AIRA: AI-Induced Risk Audit: A Structured Inspection Framework for AI-Generated Code

TL;DR

This paper introduces AIRA, a structured framework for auditing AI-generated code to detect failure patterns that may conceal true system failures, with empirical validation across multiple datasets.

Contribution

The paper proposes the AIRA inspection framework and demonstrates its effectiveness in identifying failure-untruthful patterns in AI-generated code.

Findings

AI-generated code shows more high-severity failures than human code.

AIRA detects failure patterns across multiple programming languages.

AI-assisted code exhibits a skew toward fail-soft behavior.

Abstract

Practitioners have reported a directional pattern in AI-assisted code generation: AI-generated code tends to fail quietly, preserving the appearance of functionality while degrading or concealing guarantees. This paper introduces the Reward-Shaped Failure Hypothesis - the proposal that this pattern may reflect an artifact of optimization through human feedback rather than a random distribution of bugs. We define failure truthfulness as the property that a system's observable outputs accurately represent its internal success or failure state. We then present AIRA (AI-Induced Risk Audit), a deterministic 15-check inspection framework designed to detect failure-untruthful patterns in code. We report results from three studies: (1) an anonymized enterprise environment audit, (2) a balanced 600-file public corpus pilot, and (3) a strict matched-control replication comparing 955 AI-attributed files against 955 human-control files. In the final replication, AI-attributed files show 0.435 high-severity findings per file versus 0.242 in human controls (1.80x). The effect is consistent across JavaScript, Python, and TypeScript, with strongest concentration in exception-handling-related patterns. These findings are consistent with a directional skew toward fail-soft behavior in AI-assisted code. AIRA is designed for governance, compliance, and safety-critical systems where fail-closed behavior is required.