# AIRA: AI-Induced Risk Audit: A Structured Inspection Framework for AI-Generated Code

arXiv: https://arxiv.org/abs/2604.17587 · HTML: https://mlsanity.com/paper/2604.17587/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 4 of its 8 references that are in the map.
- First posted on arXiv 19 Apr 2026.

## Builds on (most cited first, 4 of 4)

- [Open Problems and Fundamental Limitations of Reinforcement Learning from Human Feedback](https://mlsanity.com/paper/2307.15217/) (2023)
- [How AI Coding Agents Modify Code: A Large-Scale Study of GitHub Pull Requests](https://mlsanity.com/paper/2601.17581/) (2026)
- [A Survey of Bugs in AI-Generated Code](https://mlsanity.com/paper/2512.05239/) (2025)
- [Do Autonomous Agents Contribute Test Code? A Study of Tests in Agentic Pull Requests](https://mlsanity.com/paper/2601.03556/) (2026)

## Abstract (arXiv)

Practitioners have reported a directional pattern in AI-assisted code generation: AI-generated code tends to fail quietly, preserving the appearance of functionality while degrading or concealing guarantees. This paper introduces the Reward-Shaped Failure Hypothesis - the proposal that this pattern may reflect an artifact of optimization through human feedback rather than a random distribution of bugs. We define failure truthfulness as the property that a system's observable outputs accurately represent its internal success or failure state. We then present AIRA (AI-Induced Risk Audit), a deterministic 15-check inspection framework designed to detect failure-untruthful patterns in code. We report results from three studies: (1) an anonymized enterprise environment audit, (2) a balanced 600-file public corpus pilot, and (3) a strict matched-control replication comparing 955 AI-attributed files against 955 human-control files. In the final replication, AI-attributed files show 0.435 high-severity findings per file versus 0.242 in human controls (1.80x). The effect is consistent across JavaScript, Python, and TypeScript, with strongest concentration in exception-handling-related patterns. These findings are consistent with a directional skew toward fail-soft behavior in AI-assisted code. AIRA is designed for governance, compliance, and safety-critical systems where fail-closed behavior is required.