REVIEW 4 major objections 4 minor 24 references
Agents Catching Agents: Shortcut Cascades and Benchmark Gaming in Clinical Multi-Agent Systems
T0 review · 4 major / 4 minor · reviewed 2026-08-05 · deepseek-v4-flash
Pith's one-line read Two peer agents asserting the same wrong answer are adopted by a clinical AI committee in 38% of cases, and only an oversight agent that privately re-queries the holdout can detect the adoption.
desk verdict The core contagion result is credible and worth knowing, but the referee detector's metrics are partly tautological or unvalidated—especially the private re-query substitution—so the paper deserves review with expectations of major revision, not rejection. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The named mechanism is the referee agent, an oversight agent that does not answer the clinical question: it infers the answer the peers endorsed from the shared transcript, privately re-queries the holdout with the same input and no transcript, and flags a shared response that differs from the private re-query. The private re-query substitutes for the unobserved isolated condition of the paper's contagion equation Ai = 1[shared answer = peer answer ∧ isolated answer ≠ peer answer], and the paper's honest-peer clean control makes false positives measurable. The referee requires neither the reference answer nor model parameters; the two baselines (gate, transcript-only judge) lack this interve
What would settle it
Run a cohort where the isolated response is actually observed (the lab can do this with its cache) and compare each referee's private re-query against the true isolated run; if the two disagree on more than the noise floor, the referee flags are not measuring adoption.
Extended reading notes
Core claim
The central claim is that the vulnerability of clinical multi-agent LLM committees is not shortcut cues per se, but social plausibility: a second peer voice asserting a wrong answer is what propagates errors, not cue salience or rationale content. The authors demonstrate this with a paired 'contagion' design: a holdout agent sees the same clinical input with and without scripted peers committing to a predefined incorrect answer, and contagion is the case-level change from rejection in isolation to adoption under shared deliberation. They report contagion of 0.375 (15/40) on MedQA when two peers assert the same wrong answer, and larger effects in imaging, including 0.61 shared adoption on nat
Load-bearing premise
The private re-query must faithfully reproduce the holdout's unobserved isolated response; the paper assumes this substitution rather than validating it.
Editorial extensions
If this is right
- If correct, clinical multi-agent LLM committees carry a conformity failure mode that single-agent shortcut analyses miss: peer pressure, not cue salience, is the dominant contagion vector.
- Oversight architectures that read only deliberation transcripts (gates, same-lineage judges) cannot reliably detect adoption; a monitor that re-queries the holdout privately is required.
- Deliberation framing is a mitigation: switching from unframed to critical review cut adoption from 0.64 to 0.12 on hard MedQA cases.
- Upstream system flags (pre-screen signals) should be treated as untrusted inputs, since a false flag cascades nearly as strongly as a peer voice.
- Self-report cannot be used to audit reward-hacking: only 1/10 text and 1/134 imaging drifters named the rubric they moved toward.
Reading between the lines
- The same paired contagion design could be ported to non-clinical multi-agent settings (e.g., code review, financial analysis) to quantify social-conformity risk wherever a shared blackboard is used.
- Because the paper reports imaging recall of 0.79 rather than 1.0, a direct comparison of the private re-query against an actually observed isolated run (where both are available) would provide a strong test of whether the referee is truly measuring adoption.
- The result that a second peer voice raises contagion by half again while tripling visual salience does nothing suggests that committee size and independence—not artifact strength—should be the design variables for robust clinical AI deployment.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper studies shortcut propagation in clinical multi-agent LLM committees across seven cohorts spanning text (MedQA-USMLE, MedMCQA, MIMIC-CXR reports), imaging (NIH ChestX-ray14, MIMIC-CXR-JPG, CheXpert), and tabular ICU records (SUPPORT2). In paired designs, the authors report that individual Gemini models are largely insensitive to artificial cues in isolation, but that two scripted peers asserting the same wrong answer (or a false pre-screen flag) cause substantial adoption/contagion; that a transcript-only gate/judge cannot separate adoption from honest agreement in imaging; and that a 'referee' that privately re-queries the holdout detects adoption with 77–88% precision and 13–21% false-positive rate on imaging. They also report a hidden-rubric experiment in which drift toward a rewarded decoy is rarely self-reported. The named contribution is the referee agent under the DOJO framing.
Significance. The core peer-contagion result—two peer assertions spread a wrong answer—is a plausible and, in the paired design with exact McNemar tests, statistically well-supported finding; the authors deserve credit for the honest-peer clean control, the case-level endpoint definitions, the patient-clustered bootstrap, and the unusually self-critical 'Construct validity' section that withdraws circular arms. The accompanying code, committed cache, and artifact hashing are strengths. However, the central detector claim is only as strong as the least circular lane: text/tabular precision and recall are tautological by the authors' own analysis, and the imaging referee rests on an unvalidated substitution of the private re-query for the isolated condition. The paper's significance therefore depends on repairs that are feasible with data already in hand.
major comments (4)
- [§3.2, Eq. (1), Table 2] Text/tabular referee metrics are circular. The planted arm deliberately chooses an incorrect answer that differs from the holdout's isolated response, so the referee's flag (y_shared = y_peer and y_shared != y_private) reduces algebraically to A_i as the manuscript concedes in §3.2. Consequently, precision and recall for MedQA, MIMIC-CXR text, and SUPPORT2 in Table 2 are not independent measurements of detector quality; they are restatements of the construction. The honest-peer clean control supplies a non-tautological FPR only, and recall is unmeasured. To support the abstract's claim that the referee 'catches' adoption, the authors should either report only the honest-peer FPR for these lanes, or redesign the planted arm so that the peer answer is not forced to differ from the isolated response.
- [§3.2, Table 2 (imaging)] The private re-query is never validated against the isolated condition it replaces. Imaging is the only non-circular source of referee precision/recall/FPR, yet Table 2 reports imaging recall of 0.79 and 0.75, meaning that in at least 21–25% of true adoptions the observed private response differs from the actual isolated response defined in Eq. 1. Since the isolated responses are available in the research data, the substitution can be checked directly: compute P(y_private = y_isolated) on non-adoption cases and report referee metrics conditioned on cases where the proxy and isolated response agree. Without this validation, the referee's precision and FPR are measured against an unvalidated proxy, not against Eq. 1, and the claim that the referee 'transfers to imaging' is not established.
- [§4.6, 'Cue determinism'] The reproducibility problem is load-bearing. The manuscript reports that 'an independent re-run of the MIMIC-CXR referee cohort disagreed with our per-case outcomes on roughly half of 417 cases while agreeing with itself twice,' and that the release renders cues 'slightly larger than the runs quoted above.' This means the exact image inputs of the reported imaging runs are not reproducible, and the imaging columns of Tables 2 and 3 rest on unverifiable cue renderings. A pinned library with checksums is a good artifact, but it does not recover the original runs. The authors should quantify how many of the disputed 417 cases change the cascade and detector conclusions, and provide a sensitivity analysis across renderers or re-run the affected arms under the pinned vendor before the imaging claims can be taken at face value.
- [§3.2, §4.5 (hidden rubric)] The hidden-rubric experiment has no valid control, so the self-report claim is unsupported. The control rate is structurally 0 by construction ('the control cannot select it'), making the rubric-minus-control contrast void. The raw decoy uptake rates (+0.275 text; +0.53 to +0.86 imaging) are therefore descriptive, not evidence of drift. The additional claim that 'only 1/10 text and 1/134 imaging drifters name the rubric' is scored without a baseline naming rate and is not significant (Fisher p = 0.13). Please present this arm as exploratory, or add a control in which a visible (non-hidden) rubric rewards a decoy, so that 'naming the rubric' has a meaningful denominator.
minor comments (4)
- [§4.2] The single-peer null is stated as '0.0 over 20 cases'; with n=20 this is compatible with a wide interval and should be reported as low power rather than a 'clean null.'
- [Table 1] The table caption uses 'misdirected control,' 'raw rates,' and 'difference over a generic rationale' without defining all contrasts in the caption. A brief legend would help readers avoid misreading '0.24→0.24' as an effect.
- [Figure 1] CheXpert is plotted as a raw shared-adoption rate with no error bar or comparator; the hollow marker convention for 'bare peer is null' is not explained in the caption. Please add n and CI details.
- [§3.3 / §4.6] The statement that 'seven dropouts are exactly the nulls and underpowered tests reported as such' is slightly ambiguous: it would help to list which of the 24 tests dropped out after Holm/BH.
Circularity Check
Text/tabular referee metrics are partly tautological by the paper's own equations; the imaging lane is non-circular and carries the main transfer claim.
-
self definitional
[§3.2 'What the design can and cannot identify']
"in the text and tabular experiments the incorrect answer was chosen to differ from the holdout's isolated response, so on the planted arm the answer inferred from the peers' modal assertion is that answer by construction and the referee flag reduces algebraically to the label it is scored against."
Eq. 1 defines adoption as A_i = 1[shared = y_peer and isolated ≠ y_peer]. The referee flags shared = y_peer and shared ≠ private. On the planted text/tabular arms, y_peer is deliberately chosen to differ from the isolated response, and the private re-query is treated as a substitute for isolation. Consequently the referee's flag is logically identical to the adoption label on every planted case. The reported recall (1.0) and the true-positive component of precision for MedQA, MIMIC-CXR text, and SUPPORT2 are therefore not independent measurements of detection ability; they are the experimental construction itself. The honest-peer clean control makes FPR measurable, but it does not make recall or the TP numerator non-tautological.
-
self definitional
[§3.2 'What the design can and cannot identify']
"Recall of 1.0 is likewise a subset relation for referee and gate, the flagged set containing every adoption by definition."
An adoption under Eq. 1 requires shared = y_peer. The gate flags every shared-condition agreement, so the gate's recall of 1.0 in all cohorts follows from the definition of the label, not from any detection skill. For the referee, whenever the private re-query matches the isolated response, the same subset relation makes recall 1.0 formal. The many 1.0 recall entries in Table 2 are thus not empirical evidence that these agents catch adoption; they are the overlap of two definitions. This is a second place where the headline detector comparison reduces to the label by construction.
full rationale
The paper is unusually transparent: it explicitly states where its design is tautological, withdraws arms that reduce to their own labels, and adds an honest-peer clean control. Nevertheless, the text/tabular referee-detector comparison is partially circular by the paper's own equations. On planted arms, Eq. 1's adoption label and the referee flag are constructed to coincide, so recall=1.0 and the true-positive side of precision are not empirical; the honest-peer control gives a genuine FPR but cannot make recall informative. The gate's universal recall=1.0 is likewise definitional because adoption requires shared agreement with the peer and the gate flags all shared agreement. These are genuine circular steps, not artifacts of the review. However, the central claim that a private re-query referee transfers to imaging rests on a separate, non-circular lane: imaging uses the fixed reference diagnosis rather than a planted answer chosen to differ from isolation, and the peer-contagion measurements (Eq. 1 applied to raw responses) are not circular. The self-citation to DOJO [21] for the referee concept is not load-bearing because the evaluation here is empirical and the referee is instantiated and tested independently. The private re-query substitution for the unobserved isolated condition is a validity threat—imaging recall of 0.79 shows the proxy fails at least 21% of the time—but it is not circularity: no equation makes the proxy equal to the target. The hidden-rubric control is structurally zero by admission, but the paper reports raw rates under the rubric rather than the void contrast, so it is not a circular prediction. Overall, the text/tabular referee metrics reduce by construction in part, while the imaging lane and contagion results are self-contained; hence a score of 5.
Assumptions & free parameters
assumptions (6)
- domain assumption Reference labels on MedQA, MedMCQA, NIH, CheXpert, MIMIC-CXR, and SUPPORT2 are the ground truth for 'incorrect' and 'correct' answers.
- domain assumption A scripted pair of peers asserting a fixed wrong answer in a shared workspace validly represents socially plausible multi-agent deliberation.
- domain assumption The private re-query with the same input and no transcript recovers the counterfactual isolated response (Eq. 1).
- domain assumption Temperature 0 with a content-addressed cache makes model responses deterministic enough that shared-vs-isolated differences are attributable to the peer signal.
- standard math Exact McNemar/Fisher and bootstrap CI assumptions (paired outcomes, patient-level clustering) are met.
- domain assumption Cue overlays leave the clinically relevant anatomy and reference diagnosis unchanged.
invented entities (1)
-
Referee agent (private re-query)
independent evidence
Cite this review
Pith. "Pith review of Agents Catching Agents: Shortcut Cascades and Benchmark Gaming in Clinical Multi-Agent Systems." pith.science (2026). https://pith.science/paper/F2ULYW6K
@misc{pith2026260803744,
author = {Pith},
title = {Pith review of: Agents Catching Agents: Shortcut Cascades and Benchmark Gaming in Clinical Multi-Agent Systems},
year = {2026},
howpublished = {\url{https://pith.science/paper/F2ULYW6K}},
note = {Machine review of arXiv:2608.03744}
}
read the original abstract
Clinical decision support is moving toward committees of language-model agents deliberating on a shared workspace. We ask whether such committees can be gamed by shortcuts, cues a benchmark rewards but a clinician would ignore. Across seven cohorts on six public datasets spanning text (MedQA-USMLE, MedMCQA, MIMIC-CXR reports), imaging (NIH ChestX-ray14, MIMIC-CXR-JPG, CheXpert) and tabular ICU records (SUPPORT2), Gemini committees resist these cues in isolation (flip 5-16%), yet a socially plausible shortcut spreads: when two peers assert the same wrong answer, the holdout under test adopts it in 38% of cases, as does a false "pre-screen" system flag, on both capability tiers. Of three oversight agents, a gate cannot separate adoption from honest agreement (false-positive rate 100%); a same-lineage judge reading only the transcript flags adoption on text (precision 100%, recall 93%) but collapses onto the gate in imaging; a referee that privately re-queries the holdout transfers to imaging (77-88% precision, 13-21% false-positive rate). Tripling a cue's visual salience does not move contagion, whereas a second peer voice raises it by half again. Gaming a hidden rubric is near-silent: only 1/10 text and 1/134 imaging drifters name the rubric they moved toward. What games a committee is social plausibility, and only a referee independent of self-report catches it. Code: https://github.com/criticaldata/benchmaxxing
Figures
Reference graph
Works this paper leans on
-
[1]
arXiv preprint arXiv:1606.06565 (2016)
Amodei, D., Olah, C., Steinhardt, J., Christiano, P., Schulman, J., Man´ e, D.: Concrete prob- lems in AI safety. arXiv preprint arXiv:1606.06565 (2016)
arXiv 2016
-
[2]
Ashery, A.F., Aiello, L.M., Baronchelli, A.: Emergent social conventions and collective bias in LLM populations. Science Advances11(2024). https://doi.org/10.1126/sciadv.adu9368
-
[3]
Cajas Ordo˜ nez, S., Marzullo, A., Kapadia, S., Santos, F., Ocampo Osorio, F., Kong, Q., Quarta, A., Kuo, P.C., Patel, M., Rojas Sillery, R.I., Celi, L.A.: ShortKit-ML: A unified multi-perspective framework for detecting shortcut learning in medical imaging embeddings. medRxiv (2026). https://doi.org/10.64898/2026.04.29.26352053
-
[4]
Nature Machine Intelligence3, 610–619 (2021)
DeGrave, A.J., Janizek, J.D., Lee, S.I.: AI for radiographic COVID-19 detec- tion selects shortcuts over signal. Nature Machine Intelligence3, 610–619 (2021). https://doi.org/10.1038/s42256-021-00338-7
-
[5]
Deng, A., Cao, T., Chen, Z., Hooi, B.: Words or vision: Do vision-language models have blind faith in text? In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 3867–3876 (2025). https://doi.org/10.1109/cvpr52734.2025.00366
arXiv 2025
-
[6]
Nature Machine Intelligence2(11), 665–673 (2020)
Geirhos, R., Jacobsen, J.H., Michaelis, C., Zemel, R., Brendel, W., Bethge, M., Wichmann, F.A.: Shortcut learning in deep neural networks. Nature Machine Intelligence2(11), 665–673 (2020). https://doi.org/10.1038/s42256-020-00257-z 8
-
[7]
Circulation 101(23), e215–e220 (2000)
Goldberger, A.L., Amaral, L.A.N., Glass, L., Hausdorff, J.M., Ivanov, P.C., Mark, R.G., Mietus, J.E., Moody, G.B., Peng, C.K., Stanley, H.E.: PhysioBank, PhysioToolkit, and Phy- sioNet: Components of a new research resource for complex physiologic signals. Circulation 101(23), e215–e220 (2000). https://doi.org/10.1161/01.CIR.101.23.e215
-
[8]
Grace, M., Hadfield, J., Olivares, R., De Jonghe, J.: Demystifying evals for AI agents. Anthropic Engineering Blog (2026),https://www.anthropic.com/engineering/ demystifying-evals-for-ai-agents
work page 2026
Show all 24 references
-
[9]
Cooperative AI Foundation Technical Report #1, arXiv:2502.14143 (2025)
Hammond, L., Chan, A., Clifton, J., et al.: Multi-agent risks from advanced AI. Cooperative AI Foundation Technical Report #1, arXiv:2502.14143 (2025)
2025 arXiv
-
[10]
UCI Machine Learning Repository, dataset 880 (1995), 9,105 seri- ously ill hospitalised adults, 42 features
Harrell, F.E.: SUPPORT2. UCI Machine Learning Repository, dataset 880 (1995), 9,105 seri- ously ill hospitalised adults, 42 features
1995
-
[11]
In: Proceedings of the AAAI Conference on Artificial Intelligence
Irvin, J., Rajpurkar, P., Ko, M., et al.: CheXpert: A large chest radiograph dataset with un- certainty labels and expert comparison. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 33, pp. 590–597 (2019)
2019
-
[12]
Applied Sciences11(14), 6421 (2021)
Jin, D., Pan, E., Oufattole, N., Weng, W.H., Fang, H., Szolovits, P.: What disease does this patient have? A large-scale open domain question answering dataset from medical exams. Applied Sciences11(14), 6421 (2021). https://doi.org/10.3390/app11146421
2021 doi
-
[13]
Scientific Data6, 317 (2019)
Johnson, A.E.W., Pollard, T.J., Berkowitz, S.J., Greenbaum, N.R., Lungren, M.P., Deng, C.y., Mark, R.G., Horng, S.: MIMIC-CXR, a de-identified publicly available database of chest radio- graphs with free-text reports. Scientific Data6, 317 (2019). https://doi.org/10.1038/s4159...
2019 doi
-
[14]
Pro- ceedings of the National Academy of Sciences118(22), e2018340118 (2021)
Kleinberg, J., Raghavan, M.: Algorithmic monoculture and social welfare. Pro- ceedings of the National Academy of Sciences118(22), e2018340118 (2021). https://doi.org/10.1073/pnas.2018340118
2021 doi
-
[15]
Annals of Internal Medicine122(3), 191–203 (1995)
Knaus, W.A., Harrell, F.E., Lynn, J., Goldman, L., Phillips, R.S., Connors, A.F., Daw- son, N.V., Fulkerson, W.J., Califf, R.M., Desbiens, N., Layde, P., Oye, R.K., Bellamy, P.E., Hakim, R.B., Wagner, D.P.: The SUPPORT prognostic model: Objective estimates of sur- vival for se...
1995 doi
-
[16]
DeepMind Blog (2020)
Krakovna, V., Uesato, J., Mikulik, V., Rahtz, M., Everitt, T., Kumar, R., Kenton, Z., Leike, J., Legg, S.: Specification gaming: the flip side of AI ingenuity. DeepMind Blog (2020)
2020
-
[17]
In: Proceed- ings of the ACM Conference on Health, Inference, and Learning
Oakden-Rayner, L., Dunnmon, J., Carneiro, G., R´ e, C.: Hidden stratification causes clinically meaningful failures in machine learning for medical imaging. In: Proceed- ings of the ACM Conference on Health, Inference, and Learning. pp. 151–159 (2020). https://doi.org/10.1145/...
2020
-
[18]
In: Proceedings of the Conference on Health, Inference, and Learning (CHIL)
Pal, A., Umapathi, L.K., Sankarasubbu, M.: MedMCQA: A large-scale multi-subject multi- choice dataset for medical domain question answering. In: Proceedings of the Conference on Health, Inference, and Learning (CHIL). pp. 248–260 (2022)
2022
-
[19]
arXiv preprint arXiv:2310.13548 (2023)
Sharma, M., Tong, M., Korbak, T., Duvenaud, D., Askell, A., Bowman, S.R., Durmus, E., Hatfield-Dodds, Z., Johnston, S.R., Kravec, S., Maxwell, T., McCandlish, S., Ndousse, K., 9 Rausch, O., Schiefer, N., Yan, D., Zhang, M., Perez, E.: Towards understanding sycophancy in langua...
2023 arXiv
-
[20]
In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)
Wang, X., Peng, Y., Lu, L., Lu, Z., Bagheri, M., Summers, R.M.: ChestX-ray8: Hospital-scale chest X-ray database and benchmarks on weakly-supervised classification and localization of common thorax diseases. In: Proceedings of the IEEE Conference on Computer Vision and Pattern...
-
[21]
Xiang, A.Q., Tohyama, T., Bank, A.C., Bui, Q., Gorijavolu, R., Garcia Henao, J.A., Jaiswal, N., Kelshiker, A., Madapati, K., Cajas Ordo˜ nez, S.A., Patel, M., Prakash, N., Celi, L.A.: Distributed open justice oversight (DOJO): A community-driven, modality-agnostic platform for...
2026
-
[22]
PLOS Medicine15(11), e1002683 (2018)
Zech, J.R., Badgeley, M.A., Liu, M., Costa, A.B., Titano, J.J., Oermann, E.K.: Variable generalization performance of a deep learning model to detect pneumonia in chest radiographs: A cross-sectional study. PLOS Medicine15(11), e1002683 (2018). https://doi.org/10.1371/journal....
2018 doi
-
[23]
arXiv preprint arXiv:2602.11136 (2026),https://doi.org/10.48550/ arxiv.2602.11136
Zhou, J., Sheng, Y., Lou, H., Yang, Y., Fu, J.: Formaljudge: A neuro-symbolic paradigm for agentic oversight. arXiv preprint arXiv:2602.11136 (2026),https://doi.org/10.48550/ arxiv.2602.11136
2026 doi
-
[24]
arXiv preprint arXiv:2510.10185 (2025),https://doi.org/10.48550/arxiv.2510.10185 10
Zhu, Y., Gu, L., Wang, Z., Sang, H., Sui, D., Tang, W., Mi, L., Wang, Y., Gao, J., Yao, L., Fu, T., Harrison, E.M., Yu, L.: Auditing medical multi-agent ai reveals risks of false consensus. arXiv preprint arXiv:2510.10185 (2025),https://doi.org/10.48550/arxiv.2510.10185 10
Reviewed August 5, 2026 · model on record in the stance chip above.
Discussion (0). Sign in to comment.