PaperlayerView exact revision on arXiv

Source-linked AI summary

What Output-Only Review Cannot Verify: Study Contracts for Research Agents

Eitan Waks, Ben Glocker

arXiv:2610.11754v1cs.AI

TL;DR

Research-agent improvement lacks a direct scientific reward, and output-local review cannot always determine whether execution met approved obligations. The paper proposes study contracts that bind approved choices and execution evidence; in its diagnostic, output-only detection varied by fault visibility. Whether agents exploit these gaps remains untested.

  • Problem

    Research-agent development lacks a direct scientific reward, while task- and output-local checks need not establish whether the authorized study was executed.

    Source: §1 · p. 1

  • Method

    Study contracts bind approved study specifications through a versioned chain to run contracts and collected observations, with an adaptation policy defining permitted changes.

    Source: §3 · p. 3, §3.1 · p. 4, §3.3 · p. 5

  • Results

    16–18 of 18 aliases flagged contradiction-visible faults, versus 2/18 and 1/18 for the two absence faults; no mutated package received an explicit clean judgment.

    Source: §4.2 · p. 6

  • Takeaways & Limitations

    Contract-relative checks can expose authorized obligations and claim scope, while the adaptation policy can define permitted changes rather than freezing the realized trajectory.

    Source: §3 · p. 3, §3.3 · p. 5

    Whether an optimizing agent exploits proxy gaps remains untested; the diagnostic characterizes registered-fault inferences under an information-asymmetric design.

    Source: §1 · p. 2

Abstract

from arXiv · show

Some defects in an AI-generated study can be identified from its artifacts; others require knowledge of what was approved before execution. We propose study contracts that bind declared experimental choices, run obligations and claim scope to recorded execution evidence, and distinguish this contract-relative verification from scientific truth. A diagnostic using eight self-authored clean/mutated pairs illustrates the information boundary. A deterministic checker applying a registered, fault-specific rule to approved and executed objects detected all eight registered mutations. Across eighteen recorded judge aliases given individual metadata-filtered packages without pair context or the registry-selected fault label, 104 of 144 mutated evaluation cases received defect flags; the remaining cases comprised 32 abstentions and eight terminal failures, with no explicit clean decisions on mutated cases. Some packages retained approval and execution fields, including digests. The prompt instructed judges to abstain when evidence was insufficient. These results characterize a deliberately information-asymmetric development setting; they do not isolate the effect of authoritative information from differences in task specification and rule selection, and they are not comparative verifier quality or agent reward hacking. We identify full-information comparisons, legitimate-adaptation controls and closed-loop agent evaluations as necessary tests of whether contract checks improve useful compliant completion under optimization.

1 The self-improvement loop has no scientific reward

Research-agent improvement lacks a direct scientific reward, and common proxies do not establish that the authorized study was executed. The paper frames its diagnostic around this verification gap and the limits of its scope and trust assumptions.

1 The self-improvement loop has no scientific reward

  • Research agents lack a direct reward for “the science got better,” leaving developers without a scientific objective to call.A meta-agent loop requires an agent mutation, an evaluation environment, and a decision rule.Source: §1 · p. 1
  • Task completion, artifact presence, software tests, and output-only judges each leave study-level validity gaps, including wrong-split metrics that pass tests.A completed task need not support a study-level claim, and fluent output is the surface the agent controls most directly.Source: §1 · p. 1
  • These signals are task- or output-local and need not encode whether execution preserved the authorized study’s identity.The passage does not claim that completion and validity are independent; it says completion does not entail validity.Source: §1 · p. 1
  • Whether an optimizing agent exploits proxy gaps remains untested; the evidence is limited to registered-fault inferences under an asymmetric design.The paper presents the specification-gaming literature as motivation, not evidence that exploitation occurred.Source: §1 · p. 2

1.1 Scope and threat model

  • The proposed verification concerns methodological eligibility for computational-science research, not whether a result is true or any clinical, diagnostic, or safety certification.The scope includes code, seeds, jobs, schedulers, metrics, and artifacts.Source: §1.1 · p. 2
  • Record integrity depends on protected approvals and authorization plus agent-unwritable execution observations; checked boundaries do not establish universal bypass resistance.If the agent can edit the contract, labels, observations, or authorization record, the relation can be gamed.Source: §1.1 · p. 2

2 Silent protocol mutation as a potential proxy-gaming channel

The paper describes six ordinary protocol-mutation channels that can preserve proxy scores, while distinguishing package-visible contradictions from faults that require approved obligations. These channels do not require deception, and actual optimization-driven drift is not tested.

2 Silent protocol mutation as a potential proxy-gaming channel

  • The channels reflect established meta-science pathologies, but actual drift under optimization has not been tested; none of the described mutations requires deception.Artifact existence can be mistaken for claim support, and software correctness for scientific validity; lifecycle records alone do not supply authorized scope or claim-bound obligations.Source: §2 · pp. 2–3
  • Design underspecification lets an unstated split, comparator, or seed policy be chosen after data are seen, while binding drift separates an approved plan from execution.A plan hash in a report cannot establish that the executable was bound to the authorized plan.Source: §2 · p. 2
  • Semantic drift occurs when engineering and scientific edits share a translation channel; a typed study object declares whether a change, such as batch size, is in bounds.Batch size can affect optimization dynamics, normalization statistics, and the effective learning-rate schedule.Source: §2 · p. 2
  • Survivorship drift biases estimates only when accounting omits attempts; visible budget or digest contradictions were flagged by 16–18 of 18 aliases, but a missing metric artifact by 1 of 18.Retries remain visible when recorded against a locked denominator.Source: §2 · p. 3
  • Scope inflation turns benchmark results into broader claims; 17 of 18 aliases flagged the external-generalization mismatch, while contracts add an authorized ceiling and promotion gate.The contract’s role here is authorization over claim scope, not detection of a mismatch already present in the package.Source: §2 · p. 3
  • Reconstruction drift prevents re-deriving a study without private state, but an incomplete manifest can remain visible and was flagged by 16–18 of 18 aliases.What is lost is the ability to rerun the study to test facts absent from the package, not all package-visible checks.Source: §2 · p. 3

3 Environment-grounded verification: make the study the environment

The paper treats the approved study as the environment for checking execution, binding declared choices and obligations to evidence. This makes verification relative to an authorized study while leaving room for adaptation within a declared policy.

3 Environment-grounded verification: make the study the environment

  • The approved study binds question and claim scope, data, arms, metrics, expected runs, evidence obligations, authority, and authorized adaptations; execution state references it without changing it.The verification signal compares the authorized study with the executed one, and the agent controls only one side of that relation on checked boundaries.Source: §3 · pp. 3–4

3.1 Four checkable properties

  • Four checkable properties bind approved specifications through compilation and observations, account for expected runs, type claim promotion obligations, and require human-authenticated approval gates.Digests establish equality and tamper evidence across the versioned chain, while semantic preservation and honest observation require separate assumptions or tests.Source: §3.1 · p. 4

3.2 Why some faults are unreachable from the output: identical artifacts, different contracts

  • Identical visible artifacts can have different eligibility under different contracts, while scope-inflation cases can expose a claim–evidence mismatch directly in the package.The paper’s analytical example distinguishes a required artifact from an optional one; the diagnostic separately found 17/18 aliases flagged external generalization.Source: §3.2 · pp. 4–5

3.3 Freeze the adaptation policy, not the trajectory

  • The adaptation policy Π, not the realized trajectory, is frozen; departures require amendment or an exploratory fork with downgraded claim status.A synchronous attempt-admission-and-retry subset is live, but general adaptive enforcement and compiler-wired revision transitions remain specified rather than implemented.Source: §3.3 · p. 5

3.4 What a self-modifying research agent should export

  • For controlled comparisons, agents should export a study object including adaptation policy, expected-run manifest, and claim–obligation map, enabling decisions over contract-relative quantities rather than prose-judge scores.Suggested quantities include binding integrity, denominator completeness, admissible-claim yield at fixed scope, and blocked-claim reasons.Source: §3.4 · p. 5

4 Implementation status and the information-boundary diagnostic

The diagnostic contrasts a deterministic checker using approved and executed objects with judges receiving metadata-filtered packages. It reports detection and coverage patterns under that asymmetric setup, not comparative verifier quality.

4 Implementation status and the information-boundary diagnostic

  • Three locally executed, human-approved historical fixtures are shared records rather than replications, and the paper does not independently authenticate their retained approval records.The refusal and scope-ceiling audits did not pass overall; the denominator-integrity audit passed.Source: §4 · p. 5

4.1 Design

  • The self-authored corpus paired eight clean studies with mutations for registered methodological faults, while judges saw individual metadata-filtered packages and were instructed to abstain when evidence was insufficient.Some packages retained approval and execution fields, including digests; the checker applied the registered fault-specific rule.Source: §4.1 · pp. 5–6

4.2 Result: a partition, not an accuracy

  • 8/8 registered mutations were blocked by the deterministic checker, with 0/8 false blocks; no mutated case received an explicit clean decision from judges.The diagnostic used eight clean/mutated study-package pairs and the table summarizes 288 judge cases across 18 aliases and 16 packages.Source: §4.2 · p. 6, Table 1 · p. 6
  • Across 288 judge cases, 179 were binary decisions, 95 semantic abstentions, and 14 terminal failures; the 179/288 decision coverage qualifies the 178/179 conditional accuracy.These repeated evaluations of eight pairs are not 288 independent scientific examples, and aliases are evaluation instruments rather than statistical samples.Source: §4.2 · p. 6
  • Package-visible contradictions were flagged by 16–18 of 18 aliases, while missing split/grouping declarations and required metric artifacts were flagged by 2/18 and 1/18, respectively.The metadata-filtered judge was not given the registry-selected fault label or an equal-information task. The pattern is consistent with missing requirements mattering for some faults, without experimentally isolating that contribution.Source: §4.2 · p. 6
  • A constructed surface heuristic scored mutated packages above their clean controls on 2/8 pairs and tied on 3/8, but it was not a live model ranking or evidence about an optimizer.It rewarded package length, inflation vocabulary, and thinner seed lists by design.Source: §4.2 · p. 6

4.3 What the diagnostic does not show

  • The diagnostic does not isolate verifier quality, compare agents, estimate calibrated reviewer quality, demonstrate reward hacking, or test whether a stronger output-only model would do better.Fixtures and labels were self-authored, with no held-out calibration; an equal-information comparison is needed to attribute any advantage to checking rather than information or rule selection.Source: §4.3 · p. 7

5 What would test the contribution

The paper proposes equal-information comparisons and closed-loop evaluations to test whether contract checks help agents complete useful work compliantly. These tests are proposed, not reported results.

5 What would test the contribution

  • Compare output-only and contract-plus-observation reviewers with the same relevant facts, deterministic and simple-rule baselines, held-out fault compositions, legitimate-adaptation controls, independent gold labels, and protected observations.Measure false acceptance, false rejection, abstention, operational failure, cost, and decision coverage separately.Source: §5 · p. 7
  • Test whether admissibility remains useful under optimization by fixing a nontrivial task, claim requirement, and resources while measuring independent scientific utility, attempted actions, failures, narrowing, and abandonment.Compare enforcement during execution with final-only checking; a high fraction of admitted trivial claims is not success.Source: §5 · p. 7
  • The equal-information ablation is proposed but unrun, so no checking advantage can yet be attributed separately from access to approved requirements or fault-specific rules.The paper identifies its contribution as a threat model and an information-boundary diagnostic run under deliberately asymmetric information.Source: §5 · p. 7
  • The protocol recommends fixing the study while varying the agent, scoring contract-relative quantities, and keeping judges blinded, secondary, frozen, abstention-capable, and without promotion authority.Faults should have paired clean controls, the fault set should be frozen independently of detector authors, and negative results should be reported.Source: §5 · p. 7

6 Related work

Related work spans task-level verification, workflow and specification-gaming benchmarks, claim-aware review, and evidence provenance. This paper adds a prospective study-level reference and authority to enforce contract boundaries, while leaving the benefit of that combination unmeasured.

Related work

  • EviBound combines pre-execution approval with post-execution artifact checks, but a completed task can still sit inside an inadmissible study [1].Workflow benchmarks question completion as a proxy for scientific deliverables [11], while specification-gaming benchmarks report metric gains alongside violations of scientific intent.Source: §6 · p. 7
  • ClaimReceipt checks evidence sufficiency and coverage for asserted claims [14], whereas this proposal adds promotion blocking based on approved expected units and claim scope.The paper distinguishes raising an objection, issuing a verdict, and enforcing a decision; it does not claim objections are less valuable than automatic blocks.Source: §6 · p. 8
  • Tamper-evident records, typed configuration management, agent systems, provenance tools, and reporting standards offer adjacent mechanisms, but the benefit of combining them here is unmeasured.The proposed addition is an explicit relation among expected units, attempts, and claim slots under an authorized adaptation policy, together with an information-boundary diagnostic and threat model.Source: §6 · p. 8

7 Relation to companion manuscripts

This paper shares a research-contract framework and prototype multi-domain platform with two companion preprints, but focuses on the information needed to verify contract-relative compliance.

Relation to companion manuscripts

  • The three companion preprints share a research-contract framework and a prototype multi-domain research platform.Source: §7 · p. 8
  • This paper’s distinct contribution is the information required for contract-relative compliance verification, including a diagnostic on a self-authored development corpus.Source: §7 · p. 8
  • The eight-pair diagnostic and selected historical audits are shared records, not independent replications across the companion papers.Source: §7 · p. 8

8 Conclusion

Output-only review cannot resolve facts missing from a package, while study contracts expose relations between approval, execution, coverage, claim scope, and human authorization. This supports contract-relative eligibility checks, not a judgment of scientific truth.

Conclusion

  • Some research-agent defects require approved obligations that an output-only judge cannot see, and an identical visible package may correspond to different approved obligations.On the development corpus, metadata-filtered judges almost never flagged the two absence faults; a full-information equal-task comparison remains untested.Source: §8 · p. 8
  • A study-level contract makes checkable whether execution follows the authorized version chain, the denominator remains intact, claims stay within scope, and an authorized human signed off.Source: §8 · p. 8
  • Contract-relative eligibility does not establish scientific correctness, and the small diagnostic does not establish the identical-package causal claim for every fault class.The authors frame whether enforcement improves useful compliant completion under optimization as a question for closed-loop testing.Source: §8 · p. 8

A Live-judge evaluation protocol

Live judges reviewed individual blinded packages under a prompt that required abstention when evidence was insufficient. They served only as secondary reviewers, with deterministic checks retaining primary authority.

A Live-judge evaluation protocol

  • Each case presented one blinded package without pair context, the approved contract, or the study object; the prompt required abstention when approval evidence was absent.Source: A Live-judge evaluation protocol · p. 13
  • Evaluation used 16 cases per alias in fixture-registry order without additional randomization, each as a fresh stateless request; aliases were unpinned, and judges could neither promote nor override deterministic failures.Temperature was omitted for GPT-5/o-series and current Anthropic Messages models and otherwise defaulted to 0.0.Source: A Live-judge evaluation protocol · p. 13

B Frozen live-judge prompt

  • The prompt asked judges to flag methodological or contract defects affecting claim admissibility, including leakage, unequal budgets, drift from approved specifications, missing required evidence, and unsupported generalization.Source: B Frozen live-judge prompt · p. 13
  • Judges were told to inspect only package evidence, abstain when information was insufficient, and return a fixed JSON schema with a decision, confidence, rationale, and issue identifiers.The prompt was reproduced verbatim for each call, with only the blinded package JSON appended; confidence was requested but not analyzed as calibration.Source: B Frozen live-judge prompt · pp. 13–14

C Per-fixture and per-alias detail

The section’s tables cover how many of 18 aliases flagged mutated packages and per-alias counts. The per-alias caption also cautions that aliases are not independent datasets or necessarily immutable model snapshots.

C Per-fixture and per-alias detail

  • Table 2 reports how many of 18 aliases flagged each mutated package.The caption frames it as a development-corpus diagnostic.Source: Table 2 · p. 14
  • Table 3 gives per-alias counts, pooling abstentions and terminal failures as non-decisions.The caption gives pooled non-decision totals of 32 + 8 for mutated cases and 63 + 6 for clean cases.Source: Table 3 · p. 14
  • The aliases are not eighteen independent datasets or necessarily immutable model snapshots.Source: Table 3 · p. 14

D Implementation status inventory

Table 4 presents engineering observations, not comparative results. Its caption notes shared artifacts and qualifies the human-approval records.

D Implementation status inventory

  • Table 4 is identified as engineering observations, not comparative results.Source: Table 4 · p. 15
  • X3≡Y3 and X4≡Y4 denote shared artifacts.Source: Table 4 · p. 15
  • The records report human approval, but the paper does not independently authenticate every recorded actor.Source: Table 4 · p. 15
Loading 2610.11754v1…