cs.AIApr 7, 2026

Epistemic Blinding: An Inference-Time Protocol for Auditing Prior Contamination in LLM-Assisted Analysis

Authors: Michael Cuccarese

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

This paper presents epistemic blinding in the context of an agentic system that uses large language models to reason across multiple biological datasets for drug target prioritization. During development, it became apparent that LLM outputs silently blend data-driven inference with memorized priors about named entities - and the blend is invisible: there is no way to determine, from a single output, how much came from the data on the page and how much came from the model's training memory. Epistemic blinding is a simple inference-time protocol that replaces entity identifiers with anonymous codes before prompting, then compares outputs against an unblinded control. The protocol does not make LLM reasoning deterministic, but it restores one critical axis of auditability: measuring how much of an output came from the supplied data versus the model's parametric knowledge. The complete target identification system is described - including LLM-guided evolutionary optimization of scoring functions and blinded agentic reasoning for target rationalization - with demonstration that both stages operate without access to entity identity. In oncology drug target prioritization across four cancer types, blinding changes 16% of top-20 predictions while preserving identical recovery of validated targets. The contamination problem is shown to generalize beyond biology: in S&P 500 equity screening, brand-recognition bias reshapes 30-40% of top-20 rankings across five random seeds. To lower the barrier to adoption, the protocol is released as an open-source tool and as a Claude Code skill that enables one-command epistemic blinding within agentic workflows. The claim is not that blinded analysis produces better results, but that without blinding, there is no way to know to what degree the agent is adhering to the analytical process the researcher designed.

Figures & tables

Figure 1. Traditional vs. epistemic blinding workflow. Both approaches receive identical quantitative features and recover identical numbers of validated drug targets. The critical difference is in which novel candidates are surfaced: the unblinded workflow promotes literature-familiar genes while the blinded workflow ranks purely on feature strength.
IndicationSig. genesTargetsSignal
Acute myeloid leukemia306Strong
Pancreatic adenocarcinoma321Concentrated
Chromosomally unstable CRC3001Moderate
IDH-wildtype glioblastoma1103Weak
Table 1. Indications tested, spanning a range of feature signal strength.
 OverlapOnly BlindOnly UnblindTargets
AML90%226/6
Pancreatic80%441/1
CRC90%221/1
GBM75%553/3
Average84%3.253.252.75
Table 2. Set overlap between blinded and unblinded top-20 lists. Target recovery is identical in both conditions.
GeneIndicationBlindedUnblindedShiftWhat the model cited
PTENGBM#15#3−- 12“the defining PI3K/AKT pathway tumor suppressor”
RNF43Pancreatic#20#6−- 14“Wnt-pathway convergence”
KRASCRC#5#1−- 4“proven therapeutic tractability via covalent RAS inhibitors”
DPP8GBM#3#9++ 6Highest triple enrichment in dataset (ESM2=60.9, GF=30.5, PT=16.6)
SCN1ACRC#2#11++ 9Best triple-modality convergence
KCNH7CRC#6#17++ 11Triple convergence, pLI=0.91, 1252 neighbors
Table 3. Fame bias: rank shifts between blinded and unblinded conditions. Negative shift means the gene was promoted when named.
 Blinded (#5)Unblinded (#1)
SharedBoth: 38% mut. freq., codon-12 hotspot, strong enrichment
Extra“GTPase domain mutations suggest gain-of-function”“Proven tractability via covalent RAS inhibitors (sotorasib, adagrasib)”
Verdict“Recurrent hotspot with functional convergence”“Defining driver with validated druggability”
Table 4. LLM justifications for KRAS / Gene_088 in CRC. Highlighted text is parametric knowledge not present in any supplied feature.
Figure 2. Rank-shift slope chart for IDH-wildtype glioblastoma. Lines connect the same gene’s rank in the blinded (left) and unblinded (right) conditions. Orange: famous genes promoted when named. Blue: obscure genes demoted when named.
MetricMean ±\pm SDRange
Top-20 overlap13.0 ±\pm 1.012–14
Jaccard index0.48 ±\pm 0.060.43–0.54
Mean rank delta3.1 ±\pm 1.11.9–4.4
Table 5. S&P 500 blinded vs. unblinded comparison across five seeds.
Figure 3. S&P 500 consistency across five random seeds. Consistent arrows indicate systematic bias, not stochastic noise.
More in this topic

LLM Auditing

Large language model auditing tests models and deployed systems for bias, safety, privacy, reliability, and provenance using behavioral and internal evidence.

See all 639 papers

Explore similar work

CardsList
Oct 18, 2026

Auditing Tool Traces in Agentic LLMs: Source Localization and Counterfactual Dependence Testing

Agentic LLMs increasingly support scientific prediction by grounding decisions in external evidence. In biology, they promise accurate, interpretable predictions for important problems by integrating complex experimental and computational evidence. However, serialized tool results can contain hidden label shortcuts, such as dataset identifiers or template artifacts, that create apparent success without biological reasoning. To address this risk, we introduce a two-stage audit. Stage 1, Per-Tool TF-IDF Decomposition (PT2D), localizes label-predictive patterns to individual tool results while avoiding signal dilution in the concatenated tool trace. Stage 2, Token-Class Redaction, counterfactually tests whether the frozen LLM depends on the localized shortcut. We apply this audit to TCR-pMHC binding, where tool augmentation substantially outperforms a no-evidence baseline. At face value, this suggests that the LLM has learned to use scientific evidence. The audit overturns this interpretation: PT2D localizes the strongest signal to identifiers in one tool result, and redacting them reduces performance to chance. These findings show how hidden label shortcuts can masquerade as scientific reasoning or discovery, motivating source-level audits before benchmark gains are trusted.

Junhao Liu, Tianxiao Li, Yongxian Wu +4

University of California, Irvine · NEC Labs America

LLM AuditingAI Agent AuditingShortcut Learning in Language ModelsScientific Reasoning in Language ModelsFailure Attribution for LLM Agents
AskPDF
Feb 25, 2026

Algorithmic Blindness in Large Language Models: A Calibration Study of Performance Prediction

Large language models (LLMs) demonstrate remarkable breadth of knowledge, yet their ability to reason about computational processes remains poorly understood. Closing this gap matters for practitioners who rely on LLMs to guide algorithm selection and deployment. We address this limitation using causal discovery as a testbed and evaluate eight frontier LLMs against ground truth derived from algorithm executions. We find systematic, near-total failure across models. The predicted ranges are far wider than true confidence intervals yet still fail to contain the true algorithmic mean in most cases. Most models perform worse than random guessing. The best model's marginal improvement points to benchmark memorization rather than principled reasoning. We term this failure algorithmic blindness and argue it reflects a fundamental gap between declarative knowledge about algorithms and calibrated procedural prediction.

Sohan Venkatesh, Ashish Mahendran Kurapath, Tejas Melkote

Manipal Institute of Technology Bengaluru

Algorithmic ReasoningLLM EvaluationLanguage Model CalibrationConfidence Estimation in Language Models
AskPDF
Jun 3, 2026

Trust, but Don't Verify: Epistemic Blind Spots in LLM Source Evaluation

Language models increasingly act as epistemic proxies, synthesizing evidence from multiple sources to inform decisions. Whether they evaluate the quality of that evidence, or merely aggregate it based on surface presentation, remains poorly understood. We show that models possess the capability to detect fabricated statistics in isolation but do not recruit this capability during multi-source synthesis, producing similar numeric estimates whether the statistics are fabricated or valid. Specifically, source influence is governed by a methodology-register gate that responds to the distributional register of analytical text but not to numeric validity: for example, statistically impossible confidence intervals receive the same weight as valid ones. The behavioral dissociation replicates across six models from four families (Anthropic Claude, Qwen, OLMo, and OpenAI GPT-5.4) and three professional domains. Mechanistic analyses, including causal tracing, linear probes, and component-level attribution, converge on the same account: the model encodes and causally uses a methodology-register representation that transfers across domains, while numeric-validity signals, decodable in isolation, are suppressed to chance during multi-source synthesis. Prompting-based mitigations, even an oracle checklist naming the exact statistical checks, produce blanket skepticism rather than selective discernment, and the post-training pipelines we examine reinforce the shortcut without building numeric verification. Unlike sycophancy, which tracks user preference, this failure tracks whether a source presents as analytically credible, not whether its claims are consistent. We term this epistemic alignment: like preference and safety alignment, the question is not capability but deployment.

Rohan N. Pradhan, Steve Goley

Amazon

LLM InterpretabilityLLM Reliability
AskPDF