PaperlayerView exact revision on arXiv

Source-linked AI summary

The Marathon of Scientific Reasoning: Robustness of Scientific Agents to Perturbations in Multi-Turn Interactions

Xiaoting Lyu, Xinbo Ma, Yufei Han, Hangwei Qian, Ziyang Lin, Bin Wang, Bin Wang, Wei Wang

arXiv:2609.34537v1cs.AI

TL;DR

Scientific agents solve dependent multi-turn problems, but their reliability under scientifically plausible perturbations remains poorly understood. SCIARP benchmarks those perturbations through paired live executions and finds distinct robustness profiles, a capability–robustness gap, and failures that can remain hidden and propagate.

  • Problem

    How reliably can scientific agents solve multi-turn problems when plausible perturbations affect information and reasoning that later steps depend on?

    Source: §1 · pp. 1–2

  • Method

    SCIARP transforms 620 scientific problems into interdependent 3–13-turn tasks with 13 perturbation types and compares matched clean and perturbed live executions.

    Source: §1 · p. 2

  • Results

    Across eight LLMs, perturbation families show distinct robustness profiles, clean-task capability does not guarantee robustness, and failures may remain hidden and propagate across turns.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Evaluating scientific agents requires tracking both task outcomes and whether information and reasoning remain reliable throughout dependent interactions.

    Source: §1 · p. 2, §6 · p. 10

    The perturbations are predefined and task-conditioned rather than optimized against specific target systems.

    Source: ETHICS STATEMENT · p. 11

Abstract

from arXiv · show

Large language model (LLM)-based scientific agents are increasingly used for scientific problem solving, yet their robustness to imperfections arising during multi-turn interactions remains poorly understood. We introduce \textsc{SciARP} (\textbf{Sci}entific \textbf{A}gent \textbf{R}obustness to \textbf{P}erturbations), a benchmark for evaluating scientific agents under scientifically plausible perturbations throughout multi-turn problem solving. \textsc{SciARP} transforms 620 scientific problems into interdependent tasks of 3--13 turns and defines 13 perturbation types spanning problem understanding, evidence processing, reasoning, and conclusion formation. Clean and perturbed versions of each task are independently executed under matched settings, producing paired live trajectories for evaluating both task success and process reliability. Experiments across eight LLMs from four model families reveal three key robustness characteristics. First, different classes of scientific perturbations exhibit distinct robustness profiles and can decouple task progression from scientific reliability: agents may continue advancing through the task even after their information or reasoning has become unreliable. Second, stronger clean-task performance does not necessarily translate into stronger robustness, as models with higher clean-task accuracy can exhibit larger degradation under perturbation. Third, perturbation effects exhibit strong temporal dynamics: they may remain latent for multiple turns before emerging and subsequently propagate through downstream dependencies. Together, these findings show that current scientific agents remain insufficiently robust to scientifically plausible perturbations, with failures often remaining undetected, propagating, and resisting recovery.

1 INTRODUCTION

Scientific agents must preserve reliable information and reasoning across dependent turns, but their robustness to plausible, non-adversarial perturbations in those interactions remains underexplored. SCIARP evaluates this problem and finds distinct perturbation effects, a gap between clean-task capability and robustness, and failures that can remain hidden and propagate.

Motivation

  • Robustness to scientifically plausible perturbations during dependent multi-turn problem solving remains underexplored, despite reliability depending on information and reasoning carried between turns.Perturbations may arise in problem descriptions, evidence, reasoning, or conclusions, and may be corrected, remain latent, or propagate.Source: §1 · pp. 1–2

Benchmark gap

  • Existing benchmarks separately study scientific capabilities, single-input reasoning variations, or adversarial safety, leaving plausible perturbations in evolving scientific interactions insufficiently evaluated.Later decisions in these interactions depend on earlier information, and failures may emerge only after several dependent steps.Source: §1 · p. 2

SCIARP

  • SCIARP converts 620 verified problems into interdependent 3–13-turn tasks with 13 perturbation types and compares matched clean and perturbed live trajectories.It evaluates task success and process reliability, including when failures emerge, propagate, or recover.Source: §1 · p. 2

Findings

  • Across eight LLMs, perturbation families show distinct failure profiles, stronger clean-task performance does not ensure robustness, and failures can remain hidden and persist after propagation.Agents may continue advancing despite unreliable information or reasoning.Source: §1 · p. 2

2 RELATED WORK

Scientific-agent benchmarks increasingly assess multi-step analysis, discovery, and research workflows, while other benchmarks examine reasoning variations or adversarial agent settings. SCIARP focuses on scientifically plausible perturbations throughout dependent multi-turn problem solving and tracks reliability over the interaction.

LLM Agents for Scientific Reasoning and Discovery

  • Scientific-agent benchmarks cover data-driven analysis, discovery, biological-data workflows, interactive experimentation, open-ended research, and multi-step tool use.These benchmarks primarily assess capability and generalization within their task settings; NEWTONBENCH also examines robustness to observational noise.Source: §2 · pp. 2–3

Benchmark comparison

  • Table 1 compares SCIARP with representative scientific-agent benchmarks.The related-work discussion distinguishes capability-focused benchmarks from SCIARP’s focus on robustness during dependent multi-turn problem solving.Source: Table 1 · p. 3, §2 · p. 3

Robustness in LLM Reasoning and Agents

  • Reasoning-robustness benchmarks test controlled problem variations or synthetic prompt noise, while agent-safety benchmarks focus on adversarial interactions such as prompt injection and jailbreaks.Other work addresses multi-turn degradation, knowledge conflicts, and broader agent reliability dimensions.Source: §2 · p. 3

SCIARP’s focus

  • SCIARP differs by testing scientifically grounded perturbations across evolving multi-turn scientific processes and evaluating reliability changes over dependent turns.Its paired live execution and turn-level evaluation characterize performance degradation, failure onset, propagation, and recovery.Source: §2 · p. 3

3 PROBLEM FORMULATION

The paper formalizes scientific problem solving as a live, interdependent sequence of turns and defines perturbations as plausible deviations in task-relevant information. Paired clean and perturbed executions make it possible to trace how those deviations affect downstream reasoning and task success.

3.1 MULTI-TURN SCIENTIFIC PROBLEM SOLVING

  • A scientific task T pairs the original problem and its context with a verified reference solution used as ground truth.The paper writes this as T = (x, y∗).Source: §3.1 · p. 3
  • The task unfolds as an ordered interaction of T turns, each containing an input and a primary problem-solving stage.The stages are problem understanding, evidence processing, reasoning, and conclusion formation.Source: §3.1 · p. 3
  • The four stage labels describe each turn’s primary role, may recur rather than follow a fixed sequence, and cover interpretation, evidence, inference, and answer integration.Later turns may reuse earlier assumptions, evidence, calculations, or deductions.Source: §3.1 · p. 3
  • A scientific agent is an LLM-based system that solves tasks through sequential interaction, maintaining context and optionally invoking tools, producing a live trajectory of responses, tool activity, and final output.Each turn’s response and tool outputs may influence later decisions; trajectories are executed rather than synthesized from predefined reasoning traces.Source: §3.1 · p. 3

3.2 SCIENTIFIC PERTURBATIONS

  • A scientific perturbation is a scientifically plausible deviation introduced into task-relevant information during problem solving, using predefined, task-conditioned mechanisms rather than target-optimized attacks.Perturbations may affect problem descriptions, evidence, intermediate reasoning, or conclusions.Source: §3.2 · p. 4
  • SCIARP applies a perturbation to a clean task while preserving its scientific objective, then independently executes the same agent on both versions under matched settings.Comparing the resulting live trajectories characterizes effects on task success and how perturbations emerge, propagate, or are corrected through later reasoning.Source: §3.2 · p. 4

4 SCIARP BENCHMARK

SCIARP evaluates scientific agents under plausible perturbations across multi-turn problem solving, measuring both task success and process reliability. It organizes perturbations by problem-solving stage and builds validated, paired clean–perturbed tasks from established scientific problems.

4 SCIARP BENCHMARK

  • SCIARP assesses robustness at task and process levels, with clean and perturbed tasks independently executed under matched settings.Its principles target scientifically meaningful aspects of problem solving and assess both task success and process reliability.Source: §4 · p. 4

4.1 SCIENTIFIC PERTURBATION TAXONOMY

  • The taxonomy defines 13 perturbations across problem understanding, evidence processing, reasoning, and conclusion formation, targeting different stages rather than a fixed temporal order.Examples include altered terminology, units, symbols, or omitted conditions; invalid premises, citations, data, or conflicting evidence; inconsistent or misleading reasoning; and pressured or overconfident conclusions.Source: §4.1 · pp. 4–5

4.2 BENCHMARK CONSTRUCTION

  • The benchmark retains 620 verified, multi-step problems from four scientific benchmarks and transforms each into a 3–13-turn task with interdependent subtasks.Tasks preserve the original objective; an LLM planner structures turns around dependencies, and each task passes LLM and human validation.Source: §4.2 · p. 5
  • Perturbations are instantiated at valid, independently validated points, and clean and perturbed versions are run live on the same agent under matched settings.Paired trajectories allow perturbation effects to emerge immediately or after delay, propagate across dependent turns, or be corrected through later reasoning.Source: §4.2 · p. 6

4.3 ROBUSTNESS EVALUATION

  • Robustness evaluation combines end-to-end task accuracy with process measures of information correctness, task progression, and reasoning validity.Task success requires a ground-truth-matching final answer and a scientifically valid solution process; process measures assess information correctness, task advancement, and valid intermediate reasoning.Source: §4.3 · pp. 6–7
  • Process metrics assess turns from the first perturbation through the final turn, averaging turn judgments within tasks and then across tasks so different trajectory lengths contribute equally.Evaluation combines a fixed LLM evaluator with independent human assessment, counting a criterion as satisfied only when both agree.Source: §4.3 · pp. 6–7

5 EXPERIMENTS AND ANALYSIS

Matched clean–perturbed runs across eight models reveal distinct effects on task success and process reliability, while perturbation timing and repetition shape how failures emerge and persist.

5.2 OVERALL ROBUSTNESS UNDER SCIENTIFIC PERTURBATIONS

  • TACC degradation under E3 is 34.43%–52.66% across all eight models, while TP degradation is only 0.85%–3.82%.This illustrates that agents can continue task progression despite degraded scientific reliability.Source: §5.2 · p. 8
  • 96.41% clean TACC for GPT-5.6 exceeds GPT-5.5's 94.82%, yet GPT-5.6 degrades more under E1: 31.06% versus 21.29%.GPT-5.6 also has higher clean TACC than Claude Opus 5 (89.07%) but larger degradation (31.06% vs. 16.91%).Source: §5.2 · p. 8

5.3 PERTURBATION PROPAGATION AND RECOVERY

  • 74% of E2 and 58% of E3 failures emerge only after at least two subsequent turns, consistent with affected information surfacing when reused.The analysis tracks failure onset against paired clean trajectories and distinguishes local, recovered, and persistent downstream effects.Source: §5.3 · pp. 8–9
  • Only 17.1% of effects extending beyond their onset turn recover, while 82.9% persist to the final turn.Figure 3 summarizes onset delay, the first affected process dimension, and downstream outcome.Source: Figure 3 · p. 9, §5.3 · p. 9
  • IC is first affected in 80% of U4, 76% of E1, and 82% of E3 cases, while R2, R3, and C1 first affect RV, TP, and RV, respectively.The respective shares are 62% for R2, 66% for R3, and 84% for C1.Source: §5.3 · p. 9

5.4 IMPACT OF PERTURBATION CHARACTERISTICS

  • From early to late insertion, average ∆TACC rises from approximately 3.4% to 9.6% for U1, 3.7% to 10.9% for U2, and 30.6% to 37.3% for R3.The authors suggest later perturbations may leave less opportunity for verification, correction, or recovery.Source: §5.4 · p. 9
  • From n = 1 to n = 3, average ∆TACC rises from 59.20% to 76.20% for R1 and 44.78% to 72.47% for R3, while R2 rises from 87.71% to 90.09%.Repeated perturbations amplify some reasoning failures, whereas R2 is already severe after one occurrence.Source: §5.4 · p. 9

6 CONCLUSION

SCIARP evaluates scientific-agent robustness to plausible perturbations across multi-turn problem solving, finding variation across perturbations and models, a gap between clean-task capability and robustness, and failures that can remain hidden and propagate. The paper emphasizes evaluating process reliability throughout interactions, alongside final-answer accuracy.

6 CONCLUSION

  • SCIARP evaluates 620 verified problems as interdependent 3–13-turn tasks using 13 perturbation types and matched clean and perturbed live executions.It assesses both task success and process reliability.Source: §6 · p. 10
  • The authors conclude that robustness varies across perturbations and models, clean-task capability can diverge from robustness, and failures can remain hidden and propagate across turns.They argue for evaluation beyond final-answer accuracy and throughout the multi-turn process.Source: §6 · p. 10

AI USE STATEMENT

  • LLMs support task construction, perturbation generation, and evaluation, with generated materials and outputs reviewed under predefined criteria and metric-specific rubrics.Human quality control and assessment are combined with LLM-based procedures.Source: AI USE STATEMENT · p. 11

ETHICS STATEMENT

  • The study uses no private personal data or human participants as research subjects; human involvement is limited to benchmark quality control and output evaluation.The authors note that exposed failure examples could inform manipulation attempts, but the perturbations are predefined and task-conditioned rather than optimized for target systems.Source: ETHICS STATEMENT · p. 11

REPRODUCIBILITY STATEMENT

  • The paper specifies the task formulation, perturbation taxonomy, construction and execution procedures, metrics, experimental methodology, and appendix details needed to reproduce SCIARP.The appendix includes definitions and examples for all 13 perturbation types, applicability criteria, settings, and model-specific results.Source: REPRODUCIBILITY STATEMENT · p. 11

A DETAILED MULTI-TURN SCIENTIFIC TASK CONSTRUCTION

This section describes how verified scientific problems are transformed into validated, interdependent multi-turn tasks. A worked organic-chemistry example illustrates how intermediate results support later turns and the final solution.

A DETAILED MULTI-TURN SCIENTIFIC TASK CONSTRUCTION

  • The authors retain problems with available, independently verifiable reference solutions that require non-trivial multi-step reasoning, yielding 620 source problems.The original problems and verified solutions guide construction and quality validation.Source: A DETAILED MULTI-TURN SCIENTIFIC TASK… · p. 14
  • An LLM-based planner decomposes each verified solution into logically connected subtasks, grouping related operations and placing dependent steps in later turns.Applicable tool use or computation from the original task is retained in the corresponding subtasks.Source: A DETAILED MULTI-TURN SCIENTIFIC TASK… · p. 14
  • Tasks contain 3–13 turns, each assigned a primary understanding, evidence-processing, reasoning, or conclusion-formation stage that need not follow a fixed temporal order.The number of turns follows each problem's reasoning structure.Source: A DETAILED MULTI-TURN SCIENTIFIC TASK… · p. 14
  • LLM-based and human validators check scientific correctness, completeness, cross-turn dependencies, stage assignments, and solution leakage; only tasks passing both reviews are retained.Validation aims to preserve the original objective while requiring information to be accumulated and reused across turns.Source: A DETAILED MULTI-TURN SCIENTIFIC TASK… · p. 14
  • The illustrative GPQA chemistry task has 12 turns that build from reaction-condition interpretation toward a final product assignment through dependent intermediate results.The table labels turns by their primary problem-solving role.Source: A DETAILED MULTI-TURN SCIENTIFIC TASK… · p. 15, Table 3 · p. 16

B DETAILED SCIENTIFIC PERTURBATION DEFINITIONS

The appendix defines 13 perturbation types across problem understanding, evidence processing, reasoning, and conclusion formation, then details how applicable perturbations are selected, instantiated, and validated.

B DETAILED SCIENTIFIC PERTURBATION DEFINITIONS

  • Understanding perturbations test whether agents preserve meaning across terminology variation or reconcile equivalent quantities expressed in different units or scales.U1 varies terminology while preserving the concept; U2 changes representation while preserving physical meaning.Source: B DETAILED SCIENTIFIC PERTURBATION… · p. 16
  • Understanding perturbations also test resolving renamed or ambiguous symbols from context and recognizing omitted task-relevant conditions rather than assuming them.These are the U3 variable-and-symbol and U4 condition-omission perturbations.Source: B DETAILED SCIENTIFIC PERTURBATION… · p. 17
  • Evidence-processing perturbations test scrutiny of invalid premises, citations, empirical or statistical evidence, and conflicts between sources before using them in reasoning.The definitions cover E1–E4, including unsupported source attributions and anomalous measurements.Source: B DETAILED SCIENTIFIC PERTURBATION… · p. 17
  • Reasoning perturbations test whether agents resolve cross-step contradictions, distinguish correlation from causation, and reject unsuitable reasoning or computational paths.These are the R1–R3 perturbations.Source: B DETAILED SCIENTIFIC PERTURBATION… · pp. 17–18
  • Conclusion perturbations test whether agents preserve uncertainty qualifications and resist authority or stance pressure unsupported by available evidence.These are the C1 uncertainty-suppression and C2 authority-and-stance-pressure perturbations.Source: B DETAILED SCIENTIFIC PERTURBATION… · p. 18

C DETAILED PERTURBATION APPLICABILITY AND INSTANTIATION

  • A task–perturbation pair is applicable only when its targeted element is present and the affected information matters to current or downstream reasoning.For eligible perturbations, valid insertion points may be categorized as early, middle, or late; the main robustness evaluation uses one occurrence, while frequency analysis excludes non-repeatable types.Source: C DETAILED PERTURBATION APPLICABILITY… · p. 18
  • The generator modifies designated information while preserving unrelated content and the scientific objective, and instances undergo LLM-based and human validation before execution.Figures 4–16 show representative clean and perturbed interactions, with injected modifications highlighted in red.Source: C DETAILED PERTURBATION APPLICABILITY… · pp. 18–19

D DETAILED EXPERIMENTAL SETTINGS

Experiments use a shared agent pipeline and matched clean–perturbed live runs. The protocol also specifies model settings, perturbation configurations, and evaluation procedures.

D DETAILED EXPERIMENTAL SETTINGS

  • Eight LLMs from four model families use the same multi-turn pipeline, interaction protocol, system prompt, and tools, with model-specific inference settings held fixed across conditions.Complete live trajectories, including responses and tool interactions, are recorded.Source: D DETAILED EXPERIMENTAL SETTINGS · p. 27
  • Each clean task and its perturbed counterpart are independently executed under matched settings, and each condition is run three times with mean performance reported.Perturbed trajectories are live runs, not edits or replays of clean trajectories.Source: D DETAILED EXPERIMENTAL SETTINGS · p. 27
  • Overall robustness tests use one perturbation per task; position analyses vary eligible insertions across early, middle, and late turns, and frequency analyses use one to three occurrences where repeatable.Non-repeatable perturbations are excluded from the relevant position or frequency analyses.Source: D DETAILED EXPERIMENTAL SETTINGS · p. 27
  • TACC is evaluated at task level, while IC, TP, and RV are evaluated by turn over corresponding perturbed and clean trajectory ranges.A fixed LLM evaluator and two human annotators use the same rubric; disagreement is conservatively counted as incorrect.Source: D DETAILED EXPERIMENTAL SETTINGS · p. 27

E DETAILED ROBUSTNESS RESULTS

This section reports model-specific robustness results across eight models and 13 scientific perturbation types. It compares matched clean and perturbed conditions using four task and process metrics.

E DETAILED ROBUSTNESS RESULTS

  • Results cover all 8 models and 13 scientific perturbation types under matched clean and perturbed conditions.Tables 5–17 provide the model-specific results underlying the aggregated analysis in Section 5.2.Source: E DETAILED ROBUSTNESS RESULTS · p. 28
  • The evaluation reports Task Accuracy (TACC), Information Correctness (IC), Task Progression (TP), and Reasoning Validity (RV).Source: E DETAILED ROBUSTNESS RESULTS · p. 28
  • Degradation is defined as ∆= Clean −Perturbed, with larger positive values indicating greater degradation.Source: E DETAILED ROBUSTNESS RESULTS · p. 28

F DETAILED PERTURBATION POSITION RESULTS

This section reports model-specific results for perturbation position, comparing early, middle, and late insertions across four degradation metrics.

F DETAILED PERTURBATION POSITION RESULTS

G DETAILED PERTURBATION FREQUENCY RESULTS

This section examines repeated perturbation instantiations at distinct turns and reports degradation across four metrics. The accompanying tables specify the frequency conditions and metric-specific results.

G DETAILED PERTURBATION FREQUENCY RESULTS

Related papers

Loading 2609.34537v1…