Promoting an updated model is still, for many teams, an act of blind trust. You retrain, you fine-tune, you change quantization, or worse, a vendor swaps the model in production without warning. Every update can be worse than what it replaces. The work introducing DISCERN starts from this problem and inverts it: instead of labeling an entire validation set to compare two models, it exploits the fact that the risk difference lives on the inputs where the two models disagree. Those inputs are observable without labels.

DISCERN is a sequential two-tier protocol. The first tier, with zero labels, certifies benign updates when the disagreement rate remains below a tolerance threshold, using only unlabeled traffic. The second tier kicks in when disagreement is high enough: it labels only the sampled disagreements through an anytime-valid confidence sequence, valid at every stopping time and under any label-routing rule, even with an adversarial judge. In practice, you pay only for disagreement.

The theoretical results show finite-sample validity and label-complexity bounds of order rho^2/eps^2. Since the disagreement rate rho is typically small, exploiting free disagreement saves a factor 1/rho over a pairing-blind auditor. The guarantee also composes across an unbounded sequence of promotions from a single error budget.

The structural consequence for production model managers is that no-regression certification stops being a cost proportional to dataset size and becomes proportional to the fraction of traffic where the new model disagrees. For on-premise and self-hosted deployments this shifts incentives: you do not need to accumulate expensive labels before promoting an update; real unlabeled traffic, already available locally, can feed the first tier. The bottleneck is no longer access to an external labeling service, but the ability to observe traffic and record diverging decisions between the two models.

In the reported tests, across more than 14,000 replayed audit streams and 785 update pairs, including LoRA versions of language models up to 1.4 billion parameters, the observed miscoverage is 0.0002 against a nominal 5%, power is 0.986 with zero false alarms, and 56% of benign updates certify without any labels. Each audit emits a machine-checkable evidence record for post-market monitoring.

The second, less visible effect is pressure on cloud providers that apply silent swaps. If a customer can verify without labels that the substituted model is not worse, the vendor swap is no longer invisible: it becomes a checkable and certifiable event. Power shifts from whoever owns the model to whoever owns the traffic. This does not eliminate regression risk on out-of-distribution data, but it makes continuous monitoring cheaper and compatible with unified risk budgets.

A further implication concerns update frequency. If promotion is cheap and certifiable, teams can afford shorter cycles of fine-tuning and quantization, adapting local models to specific domains without accumulating labeling debt. But there is a downside: certifying only on disagreement assumes that the observed traffic is representative. If the input distribution shifts silently, disagreement can remain low while absolute risk rises. The certification is robust to an adversarial judge, not necessarily to a non-stationary environment. For those evaluating on-premise deployments, there are trade-offs between traffic control and labeling costs; AI-RADAR dedicates analytical frameworks to these aspects in the /llm-onpremise section.