BioAgent-DFTowards Trustworthy and Controllable Fully Automated Wet Labs

From Tool State to Scientific ActionAuditing Decision Provenance in Biomedical Research Agents

*Corresponding author

Paper arXiv Code · Aritheia BibTeX

TL;DR

Hardware can change
scientific decisions硬件可能改变
科学决策

Hardware is an overlooked reproducibility variable in AI-driven science: silent numerical faults can change evidence selection and experimental decisions even when aggregate metrics remain unchanged.硬件是 AI 驱动科学中一个被忽视的可重复性变量：静默数值故障可能在汇总指标不变时，改变证据选择和实验决策。

hERGThe shortlist retains the same number of labeled blockers, but which compounds are sent for testing changes. See the testing assignments →候选名单中的标注阻断剂数量不变，送检的化合物却变了。查看检测分配 →

SciFactIn combinations selected for changed retrieval lists, agents can return the same verdict while reading or citing different evidence. See the selection criteria and controls →在按检索列表变化筛选的组合中，Agent 的结论不变，读取或引用的证据却可能改变。查看筛选条件与对照 →

  • Reference state. Values from a matched healthy execution.参考状态。来自匹配健康运行的数值。
  • Candidate state. Values captured at the same computation site on faulty hardware.候选状态。在故障硬件上同一计算位置捕获的数值。
Paired replay on healthy hardware
H Reference healthy run C Candidate faulty capture Same agent model healthy hardware Evidence path A reads · citations Evidence path B reads · citations ≠ Same verdict

Case 1 (size-dependent) faults appear more often on tested large-matrix paths than on short probes. Case 2 (expanded-trigger) faults also appear on short probes.Case 1（尺寸依赖型）在所测试的大矩阵路径上比短探针更常出现异常；Case 2（触发范围扩展型）也会在短探针上出现异常。

6/8

Of eight Case 2 sources, six changed the hERG shortlist and six changed testing assignments八个 Case 2 来源中，六个改变了 hERG 候选名单，六个改变了检测分配

2

labeled hERG blockers, K12252 and K1461, assigned to advancement without testing in faulty runs标注为 hERG 阻断剂的 K12252 和 K1461，在故障运行中被安排不经检测直接推进

39/39

changed decisions recovered by restoring the agent’s pre-read execution state; replacing the prediction file recovered none恢复 Agent 读取前的执行状态后，39 个被改变的决策全部复原；仅替换预测文件未能恢复

42.4%

less time for forward execution plus verification than the original FP64 checks, with identical flags and recovery outputs前向计算与验证总耗时降幅，比较基准为原始 FP64 校验；异常标记与恢复输出保持一致

Abstract摘要

AI 驱动科学的可重复性，还取决于运行计算工具的硬件。汇总指标稳定，不能保证证据选择和 Agent 决策也稳定。

我们在生产训练集群中发现了两种 GPU 静默数值故障模式：程序没有报错，训练持续运行，底层计算却已悄然发生偏差。Lei 等（OSDI’26）在覆盖 3,500 万 GPU 小时的生产部署中检测到 18 起静默数据损坏（SDC）事件，涉及 13 张故障 GPU。OSDI’26 的另一项生产集群研究分析了 23 张出现 SDC 的 GPU：标准合成微基准漏掉了超过 60% 的设备，常规 ECC 与温度保护也未捕获所观察到的逻辑级错误。因此，通过通用设备检查，并不等于某项具体科学计算可靠。

我们在健康硬件上回放捕获的工具数值。在原生 Biomni A1 Agent（GPT-6.1 Sol）执行的 hERG 筛查任务中，候选名单中的标注阻断剂数量保持不变，名单成员和检测分配却发生变化，甚至让参考决策要求送检的两个标注阻断剂不经检测直接推进。在 SciFact 检索列表发生变化的组合中，可出现“结论不变、证据路径改变”；未按这一条件筛选的队列中，差异未超出健康硬件重复运行时的波动。这两类实验共同说明：应同时检查汇总结果与产生科学决策的具体证据和对象。

为此，我们提出 BioAgent-DF，构建了一套从 GPU 数值校验、可信重算，到 Agent 状态恢复与决策认证的端到端科学决策保真框架。我们将研究从 hERG 药物安全筛查拓展到 GB1 蛋白工程和超导材料筛选，在三类任务中都观察到数值故障改变了 Agent 的决策。经 BioAgent-DF 恢复后，三个任务中的 Agent 决策均与匹配健康运行的参考决策一致。同时，与原始 FP64 校验相比，流式校验将额外验证耗时降低 78.2%，计算与验证总耗时降低 42.4%。

从生产集群中的静默数值故障，到科研 Agent 的决策保真，再到未来全自动湿实验室的发展，我们希望以 BioAgent-DF 为可信决策核心，将可信计算与科学决策的保障延伸至真实物理实验。我们的目标，是为下一代实验室构建贯穿计算、决策、执行与观测的可信基础设施。

让每一次科学决策有据可验，让每一步实验过程有迹可循，让每一项研究结论都能基于原始证据被重新审查与纠正。

Reproducibility in AI-driven science also depends on the hardware that produces tool values. Stable aggregate metrics do not guarantee that evidence selection or agent decisions will remain stable.

In production training clusters, we found two patterns of silent numerical faults on GPUs: programs reported no errors and training continued, while the underlying calculations had quietly diverged. Lei et al. (OSDI’26) detected 18 silent data corruption (SDC) incidents involving 13 faulty GPUs during a production deployment spanning 35 million GPU-hours. In another OSDI’26 study of 23 GPUs affected by SDC, standard synthetic microbenchmarks missed over 60% of the defective devices, and conventional ECC and thermal protections did not capture the observed logic-level faults. Passing a general device test therefore does not establish correctness for a specific scientific computation.

We replay captured tool values in paired runs on healthy hardware. In hERG screening with the native Biomni A1 agent (GPT-6.1 Sol), the shortlist retains the same number of labeled blockers while shortlist membership and testing assignments change, including two labeled blockers advanced without testing, although the reference decision was to test them. In SciFact combinations selected for changed retrieval lists, verdicts can stay unchanged while evidence paths change; the unfiltered cohort shows no excess over healthy-repeat variation. Both experiments motivate checking the evidence and objects behind scientific decisions alongside aggregate results.

To address this, we propose BioAgent-DF, an end-to-end scientific decision-fidelity framework spanning GPU numerical verification, trusted recomputation, agent state restoration and decision certification. We extended our experiments from hERG drug safety screening to GB1 protein engineering and superconducting materials screening and observed that numerical faults changed agent decisions in all three tasks. After recovery with BioAgent-DF, agent decisions in all three tasks matched the reference decisions from matched healthy runs. Compared with the original FP64 verification, streaming verification reduces the added verification time by 78.2% and the total compute-and-verification time by 42.4%.

From silent numerical faults in production clusters to decision fidelity in research agents, we aim to make BioAgent-DF a trusted decision core that extends these safeguards to physical experiments. For future fully automated wet labs, this infrastructure would span computation, decisions, execution and observation.

Every scientific decision, verifiable against evidence.Every experimental step, traceable.Every conclusion, open to re-examination and correction from the original evidence.

Outlook展望

BioAgent-DF for Next-Generation LabsBioAgent-DF：面向下一代实验室

Towards Trustworthy and Controllable Fully Automated Wet Labs

下一代全自动湿实验室既要自主设计和开展实验，也要判断哪些计算结果可信、哪些决策可以提交，以及出错后可以恢复哪些状态。我们在 hERG 检测分配任务中验证了计算与决策环节。线性层校验和检出了故障 GPU 上的全部受测故障来源，常规检查均未报警。Agent 使用错误数值后，仅替换文件无法纠正决策，恢复执行状态则可以。所有提交的决策均与认证结果一致。

我们希望将 BioAgent-DF 用于机器人和实验仪器。Agent 可以提前推理，仪器只在决策通过验证后执行操作。出错后可重建数字状态，并保留已执行的操作和测量记录。

Next-generation fully automated wet labs must design and run experiments, assess which computational results are trustworthy, and determine which decisions may be submitted and which states can be restored after an error. We validated the computational and decision steps in hERG testing assignment. Linear-layer checksums flagged every tested fault source, while routine checks raised no alerts. After the agent had used faulty values, replacing the file did not correct its decisions; restoring the execution state did. All submitted decisions matched the certificate.

We aim to apply BioAgent-DF to robots and instruments. The agent can reason ahead while instruments act only after a decision is verified. After an error, digital state can be rebuilt while retaining records of completed operations and measurements.

  • Solid: validated in this work (appendix cited)实线框：本文已验证（附录可查）
  • Dashed: proposed extensions虚线框：拟议扩展
BioAgent-DF framework figure in five panels. (a) Overall framework: research goals and constraints feed the BioAgent-DF runtime, where the Biomni A1 agent (GPT-6.1 Sol), verified tool computation for linear layers, an execution-state checkpoint and a commit gateway form the validated core; experimental execution, verified results and the closed loop are proposed. (b) Trusted computation and certified decisions for the D-MPNN predictor. (c) Hold, verify, restore and commit across three recovery conditions. (d) Recovery after the agent has used faulty values, for compounds K12252 and K1461. (e) Long-running operation and guarantees. Solid boxes are validated in this work; dashed boxes are proposed. Click a panel to zoom in点击分图放大

Figure 1. BioAgent-DF connects numerical verification, trusted recomputation, execution-state restoration and decision certification, with extensions toward fully automated wet labs. Solid boxes show components validated in this work; dashed boxes show proposed extensions, and “class-1 objects” denotes compounds labeled as hERG blockers.

图 1｜BioAgent-DF 将数值校验、可信重算、执行状态恢复与决策认证连接起来，并向全自动湿实验室延伸。实线框表示本文已验证的部分，虚线框表示拟议扩展；图中的 class-1 objects 即标注为 hERG 阻断剂的化合物。

01From tool state to scientific decisions从工具状态到科学决策

Silent numerical faults change which compounds get tested静默数值故障改变了哪些化合物会被送检

A three-member Chemprop D-MPNN ensemble predicts blockade of the hERG potassium channel, a cardiac-safety liability, for 2,009 held-out compounds. A native Biomni A1 agent (GPT-6.1 Sol) selects the 402 highest-scoring compounds for measurement and assigns every compound to patch-clamp testing or advancement without testing. Sixteen saved BF16 passes, eight per fault pattern, are compared with a healthy reference from the same GPU model and host.

Case 1 preserved shortlist membership; only one of eight sources changed testing assignments. Of eight Case 2 sources, six changed shortlist membership and six changed testing assignments.

Every list replacement exchanged labeled blockers. The shortlist therefore still contained 351 labeled blockers among 402 compounds, even though its members and testing assignments changed. K12252 and K1461, both labeled blockers, were assigned to advancement without testing although the reference decision required testing. The changes extended beyond near-ties: K8429 fell from 0.880 to 0.584 and left the list, while K12096 and K2422 entered with unchanged predictions because competitors fell.

R1 recomputes on healthy hardware the predictions flagged by row and column checksums with a rounding bound. R1+M also recomputes the 68 compounds whose decision margin falls below ε=0.009354\varepsilon = 0.009354. Selection and testing assignment then matched the healthy reference in all 16 sources, and all 96 fresh Biomni trajectories on R1+M inputs reproduced the healthy decisions.

三个 Chemprop D-MPNN 模型组成的集成，为测试集中的 2,009 个化合物预测 hERG 钾通道阻断风险。原生 Biomni A1 Agent（GPT-6.1 Sol）选取分数最高的 402 个化合物作为测量候选，并将每个化合物分配为膜片钳检测或不经检测直接推进。实验比较了 16 次保存的 BF16 前向计算，每种故障模式八次，与相同 GPU 型号、相同主机上的健康参考配对。

Case 1 保持候选名单成员不变，8 个来源中仅 1 个改变了检测分配；Case 2 的 8 个来源中，候选名单成员和检测分配各有 6 个发生变化。

所有名单替换都发生在标注阻断剂之间。因此，402 个化合物的候选名单中仍有 351 个标注阻断剂，具体成员和检测分配却已经改变。标注为阻断剂的 K12252 和 K1461 被安排不经检测直接推进，而参考决策要求送检。变化也不限于分数接近的候选：K8429 从 0.880 降至 0.584 后离开名单，K12096 和 K2422 自身预测不变，却因竞争对象分数下降而进入名单。

R1 在健康硬件上重算被行列校验和及舍入误差界标记的预测。R1+M 还重算决策余量低于 ε=0.009354\varepsilon = 0.009354 的 68 个化合物。随后，全部 16 个来源的选择与分配都与健康参考一致，基于 R1+M 输入新运行的 96 条 Biomni 轨迹也全部复现健康决策。

Four panels on hERG testing assignment. (a) Pipeline from 2,009 held-out compounds through BF16 predictions, arithmetic checks and R1 or R1+M recomputation to the native Biomni A1 agent and testing assignment. (b) Grid of compounds whose Top-402 or testing assignment decision changed across 16 fault sources, with rows showing recovery by R1, R1+M and the agent. (c) Scatter of prediction displacement against healthy distance to the nearer decision boundary. (d) R1 residual against the minimum decision margin after R1, with the R1+M selection region shaded. Enlarge放大
Figure 2. Changed hERG testing assignments and recovery. (a) BF16 predictions feed native Biomni selection and testing assignment; R1 recomputes predictions flagged by arithmetic checks, and R1+M adds a margin rule that also recomputes 68 compounds near decision boundaries. (b) Changed decisions across 16 sources; the ring marks the discrepancy left by R1 and recovered by R1+M. Healthy margin is distance to the affected decision’s boundary; lower rows show recovery and the decisions of native Biomni runs on R1+M inputs. (c) Prediction displacement versus healthy distance to the nearer boundary; highlights mark changed decisions, and the lower strip shows entry with unchanged predictions. (d) R1 residual versus the minimum decision margin computed from R1 scores; shading marks R1+M selection. Dashed lines in (c,d) mark equality.图 2｜hERG 检测分配的变化与恢复。（a）BF16 预测进入原生 Biomni 的选择与检测分配任务；R1 重算被算术检查标记的预测，M 追加重算 68 个近边界化合物。（b）16 个故障来源中的决策变化；圆圈标出 R1 留下、由 R1+M 恢复的差异。健康余量是参考分数到相关决策边界的距离，下方给出恢复结果与使用 R1+M 输入的 Biomni 决策。（c）预测位移与到较近边界的健康距离；高亮标出决策变化，下方条带显示自身分数不变却进入名单的对象。（d）R1 残差与 R1 分数的最小决策余量；阴影表示 M 的重算范围。（c、d）的虚线表示相等。

Correct numerical results must also be reflected in the final decision. The execution-state comparison and certification conditions explain how.数值修正后，还要确认系统最终采用了正确结果。执行状态对照与认证条件说明了具体做法。

MMathematics数学

Mathematical Foundations of Decision Fidelity决策保真的数学基础

Definition定义

Under the same computational settings and decision rule, scientific decision fidelity means that the final selection or testing assignment matches the decision obtained from trusted reference scores. Evidence reads and citations are compared separately with a reference execution.在相同的计算设置和决策规则下，如果系统最终给出的候选名单或检测分配，与可信参考计算得到的结果一致，我们就称其具有“科学决策保真性”。至于读了哪些文档、引用了哪些句子，则另行与参考运行记录比较。

a=g(p⋆)a=g(p^\star)
a
the final decision最终决策
p⋆
the reference scores参考分数
g
the decision rule, specified in advance预先规定的决策规则

Open any step for its explanation, equations and examples.点击下面的步骤，可展开说明、公式和实验例子。

01Check outputs against their inputs用输入核验输出Compare output checksums with input-derived values and the allowed rounding error.先比较行列校验和与预期结果，判断偏差是否超出了允许的舍入误差。

For a linear layer, X has u rows and k inputs, W has v rows and k inputs, and b is a v-entry bias vector. The vector 1 contains ones; its subscript specifies its length.以线性层为例，输入 X 包含 u 行、k 个特征，权重 W 包含 v 行、k 个特征，b 是长度为 v 的偏置向量。公式中的 1 表示各项均为 1 的向量，下标表示向量长度。

Y=XW⊤+1ub⊤Y=XW^\top+\mathbf1_u b^\top

The expected row sums χrow and column sums χcol can be computed from X, W and b without forming the full reference product:根据输入 X、权重 W 和偏置 b，可以直接算出预期的行和 χrow 与列和 χcol，无需先重算整张输出矩阵：

χrow=X(W⊤1v)+1u(b⊤1v)\chi_{\mathrm{row}}=X(W^\top\mathbf1_v)+\mathbf1_u(b^\top\mathbf1_v)
χcol⊤=(1u⊤X)W⊤+ub⊤\chi_{\mathrm{col}}^\top=(\mathbf1_u^\top X)W^\top+u b^\top

Let Ŷ be the observed output. Compare its sums with χrow and χcol. For example, row i is flagged when the magnitude of its computed residual exceeds βᵣ,ᵢ:再将实际输出 Ŷ 的行和、列和与上述结果比较。例如，当第 i 行的校验残差超过允许的舍入误差界 βᵣ,ᵢ 时，就标记这一行：

∣r^res,i∣>βr,i|\widehat{r}_{\mathrm{res},i}|>\beta_{\mathrm{r},i}

The residual compares Ŷ1 with χrow. The bound β includes rounding in the declared layer computation and in the checksum calculation; column checks use the corresponding column bounds.这里的残差来自 Ŷ1 与 χrow 的差。误差界 β 同时考虑线性层计算和校验计算中的舍入误差；列检查采用同样的原则。

Why a checksum does not bound each score为什么校验和不能给出每个分数的误差界
E=(η−η−ηη),E1=0,1⊤E=0E=\begin{pmatrix}\eta&-\eta\\-\eta&\eta\end{pmatrix},\quad E\mathbf1=\mathbf0,\quad\mathbf1^\top E=\mathbf0

For any nonzero η, this error matrix has zero row and column sums. Cancellation can therefore hide individual errors; decision certification requires additional valid score bounds or trusted recomputation.只要 η 不为零，矩阵中就存在误差，但各行、各列求和后仍然为零。这说明正负误差可能相互抵消，掩盖具体数值的偏差。因此，要认证最终决策，还需要有效的逐分数误差界或可信重算。

Streaming verification with conservative fallback带保守回退的流式校验

Our streaming checker shares signed and absolute FP64 tile reductions across row and column checks. A conservative arithmetic guard resolves checks when the original verifier’s decision is unambiguous and falls back to that verifier otherwise. Across the 16 evaluated fault sources, it preserved flags, localization and bitwise recovery outputs while reducing total forward-and-verification time by 42.4% relative to our original FP64 implementation.流式校验在行、列检查之间共享带符号与绝对值的 FP64 分块归约。当保守误差界足以确定原始校验器的判定时，直接给出结果；否则回退到原始校验器。在评价的 16 个故障来源中，标记、定位及逐位恢复输出均与原实现一致，前向计算与验证的总耗时比原始 FP64 实现降低 42.4%。

Mathematical form of the guard判定逻辑的数学表述

For one row or column check, let r64 be the original FP64 residual and β64 its rounding-error bound. The signed margin z64 determines its flag f64: one when z64 > 0, zero otherwise. Let z̃ be the streaming estimate and κ a valid bound on its discrepancy from z64, including rounding in both the residual and bound calculations.对一次行或列检查，r64 是原始 FP64 校验残差，β64 是对应的舍入误差界。残差绝对值与误差界之差 z64 决定标记 f64：大于零时取 1，否则取 0。z̃ 是流式估计，κ 是它与 z64 之差的有效上界，包含残差与误差界计算中的舍入影响。

z64=|r64|−β64|z~−z64|≤κz_{64}=|r_{64}|-\beta_{64},\qquad |\widetilde z-z_{64}|\le\kappa
fstream={1z~−κ>00z~+κ<0f64otherwise=f64f_{\mathrm{stream}}=\begin{cases}1,&\widetilde z-\kappa>0\\0,&\widetilde z+\kappa<0\\f_{64},&\text{otherwise}\end{cases}=f_{64}

If the interval lies entirely above zero, flag the check; if it lies entirely below zero, pass it. An interval containing or touching zero triggers the original FP64 check. Under the stated bound, the streaming flag equals the original FP64 flag.区间完全高于零时标记，完全低于零时通过；包含或触及零时调用原始 FP64 检查。在上述误差界成立时，流式判定与原始校验器一致。

02Locate and test the differences定位并检验差异Restore and transplant values at the same coordinates to test which differences affect the decision.在同一位置恢复和移植数值，观察决策是否随之改变，检验哪些差异真正起作用。

Pair a healthy reference state h with a candidate state c captured at the same computation site. For a coordinate or block set S, restoration corrects the candidate; transplantation introduces the captured differences into the reference.在同一个计算位置，分别保存健康参考状态 h 和候选状态 c。对坐标或块集合 S，恢复操作将对应数值换回参考值；移植操作则将候选值放入参考状态。

Here i indexes a tensor entry. When blocks are selected, S denotes the union of their entry coordinates. RS is the restored state and TS the transplanted state.i 表示张量条目的坐标；按块选择时，S 表示这些块包含的全部条目坐标。RS 是恢复后的状态，TS 是移植后的状态。

(RS)i={hi,i∈Sci,i∉S(R_S)_i=\begin{cases}h_i,&i\in S\\c_i,&i\notin S\end{cases}
(TS)i={ci,i∈Shi,i∉S(T_S)_i=\begin{cases}c_i,&i\in S\\h_i,&i\notin S\end{cases}

Continue with the same downstream computation F and compare endpoint D. Restoration tests recovery of D(F(h)); transplantation tests reproduction of D(F(c)). The two directions provide controls for one another. Empty and full edits, healthy repeats and fixed continuation conditions distinguish the intervention from reconstruction errors.继续相同的后续计算 F，比较终点 D。恢复实验检验是否恢复 D(F(h))，移植实验检验是否重现 D(F(c))；两个方向的干预互为对照。通过不替换数值、完整替换和健康重复等对照，并保持后续计算条件一致，可以区分干预效果与状态重建带来的误差。

03Recompute selected objects选择性重算Use arithmetic evidence and distance from selection or testing boundaries to choose further recomputation.结合异常位置，以及分数距入选线或检测阈值的距离，选择需要进一步重算的预测。

For fixed threshold and Top-K rules, let d(q) be the L∞ distance to the decision boundary. A rule output can change only if the score displacement reaches that boundary.对于固定阈值或 Top-K 选择，分数变了并不意味着名单一定会变。只有分数位移达到决策边界，规则输出才可能改变。下面用 d(q) 表示分数向量到边界的 L∞ 距离。

q is a score vector and s the currently observed vector. Bg denotes the decision boundary, where g is not locally constant. The L∞ norm is the largest absolute coordinate difference, and dist∞ is distance measured with that norm.q 表示一个分数向量，s 是当前观察到的分数向量。Bg 表示规则 g 不再局部恒定的决策边界。L∞ 范数是各坐标绝对差的最大值，dist∞ 是按该范数计算的距离。

d(q)=dist⁡∞(q,Bg)d(q)=\operatorname{dist}_{\infty}(q,B_g)
g(s)≠g(p⋆) ⟹ ∥s−p⋆∥∞≥d(p⋆)g(s)\ne g(p^\star)\ \Longrightarrow\ \|s-p^\star\|_\infty\ge d(p^\star)

For Top-K membership with a strict cut-off gap, d(q) = (q(K) − q(K+1))/2. An unchanged score can enter or leave when competitors move. M uses current, per-object margins to allocate additional recomputation.对于按分数选取前 K 个对象的规则，如果入选线处没有平局，则 d(q) = (q(K) − q(K+1))/2。即使某个对象自身的分数没有变化，竞争对象的分数变化也可能使它进入或退出名单。M 就是根据各对象当前距离决策边界的远近，安排进一步重算。

For the vector of threshold decisions gi(q) = 1[qi ≥ τ], the boundary distance is d(q) = mini|qi − τ|.对全部对象的阈值决策 gi(q) = 1[qi ≥ τ]，边界距离为 d(q) = mini|qi − τ|。

K is the number selected; q(K) is the K-th largest score. In the threshold rule, τ is the specified threshold, i indexes an object, and 1[·] equals one when the condition holds and zero otherwise. R1 recomputes predictions identified by arithmetic checks; M adds objects whose current decision margin is below the empirical threshold ε, determined before evaluation.K 是入选数量，q(K) 是第 K 大的分数。在阈值规则中，τ 是规定阈值，i 是对象索引；1[·] 在条件成立时取 1，否则取 0。R1 重算由算术检查定位到的预测；M 追加重算当前决策余量小于经验阈值 ε 的对象，ε 在评价前确定。

From distance to an interval certificate从边界距离到区间认证

Suppose each score has a valid bound |si − p⋆i| ≤ ei. The admissible set lies within radius max ei of s. A radius smaller than d(s) cannot reach a boundary, so the rule is constant throughout the set.若每个分数具有有效误差界 |si − p⋆i| ≤ ei，可容许集合位于以 s 为中心、max ei 为半径的球内。半径小于 d(s) 时无法触及边界，规则在整个集合内为常值。

The non-negative ei bounds the error of score i. The admissible set is 𝒰 = {q : |qi − si| ≤ ei for every i}. Thus g(𝒰) is the set of decisions obtained from all score vectors allowed by these bounds.非负的 ei 是第 i 个分数的误差上界。可容许集合为 𝒰 = {q：对每个 i，都有 |qi − si| ≤ ei}。g(𝒰) 则是这些误差界允许的所有分数向量对应的决策集合。

max⁡iei<d(s) ⟹ g(U)={g(s)}\max_i e_i<d(s)\ \Longrightarrow\ g(\mathcal U)=\{g(s)\}

Full recomputation gives a singleton set; the specified tie rule then determines its decision, including at a tie.全量重算得到单点集合，规定的平局规则可以确定其决策，包括参考分数恰好平局的情况。

The displacement condition is necessary for a decision change; the interval condition is sufficient, not necessary, for certification.位移条件是决策变化的必要条件，区间条件是认证的充分而非必要条件。

A numerical example: K13418一个具体例子：K13418

K13418: healthy score 0.304710 below the threshold 0.30475175; score after R1 0.305339 above it, 0.00059 from the threshold. Healthy 健康分数 0.304710 +0.000629 no test不检测test检测 distance to τ ≈ 距阈值 ≈ 0.00059 τ ≈ 0.30475175 After R1 R1 之后 0.305339
Drawn to scale. The shaded band is the range M recomputes, within ε = 0.009354 of τ; it extends beyond both ends of this view.按比例绘制。阴影为 M 的重算范围，即距 τ 不到 ε = 0.009354 的分数，两端均超出图示范围。

In Case 2, block 3, the healthy score was about 0.304710, below the testing threshold τ ≈ 0.30475175. After R1, the score was still about 0.305339, above the threshold, which added a testing assignment.以 Case 2 的第 3 区组为例，K13418 的健康分数约为 0.304710，低于检测阈值 τ ≈ 0.30475175。R1 之后，它的分数仍约为 0.305339，高于阈值，因此比参考决策多安排了一项检测。

The positive residual, about 0.000629, crosses the healthy margin of about 0.000041. M uses only the current distance to the threshold, about 0.00059: it is smaller than ε = 0.009354, so this object is recomputed and the reference decision is recovered.约 0.000629 的向上偏移，已经越过了健康分数距阈值约 0.000041 的间隔。M 无需读取健康参考，只需检查当前分数距阈值约 0.00059，小于预定的 ε = 0.009354，就会将该对象纳入重算。重算后，检测分配恢复为参考决策。

K13418 is labeled a non-blocker in the benchmark; the changed decision adds an unnecessary test.K13418 在基准数据中标注为非阻断剂，这里多出的是一次不必要的检测。

Decision recovery versus full-state recovery决策恢复与完整状态恢复的成本

Recovery cost恢复成本

Recover the decision before the full state决策可以先于完整状态恢复

Let C(S) measure the cost of an admissible edit. The decision endpoint may be membership, order or testing assignment. The two recovery targets have different feasible sets:令 C(S) 表示允许编辑的成本。决策终点可以是名单成员、排序或检测分配。两种恢复成本具有不同的可行集合：

ℛ is the family of allowed coordinate sets S. F continues computation from the saved state; D extracts the endpoint being compared. ρD is the minimum cost of recovering that endpoint, and ρstate the minimum cost of reproducing the full reference state h. C(S) uses the same specified unit in both problems, such as replaced blocks or measured computation time; an infeasible minimum is +∞.ℛ 是允许选择的坐标集合 S 的全体。F 从保存状态继续计算，D 提取要比较的终点。ρD 是恢复该终点的最小成本，ρstate 是恢复完整参考状态 h 的最小成本。两者的 C(S) 使用同一规定单位，例如替换块数或实测计算时间；无可行方案时，最小值记为 +∞。

ρD=min⁡S∈RD(F(RS))=D(F(h))C(S)\rho_D=\min_{\substack{S\in\mathcal R\\D(F(R_S))=D(F(h))}}C(S)
ρstate=min⁡S∈RRS=hC(S)\rho_{\mathrm{state}}=\min_{\substack{S\in\mathcal R\\R_S=h}}C(S)
ρD≤ρstate\rho_D\le\rho_{\mathrm{state}}

With the same admissible edits, cost function and fixed deterministic continuation, full-state recovery is sufficient for endpoint recovery. This inclusion establishes the inequality.在相同允许编辑、成本函数和固定确定性后续计算下，完整状态恢复足以恢复终点，因此得到这个不等式。

04Restore the execution state恢复执行状态If incorrect values have already been used, return to the pre-read state and continue with trusted results.如果 Agent 已经读过错误结果，就回到读取之前保存的状态，再使用可信结果继续分析。

The agent’s decision is a = π(H). Here π is its decision procedure, and H includes the visible history, tool-derived variables and prepared decisions. Let H₀ be the saved state before reading a score table. Φ(H, p) denotes continuation from execution state H with score table p available to the tools.Agent 不只依赖眼前的文件，还会使用此前读到的信息和已经生成的变量、名单。我们用 H 表示这些执行状态，用 π 表示 Agent 据此作出决策的过程，即 a = π(H)。H₀ 是读取分数表前保存的状态。Φ(H, p) 表示从执行状态 H 继续分析，此时工具可读取的分数表为 p。

Hc=Φ(H0,pc),a=π(Hc)H_c=\Phi(H_0,p^c),\qquad a=\pi(H_c)

The vector pᶜ is the faulty score table; p⋆ is its trusted reference. File replacement makes the trusted table available, but the agent continues from Hc, the execution state formed using the faulty table:pᶜ 是故障分数表，p⋆ 是可信参考表。只替换文件后，工具可读取的表格已换成可信参考，但 Agent 仍从使用故障表后形成的执行状态 Hc 继续分析：

(pc,Hc) ⟶ (p⋆,Φ(Hc,p⋆))(p^c,H_c)\ \longrightarrow\ (p^\star,\Phi(H_c,p^\star))

Execution-state restoration returns to H₀ and continues with the reference table:恢复执行状态则先返回读取前的 H₀，再使用同一份参考表继续分析：

(pc,Hc) ⟶ (p⋆,Φ(H0,p⋆))(p^c,H_c)\ \longrightarrow\ (p^\star,\Phi(H_0,p^\star))
0 / 39changed decisions recovered by file replacement只替换文件：被改变的决策恢复数
39 / 39changed decisions recovered by state restoration恢复执行状态：被改变的决策恢复数

The final decision is checked against the certified result. Under state restoration, all 102 requests submitted decisions that matched the reference: 39 changed decisions were recovered, and the other 63 remained unchanged.最终决策仍需与认证结果核对。在状态恢复条件下，102 个请求提交的决策全部与参考一致：39 个被改变的决策复原，其余 63 个保持不变。

05Check the final decision核对最终决策Check the final selection or testing assignment against the certificate and current inputs.核对最终名单或检测分配是否与认证结果一致，并确认它依据的是当前数据。

𝒰 contains the score vectors permitted by valid numerical evidence. acert is the single decision shared by all of them. a is the actual final decision.𝒰 包含有效数值证据允许的分数向量，acert 是这些向量共同给出的唯一决策。a 是实际最终决策。

p⋆∈U,g(U)={acert},a=acert⟹a=g(p⋆)\begin{gathered}p^\star\in\mathcal U,\quad g(\mathcal U)=\{a_{\mathrm{cert}}\},\quad a=a_{\mathrm{cert}}\\ \Longrightarrow\quad a=g(p^\star)\end{gathered}

Certification requires three checks: the score vectors permitted by valid evidence include the trusted reference; the rule gives the same decision throughout that set; and the submitted decision matches that result. If the agent has already used incorrect values, their effects on its history, variables and previously prepared decisions must also be addressed. Before recording the final decision, the system checks the certified result and the current input data again.认证需要确认三件事：有效证据允许的分数范围包含可信参考；规则对这个范围内的分数都给出同一决策；系统最终提交的决策与它一致。如果 Agent 已经使用过错误数值，还需要处理历史记录、变量和此前决策中保留的影响。记录最终决策前，系统会再次核对认证结果和当前输入数据。

In the hERG single-request experiment, every certificate came from full trusted recomputation.在 hERG 单请求实验中，每份证书均来自全量可信重算。

Extension: AdamW and all-reduce扩展阅读：AdamW 与 all-reduce

State and communication状态与通信

AdamW and all-reduce carry errors forwardAdamW 与 all-reduce 中的误差传播

Here, zₜ = (θₜ, mₜ, vₜ) denotes the components varied in the restoration experiments: parameters and AdamW moments. The remaining state, including counters, hyperparameters, random state and the sample stream, is matched across the compared continuations. Future computations depend on this state, not just the current predictions.这里 zₜ = (θₜ, mₜ, vₜ) 只表示恢复实验中改变的分量：参数与 AdamW 的一阶矩、二阶矩。其余状态，包括计数器、超参数、随机状态和样本流，在各条对比的后续计算中保持对应一致。未来计算依赖这些状态，而不只是当前预测。

In this section, t indexes optimizer updates. θt denotes model parameters, mt and vt the first- and second-moment accumulators, and 𝒯t the update map with the stated settings. 本节中的 t 是优化器更新步数。θt 是模型参数，mt、vt 分别是一阶矩和二阶矩累积量，𝒯t 是规定设置下的更新映射。

zt=(θt,mt,vt),zt+1=Tt(zt,γˉt)z_t=(\theta_t,m_t,v_t),\qquad z_{t+1}=\mathcal T_t(z_t,\bar\gamma_t)

For an averaged all-reduce, captured local-gradient residuals contribute through their sum:对取平均的 all-reduce，捕获的局部梯度残差通过求和传播：

N counts the gradient contributions in the average and j indexes a contribution. γt,j is its gradient at update t, δt,j its captured candidate-minus-reference residual, and γ̄t the averaged gradient. Δγ̄t denotes the change in that average.N 是平均运算中的梯度贡献数量，j 是贡献索引。γt,j 是第 t 步对应的梯度，δt,j 是捕获的候选梯度减参考梯度的残差，γ̄t 是平均梯度，Δγ̄t 表示该平均值的变化。

γˉt=1N∑j=1Nγt,j,Δγˉt=1N∑j=1Nδt,j\bar\gamma_t=\frac1N\sum_{j=1}^{N}\gamma_{t,j},\qquad \Delta\bar\gamma_t=\frac1N\sum_{j=1}^{N}\delta_{t,j}

The second relation describes the idealized pre-clipping residual contribution; reduction-rounding differences are checked separately. The experiments replay captured gradient differences before reduction.第二式描述裁剪前的理想化残差贡献，归约舍入差异另行核对。实验在归约前回放捕获的梯度差异。

Experimental results and data sources实验结果与数据来源
Experiment实验Decision result决策结果Other observations同时观察到的结果
Molecular ranking分子排序One restored score recovers the full Top-10 order; reverse transplantation reproduces the changed order.恢复一个分数即可恢复完整 Top-10 顺序；反向移植重现改变后的顺序。55 other scores still differ.仍有 55 个其他分数不同。
Compound-activity ranking化合物活性排序Replacing two blocks recovers Top-20 membership in both confirmation captures.只替换两个块，两次确认捕获都恢复了 Top-20 成员。After replacing two complete blocks, 98.32% and 98.52% of the differing activation entries remain.替换两个完整块后，仍有 98.32% 和 98.52% 的激活差异未被改动。
hERG testing assignmenthERG 检测分配After R1, M additionally recomputes 68 of 2,009 compounds. Both rule outputs recover in all 16 fault sources.R1 之后，M 在 2,009 个化合物中追加重算 68 个。16 个故障来源的两种规则输出均恢复。All 96 fresh Biomni trajectories on the repaired scores reproduce the healthy reference decisions.使用修复后分数新运行的 96 条 Biomni 轨迹，全部复现健康参考决策。
Distributed training分布式训练In one continued-training run with eight processes across two nodes, all 1,017 predictions differ while Top-20 membership and order agree.在一次 8 进程、2 节点的继续训练中，全部 1,017 个预测不同，但 Top-20 成员与顺序一致。All 63 stored FP32 losses also agree bit for bit.记录的 63 个 FP32 损失也逐位相同。
AdamW / distributed gradientsAdamW／分布式梯度In delayed-restoration tests, all 16 complete-state configurations recover future endpoints and post-restoration logs.在延迟恢复实验中，16 个完整状态恢复配置全部恢复未来终点及恢复后的日志。Partial restoration recovers membership in 30/32 configurations, while full order and numerical state still differ.部分恢复在 30/32 个配置中恢复了名单成员，完整排序与数值状态仍有差异。

Sources: paper and supplementary material, Appendices C (coordinate interventions and recovery cost), D (optimizer state and distributed gradients), and I (hERG recovery and commitment).依据：论文及补充材料，附录 C（坐标干预与恢复成本）、D（优化器状态与分布式梯度）、I（hERG 恢复与提交）。

02Method方法

Restore or transplant values at their original coordinates在原始坐标上恢复或移植数值

We study silent data corruption observed during distributed training. Erroneous outputs without NaN (not-a-number) or Inf (infinity) can pass ordinary monitoring and reach a tool result. Case 1 faults appear more often on tested large-matrix paths; Case 2 faults also appear on short probes.我们研究分布式训练中观察到的 GPU 静默数据损坏。未出现 NaN（非数值标记）或 Inf（无穷大）的错误输出，可能通过常规监测并进入工具结果。Case 1 在所测试的大矩阵路径上比短探针更常出现异常；Case 2 也在短探针中出现异常。

With inputs, model, representation and document order matched, BioAgent-DF saves a reference state h and a candidate state c at the same computation site. The remaining tool and agent steps run on healthy hardware, and repeated reference runs (H1, H2) measure the agent’s own variation.在输入、模型、数值表示与文档顺序匹配的条件下，BioAgent-DF 在同一计算位置保存参考状态 h 和候选状态 c。其余工具步骤与 Agent 推理在健康硬件上继续执行；重复参考运行 H1、H2 用于测量 Agent 自身的变化。

Coordinate interventions compare the same captured values in two directions; the recovery-cost formulation distinguishes recovering a decision from restoring every value.坐标干预从两个方向检验同一组数值差异；恢复成本定义区分恢复决策与恢复全部数值。

Three panels. (a) A training cluster with a silent fault produces paired reference and anomalous executions; their captured states h and c are combined by restore or transplant and continued on healthy hardware. (b) The RTX PCIe server and the eight-GPU NVLink/NVSwitch server, with single-node and dual-node layouts. (c) Flow from stored state to predictions and scores, then to decisions and task metrics, with an arithmetic contract checking the execution. Enlarge放大
Figure 3. Tool-state interventions and computing platforms. (a) Paired states supply original-coordinate restoration and transplantation on healthy hardware. (b) The PCIe and NVLink/NVSwitch layouts indicate computing roles and participation. (c) Arithmetic checks, stored states, selected objects and task metrics are recorded separately.图 3｜工具状态干预与计算平台。（a）配对状态用于在原始坐标上进行恢复和移植，并在健康硬件上继续计算。（b）PCIe 与 NVLink／NVSwitch 布局说明不同设备的计算角色。（c）分别记录算术检查、保存状态、入选对象与任务指标。

03Mechanism机制

Selection turns small residuals into discrete changes排序竞争使细小残差改变入选对象

Tool outputs determine which items an agent can inspect, and selection is a competition. An unchanged score can still matter: for SciFact claim 684, one relevant document with an unchanged score leaves the top five after three competitors change, and restoring or transplanting any two competitor scores eliminates or reproduces the Recall@5 loss.工具输出决定 Agent 可以检查哪些对象，而选择取决于对象之间的竞争。对于 SciFact 声明 684，三个竞争文档的分数改变后，一个自身分数未变的相关文档退出前五名；恢复或移植任意两个竞争文档的分数，即可消除或重现 Recall@5 的下降。

Recombining captured residuals across a panel of eight executions keeps each call’s values but changes which differences occur together. Of 4,096 recombined executions, 29 produce lists absent from their source group, and the BF16 score grid with a lower-index tie rule explains all 1,024 enumerated combinations.在八次计算之间重组捕获的残差，保留每次调用的数值，但改变哪些差异共同出现。4,096 次重组计算中，有 29 次产生了其来源组中未出现过的名单；BF16 分数间隔及较小索引优先的平局规则可以解释全部 1,024 个穷举组合。

Error decomposition误差分解

ΔMSE=2 mean⁡(e δ)+mean⁡(δ2)\Delta\mathrm{MSE} = 2\,\operatorname{mean}(e\,\delta) + \operatorname{mean}(\delta^{2})

With reference error e and candidate-minus-reference difference δ on the same evaluation rows, when the two have opposite signs, MSE can fall even though the selection changes.在相同评价对象上，e 表示参考预测误差，δ 表示候选预测减参考预测；两者方向相反时，即使名单改变，均方误差 MSE 也可能降低。

Four panels. (a) Call-wise recombination of residuals yields 24 of 512 new memberships in the earlier group and 5 of 512 in the later group. (b) Exhaustive enumeration of 512 combinations per group, split by whether candidates 839 and 840 enter. (c) Two block switches and one tie rule determine which candidates enter. (d) The MSE change decomposed into an alignment term and a squared-difference term over separate decision and evaluation domains. Enlarge放大
Figure 4. Recombination and competition. Finite combinations of captured residuals explain candidate membership and its relation to prediction error. The MSE panel shows the cross term and squared-difference term.图 4｜残差重组与排序竞争。对捕获残差的有限组合进行分析，解释候选成员变化及其与预测误差的关系。MSE 面板给出交叉项与差异平方项。

04Metrics指标

Identical losses and metrics can hide changed states损失与指标相同，内部状态仍可能不同

An eight-process, two-node training continuation records 63 bitwise-identical FP32 losses with synchronized replicas, yet 30,411 parameters, 60,025 first moments, 105,921 second moments and all 1,017 FP64 predictions differ from the reference.一次 8 进程、2 节点的继续训练，副本保持同步，记录的 63 个 FP32 损失逐位相同，但 30,411 个参数、60,025 个一阶矩和 105,921 个二阶矩条目以及全部 1,017 个 FP64 预测均与参考不同。

The direction of an effect can also depend on the healthy reference: the change in test RMSE reverses sign between RTX and NVLink environments. In SciFact, four of five new captures change which documents are retrieved while every query’s relevance-label sequence, Recall@5 and nDCG@10 stay the same.效应方向还可能取决于所用健康参考：测试集 RMSE 的变化在 RTX 与 NVLink 环境之间出现相反符号。SciFact 的五次新捕获中，有四次改变了检索文档，但每个查询的相关性标签序列、Recall@5 与 nDCG@10 都保持不变。

Three panels. (a) Optimizer-state divergence: FP32 losses show zero difference at all 63 updates while up to 105,921 parameter and moment entries differ. (b) Change in test RMSE for five treatments, with opposite signs on the RTX and NVLink servers. (c) SciFact document exchanges across five sources, with Recall@5 = 0.525 and nDCG@10 = 0.4636 in every condition. Enlarge放大
Figure 5. Numerical and task endpoints. (a) State divergence with unchanged losses. (b) Reversal of RMSE direction across healthy environments. (c) Document changes with unchanged relevance labels.图 5｜数值终点与任务终点。（a）损失不变时内部状态仍出现差异。（b）RMSE 的变化方向在健康环境之间反转。（c）检索到的文档改变，但相关性标签保持不变。

05SciFact claim 431SciFact 声明 431

Same verdict, different cited evidence结论不变，引用的证据变了

This mechanism study selected 27 Case 2 capture-claim combinations, covering 11 claims, because their upstream Top-10 retrieval lists had already changed.

Claim 431 states that FoxO3a activation in neuronal death is mediated by reactive oxygen species. Replayed to the same Gemma 3 4B IT model on healthy hardware, the reference state leads the agent to cite a sentence about ROS and autophagy (19922508/3), and the candidate state a sentence on ROS sensing microbe size (22696649/1). Neither sentence supports the stated FoxO3a mechanism and neither matches the annotated evidence (28937856/5), yet both branches return the SUPPORT label that matches the benchmark annotation.

All 27 selected combinations were rerun in eight further batches with the request seed fixed. Three Qwen3.5-4B combinations show the same citation change in every batch; four Gemma 3 4B IT combinations show the same read and citation change. H1, H2 and full restoration agree, and verdicts do not change. These seven combinations involve only claims 431 and 729.

机制实验选取了 27 个 Case 2 捕获与声明的组合，覆盖 11 条声明，筛选依据是上游 Top-10 检索列表已经发生变化。

声明 431 讨论神经元死亡中由活性氧介导的 FoxO3a 激活。在健康硬件上回放给同一 Gemma 3 4B IT 模型时，参考状态让 Agent 引用关于活性氧与自噬的句子（19922508/3），候选状态让它引用关于活性氧感知微生物大小的句子（22696649/1）。两句话都不支持声明中的 FoxO3a 机制，也都不是标注证据（28937856/5），但两条轨迹均给出与基准标注一致的 SUPPORT 标签。

固定请求种子后，全部 27 个筛选组合又运行了八批。Qwen3.5-4B 有三个组合在每批中都出现相同的引用变化，Gemma 3 4B IT 有四个组合出现相同的读取与引用变化；H1、H2 和全量恢复相互一致，结论标签未改变。这七个组合仅涉及声明 431 和 729。

Without selecting for an upstream change不按上游变化筛选时

In a separate, unselected set of Qwen runs, 382 of 421 groups completed every condition with the agent reading the tool result; the other 39 were incomplete or the agent did not read the result. Disagreements between candidate and reference runs were no greater than disagreements between healthy repeats (paper Table 2).在另一组未经筛选的 Qwen 运行中，421 组里有 382 组各条件均完成，且 Agent 读取了工具结果，其余 39 组未完成或未读取结果。候选状态相对参考状态的差异不高于健康重复之间的差异（论文表 2）。

Groups that differ, among the same 382 groups同一批 382 个完成且已读取结果的组中，发生差异的组数
Endpoint比较项C vs H1C 与 H1H2 vs H1H2 与 H1
Documents read读取的文档3/3824/382
Cited sentences引用句子5/3828/382
Verdict结论标签2/3822/382

C is the candidate state; H1 and H2 repeat the healthy reference state. All confidence intervals for the excess disagreement rate relative to healthy repeats include zero. Separate unselected controls for claims 350 and 1180 also showed no read, citation or verdict changes in their completed comparison subsets; baseline Gemma completed only claim 350.C 为候选状态，H1 与 H2 为健康参考状态的重复运行。候选与参考的差异率减去健康重复差异率，所得差值的置信区间均包含零。另行设置的未筛选声明 350 与 1180 对照，在已完成的比较子集中也未出现读取、引用或结论变化；基线 Gemma 完成的子集仅覆盖声明 350。

Record the evidence and experimental choices behind a result, and compare their changes with healthy-repeat variation.记录结果背后的证据与实验选择，并将其变化与健康重复的波动比较。
Tool-state replay for SciFact claim 431. Reference (H) and candidate (C) tool states go to the same agent model on healthy hardware. H selects document 19922508, sentence 3, on autophagy; C selects document 22696649, sentence 1, on microbe size. Both return the correct SUPPORT label, and neither cites the annotated document 28937856, sentence 5. Lower panels show restoration and transplantation at the same coordinates, and the three evaluation endpoints: tool execution completion, evidence-path fidelity and verdict correctness. Enlarge放大
Figure 6. The same verdict from different cited evidence. (a) Reference and candidate tool states are supplied to the same agent model on healthy hardware. Claim 431 concerns ROS-mediated FoxO3a activation in neuronal death. Gemma’s reference branch cites a sentence about ROS and autophagy (19922508/3), and its candidate branch cites ROS sensing microbe size (22696649/1). Neither sentence supports the stated FoxO3a mechanism, yet both branches return the SUPPORT label that matches the benchmark annotation. Neither citation matches the annotated evidence, 28937856/5. Sentence indices are zero-based and document identifiers are SciFact IDs. (b) Restoration and transplantation select values at their original coordinates. (c) Tool execution completion, evidence-path fidelity, and verdict correctness are evaluated. H1 and H2 repeat the same reference state.图 6｜结论相同，引用证据不同。（a）参考与候选工具状态提供给健康硬件上的同一 Agent。声明 431 涉及神经元死亡中活性氧介导的 FoxO3a 激活。Gemma 的参考轨迹引用活性氧与自噬的句子（19922508/3），候选轨迹引用活性氧感知微生物大小的句子（22696649/1）。两句话均不支持该 FoxO3a 机制，也不匹配标注证据 28937856/5，但两条轨迹均返回与基准标注一致的 SUPPORT 标签。句子索引从零开始，文档编号为 SciFact ID。（b）恢复与移植选取原始坐标上的数值。（c）分别评价工具执行完成、证据路径保真与结论正确性。H1、H2 重复使用同一参考状态。

Citation引用

BibTeX

@misc{yi2026toolstate,
  title         = {From Tool State to Scientific Action: Auditing Decision
                   Provenance in Biomedical Research Agents},
  author        = {Yi, Xingyu and Zhang, Xinya and Zhou, Yunshen and Bao, Haoyu},
  year          = {2026},
  eprint        = {2611.01527},
  archivePrefix = {arXiv},
  primaryClass  = {cs.AI},
  url           = {https://arxiv.org/abs/2611.01527}
}
Original原图