From Tool State to Scientific Action: Auditing Decision Provenance in Biomedical Research Agents

From Tool State to Scientific Action. Auditing Decision Provenance in Biomedical Research Agents. By Xingyu Yi and three others, from Intosyn AI Labs, Columbia University, and one other institution. Published on the first of November.

A scientific agent can reach the same verdict while reading and citing different evidence. That separation is the claim, and its consequence follows directly: an audit that checks only the final answer can miss a change in what the answer rests on. The authors conclude that an audit should track both the evidence an agent uses and the answer it gives.

The test harness is called BioAgent-DF. It works with paired values, a reference and a candidate, saved at the same scientific computation site. Those values are restored or transplanted at their original coordinates, and the agent is then run on healthy hardware. Across eight SciFact batches, Qwen3.5-4B shows repeatable citation changes in three capture-claim combinations. Gemma 3 4B IT shows repeatable changes to both what it reads and what it cites, in four combinations.

Full restoration recovers the reference evidence sets, and through all of this the verdicts stay the same. Further experiments on tools and an optimizer separate three kinds of recovery: of numerical state, of ranked lists, and of the agent's visible history.

A second setting is cardiac-safety assay allocation for hERG. There, silent numerical faults changed which compounds were sent for testing, while the fixed-budget shortlist still held the same number of compounds labeled as blockers. A count-level check would have seen nothing. After the agent had used the faulty values, restoring its earlier execution state and supplying certified scores recovered all thirty-nine changed decisions. Replacing the prediction file recovered none of them. No incorrect action was committed.

The boundaries are stated plainly. Two small models are tested, and the seven combinations that show repeatable changes cover only two claims. Verdict changes did appear under the baseline prompt, but they did not recur under the explicit-example prompt, so the stable result concerns evidence, not verdicts. On cost, a streaming implementation of the arithmetic checks cut the total time for forward execution and verification by forty-two point four percent relative to the original FP64 implementation, with identical flags and recovery outputs.

Picture two audits of the same run. One asks whether the agent's answer changed, and in most of these cases it says no. The other asks what the agent read, what it cited, and which decisions moved, and that one finds the faults. The hERG case makes the gap concrete: the headline count held steady while thirty-nine individual decisions shifted underneath it, and only restoring the agent's own earlier state brought them back.