Pith. sign in

REVIEW 4 major objections 4 minor 20 references

No frontier AI agent configuration answered more than about half of the tasks in a new 100-task benchmark of pathogen genomic surveillance, and most failures came from wrong references, thresholds, and normalization around otherwise correct

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 12:53 UTC pith:OTHKJOYC

load-bearing objection A genuinely useful benchmark whose headline numbers are plausible but rest on author-controlled ground truths and tolerances; the paper deserves serious peer review, not yet a settled standard. the 4 major comments →

arxiv 2607.19262 v1 pith:OTHKJOYC submitted 2026-07-21 cs.AI

BioSecBench-Surveillance: A Verifiable Benchmark for AI Agents in Pathogen Genomic Surveillance

Harmon Bhasin , Kevin Flyangolts , Dianzhuo Wang , Evan Seeyave , Arjun Banerjee , Amanda Darling , Joshua Stallings , David Stern
show 4 more authors
Shawn Higdon Claire Duvallet Bryan Tegomoh Kenny Workman
This is my paper
classification cs.AI
keywords pathogen genomic surveillanceAI agentsbenchmarkdeterministic gradingpipeline selectionreference choicethreshold calibrationanomaly detection
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper sets out to measure whether AI agents can infer the correct analysis pipeline for pathogen genomic surveillance from the same raw sequencing data and context a human analyst would have. To do this it introduces BioSecBench-Surveillance, a set of 100 evaluations with deterministic grading of structured answers. The central result is that no tested configuration passes more than about half of the tasks: the strongest clears 50.2%, and most errors are not about running the right workflow but about choosing the right references, thresholds, filters, and normalization around it. A sympathetic reader would care because the analysis bottleneck is now the limiting step in pandemic preparedness, and the paper provides a measurable standard for whether agents can be trusted with that step.

Core claim

The paper's central empirical discovery is that across 3,962 gradable attempts from sixteen model-harness pairs, the best configuration passed only 50.2% of the 100 tasks, and none exceeded roughly half. The dominant failure signature is that agents almost always invoke validated tools but make wrong choices around them—wrong reference or database, wrong threshold or filter, wrong normalization—producing plausible answers that fall outside the grading tolerance. The two open-world categories, anomaly detection and genetic-engineering characterization, were the hardest at 20% and 35%, suggesting that the core bottleneck is judgment under ambiguity rather than tool execution. The paper reads t

What carries the argument

The central object is the evaluation definition file: a task prompt that contains only the raw or near-raw sequencing data and context a human analyst would have, a typed deterministic grader, metadata tags, and input files stripped of identifying clues. The grader combines numeric tolerance checks, label-overlap checks, and categorical matches, and a run passes only if all required checks pass. The benchmark grades only the final structured answer, while the ungraded intermediate choices—references, thresholds, filters, normalization—carry the difficulty. Runs are classified as correct, incorrect, or refused, with the endpoint pass rate computed over gradable attempts only.

Load-bearing premise

The load-bearing premise is that the author-set ground-truth answers and grading tolerances are correct and fair; if those are flawed, the reported pass rates and the headline 'none above half' claim collapse.

What would settle it

Have a panel of independent surveillance experts, blinded to the benchmark's answers, re-derive the ground-truth answers and tolerances for a random subset of the 100 tasks using the stated published methods; substantial expert disagreement with the benchmark's answers would show that the pass rates are artifacts of grading choices rather than measures of agent capability.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Deploying current agents for end-to-end genomic surveillance decisions would mis-handle roughly half of tasks, so human expert review remains necessary.
  • Because the dominant failure mode is mis-selection of references, thresholds, filters, and normalization rather than ignorance of tools, progress depends on calibrating those choices, not just improving tool invocation.
  • Open-world tasks such as anomaly detection and engineered-sequence detection are the hardest categories, identifying judgment under ambiguity as the key bottleneck.
  • Refusals can distort scores and create a potential gaming path, so reporting must track refusal rates separately from pass rates.
  • The benchmark establishes a deterministic standard for measuring whether future agents can be trusted for surveillance work.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves open whether improving calibration on reference selection and threshold setting, rather than expanding tool knowledge, will yield the largest gains in agent performance; we infer this is where the next generation of surveillance agents is most likely to improve.
  • Because refusal rates vary sharply across harnesses, we infer that the scaffolding around a model—not just the model itself—determines apparent surveillance capability, and comparisons that ignore the harness are misleading.
  • The full evaluation set is held under restricted access; we infer that independent verification would be strengthened by releasing a random held-out subset for blinded expert re-derivation of ground truths and tolerances.
  • Given that long-read datasets were markedly harder than short-read, we infer that surveillance programs adopting long-read sequencing will face a longer trust gap unless benchmarks and agents are specifically tuned for that data type.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper introduces BioSecBench-Surveillance, a benchmark of 100 pathogen genomic surveillance tasks, each supplying raw sequencing data and context and requiring a structured answer that is graded deterministically. The authors evaluate sixteen model-harness configurations over three trials per task, report endpoint pass rates from roughly 14% to 50%, and conclude that current AI agents cannot be relied on for end-to-end surveillance decisions. They also report that errors largely come from choices around otherwise correct workflows, such as references, thresholds, and normalization.

Significance. If the benchmark is sound, it fills a real gap in execution-based evaluation for a high-stakes application domain. The paper has clear strengths: deterministic typed grading, multiple trials per configuration, per-evaluation confidence intervals, a well-described run-outcome taxonomy, and a frank discussion of limitations such as refusal gaming and uneven task coverage. The claim that no configuration exceeds roughly 50% would be a practically important, falsifiable result. However, the central empirical claim rests on ground truths and grading tolerances that are not publicly accessible, and the paper lacks a human-analyst baseline and a quantified analysis of failure trajectories. These issues must be addressed before the benchmark's diagnostic value can be accepted.

major comments (4)
  1. [Data availability; Methods, 'Task format and deterministic grading'] The headline pass rates are computed by author-written graders against ground truths and tolerances that are not publicly available. The paper states tolerances are 'set per evaluation from the underlying biology' and 'recorded in the notes,' but the full evaluation set is restricted and only example evaluations are released. An external reader cannot audit whether a relative tolerance is too tight or too loose, or whether a Jaccard threshold captures the intended biological equivalence. Because every configuration is graded by the same unpublished rules, a systematic tolerance bias would shift all pass rates and invalidate the central 'about half' claim. This is load-bearing. The paper should provide either a full technical appendix with every task prompt, ground truth, tolerance value, and the grader source code, or a concrete controlled-access mechanism that permits independent re-der
  2. [Results, 'No model–harness pairing exceeds ~50% mean pass rate'; Discussion] The conclusion that agents 'cannot be trusted' is an implicit comparison to human analysts, yet the paper reports no human-expert pass rate on the same tasks. Without a human baseline, the observed 50% could mean the tasks are unusually hard even for experts, or that the benchmark is mis-calibrated. The paper should include a human-analyst study on at least a subset of the evaluations (ideally with the same tools and time limits), or explicitly justify an assumed expert performance level from prior literature. This would strengthen the interpretability of the absolute pass rates and the claimed 'gap between today's agents and a trusted analyst.'
  3. [Discussion, 'The failures we describe are only meaningful because...'] The authors correctly note that benchmark validity requires stripping every identifying clue from task inputs, and even state that a filename or header was 'often enough' for an agent to answer without analysis. However, the paper does not report a systematic audit of de-identification across all 100 evaluations. Without such an audit, some tasks may leak the answer, inflating pass rates or masking the targeted reasoning failures. Please describe the sanitization pipeline in detail, report whether automated checks (e.g., grepping for accessions or sample identifiers) were applied to all files, and state how many tasks required manual redaction. This is essential for the claim that the tasks actually force agents to run the analysis.
  4. [Results, 'Failure patterns are consistent across configurations'; Discussion] The secondary claim that 'agents almost always call the validated tools' and that errors arise from 'choices around' tools is supported only by 'trajectory review' with no methodology, sample size, or inter-rater reliability. This is a significant qualitative finding, but as reported it is anecdotal. Please specify how many trajectories were reviewed, by whom, which criteria defined a 'correct workflow,' and how failure modes were coded. Quantify the distribution of error categories (wrong reference, threshold, normalization, interpretation, etc.) across configurations and task categories. Without this, the paper's explanation of the pass rates remains unverified.
minor comments (4)
  1. [Title; Abstract] The term 'verifiable' in the title and abstract is stronger than what the paper delivers, since the full evaluation set is restricted and the grader rules are not published. Consider rephrasing to 'deterministically graded' or add a clear statement in the abstract about the controlled-access availability of the full benchmark.
  2. [Figure 2 caption] The run-outcome decomposition in Figure 2A shows percentages that sum to 100 across correct/incorrect/refused, while the endpoint pass rate in Figure 2B excludes refusals. Make explicit in the caption that panel A uses all attempts and panel B uses gradable attempts only, so the two panels are not directly comparable.
  3. [Methods, 'Task format and deterministic grading'] The sentence 'Tolerances are set per evaluation from the underlying biology and how the ground truth was derived' is too vague to be useful even for the example evaluations that are public. Provide at least two or three concrete examples in the main text, with numeric tolerance values, so readers can see how the graded checks are calibrated.
  4. [Figure 3 caption] The analysis by sequencing technology reports only n=15 for long-read tasks. Because this is a small subsample, the 26% pass rate should be accompanied by a confidence interval or a caution that the difference from short-read may not be stable. Otherwise, a reader may overweight a single attribute with few tasks.

Circularity Check

0 steps flagged

No significant circularity: the paper reports a benchmark measurement, not a derivation, and its self-citations are contextual rather than load-bearing.

full rationale

The central claim is an empirical measurement: model-harness configurations were run on 100 benchmark evaluations and graded by deterministic author-defined graders, with pass rates ranging from about 14% to 50%. This is not derived from the benchmark's inputs by construction; pass rates are observed outcomes scored against ground truths that the paper says are established externally: 'The ground truth is established with gold-standard workflows or literature and is kept out of the prompt.' The tolerances are author choices ('Tolerances are set per evaluation from the underlying biology and how the ground truth was derived'), and the full evaluation set is restricted, so independent re-grading is not currently possible. That is a verification and evidence limitation, not circularity: no fitted parameter is renamed as a prediction, no equation reduces to its inputs, and the ground truth is not defined in terms of agent outputs. The only self-citations (refs. [8], [9], [11]) are used for background context and a future-work suggestion about refusal evaluation; they do not carry the headline result. The secondary failure-pattern claim ('their mistakes came from the choices around them') is supported only by unquantified trajectory review, but that is a strength-of-evidence concern, not a circular reduction.

Axiom & Free-Parameter Ledger

2 free parameters · 6 axioms · 0 invented entities

The central claim rests on internally constructed ground truths and author-chosen grading tolerances rather than externally validated standards. No new physical or conceptual entities are introduced. The main epistemic burdens are the unverified correctness of the gold-standard workflows, the chosen tolerances, and the representativeness of the task set.

free parameters (2)
  • Per-evaluation grading tolerances = Not disclosed (recorded in evaluation notes)
    Numeric fields pass against relative, absolute, minimum, or maximum tolerances 'set per evaluation from the underlying biology'; these thresholds directly determine pass/fail outcomes.
  • Jaccard similarity threshold for set-valued fields = Not disclosed
    Set-valued fields pass by 'label overlap above a Jaccard threshold'; the specific threshold is author-chosen and affects pass rates.
axioms (6)
  • domain assumption Gold-standard workflows produce correct ground truth
    The paper states ground truth is 'derived with validated gold-standard workflows, following published methods and literature,' but the full evaluation set is restricted and no external audit is possible.
  • domain assumption Author-set deterministic grading measures correctness
    Pass/fail depends on per-evaluation tolerances and Jaccard thresholds chosen by the authors; no evidence shows these match external expert consensus.
  • domain assumption The 100-task set is representative of real biosurveillance
    The paper restricts tasks to those with 'a single objective answer' and notes uneven distribution across labels, so aggregate scores may not generalize to open-ended real-world surveillance.
  • domain assumption Removing identifying metadata prevents shortcutting
    The authors found that leftover filenames, sequence headers, or accessions were 'often enough for an agent to name the organism without running the analysis'; they assert inputs are stripped, but released data are insufficient to verify.
  • domain assumption Timeout indicates a wrong path
    Timeouts are counted as incorrect because 'experts using the correct methods finish well within the time limit'; this assumes all tasks are solvable within six hours by the correct workflow.
  • standard math Per-evaluation averaging with Student-t intervals is valid
    Aggregating per-evaluation pass rates and computing 95% t-intervals is standard, though unequal evaluation counts per category complicate interpretation.

pith-pipeline@v1.3.0-alltime-deepseek · 7171 in / 8519 out tokens · 73874 ms · 2026-08-01T12:53:44.342100+00:00 · methodology

0 comments
read the original abstract

As pathogen genomic surveillance scales, the bottleneck is shifting from data generation to analysis. We present BioSecBench-Surveillance, a verifiable benchmark of 100 evaluations testing whether AI agents can infer the right analysis pipeline from raw sequencing data and surveillance context. Each evaluation gives an agent only the data and context a human analyst would have, then grades its structured answer deterministically. The tasks span seven categories, from taxonomic classification to genetic-engineering detection, across diverse sample types and sequencing technologies. Across 3,962 gradable attempts from sixteen model-harness pairs, the strongest configuration cleared only about half. Opus 4.8 with PI led at 50.2 percent, with a 95 percent confidence interval of 40.1 to 60.3 percent across 83 evaluations, tied with GPT-5.5 with Codex at 50.2 percent, with a 95 percent confidence interval of 40.8 to 59.6 percent, followed by Opus 4.7 with PI at 49.6 percent, with a 95 percent confidence interval of 40.0 to 59.2 percent, and Sonnet 4.6 with PI at 48.6 percent, with a 95 percent confidence interval of 38.9 to 58.3 percent. Even when agents invoked the correct workflows, their mistakes came from the choices around them, such as which references, thresholds, filters, and normalization to apply. BioSecBench-Surveillance provides a standard for measuring whether agents can be trusted to perform genomic surveillance when the next outbreak arrives.

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

20 extracted references · 6 linked inside Pith

  1. [1]

    New England Journal of Medicine , volume=

    Pathogen genomics in public health , author=. New England Journal of Medicine , volume=. 2019 , publisher=

    2019

  2. [2]

    Nature Reviews Genetics , volume=

    Towards a genomics-informed, real-time, global pathogen surveillance system , author=. Nature Reviews Genetics , volume=. 2018 , publisher=

    2018

  3. [3]

    2022 , publisher=

    Global genomic surveillance strategy for pathogens with pandemic and epidemic potential, 2022-2032 , author=. 2022 , publisher=

    2022

  4. [4]

    Nature , volume=

    Wastewater sequencing reveals early cryptic SARS-CoV-2 variant transmission , author=. Nature , volume=. 2022 , publisher=

    2022

  5. [5]

    International Conference on Learning Representations , volume=

    Swe-bench: Can language models resolve real-world github issues? , author=. International Conference on Learning Representations , volume=

  6. [6]

    arXiv preprint arXiv:2407.10362 , year=

    Lab-bench: Measuring capabilities of language models for biology research , author=. arXiv preprint arXiv:2407.10362 , year=

    Pith/arXiv arXiv

  7. [7]

    arXiv preprint arXiv:2503.00096 , year=

    Bixbench: a comprehensive benchmark for llm-based agents in computational biology , author=. arXiv preprint arXiv:2503.00096 , year=

    arXiv

  8. [8]

    Frontiers in Microbiology , volume=

    Without safeguards, AI-Biology integration risks accelerating future pandemics , author=. Frontiers in Microbiology , volume=. 2026 , publisher=

    2026

  9. [9]

    arXiv preprint arXiv:2606.13602 , year=

    EpiBench: Verifiable Evaluation of AI Agents on Epigenomics Analysis , author=. arXiv preprint arXiv:2606.13602 , year=

    Pith/arXiv arXiv

  10. [10]

    arXiv preprint arXiv:2606.19245 , year=

    TxBench-PP: Analyzing AI Agent Performance on Small-Molecule Preclinical Pharmacology , author=. arXiv preprint arXiv:2606.19245 , year=

    Pith/arXiv arXiv

  11. [11]

    Clinical Infectious Diseases , volume=

    Overcoming data bottlenecks in genomic pathogen surveillance , author=. Clinical Infectious Diseases , volume=. 2021 , publisher=

    2021

  12. [12]

    npj Vaccines , volume=

    Outlook of pandemic preparedness in a post-COVID-19 world , author=. npj Vaccines , volume=. 2023 , publisher=

    2023

  13. [13]

    2026 , eprint=

    Evaluating calibrated refusal and safe usefulness in dual-use biology settings , author=. 2026 , eprint=

    2026

  14. [14]

    arXiv preprint arXiv:2606.26563 , year=

    scBench-Long: Verifiable Benchmarking of Long-Horizon Single-Cell Biology , author=. arXiv preprint arXiv:2606.26563 , year=

    Pith/arXiv arXiv

  15. [15]

    arXiv preprint arXiv:2606.06749 , year=

    Deterministic access to global viral sequence data enables robust agentic scientific discovery , author=. arXiv preprint arXiv:2606.06749 , year=

    Pith/arXiv arXiv

  16. [16]

    2405.20947 , archivePrefix =

    Cui, Justin and Chiang, Wei-Lin and Stoica, Ion and Hsieh, Cho-Jui , year =. 2405.20947 , archivePrefix =

    Pith/arXiv arXiv

  17. [17]

    bioRxiv , pages=

    GeneBench-Pro: Evaluating Multistage Statistical Reasoning in Genomics, Quantitative Biology, and Translational Biomedicine , author=. bioRxiv , pages=. 2026 , publisher=

    2026

  18. [18]

    BMC bioinformatics , volume=

    Managing false positives during detection of pathogen sequences in shotgun metagenomics datasets , author=. BMC bioinformatics , volume=. 2024 , publisher=

    2024

  19. [19]

    Scientific reports , volume=

    Diagnostic accuracy of metagenomic next-generation sequencing in diagnosing infectious diseases: a meta-analysis , author=. Scientific reports , volume=. 2022 , publisher=

    2022

  20. [20]

    Blythe and Lang, Daniel and Alazawi, Mohammed A

    Ryerson, A. Blythe and Lang, Daniel and Alazawi, Mohammed A. and Neyra, Milagros and Hill, Dustin T. and St. George, Kirsten and Fuschino, Meghan and Lutterloh, Emily and Backenson, Bryon and Rulli, Samuel and Ruppert, Patricia Schnabel and Lawler, Jacqueline and McGraw, Nancy and Knecht, Andrew and Gelman, Irina and Zucker, Jane R. and Omoregie, Enoma an...