PaperlayerView exact revision on arXiv

Source-linked AI summary

Same Patient, Different Order: Action-Level Reliability of Clinical LLM Agents Under Repeated Runs

Rohith Reddy Bellibatlu, Manpreet Singh, Zhoutian Han, Wenbin Zhang

arXiv:2609.13582v1cs.CLcs.AIcs.LGcs.SE

TL;DR

Clinical-agent benchmarks commonly report single-run verdicts, leaving action consistency across identical inputs unmeasured. This paper replays fixed tasks and compares orders, finding action-level divergence across measured arms and that verdict changes occur less often than order changes.

  • Problem

    Clinical-agent benchmarks commonly score a single run, while agreement measures for scalar or string outputs do not compare orders, destinations, or omitted actions.

    Source: §1 · p. 2, §2 · p. 3

  • Method

    Same-input rerun replays each task five times with inputs fixed and compares requests across action and run-level reliability measures.

    Source: §1 · p. 2, §4 · p. 4

  • Results

    Action-level divergence appears in every measured arm, and order-set divergence and omission rise with temperature in both tested models.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The findings support repeated-run evaluation, action-level stability reporting, and environment feedback that matches record-server behavior.

    Source: §10 · p. 9

    Because the benchmark forwards no writes and the panel's rates do not generalize, the findings concern issued orders rather than orders received.

    Source: §9 · pp. 8–9

Abstract

from arXiv · show

A clinical agent benchmark can report the same verdict on identical inputs while the agent files a materially different order on each run. Such agents order tests, request medications and place referrals, yet benchmarks typically score one run per task and rarely ask whether identical inputs produce identical actions; MedAgentBench, the benchmark we use, scores a single attempt and says so. To measure this gap we introduce "same-input rerun", which replays a task with every input held fixed and compares the orders rather than the score, with six reliability metrics, and apply it to 1000 MedAgentBench runs across 50 tasks from its five write-capable families, two open-weight models below ten billion parameters quantised to four bits, and two temperatures. The study establishes that action-level divergence exists and can pass unrecorded by the score, not that any rate generalises. Under the 8B model at temperature 0.7, all 43 ordering groups emit a different set of orders across five identical runs, 26 emit the order on some runs and not others, and 28 record a different coded value, dose or analyte. In 22 of those 43 the benchmark reports the same failing verdict for materially different behaviour, as it does for all 10 divergent groups of the 4B model at 0.7. Orders also reach different endpoints across runs, one of which the record server rejects while the agent is told it succeeded. These findings motivate repeated-run evaluation, action-level stability reporting and execution-faithful environment feedback in clinical-agent benchmarks.

1. Introduction

Clinical-agent benchmarks often report a single verdict, although these agents issue orders whose consistency that score does not measure. This paper proposes fixed-input reruns and action-level measures, finding that orders diverge more often than verdicts change.

1. Introduction

  • Benchmarks commonly score one run per task, recording correctness but not whether an agent's actions remain consistent across identical inputs.For an agent that writes orders, the output is an action, not merely an answer.Source: §1 · p. 2
  • Same-input rerun replays each task five times with inputs fixed, comparing which resource was posted, where it was sent, and whether it was posted.The paper proposes rerunning tasks, reporting action-level stability beside accuracy, and making environment feedback match record-server behavior.Source: §1 · p. 2
  • Meaningful comparison requires defining when orders count as the same, checking requests against the record server, and accounting for rerun budgets and dependent groups.The paper identifies these as three difficulties shaping its methods.Source: §1 · p. 2
  • Action-level divergence appears in every measured arm, and order-set divergence and omission both rise with decoding temperature in the two tested models.Verdicts change less often than orders do in every arm.Source: §1 · p. 2
  • The proposed reporting framework pairs six reliability metrics with interval estimates, matched-group tests, family-level bootstrap checks, and one measure checked against the record server.Four metrics read the orders and two read the runs that produced them.Source: §1 · pp. 2–3

2. Background

Prior repeatability work often studies clinical answers or scalar scores, while agent reliability work has begun to examine tools and task success. The paper identifies a gap in comparing the orders themselves across identical clinical-agent runs.

2. Background

  • Clinical repeatability studies cover examinations, notes, licensing and rare-disease items (Shyr et al., 2025; G¨urses et al., 2026), and triage.These studies assess single-turn outputs.Source: §2 · p. 3
  • Existing medical studies and agreement measures address scalar or string outputs, not orders sent to wrong endpoints or actions never issued.The paper distinguishes action-level reliability from work on passk, which evaluates whether all trials succeed (Yao et al., 2024).Source: §2 · p. 3
  • Agent work has examined repeated tool calls outside medicine (Yagubyan, 2026), while a clinical FHIR study compares task success rather than payloads or field values.The paper says none of these compares the order's payload, destination, and returned verdict across identical runs.Source: §2 · p. 3
  • Related work also studies evaluation fairness (Morla et al., 2026), prompt-sensitive automated judges (Bellibatlu et al., 2026a), identity errors, and score-to-deployment divergence.The paper distinguishes its fixed reference grader from model-based judges.Source: §2 · p. 3

3. Environment

The study uses MedAgentBench's five write-capable task families and its FHIR record environment. Its benchmark loop checks write requests but does not send them to the record server.

3. Environment

  • MedAgentBench provides 300 tasks in ten families, with five families that can involve a write and are used in this study (Jiang et al., 2025).Those families cover observations, service requests, and conditional orders, including medication paired with a service request.Source: §3 · p. 3
  • A revised MedAgentBench scaffold changes the prompt, examples, memory, and tools while leaving the environment unchanged.That version reports 91% success with GPT-4.1; this study uses the original scaffold.Source: §3 · p. 3
  • The authors ran the extracted HAPI FHIR server locally and released the reproduction script and resource counts.They report two departures from the reference implementation: retained agent message roles and GET responses truncated at 6000 characters.Source: §3 · p. 4
  • The benchmark sanity-checks POST payloads as JSON and tells the agent they succeeded, but does not forward writes to its record server (Jiang et al., 2025).Across 1000 runs, the store still held zero of the 189 emitted ServiceRequest payloads.Source: §3 · p. 4

4. Protocol and metrics

Same-input rerun holds task, model, and decoding configuration fixed across five runs, then compares actions and run behavior. The protocol defines six measures and reporting choices that address changing denominators and rerun budgets.

4. Protocol and metrics

  • For each fixed task, model, and decoding configuration, the protocol runs the agent five times with identical inputs and compares the requests.The task serves as its own control because case, prompt, and environment do not change.Source: §4 · p. 4
  • Four action-level measures use ordering groups: tasks with at least one order in any run, whose denominator can differ by arm.Trajectory and verdict measures instead use all groups.Source: §4 · p. 4, Table 1 · p. 5
  • Order-set divergence counts distinct canonical sets of endpoint and full payload across runs; an empty set makes an omitted order count as a difference.Omission split separately marks groups with at least one emitting and one non-emitting run.Source: §4 · p. 4
  • Endpoint divergence compares destinations among emitting runs, excluding non-emitting runs so omissions alone cannot trigger it.The paper reports it separately because destination and payload errors need different fixes.Source: §4 · p. 4
  • Trajectory divergence records the first turn where runs stop agreeing, while verdict instability records whether benchmark pass/fail changes across runs.Trajectory comparisons sort query parameters before checking agreement.Source: §4 · pp. 4–5
  • Clinical-content divergence compares codes, values, medication details, and dose fields, excluding timestamps, workflow status, labels, and non-emitting runs.The syntactic comparison can count clinically equivalent codings as divergent, which can only inflate the rate.Source: §4 · pp. 4–5
  • Pairwise order-set disagreement reports the share of within-group run pairs that differ, offering a measure that can be compared across rerun budgets.The paper contrasts this with an at-least-once rate, which can only rise as more runs are added.Source: §4 · p. 5
  • Rates use Wilson 95% intervals and paired exact McNemar tests; family-cluster bootstrap intervals with two or three clusters are treated as robustness checks.The tests use all 50 groups, and the six corrected comparisons cover one quantity per comparison layer per model.Source: §4 · p. 5, Table 1 · p. 5

5. Experimental setup

The experiment crosses two locally served, four-bit open-weight models with two decoding temperatures on the same 50 tasks. It uses repeated runs and stack controls to characterize action variability within a deliberately limited model and task panel.

5. Experimental setup

  • Four fully crossed arms use Qwen3-4B and Llama-3.1-8B at temperatures 0.05 and 0.7 on the same 50 tasks.The models are open-weight, instruction-tuned, locally served, and quantised to four bits.Source: §5 · p. 6
  • 0.05 and 0.7 replace the benchmark’s temperature 0 because greedy decoding on this stack is exactly reproducible.MedAgentBench scores a single attempt at temperature 0.Source: §5 · p. 6
  • 4 of 12 greedy cells produce multiple completions under concurrent server traffic, although every matched serial cell returns one completion.The observed change is in completion text rather than orders; a fixed seed repeats one draw across five runs.Source: §5 · p. 6
  • 1,000 runs cover the first ten identifier-ordered tasks in each of five families, with five runs per task and 250 runs per arm.Each family contains 30 tasks; the round limit is eight.Source: §5 · p. 6
  • Greedy decoding is exactly reproducible in the serial noise-floor control, whether seeded or unseeded.The control uses 20 identical calls per cell across 18 cells; the passage attributes downstream variation to decoding configuration rather than infrastructure.Source: §5 · p. 6

6. Is endpoint divergence cosmetic?

The two tested FHIR destinations behave differently for an identical ServiceRequest payload. The benchmark’s runtime reply can report success even when the record server rejects the write.

6. Is endpoint divergence cosmetic?

  • 201 Created at the typed endpoint creates the resource, while the collection root returns 400 Bad Request for the identical payload.The root endpoint returns HAPI-0450, “Failed to parse request body as JSON resource.”Source: §6 · p. 6
  • The endpoints are not interchangeable: one places the order and the other does not.The benchmark does not execute writes, but the agent receives only a success reply for any payload that passes its JSON-loadability check.Source: §6 · p. 6
  • The runtime reply can conceal a rejected write because it reports success regardless of destination.The benchmark discloses to human readers that writes are not executed; the agent’s runtime surface carries no trace of that distinction.Source: §6 · p. 6

7. Results

Across the tested arms, order divergence and omission rise with sampling, while clinical-content divergence appears in one arm. Materially different orders can retain the same verdict, and the observed rates do not establish generalisation.

7. Results

  • Order-set divergence and omission rise with temperature in both models, while clinical-content divergence appears in only one arm.Endpoint divergence is an exception: its Llama rate falls as the ordering-group base grows, although its count rises from 8 to 12.Source: §7 · p. 6, Figure 2 · p. 7
  • Trajectory divergence exceeds order-set divergence in both Qwen arms and matches it in both Llama arms; median first-divergence is zero in three of four arms.The median never exceeds four.Source: §7 · pp. 6–7
  • Paired task-group tests find temperature-related increases significant, but family-level tests cannot establish significance and the study rests no claim on it.The task-group tests assume independence despite family clustering; only one to four families move in each test.Source: §7 · p. 7
  • The higher Llama divergence rates do not establish a model difference: clustered rates overlap, and no cross-model test was run.The reported rates belong to specific models and configurations.Source: §7 · p. 7
  • In Llama sampling, 28 of 43 ordering groups changed clinical-content fields, including resource codes, recorded values, medication, or dose.The count compares runs that emitted orders, so omissions do not explain these differences; no other tested arm showed clinical-content divergence.Source: §7 · p. 7
  • In Llama sampling, 22 of 43 divergent groups had changing orders but stable verdicts across identical runs, spanning five write families; Qwen sampling showed this in 10 of 10 groups.Across four arms, 36 of 38 such groups failed on all five runs.Source: §7 · p. 7
  • The study shows inconsistent failures, not inconsistent success: no group both passed every run and changed what it ordered.The authors note that demonstrating inconsistent success would require a stronger panel.Source: §7 · p. 8
  • Family clustering weakens broad rate claims: two arms’ intervals widen to [0.00, 1.00], while only Llama sampling has all five ordering families diverge.Qwen’s temperature effect is concentrated in service requests; its observation tasks never diverge and its other three families never order.Source: §7 · p. 8

8. What this suggests for benchmark design

The authors propose three independent benchmark changes: repeat tasks, report action-level stability, and make environment feedback reflect actual record-system behavior.

R1. Rerun, and say so

  • Rerun each task and report that repetition, since one attempt cannot show whether an incorrect action recurs.The authors note that guidance for single-turn evaluation already suggests at least two runs.Source: §8 · p. 8

R2. Report an action-level stability measure

  • Report an action-level stability measure, preferably pairwise order-set divergence, which remains comparable across rerun budgets.Order-set divergence and omission splits can be computed from transcripts benchmarks already store.Source: §8 · p. 8

R3. Let the environment answer as the real system would

  • Have the environment respond as the real system would, so rejected requests are not reported to the agent as executed.The authors argue that a refused write needs no reset and would make misrouting visible to the agent and score.Source: §8 · p. 8

9. Limitations

The study measures issued actions in one benchmark and serving setup, not the outcomes of writes received by a record server or deployment safety.

Limitations

  • The benchmark forwards no writes, so the findings concern orders issued rather than orders received and do not establish clinical-agent deployment safety.The authors explicitly distinguish emitted actions from executed writes.Source: §9 · p. 8
  • The rates are bounded to the original scaffold, one benchmark and serving stack, and two four-bit open-weight models below ten billion parameters.Tasks are a family prefix rather than a random sample, potentially underrepresenting harder tasks if difficulty rises with identifier order; the authors say the protocol transfers, but the rates do not.Source: §9 · pp. 8–9

10. Conclusion

A single run can show whether an agent was right but not whether its actions are consistent; clinical-action benchmarks should measure orders as well as verdicts and reflect record-system behavior.

10. Conclusion

  • Clinical-action benchmarks should rerun tasks, measure orders alongside verdicts, and respond as the record system would.The conclusion contrasts one-run correctness with action consistency.Source: §10 · p. 9

Appendix A. Paired-test discordance tables

  • Table 2 reports six paired tests over 50 task groups, with b and c denoting temperature-specific discordant groups used for the exact two-sided McNemar p-value.Groups that never order in either arm are concordant by construction for order-set divergence, but not for the other two measures.Source: Table 2 · p. 11

Appendix B. Implementation details

The appendix details the serving and harness setup, decomposes action divergence, and checks how results relate to model precision, trajectories, and serving variability.

Why the harness departs from the reference implementation

  • The harness preserves multi-turn roles and truncates GET responses at 6,000 characters; truncation occurred in only 7 of 72 non-emitting Llama-sampling runs.The authors report that 65 of those 72 runs saw the response in full; flattening dialogue had caused near-universal formatting failures in an earlier harness version.Source: Appendix B · p. 11

What order-set divergence is made of

  • In Llama sampling, 26 of 43 divergent groups include omission and 12 include misrouting; the remaining 10 differ in payload alone.The categories overlap on five groups; those five omit orders on some runs and vary destinations on the runs that emit.Source: Appendix B · p. 11

The eight-bit arm

  • Across the ten Qwen sampling groups divergent at four bits, all ten also diverge at eight bits, while failure mode shifts from endpoint divergence toward omission.Across all task groups, eight-bit Qwen orders in 22 versus 20 at four bits and diverges in 12 versus 10; endpoint divergence drops from 8 of 20 to none of 22, while omission rises from 4 of 20 to 12 of 22.Source: Appendix B · p. 12

The noise floor under batching

  • Changing batch traffic made four of twelve greedy cells irreproducible, while matched serial cells had only one distinct completion each.The target request and its inputs were held fixed; the authors attribute this variation to the serving stack, not the agent.Source: Appendix B · p. 12

Clinical-content divergence

  • Under Llama sampling, 28 of 43 groups differ in clinically coded content, including resource codes or recorded values, while display-label differences are excluded.The appendix gives a blood-pressure example with different LOINC codes and values, and a magnesium task where runs post either a MedicationRequest or an Observation.Source: Appendix B · pp. 11–12

Trajectory and comparison details

  • Trajectory divergence exceeds order divergence for Qwen, but the two measures coincide in both Llama arms; divergences often begin on the first agent turn.The first-divergence median is zero in three of four arms and never exceeds four; query-parameter sorting changes at most one divergent group per arm.Source: Appendix B · pp. 12–13

Appendix C. Divergence by task family

The appendix breaks pooled divergence rates down by task family, showing that the pooled figures summarize this task mixture rather than a general rate.

Appendix C. Divergence by task family

  • F3 records observations and F8 places service requests unconditionally, while F5, F9, and F10 order conditionally on laboratory values or result age.F9 pairs a potassium order with a follow-up draw; F5 concerns magnesium replacement, and F10 a repeat test.Source: Appendix C · p. 13
  • Pooled rates average across five task families with different ordering conditions, so they summarize this task mixture rather than a general rate.In conditional families, ordering nothing can be correct; neither Qwen arm orders in F5, F9, or F10, and F9 pass rates of 0.46 and 0.40 reflect correct withholding.Source: Appendix C · p. 13
  • Table 3 reports divergent order sets by family, with mean pass rates in parentheses; each family has ten task groups per arm, and a dash denotes no orders.Source: Table 3 · p. 13
Loading 2609.13582v1…