivot's foundational diagnostic isn't in the table, the framework label reads as incomplete. **Highest priority.**
2.**N1 (denominator inconsistency).** Add the Firm C 19,122 vs 19,501 reconciliation footnote to §IV-M.4 Table XXIII. Half a sentence; high payoff for reviewer trust.
3.**N4 (cross-firm hit matrix "None" assumption).** Replace with the actual mode-of-firms + any-pair-vs-same-pair assumption disclosure.
**Copy-edit / structural:**
4.**N3 (unnumbered Table).** Assign Table XXVII to §III-M validation table.
5.**N5 (within-firm violation firm-dependence).** Add half-sentence to §V-H limitation 2.
6.**N6 (§IV-I reduced to a stub).** Update §III-K.4 line 149 cross-reference wording.
7.**Splice-strip pass.** Remove all internal draft notes + checklists per the pre-existing list (codex r8 + Gemini m1 + Opus r1 minor 2).
8.**Spearman precision (Opus M7 from r1; codex r8 OPEN COPY-EDIT).** Standardise 4-dp across §III-K Table / §IV-F Table IX / §III provenance.
9.**Decimal vs percentage notation.** Standardise the 0.34 / 33.75% / 0.3375 mix across Abstract / §I / §III-L / §IV-M.
**Splice-time checks:**
10. v3.x §IV-F.1 cross-reference letter resolution in master manuscript.
11. v3.x Table XVIII (backbone ablation) vs v4 Table XVIII (Spearman drift) collision avoidance in the final manuscript table sequence.
12. Confirm the upstream Script 37 LOOO report file's legacy "C1 hand-leaning / C2 mixed / C3 replicated" labels do not propagate to any supplementary material exported with the manuscript.
@@ -313,15 +313,18 @@ The K=3 mixture of §III-J is reported in §IV as an accountant-level descriptiv
The v4.0 corpus lacks signature-level ground-truth replication labels: no signature is annotated as definitively hand-signed or definitively templated. The conservative positive anchor (pixel-identical same-CPA signatures; §III-K.4 and v3.x §IV-F.1) is by construction near $\text{cos} = 1$ and $\text{dHash} = 0$, providing a tautological capture-check rather than a sensitivity estimate for the non-byte-identical replicated class. The corpus therefore does not admit standard supervised classifier validation: we cannot report False Rejection Rate, sensitivity, recall, Equal Error Rate, ROC-AUC, or precision against ground truth.
In place of supervised validation, v4.0 adopts a **multi-tool collection of partial-evidence diagnostics**, each with an explicitly disclosed assumption:
In place of supervised validation, v4.0 adopts a **multi-tool collection of partial-evidence diagnostics** (Table XXVII), each with an explicitly disclosed assumption:
**Table XXVII.** Ten-tool unsupervised-validation collection with disclosed untested assumptions.
| Tool | What it measures | Untested assumption |
|---|---|---|
| Composition decomposition (§III-I.4; Scripts 39b–39e) | Whether descriptor multimodality is within-population (mechanism) or between-group (composition + integer artefact); $p_{\text{median}} = 0.35$ under joint firm-mean centring + integer-tie jitter | Integer-tie jitter is unbiased over the descriptor support; within-firm dip tests on every firm with $n \geq 500$ (Script 39c) corroborate the absence of within-population bimodality |
| Per-comparison inter-CPA coincidence rate (§III-L.1; Script 40b) | Pair-level specificity proxy under a random-pair negative anchor | Inter-CPA pairs are negative (i.e., not template-related); partially violated by within-firm sharing (§III-L.4) |
| Pool-normalised per-signature ICCR (§III-L.2; Script 43) | Deployed-rule specificity proxy at per-signature unit, accounting for pool size | Same as above + that pool replacement preserves the negative-anchor property |
| Document-level ICCR (§III-L.3; Script 45) | Operational alarm rate proxy at per-document unit under three alarm definitions | Same as above |
| Firm-heterogeneity logistic regression (§III-L.4; Script 44) | Multiplicative effect of firm membership on per-signature rate, controlling for pool size | Per-signature observations are clustered by CPA/firm; naïve standard errors inflated; cluster-robust analysis is a future check |
| Cross-firm hit matrix (§III-L.4; Script 44) | Concentration of inter-CPA collisions within source firm | None — direct descriptive observation |
| Cross-firm hit matrix (§III-L.4; Script 44) | Concentration of inter-CPA collisions within source firm | Concentration depends on deployed-rule semantics (the stricter same-pair joint event yields $97.0$–$99.96\%$ within-firm at all four firms versus $76.7$–$98.8\%$ under any-pair; §III-L.4); per-document per-firm assignment uses Script 45's mode-of-firms tie-break (§IV-M.4 footnote) |
| Alert-rate sensitivity sweep (§III-L.5; Script 46) | Local sensitivity of deployed rule to threshold perturbation | Gradient comparison is descriptive, not a formal plateau test |
| Convergent score Spearman ranking (§III-K.1; Script 38) | Internal-consistency of three feature-derived per-CPA scores | Scores share underlying inputs and are not statistically independent |
| Pixel-identical conservative positive capture (§III-K.4; v3.x; Script 40) | Trivial sanity check on the conservative positive anchor | Anchor is tautologically captured by any reasonable threshold |
@@ -54,7 +54,7 @@ The contributions of this paper are:
7. **K=3 as descriptive firm-compositional partition; three-score convergent internal consistency.** We fit a K=3 Gaussian mixture as a descriptive partition of the Big-4 accountant-level distribution (no longer interpreted as three mechanism clusters). Three feature-derived scores agree on the per-CPA descriptor-position ranking at Spearman $\rho \geq 0.879$; we report this as internal consistency rather than external validation, given that the scores share the underlying descriptor pair.
8. **Annotation-free positive-anchor validation and unsupervised validation ceiling.** We achieve $0\%$ positive-anchor miss rate (Wilson 95% upper bound $1.45\%$) on 262 byte-identical Big-4 signatures, with the conservative-subset caveat that byte-identical pairs are by construction near cos$=1$ and dHash$=0$. We frame the overall validation strategy as a multi-tool collection of nine partial-evidence diagnostics, each with an explicitly disclosed untested assumption; their conjunction constitutes the unsupervised validation ceiling achievable on this corpus. We do not claim a validated forensic detector; we position the system as a specificity-proxy-anchored screening framework with human-in-the-loop review.
8. **Annotation-free positive-anchor validation and unsupervised validation ceiling.** We achieve $0\%$ positive-anchor miss rate (Wilson 95% upper bound $1.45\%$) on 262 byte-identical Big-4 signatures, with the conservative-subset caveat that byte-identical pairs are by construction near cos$=1$ and dHash$=0$. We frame the overall validation strategy as a multi-tool collection of ten partial-evidence diagnostics (§III-M Table XXVII), each with an explicitly disclosed untested assumption; their conjunction constitutes the unsupervised validation ceiling achievable on this corpus. We do not claim a validated forensic detector; we position the system as a specificity-proxy-anchored screening framework with human-in-the-loop review.
The remainder of the paper is organized as follows. Section II reviews related work on signature verification, document forensics, perceptual hashing, and the statistical methods used. Section III describes the proposed methodology. Section IV presents the experimental results — distributional characterisation, mixture fits, convergent internal-consistency checks, leave-one-firm-out reproducibility, pixel-identity validation, and full-dataset robustness. Section V discusses the implications and limitations. Section VI concludes with directions for future work.
@@ -144,7 +144,7 @@ Several limitations should be transparent. The first nine are v4.0-specific; the
We present a fully automated pipeline for detecting non-hand-signed CPA signatures in Taiwan-listed financial audit reports and a multi-tool framework for characterising and disclosing its operational behaviour at the Big-4 sub-corpus scope. The pipeline processes raw PDFs through VLM-based page identification, YOLO-based signature detection, ResNet-50 feature extraction, and dual-descriptor (cosine + independent-minimum dHash) similarity computation. The operational output is an inherited Paper A five-way per-signature classifier with worst-case document-level aggregation (§III-L). Applied to 90,282 audit reports filed between 2013 and 2023, the pipeline extracts 182,328 signatures from 758 CPAs, with the Big-4 sub-corpus (437 CPAs at accountant level; 150,442–150,453 signatures at signature level) as the primary analytical population.
Our central methodological contributions are: (1) a composition decomposition (Scripts 39b–39e) that establishes the absence of a within-population bimodal antimode in the Big-4 descriptor distribution: the apparent multimodality dissolves under joint firm-mean centring and integer-tie jitter ($p_{\text{median}} = 0.35$), so distributional "natural-threshold" framings of the inherited operating points are not empirically supported; (2) an anchor-based inter-CPA coincidence-rate (ICCR) calibration at three units of analysis — per-comparison ($0.0006$ at cos$>0.95$; $0.0013$ at dHash$\leq 5$; $0.00014$ jointly), pool-normalised per-signature ($0.11$ for the deployed any-pair HC rule), and per-document ($0.34$ for the operational HC$+$MC alarm) — with explicit terminological replacement of "FAR" by "ICCR" given the unsupervised setting; (3) firm heterogeneity quantification: logistic regression with pool-size adjustment gives odds ratios $0.053$, $0.010$, $0.027$ for Firms B/C/D relative to Firm A reference, indicating a large multiplicative effect that pool-size differences do not explain; (4) cross-firm hit matrix evidence that under the deployed any-pair rule, within-firm collision concentration is $98.8\%$ at Firm A and $76.7$–$83.7\%$ at Firms B/C/D (the stricter same-pair joint event saturates at $97.0$–$99.96\%$ within-firm across all four firms), consistent with firm-specific template, stamp, or document-production reuse mechanisms; (5) K=3 mixture demoted from "three mechanism clusters" to a descriptive firm-compositional partition; (6) three feature-derived scores converging on the per-CPA descriptor-position ranking at Spearman $\rho \geq 0.879$, reported as internal consistency rather than external validation; (7) $0\%$ positive-anchor miss rate on 262 byte-identical Big-4 signatures with the conservative-subset caveat; and (8) a nine-tool unsupervised-validation collection (§III-M) that explicitly discloses each tool's untested assumption and positions the system as an anchor-calibrated screening framework with human-in-the-loop review, not as a validated forensic detector.
Our central methodological contributions are: (1) a composition decomposition (Scripts 39b–39e) that establishes the absence of a within-population bimodal antimode in the Big-4 descriptor distribution: the apparent multimodality dissolves under joint firm-mean centring and integer-tie jitter ($p_{\text{median}} = 0.35$), so distributional "natural-threshold" framings of the inherited operating points are not empirically supported; (2) an anchor-based inter-CPA coincidence-rate (ICCR) calibration at three units of analysis — per-comparison ($0.0006$ at cos$>0.95$; $0.0013$ at dHash$\leq 5$; $0.00014$ jointly), pool-normalised per-signature ($0.11$ for the deployed any-pair HC rule), and per-document ($0.34$ for the operational HC$+$MC alarm) — with explicit terminological replacement of "FAR" by "ICCR" given the unsupervised setting; (3) firm heterogeneity quantification: logistic regression with pool-size adjustment gives odds ratios $0.053$, $0.010$, $0.027$ for Firms B/C/D relative to Firm A reference, indicating a large multiplicative effect that pool-size differences do not explain; (4) cross-firm hit matrix evidence that under the deployed any-pair rule, within-firm collision concentration is $98.8\%$ at Firm A and $76.7$–$83.7\%$ at Firms B/C/D (the stricter same-pair joint event saturates at $97.0$–$99.96\%$ within-firm across all four firms), consistent with firm-specific template, stamp, or document-production reuse mechanisms; (5) K=3 mixture demoted from "three mechanism clusters" to a descriptive firm-compositional partition; (6) three feature-derived scores converging on the per-CPA descriptor-position ranking at Spearman $\rho \geq 0.879$, reported as internal consistency rather than external validation; (7) $0\%$ positive-anchor miss rate on 262 byte-identical Big-4 signatures with the conservative-subset caveat; and (8) a ten-tool unsupervised-validation collection (§III-M Table XXVII) that explicitly discloses each tool's untested assumption and positions the system as an anchor-calibrated screening framework with human-in-the-loop review, not as a validated forensic detector.
Future work falls in four directions. *First*, a small-scale human-rated validation set would enable direct ROC optimisation and provide signature-level ground truth that v4.0 fundamentally lacks; without such ground truth, no true error rates can be reported. *Second*, the within-firm collision concentration documented in §III-L.4 (any-pair $76.7$–$98.8\%$ across Big-4; same-pair joint $97.0$–$99.96\%$) invites a separate study to distinguish deliberate template sharing from passive firm-level production artefacts (shared scanners, common form templates, identical report-generation infrastructure) — a question the inter-CPA-anchor analysis alone cannot resolve. *Third*, the descriptive Firm A versus Firms B/C/D contrast (per-document HC$+$MC alarm $0.62$ vs $0.09$–$0.16$) — together with v3.x's byte-level evidence of 145 pixel-identical signatures across $\sim 50$ distinct Firm A partners — invites a companion analysis examining whether such firm-level signing patterns correlate with established audit-quality measures. *Fourth*, generalisation to mid- and small-firm contexts requires extending the anchor-based ICCR framework to scopes where firm-level LOOO folds are not available; the §III-I.4 composition diagnostics already document that the absence of within-population bimodality is corpus-universal, so the v4.0 calibration approach in principle generalises, but a full extension with cluster-robust uncertainty quantification is left as future work.
@@ -322,7 +322,7 @@ Decile trend is broadly monotone in pool size with two minor reversals (decile 5
| D2 (operational) | HC + MC | $0.3375$ | $[0.3342, 0.3409]$ |
| D3 | HC + MC + HSC | $0.3384$ | $[0.3351, 0.3418]$ |
Per-firm D2 document-level ICCR: Firm A $0.6201$ ($n = 30{,}226$); Firm B $0.1600$ ($n = 17{,}127$); Firm C $0.1635$ ($n = 19{,}501$); Firm D $0.0863$ ($n = 8{,}379$).
Per-firm D2 document-level ICCR: Firm A $0.6201$ ($n = 30{,}226$); Firm B $0.1600$ ($n = 17{,}127$); Firm C $0.1635$ ($n = 19{,}501$); Firm D $0.0863$ ($n = 8{,}379$). The Firm C denominator $n = 19{,}501$ exceeds Table XIX's single-firm Firm C count of $19{,}122$ by exactly the $379$ mixed-firm PDFs: Script 45 assigns each multi-firm PDF to its mode-of-firms (majority firm), and all $379$ mixed-firm PDFs in the Big-4 sub-corpus resolve to Firm C as the majority firm. The four per-firm denominators here therefore sum to the full $75{,}233$, whereas Table XIX's per-firm rows sum to $74{,}854 = 75{,}233 - 379$.
### M.5 Firm heterogeneity logistic regression and cross-firm hit matrix (Script 44)
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
gbanyanandClaude Opus 4.7