Auditing clinical prediction networks without their weights: GPT-6 Astra recovers every planted relationship up to 38,401 weights once given a calculator
Synopsis
Clinical prediction models often arrive as files without the data they were trained on, so an auditor must work out what the model actually computes. Researchers trained tanh networks of 105 to 38,401 weights on simulated subarachnoid haemorrhage cohorts, planted known relationships or a label bias, and asked GPT-6 Astra to answer with no tools, with a calculation-only white-box tool, or with a black-box tool exposing only predictions. Without tools Astra recovered planted relationships in 353-weight networks but became unreliable at 3,457 weights; with the calculator it recovered the relationship in all 29 runs that had one, raised no false alarm in 15 null runs, and black-box matched white-box.
Interpretation
For auditing these clinical prediction networks, what decides performance is whether computation is possible and how the task is posed, not whether the weights are visible. Earlier public demonstrations mixed reading raw weights directly with writing and running code, so the two conditions were never separated. In the 18 black-box runs, where the calculator exposed only the network's predictions and not its weights, Astra's strength ratios were 0.97–1.10, matching the white-box runs cell by cell.
The approach loads the network's weights or its prediction function into an environment that only does numerical computation, and lets the model write code to probe the network. Without tools the weights sat in the prompt as JSON, leaving the model to infer the function by reading numbers. The tool is a locally served run_python preloaded with NumPy and the network, refusing imports and file operations and limited to 60 seconds per call; with it, all 29 runs with a planted relationship recovered it, with strength ratios of 0.85–1.10 and surrogate R² of 0.88–0.98.
A one-sentence default system instruction made the model decline audit and repair tasks as unidentifiable, and one explicit instruction removed those refusals. Under the default instruction, 11 of 12 audit and repair runs declined. With every prompt unchanged and only the instruction replaced, none of 14 audit and repair runs declined, and no false alarm appeared on the null and unbiased networks.
Perspective
The findings rest on small tanh multilayer perceptrons trained on simulated cohorts, with planted relationships and a label bias of simple, known form; the audit target is one-month mortality after aneurysmal subarachnoid haemorrhage in adults.
The authors note the results may not transfer to models trained on real clinical data, to other architectures such as gradient-boosted trees, or to problems of unknown form; the models came mainly from one family through one harness, and several cells had only one to three runs; the scripted audit's search space was designed with knowledge of the planted subgroup's form, which favours the script.