Artifact-centered Claim-aware Observability for Autonomous Scientific Agents
When AI systems run experiments and write papers themselves, call logs alone can't tell you what went wrong
As autonomous AI systems increasingly propose ideas, run experiments, and draft papers, simply logging every model call isn't enough to catch failures, since problems are often scattered across multiple objects rather than one call. This paper argues the right unit of audit is the artifact and the claim, not the individual model call, and proposes a lightweight observability profile built around candidate artifacts, the operations that create them, evaluator results, archive decisions, human interventions, and claims with linked evidence. It positions this as a complementary layer on top of existing tools like OpenTelemetry, PROV-O, and RO-Crate rather than a replacement.
METAL MEDIA explanatory visual
When AI systems run experiments and write papers themselves, call logs alone can't tell you what went wrong
- 01Problem: call-by-call logs (what happened and when) can't catch failures in autonomous scientific agents because failures are often distributed across several objects—a manuscript may cite the wrong evidence, a search process may pick a degenerate candidate, or a lab novelty claim may rest on an unstated rule.
- 02Gap in existing tools: LLM tracing tools, experiment trackers, and provenance standards (PROV-O, RO-Crate) each answer a different narrow question (what call happened next, which run produced this metric, how was the final object derived), but none makes 'what evidence supports this claim' or 'who approved it' a first-class, queryable relation.
- 03Proposed profile: eight components—individuals (candidate artifacts like programs, drafts, tables, samples, claims), operators (events that derive artifacts), fitness records (evaluator outputs), lineage (parent-child graph), archives (curated selected sets), runs, streams (workers/agents/instruments), and steering commands (human interventions). Notably, scientific claims are treated as ordinary individuals with explicit evidence bindings and verification records, not special annotations.
- 04Worked example and payoff: using a case where an agent claims a 4.2 percentage point accuracy improvement that contradicts the experiment log, the paper shows a reviewer can query for unsupported claims, candidates accepted without independent evaluation, or archive decisions made after a human intervention—without reading thousands of logged calls. The profile is meant to sit alongside, not replace, standards like OpenTelemetry, PROV-O, and RO-Crate.
- 05Limitations: this observability layer doesn't prevent hallucination, fabrication, unsafe lab actions, or benchmark overfitting on its own—verification quality still depends on evaluators and human judgment. Deciding what counts as a distinct 'artifact' at what granularity remains an open, domain-specific question.
What they did
- Problem: call-by-call logs (what happened and when) can't catch failures in autonomous scientific agents because failures are often distributed across several objects—a manuscript may cite the wrong evidence, a search process may pick a degenerate candidate, or a lab novelty claim may rest on an unstated rule.
- Gap in existing tools: LLM tracing tools, experiment trackers, and provenance standards (PROV-O, RO-Crate) each answer a different narrow question (what call happened next, which run produced this metric, how was the final object derived), but none makes 'what evidence supports this claim' or 'who approved it' a first-class, queryable relation.
- Proposed profile: eight components—individuals (candidate artifacts like programs, drafts, tables, samples, claims), operators (events that derive artifacts), fitness records (evaluator outputs), lineage (parent-child graph), archives (curated selected sets), runs, streams (workers/agents/instruments), and steering commands (human interventions). Notably, scientific claims are treated as ordinary individuals with explicit evidence bindings and verification records, not special annotations.
- Worked example and payoff: using a case where an agent claims a 4.2 percentage point accuracy improvement that contradicts the experiment log, the paper shows a reviewer can query for unsupported claims, candidates accepted without independent evaluation, or archive decisions made after a human intervention—without reading thousands of logged calls. The profile is meant to sit alongside, not replace, standards like OpenTelemetry, PROV-O, and RO-Crate.
- Limitations: this observability layer doesn't prevent hallucination, fabrication, unsafe lab actions, or benchmark overfitting on its own—verification quality still depends on evaluators and human judgment. Deciding what counts as a distinct 'artifact' at what granularity remains an open, domain-specific question.
| Audit question | Required relation | Example failure exposed |
|---|---|---|
| Where did this result come from? | Parent individuals, derivation operator, emitter stream | Final candidate descends from a failed or out-of-policy branch |
| What supports this claim? | Claim individual, evidence references, evidence bindings | Manuscript cites a table whose value contradicts the sentence |
| Who or what accepted it? | Fitness record, evaluator identity, threshold or rubric | One unstable evaluator dominates a multi-evaluator pipeline |
| How was the search steered? | Steering command, applied operator, affected archive or plan | Human correction is overwritten by a later autonomous step |
| What was discarded? | Archive-update and rejection events | Negative results or failed replications disappear from the record |
| Step | Record | Audit-relevant fields |
|---|---|---|
| 1 | Individual: experiment log | id=i_exp, kind=experiment_log, payload hash, metric table URI. |
| 2 | Individual: draft | id=i_draft, kind=manuscript_draft, payload hash for generated text. |
| 3 | Operator: extract claim | Parent i_draft, child i_claim, stream writer, extractor version. |
| 4 | Individual: claim | kind=claim, text payload, evidence_refs=[i_exp], binding to metric row and value. |
| 5 | Operator: verify | Parent i_claim, context i_exp, evaluator claim_numeric_checker. |
| 6 | Fitness: verification | Target i_claim, value unsupported, reason evidence_mismatch, extracted and claimed values. |
| Record | Minimum fields | Integrity rule |
|---|---|---|
| Individual | id, run_id, kind, created_at, payload reference or hash | The identifier denotes one inspectable artifact version: draft, code, dataset, sample, measurement, plan, policy, evaluator, or claim. |
| Operator | id, op_type, parent_ids, child_ids, emitter stream, timestamp | Children are derived from earlier parents or explicitly imported external objects. Context references do not imply derivation. |
| Fitness record | evaluated individual, evaluator identity and version, value or verdict, timestamp | The evaluator version is part of the result. A later evaluator may disagree without overwriting the earlier record. |
| Evidence binding | claim identifier, evidence identifier, locator, extracted value or rule, binding role | A claim can cite many evidence objects, and each citation can fail independently. |
| Archive event | archive identifier, member identifier, add/remove action, rule or policy, timestamp | Membership history is event-sourced. The current archive is a derived view. |
| Run and stream | run identifier, stream identifier, invoker identity, parent run when applicable | Parallel agents, tools, humans, and instruments can emit into separate streams without requiring separate schemas. |
| Steering command | command identifier, issuer, target stream or operator, instruction type, effect reference | Human interventions and policy updates are auditable artifacts, not comments hidden in logs. |
| Query | Records read | Expected answer |
|---|---|---|
| List unsupported final claims | Final report archive, claim individuals, evidence bindings, verification fitness | Claims with no supporting evidence, failed verification, stale evidence, or explicit unsupported status. |
| Trace a number in the manuscript | Claim individual, locator, evidence binding, source table or run artifact, verifier record | The evidence object, extracted value, claimed value, and pass/fail status. |
| Recover the best candidate’s ancestry | Archive event, selected individual, lineage operators, parent individuals, fitness records | The branch or population history that produced the selected artifact. |
| Detect archive collapse | Archive events, lineage graph, payload hashes, diversity metrics when present | Whether high-scoring candidates share recent ancestors, duplicate payloads, or one evaluator loophole. |
| Find the cause of a plan revision | Plan individuals, revision operators, context references, message operators, steering commands | The result, reviewer artifact, tool failure, or human intervention that changed the plan. |
| Audit self-modification | Agent-policy individuals, self-modification operators, later operator context | Which agent version produced each result and whether evaluator or policy changes preceded acceptance. |
| Audit closed-loop claims | Sample, protocol, instrument, measurement, extraction, claim, and verifier records | Which physical evidence and decision rule support each novelty, yield, or safety claim. |
| Check redaction boundaries | Payload manifest, redaction records, event hashes, access labels | Which payloads are hidden, why they are hidden, and whether their event identities remain intact. |
| Case | Minimal event sequence | What becomes inspectable |
|---|---|---|
| Hallucinated number | draft_4 → extract_claim → claim_23. claim_23 binds to run7_metrics. metric_checker_v2 emits fail with observed value 84.7 rather than claimed value 87.4. | The sentence is no longer buried in prose. The trace identifies the claim, the evidence table, the extracted value, the checker version, and the repair or propagation path. |
| Evolutionary collapse | program_87 and program_91 produce children through mutation and crossover. Benchmark fitness rises. Archive events admit near-duplicate payload hashes under one selection rule. | Improvement can be separated from diversity. A reviewer can see whether the archive exploited a benchmark corner rather than discovering robust alternatives. |
| Plan revision | A runner artifact reports a failed experiment. A critic stream emits a review. A human steering command changes the priority. revise_plan derives plan_v2 from plan_v1 with both records as context. | The plan change has a visible cause. Cross-agent handoff and human steering are part of lineage rather than chat transcript residue. |
| Closed-loop novelty | sample_s17, protocol_p4, and xrd_file_s17 feed an extraction operator. A novelty rule emits a verdict. A manuscript claim binds to the rule, reference set, and instrument file. | A later correction can identify whether the disputed claim came from the measurement, the extraction, the database comparison, or the novelty rule. |
| Self-modification | agent_v2 edits its prompt and evaluator definition, producing agent_v3. Later candidate-generation operators list agent_v3 as context. | The trace remains acyclic by version while showing that the process generating later artifacts changed. |
| Package component | Contents | Failure mode avoided |
|---|---|---|
| Event stream | JSONL, database export, or graph export containing the contract in Table A.1 | Reviewers receive files but cannot reconstruct relations among claims, evidence, and evaluations. |
| Payload manifest | Hashes or URIs for drafts, code, tables, datasets, notebooks, instrument files, figures, and external references | A trace points to objects whose identity changed after the run. |
| Validator report | Reference checks, acyclicity checks, required-field checks, final-claim coverage, redaction accounting | Missing or malformed relations are discovered only during manual review. |
| Inspection queries | Saved queries for unsupported claims, lineage, archive history, steering effects, and redaction boundaries | Each reviewer reconstructs a different audit procedure. |
| Telemetry export | Span identifiers, model metadata, tool calls, latency, token counts, errors, and links to produced individuals | Execution debugging is separated from scientific artifact audit. |
| Archival export | PROV-O, RO-Crate, OpenLineage, or domain archive bundle when applicable | Final research objects lose the running history that explains how they were selected. |
Why it matters
As autonomous AI systems move into real research workflows—writing papers, running experiments, discovering materials—there's currently no standard way to trace whether a reported claim is actually backed by evidence, which raises real risk of fabricated or unverified results reaching publication. This proposal gives researchers, reviewers, and benchmark designers a concrete minimum set of requirements for making AI-generated scientific outputs auditable.
Terms in this paper
- OpenTelemetry · An industry-standard tool for logging software execution details like calls and latency
- PROV-O / RO-Crate · W3C standards for recording how research data or artifacts were derived and packaging them for sharing
- lineage · The parent-child graph showing which artifacts were derived from which earlier artifacts
- archive · A curated set of selected candidates kept from a larger pool, such as a set of top-performing results
- evidence binding · An explicit link recording exactly which data or measurement a claim relies on
Original abstract (English)
Autonomous scientific agents now increasingly propose ideas, write code, run experiments, analyze results, and even draft papers. Observe and audit those agents are necessary but logging every model call is not enough, scientists also need to inspect the artifacts and claims that the systems produced and their relations. This is driven by the fact that failures in scientific agent systems are often distributed across several objects. A manuscript claim may cite the wrong evidence, a search process may select a degenerate candidate, a laboratory novelty claim may depend on an unstated rule, or a multi-agent plan may change without a visible trigger. Existing tracing, experiment tracking, and archival provenance tools are valuable, but their native objects do not make these scientific audit relations first-class. We argue that autonomous scientific systems should emit portable, claim-aware artifact lineage as a minimum audit layer. We propose a compact observability profile organized around individuals, operators, fitness records, lineage, archives, runs, streams, and steering commands. In this profile, scientific claims are ordinary individuals with explicit evidence bindings and verification records. The profile is intended as a semantic layer that complements current telemetry and provenance standards. Execution details can remain in OpenTelemetry. Final packages can export to PROV-O or RO-Crate standards.
Read on arXivLatest papers
- SWE-bench Science: Can Coding Agents Resolve Engineering Tasks in Science?AI coding agents were tested on fixing real scientific software, and even the best one failed more than half the time
- FlashPrefill V2: Block-Sparse Prefill Attention for Long-Context LLM ServingMaking sparse attention fast enough and accurate enough for real LLM serving, not just papers
- PolicyGuide: From Guarding One Action to Guiding the Whole Workflow for Policy-Compliant LLM AgentsMaking customer-service AI agents follow the whole procedure, not just avoid one bad action
- EXIMO: VLM Guided Exploration of VLA PoliciesTeaching a robot new chores without human teleoperation, by letting a chatty AI supervise it
- EnvHarness: Awakening Static Worlds for Agent LearningInstead of building new training worlds from scratch, this work adds a plug-in layer that reshapes existing ones around each agent's actual weaknesses
- Bounded Sovereignty and the Control Tax: Pricing AI Oversight When the Deployer Does Not Own the ModelCompanies that rent AI instead of owning it can only do half of AI safety oversight
- Beyond Imitation: Filtering On-Policy Distillation by Reasoning ProgressA fix for AI models that get penalized by their teacher even when they're reasoning correctly
- PersonalBench: Measuring the Authorship Gap in LLM PersonalizationAI can be prompted to write 'like someone,' but its own voice never fully disappears
Latest from METAL MEDIA
Figures: Xiangyu Yin et al., arXiv:2608.18312, CC BY 4.0