cs.AINov 1, 2026

From Tool State to Scientific Action: Auditing Decision Provenance in Biomedical Research Agents

Authors: Xingyu Yi, Xinya Zhang, Yunshen Zhou, Haoyu Bao

Organizations: INTOSYN AI Labs · Columbia University · Microsoft

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

A scientific agent can give the same verdict while reading and citing different evidence. BioAgent-DF tests this separation using paired reference and candidate values saved at the same scientific computation site. It restores or transplants those values at their original coordinates, then runs the agent on healthy hardware. Across eight SciFact batches, Qwen3.5-4B shows repeatable citation changes in three capture-claim combinations, and Gemma 3 4B IT shows repeatable read and citation changes in four. These seven combinations cover two claims. Full restoration recovers the reference evidence sets while verdicts remain unchanged. Verdict changes observed under the baseline prompt did not recur under the explicit-example prompt. Complementary tool and optimizer experiments distinguish recovery of numerical state, recovery of ranked lists, and restoration of an agent's visible history. These results show that an audit should track both the evidence an agent uses and its final answer. In hERG cardiac-safety assay allocation, silent numerical faults changed testing decisions while the fixed-budget shortlist kept the same number of compounds labeled as blockers. After the agent had used faulty values, restoring its earlier execution state and supplying certified scores recovered all 39 changed decisions, whereas replacing the prediction file recovered none; no incorrect action was committed. A streaming implementation of the arithmetic checks reduced the total time for forward execution and verification by 42.4% relative to the original FP64 implementation, with identical flags and recovery outputs.

Figures & tables

Figure 1: The same verdict from different cited evidence. (a) Reference and candidate tool states are supplied to the same agent model on healthy hardware. Claim 431 concerns ROS-mediated FoxO3a activation in neuronal death. Gemma’s reference branch cites a sentence about ROS and autophagy (19922508/3), and its candidate branch cites ROS sensing microbe size (22696649/1). Neither sentence supports the stated FoxO3a mechanism, yet both branches return the benchmark-correct SUPPORT label. Neither citation matches the annotated evidence, 28937856/5. Sentence indices are zero-based and document identifiers are SciFact IDs. (b) Restoration and transplantation select values at their original coordinates. (c) Tool execution completion, evidence-path fidelity, and verdict correctness are evaluated. H1 and H2 repeat the same reference state.
Prompt / model / query batchJoint groups / scheduledReadCiteVerdict
Baseline / Qwen / 830/300 / 00 / 01 / 0
Baseline / Qwen / 30051/5112 / 02 / 02 / 0
Baseline / Gemma / 83/300 / 00 / 00 / 0
Baseline / Gemma / 30033/512 / 08 / 06 / 0
Explicit examples / Qwen / 830/300 / 00 / 00 / 0
Explicit examples / Qwen / 30048/510 / 09 / 00 / 0
Table 1: Endpoints by prompt. Each endpoint cell reports candidate–H1 / H2–H1 discordance among jointly completed, exposed groups. A group is one repeat of a capture–claim combination.
Figure 2: Read and citation selections across repeated batches. (a) Actual document and sentence selections. Qwen reads the same document without citing under C; both NEI verdicts are wrong. Gemma gives correct verdicts while selecting different evidence, neither branch matching the annotated evidence. (b) Each marked combination has stable within-state endpoints, different H/C endpoints, and full restoration in all eight batches. Figure 3 reports all attempts and incomplete groups.
Figure 3: All attempts and within-state variability. (a) Each model schedules 27 combinations ×\times eight batches ×\times seven conditions, or 1,512 episodes. (b) Qwen has 208 jointly completed groups and Gemma 152. Between candidate and H1, read, citation, and verdict discordances are 1, 25, and 0 for Qwen and 32, 35, and 0 for Gemma; H2 and full restoration never differ from H1. (c) Claim 507 differs only in the seventh batch; its adjusted read difference is zero. (d) Summaries weight each of 26 Qwen and 20 Gemma combinations equally. CH, HH, and CC are between-state and within-state discordance fractions; δ=CH−(HH+CC)/2\delta=\mathrm{CH}-(\mathrm{HH}+\mathrm{CC})/2 , in percentage points (Appendix H.12 ).
EndpointCandidate versus H1H2 versus H1
Read membership3/3824/382
Cited sentences5/3828/382
Verdict2/3822/382
Table 2: Candidate and healthy-repeat discordance in the sustained-batching cohort. The remaining 39 groups are incomplete or unexposed. Full restoration also has two verdict discordances.
Figure 4: Recovery under score and prefix interventions. (a) Recovery for the compound-activity model across nine tested budgets and two changed captures. Random priority averages 128 fixed orders. Horizontal spacing uses log 2 (b + 1), but the AUC in Table C1 is computed over b/127. Percentages of remaining differences refer to the two-block budget. (b) Two baseline Qwen repeats for claim 431: one score is restored and 95 differences remain. Citations and verdict recover, reads do not, and transplantation does not reproduce the candidate verdict. (c) Citation discordances after prefix interventions in 24 groups. Healthy repeat has 2/24 discordances.
Tool and endpointAfter roundingHealthy repeats / controls
PBMC: actions or marker selection9/30Repeat and zero: 0/30 each
NCI: final molecule membership11/61; 13/62Repeats: 0/61; 1/62
ESOL: sampled membership12/24 eachRepeat and zero: no change
Table 3: Subsequent choices under ordinary precision. Counts use jointly completed groups.
Figure 5: Changed hERG assay allocations and recovery. (a) BF16 predictions feed native Biomni selection and triage; R1 recomputes predictions flagged by arithmetic checks, and R1+M adds a margin rule that also recomputes 68 compounds near decision boundaries. (b) Changed decisions across 16 sources; the ring marks the discrepancy left by R1 and recovered by R1+M. Healthy margin is distance to the affected decision’s boundary; lower rows show recovery and the decisions of native Biomni runs on R1+M inputs. (c) Prediction displacement versus healthy distance to the nearer boundary; highlights mark changed decisions, and the lower strip shows entry with unchanged predictions. (d) R1 residual versus the minimum decision margin computed from R1 scores; shading marks R1+M selection. Dashed lines in (c,d) mark equality.
Appendix figures & tables34 assets

Supplementary material from the paper’s appendix.

Appendix

Figure A1: Arithmetic execution-path controls. The panels show exact-input, paired-instruction, matrix-shape, training, diagnostic, and precision-path comparisons. Case 1 and Case 2 label the two classes of faulty GPUs. Matrix-call fractions count failures among eight calls; training cells count completions among three seeds.
Task and dataSize / splitComputation and measured scope
RDKit FreeWilson CHEMBL2321810 activity example1,017; 719/140/1582,048-bit Morgan fingerprints; 2048 →\rightarrow 512 →\rightarrow 256 →\rightarrow 1 MLP; full-candidate Top-10. Top-20 protocols: Appendices C–D.
Continuation of the compound checkpoint1,017; 719/140/15864 AdamW updates; parameters, moments, predictions, and ranking.
RDKit NCI molecular neighbors4,999 raw; 4,991 valid; 1,536 queriesTanimoto similarity, self-match exclusion, fixed Top-10.
WDBC morphology features569 ×\times 30; 401/83/8530 →\rightarrow 512 →\rightarrow 256 →\rightarrow 2 feature classifier.
scikit-learn optical digits1,797 ×\times 64; 1271/247/279256-dimensional cached features and a healthy classification head.
Processed PBMC2,638 ×\times 1,838Normalized-dot-product Top-10; five-neighbor voting with computational annotations.
Appendix
Table B1: Scientific interfaces and input sizes. Splits count dataset rows.
Figure B1: Tool-state interventions and computing platforms. (a) Paired states supply original-coordinate restoration and transplantation on healthy hardware. (b) The PCIe and NVLink/NVSwitch layouts indicate computing roles and participation. (c) Arithmetic checks, stored states, selection identities, and task metrics. Table B1 lists the twelve interfaces.
PriorityAUC, linear budget axisFirst tested budget recovering both lists
Single-block decision sensitivity0.9922
Co-occurrence0.9922
Healthy boundary margin0.9824
Current output displacement0.85832
Hidden difference energy0.62264
Mean of 128 preset random orders0.498All orders recover at 127
Appendix
Table C1: Recovery over the two confirmation captures with changed membership. Budgets are 0, 1, 2, 4, 8, 16, 32, 64, and 127 blocks.
Figure C1: Recombination and competition. Finite combinations of captured residuals explain candidate membership and its relation to prediction error. The MSE panel shows the cross term and squared-difference term.
CaptureDifferent scoresChanged-membership queriesChanged-order queriesFirst successful budgetRemaining score differences
00591228/38 blocks464
0158500No changed list to recover—
02588228/38 blocks462
03588238/38 blocks460
04591118/38 blocks463
Appendix
Table C2: All five new SciFact captures. The first successful budget uses the fixed development priority.
Figure D1: Numerical and task endpoints. (a) State divergence with unchanged losses. (b) Reversal of RMSE direction across healthy environments. (c) Document changes with unchanged relevance labels.
Figure D2: Nonmonotonic and delayed recovery. (a) Initial residual dilution with fixed continuation. (b) Parameter/moment combinations from one reconstructed state. (c) Delayed restoration using the two membership-changing new captures. Full-state restoration recovers subsequent computed endpoints without rewriting earlier records.
TreatmentΔg\Delta g L2Changed θ\thetaLoss/63O Δ\DeltaΔ\Delta RMSE
Single GPU; divisor 2
SINGLE03.856×10−43.856\times 10^{-4}164,218903.240×10−63.240\times 10^{-6}
SINGLE1.927×10−31.927\times 10^{-3}281,177410−8.191×10−5-8.191\times 10^{-5}
PAIR1.965×10−31.965\times 10^{-3}280,581410−9.996×10−5-9.996\times 10^{-5}
MATCH_C1.965×10−31.965\times 10^{-3}280,581410−9.996×10−5-9.996\times 10^{-5}
Initial collective; N=2
Appendix
Table D1: Continuation endpoints by computing layout. Each row represents two identical technical repeats. The four zero-difference controls per layout are consolidated in the text.
Series / endpointCapture-balanced estimateCapture-bootstrap intervalCrossed-bootstrap interval
Initial, unselected / actions1.626[ −- 3.871, 8.750][ −- 6.818, 12.121]
Initial, unselected / read membership−- 0.667[ −- 2.000, 0.000][ −- 7.194, 4.511]
Initial, unselected / citations0.793[ −- 3.871, 6.250][ −- 7.194, 9.783]
Initial, unselected / verdict0.000[0, 0][0, 0]
Sustained / actions−- 0.376[ −- 3.455, 2.609][ −- 5.159, 3.975]
Sustained / read membership−- 0.189[ −- 0.566, 0.000][ −- 1.551, 1.181]
Appendix
Table F1: Recorded sensitivity estimates. Intervals use the original 10,000 fixed-seed resamples. Units are percentage points of excess discordance.
Figure F1: State replacement by continuation condition. H/C denote reference and candidate contents. Tool-only replacement retains candidate visible history; joint replacement restores both history and tool state; a fresh execution starts without an existing prefix. Each condition has 24 groups, giving 168 continuations.
TaskUnitsExecutionsH/H action changesZero-treatment action changesBF16 action changesBF16 final-membership changes
NCI, four rounds of descriptor feedback6425600103
WDBC, five active-sampling batches24960000
Appendix
Table G1: Protocol II. Counts refer to the same fixed task units across conditions.
CaptureGlobally different scoresGlobally replaced different scoresDifferent scores in claim-831 rowWithin-row replacementRemaining row differences
005911271616/160
015851271616/160
025881261414/140
035881281616/160
045911281616/160
Appendix
Table H1: Global and claim-831 mask scope.
GPU classQuery batchNumerically changed capturesDifferent scores per captureCaptures with changed Top-10 membership
Case 1: size-dependent88/854–880/8
Case 1: size-dependent3007/80–240/8
Case 2: expanded-trigger88/8588–5927/8
Case 2: expanded-trigger3008/8328–4718/8
Appendix
Table H2: Initial capture comparison.
ModelComplete pairsDifferent read setsDifferent citationsDifferent verdictsDifferent structured actions
Qwen390112
Gemma182103
Appendix
Table H3: Endpoint variability under identical initial requests.
Model / promptMechanismMaskingUnselected controls
Qwen / baseline567/567243/243576/576
Qwen / explicit examples553/567243/243576/576
Gemma / baseline269/567243/243288/576
Gemma / explicit examples494/56729/243555/576
Appendix
Table H4: Completion by model, prompt, and cohort.
ClaimCapture–claim combinationsH1 document / sentenceC document / sentenceBoth verdicts
34317873737 / 019308127 / 4SUPPORT, label-correct
431319922508 / 322696649 / 1SUPPORT, label-correct
72919154703 / 252944377 / 7SUPPORT, label-correct
Appendix
Table H5: Documents read and sentences cited by Gemma under the explicit-example prompt. Sentence indices are zero-based.
ModelCompleted / attempted episodesBudget exhaustedJoint core groups / scheduledRead C–H1Cite C–H1Verdict C–H1
Qwen1472/151240208/2161250
Gemma1154/1512358152/21632350
Appendix
Table H6: All attempts and jointly completed core groups in the eight-batch series.
Model / endpointEligible combinations / claimsdCHd_{CH}dHHd_{HH}dCCd_{CC}δD\delta_{D} , combinations weighted equallyδD\delta_{D} , claims weighted equally
Qwen / read membership26 / 100.481%0.000%0.962%0.0000.000
Qwen / cited sentences26 / 1012.019%0.000%0.962%11.53810.000
Gemma / read membership20 / 1020.000%0.000%0.000%20.00020.000
Gemma / cited sentences20 / 1021.875%0.000%3.393%20.17920.119
Appendix
Table H7: Between-state differences adjusted for within-state variation. Fractions are percentages; adjusted differences are percentage points.
SettingValue
EnsembleThree Chemprop D-MPNN members; hidden size 300; message-passing depth 3; mean aggregation; two-layer feed-forward classifier; batch normalization off
Batching128 compounds per batch, the last holding 89; seven linear calls per member per batch; 336 linear observations per pass
Calibration temperature1.0546289419746864
Triage threshold0.30475174995423615; assign to patch-clamp testing if the calibrated probability is at least this value
Selection402 of 2,009 compounds; exact ties ordered by compound identifier
Margin threshold ε\varepsilon0.009354012791251587, twice the largest absolute calibrated R1 residual in the retrospective series (0.0046770063956257935)
Appendix
Table I1: Fixed settings of the hERG experiments.
BF16 conditionSourcesChanged ensemble means per sourceChanged Top-402 setsChanged triage vectorsLabeled blockers in Top-402
Healthy reference800/80/8351/402
Case 1818–610/81/8351/402
Case 28287–3136/86/8351/402
Appendix
Table I2: hERG predictions and compound allocation in the confirmation series. Each source covers all 2,009 compounds and three ensemble members. Comparisons use the healthy BF16 reference obtained with the same GPU model on the same host.
Case 2 blockLeft the listEntered the list
1K5612 (397; 0.798067 →\rightarrow 0.786460)K5629 (406; 0.792903 →\rightarrow 0.795484)
2K5612 (397; 0.798067 →\rightarrow 0.791613)K12096 (403; 0.794193, unchanged)
3K8400 (402; 0.795484 →\rightarrow 0.790324)K12096 (403; unchanged)
4, 5nonenone
6K5612 ( →\rightarrow 0.786460); K8400 ( →\rightarrow 0.791613)K12096 (403), K2422 (404); both unchanged
7K5612 ( →\rightarrow 0.782601); K8400 ( →\rightarrow 0.792903); K8429 (211; 0.879586 →\rightarrow 0.584045)K12096, K2422 (unchanged); K5629 ( →\rightarrow 0.798067)
Appendix
Table I3: Compounds that left or entered the 402-compound list. Values are the healthy rank, then healthy →\rightarrow source calibrated probability. R1 restored every changed list.
SourceCompoundLabelHealthy probability (signed margin)Source probabilityChangeRestored by
Case 2, block 1K478000.283293 ( −0.021459-0.021459 )0.321968assay addedR1
Case 2, block 3K1225210.313189 ( +0.008437+0.008437 )0.298736assay removedR1
Case 2, block 3K1338800.305025 ( +0.000273+0.000273 )0.303768assay removedR1
Case 2, block 3K1341800.304710 ( −0.000041-0.000041 )0.305339assay addedR1+M
Case 2, block 5K478000.283293 ( −0.021459-0.021459 )0.335736assay addedR1
Case 2, block 6K1338800.305025 ( +0.000273+0.000273 )0.304710assay removedR1
Appendix
Table I4: Compounds whose assignment to patch-clamp testing changed. The signed margin is the healthy probability minus the threshold.
Case 2 block, taskTables listing affected compoundsReports naming affected compounds
1, selection2/30/3
2, selection2/33/3
3, selection2/33/3
6, selection3/31/3
7, selection2/33/3
8, selection2/31/3
Appendix
Table I5: Visibility of changed compounds. Three trajectories per combination of source and task; none called the prediction tool. Tables concern boundaries, cut-off ties or threshold neighborhoods; compound identities are listed above.
SourceFirst R / T prefixNumber of strict bidirectional partial prefixes
K5612, block 164 / 27227
K5612, block 2254 / 24312
K7714, triage task11 / 547281
Appendix
Table I6: First successful prefixes and numbers of strict bidirectional partial prefixes with coordinates ordered by mean absolute differences in the development captures. R is reference restoration and T is reciprocal transplantation.
ContextBF16 forwardBF16 forward with verificationTwo BF16 passes and comparison
Confirmation on the same host (RTX)0.4883 s0.8956 s0.9761 s
Margin experiment (RTX)0.50383 s1.18486 s1.00587 s
Data-center GPU, original FP64 checks0.4673 s1.0204 s0.8816 s
Data-center GPU, streaming FP64 checks0.4673 s0.5877 s0.8816 s
Appendix
Table I7: Timing on healthy GPUs. Medians of eight repetitions per method; columns report total times for separate methods. Data-center GPU rows use healthy inputs on the same device, include calibration and output writing, and share the BF16 forward and double-execution baselines.
StrategyCompoundsPredictionsSelectionTriageResiduals
R1 only0016/1615/160/1
R1+M6820416/1616/161/1
Random, each of 20 fixed seeds6820416/1615/16 for every seed0/1 for every seed
Ordered by ensemble disagreement6820416/1615/160/1
Appendix
Table I8: Additional recomputation in the 16 confirmation sources. Compounds and predictions are recomputed per source; selection and triage count sources whose outputs match the healthy reference; the last column counts R1 residual decisions recovered.
Input conditionTaskTrajectoriesAgreement with own input ruleAgreement with reference decision
R1+M, 16 sourcesSelection4848/4848/48
R1+M, 16 sourcesTriage4848/4848/48
Case 1 block 4, original inputSelection33/33/3
Case 1 block 4, original inputTriage33/30/3
Case 1 block 4, R1 inputSelection33/33/3
Case 1 block 4, R1 inputTriage33/33/3
Appendix
Table I9: All 114 continuation trajectories. The reference decision is the agent’s output on contemporary healthy inputs.
OutcomeBefore readingFile replacementState restoration
Case 148/4845/4848/48
Case 248/4812/4848/48
Healthy controls6/66/66/6
Changed decisions recovered39/390/3939/39
Actions committed1026102
Actions rejected, decision deviating0390
Appendix
Table I10: Decisions and commitments by recovery condition. The first four rows count agreement with the healthy decision. Rejected actions are grouped by agreement with that decision; all 96 rejections recorded a superseded input view. Across the 306 outcomes from the three conditions, 210 actions were committed, none deviating from the certified decision or recorded twice.
ItemValue
Saved state, original checks with trusted recomputation8.091 / 8.117 s
Saved state, streaming checks with trusted recomputation2.731 / 2.783 s
Saved state, direct trusted recomputation0.455 / 0.453 s
Saved state, double execution0.870 / 0.863 s
Verified forward plus full trusted recomputation (original / streaming checks)1.4339 / 1.0021 s
Tokens, 96 requests with faulty inputs: analysis after recovery before reading / initial analysis of the faulty predictions4,264,281 / 4,224,138
Appendix
Table I11: Numerical processing costs and agent token use. Entries for saved states list Case 1 / Case 2 medians across eight sources each, with one paired timing per source and method; verification followed by recomputation includes reading, checks, trusted recomputation, calibration and writeback. Timings that include forward execution use healthy inputs and cover one verified forward pass followed by full recomputation, with eight repetitions per method. State operations cover file restoration, checkpoint decoding, table writeback and commit recording. Token counts cover successful responses, with cached input included within input and the shared prefix counted once.
SettingValue
ESOL endpointAqueous solubility; supported if logS is at least −2-2
CITE-seq endpointsNormalized antibody-derived tag readouts; CD3 threshold 5.937278695830723; CD14 threshold 3.539439707328391
PredictorSaved input representations, cosine similarities to landmark samples and fitted ensembles of four ridge predictors, retained across numerical conditions
Shortlist24 candidates nearest the threshold; ties broken by identifier; displayed in identifier order with predicted mean, predictor dispersion and threshold comparison
QueriesTwo objects measured in sequence; public measurements revealed only when queried
27B agentQwen3.8-27B served locally; serial client requests; temperature zero; seed zero; thinking disabled; output limit 384 tokens
Appendix
Table J1: Fixed settings of experiments on new inputs.
DomainChangedWilson 95%Bootstrap 95%OrderHit count
ESOL7/487.25–27.176.25–25.0083
CD318/4825.22–51.6425.00–52.08183
CD1413/4816.57–41.0014.58–39.58145
Appendix
Table J2: Case 2 query outcomes on new inputs. Each domain has 48 contexts. Changed: contexts whose set of measured objects changed. Intervals are in percent; CD3 and CD14 share cell operations, so the cluster bootstrap resamples operations. Order and hit count: contexts whose query order or number of measured objects meeting the threshold changed.
List / valuesTrajectoriesMatch referenceMatch candidateReport errors
Reference / reference16016080
Reference / candidate16084280
Candidate / reference16032840
Candidate / candidate16081560
Appendix
Table J3: Factorial comparison of list membership and numerical values. The first factor is list membership and the second the numerical fields. Matching the reference and matching the candidate are not mutually exclusive in the two contexts whose reference and candidate query sets coincide; the four candidate/candidate trajectories that differ from the candidate come from one context.
BlockCellReference predictionCase 2 predictionMeasurementEffect
1E2L8_AGCGATTGTGGAAGTC5.9055395.9585295.294847new false positive
1E2L8_AGGACTTGTGGAATGC6.0672705.8347045.769720false positive corrected
2E2L8_CTCAACCGTCTCCTGT5.9188456.0415445.965956false negative corrected
2E2L8_GACTATGTCGAGAGCA5.9106366.0080345.628356new false positive
Appendix
Table J4: The four distinct changed cells in the primary Case 2 captures. Values are normalized CD3 readouts; the threshold is given in Table J1 . All four cells come from donor P7.
More in this topic

AI Agent Auditing

AI agent auditing examines agents’ actions, tool use, evidence, and outcomes to assess safety, compliance, reliability, and accountability.

See all 291 papers

Explore similar work

CardsList

  1. When Tools Silently Lie: Evaluating and Mitigating Blind Compliance in Tool-Augmented Data Agents

    Sep 29, 2026Zifu Tao, Changqing YinAI Agent ReliabilityTool-Use Evaluation

    Tongji University

  2. Replayable Financial Agents: A Determinism-Faithfulness Assurance Harness for Tool-Using LLM Agents

    Jan 17, 2026Raffi KhatchadourianAI Agent ReliabilityLLM Agent Evaluation

    IBM Financial Services Market, New York, NY, USA

  3. Beyond the Text: Verifying That Agent-Written Papers Are Backed by Their Artifacts

    Aug 18, 2026Qiuhong Shen, Benlong Wu, Hanjin Liu +2AI Agent AuditingAI Agent Evaluation

    University of Science and Technology of China