Cros: risk-constrained stopping for clinical diagnosis agents

A stopping layer that tries to decide when a sequential diagnosis agent should diagnose or defer — with finite-sample style tests, and an honest ‘exploratory, not confirmatory’ framing.

Primary source: arXiv:2609.09678: https://arxiv.org/abs/2609.09678

What’s new: Most “diagnosis agent” benchmarks score accuracy after a fixed or unconstrained dialogue. They rarely ask the harder operational question: when is it safe for the agent to stop, diagnose, or defer? Cros (arXiv:2609.09678, Wu & Rus, submitted 9 Sep 2026) proposes a risk-constrained stopping layer for sequential clinical diagnosis agents. It combines state-wise error ranking, policy design on disjoint development splits, and LTT-style exact tests of selective diagnostic error and minimum autonomous coverage for complete sequential policies. The finite-sample-style guarantee the authors describe requires the candidate family, testing rule, and any randomization to be frozen before calibration labels are touched.

On a 1,834-episode MIMIC-derived abdominal-pain benchmark, the full ranker reaches an exploratory state-error AUROC of 0.853, versus 0.715 for maximum class probability and 0.552 for the backbone’s native stop score. On a previously viewed 367-episode evaluation split, analytically averaging over the frozen Cros weights yields 16.9% selective error at 78.8% coverage (cost 5.57, 0.68 tests), compared with native stopping at 30.8% error, 100% coverage, cost 8.14, and 1.53 tests. Forced continuation is non-monotone in this setting: error is 28.3% with history of present illness alone and 34.3% after a full workup — more tests are not automatically safer. A uniform-weight mixture ablation is cheaper on the viewed split even though it misses the locked development margins, and Cros nominally meets the joint criterion in only 6 of 20 development resplits.

Why it matters: Agent demos love next-action accuracy. Clinics care about when to shut up and escalate. A separable stopping layer with selective coverage is the right shape of problem for safety-minded medical ML: trade autonomous decisions for lower error, measure the deferral rate, and put the statistical assumptions in writing. The non-monotone “more workup, worse error” result is also a useful corrective to the intuition that longer tool use always helps.

This fits Bitware’s safety and eval lane: the contribution is less “new diagnose-anything model” and more “how do you evaluate and constrain when an agent is allowed to act.”

Caveats: Lean on the authors’ own framing. Because evaluation labels were inspected during earlier development, they present the numbers as exploratory feasibility and audit evidence — not a confirmatory safety certificate. The setting is MIMIC-derived episodes, not a live ED deployment. Resplit fragility (6/20) and the cheap uniform-weight ablation both say the margins are sensitive to how you lock the policy. Selective coverage improves error by declining cases; that is a feature for risk control and a cost for autonomy metrics. Until someone freezes the procedure before seeing the eval labels and repeats the claim out of sample, treat Cros as a careful prototype of how to ask the stopping question — not as a green light for unsupervised diagnostic agents.