Organizations: Florida International University, Miami, FL, USA · Boston University, Boston, MA, USA · Stevens Institute of Technology, Hoboken, NJ, USA
A clinical agent benchmark can report the same verdict on identical inputs while the agent files a materially different order on each run. Such agents order tests, request medications and place referrals, yet benchmarks typically score one run per task and rarely ask whether identical inputs produce identical actions; MedAgentBench, the benchmark we use, scores a single attempt and says so. To measure this gap we introduce "same-input rerun", which replays a task with every input held fixed and compares the orders rather than the score, with six reliability metrics, and apply it to 1000 MedAgentBench runs across 50 tasks from its five write-capable families, two open-weight models below ten billion parameters quantised to four bits, and two temperatures. The study establishes that action-level divergence exists and can pass unrecorded by the score, not that any rate generalises. Under the 8B model at temperature 0.7, all 43 ordering groups emit a different set of orders across five identical runs, 26 emit the order on some runs and not others, and 28 record a different coded value, dose or analyte. In 22 of those 43 the benchmark reports the same failing verdict for materially different behaviour, as it does for all 10 divergent groups of the 4B model at 0.7. Orders also reach different endpoints across runs, one of which the record server rejects while the agent is told it succeeded. These findings motivate repeated-run evaluation, action-level stability reporting and execution-faithful environment feedback in clinical-agent benchmarks.
Figures & tables
Figure 1: The rerun protocol, with an illustrative outcome. Inputs are held fixed, so any difference between runs belongs to the agent, and the three comparison layers come apart in practice.
Qwen 0.05
Qwen 0.7
Llama 0.05
Llama 0.7
Task groups
50
50
50
50
Groups emitting any order
20
20
21
43
Mean pass rate
0.31
0.30
0.22
0.18
Action level
Order-set divergence
3/20 [0.05, 0.36]
10/20 [0.30, 0.70]
11/21 [0.32, 0.72]
43/43 [0.92, 1.00]
as pairwise disagreement
0.08
0.29
0.33
0.78
Table 1: Divergence across five identical reruns of each task. Action quantities are computed over the task groups that emitted at least one order, since a task that never orders cannot diverge in its orders; trajectory and verdict quantities are over all groups, apart from the last row, which repeats verdict instability over the ordering groups; the mean pass rate is over the arm’s 250 runs. The columns are not a ranking. Each arm carries its own denominator, and we ran no cross-model test.
Figure 2: Three of the four action-level rows of Table 1 ; clinical-content divergence is zero in every arm but one. Drawn as the movement from T=0.05 (open mark) to T=0.7 (solid), with Wilson intervals. Each arm’s denominator is its own ordering groups: 20 and 20 for Qwen, 21 and 43 for Llama. Only Llama’s grows under sampling, which is why its endpoint arrow points left as the count rises from 8 to 12.
Appendix figures & tables2 assets
Supplementary material from the paper’s appendix.
Appendix
Model
Measure
n
b
c
disc.
p
Qwen3-4B
Trajectory divergence
50
21
0
21
< 0.0001
Qwen3-4B
Order-set divergence
50
7
0
7
0.0156
Qwen3-4B
Verdict instability
50
7
0
7
0.0156
Llama-3.1-8B
Trajectory divergence
50
15
0
15
< 0.0001
Llama-3.1-8B
Order-set divergence
50
33
1
34
< 0.0001
Llama-3.1-8B
Verdict instability
50
13
3
16
0.0213
Appendix
Table 2: The six paired tests, with the discordance behind each. b counts groups showing the measure only at T=0.7 and c only at T=0.05 ; the exact two-sided McNemar p uses b and c alone. All six run over the 50 task groups. A group that never orders in either arm is concordant by construction on order-set divergence, but not on the other two.
Family
Qwen .05
Qwen .7
Llama .05
Llama .7
F3
0/10 (1.00)
0/10 (1.00)
0/10 (0.00)
10/10 (0.28)
F5
– (0.08)
– (0.10)
1/1 (0.50)
8/8 (0.18)
F8
3/10 (0.00)
10/10 (0.00)
10/10 (0.58)
10/10 (0.44)
F9
– (0.46)
– (0.40)
– (0.00)
7/7 (0.00)
F10
– (0.00)
– (0.00)
– (0.00)
8/8 (0.00)
Appendix
Table 3: Divergent order sets out of ordering groups, with each family’s mean pass rate in parentheses. Ten task groups per family per arm; a dash marks a family that never ordered in that arm.
Running the same LLM agent on identical inputs yields 2.3-4.2 distinct action sequences per 10 runs; this behavioral variance constitutes a training-free, black-box uncertainty signal that instantiates selective classification and distribution-free calibration for agentic systems. Across 8,000 runs of four models on 200 HotpotQA questions, consistent tasks (at most 2 unique paths) achieve 82-87% accuracy while inconsistent tasks (4 or more paths) achieve 41-65%, a gap that survives controls for task difficulty. Divergence concentrates at step 2 (50.5% of Llama tasks), and consistency metrics detect failures with AUROC 0.62-0.78. Exploiting this signal, selective prediction (answering only when k=3 runs agree) achieves 87-88% accuracy at 54-62% coverage, a 6-14pp gain over single-run baselines, and matches a split-conformal baseline without a held-out calibration set. A cross-benchmark validation on SWE-bench (50 tasks, 1,000 runs) preserves the consistency hierarchy while revealing an ~8x spread in mean trajectory length across models, and bootstrap analysis shows single-run evaluations misrank models 29.3% of the time.
Evaluating how LLM agents recover from mid-task failures is central to deploying reliable agentic systems. Existing checkpoint-based benchmarks measure recovery by comparing which action is selected as best across independent runs, a quantity known as set agreement. However, set agreement is a purely ordinal measure that records which action wins without reflecting the absolute level of performance. When all actions fail, they tie at zero reward, and independent runs produce the same tied set with high probability, creating an illusion of stability that masks near-zero recovery success. We formalize this limitation through a set-path symmetry result, proving that for equal-cost Bernoulli actions the success probabilities (0.9, 0.8) and (0.2, 0.1) yield identical best-action-set distributions at every sample size. No procedure based solely on which action wins can distinguish these two regimes. We further prove that certifying exact population ties is impossible in finite time, and that the assignment of outcomes to checkpoints carries information beyond marginal outcome distributions. The pooled success probability is the missing scalar that resolves the ordinal ambiguity. Experiments on 864 frozen RecoveryBench episodes and two planning cohorts totaling 3,456 responses confirm the theoretical predictions. Agreement and held-out quality can move in opposite directions, and permuting checkpoint-to-action bindings changes 8 to 13 percent of cell-level conclusions. Based on these findings, we propose reporting four diagnostic quantities (agreement, all-zero fraction, held-out success, and pooled success) that expose this failure mode with no additional data collection.
Dong Xu, Zhangfan Yang, Jiantao Wu +5
School of Artificial Intelligence, Shenzhen University · EasternDawn · School of Computer Science, University of Nottingham Ningbo
Large language model (LLM) agents with tool-calling capabilities are increasingly deployed in production systems, yet a fundamental reliability question remains under-explored: does the same agent behave the same way twice? We present a systematic empirical study of behavioral consistency in multi-step tool-calling agents, measuring whether agents select the same tools, in the same order, with the same arguments, across repeated identical invocations. Unlike prior work on consistency in ReAct-style agents(search-only, free-text actions), we study the richer setting of structured tool-calling interfaces with typed parameters and consequential side effects.