SARC-DQ: Runtime Data-Quality Gating for Agentic AI: Silent Evidence Defects, the Incompetence Shield, and Downstream-Only Remediation

Can Smarter Agents Solve Bad Data?

When AI agents move from simply chatting to taking actions—like placing orders or managing inventory—the stakes of a mistake shift. A mistake shifts from a wrong sentence to a real-world currency loss. Most work in agentic robustness focuses on handling noise or tool failures. Researchers assume a "smart" model can reason its way out of a confusing situation. But what happens when the data itself is technically perfect but fundamentally wrong?

The problem arises from "metadata-borne" defects. These are errors like a stale price or a superseded record. They look entirely valid in the data payload (the actual content of the message). However, they are betrayed only by their metadata (information about the data, such as its age, origin, or version). Because these defects do not manifest as contradictions, they are structurally invisible to a model that only sees the payload. This paper investigates whether increasing model intelligence can bridge this gap.

The invisibility of the metadata channel

The authors investigate if the "intelligence" of an agent can compensate for missing context. They ask a specific question. If an agent is presented with a perfectly well-formed but stale piece of information, will a more capable model notice? Will it eventually learn to doubt that information? Or is the defect structurally undetectable?

They frame the problem through the "silent conversion chain." A metadata-borne defect enters the system. Because it is invisible in the payload, the agent perceives it as truth. The agent then acts confidently. Finally, that confident action converts the data defect into a tangible loss .

The core tension is whether "capability" (the ability to reason complexly) can serve as a proxy for "integrity" (the ability to verify the truth of one's inputs).

The failure of the scaling hypothesis

The prevailing intuition in LLM research is that scaling laws are broadly applicable. As models get larger and more expensive, they become better at spotting subtle errors. One might expect a frontier model would notice that a price seems "off." One might expect it to exhibit some form of behavioral hesitation.

However, the paper identifies a phenomenon called the "incompetence shield." In their pilot study, they found that low-capability agents were actually less vulnerable to these defects. This is because they were "inelastic" (they did not closely follow the signal). They lacked the reasoning capacity to follow the corrupted signal to a disastrous conclusion. Conversely, as agents become more competent and "elastic," they track the corrupted evidence more faithfully. This means they inherit the corruption more effectively. Scaling might actually increase the risk of silent failure in enterprise environments.

Testing the ladder of capability

To test this, the researchers deployed a "four-model tier ladder" on a priced replenishment task. This was a "newsvendor" problem (a task where an agent decides how much stock to order based on a unit price). They spanned approximately 15× in inference price. They moved from smaller models like Haiku to frontier models like Fable.

The results were striking. Across all four tiers, the Action Deviation Rate (ADR)—the frequency with which a defect leads to a wrong action—remained flat or slightly rose. It moved from 60% at the lowest tier to 62% at the highest . This means higher intelligence did not reduce the error rate. Crucially, the agents showed no sign of realizing anything was wrong. Behavioral doubt markers (signals in the text that the agent is uncertain) stayed at chance levels ($\text{AUC} \le 0.50$). Explicit data-quality flags were non-existent (0%).

The researchers developed a model-free "analytical oracle" to predict these rates. This oracle uses the task's decision geometry (the mathematical structure of the choices). It tracked the measured ADR with high precision (MAE 0.015; $\text{Pearson } r = 0.876$) .

The oracle predicts the error rate without knowing anything about the LLM's "intelligence." This implies the errors are driven by the data's structure, not the model's reasoning limits.

Architecture over intelligence

Since scaling the model failed to solve the problem, the authors propose an architectural remedy. They suggest a "Pre-Action Gate." Instead of asking the LLM to be a data auditor, they place a lightweight, metadata-aware gate at the point of action. This gate does not reason. It simply checks programmed predicates (rules like freshness or schema conformance) against the metadata.

The findings regarding this gate are nuanced. The authors admit the gate does not achieve total "portfolio recovery" (the goal of fixing all errors across all categories). In fact, overall portfolio recovery was $-0.04$. This was largely because the gate lacked a predicate for "silent unit changes." This is a specific error where the value is valid but the units are wrong .

However, the gate was highly successful on the specific channels it was designed for. For example, on the "freshness" channel (detecting stale data), the gate achieved 100% detection. In contrast, a payload-only critic achieved 0% [Table 3]. The paper concludes that mitigation effectiveness depends on "enforcement placement and predicate coverage."

Implications for agentic systems

The implications of this work suggest a shift in how we build autonomous enterprise systems.

First, improving a model's reasoning capabilities will not protect an agent from acting on a stale price. This is true if that price is presented as a valid number. Reliability in agentic workflows must be treated as a systems-engineering problem. It is an issue of "memory protection" (preventing unauthorized access to data) for data.

Second, the "incompetence shield" provides a warning for developers. A highly capable agent is a high-fidelity follower of its instructions. If those instructions are fed corrupted evidence, the agent's competence becomes the engine of its failure.

Finally, the success of the Pre-Action Gate suggests a safer pattern. Use "downstream-only remediation" (intercepting a bad action and substituting it with a known-good value). This maintains a governed buffer and avoids corrupting source systems.

Figures from the paper