AI结论没变，证据却换了
两个科研 AI 给出同一个结论，引用的证据却可以完全不同——这篇把这件事变成了可测的。研究者在同一个计算节点上存下「参考值」和「候选值」，再原位还原或移植，让模型在正常硬件上跑。结果：Qwen3.5-4B 在三种组合下稳定地换了引用，Gemma 3 4B IT 在四种组合下连「读到什么」都变了，七个组合只覆盖两个论断。把数值全部还原后，引用证据集恢复原样，结论却始终没动。更具体的是 hERG 心脏安全性测试分配：静默的数值错误改变了「测哪些化合物」的决定，而固定预算的候选名单里被标为阻断剂的数量一个没变——结论看着一样，实际动作已经偏了。研究者随后把模型恢复到出错前的执行状态、再喂入经认证的分数，39 个被改变的决定全部找回；只替换预测文件则一个都救不回。这不是你明天能用的工具，但它指出了一个审计盲区：只看最终答案，等于没审。
📄 原文摘要(英文)
A scientific agent can give the same verdict while reading and citing different evidence. BioAgent-DF tests this separation using paired reference and candidate values saved at the same scientific computation site. It restores or transplants those values at their original coordinates, then runs the agent on healthy hardware. Across eight SciFact batches, Qwen3.5-4B shows repeatable citation changes in three capture-claim combinations, and Gemma 3 4B IT shows repeatable read and citation changes in four. These seven combinations cover two claims. Full restoration recovers the reference evidence sets while verdicts remain unchanged. Verdict changes observed under the baseline prompt did not recur under the explicit-example prompt. Complementary tool and optimizer experiments distinguish recovery of numerical state, recovery of ranked lists, and restoration of an agent's visible history. These results show that an audit should track both the evidence an agent uses and its final answer. In hERG cardiac-safety assay allocation, silent numerical faults changed testing decisions while the fixed-budget shortlist kept the same number of compounds labeled as blockers. After the agent had used faulty values, restoring its earlier execution state and supplying certified scores recovered all 39 changed decisions, whereas replacing the prediction file recovered none; no incorrect action was committed. A streaming implementation of the arithmetic checks reduced the total time for forward execution and verification by 42.4% relative to the original FP64 implementation, with identical flags and recovery outputs.