Grading the Grader: Lessons from Evaluating an Agentic Data Analysis System
Source: arXiv:2606.24839 · Published 2026-06-23 · By Tian Zheng, Kai-Tai Hsu
TL;DR
This paper addresses the challenging problem of evaluating multi-agent, agentic data analysis systems that produce complex outputs combining code, numeric results, and diagnostic text rather than simple single-turn responses. The authors investigate the reliability of automated grading mechanisms applied to LAMBDA, a multi-agent data analysis system evaluated on 153 numerical tasks from the QRData subset of DSGym. They develop a three-layer human-AI grading cascade combining strict regex-based matching, LLM-based lenient grading, and snippet-based human inspection to distinguish true agent-ground truth disagreements from grader artifacts. Key innovations include an iterative nudge prompting mechanism to coax more gradeable outputs and a keyword-anchored answer extraction pipeline. The study finds that nudging dramatically improves grading run success from 36% to 97% and lenient grader recall from 35% to 97%, while maintaining observed 100% precision. Variable type metadata also predicts grading dynamics, with categorical tasks requiring more nudges but achieving higher strict pass rates than continuous tasks. The evaluation framework and insights form a practical blueprint for reliably grading richer, multi-step outputs from agentic systems.
Key findings
- Nudging raises grading run success from 36% to 97% and lenient grader recall from 35% to 97%.
- Both automated graders (strict regex and LLM-based lenient) achieve 100% observed precision (0/70 false positives).
- Keyword-anchored answer extraction increases strict grader recall from 26% (heuristic last-number) to 86%.
- Lenient grading using GPT-4o-mini is parser-independent and achieves 97% recall against human labels.
- Re-injecting the original question during nudging provides no grading improvement, implying nudges mainly serve as answer template cues.
- Human snippet-based review agrees 89% with full human labels, enabling low-cost audit of auto-grading outcomes.
- Variable type (categorical, continuous, mixed) is the only task covariate consistently associated with grading dynamics and outcomes.
- Categorical tasks are most nudge-dependent (79%) but have the highest strict pass rate (80%), while continuous tasks have higher clean run rates but lower strict pass rates.
Threat model
Not a security-focused paper. The study assumes a benign setting where the grader aims to score agent outputs vs established ground truth in a benchmark evaluation context. There is no adversarial agent or grader manipulation considered.
Methodology — deep read
Threat Model & Assumptions: The study assumes an adversary-free setting where the agentic system LAMBDA is tasked with producing numerical data-analysis results on DSGym QRData benchmark. The grader aims to detect disagreement between agent output and known scalar ground truth. There is no explicit adversarial manipulation of grader or output. Errors may arise from grader limitations or agent disagreement.
Data: The 153 numerical tasks from QRData consist of natural language questions, tabular data files, and single scalar ground truth values. Each task tests quantitative reasoning on tabular datasets.
Pipeline & Architecture: They run LAMBDA multi-agent system (programmer and inspector loop) integrated with a custom Python wrapper implementing a two-loop evaluation scheme. Each task run involves up to 3 code execution retries by the programmer-inspector loop, followed by up to 2 iterative nudges if a usable scalar answer is not extracted. Answer extraction uses two methods: a baseline heuristic parser picking final number, and a novel keyword-anchored parser that segments output into blocks ranked by keyword overlap with question and answer indicator phrases, extracting candidate numbers from highest scoring block.
Strict grading is based on exact numerical match within 2% relative tolerance to ground truth; lenient grading is performed by a GPT-4o-mini model that semantically extracts answers and compares with 3% tolerance. Errors from strict grading are then passed to lenient auto grading. Human inspection uses 100-character output snippets for triage and full transcript review for final labeling.
Training Regime: No training/fine-tuning performed as LAMBDA and graders use pre-trained models. The wrapper calls are run on CPU-only environments (GitHub codespaces and Apple M1 Max). Prompts for nudging and grader LLM are provided in supplementary materials.
Evaluation Protocol: Metrics are precision and recall of graders against human labels, grading run success (whether a scalar was generated), and outcome grades (pass/fail by strict, lenient, and human graders). Recall is computed from true positives / total ground truth matches. They also analyze task covariates (variable type, dimension, analysis type) with chi-squared tests. Stability is checked with 40 repeated runs of a single task.
Reproducibility: Code, prompts, grading artifacts, and datasets are open-access on GitHub. While LAMBDA and models are public, full benchmarking requires running the provided wrapper and prompts. No random seed tuning reported but stability experiments show 95% repeatability on test task.
Concrete example: For one QRData task, LAMBDA's programmer produces multi-step code outputs including intermediate results. The strict grader fails to find a final number due to verbose intermediate outputs containing many numbers. The keyword-anchored parser isolates the answer-rich block using keywords overlapping the question, extracts candidate scalars, and applies tolerance-based matching to detect ground truth agreement. Where failure occurs, the wrapper issues a nudge instructing LAMBDA to output only a single final numerical answer. After up to two nudges, a clean scalar is extracted allowing strict or lenient grading. Human snippet review validates this classification, ensuring no false positives.
Technical innovations
- Iterative nudge prompting mechanism that raises grading run success from 36% to 97% by coercing agent to produce clean numeric outputs.
- Three-layer grading cascade combining strict deterministic regex-based grading, LLM-based lenient grading, and human snippet inspection to balance precision and recall in grading agentic outputs.
- Keyword-anchored answer extraction pipeline that segments output by keyword overlap with the question to isolate answer regions, boosting strict grader recall by 60 percentage points over last-number heuristics.
- Empirical demonstration that question re-injection during nudging adds no benefit over answer-format nudging alone, informing prompt engineering for agentic evaluation.
Datasets
- QRData subset of DSGym — 153 numerical scalar tasks — public via DSGym benchmark
Baselines vs proposed
- Strict grader with heuristic last-number parser: recall = 26% vs keyword-anchored parser recall = 86%
- Strict grader with keyword-anchored parser (with nudge): grading success = 97% vs without nudge 36%
- Lenient grader (with nudge): recall = 97% vs without nudge recall = 35%
- Both automated graders: observed precision = 100% (0 false positives in 70+ cases)
Figures from the paper
Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2606.24839.
Fig 2: visualizes these differences across the 153 tasks in evaluation order: the strict grader without
Fig 4: Task-anchoring trajectory by turn (n = 153 per mode). Faint lines: individual tasks,
Fig 3: Sankey diagram of variable type →pipeline outcome →grading result (merged across
Limitations
- Focus on a single agentic system (LAMBDA) limits generalizability to other agents or settings.
- Study restricted to numerical scalar ground truth tasks; does not cover richer answer types or qualitative evaluation.
- Keyword-anchored parser depends on lexical keyword overlap, which may fail if correct answers use different terminology or notation.
- Human labeling performed by a single annotator and was not blinded to automated grades, potentially introducing bias.
- Stability experiments limited to 40 runs on a single task; broader robustness to prompts, models, and seeds untested.
- Potential shared systematic bias between agent and lenient grader models since drawn from same model family.
- No adversarial or out-of-distribution evaluation to stress-test grader robustness.
Open questions / follow-ons
- How to extend grading strategies to richer, multi-modal agent outputs beyond scalar numerical answers, including qualitative diagnostics and code correctness?
- Can more robust, less lexically dependent answer extraction methods improve strict grader recall across varied task domains?
- What are the effects of adversarial or distribution-shifted agent outputs on grader reliability and how to defend against grading failures?
- How to design richer grading taxonomies that capture methodological correctness and partial-credit judgments rather than strict numeric matches?
Why it matters for bot defense
For bot-defense and CAPTCHA practitioners, this work highlights challenges in reliably grading complex multi-step outputs from agentic AI systems where the correctness signal is entangled with output formatting and intermediate steps. The demonstrated use of iterative nudges to coerce clearer output formats and multi-layer grading cascades combining deterministic extraction with LLM-based lenient assessments can inform scoring in automated challenge-response systems where answers may be noisy or partial. Moreover, the importance of human calibration to detect grader false negatives/positives is relevant to designing robust evaluation pipelines resistant to grader artifacts. The revealed impact of task metadata on grading dynamics suggests incorporating input or challenge type features could improve automated grader adaptivity. Overall, this study advocates combining parsimonious deterministic methods with generative methods plus human-in-the-loop review for reliable evaluation of agentic AI outputs—an approach applicable when assessing responses from complex or multi-turn interactions inherent to advanced bot-detection frameworks and CAPTCHA challenges.
Cite
@article{arxiv2606_24839,
title={ Grading the Grader: Lessons from Evaluating an Agentic Data Analysis System },
author={ Tian Zheng and Kai-Tai Hsu },
journal={arXiv preprint arXiv:2606.24839},
year={ 2026 },
url={https://arxiv.org/abs/2606.24839}
}