Quick Take
- The test: Tampered ML pairs 1,858 experiment designs from top ML papers with a copy that has one planted methodological flaw. Models must pick the sound version in both presentation orders.
- The result: Frontier models beat chance but are far from reliable. The best, Claude Opus 5 and Claude Fable 5, reach about 78 to 79% in both orders; many models fall well below that.
- The weakness: Models change their verdict when the order is swapped, and often prefer the flawed design because it sounds more specific, transparent or conventional.
If AI systems are to help run AI research, including safety research, they have to tell a good experiment from a subtly broken one before anyone spends compute on it. A new paper by Soroush Ebadian (Anthropic Fellows Program), Parand A. Alamdari (University of Toronto), and Joe Benton and Hailey Joren (Anthropic), accepted at EMNLP 2026, builds a benchmark for exactly that skill. Its verdict: today’s models notice many flaws, but cannot yet be trusted to weigh them.
What the study shows
The authors started from oral and spotlight papers at NeurIPS, ICML and ICLR from 2024 to 2026 (981 papers in the leaderboard set). A language-model pipeline extracted one experiment per item, rewrote it as a self-contained proposal, then planted a single flaw by a minimal edit, changing a median of only 2.0% of the text. Several automated gates checked that the original stays faithful to the paper and that the edit really changes the experiment. Each model sees the pair twice, once in each order, and only gets credit if it picks the original both times; random guessing scores 25%.
| Measure | Result |
|---|---|
| Best both-orders accuracy | 77.9% (Claude Opus 5); Claude Fable 5 79.6% on the items it answers, 73.5% counting its 7.8% refusals as errors |
| Best per-order accuracy | 86 to 88% (Opus 5, Fable 5) |
| Order effect, Claude Opus 4.6 | about 66% per order vs. 43% in both orders |
| Rating proposals one at a time (0 to 100) | 4 to 19 points lower than pairwise; best Opus 5 at 68.8%, Gemini 3.1 Pro 67.6% |
| Estimated share of valid items (human check) | 86% (95% CI 81 to 91%) |
- Right flaw, wrong verdict: When a model was right in only one order, its reasoning usually named the planted flaw (above 86% for the stronger models). Order bias, not ignorance, explains many misses.
- Order shifts confidence: Even when correct in both orders, several models, especially the Opus models and GPT-5.5, were less confident and thought longer when the original came second.
- Typical errors: The authors catalog seven failure modes, including treating common practice as proof of validity, reading added detail as rigor, echoing the flawed proposal’s own justification, contradicting themselves across orders, and “recalling” the source paper incorrectly.
- Hints help, compute helps less: On a hard subset of 896 items, telling Opus 4.7 and Gemini 3.1 Pro that one design is flawed, and especially naming the flaw category, recovered many errors. More reasoning effort raised accuracy within each model, with diminishing returns; Opus 5 at its lowest effort already matched or beat most other models’ best settings.
Why it matters: judging experiments is an oversight skill
- Clear ground truth: Comparing two independent research proposals rarely has a right answer. Minimal edits make the label clean: the tampered design only needs to be worse along one dimension.
- Order-robust scoring: Requiring the right answer in both orders exposes position bias that a single-order score would hide.
- Human validation: Late-stage ML PhD students and PhD graduates reviewed 210 items, deliberately focused on items strong models missed; 166 were judged valid. Post-stratified, that gives the 86% estimate.
- Built for reuse: A public subset is on GitHub with a canary string against training contamination; the rest is available to researchers on request.
Method in brief
Source: 981 oral and spotlight papers with LaTeX source from NeurIPS, ICML and ICLR 2024 to 2026. Construction: Claude Opus 4.6/4.7 and Sonnet 4.6 extract a structured fact set, write the original proposal, plan and apply one flaw, and pass gates for faithfulness, real divergence from the paper, experimental non-equivalence, self-containedness and absence of giveaway cues. A difficulty filter removed items a panel of models already solved, leaving 1,858. Flaw types: confounded comparison (20.5%), blocked mechanism (20.3%), measurement mismatch (18.0%), unfair comparison (17.1%) and four smaller categories including data leakage (2.8%). Models: 22 models from Anthropic, OpenAI, Google, xAI, DeepSeek, Moonshot, Z.ai, Qwen and MiniMax, mostly at high reasoning effort.
What remains open
- Models built the test: The pipeline uses language models to generate and check items, so model errors can shape the benchmark. About one item in seven is estimated not to be clearly valid.
- Thin human check: Each reviewed item had a single validator, and only 128 of the reviewed items are in the 1,858-item leaderboard set.
- Easier than reality: Real proposals have several interacting weaknesses and no matched counterpart to compare against. The authors call their accuracies optimistic estimates, and pointwise scoring already shows a lower ceiling.
- Judging is not designing: The benchmark measures whether models recognize flaws, not whether they avoid them when they write experiments themselves. Construction pipeline code is not released.
Context: from finding errors to weighing them
Earlier benchmarks such as FLAWS and PaperAudit-Bench plant errors in full papers and ask models to locate them; MLE-Bench, RE-Bench and PaperBench test agents as executors of ML research. Tampered ML targets a narrower skill: deciding which of two near-identical designs supports its claim. It fits a growing body of evidence that LLM reviewers sound convincing while missing what matters, covered in i10X’s Benchmarks & Evals section.
What it means for research teams using AI reviewers
- Swap the order: When asking a model to compare two designs, run both orders and treat disagreement as a warning sign.
- Ask for a defect, not a winner: Prompts that say a flaw exists and suggest where to look recovered many errors in the study.
- Distrust polish: Extra specificity and “standard practice” language are exactly what fooled models. Keep a human in the loop for go/no-go decisions on experiments.
More on the lab behind the benchmark and its leading models is on the Anthropic hub and the Claude product page.
About the analysis
Researched and written with AI assistance under the editorial responsibility of the i10X News team. The title image is an AI-generated illustration. Read our AI Use Policy. Spotted an error? Request a correction.
This article is based on the full text of “Tampered ML: Evaluating LLM Judgment of Machine Learning Research” (arXiv:2610.32114v1, submitted October 23, 2026; EMNLP 2026 Main), including the limitations and the human-validation appendix. All numbers come from the paper; i10X did not rerun the evaluation. Three of the four authors are affiliated with Anthropic or its Fellows Program, and Anthropic models top the leaderboard; the paper contains no separate funding or competing-interest statement. The paper is licensed CC BY 4.0, and Figure 1 is reproduced under that license. AI tools assisted with research, drafting and the title illustration; the selection, fact-checking and final editing were done by the i10X editorial team.
i10x Perspective
The most telling result is not the leaderboard but the pattern of errors. Models often see the flaw and then talk themselves out of it, rewarding detail and convention over validity. That is a very human failure, and a dangerous one to automate: a reviewer that explains itself fluently is easy to trust. Labs that want AI to propose and filter experiments, including for safety research, will need order-robust checks and explicit flaw hunting built into the loop. It is also worth noting who sits at the top: an Anthropic-led benchmark ranked Anthropic models first, so independent replication on the public subset would add weight.
