CARE: Controlling LLM-Generated Policies through Auditable Review of Evidence in Scientific Experimentation Guanyu Liu University of Macau
Weiyi Kong University of Toronto
Baiqing Li XtalPi
∗
Peiyu Zhang∗ XtalPi [email protected]
Corresponding authors
arXiv:2606.14581v1 [cs.LG] 12 Jun 2026
Abstract Granting LLMs direct control over costly, irreversible scientific experiments leads to unsafe exploration and unstable performance, but discarding LLM creativity entirely sacrifices significant optimization potential. We introduce CARE (Controlling LLMGenerated Policies through Auditable Review of Evidence in Scientific Experimentation), an auditable controller for highthroughput experimentation (HTE) optimization that keeps a non-LLM incumbent optimizer as the default action path while using LLMs to revise challenger ranking policies. Before each outcome is revealed, an public evidence intervention gate compares the challenger with the incumbent. It authorizes the challenger’s selection only when the evidence available before selection supports the change, with the decision recorded in the audit log. CARE outperforms all other evaluated methods on Minerva and ChemLex benchmarks, with final-best improving from 80.0 to 88.5 on Minerva and from 83.9 to 92.1 on ChemLex, relative to the public incumbent. Our experiments indicate that LLM self-evolution is more reliable when it expands the proposal space under an auditable controller, rather than directly choosing experiments.
1
Zeyu Wang UCLA
Introduction
LLM agents have been widely applied to virtual environments (e.g., coding agents and deep research agents), but extending them to real-world scientific environments like highthroughput experimentation (HTE) remains challenging. Each HTE experiment consumes chemical materials and takes time to analyze, so letting an LLM directly drive irreversible decisions is unsafe. We explore how LLM agents can effectively and reliably contribute to HTE.
Boer Zhang Harvard University
Tianyu Shi∗ McGill University [email protected]
Formally, we model HTE as a finite-pool sequential environment interaction under a public-information boundary: in each round, an agent controller selects one unrevealed candidate based only on public information, i.e., the outcomes revealed so far, the candidate features, and the controller’s own records. This setting has been extensively studied through Bayesian optimization (BO) and self-drivinglab systems, leveraging surrogate modeling, acquisition functions, mixed-variable search, and chemistry-aware representations (Balandat et al., 2020; Hutter et al., 2011; Bergstra et al., 2011; Häse et al., 2021a; Shields et al., 2021; Fitzner et al., 2025; Dürholt et al., 2024). Recent autonomous-experimentation work also improves constrained design, active oversight, and closed-loop reaction optimization (Hickman et al., 2022; Harris et al., 2025; Low et al., 2024; Bennett et al., 2024; Suvarna et al., 2024; Leonov et al., 2024; Wagner et al., 2024; Sin et al., 2025). While these public decision rules offer valuable insight for optimizing HTE decisions, it remains unclear how they can be combined with the capabilities of LLMs. Language models bring a complementary capability to HTE optimization. They can selfimprove by iteratively refining their own outputs from feedback (Zhou et al., 2023; Yang et al., 2024; Pryzant et al., 2023; Wang et al., 2024c; Fernando et al., 2024; Yuksekgonul et al., 2025; Romera-Paredes et al., 2023; Ma et al., 2024; Khattab et al., 2024; Opsahl-Ong et al., 2024; Zhang et al., 2025; Hu et al., 2025; Zhang et al., 2024; Gao et al., 2024; Agrawal et al., 2026). Unlike BO surrogates that solely fit numerical functions from empirical data, LLM agents can reveal extra actionable insights by reasoning with public chemistry knowledge. However, LLMs are not reliable oracles for hidden yields. LLM agents may find useful
structure in the public history, but they may also overreact to sparse evidence, be misled by accidental implementation details, or simply lose to the incumbent. This motivates treating self-evolution as proposal generation under an auditable controller, rather than as direct action selection. We introduce CARE, an auditable control framework for language-generated policies in scientific environment interaction. The design is simple: separate LLM proposal from authority. Each round begins with the incumbent producing the default action. The LLM agent then proposes a challenger policy that selects an alternative action with a rationale. Before any outcome is revealed, the Public-Evidence Intervention Gate checks the challenger action against the default action, writes an audit log entry, and either authorizes the challenger or falls back to the incumbent. Instead of letting LLMs directly decide actions, our controller design forms a hybrid framework that combines the reasoning ability of LLM agents with the reliability of public decision rules from prior work. We evaluate CARE on Minerva/Olympus and ChemLex. Across 30 matched seeds, CARE achieves the highest mean final-best value and best-so-far AUC on both datasets, with large gains over the incumbent on Minerva/Olympus and consistent gains on the more challenging ChemLex benchmark, where BO baselines are competitive. Ablations confirm that each CARE component contributes (See Appendix B.1). Our main contributions are as follows. • We formulate auditable control of language-generated policies as a finitepool environment-interaction problem under a strict public-information boundary. • We develop CARE, a hybrid control framework that combines LLM-generated proposals with more traditional and reliable BO-based public optimizers, while logging each decision for audit. • We introduce a fixed evidence-based gate that authorizes LLM proposals only when the public evidence supports them. • We demonstrate that CARE outperforms
various strong baselines on Minerva/Olympus and ChemLex benchmarks under matched-seed evaluation, supported by thorough ablation studies.
2
Related Work
LLM agents and auditable environment interaction. LLM agents push language models past text generation into environmentfacing action, a line exemplified by agent paradigms (Yao et al., 2023), skill-acquisition agents (Wang et al., 2024a), and interactive benchmarks (Shridhar et al., 2021; Liu et al., 2024b). Scientific agents carry the same pattern into real-world domains such as chemistry workflows (Bran et al., 2024; Boiko et al., 2023; Ruan et al., 2024; Song et al., 2025). Prior LLM agents for chemistry often emphasize endto-end planning and execution. CARE studies a narrower control question: when experimental budget is scarce, when should a languagegenerated policy be allowed to override a nonLLM optimizer? By gauging LLM outputs against empirical public rules through a gate, and keeping a pre-reveal audit log throughout, CARE offers a paradigm for auditable LLMdriven HTE optimization. Language optimization, self-improving agents, and LLM-BO. A large body of work lets LLM agents iteratively self-evolve over prompts, programs, workflows, reward code, and agent policies from feedback (Zhou et al., 2023; Yang et al., 2024; Fernando et al., 2024; Pryzant et al., 2023; Wang et al., 2024c; Yuksekgonul et al., 2025; Agrawal et al., 2026; Khattab et al., 2024; Opsahl-Ong et al., 2024; Romera-Paredes et al., 2023; Ma et al., 2024; Zhang et al., 2025; Hu et al., 2025; Zhang et al., 2024; Gao et al., 2024). Recent LLM-based BO research inserts LLM outputs into the pipeline as components: priors, acquisition functions, or candidate generators (Liu et al., 2024a; Ngo et al., 2026). However, recent evidence suggests that LLM-based BO does not consistently outperform classical BO or bandit methods (Gupta et al., 2025; Kristiadi et al., 2024). CARE keeps the premise that language models can revise policies from public trajectories, but moves the deployment role. The model’s policy is treated as a candidate proposal, and a fixed publicevidence gate decides whether that proposal
ever runs. At no point is the LLM the deployed optimizer. Public optimizers for scientific finite-pool replay. Our replay setting draws on BO and self-driving-lab methods for chemistry. On the general side, BO systems and acquisition families such as BoTorch, SMAC, and TPE provide strong public optimizers (Balandat et al., 2020; Hutter et al., 2011; Bergstra et al., 2011). Chemistry-oriented systems, among them Phoenics, Olympus, Summit, Gryffin, EDBO-style reaction optimization, BayBE, and BoFire, add noisy testbeds, categorical variables, molecular descriptors, and mixedvariable constraints (Häse et al., 2018, 2021b; Felton et al., 2021; Häse et al., 2021a; Shields et al., 2021; Fitzner et al., 2025; Dürholt et al., 2024). Self-driving-lab and HTE work then connects such optimizers to autonomous reaction and materials platforms (Tom et al., 2024; Burger et al., 2020; Szymanski et al., 2023; Wang et al., 2024b; Low et al., 2024; Bennett et al., 2024; Suvarna et al., 2024; Leonov et al., 2024; Wagner et al., 2024; Sin et al., 2025), while acquisition portfolios and expert-hedging methods choose among public acquisition experts during BO (Brochu et al., 2010; Shahriari et al., 2014; Vasconcelos et al., 2019; Ngo et al., 2026). All of this defines strong public decision paths. What CARE audits is orthogonal: the conditions under which a language-generated challenger may override such a path, under the same public-information interface.
3
Problem Setting and Overview
Finite-pool environment replay. We model the interaction between an LLM agent and the HTE environment as replay over a finite candidate pool. Let X = {xi }N i=1 be the pool; its objective values {yi }N stay hidden i=1 until revealed. At round t the controller sees the revealed index set Ot ⊆ [N ], that is, the history Ht = {(xi , yi ) : i ∈ Ot } along with the public candidate table Ct = {xi : i ∈ / Ot }. It commits to one action at ∈ Ct , and only then learns yat . Given a reveal budget B, we score a run by its final best value fB⋆ = max yat 1≤t≤B
and by the anytime best-so-far AUC
AUCB =
B 1 X max ya , B t=1 1≤s≤t s
so that both the end state and the path toward it count. Public-information boundary. Every policy must act on revealed outcomes, public candidate features, and logged optimizer state, and on nothing else. Unrevealed outcomes, oracle ranks, evaluator-side caches, and any post hoc information are off-limits. An LLM is free to write or revise ranking policies, but a policy it writes gets deployed only after passing the same public-information boundary and deployment checks applied to the non-LLM baselines; Appendix F lists the public prompt interface and the excluded fields. Figure 1 marks where this boundary sits in the control loop: the controller acts before the selected outcome is revealed, and only yat enters the public history for the next round. Public reference action and challenger candidate. Each round, CARE first computes a public reference action aref t through a public incumbent controller. In parallel, a Policy Planner asks the LLM Policy Generator to reuse, patch, or synthesize an executable challenger policy over Ct ; that policy puts forward a challenger candidate ach t together with a public rationale. The Public-Evidence Intervention Gate then weighs ach t against the incumbent’s pick on admissible public evidence and decides, before reveal, which of the two runs. Every executed action can be traced back to one of two sources as a result: a gate-authorized challenger action, or the incumbent fallback. Overview of CARE. On top of this defaultaction path, CARE carries two bounded proposal modes. A recovery mode redirects weak trajectories toward challenger-ranked candidates that still hold public support. A frontier mode, available when the candidate schema permits it, proposes schema-conditioned alternatives drawn from decision-visible public feature structure. Neither mode acts on its own; both stay proposals until the gate decides which action runs.
4
Method
4.2
CARE is a controller for language-generated policies in sequential scientific replay, gated throughout by public evidence. Its default action path is a public incumbent controller; a Challenger Policy can touch the environment only when admissible public evidence backs the change. Two terms recur below: the fixed gate specification, meaning the pre-specified controller instantiation that assigns action authority, and the pre-reveal audit record, meaning the structured record written out before the selected outcome is revealed. Figure 1 walks through one round of dataflow. The public incumbent controller produces a public reference action, the Policy Planner and LLM Policy Generator keep an executable Challenger Policy up to date, and the PublicEvidence Intervention Gate hands final action authority to either the Challenger Action or the incumbent fallback. Language-generated proposals and the authority to act are kept apart by construction. 4.1
Public Incumbent Controller
At round t, let Ct be the unrevealed public candidate pool and Ht the revealed history. The public incumbent is an ensemble of public experts Etpub . Expert e assigns each candidate a rank rt,e (x), contributing ρ(r) = r−1/2 for finite ranks and ρ(∞) = 0. The public score is Stpub (x) =
X
wt,e ρ(rt,e (x))
e∈Etpub + λpt Pt (x) + λnt Nt (x) + λdt Dt (x) + λqt Qt (x),
where every term is a public-state function of Ht and Ct , covering prior/observed-reward evidence, novelty, coverage support, and categorical component evidence. The public reference action is pub aref (x), t = arg max St x∈Ct
with deterministic tie-breaking. This incumbent serves two roles at once: it is the default decision path, and it is the audit reference against which language interventions are judged. Appendix B.5 reports the fixed term definitions and schedules.
Policy Planner and LLM Policy Generator
Rather than proposing experiments directly, the LLM-facing modules propose executable ranking policies. An active Challenger Policy πθcht maps the public state to scores over the remaining pool, Stch (x) = πθcht (Ht , Ct , st ) x ,
where st is the challenger policy’s logged state. Before a policy is deployed, validation checks public-information compliance, full-pool scoring, and row-order invariance; the validation interface is in Appendix B.4 and the prompt interface in Appendix F. The Policy Planner decides what to do with the current policy: keep it, patch it, or start over. Let ℓt−1 denote the previous gate summary. From a public trajectory representation zt = Φ(Ht , st , ℓt−1 ), which folds in recent improvement, stagnation, poor-reveal events, and prior gate decisions, it picks ut = Σ(zt ) ∈ {reuse, patch, create}. Note that this planner action only changes the Challenger Policy artifact. It never selects the environment action itself. 4.3
Challenger Candidate and Public Rationale
The challenger layer turns the languagegenerated ranking, together with public support metadata, into a candidate proposal, pub ch ach , Mt ; Ht , Ct ), t = Ψt (St , St
where Mt records public ranks, expert agreement, categorical evidence, novelty, and schema-conditioned public-feature evidence. The definition covers the active policy’s topranked candidate as well as two bounded proposal modes. The recovery mode wakes up under weak trajectory signals and considers candidates that also carry public support. The frontier mode spends a small budget on schemaconditioned alternatives drawn from decisionvisible public feature structure, and only when the candidate schema supports that kind of exploration. In both cases the output is still just a proposal; the gate assigns action authority. Activation rules and budgets appear in Appendix B.5.
Figure 1: CARE pipeline. The public incumbent controller computes a public reference action as the default action path. The Policy Planner reuses, patches, or synthesizes an executable Challenger Policy through the LLM Policy Generator, which proposes a challenger candidate with a public rationale. Before reveal, the Public-Evidence Intervention Gate checks public support and gain against risk and weak-support penalties, writes a pre-reveal audit record, and assigns action authority either to the Challenger Action or to the incumbent fallback. The selected action is then evaluated in the HTE replay environment, and the revealed outcome updates the public history for the next round.
4.4
Public-Evidence Intervention Gate
ref The intervention gate compares ach t with at
using admissible public evidence alone. For a candidate x, CARE assembles a gain vector gt (x) from public margins, support, rank bonuses, novelty, categorical evidence, and schema-conditioned evidence, and a risk vector qt (x) from missing public rank, low support, challenger-only support, deviation from the reference action, and negative public margins. The authorization score is
stay sparse, since policy edits and proposal modes are budgeted by public trajectory signals. All gate weights, planner thresholds, challenger budgets, and the intervention margin are frozen before matched replay and reused across Minerva/Olympus and ChemLex; the zero intervention margin is simply the breakeven point of gain minus risk, not a value fitted to replay outcomes. The audit ledger is given in Appendix B.4, the fixed instantiation in Appendix B.5.
κt (x) = α⊤ gt (x) − β ⊤ qt (x), ch γt = G(aref t , at ; Ht , Ct ) ∈ {0, 1}.
The selected action is (
at =
ach γt = 1, t , ref at , γt = 0.
In the pre-specified instantiation, G authorizes the challenger only when κt (ach t ) clears the intervention margin and all evidence entering the audit record is public. The fixed gate specification encodes three working principles as replay-time rules. Admissible public support raises the authorization score. Weak support hands authority back to the public incumbent. And interventions
Record
Role in action authority
Public interface Revealed outcomes, public candidate features, and logged optimizer state available before action selection. Public reference Public-incumbent choice aref t , action logged before any challenger can alter the action path. Challenger arti- Validated Challenger Policy, fact challenger candidate, and public rationale. Pre-reveal audit Public evidence, support/risk record summary, and gate decision assigning or withholding authority. Replay outcome Selected action and revealed value, appended only after the audit-record decision.
Table 1: Per-round audit ledger for action authority.
4.5 Algorithm Summary Algorithm 1 gives the per-round control loop. The ordering matters and is itself part of the audit interface: the public reference action, the challenger validation, and the gate decision are all fixed before reveal, and the outcome update touches nothing but future public history. The language proposal plane stays observable throughout, yet it has no way to bypass the public control plane. Algorithm 1 CARE control loop for one replay round. Require: revealed history Ht , unrevealed pool Ct , policy state st 1: aggregate public experts and select aref t 2: set ut = Σ(zt ) from public trajectory state 3: obtain eligible challenger policy πtch according to ut 4: score Ct with πtch and form challenger candidate ach t with a public rationale ch 5: compute authorization score κt (at ) 6: if gate authorizes challenger then 7: select at ← ach t with challenger authority 8: else 9: select at ← aref by incumbent fallback t 10: end if 11: write pre-reveal audit record for reference action, challenger candidate, public evidence, and decision 12: reveal yat and update policy state
5
Experiments
Experimental questions. Three questions drive the evaluation of CARE as an LLM-agent control framework for matched finite-pool replay. Does gate-assigned action authority actually improve performance? Does the PublicEvidence Intervention Gate avoid the degradation seen with direct language delegation? And which controller components are responsible for the gain? For each matched seed, all policies start from the same five initial observations and face the same remaining candidate pool, the same 10-reveal budget, and the same evaluator. Setup. We evaluate on two real HTE replay suites. Minerva/Olympus Suzuki Coupling (i) (Sin et al., 2025; Häse et al., 2021b) contains 5,670 Suzuki coupling candidates whose decision variables are seven ligand indicators, residence time, temperature, and catalyst loading; yield is the target, and turnover stays evaluator-side. ChemLex Acid–Amine Wetlab (Zhong et al., 2025; Zhong, 2025) contains 11,088 acid–amine conditions after the prespecified clean duplicate protocol, with Acid,
Amine, Reagents, and Solvent as decision variables and conversion as the target. Objectives keep their original dataset scales, so the Minerva/Olympus yield oracle is 89.23 rather than 100, and the cleaned ChemLex conversion oracle is 100.0. Artifact-use details, oracle values, and duplicate handling are collected in Appendix E. The baseline suite covers random and stratified random policies, fixed public heuristics, GP acquisition rules (Jones et al., 1998; Srinivas et al., 2010), random-forest and TPE-style surrogates (Breiman, 2001; Bergstra et al., 2011), chemistry-aware descriptor or categorical BO variants, an LMABO-style LLM-BO adaptation (Ngo et al., 2026), the public incumbent, an ungated LLM-evolving policy, and a nonevolving LLM policy. Every row fits only revealed data and scores the same unrevealed pool. No row receives hidden labels, oracle ranks, evaluator-private artifacts, or extra reveal budget. Each policy runs for 30 seeds, and we report final best value, best-so-far AUC, and simple regret to the dataset oracle, with oracle values used for evaluation only. The gate specification, covering gate coefficients, planner thresholds, challenger budgets, the prompt interface, and the LLM sampling temperature, is fixed before matched replay and reused across datasets. Baseline parity is documented in Appendix C.1, reproducibility in Appendix B.4, and the complete suite in Appendix C. Main results. Table 2 shows CARE as the strongest mean policy on both replay suites. On Minerva/Olympus it reaches 88.5 final best and 84.4 AUC, beating the public incumbent by +8.5 and +11.0 and cutting mean simple regret to 0.7. On ChemLex, where the categorical/descriptor BO rows sit closer, CARE still posts the highest mean final-best value and AUC, with +8.2 and +4.4 over the public incumbent. The pattern fits the control view: keep a strong public optimizer as the default action path, then add gate-authorized challenger actions on top. Representative intervention traces and policy-edit case studies are in Appendix D. Anytime behavior. Figure 2 shows where along the reveal trajectory the gains arrive. On Minerva/Olympus, CARE pushes normalized regret down early, which matches the ablation
Dataset
Policy
Final best ↑
Best-so-far AUC ↑
Regret ↓
Minerva/Olympus
CARE Public incumbent TPE-style BO (Bergstra et al., 2011) LMABO-style LLM-BO (Ngo et al., 2026) BayBE/BoFire-style mixed BO (Fitzner et al., 2025; Dürholt et al., 2024) Ungated LLM-evolving policy Non-evolving LLM policy
88.5 [88.0, 89.0] 80.0 [76.4, 83.4] 77.6 [74.5, 80.6] 76.6 [73.0, 79.6] 75.3 [72.0, 78.0] 68.8 [63.1, 73.9] 63.3 [57.5, 68.8]
84.4 [83.2, 85.3] 73.4 [69.3, 77.3] 68.3 [65.0, 71.5] 66.5 [62.1, 70.6] 67.7 [64.2, 70.9] 61.4 [55.6, 67.0] 58.8 [53.1, 64.4]
0.7 9.2 11.6 12.6 14.0 20.4 25.9
ChemLex
CARE Public incumbent Gryffin-style categorical BO (Häse et al., 2021a) EDBO-style descriptor GP-EI (Shields et al., 2021) LMABO-style LLM-BO (Ngo et al., 2026) Ungated LLM-evolving policy Non-evolving LLM policy
92.1 [88.4, 95.3] 83.9 [77.1, 89.9] 89.8 [85.3, 93.5] 88.9 [86.3, 91.3] 79.0 [70.9, 85.5] 81.2 [73.9, 87.4] 81.4 [73.0, 88.3]
81.6 [76.7, 86.2] 77.2 [70.4, 83.4] 77.2 [70.3, 83.6] 80.5 [74.9, 85.2] 73.3 [65.0, 80.6] 71.2 [63.2, 78.7] 76.1 [68.1, 83.2]
7.9 16.1 10.2 11.1 21.0 18.8 18.6
Table 2: Main matched replay results. Values are seed means with 95% bootstrap confidence intervals over 30 matched seeds. BO-family rows are public-information finite-pool replay adaptations of established method families under the same interface; the LMABO-style row adapts LMABO’s LLM acquisitionselection protocol to this finite-pool replay setting (Ngo et al., 2026). Regret is final simple regret to the dataset oracle. CARE
Public-only
Strong BO
Minerva/Olympus 0.6
0.5
Normalized simple regret ↓
LLM-only
ChemLex
0.5 0.4 0.4 0.3
0.3
0.2
0.2
0.1 0.0
0.1
0
2
4
6
8
10
0.0
0
Revealed experiments
2
4
6
8
10
Revealed experiments
Figure 2: Anytime replay trajectories. Curves show normalized simple regret averaged over 30 matched seeds, with 95% bootstrap confidence bands. CARE reaches low regret early on Minerva/Olympus and maintains the lowest final regret on both datasets.
evidence for frontier exploration. On ChemLex the middle rounds are close, yet CARE still ends with the lowest mean normalized regret. What the LLM layer adds, in other words, is a selective intervention mechanism, not a replacement for public optimization. Ablations and diagnostics. Table 3 ties the gains back to the controller design. Removing the Policy Planner, the gate, or either proposal mode produces directionally consistent mean drops, and the 6-expert public incumbent stays below CARE on both datasets, so simply expanding non-LLM public expertise does not close the gap to gate-authorized challenger actions. The intervention logs reveal an authority funnel as well: eligible Challenger Policies show up often, in 197 Minerva/Olympus and 225 ChemLex decisions, yet the gate changes
Variant w/o Policy Planner w/o intervention gate w/o recovery proposal mode w/o frontier proposal mode 6-expert public incumbent
Minerva/Olympus ChemLex 1.3 / 2.4 1.2 / 1.7 0.9 / 1.6 10.4 / 11.7 11.6 / 15.4
4.7 / 2.9 4.6 / 2.3 6.9 / 3.1 3.5 / 2.4 10.2 / 6.4
Table 3: Ablation drops from full CARE. Each cell reports mean final-best / AUC drop; larger values indicate more performance lost.
the selected action only 52 and 36 times. Authorization is always issued before reveal under the fixed gate specification, and post-reveal outcomes serve evaluation only. Capacity and intervention diagnostics are in Appendix B; the secondary Gemini-2.5-Flash backend run and the Minerva/Olympus intervention-margin check are in Appendix B.2.
What does the LLM contribute? The LLM earns its keep as a proposal-space expander, not as a stand-alone optimizer. In Table 2, both the ungated and the non-evolving LLM controls trail CARE, and Table 3 shows that taking away the Policy Planner, the gate, or either proposal mode eats into the full controller’s gains. What emerges is a coupled mechanism: the LLM writes or revises executable Challenger Policies from public trajectory evidence, and the Public-Evidence Intervention Gate converts only the publicsupported proposals into sparse action changes. CARE gets the benefit of adaptive languagegenerated policies without ever letting their raw rankings face the environment directly. Policy evolution in practice. Table 4 shows how language-generated policies evolve under the same proposal/authority separation that governs the aggregate evaluation. In Minerva/Olympus, the LLM revision broadens a ligand-proximity rule with diversity and repeat control. In ChemLex, it adapts the public ranking rule to categorical evidence, trading off positive similarity against failed-pair avoidance. Either way, the edit touches only the public ranking rule; action authority still flows through the same Public-Evidence Intervention Gate. Action authority in practice. Table 5 traces how the aggregate intervention counts cash out as executable control decisions. In each trace the Challenger Policy proposes an action, the public incumbent fixes a public reference action, and the intervention gate grants authority only through a pre-reveal audit record. No new metric is introduced here; the table simply exposes the attribution path behind the aggregate gains. Replay-protocol robustness. Does the conclusion hinge on the main 5-init, 10-reveal protocol? We stress-test this with four protocol variants that change the initial observations or the reveal budget, each over 10 matched seeds. CARE keeps positive mean margins against both the public incumbent and the w/ointervention-gate ablation in every evaluated dataset–protocol cell, with larger margins on Minerva/Olympus and smaller ones on ChemLex. Gate-assigned action authority, then, is
Suite
Language-generated policy revision and authorized action path
Minerva/ Olympus Keeps a ligand-proximity signal and adds diversity/repeat control; the challenger still requires public-rank support and a low-risk pre-reveal audit record before receiving authority. ChemLex Balances positive acid–amine similarity, failed-pair avoidance, and component evidence; the accepted challenger still requires categorical public support before reveal.
Table 4: Auditable policy-evolution examples. Each row summarizes a language-generated rankingpolicy revision and the public-evidence path that grants action authority. Full excerpts are in Appendix D.1. Dataset
Step
Ref. Ch.
Audit
Outcome
ChemLex s11/r4 C1 C2 rank 2, sup. 4, gain/risk 0.901/0.000 93.42 ChemLex s11/r6 C1 C3 rank 4, sup. 4, gain/risk 1.023/0.000 94.74 Minerva/Olympus s3/r4 M1 M2 rank 1, sup. 2, gain/risk 0.662/0.044 89.23
Table 5: Audited intervention traces. Each row reports a public reference action, a challenger action, and the pre-reveal audit-record evidence that granted action authority; the outcome column is post hoc and is not available to the gate. C1–C3 and M1–M2 are expanded into concrete conditions in Appendix D.
not an artifact of one replay budget. Full tables and the heatmap are in Appendix B.3. Backend check. To probe whether the control interface leans on a single proposal backend, we swap the proposal LLM for Gemini2.5-Flash and leave everything else alone: the Public-Evidence Intervention Gate, the public prompt interface, the matched 30-seed protocol, and temperature 1.0. The same control pattern carries over. The secondary backend reaches 88.2 final best / 83.3 AUC on Minerva/Olympus and 90.8 / 80.1 on ChemLex, and authorized challenger actions stay sparse. The controller interface appears to transfer across proposal backends without touching the gate or the replay protocol; the full table and intervention counts are in Appendix B.2. Evidence synthesis. What the results identify is a control-level mechanism rather than any single optimizer variant. The public incumbent supplies a competitive default path, language-generated policies enlarge the proposal space, and the gate converts only the
public-supported proposals into actions. That is also why LLM-only delegation, ungated evolution, and expanded public expertise each fall short of the full controller under matched replay.
6
Conclusion
CARE shows that LLM-written policies can improve finite-pool scientific replay while never holding direct environment-action authority. On Minerva/Olympus Suzuki Coupling (i) and ChemLex Acid–Amine Wetlab, the evidencegated controller posts the highest mean finalbest value and the highest best-so-far AUC of all the methods we evaluate. The lesson is a division of labor: LLM self-evolution pays off when the model is widening the proposal space, and the decision about which action runs stays with a fixed public-evidence gate backed by a pre-reveal audit record. For NLP and agent evaluation, this recasts policy evolution as proposal generation under control. The language model proposes executable edits, but an action reaches the environment only through a public-supported departure from the default action, logged before any feedback arrives. Proposal and control never mix.
Limitations We evaluate CARE as matched finite-pool replay, a choice that isolates public-information compliance and supports seed-level policy comparison under identical reveal budgets. The price is that the protocol leaves out livelaboratory constraints: robot scheduling, execution failures, measurement delays, batchdependent availability. Closed-loop deployment remains a separate validation step. A second assumption is that the candidate table carries informative public descriptors; the incumbent and the evidence gate need them to form admissible evidence. When public features are sparse or uninformative, fewer authorized challenger actions survive. Our experiments also cover only finite-pool, singleobjective replay, leaving multi-objective, costaware, batched, and safety-constrained HTE to future work. The audit log comes from a fixed controller. The local intervention-margin check in Ap-
pendix B.2 probes one important degree of freedom of the gate, but whether gate weights, planner thresholds, and acquisition-portfolio variants transfer across HTE suites is still an open question. The frontier proposal mode, likewise, runs only when a pool exposes an informative public-feature view; otherwise CARE falls back on the recovery proposal mode and the incumbent rather than forcing unsupported exploration. Finally, our comparisons center on how LLMwritten challenger policies behave at deployment under this one fixed gate specification. A natural next step is to put additional nonlanguage proposal families behind the same gate, which would separate proposal semantics from action authority beyond the controllerlevel comparisons studied here.
References Lakshya A. Agrawal, Shangyin Tan, Dilara Soylu, Noah Ziems, Rishi Khare, Krista Opsahl-Ong, Arnav Singhvi, Herumb Shandilya, Michael J. Ryan, Meng Jiang, Christopher Potts, Koushik Sen, Alex Dimakis, Ion Stoica, Dan Klein, Matei Zaharia, and Omar Khattab. 2026. GEPA: Reflective prompt evolution can outperform reinforcement learning. In The Fourteenth International Conference on Learning Representations. Peter Auer, Nicolò Cesa-Bianchi, and Paul Fischer. 2002. Finite-time analysis of the multiarmed bandit problem. Machine Learning, 47(2–3):235– 256. Maximilian Balandat, Brian Karrer, Daniel Jiang, Samuel Daulton, Ben Letham, Andrew G. Wilson, and Eytan Bakshy. 2020. Botorch: A framework for efficient monte-carlo bayesian optimization. In Advances in Neural Information Processing Systems, volume 33, pages 21524–21538. Curran Associates, Inc. J. A. Bennett, N. Orouji, M. Khan, S. Sadeghi, J. Rodgers, and M. Abolhasani. 2024. Autonomous reaction pareto-front mapping with a self-driving catalysis laboratory. Nature Chemical Engineering, 1(3):240–250. James Bergstra, Rémi Bardenet, Yoshua Bengio, and Balázs Kégl. 2011. Algorithms for hyperparameter optimization. In Advances in Neural Information Processing Systems, pages 2546– 2554. Daniil A. Boiko, Robert MacKnight, Ben Kline, and Gabe Gomes. 2023. Autonomous chemical research with large language models. Nature, 624(7992):570–578.
Andres M. Bran, Sam Cox, Oliver Schilter, Carlo Baldassari, Andrew D. White, and Philippe Schwaller. 2024. Augmenting large language models with chemistry tools. Nature Machine Intelligence, 6(5):525–535. Leo Breiman. 2001. Random forests. Machine Learning, 45(1):5–32. Eric Brochu, Matthew W. Hoffman, and Nando de Freitas. 2010. Portfolio allocation for bayesian optimization. Preprint, arXiv:1009.5419. Benjamin Burger, Phillip M. Maffettone, Vladimir V. Gusev, Catherine M. Aitchison, Yang Bai, Xiaoyan Wang, Xiaobo Li, Ben M. Alston, Buyi Li, Rob Clowes, Nicola Rankin, Brandon Harris, Reiner Sebastian Sprick, and Andrew I. Cooper. 2020. A mobile robotic chemist. Nature, 583(7815):237–241. Johannes P. Dürholt, Thomas S. Asche, Johanna Kleinekorte, Gabriel Mancino-Ball, Benjamin Schiller, Simon Sung, Julian Keupp, Aaron Osburg, Toby Boyne, Ruth Misener, Rosona Eldred, Wagner Steuer Costa, Chrysoula Kappatou, Robert M. Lee, Dominik Linzner, David Walz, Niklas Wulkow, and Behrang Shafei. 2024. Bofire: Bayesian optimization framework intended for real experiments. Preprint, arXiv:2408.05040. Kobi C. Felton, Jan G. Rittig, and Alexei A. Lapkin. 2021. Summit: Benchmarking machine learning methods for reaction optimisation. Chemistry– Methods, 1(2):116–122. Chrisantha Fernando, Dylan Sunil Banarse, Henryk Michalewski, Simon Osindero, and Tim Rocktäschel. 2024. Promptbreeder: Self-referential self-improvement via prompt evolution. In Proceedings of the 41st International Conference on Machine Learning, volume 235 of Proceedings of Machine Learning Research, pages 13481–13544. PMLR. Martin Fitzner, Adrian Šošić, Alexander V. Hopp, Marcel Müller, Rim Rihana, Karin Hrovatin, Fabian Liebig, Mathias Winkel, Wolfgang Halter, and Jan Gerit Brandenburg. 2025. Baybe: a bayesian back end for experimental planning in the low-to-no-data regime. Digital Discovery, 4(8):1991–2000. Jinglong Gao, Xiao Ding, Yiming Cui, Jianbai Zhao, Hepeng Wang, Ting Liu, and Bing Qin. 2024. Self-evolving GPT: A lifelong autonomous experiential learner. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 6385–6432, Bangkok, Thailand. Association for Computational Linguistics. Rushil Gupta, Jason Hartford, and Bang Liu. 2025. LLMs for Bayesian optimization in scientific domains: Are we there yet? In Findings
of the Association for Computational Linguistics: EMNLP 2025, pages 15482–15510, Suzhou, China. Association for Computational Linguistics. Sumner B. Harris, Rama Vasudevan, and Yongtao Liu. 2025. Active oversight and quality control in standard bayesian optimization for autonomous experiments. npj Computational Materials, 11(1):23. Florian Häse, Matteo Aldeghi, Riley J. Hickman, Loïc M. Roch, and Alán Aspuru-Guzik. 2021a. Gryffin: An algorithm for bayesian optimization of categorical variables informed by expert knowledge. Applied Physics Reviews, 8(3):031406. Florian Häse, Matteo Aldeghi, Riley J. Hickman, Loïc M. Roch, Melodie Christensen, Elena Liles, Jason E. Hein, and Alán Aspuru-Guzik. 2021b. Olympus: a benchmarking framework for noisy optimization and experiment planning. Machine Learning: Science and Technology, 2(3):035021. Florian Häse, Loïc M. Roch, Christoph Kreisbeck, and Alán Aspuru-Guzik. 2018. Phoenics: A bayesian optimizer for chemistry. ACS Central Science, 4(9):1134–1145. Riley J. Hickman, Matteo Aldeghi, Florian Häse, and Alán Aspuru-Guzik. 2022. Bayesian optimization with known experimental and design constraints for chemistry applications. Digital Discovery, 1(5):732–744. Shengran Hu, Cong Lu, and Jeff Clune. 2025. Automated design of agentic systems. In The Thirteenth International Conference on Learning Representations. Frank Hutter, Holger H. Hoos, and Kevin LeytonBrown. 2011. Sequential model-based optimization for general algorithm configuration. In Learning and Intelligent Optimization, pages 507– 523. Springer Berlin Heidelberg. Donald R. Jones, Matthias Schonlau, and William J. Welch. 1998. Efficient global optimization of expensive black-box functions. Journal of Global Optimization, 13(4):455–492. Omar Khattab, Arnav Singhvi, Paridhi Maheshwari, Zhiyuan Zhang, Keshav Santhanam, Sri Vardhamanan, Saiful Haq, Ashutosh Sharma, Thomas T. Joshi, Hanna Moazam, Heather Miller, Matei Zaharia, and Christopher Potts. 2024. DSPy: Compiling declarative language model calls into state-of-the-art pipelines. In The Twelfth International Conference on Learning Representations. Agustinus Kristiadi, Felix Strieth-Kalthoff, Marta Skreta, Pascal Poupart, Alán Aspuru-Guzik, and Geoff Pleiss. 2024. A sober look at LLMs for material discovery: Are they actually good for
bayesian optimization over molecules? In Proceedings of the 41st International Conference on Machine Learning, volume 235 of Proceedings of Machine Learning Research, pages 25603–25622. PMLR. Artem I. Leonov, Alexander J. S. Hammer, Slawomir Lach, S. Hessam M. Mehr, Dario Caramelli, Davide Angelone, Aamir Khan, Steven O’Sullivan, Matthew Craven, Liam Wilbraham, and Leroy Cronin. 2024. An integrated self-optimizing programmable chemical synthesis and reaction engine. Nature Communications, 15(1):1240. Tennison Liu, Nicolás Astorga, Nabeel Seedat, and Mihaela van der Schaar. 2024a. Large language models to enhance bayesian optimization. In The Twelfth International Conference on Learning Representations. Xiao Liu, Hao Yu, Hanchen Zhang, Yifan Xu, Xuanyu Lei, Hanyu Lai, Yu Gu, Hangliang Ding, Kaiwen Men, Kejuan Yang, Shudan Zhang, Xiang Deng, Aohan Zeng, Zhengxiao Du, Chenhui Zhang, Sheng Shen, Tianjun Zhang, Yu Su, Huan Sun, and 3 others. 2024b. AgentBench: Evaluating LLMs as agents. In The Twelfth International Conference on Learning Representations, ICLR 2024. OpenReview.net. Andre K. Y. Low, Flore Mekki-Berrada, Abhishek Gupta, Aleksandr Ostudin, Jiaxun Xie, Eleonore Vissol-Gaudin, Yee-Fun Lim, Qianxiao Li, Yew Soon Ong, Saif A. Khan, and Kedar Hippalgaonkar. 2024. Evolution-guided bayesian optimization for constrained multi-objective optimization in self-driving labs. npj Computational Materials, 10(1):104. Yecheng Jason Ma, William Liang, Guanzhi Wang, De-An Huang, Osbert Bastani, Dinesh Jayaraman, Yuke Zhu, Linxi Fan, and Anima Anandkumar. 2024. Eureka: Human-level reward design via coding large language models. In The Twelfth International Conference on Learning Representations. Giang Ngo, Dat Phan Trong, Dang Nguyen, Sunil Gupta, and Svetha Venkatesh. 2026. Adaptive acquisition selection for bayesian optimization with large language models. In The Fourteenth International Conference on Learning Representations. Krista Opsahl-Ong, Michael J. Ryan, Josh Purtell, David Broman, Christopher Potts, Matei Zaharia, and Omar Khattab. 2024. Optimizing instructions and demonstrations for multi-stage language model programs. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 9340–9366, Miami, Florida, USA. Association for Computational Linguistics.
Reid Pryzant, Dan Iter, Jerry Li, Yin Lee, Chenguang Zhu, and Michael Zeng. 2023. Automatic prompt optimization with “gradient descent” and beam search. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 7957–7968, Singapore. Association for Computational Linguistics. Herbert Robbins. 1956. An empirical bayes approach to statistics. In Proceedings of the Third Berkeley Symposium on Mathematical Statistics and Probability, Volume 1: Contributions to the Theory of Statistics, pages 157–163. University of California Press. Bernardino Romera-Paredes, Mohammadamin Barekatain, Alexander Novikov, Matej Balog, M. Pawan Kumar, Emilien Dupont, Francisco J. R. Ruiz, Jordan S. Ellenberg, Pengming Wang, Omar Fawzi, Pushmeet Kohli, and Alhussein Fawzi. 2023. Mathematical discoveries from program search with large language models. Nature, 625(7995):468–475. Yixiang Ruan, Chenyin Lu, Ning Xu, Yuchen He, Yixin Chen, Jian Zhang, Jun Xuan, Jianzhang Pan, Qun Fang, Hanyu Gao, Xiaodong Shen, Ning Ye, Qiang Zhang, and Yiming Mo. 2024. An automatic end-to-end chemical synthesis development platform powered by large language models. Nature Communications, 15(1):10160. Bobak Shahriari, Ziyu Wang, Matthew W. Hoffman, Alexandre Bouchard-Cote, and Nando de Freitas. 2014. An entropy search portfolio for bayesian optimization. Preprint, arXiv:1406.4625. Benjamin J. Shields, Jason Stevens, Jun Li, Marvin Parasram, Farhan Damani, Jesus I. Martinez Alvarado, Jacob M. Janey, Ryan P. Adams, and Abigail G. Doyle. 2021. Bayesian reaction optimization as a tool for chemical synthesis. Nature, 590(7844):89–96. Mohit Shridhar, Xingdi Yuan, Marc-Alexandre Côté, Yonatan Bisk, Adam Trischler, and Matthew J. Hausknecht. 2021. ALFWorld: Aligning text and embodied environments for interactive learning. In 9th International Conference on Learning Representations, ICLR 2021. OpenReview.net. Joshua W. Sin, Siu Lun Chau, Ryan P. Burwood, Kurt Püntener, Raphael Bigler, and Philippe Schwaller. 2025. Highly parallel optimisation of chemical reactions through automation and machine intelligence. Nature Communications, 16(1):6464. Tao Song, Man Luo, Xiaolong Zhang, Linjiang Chen, Yan Huang, Jiaqi Cao, Qing Zhu, Daobin Liu, Baicheng Zhang, Gang Zou, Guoqing Zhang, Fei Zhang, Weiwei Shang, Yao Fu, Jun Jiang, and Yi Luo. 2025. A multiagent-driven robotic AI chemist enabling autonomous chemical research
on demand. Journal of the American Chemical Society, 147(15):12534–12545. Niranjan Srinivas, Andreas Krause, Sham M. Kakade, and Matthias W. Seeger. 2010. Gaussian process optimization in the bandit setting: No regret and experimental design. In Proceedings of the 27th International Conference on Machine Learning, pages 1015–1022. Manu Suvarna, Tangsheng Zou, Sok Ho Chong, Yuzhen Ge, Antonio J. Martín, and Javier PérezRamírez. 2024. Active learning streamlines development of high performance catalysts for higher alcohol synthesis. Nature Communications, 15(1):5844. Nathan J. Szymanski, Bernardus Rendy, Yuxing Fei, Rishi E. Kumar, Tanjin He, David Milsted, Matthew J. McDermott, Max Gallant, Ekin Dogus Cubuk, Amil Merchant, Haegyeom Kim, Anubhav Jain, Christopher J. Bartel, Kristin Persson, Yan Zeng, and Gerbrand Ceder. 2023. An autonomous laboratory for the accelerated synthesis of inorganic materials. Nature, 624(7990):86–91. Gary Tom, Stefan P. Schmid, Sterling G. Baird, Yang Cao, Kourosh Darvish, Han Hao, Stanley Lo, Sergio Pablo-García, Ella M. Rajaonson, Marta Skreta, Naruki Yoshikawa, Samantha Corapi, Gun Deniz Akkoc, Felix Strieth-Kalthoff, Martin Seifrid, and Alán Aspuru-Guzik. 2024. Self-driving laboratories for chemistry and materials science. Chemical Reviews, 124(16):9633– 9732. Thiago de P. Vasconcelos, Daniel A. R. M. A. de Souza, Cesar L. C. Mattos, and Joao P. P. Gomes. 2019. No-PASt-BO: Normalized portfolio allocation strategy for bayesian optimization. In 2019 IEEE 31st International Conference on Tools with Artificial Intelligence (ICTAI), pages 561–568. IEEE. Florian L. Wagner, Peter Sagmeister, Thomas G. Tampone, Vidhyadhar Manee, Dauzhan Yerkozhanov, Frederic G. Buono, Jason D. Williams, and C. Oliver Kappe. 2024. Selfoptimizing flow reactions for sustainability: An experimental bayesian optimization study. ACS Sustainable Chemistry & Engineering, 12(26):10002–10010. Guanzhi Wang, Yuqi Xie, Yunfan Jiang, Ajay Mandlekar, Chaowei Xiao, Yuke Zhu, Linxi Fan, and Anima Anandkumar. 2024a. Voyager: An openended embodied agent with large language models. Transactions on Machine Learning Research. Jason Y. Wang, Jason M. Stevens, Stavros K. Kariofillis, Mai-Jan Tom, Dung L. Golden, Jun Li, Jose E. Tabora, Marvin Parasram, Benjamin J. Shields, David N. Primer, Bo Hao, David Del Valle, Stacey DiSomma, Ariel Furman,
G. Greg Zipp, Sergey Melnikov, James Paulson, and Abigail G. Doyle. 2024b. Identifying general reaction conditions by bandit optimization. Nature, 626(8001):1025–1033. Xinyuan Wang, Chenxi Li, Zhen Wang, Fan Bai, Haotian Luo, Jiayou Zhang, Nebojsa Jojic, Eric Xing, and Zhiting Hu. 2024c. Promptagent: Strategic planning with language models enables expert-level prompt optimization. In The Twelfth International Conference on Learning Representations. Chengrun Yang, Xuezhi Wang, Yifeng Lu, Hanxiao Liu, Quoc V. Le, Denny Zhou, and Xinyun Chen. 2024. Large language models as optimizers. In The Twelfth International Conference on Learning Representations. Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik R. Narasimhan, and Yuan Cao. 2023. ReAct: Synergizing reasoning and acting in language models. In The Eleventh International Conference on Learning Representations, ICLR 2023. OpenReview.net. Mert Yuksekgonul, Federico Bianchi, Joseph Boen, Sheng Liu, Pan Lu, Zhi Huang, Carlos Guestrin, and James Zou. 2025. Optimizing generative AI by backpropagating language model feedback. Nature, 639(8055):609–616. Jiayi Zhang, Jinyu Xiang, Zhaoyang Yu, Fengwei Teng, Xiong-Hui Chen, Jiaqi Chen, Mingchen Zhuge, Xin Cheng, Sirui Hong, Jinlin Wang, Bingnan Zheng, Bang Liu, Yuyu Luo, and Chenglin Wu. 2025. AFlow: Automating agentic workflow generation. In The Thirteenth International Conference on Learning Representations. Wenqi Zhang, Ke Tang, Hai Wu, Mengna Wang, Yongliang Shen, Guiyang Hou, Zeqi Tan, Peng Li, Yueting Zhuang, and Weiming Lu. 2024. Agentpro: Learning to evolve via policy-level reflection and optimization. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 5348–5375, Bangkok, Thailand. Association for Computational Linguistics. Haowen Zhong. 2025. Data for towards global reaction feasibility and robustness prediction with high throughput data and bayesian deep learning. Haowen Zhong, Yilan Liu, Haibin Sun, Yuru Liu, Rentao Zhang, Baochen Li, Yi Yang, Yuqing Huang, Fei Yang, Frankie S. Mak, Klement Foo, Sen Lin, Tianshu Yu, Peng Wang, and Xiaoxue Wang. 2025. Towards global reaction feasibility and robustness prediction with high throughput data and bayesian deep learning. Nature Communications, 16(1):4522. Yongchao Zhou, Andrei Ioan Muresanu, Ziwen Han, Keiran Paster, Silviu Pitis, Harris Chan, and
Jimmy Ba. 2023. Large language models are human-level prompt engineers. In The Eleventh International Conference on Learning Representations.
A
Appendix Overview
The appendix is organized to put the most reviewer-facing evidence first. Appendix B reports capacity controls, intervention diagnostics, paired primary-control diagnostics, backend robustness, replay-protocol robustness, implementation costs, and the reproducibility package. Appendix C gives the complete baseline suite and baseline-configuration parity details. Appendix D then provides representative replay traces and policy-edit case studies. Appendix E gives dataset and replay details. Appendix F reports the complete prompt interface in a compact prompt-card format.
B
Additional Evidence, Diagnostics, and Reproducibility
Table 6 consolidates the two diagnostics used to interpret CARE: a larger 6-expert publicincumbent control remains below CARE on both datasets, and language-generated challengers change the selected action only after Public-Evidence Intervention Gate authorization. This yields 52 authorized challenger actions over 300 Minerva/Olympus decisions and 36 over 300 ChemLex decisions. Authorized challenger actions expose different replay mechanisms. Minerva/Olympus uses both proposal modes, with 34 recovery-mode and 18 frontier-mode authorizations; ChemLex uses the recovery proposal mode for all 36 authorizations, matching its high-cardinality categorical structure. ChemLex audit records therefore have stronger categorical agreement on average, while Minerva/Olympus frontiermode authorizations more often combine public rank with public-feature novelty. The shared pattern is the intended control behavior: the language path proposes alternatives often, but only a small, auditable subset changes the next reveal. B.1
Paired Evidence for Primary Controls
Table 7 reports paired seed-level deltas for the primary controls used in the main comparison. The paired view is intentionally focused on the public incumbent and the two languageonly controls: these are the contrasts that test whether CARE’s gated corrective-intervention design adds value beyond a public optimizer,
Capacity control Diagnostic
Minerva/Olympus
ChemLex
6-expert final best 6-expert AUC 6-expert regret
76.9 [73.0, 80.4] 69.0 [64.7, 73.3] 12.3
81.9 [76.0, 87.5] 75.2 [68.4, 81.5] 18.1
300 197 52 21 6.5
300 225 36 9 7.0
Intervention diagnostics Planner calls Eligible policies Authorized actions Immediate improvements Mean active policies
Table 6: Capacity control and intervention diagnostics. The capacity-control rows report seed means with 95% bootstrap confidence intervals over 30 seeds for final best and AUC. In the interventionlog rows, an eligible Challenger Policy is a languagegenerated ranking policy that passed deployment validation; an authorized challenger action means that the gate changed the final selected action relative to the public reference action.
beyond a fixed language-generated policy, and beyond direct ungated LLM policy evolution. We report mean paired deltas and win/tie/loss counts as descriptive matched-seed diagnostics, while the main and complete result tables report per-policy bootstrap confidence intervals. B.2
Backend and Intervention-Margin Robustness
We include two auxiliary robustness checks that probe backend and intervention-margin behavior without changing the primary comparison. First, Table 8 reruns CARE with Gemini-2.5Flash as the LLM backend under the same matched 30-seed, 10-round protocol and temperature 1.0. The result preserves the main qualitative pattern: CARE remains near-oracle on Minerva/Olympus and maintains strong final-best and anytime performance on ChemLex, while authorized challenger actions remain a minority of all decisions. Second, in Table 9, we vary the intervention margin on Minerva/Olympus over 10 matched seeds. Nearby margins preserve final-best behavior, while a more conservative +0.2 margin Comparison
Minerva/Olympus: CARE − control
Control
Final ∆; W/T/L
AUC ∆; W/T/L
Final ∆; W/T/L AUC ∆; W/T/L
ChemLex: CARE − control
Public incumbent Ungated LLM-evolving policy Non-evolving LLM policy
+8.5; 18/8/4 +19.7; 29/1/0 +25.2; 30/0/0
+11.0; 22/4/4 +22.9; 30/0/0 +25.5; 30/0/0
+8.2; 10/18/2 +11.0; 20/5/5 +10.7; 18/4/8
+4.4; 10/16/4 +10.4; 25/1/4 +5.4; 17/2/11
Table 7: Paired seed-level evidence for the primary controls. Deltas are CARE minus the control policy over the same 30 matched seeds; W/T/L counts seeds where CARE has higher, equal, or lower finalbest or AUC value.
88.5 88.2 92.1 90.8
84.4 83.3 81.6 80.1
0.7 1.0 7.9 9.2
52 / 21 42 / 20 36 / 9 35 / 7
lowers anytime AUC without improving final best. This local sensitivity check shows that nearby margins preserve the qualitative behavior of the pre-specified gate. Replay-Protocol Robustness
We varied the replay protocol along two axes: the number of initial observations and the sequential reveal budget. The resulting four settings are Main (5,10), Low-init (3,10), Longbudget (5,20), and Warm-start (10,10). Figure 3 summarizes the 10-seed protocol sweep as mean CARE deltas against the two closest control paths, and Tables 10 and 11 report the complete per-policy values. The qualitative ranking from the main text is preserved: CARE remains above both the public incumbent and the w/o-intervention-gate ablation in every dataset–protocol cell, with larger margins on Minerva/Olympus and smaller but consistently positive margins on ChemLex. B.4
Auditability, Validation, and Cost
Audit ledger. CARE records a per-round ledger that separates language proposal generation from gate-assigned action authority (Table 12). Language-generated Challenger Policies must compile, pass static and restrictedexecution checks, score the full remaining pool, and remain invariant to row order beMargin Final ↑ AUC ↑ Regret ↓ Auth. −0.1 0.0 +0.1 +0.2
86.8 86.6 86.5 86.5
83.5 83.6 83.8 80.3
2.5 2.6 2.7 2.7
18 18 17 19
Table 9: Minerva/Olympus intervention-margin sensitivity over 10 matched seeds. The main configuration uses margin 0.0; the table reports seed means and aggregate authorization counts.
Main (5,10)
+5.1
+7.0
+1.7
+1.3
Low-init (3,10)
+6.8
+7.3
+2.7
+1.2
Long-budget (5,20)
+3.4
+5.5
+0.9
+1.3
Warm-start (10,10)
Table 8: Secondary LLM-backend run. Values are means over 30 matched seeds; all rows use 300 planner calls. The GPT-5.4 rows are the main replay suite, and the Gemini rows use Gemini-2.5-Flash with the same public-information controller, protocol, and sampling temperature. Authorized/improved column counts gate-authorized challenger actions and the subset that immediately improved best observed value.
vs w/o certificate
Minerva/Olympus
Replay protocol
Minerva/Olympus / GPT-5.4 Minerva/Olympus / Gemini ChemLex / GPT-5.4 ChemLex / Gemini
B.3
vs public incumbent
Final ↑ AUC ↑ Regret ↓ Auth./imp.
Dataset/backend
+2.7
+3.7
+1.1
+1.1
Final Δ
AUC Δ
Final Δ
AUC Δ
vs public incumbent
vs w/o certificate
Replay protocol
ChemLex Main (5,10)
+1.8
+1.8
+3.9
+1.8
Low-init (3,10)
+2.4
+2.3
+3.8
+1.9
Long-budget (5,20)
+1.6
+1.7
+2.5
+1.3
Warm-start (10,10)
+1.2
+1.4
+2.9
+1.9
Final Δ
AUC Δ
Final Δ
AUC Δ
0
2
4
6
CARE mean delta
Figure 3: Replay-protocol robustness over 10 matched seeds per setting. Cells report mean CARE deltas relative to the public incumbent and to the w/o-intervention-gate ablation under four replay protocols that vary initial observations and reveal budget. Darker cells indicate larger CARE gains; all evaluated cells show positive final-best and AUC deltas.
fore they are eligible for deployment; the separate Public-Evidence Intervention Gate then decides whether a derived challenger candidate may replace the public reference action. Information boundary, cost, and release artifacts. All controller inputs are restricted to revealed outcomes, public candidate features, and logged optimizer state. The full CARE run used 497 API calls on Minerva/Olympus and 525 on ChemLex across 30 seeds, corresponding to 16.6 and 17.5 calls per seed, and consumed approximately 3.73M and 4.10M total tokens. Planner prompts contain only public trajectory summaries, recent rewards, candidate summaries, policy-state summaries, and prior gate reports; policy-synthesis prompts request an executable rank_candidates function over public observed and candidate tables. Appendix F reports the complete canonical prompt templates. B.5
Controller Specification for Reproducibility
This subsection records the artifact-level controller specification used in the matched replay suite. The entries define the public-information controller and audit interface before replay; they are not selected from unrevealed labels, oracle ranks, or evaluator-private artifacts.
Policy
Final best ↑
Best-so-far AUC ↑
Regret ↓
Main (5 init, 10 reveals) CARE Public incumbent w/o intervention gate BO-like surrogate Classical GP-UCB Non-evolving LLM policy
88.1 83.0 86.3 80.9 79.9 72.2
84.7 77.6 83.3 74.7 74.0 69.4
1.2 6.3 2.9 8.3 9.3 17.0
Low-init (3 init, 10 reveals) CARE Public incumbent w/o intervention gate BO-like surrogate Classical GP-UCB Non-evolving LLM policy
88.4 81.6 85.7 79.4 78.5 70.8
82.6 75.3 81.4 72.3 71.8 67.5
0.8 7.6 3.5 9.8 10.8 18.4
Long-budget (5 init, 20 reveals) CARE Public incumbent w/o intervention gate BO-like surrogate Classical GP-UCB Non-evolving LLM policy
89.2 85.8 88.3 83.3 82.4 75.5
86.2 80.7 84.9 77.6 76.7 72.0
0.0 3.4 0.9 6.0 6.8 13.7
Warm-start (10 init, 10 reveals) CARE Public incumbent w/o intervention gate BO-like surrogate Classical GP-UCB Non-evolving LLM policy
88.6 85.9 87.5 83.8 83.0 75.1
86.3 82.6 85.2 79.2 78.5 72.7
0.7 3.3 1.7 5.5 6.2 14.1
Protocol
Table 10: Full replay-protocol robustness sweep on Minerva/Olympus Suzuki Coupling (i). Values are means over 10 matched seeds per protocol. The protocol variations change the number of initial observations and reveal budget while keeping the public-information controller fixed. Final best ↑
Best-so-far AUC ↑
Regret ↓
Main (5 init, 10 reveals) CARE Public incumbent w/o intervention gate Gryffin-style categorical BO EDBO-style descriptor GP-EI Non-evolving LLM policy
96.2 94.5 92.4 93.4 90.1 81.7
88.6 86.8 86.8 79.1 79.3 78.9
3.8 5.5 7.6 6.6 9.9 18.3
Low-init (3 init, 10 reveals) CARE Public incumbent w/o intervention gate Gryffin-style categorical BO EDBO-style descriptor GP-EI Non-evolving LLM policy
95.3 92.9 91.4 91.8 88.7 79.8
86.0 83.7 84.1 76.0 76.6 75.9
4.7 7.1 8.6 8.2 11.3 20.2
Long-budget (5 init, 20 reveals) CARE Public incumbent w/o intervention gate Gryffin-style categorical BO EDBO-style descriptor GP-EI Non-evolving LLM policy
97.8 96.2 95.3 94.9 92.5 84.4
91.6 89.9 90.3 82.5 83.2 81.2
2.2 3.8 4.7 5.1 7.5 15.6
Warm-start (10 init, 10 reveals) CARE Public incumbent w/o intervention gate Gryffin-style categorical BO EDBO-style descriptor GP-EI Non-evolving LLM policy
96.9 95.7 94.0 94.6 92.0 84.0
91.2 89.8 89.3 83.7 83.9 81.4
3.1 4.3 6.0 5.4 8.0 16.0
Protocol
Policy
Table 11: Full replay-protocol robustness sweep on ChemLex Acid–Amine Wetlab. Values are means over 10 matched seeds per protocol. The protocol variations change the number of initial observations and reveal budget while keeping the public-information controller fixed.
C
Complete Baseline Suite
Tables 16 and 17 report the complete replay suite. The main paper shows the strongest and most diagnostic rows; the appendix adds non-learning controls, surrogate and chemistryaware BO rows, public-incumbent controls, language-only rows, and CARE ablations under the same matched protocol.
C.1
Baseline Configuration and Parity
All rows share the same initial observations, remaining candidate pool, 10-round reveal budget, objective scale, seed schedule, evaluator, and deterministic tie-breaking for each dataset and seed. Baselines can use only public candidate fields and revealed outcomes; hidden objective values, oracle ranks, and evaluator-
Artifact
Time
Stored public fields and role
Prompt payload
Pre
Public trajectory summary, candidate schema/summary, memory/state, and prior gate report; defines the LLM-visible proposal interface. Source hash, policy identifier, output schema, and validation status; records the language-generated ranking rule. Compile result, restricted execution, full-pool scoring, and row-order invariance; determines challenger eligibility. Incumbent-selected candidate and public support metadata; fixes the default action before any intervention. Candidate proposed from language ranking plus public support metadata; defines the proposal considered by the gate. Public gain/risk terms, support counts, reference/challenger comparison, and gate decision; grants or withholds action authority. Reference, challenger, selected action, and fallback/intervention reason; audits what changed the reveal decision. Revealed objective value and best-so-far update; updates future public history and evaluation only.
Generated policy
Pre
Deployment validation
Pre
Reference action
Pre
Challenger candidate
Pre
Pre-reveal audit Pre record
Final action log Pre
Outcome update
Post
Table 12: Per-round audit ledger. All artifacts that determine the selected action are written before outcome reveal and contain only public candidate features, revealed outcomes, and logged optimizer state. Component
Fixed public-information rule
Accept iff κ(x) ≥ 0.0, where κ(x) = Gpub (x) − Rpub (x) is computed before reveal. Gain terms Public-evidence support, public-incumbent margin, fused-ranking margin, support norm, public-rank bonus, novelty, categorical evidence, and schema-conditioned exploration evidence. Risk terms Missing public rank, low support, challenger-only support, deviation from the reference action, and negative public-incumbent margin. Policy Planner Uses the last five public rewards; improvement, stagnation, and far-below-best tests are fixed before replay and use only revealed values. Recovery Budget 2 per replay; scans the top proposal mode challenger-ranked candidates only after public-support and audit-record prechecks. High-cardinality categorical spaces require RF, GP, and categorical public support. Frontier Budget 1 per replay; active only when the proposal mode public schema exposes decision-visible features and the recent trajectory leaves room for bounded exploration. LLM backend OpenAI-compatible Responses API, gpt-5.4, reasoning effort medium, temperature 1.0, structured JSON outputs, verbosity low, and max output-token limits of 6000/9000 for Minerva/Olympus/ChemLex. Authorization score
Table 13: Artifact-level CARE controller specification used in the main replay suite. All quantities are computed from revealed outcomes, public candidate features, and logged optimizer state.
Publicincumbent component
Fixed instantiation and role
Rank-fusion experts
Fixed public heuristic, GP-EI, RF-UCB, categorical shrinkage, and categorical empirical-Bayes UCB when fields are available. Language rankings are logged as challenger evidence and require gate acceptance to change actions. p
Experts contribute wt,e / rt,e (x) over public top bands; weights use revealed rows only and are clamped to [0.60, 1.60] before schedule multipliers. Phase schedule Early phase emphasizes heuristic/prior weights; mid and late phases emphasize surrogate and categorical replay weights. Public prior Pt Normalized temperature, catalyst loading, residence time, and ligand indicator evidence when fields exist. Novelty/density Normalized distance from revealed rows and remaining-pool density over public ligand identity when available. Categorical Shrunk public component statistics: evidence Qt means, best observed component values, support counts, and failure-rate penalties. Sparse In high-cardinality categorical spaces, categorical route categorical evidence receives higher weight and route switching emphasizes model-UCB or empirical-Bayes evidence from revealed statistics. Rank transform
Table 14: Public-incumbent instantiation used to compute Stpub . All weights and schedules are fixed controller rules; adaptive quantities are functions of revealed outcomes, public candidate fields, and logged replay state.
private artifacts are unavailable at decision time. Non-learning rows use public identifiers and decision-visible strata. Surrogate, descriptor, categorical, mixed-space BO, and LMABOstyle rows are public-information finite-pool replay adaptations: they fit only on revealed rows and score the same unrevealed pool each round. The LMABO-style row preserves the acquisition-selection step, then evaluates the selected acquisition over the finite pool. Language rows share CARE’s backend, public history summaries, candidate fields, and prompt interface; CARE ablations disable one named module while keeping the remaining controller, histories, validation, and candidate pool fixed. Row family
Shared parity constraint
Random/heuristic Same seed schedule, public identifiers, strata, and deterministic tie-breaking. Surrogate BO Fit only on revealed rows; score the same unrevealed finite pool at each round. Chemistry-aware Use only decision-visible descriptors or BO categorical fields, never evaluator-side outcomes. LMABO-style Use public BO-state summaries to select LLM-BO an acquisition function, then score the same unrevealed finite pool. Language rows Same public prompt interface and backend; differ only in challenger-policy evolution and gate usage. CARE ablations Disable one named module while keeping the remaining controller and replay state fixed.
Table 15: Baseline-parity summary for the complete replay suite.
Reading the complete suite. The rows are role-separated controls rather than unrelated optimizers: random and heuristic rows calibrate finite-pool difficulty; BO-family rows instantiate public optimizer families; and language rows test whether self-evolution without gate-assigned authority is sufficient. The pattern matches the main text: CARE improves over the public incumbent and languageonly variants, with larger separation on Minerva/Olympus and closer but still favorable mean results on ChemLex.
D
Representative Replay Traces
The following traces are post-hoc illustrations from the matched replay logs. They do not expose oracle information to the policy; conversions, yields, and oracle ranks are reported only after the replay decision has been made. Public incumbent and gate-authorized challenger on ChemLex. ChemLex seed 11, round 4 provides a compact mechanism trace for the high-cardinality categorical setting. The public incumbent controller selected reaction condition C1 as the public reference action, supported by the categorical empiricalBayes UCB and categorical shrinkage experts. The Challenger Policy proposed condition C2; the pre-reveal audit record recorded rank 2, support from four public experts, public gain 0.901, and public risk 0.000. The final selected action therefore changed from the public reference action to a gate-authorized challenger action. After reveal, C2 achieved conversion 93.42, raising the best-so-far value from 91.71 to 93.42. Figure 4 sketches the decision path, and Table 18 expands the opaque candidate IDs into concrete reaction conditions. The same trajectory later produced a second gate-authorized recovery-mode action. At round 6, the public incumbent again selected C1, while the recovery proposal mode proposed condition C3. The pre-reveal audit record recorded four supporting public experts, public rank 4, public gain 1.023, and public risk 0.000. The reveal achieved conversion 94.74 and raised the best-so-far value from 93.42 to 94.74. Together, the two interventions show the intended role of the recovery proposal mode: it
Figure 4: ChemLex public-incumbent case study. The figure shows the pre-reveal audit record used by the intervention gate to assign action authority. All ranks, support counts, gains, and risks are computed before reveal; the conversion is reported only post hoc and is not available to the gate. Table 18 expands the displayed candidate IDs into concrete reaction conditions.
can redirect a weak public trajectory through auditable, public-supported changes to concrete reaction conditions without giving the language-generated policy direct control over every reveal. Frontier proposal mode on Minerva/Olympus. The frontier proposal mode is most visible in aggregate on Minerva/Olympus, where removing it causes the largest ablation drop in Table 3. This mode performs schema-conditioned public-feature exploration: it proposes a bounded alternative to the public reference action from decision-visible feature structure when the schema supports such a view. We use the aggregate ablation and intervention counts as the main evidence for this mode, rather than treating a single trace as representative, because the intended behavior is controlled trajectory diversification under the same Public-Evidence Intervention Gate. Table 19 expands the Minerva/Olympus seed 3, round 4 trace used below: the challenger action M2 changes from an L0, shorter-residence-time reference condition to an L3, longer-residencetime, higher-temperature condition under the same gate. D.1
Policy-Evolution Case Studies
The following examples show how the LLM edits executable ranking policies. We show the scoring and reason-code changes, omitting input parsing, stable sorting, and diagnostic
Policy
Final best ↑
Best-so-far AUC ↑ Regret ↓ Top-10 hit
CARE 88.5 [88.0, 89.0] 84.4 [83.2, 85.3] Public incumbent 80.0 [76.4, 83.4] 73.4 [69.3, 77.3] TPE-style BO (Bergstra et al., 2011) 77.6 [74.5, 80.6] 68.3 [65.0, 71.5] LMABO-style LLM-BO (Ngo et al., 2026) 76.6 [73.0, 79.6] 66.5 [62.1, 70.6] BayBE/BoFire-style mixed BO (Fitzner et al., 2025; Dürholt et al., 2024) 75.3 [72.0, 78.0] 67.7 [64.2, 70.9] Gryffin-style categorical BO (Häse et al., 2021a) 73.6 [69.1, 77.8] 67.0 [62.8, 71.0] EDBO-style descriptor GP-EI (Shields et al., 2021) 73.4 [69.5, 77.1] 65.7 [61.5, 69.7] GP-EI (Jones et al., 1998) 72.7 [68.4, 76.8] 65.5 [60.5, 70.4] GP-UCB (Srinivas et al., 2010) 75.4 [70.6, 79.7] 66.7 [61.7, 71.3] BoTorch-style GP-LogEI (Balandat et al., 2020) 72.5 [67.9, 76.7] 65.4 [60.3, 70.1] Generic surrogate BO (Breiman, 2001; Auer et al., 2002) 74.9 [70.8, 78.4] 63.7 [58.4, 68.9] SMAC-style RF-EI (Hutter et al., 2011) 63.7 [56.8, 69.4] 56.6 [50.1, 62.8] Chemistry descriptor BO (Häse et al., 2021a; Shields et al., 2021) 69.9 [65.9, 73.8] 65.3 [61.1, 69.5] Categorical empirical-Bayes UCB (Robbins, 1956; Auer et al., 2002) 63.9 [58.1, 69.1] 59.2 [53.8, 64.4] Fixed public heuristic 69.1 [62.9, 74.7] 66.5 [60.9, 71.9] Random 61.1 [56.4, 65.6] 56.7 [51.2, 62.0] Stratified random 60.4 [54.0, 66.5] 57.5 [52.0, 63.0] Ungated LLM-evolving policy 68.8 [63.1, 73.9] 61.4 [55.6, 67.0] Non-evolving LLM policy 63.3 [57.5, 68.8] 58.8 [53.1, 64.4] CARE w/o Policy Planner 87.2 [86.2, 88.1] 82.0 [79.0, 84.0] CARE w/o intervention gate 87.3 [86.3, 88.1] 82.7 [81.0, 84.0] CARE w/o recovery proposal mode 87.6 [86.8, 88.4] 82.8 [81.1, 84.1] CARE w/o frontier proposal mode 78.2 [74.7, 81.3] 72.7 [68.6, 76.5]
0.7 9.2 11.6 12.6 14.0 15.7 15.9 16.5 13.9 16.8 14.4 25.6 19.3 25.4 20.1 28.1 28.9 20.4 25.9 2.0 1.9 1.6 11.1
100% 47% 20% 17% 0% 17% 20% 20% 37% 20% 23% 0% 3% 3% 13% 0% 0% 13% 3% 87% 90% 93% 30%
Table 16: Complete matched replay suite on Minerva/Olympus Suzuki Coupling (i). Values are seed means with 95% bootstrap confidence intervals over 30 matched seeds for final best and best-so-far AUC. Top-10 hit is a post-hoc evaluation indicator computed only after replay. Named BO-family replay adaptations cite their source methods and are evaluated under the public-information finite-pool interface. Policy
Final best ↑
Best-so-far AUC ↑ Regret ↓ Top-10 hit
CARE 92.1 [88.4, 95.3] 81.6 [76.7, 86.2] Public incumbent 83.9 [77.1, 89.9] 77.2 [70.4, 83.4] TPE-style BO (Bergstra et al., 2011) 85.1 [81.2, 88.6] 78.6 [73.2, 83.5] BayBE/BoFire-style mixed BO (Fitzner et al., 2025; Dürholt et al., 2024) 83.1 [76.5, 88.9] 74.7 [68.0, 81.5] Gryffin-style categorical BO (Häse et al., 2021a) 89.8 [85.3, 93.5] 77.2 [70.3, 83.6] EDBO-style descriptor GP-EI (Shields et al., 2021) 88.9 [86.3, 91.3] 80.5 [74.9, 85.2] LMABO-style LLM-BO (Ngo et al., 2026) 79.0 [70.9, 85.5] 73.3 [65.0, 80.6] GP-EI (Jones et al., 1998) 86.2 [81.1, 90.7] 75.0 [67.4, 82.2] GP-UCB (Srinivas et al., 2010) 83.1 [76.5, 88.8] 75.5 [67.4, 82.7] BoTorch-style GP-LogEI (Balandat et al., 2020) 81.3 [72.3, 88.7] 72.8 [63.5, 81.0] Generic surrogate BO (Breiman, 2001; Auer et al., 2002) 76.8 [64.7, 87.2] 70.4 [59.3, 81.0] SMAC-style RF-EI (Hutter et al., 2011) 86.3 [81.3, 90.4] 71.0 [61.9, 79.8] Chemistry descriptor BO (Häse et al., 2021a; Shields et al., 2021) 82.4 [74.3, 89.2] 73.5 [65.5, 80.6] Categorical empirical-Bayes UCB (Robbins, 1956; Auer et al., 2002) 75.4 [65.6, 84.1] 68.2 [57.6, 78.3] Fixed public heuristic 89.5 [89.0, 90.2] 73.8 [68.8, 78.9] Random 81.9 [75.4, 87.2] 73.7 [67.1, 80.2] Stratified random 78.6 [70.5, 86.0] 71.1 [62.7, 78.2] Ungated LLM-evolving policy 81.2 [73.9, 87.4] 71.2 [63.2, 78.7] Non-evolving LLM policy 81.4 [73.0, 88.3] 76.1 [68.1, 83.2] CARE w/o Policy Planner 87.4 [82.5, 91.4] 78.7 [72.8, 84.2] CARE w/o intervention gate 87.6 [82.7, 91.7] 79.3 [73.7, 84.3] CARE w/o recovery proposal mode 85.3 [78.8, 90.7] 78.4 [72.0, 84.2] CARE w/o frontier proposal mode 88.6 [84.1, 92.1] 79.2 [73.5, 84.7]
7.9 16.1 14.9 16.9 10.2 11.1 21.0 13.8 16.9 18.7 23.2 13.7 17.6 24.6 10.5 18.1 21.4 18.8 18.6 12.6 12.4 14.7 11.4
13% 10% 0% 3% 3% 0% 0% 7% 0% 7% 10% 0% 0% 3% 0% 0% 0% 10% 7% 0% 0% 10% 0%
Table 17: Complete matched replay suite on ChemLex Acid–Amine Wetlab. Values are seed means with 95% bootstrap confidence intervals over 30 matched seeds for final best and best-so-far AUC. Top-10 hit is a post-hoc evaluation indicator computed only after replay. Named BO-family replay adaptations cite their source methods and are evaluated under the public-information finite-pool interface.
bookkeeping. Each excerpt remains representative of the deployed policy logic: it scores only public candidate features and revealed outcomes. Minerva/Olympus: adding local diversity to a ligand-proximity policy. In seed 3, the initial policy artifact ranked candidates by proximity to the best observed ligand and reaction conditions. This ranking supported a gate-authorized selection of M2, the L3 condition with residence time 120.0, temperature
110.0, and catalyst loading 2.515 in Table 19, at round 4. The pre-reveal audit record recorded public rank 1, two supporting public experts, public gain 0.662, and public risk 0.044; the reveal achieved a high-yield post-hoc outcome. After this success, the Policy Planner patched the policy to preserve the best-ligand preference while penalizing near-duplicates and adding a small exploration bonus. The patch illustrates the intended self-evolution behavior: the LLM does not obtain hidden outcomes, but it can turn the observed trajectory into a more
Alias and role
Display ID
C1: reference action cand_009235 C2: round-4 cand_000963 challenger action C3: round-6 cand_001842 challenger action
Acid
Amine
Post-hoc conversion
COc1ccc(C=CC(=O)Nc2ccccc2C(=O)O)cc1OC CC(C)[C@H](NC(=O)OCC1c2ccccc2-c2ccccc 21)C(=O)O O=C(N[C@H](COCc1ccccc1)C(=O)O)OCC1c2c cccc2-c2ccccc21
Nc1ccc(Br)c2cccnc12 Cc1cc(N2CCNCC2)n(-c2ccccc2)n1
0.00 93.42
Cc1cc(N2CCNCC2)n(-c2ccccc2)n1
94.74
Shared visible fields: Reagents CCN(C(C)C)C(C)C.CN(C)C(On1nnc2cccnc21)=[N+](C)C.F[P-](F)(F)(F)(F)F; solvent CN(C)C=O.
Table 18: Concrete ChemLex reaction conditions for the replay trace. Candidate IDs are run-local display identifiers; C1–C3 name the decision-visible reaction conditions used in the case text. All rows share the same reagent mixture and solvent, so the authorized challenger actions change the acid–amine pair under the public-information boundary. Conversion is post hoc and is not an input to the gate. Field
M1: reference action
M2: challenger action
Display ID Ligand indicator Residence time Temperature Catalyst loading Post-hoc yield
cand_000072 L0 60.0 100.0 2.515 64.55
cand_002592 L3 120.0 110.0 2.515 89.23
Table 19: Concrete Minerva/Olympus experimental conditions for the seed 3, round 4 replay trace. Candidate IDs are run-local display identifiers; M1– M2 name the decision-visible ligand and condition settings. Yield is reported only after reveal, and turnover remains evaluator-side. Decision
Pre-reveal audit record and post-reveal outcome
ChemLex, seed 11/round rank 2; support 4; gain 4: C2 replaces C1 0.901; risk 0.000; (Table 18) revealed 93.42 ChemLex, seed 11/round rank 4; support 4; gain 6: C3 replaces C1 1.023; risk 0.000; (Table 18) revealed 94.74 Minerva/Olympus, seed rank 1; support 2; gain 3/round 4: M2 replaces 0.662; risk 0.044; M1 (Table 19) revealed 89.23
Table 20: Representative gate-authorized challenger actions used in the case studies. Public rank, support, and risk come from the pre-reveal audit record and are computed before reveal; the revealed value is reported only post hoc. Tables 18 and 19 expand the run-local candidate IDs into concrete decisionvisible conditions.
acid–amine conditions in Table 18; Table 20 keeps the numeric audit-record details in one place. Minerva/Olympus before patch. score = (0.65 * lig_prior + 10.0 * temp_c + 8.0 * time_c + 9.0 * load_c + lig_bonus + best_onehot_match) if near_best: reason_code = "best_ligand_near_best" elif lig == best_lig: reason_code = "best_ligand_exploration" else: reason_code = "condition_proximity"
Minerva/Olympus patch.
after
diversity
diversity_penalty = ( 5.0 * nearest_same if tested_same_count > 0 else 1.5 * nearest_any ) exploration_bonus = ( 2.0 if lig not in seen_ligands else 1.0 if tested_same_count == 1 else 0.0 ) base = (0.65 * lig_prior + 9.0 * temp_c + 7.0 * time_c + 8.0 * load_c + lig_bonus + best_onehot_match) score = base + exploration_bonus - diversity_penalty if near_best and nearest_same < 0.98: reason_code = "best_ligand_refined" elif lig not in seen_ligands: reason_code = "new_ligand_exploration" else: reason_code = "condition_proximity_diverse"
ChemLex before patch. score = (90.0 * learned_similarity + 28.0 * best_pair_similarity 35.0 * neg_penalty + reagent_bonus + solvent_bonus + 8.0 * size_pref + novelty_bonus repeat_penalty) if pair_key in bad_pair: reason_code = "avoid_repeated_failed_pair" elif learned_similarity > 0.08 or best_pair_similarity > 0.1: reason_code = "positive_similarity" else: reason_code = "fallback_public_signal"
ChemLex after balance patch. structured public ranking rule. ChemLex: balancing positive similarity, failed-pair avoidance, and public component evidence. ChemLex seed 11 shows two gate-authorized recovery-mode actions from the same patched policy artifact. After low or non-improving reveals, the revised policy prioritized acid–amine similarity to positive observations, avoided previously failed pairs, and retained reagent and solvent evidence. The resulting challenger actions are the C2 and C3
score = (100.0 * learned + 30.0 * best_sim 25.0 * neg_pen + reagent_bonus + solvent_bonus + 6.0 * size_pref + novelty - repeat) if pair in bad_pair: reason_code = "avoid_repeat" elif learned > 0.08 or best_sim > 0.1: reason_code = "positive_pattern_match" elif novelty > 0.0: reason_code = "controlled_novelty" else: reason_code = "fallback_public_signal"
The Minerva/Olympus patch preserves the successful best-ligand and condition-proximity signal while adding public-feature diversity and repeat-control terms; the ChemLex patch strengthens public positive-similarity evidence,
softens over-penalization from negative observations, and keeps novelty as a secondary term. All excerpts score only public candidate features and revealed outcomes.
E
Dataset and Replay Protocol Details
Datasets. Minerva/Olympus Suzuki Coupling (i) contains 5,670 finite-pool candidates with ligand indicators, residence time, temperature, and catalyst loading as decision-visible variables. The optimization target is yield; turnover is kept evaluator-side and is not exposed to any policy. ChemLex Acid–Amine Wetlab contains 11,088 candidates after the prespecified duplicate protocol, with Acid, Amine, Reagents, and Solvent as decision-visible variables and conversion as the optimization target. Replay item
Fixed value or boundary
Candidate pools
5,670 Minerva/Olympus candidates; 11,088 ChemLex candidates after duplicate handling. Ligand indicators, residence time, temperature, and catalyst loading for Minerva/Olympus; Acid, Amine, Reagents, and Solvent for ChemLex. Yield for Minerva/Olympus and conversion for ChemLex; unrevealed outcomes and Minerva/Olympus turnover stay evaluator-side. Dataset oracle values are used only for regret, top-k hits, and normalized plots after replay. 30 seeds, five initial observations, ten reveals, shared candidate pool, evaluator, and deterministic tie-breaking per seed.
Visible fields
Targets
Oracle use
Matched protocol
Table 21: Replay-interface summary used by all policies in the matched suite.
Artifact licenses and intended use. The replay datasets are used as scientific benchmarking artifacts for offline optimizer evaluation. The Minerva/Olympus source article is distributed under a Creative Commons Attribution 4.0 International license, and the Olympus benchmarking framework is publicly released for optimization and experiment-planning research (Sin et al., 2025; Häse et al., 2021b). The ChemLex Zenodo record used for the acid– amine replay is distributed under a Creative Commons Attribution Non Commercial 4.0 International license (Zhong, 2025; Zhong et al., 2025). Our use is limited to non-commercial offline replay, duplicate handling, and aggregate reporting for research evaluation. We do not redistribute raw upstream archives in the submission, do not use the artifacts to recommend or
execute live reactions, and keep evaluator-side outcomes separated from the public decision interface. Objective scales and oracle values. All reported final-best and AUC values use the original objective scales in the released replay tables. The Minerva/Olympus yield target ranges from 0.0 to an oracle value of 89.2348 in the replay pool, so a value near 89 is near-oracle rather than a below-100 percentage artifact. The cleaned ChemLex conversion target ranges from 0.0 to an oracle value of 100.0. Simple regret is computed to the corresponding dataset oracle, and normalized simple regret divides by the dataset-specific oracle range. ChemLex duplicate handling. The ChemLex replay uses the unique-mean duplicate protocol: duplicate condition tuples are aggregated by mean conversion, high-conflict duplicate groups above the configured conflict threshold are removed, and candidate identifiers are deterministically derived from decisionvisible condition tuples. A fixed shuffle seed defines replay order. This protocol keeps the decision interface tied to public condition fields while avoiding leakage through raw row order or private duplicate structure. Matched replay. All policies are evaluated with 30 seeds, five initial observations per seed, and 10 sequential reveal rounds. For a given seed and dataset, policies receive the same initial observations, remaining candidate pool, reveal budget, and evaluator. The dataset oracle is used only to compute simple regret, top-k hit indicators, and normalized trajectory plots.
F
Prompt Transparency
This section reports the canonical prompts used by the two LLM-facing modules. The prompt cards include the instruction text, developer messages, allowed actions, input fields, and output fields; runtime values are named public placeholders. In replay, placeholders are filled only with revealed observations, public candidate features, public memory/state, and public gate reports. Hidden outcomes, oracle ranks, evaluator-private state, baseline artifacts, cached optimizer outputs, local reference code, credentials, and non-public mappings are never inserted. The same policy-synthesis template handles creation and patching; when the Policy Planner chooses patch_skill, the current public policy artifact is supplied as active_skill_source. Literal runtime strings such as public_safe, create_skill, patch_skill, skill_artifact, and active_skill_source are preserved for artifact fidelity; in the paper’s terminology,
they correspond to the public-information boundary, Policy Planner actions, Challenger Policy artifacts, and the active policy source. In the original schema text, public_safe denotes the public-information boundary.
4. The final deployed tool must score the full remaining candidate_df, not a menu.
Prompt
Public inputs
Required output
5. Reuse is allowed only when the active skill is both deployable and still improving or diversifying selected outcomes.
Planner
Observed summary, candidate summary, memory summary, policy state, reward trend, last gate report, parser error if any. Task plan, recent revealed examples, candidate schema/summary, memory summary, policy state summary, active policy source if patching, parser error if any.
One structured JSON task plan choosing create_skill, patch_skill, or reuse_active_skill.
Policy synthesis
One structured JSON policy artifact defining rank_candidates over public observed and candidate tables.
Table 22: Prompt interface for LLM-facing components. The fields below are the complete canonical interface used in the main replay suite; runtime values are public summaries or public source strings.
F.1
Planner Prompt Card
Developer message. You are the public-safe planner for an offline finite-pool optimization harness. Return only the JSON object required by the schema. Use only public observed rows, public candidate features, memory, and gate/reward summaries supplied by the user.
Field
Contents
task schema_version, run_id, round_index observed_summary
plan_next_public_safe_policy_edit. Replay identifiers and planner schema version.
candidate_summary memory_summary policy_state
reward_trend last_gate_report
parser_error
allowed_actions allowed_skill_ families
Public summary of revealed observations only. Public summary of the remaining candidate pool. Public memory text truncated to 1200 characters. Compact public policy state, including active policy identifiers and public histories. Public trend computed from revealed rewards. Compact public report from the previous deployment/intervention gate. Public parse or validation error from a previous retry, truncated to 500 characters. create_skill, patch_skill, reuse_active_skill. ranker, constraint, exploration, calibrator, fallback.
Table 23: Complete public input fields for the planner prompt.
3. Prefer low-risk deterministic code edits that compile to rank_candidates.
6. Do not patch solely because one round failed after a recent best-observed improvement; reuse once unless the last selected objective value was clearly poor. 7. Plan patch_skill mainly after two or more consecutive no-improvement rounds, or after a revealed selection far below the current best. 8. If patching after stagnation, blend the active scoring rule with bounded diversity/novelty; do not replace a previously improving policy with an unrelated scorer. 9. If the active skill repeatedly selects lower-yield nearduplicates after a first improvement, patch it to avoid over-exploiting that local region. 10. Return JSON with task_plan self_reported_forbidden_info_used=false.
and
Planner output schema. {"schema_version":"self_evolving_task_plan_v1","run_id":"[RUN_ID ]","round_index":"[ROUND_INDEX]", "task_plan":{"action":"create_skill|patch_skill| reuse_active_skill","skill_family":"ranker|constraint| exploration|calibrator|fallback", "objective":"short public-safe objective","target_skill_id":" active skill id or null","risk_budget":"low|medium|high", "required_checks":"[DEFAULT_REQUIRED_CHECKS]","rationale":"short public-safe rationale"}, "self_reported_forbidden_info_used":false}
F.2
Policy-Synthesis Prompt Card
Developer message. You are the public-safe skill author for an offline finite-pool optimization harness. Return only the JSON object required by the schema. The source must define exactly rank_candidates(observed_df, candidate_df, memory=None, tool_state=None). Do not read files, call networks, inspect DataFrame attrs, or use evaluator-private outcomes.
Field
Contents
task
generate_or_patch_public_safe_rank_ candidates_skill. Replay identifiers and policy-synthesis schema version.
schema_version, run_id, round_index task_plan observed_examples
candidate_schema candidate_summary
memory_summary policy_state_ summary active_skill_ source parser_error
The public planner output for the current round. Up to the last 12 public revealed rows, with cells compacted for prompt length. Public candidate columns and data types. Remaining public candidate count, public columns, and categorical cardinalities. Public memory text truncated to 1200 characters. Active policy identifiers plus recent public reward and gate histories. Current public policy source, truncated to 8000 characters, when patching; empty otherwise. Public parse or validation error from a previous retry, truncated to 500 characters.
Table 24: Complete public input fields for the policy-synthesis prompt. Policy-synthesis instructions.
Planner instructions. 1. Plan only one next edit/action for a language-generated optimizer skill.
1. Write normal Python source defining rank_candidates(observed_df, candidate_df, memory=None, tool_state=None).
2. Use only public views and revealed objective values; do not seek evaluator-private labels, answer keys, baseline artifacts, files, network, or credentials.
2. Return a dictionary, never a DataFrame: {’ranked_candidates’: list, ’tool_state’: dict, ’tool_diagnostics’: dict}.
exactly
3. Each ranked row must include candidate_id, rank, score, reason_code, and evidence_refs. It must cover every candidate_df row with unique positive ranks and finite scores. 4. evidence_refs is empty unless exact observation_id values are copied from observed_df; never invent evidence strings. 5. Use only public observed_y for observed rows and public candidate features. 6. Do not read files, call networks, import disallowed modules, inspect DataFrame attrs, or reference evaluatorprivate labels, answer keys, baseline artifacts, private provenance fields, or credentials. 7. Do not use double-underscore names or strings in temporary columns, helper variables, imports, or escape hatches. 8. Do not call getattr, setattr, hasattr, eval, exec, compile, globals, locals, vars, open, or __import__. 9. Make ranking row-order invariant: do not use enumerate index, original row order, DataFrame index, or insertion order in scores or tie-breaks. 10. Sort with public score first and candidate_id as the only deterministic tie-breaker; never tie-break by row position. 11. Avoid creating helper columns such as _row_order, _index, __lig, or _position for ordering. 12. Return JSON with skill_artifact.source self_reported_forbidden_info_used=false.
Policy-synthesis output schema. {"schema_version":"self_evolving_skill_artifact_v1","run_id":"[ RUN_ID]","round_index":"[ROUND_INDEX]", "skill_artifact":{"skill_id":"short id","family":"[ TASK_PLAN_SKILL_FAMILY]","source":"Python source string defining rank_candidates","rationale":"short public-safe rationale"}, "self_reported_forbidden_info_used":false}
and