PaperlayerView exact revision on arXiv

Source-linked AI summary

Label Agreement Does Not Measure Authorization

Amir Sabbaghziarani, Bradley Thomas Baker, Theodore J. LaGrow, Sergey Plis

arXiv:2610.04544v1cs.AIcs.LG

TL;DR

A single label-agreement score does not establish whether an agent’s proposal is authorized, complete, or responsive to changed evidence. The paper audits these properties separately on COBRE and FBIRN, finding that they diverge from label agreement and from one another; it proposes controls and review gates while noting that its rule-derived references establish consistency, not correctness.

  • Problem

    Label agreement checks whether a proposed label matches a reference, but does not establish authorization, actionable output completeness, or responsiveness to changed evidence.

    Source: §1 · p. 2

  • Method

    The authors audit a bounded pipeline that separates deterministic evidence extraction, LLM interpretation, and authorization, measuring distinct proposal properties with controls and gates.

    Source: §2 · pp. 2–3

  • Results

    The diagnostics come apart: Gemma4’s marginal label agreement shifts from 0.857 to 0.870 while coverage rises from 0.726 to 0.917.

    Source: §3 · p. 3, §3.1 · p. 4

  • Takeaways & Limitations

    Separate measurements and review gates make failures visible and route unresolved decisions to human review rather than silent commitment.

    Source: §4 · p. 5

    The real-panel reference labels are provisional and rule-derived, so agreement with them indicates consistency rather than correctness.

    Source: §3.1 · p. 4

Abstract

from arXiv · show

Many groups now delegate label ontology and metadata harmonization to agentic LLM pipelines. We built one and audited it. Our aggregate scores looked healthy, but the pipeline kept failing in ways they did not show, so we set out to find what they hid. Label agreement asks whether a proposed label matches a reference. It does not ask whether the agent was entitled to propose it, whether the output was complete enough to act on, or whether the label moved when the evidence moved. We measured those three separately on COBRE and FBIRN, two schizophrenia and control neuroimaging cohorts from different consortia, and they come apart, from label agreement and from each other. Showing the agent an upstream proposal barely moves label agreement, 0.857 to 0.870, while agreement on the chosen action doubles, 0.409 to 0.830. Output that parses as JSON still drops a required field on 10% of one model's cases and 33% of the other's. And an agent that replays its first answer scores perfectly on original cases and zero once we change the evidence that decides them. Downstream, a row-order error that none of these metrics reports erases most of the diagnostic signal. So we measure these properties apart, pair each with a control, and gate commitment on the result, which makes failures visible and easy to route to a person. None of this prevents failure. Our reference labels are rule-derived, so agreement with them means consistency, not correctness. Code is available at https://github.com/amir-sbg/Label-Agreement-Does-Not-Measure-Authorization.

1 Introduction

Neuroimaging harmonization requires mapping differently encoded repository artifacts while preserving their meaning, but evidence is scattered and undocumented labels can support plausible yet unauthorized actions. The paper separates label agreement from authorization, completeness, and evidence responsiveness, then audits these dimensions and downstream consequences.

1 Introduction

  • Neuroimaging harmonization maps source files and variables to a common representation while preserving meaning, coding, units, and identity relations.The evidence can be scattered across clinical tables, dictionaries, identifier files, MATLAB bridges, and imaging derivatives.Source: §1 · p. 1
  • COBRE and FBIRN encode shared clinical questions differently, with undocumented diagnosis codes, unverified medication units, and joinable identifiers that denote distinct entities.A single accuracy number cannot distinguish a plausible label from an action unsupported by evidence.Source: §1 · p. 1
  • Prior work spans LLM schema matching, biomedical ontology and validation systems, schema integration, provenance, and abstention; this paper focuses on what authorizes a mapping when evidence is missing.The related work notes controlled studies where added context can hurt [12] [17] and analyses showing that one validation score can hide distinct failures.Source: §1 · pp. 1–2
  • The paper contributes a bounded pipeline separating evidence extraction, interpretation, and authorization, with diagnostics for three decision properties and downstream consequence.The audit finds these properties come apart both from label agreement and from one another.Source: §1 · p. 2

2 Methods

The methods separate evidence extraction, model interpretation, and deterministic authorization, then measure distinct proposal properties using controls and gates. The audit covers real repository artifacts, controlled evidence changes, and downstream classification consequences.

2 Methods

  • Read-only deterministic readers extract repository evidence, an LLM renders it into an Evidence Card and proposes a controlled action, and a deterministic controller authorizes mappings or routes blocked proposals to review.The workflow audits authorization, completeness, responsiveness to changed decisive evidence, and downstream consequence; the changed-evidence diagnostic applies to the deterministic gate, not the LLM arms.Source: §2 · p. 2
  • Readers extract structural, value, context, dictionary, linkage, and row-order evidence without inferring undocumented semantics; the fixed-schema Evidence Card tags facts as observed, documented, or inferred.The card-mediated experiments do not ablate the cards, so they do not test the cards’ independent benefit.Source: §2 · pp. 2–3
  • The controller checks syntax, required fields and types, allowed actions, evidence requirements, duplicates, and budget, blocking commitment when decisive evidence is missing or contradictory.The evaluation uses null perturbations, a frozen-answer adversary, and an in-domain deterministic reference as controls.Source: §2 · p. 3
  • The audit reports label agreement, action agreement, case success, unsafe rate, coverage, and exact repair, plus UCRcond and paired original/changed correctness (CEC).Proposal outcomes are scored before the gate; commitment-conditional values are used when needed because label and action denominators differ.Source: §2 · p. 3
  • The audit covers 17 COBRE/FBIRN artifacts across real, synthetic, and downstream panels; real-panel references are provisional and rule-derived, so agreement means consistency rather than correctness.The synthetic panel includes 90 changed-evidence pairs, 58 for CEC; the downstream bundle evaluates diagnosis classification on 157 COBRE and 311 FBIRN rows.Source: §2 · p. 3

3 Results

The results separate failures that aggregate metrics can hide: label agreement from authorization, parseability from contract completeness, and replaying an answer from responding to changed evidence.

3.1 Label agreement does not track authorization

  • Gemma4’s marginal label agreement shifts from 0.857 to 0.870 as proposal exposure raises coverage from 0.726 to 0.917; conditional on commitment, label agreement falls while action agreement rises from 0.563 to 0.905.Conditional label agreement falls from 156/167 to 190/211. Case success rises +0.378 (95% CI [0.290, 0.467]).Source: §3.1 · p. 4
  • Gemma4’s unsafe rate falls from 0.378 to 0.191, whereas Qwen3’s rises from 0.200 to 0.352.The hidden arm cannot see the proposal it would contradict, so its UCRcond of 1.000 is structurally forced; the deterministic reference also shares derivation with the reference set.Source: §3.1 · p. 4

3.2 Output that parses can still break the contract

  • All 230 responses parse as JSON, but the required Boolean appears in only 207/230 Gemma4 and 153/230 Qwen3 outputs.The label is also missing from 13 Gemma4 and 45 Qwen3 outputs; a missing Boolean routes to review, not false.Source: §3.2 · p. 4
  • The Boolean requirement cuts contradictory approvals from 3/91 to 1/91, but improves some Qwen3 metrics and worsens the same Gemma4 metrics.Native function calling or constrained decoding can enforce field presence, but not that the Boolean is meaningful; the study did not run an inert-field control for prompt sensitivity.Source: §3.2 · p. 4

3.3 A system can repeat an answer without responding to evidence

  • The frozen-answer adversary scores perfectly on original cases and zero CEC, while the gate scores 0.948 over 58 pairs and 1.000 over 48 mechanistic pairs.The LLM arms were not tested with changed payloads, so this validates the harness rather than measuring LLM evidence sensitivity.Source: §3.3 · p. 4
  • Shuffling half the metadata-to-image row order costs 0.13 AUC on COBRE and 0.26 on FBIRN, or 57% and 81% of the clean-to-chance gap.The authors say a within-site shuffle would test how much clean AUC is site-driven; FBIRN’s seven-site structure may also be disrupted by cross-site shuffling.Source: §3.3 · pp. 4–5
  • Gating leaves Gemma4’s COBRE diagnosis mapping unresolved, reducing its coverage from 157/157 rows to none, although bypassing the gate matches the operational label on all 157.The blocked mapping was conservative rather than corrective; the single-bundle FBIRN estimates establish neither correctness nor superiority.Source: §3.3 · p. 5

4 Conclusions

The conclusion argues that plausible labels do not establish a reliable workflow. It recommends separate diagnostics and review gates while bounding the claims to the audited setting.

4 Conclusions

  • A plausible semantic label may still be unauthorized, schema-incomplete, unresponsive to changed evidence, or produce a downstream-invalid artifact.The audit claims neither prevention of all failures, clinical validity, nor readiness for unattended use.Source: §4 · p. 5
  • Separate measurements, controls, and review gates make failures auditable and route decisions to human review before silent commitment.Evidence Cards record observed, documented, and unresolved information; the controller turns it into a reversible decision.Source: §4 · p. 5
  • The labels are provisional and rule-derived, and the policy is tailored to the audited families; two models were run once per arm.The authors also assume card-rendering fidelity and ran no name-exposure control.Source: §4 · p. 5
Loading 2610.04544v1…