A language model identified and repaired most deliberately planted flaws in small networks designed to screen head-and-neck radiotherapy planning requests, researchers report. But it struggled to recognize healthy networks and missed most hidden triggers, leaving the approach unsuitable for certifying clinical safety.
Humza Nusrat and Omar Nusrat describe the experiment in an arXiv preprint posted on 3 November 2026. Peer review has not been verified. This was a controlled engineering study using synthetic requests, with no patient outcomes or clinical deployment evaluated.
The researchers tested “weight-space programming”: asking a language model to inspect and edit the numerical weights that govern another network. Claude Opus 5.5 received the protocol, network structure and weights, without tools, training data or code execution. The main networks had eight inputs and 433 parameters. Four rules determined whether a request should enter automated planning or be escalated, covering incompatible target-dose goals, mandible constraints, spinal-cord feasibility and missing structures.
The main panel contained 18 flawed networks: three training seeds for each of four confounds that hid a rule, a spinal-cord threshold shifted by 3 Gy, and a hidden trigger. The model identified 16 of 18 flawed networks, with a Wilson 95% confidence interval of 67%–97%. That included all 15 confound or threshold-shift networks, but only one of three trigger networks. Under a stricter criterion for verifying its claims, detection of confounds and the shift fell to 14 of 15.
All 16 detected flaws were repaired on the evaluation requests. Error in the planted region fell to zero, and accuracy on uniformly sampled requests reached at least 99.995%. Edits changed a median of three parameters, with a range of 1–53. Fourteen repairs introduced no new errors among approximately 420,000 requests; two threshold repairs caused two and 18 unnecessary escalations.
Recognizing correctness proved harder. Across five healthy networks, only two were cleared without a forced verdict. Another received a tentative forced clearance, one never reached a verdict, and one received a false alarm followed by an edit that broke 2,018 previously correct decisions. Numerical precision created another hazard: every edit introducing weights of at least 100,000 failed in 16-bit floating-point arithmetic. Several produced undefined scores for every request, sending all requests to automated planning and reducing accuracy to 24.8%.
The comparisons also temper claims of an advantage. Simple statistics selected with knowledge of the flaw types found every confound and threshold shift. Protocol-based testing detected every flaw, while black-box probing found the confounds and shift faster. Fine-tuning repaired all 18 flawed networks in every reported run; using the original training schedule changed 432–433 of 433 parameters, compared with the language model’s smaller edits.
These results concern small networks, explicit rules and synthetic inputs. The confidence interval describes outcomes across trained networks within this design, not performance across clinical settings. Threshold-adjacent requests were excluded, audit procedures changed during the study, and formal verification was not compared. Small, inspectable repairs are a promising research result, but neither successful testing nor reading the weights established correctness for every possible input.
Cover illustration generated with AI; conceptual, not research evidence.