Agentic Data Cleaning Without a Clean Reference: An Experimental Study of Capabilities and Trade-offs

AGENTIC DATA C LEANING W ITHOUT A C LEAN R EFERENCE : A N E XPERIMENTAL S TUDY OF C APABILITIES AND T RADE - OFFS

arXiv:2608.14765v1 [cs.AI] 14 Aug 2026

Hadi Fadlallah Faculty of Arts and Sciences University of Sciences and Arts in Lebanon Beirut, Lebanon ha.fadlallah@usal.edu.lb ORCID: 0000-0003-1160-5980

August 18, 2026

A BSTRACT Data cleaning without a trusted clean reference is challenging because unusual values may represent either genuine errors or valid observations. This paper studies how different agent capabilities affect reference-free data cleaning and proposes an evidence-grounded framework that combines structured context, profiling, LLM reasoning, executable checks, controlled evidence retrieval, source ranking, citation alignment, conservative repair, reversible scripts, and provenance logging. Seven configurations are evaluated across financial, clinical, and environmental-monitoring datasets using controlled synthetic corruption and original-data descriptive analysis, resulting in 126 completed runs. The evaluation includes two comparison baselines and a progressive LLM-based sequence that adds executable tools, evidence retrieval, evidence controls, and conservative repair. In the synthetic evaluation, the deterministic profiling baseline achieved the highest detection F1-score of 0.561. Among the LLM-based configurations, the full conservative configuration achieved the highest F1-score of 0.421, but no configuration performed best across all evaluation criteria. The source-ranked configurations achieved the lowest unsupported-rule rates, while decision-level citation alignment remained weak. The full conservative configuration produced no unsafe or unnecessary modifications, although these rates were already zero before the conservative policy was added, and it performed no direct repairs. Overall, the results show that additional capabilities introduce trade-offs among detection, repair, evidence grounding, conservative behaviour, reproducibility, and operational cost rather than producing consistent improvements. The study provides a structured framework and empirical methodology for evaluating these trade-offs in reference-free agentic data cleaning. Keywords data cleaning · data quality · agentic AI · large language models · reference-free evaluation

1

Introduction

Data cleaning is essential in analytics, scientific computing, data management, and machine-learning pipelines, but errors are rarely purely syntactic. Missing values, invalid formats, implausible codes, temporal irregularities, duplicates, and unusual measurements must be interpreted relative to task, consumer, and context. Foundational data-quality research frames quality as multidimensional and dependent on data consumers rather than as a single correctness property [1]. Ontological and methodological perspectives further show that data-quality dimensions must be interpreted with respect to the represented real-world entities and the intended assessment context [2, 3]. Broader data-quality methodologies likewise treat assessment and improvement as context-sensitive processes involving dimensions, data types, techniques, and organizational requirements [4]. Classical cleaning work shows that profiling, constraints, external information, and human judgment are needed because no single technique detects or repairs all quality problems [5]. Subsequent surveys and systems reinforce this view by highlighting the complementary roles of error detection, profiling, rule discovery, repair, and user involvement [6, 7].

A PREPRINT - AUGUST 18, 2026

Large language models (LLMs) and agentic systems can infer column semantics, propose rules, generate scripts, explain anomalies, and coordinate multi-step workflows. Recent work has explored LLM-supported cleaning workflows and automated data-cleaning pipelines [8, 9]. Other studies examine retrieval-supported repair and agentic cleaning workflows that combine reasoning with external evidence or actions [10, 11]. Related work also investigates contextual rule generation, semantic table profiling, and LLM-assisted data standardisation [12, 13]. These capabilities are promising, but they do not solve the central reference-free problem: a suspicious value may be a true error, a rare but valid signal, an undocumented convention, or a case requiring expert review. In domains such as clinical records, finance, and radiation monitoring, unsupported modification can damage scientific, operational, or regulatory meaning. This paper therefore studies reference-free cleaning as evidence-grounded decision-making rather than as direct transformation. The proposed framework asks an agent to detect candidate issues, gather internal and external evidence, construct requirements, classify repair risk, generate reversible transformations only when justified, and preserve or escalate ambiguous cases. The study evaluates this design using two comparison baselines, A0 and A1, followed by a progressive ablation from A2 to A6. The evaluation covers three datasets, two evaluation settings, and three repeated runs, producing 126 successful runs. The aim is to measure configuration trade-offs under the tested datasets and controlled evidence setting, not to claim that one configuration is universally superior. Controlled synthetic-corruption runs provide ground truth for detection, repair, and valid-signal preservation, while original-data runs are interpreted descriptively because no trusted clean reference or manual adjudication is available. The main contribution is threefold. First, the paper formalises the contextual knowledge, tool capabilities, evidence sources, and decision classes that may support reference-free data cleaning. Second, it proposes an evidence-grounded framework that combines profiling, tools, controlled evidence retrieval, source ranking, citation alignment, conservative repair, reversibility, and provenance. Third, it reports an exploratory ablation study that measures how these capabilities affect cleaning behavior. The results show clear trade-offs: A1 achieved the highest synthetic detection F1-score, A5 and A6 had the lowest unsupported-rule rates, and A6 showed more conservative repair behavior. However, the most complete configuration was not consistently better in detection, repair, reproducibility, runtime, or token cost. The study is intentionally cautious in its claims. It does not assume that more agent capabilities necessarily produce better cleaning, and it does not evaluate original-data outputs as if they had hidden ground truth. Instead, it asks which components change observable behavior under controlled conditions and which uncertainties remain when the reference-free assumption is respected. The paper is organised as follows. Section 2 positions the study in relation to data-quality, cleaning, retrieval, provenance, and LLM-agent research. Sections 4 and 5 define the reference-free setting and the taxonomy of contextual knowledge, tools, evidence, and decision classes. Sections 6–8 present the framework, implementation, and metrics. Sections 9 and 10 report and interpret the ablation results, followed by threats to validity and the conclusion.

2

Background and Related Work

Research on data quality provides the conceptual basis for this study. Quality dimensions such as accuracy, completeness, consistency, timeliness, believability, and interpretability depend on the consumer, intended use, and represented real-world entities [1–3]. Broader methodologies organise assessment and improvement across dimensions, data types, techniques, and systems [4, 14]. Context-aware data-quality work further argues that assessment rules must be selected with respect to usage context and domain constraints [15, 16]. The CTXDQ model provides a computational interpretation of this view by representing contextual characteristics and matching them to relevant quality dimensions and assessment techniques [17]. These ideas motivate the explicit cleaning context used in this paper. Classical cleaning and repair systems show why reference-free cleaning cannot rely on natural-language reasoning alone. Profiling identifies distributions, types, missingness, duplicates, and dependencies [18]; duplicate and entityresolution methods require specialised matching logic [19]; and anomaly detection treats unusual observations as deviations from expectations, not automatically as errors [20]. Systems such as Potter’s Wheel and Wrangler emphasise interactive transformation and user feedback [21, 22], while NADEEF and constraint-based repair work formalise rule-driven detection and repair [23–25]. Probabilistic systems such as HoloClean and PClean incorporate uncertainty, signals, and domain knowledge [26, 27]. ActiveClean and related interactive approaches further show that human guidance remains important when cleaning choices affect downstream analysis [28]. Knowledge-based and retrieval-based approaches are especially relevant when table content is insufficient to interpret a value. KATARA uses knowledge bases and crowdsourcing to support cleaning decisions [29]; RetClean uses retrieval to support LLM-assisted cleaning [10]; and retrieval-augmented generation separates retrieved evidence from 2

A PREPRINT - AUGUST 18, 2026

generated output [30]. Work on attribution and fact verification motivates explicit checks that a cited source supports the generated claim [31, 32]. Provenance research further motivates recording why and where a decision originated, including data, rules, tools, and evidence [33–35]. Recent LLM and agent research extends these ideas with reasoning and tool use. ReAct and Toolformer show how language models can combine reasoning with external actions or tools [36, 37]. In data preparation, foundation models and LLM-based systems can wrangle tables, profile semantics, generate workflows, and standardise values [8, 11, 12, 38]. However, empirical studies also show sensitivity to prompts, domain context, and verification mechanisms [9, 13]. The gap addressed here is therefore not whether LLMs can propose cleaning actions, but how profiling, executable tools, evidence controls, and conservative repair policies affect cleaning decisions when no clean reference is available. Two implications follow from this literature. First, reference-free cleaning requires an explicit distinction between detecting a possible issue and modifying a value. Detection can be supported by profiling, constraints, and anomaly indicators, but repair requires stronger evidence because a value may be unusual and still valid. Second, evidence grounding must be operationalised rather than asserted. A system that retrieves a source or produces a citation is not necessarily source-grounded unless the final decision can be traced to evidence that is relevant, specific, current, and consistent with the proposed rule. These implications motivate the taxonomies, framework, and experimental design used in the present study.

3

Research Questions and Hypotheses

The study addresses five research questions: RQ1 asks how different baseline and agent configurations affect reference-free data-cleaning behavior; RQ2 asks which tool capabilities change cleaning decisions; RQ3 asks whether source-ranking and citation-alignment controls reduce unsupported rules or unsafe repairs; RQ4 asks whether a conservative repair policy improves valid-signal preservation and reduces unnecessary modification; and RQ5 asks what operational cost is introduced as additional agent capabilities are enabled. The corresponding hypotheses are that profiling and executable validation improve structural and syntactic issue detection (H1); source-ranking and citation-alignment controls reduce unsupported-rule behavior but may not guarantee strong citation support for every decision (H2); conservative repair policies reduce unsafe repairs and unnecessary modifications (H3); the full conservative evidence-grounded configuration shifts behavior toward more conservative and auditable decisions but may introduce trade-offs in detection, direct repair, runtime, and token cost (H4); and the relative effectiveness of agent configurations depends on dataset characteristics and cleaning requirements (H5).

4

Problem Definition

Let X denote the raw dataset. It may be accompanied by schema S, optional metadata M , sample records R, profiling summaries P , and optional documentation G. Following context-driven data-quality assessment, the dataset is associated with a structured cleaning context ΓX = ⟨Csrc , Cstr , Csem , Ctemp , Cuse , Crisk , Cpolicy , Cprov ⟩,

(1)

where the components represent source, structural, semantic, temporal, use, risk, policy, and provenance characteristics. In supervised evaluation, a clean reference table X ∗ may be available. In the reference-free setting considered here, however, X ∗ is unavailable. The agent must therefore infer cleaning requirements from the available decision context K = {X, S, M, R, P, G, ΓX , Eext , T }, (2) where Eext denotes retrieved evidence and T denotes tool outputs such as parsing, duplicate, unit, temporal, and consistency checks. The set K represents the information and outputs that may support a cleaning decision; it does not imply that every component is required in every cleaning task. In the completed experiment, retrieval used a controlled local evidence corpus rather than online retrieval. The agent produces cleaning decisions C = {c1 , c2 , . . . , cn },

(3)

ci = ⟨issuei , evidencei , requirementi , rulei , actioni , confidencei , provenancei ⟩.

(4)

with each decision represented as

The action belongs to A = {safe-repair, conditional-repair, flag-only, preserve, human-review, reject-repair}. 3

(5)

A PREPRINT - AUGUST 18, 2026

This notation separates the raw dataset X from the decision set C. A repair is permitted only when the evidence is sufficient, the rule is operationally checkable, the transformation is reversible, and the conservative cleaning policy is not violated. The formulation also separates a cleaning requirement from an applied transformation. A requirement may state that a timestamp should be parseable, a code should belong to a documented set, or a measurement should respect a unit convention, but the corresponding action may still be flagging or preservation when the evidence is incomplete. This separation is central to avoiding unsupported repair in the absence of X ∗ . The framework follows six principles: repairs should be evidence-grounded; rare or extreme values should not be modified solely because they are unusual; executable checks should be used where deterministic validation is more reliable than natural-language judgement; external sources should be ranked and aligned with the decisions they support; transformations should preserve provenance and reversibility; and the effects of added agent capabilities should be evaluated empirically rather than assumed beneficial.

5

Knowledge and Decision Taxonomies

The proposed framework uses five taxonomies to specify what the agent should produce, what contextual knowledge may support its decisions, which tools it can use, which evidence can support decisions, and which conservative action classes are available. These taxonomies synthesize prior work on multidimensional data quality, context-aware assessment, profiling, knowledge-based cleaning, retrieval, attribution, provenance, constraint-based repair, probabilistic cleaning, and anomaly detection. Data-quality and context-aware assessment work motivate the schema, semantic, usage, policy, and risk categories [1, 4]. Profiling and classical cleaning systems motivate tool-mediated detection outputs and executable checks [5, 6]. Knowledge-based and retrieval-based systems motivate the evidence taxonomy [29, 30], while attribution and provenance research motivate citation alignment and decision traceability [31, 33]. Constraint-based repair, probabilistic cleaning, and anomaly-detection research motivate the conservative distinction between repair, flagging, preservation, review, and rejection [20, 24, 26]. The aim is not to claim that every category is necessary or equally important for every dataset, but to make the knowledge, capabilities, evidence, and decision requirements of the framework explicit. 5.1

Taxonomy-to-Implementation Mapping

Table 1 summarizes how the taxonomy is operationalized in the reported ablation. This mapping is included to avoid overclaiming: some categories are directly measured, some are partly implemented through context and logging, and others define framework-level concepts or referral mechanisms rather than independently adjudicated experimental variables. Table 1: Mapping between taxonomy components and the reported experimental implementation. Taxonomy component

Framework role

Required outputs

Expose issues, requirements, rules, Logged in the output schema; A0–A6; checked through decisions, evidence, provenance, capability-specific fields are counts, repair metrics, scripts, and audit summaries. absent when not enabled. schema/JSON validity, reproducibility, and auditability. Provide schema, unit, temporal, Partly implemented through Context is available to policy, purpose, and risk context context profiles, different degrees across that may support repair decisions. schema/samples, profiling configurations, but individual summaries, and risk knowledge types are not descriptions; not separately evaluated independently. ablated by knowledge type. Delegate profiling, parsing, Implemented for A1 tests deterministic profiling/checking in A1 and profiling; A3–A6 test validation, temporal/constraint for executable executable checks and checks, and reversible scripts to reversible scripts; evaluated tools. validation/script generation from A3 onward. through detection, repair, execution, and operational metrics.

Prior knowledge

Tool capabilities

Implementation status

4

Configurations and evaluation

A PREPRINT - AUGUST 18, 2026

Taxonomy component

Framework role

Implementation status

Evidence and citation controls

Distinguish evidence types, rank sources, and align cited claims with decisions.

Controlled local evidence retrieval is used in A4; source-ranking and citation-alignment checks are used in A5–A6.

Decision classes and conservative policy

Convert suspected issues into repair, flagging, preservation, human review, or rejected repair.

Human review and expert adjudication

Provide a high-authority pathway for ambiguous or high-risk cases.

5.2

Configurations and evaluation

A4 tests evidence availability; A5–A6 test ranking/alignment; evaluated through evidence coverage, unsupported-rule rate, citation alignment, runtime, and token use. A5–A6 isolate conservative Decision labels are logged across configurations; explicit control; evaluated through repair/safety metrics, conservative policy and valid-signal preservation, provenance control are human-review rate, and enabled most fully in A6. reproducibility. Mainly visible in A6 Implemented only as a original-data behavior; referral/decision class; no reported descriptively through external expert adjudication referral rate and discussed as a of original-data cases was limitation/future-work need. performed.

Required-Output Taxonomy

The required-output taxonomy in Table 2 defines the artefacts that must be produced for an auditable cleaning decision. It separates candidate issues, requirements, rules, decisions, repairs, provenance, and escalation outputs so that a detected anomaly is not automatically treated as a repairable error. Table 2: Required outputs of the evidence-grounded cleaning agent. Output

Definition

Purpose

Issue inventory

Structured list of suspected quality issues, including affected columns, rows, entities, timestamps, and issue contexts. Classification of the issue, such as missing value, duplicate, invalid unit, impossible value, inconsistent category, temporal gap, entity mismatch, or suspicious anomaly. Dataset-derived or externally retrieved evidence used to support the issue or repair decision. A requirement inferred from schema, profiling, documentation, standards, or authoritative sources. A machine-checkable rule derived from a cleaning requirement. A suggested transformation, imputation, normalization, deletion, or correction. Final action category: safe repair, conditional repair, flag only, preserve, human review, or reject repair. Numeric or ordinal estimate of decision reliability based on evidence quality and rule support. Record of prompt context, source, tool output, rule, affected records, and transformation. Script that applies approved transformations while preserving original values. Human-readable summary of issues, decisions, repairs, rejected repairs, evidence quality, and remaining uncertainties.

Identifies what may be wrong.

Issue type

Evidence record Cleaning requirement Validation rule Repair proposal Decision class Confidence and evidence strength Provenance log Reversible script Audit report

Supports systematic analysis. Reduces hallucinated cleaning. Defines what the data should satisfy. Enables repeatable validation. Generates candidate repairs when safe. Prevents over-cleaning. Supports prioritization. Ensures auditability. Enables rollback and review. Supports scientific reporting.

These outputs support auditability. A reviewer, data owner, or downstream analyst should be able to see what issue was detected, what requirement was inferred, which evidence supported it, what action was chosen, and whether any 5

A PREPRINT - AUGUST 18, 2026

value was changed. The taxonomy therefore treats provenance and escalation as first-class outputs rather than optional metadata.

5.3

Prior-Knowledge Taxonomy

The prior-knowledge taxonomy in Table 3 identifies contextual information that may support the interpretation of a dataset before repair decisions are made. It includes schema, semantic, temporal, entity, risk, policy, and provenance knowledge because reference-free decisions may depend on both data-derived patterns and external interpretation. The current experiment does not evaluate these knowledge categories independently.

Table 3: Taxonomy of prior knowledge required by an autonomous cleaning agent. Knowledge Type

Definition

Domain-Independent Example

Schema knowledge

Column names, data types, key fields, expected structural constraints, and valid formats.

Unit and scale knowledge

Meaning, unit, scale, and compatibility of measured values.

Temporal knowledge

Expected frequency, ordering, allowable time gaps, duplicate timestamps, and continuity constraints. Entities represented in the dataset and valid relationships among them.

Identifier fields, timestamps, categorical codes, numeric measures. Currency units, medical units, sensor units, percentages, rates. Hourly readings, admission/discharge dates, transaction sequences. Patient ID, station ID, customer ID, product ID, location ID. Valid age range, sensor range, maximum transaction amount. Maintenance event, market shock, public-health event, environmental event. “NA”, “unknown”, below-detection values, empty codes. End date follows start date; total equals sum of parts. Do not modify high-impact values without evidence. Official documentation preferred over unsupported web pages. Preserve anomalies for anomaly detection; normalize for reporting. Clinical, financial, safety, regulatory, or scientific impact.

Entity knowledge Domain-threshold knowledge

Expected ranges, warning limits, legal limits, operational thresholds, or plausible bounds.

Contextual-event knowledge

External events or domain conditions that may explain unusual values.

Missingness knowledge

Meaning of nulls, placeholders, censored values, unavailable observations, and not-applicable values. Functional, relational, temporal, arithmetic, or semantic constraints that should hold. Rules defining when to repair, flag, preserve, or escalate. Authority, date, source type, citation alignment, and source reliability.

Constraint knowledge Cleaning-policy knowledge Evidence-provenance knowledge Task-purpose knowledge Risk knowledge

Intended downstream use of the data, including whether cleaning is for reporting, modeling, compliance, or exploration. Consequences of false repair, false preservation, deletion, or imputation.

This taxonomy is deliberately broader than schema metadata because many cleaning decisions may depend on semantic, temporal, or policy context. For example, a radiation spike, clinical measurement, or financial transaction cannot always be judged safely from column names alone. Interpreting such values may require information about how the data were produced, how they are used, and what risks are associated with an incorrect repair or a missed issue. 6

A PREPRINT - AUGUST 18, 2026

5.4

Tool-Capability Taxonomy

The tool-capability taxonomy in Table 4 distinguishes computations that should be delegated to deterministic or executable tools from judgements that require evidence-aware reasoning. Tool outputs are treated as evidence records rather than as unverified suggestions. Table 4: Tool-capability taxonomy for evidence-grounded data cleaning. Tool Class

Function

Example Output

Profiling tools

Summarize types, missingness, uniqueness, distributions, outliers, patterns, and correlations. Validate dates, numbers, codes, units, regular expressions, and encodings. Detect exact duplicates, near duplicates, and possible entity conflicts. Check ordering, gaps, repeated timestamps, rolling statistics, and frequency expectations. Execute functional, arithmetic, relational, and semantic constraints. Validate unit compatibility and perform documented conversions. Retrieve supporting evidence from a controlled evidence collection; online evidence retrieval can be used in future replications when source volatility and reproducibility are explicitly controlled. Score retrieved sources by authority, relevance, recency, specificity, and consistency. Check whether a cited statement supports a generated requirement or repair. Generate reversible cleaning scripts and execution logs. Run generated validation or repair scripts in a controlled environment and capture errors, modified records, rollback information, and execution status.

Missingness rate, duplicate count, value ranges. Invalid timestamp list.

Parsing and type tools Duplicate and entity-resolution tools Temporal validation tools Constraint-checking tools Unit and conversion tools Controlled evidence-retrieval tools Source-ranking tools Citation-alignment tools Script-generation tools Script-execution tools

Candidate duplicate clusters. Gap intervals and repeated measurements. Rule violation table. Converted values with original unit preserved. Candidate evidence sources. Ranked evidence list. Supported, partially supported, unsupported. Python or SQL transformation script. Execution log, error trace, affected-row count, rollback file.

The taxonomy assigns tools to verification roles rather than treating the LLM as the sole decision-maker. Deterministic checks are appropriate for parsing, type validation, duplicate detection, and script execution, while the agent is responsible for interpreting those outputs with respect to domain context and repair risk. 5.5

Evidence Taxonomy

For evidence item e, the framework represents evidence strength as ES(e) = αA(e) + βR(e) + γSp(e) + δC(e) + ηT (e),

(6)

where A(e) denotes source authority, R(e) relevance to the cleaning decision, Sp(e) specificity, C(e) consistency with other available evidence, and T (e) temporal validity. The coefficients α, β, γ, δ, and η represent the relative importance assigned to these dimensions. The formulation provides a structured way to compare evidence sources; it is not intended as a universal evidence-quality model. Table 5: Evidence taxonomy for cleaning decisions. Evidence Type

Definition

Typical Strength

Schema evidence

Evidence from names, declared types, primary keys, foreign keys, and constraints. Evidence from distributions, missingness, duplicates, type errors, and statistical summaries.

Medium to high.

Profile evidence

7

Medium; weaker for semantic repair.

A PREPRINT - AUGUST 18, 2026

Evidence Type

Definition

Typical Strength

Executable evidence

Evidence from deterministic validation, parsing, rule execution, and reproducible checks. Official metadata, data dictionary, README, or provider documentation. Government, standards body, organizational documentation, or domain authority. Peer-reviewed source providing domain thresholds, measurement interpretation, or methods. Device, software, or system manual explaining units, codes, or valid ranges.

High for syntactic and structural issues. High when specific and current. High when directly relevant. Medium to high depending on specificity. High for instrumentation-specific rules. Low; should not justify high-impact repairs alone. High, but may be subjective and should be logged.

Dataset documentation Institutional or regulatory source Scientific literature Technical manual General web source

Blog, forum, or unverified page.

Human expert review

Domain expert judgment or adjudication.

The evidence-strength equation is not intended as a universal scoring formula. It defines the dimensions that should be logged and made explicit when a decision depends on evidence. Different domains may weight the dimensions differently; for example, clinical and regulatory settings may require stronger authority and specificity than exploratory data analysis. 5.6

Cleaning Decision Taxonomy

The decision classes in Table 6 are defined by evidence sufficiency and repair risk. This taxonomy is the main bridge between the conceptual problem and the executable experiment: it determines whether a candidate issue becomes a repair, a flag, a preservation decision, a human-review referral, or a rejected repair proposal. Because no reference value is available, the taxonomy gives the agent conservative alternatives to modification: flagging, preserving possible valid signals, escalating to human review, or rejecting unsupported repair. Table 6: Cleaning decision classes used by the proposed framework. Decision Class

Definition

Example

Safe repair

The issue is clearly erroneous and the correction is directly supported by rules, documentation, executable checks, or strong evidence. A repair is plausible but depends on an explicit documented assumption. The value is suspicious but evidence is insufficient for modification. The value is unusual but may represent a meaningful rare event or domain signal. The issue is high-risk, ambiguous, or unresolved by available evidence. A repair proposal lacks sufficient support or violates policy.

Standardizing timestamp format; replacing documented placeholder codes with null.

Conditional repair Flag only Preserve as possible valid signal Needs human review Reject unsupported repair

6

Converting units when the source unit is strongly inferred but not directly stated. Sudden spike, unusual transaction, or unexpected sensor value. Rare clinical result, extreme environmental reading, valid financial shock. Conflicting evidence or uncertain domain interpretation. Replacing an outlier only because it is statistically extreme.

Methodology: Evidence-Grounded Agentic Cleaning Framework

The framework translates the problem definition into a multi-stage process: issue detection, evidence acquisition, requirement generation, rule construction, decision classification, reversible repair execution, and provenance logging. The process begins with the raw dataset, schema, metadata, and sample records. Profiling derives structural and statistical summaries; the issue detector identifies candidate quality problems; and the agent planner decides whether 8

A PREPRINT - AUGUST 18, 2026

internal evidence is sufficient or whether additional tool use or controlled evidence retrieval is required. Figure 1 summarises the architecture.

Figure 1: Architecture of the evidence-grounded agentic data-cleaning framework. 9

A PREPRINT - AUGUST 18, 2026

The framework distinguishes dataset-derived evidence from retrieved evidence. Dataset-derived evidence includes schema constraints, profiling summaries, missingness, duplicates, temporal behavior, distributions, and executable validation results. Retrieved evidence includes documentation, standards, manuals, domain references, or other configured sources. Both forms of evidence can support the requirements and rules used to evaluate candidate cleaning decisions. The agent workflow has five steps. First, it constructs ΓX and profiles the dataset. Second, it proposes candidate issues and identifies the contextual knowledge relevant to their interpretation. Third, it invokes tools for deterministic checks where applicable. Fourth, it creates evidence-backed requirements and rules, with evidence assessed according to authority, relevance, specificity, consistency, and temporal validity. Fifth, it classifies each decision into the conservative action set and generates reversible scripts only when the policy allows repair. All decisions record provenance, including evidence identifiers, rule text, tool outputs, and the original value. The conservative repair policy acts as a control layer over candidate transformations. A decision may be classified as safe repair only when the candidate issue is clear, the rule is supported by available evidence, and the transformation can be reversed. When evidence is partial, conflicting, or high risk, the policy favours conditional repair, flagging, preservation, human review, or rejection of unsupported repair. This approach may reduce direct repair because uncertain cases can be preserved or escalated instead of being modified automatically. The framework also separates planning from execution. The agent may propose a requirement or rule, but executable checks and reversible scripts determine whether the proposal can be operationalised. This reduces reliance on fluent natural-language explanations when deterministic validation is available. In the same way, evidence records are not treated as decorations for the report; they are intended to be linked to requirements and actions so that reviewers can distinguish supported repairs from unsupported or ambiguous suggestions. When a repair is executed, the framework uses reversible scripts that preserve original values and produce logs that can be inspected after execution. This separates the agent’s recommendation from the deterministic effect of the generated transformation and supports auditability and reproducibility.

7

Experimental Design and Implementation

The exploratory experiment evaluates seven configurations across three datasets and two run modes. A0 and A1 serve as comparison baselines, while A2–A6 form the progressive LLM-based ablation. Three repeated runs were performed for each dataset–mode–configuration combination, resulting in 126 completed runs. The datasets represent financial decision support [39], clinical records [40], and environmental radiation monitoring [41]. Each dataset was supplied with a context profile describing its domain, operational setting, schema, risk level, and relevant cleaning context. Table 7 summarises the dataset roles.

Table 7: Datasets and context profiles used in the experimental study. Dataset

Domain

Cleaning Context

Main Context Requirements

German Credit

Finance

EHR

Healthcare

Financial decision support and credit-risk interpretation. Clinical data-quality assessment.

Radiation

Environmental monitoring / IoT

Schema and categorical-code interpretation, plausible financial ranges, sensitive attributes, target-label protection, and conservative handling of unusual but valid credit profiles. Patient/entity consistency, clinical attribute validation, missingness interpretation, categorical consistency, high-risk repair control, and human-review escalation. Timestamp parsing, temporal gaps, duplicate measurements, unit and scale interpretation, sensor anomalies, battery/status fields, and preservation of plausible radiation spikes.

Sensor monitoring and anomaly detection.

The controlled synthetic-corruption mode injects known errors and plausible valid-signal cases, allowing detection, repair, and preservation metrics to be computed against ground truth. The original-data mode applies the same configurations to the unmodified datasets. Because the original datasets do not have a trusted clean reference or manual adjudication in the verified outputs, original-data results are descriptive only. Table 8 summarises the corruption and valid-signal protocol. 10

A PREPRINT - AUGUST 18, 2026

Table 8: Synthetic corruption and valid-signal protocol used in the completed experiment. Counts are per dataset and repeated run; the same ground-truth file for a given dataset and run was used across all A0–A6 configurations. Dataset

Missing value

Type error

Range violation

Invalid category

Invalid timestamp

Duplicate row

Entity duplicate

Missing identifier

Injected errors

Valid signals

Total records

10 10 10

5 5 5

5 5 5

5 5 0

0 0 5

5 5 5

0 2 0

0 1 0

30 33 30

5 5 5

35 38 35

German Credit EHR Radiation

The experiment uses two comparison baselines followed by a progressive capability ablation. A0 is a schema-andsample LLM baseline without profiling, executable tools, evidence retrieval, or conservative repair controls. A1 is a deterministic profiling-and-checking baseline and does not use an LLM. A2 combines profiling summaries with LLM reasoning and serves as the starting point of the progressive LLM-based sequence. A3 adds executable Python checks and reversible-script generation, A4 adds controlled evidence retrieval, A5 adds source ranking and citation-alignment checks, and A6 adds the conservative repair policy. A0 and A1 should therefore be interpreted as contrasting baselines rather than consecutive steps of a single-factor ablation. The more direct capability comparisons are A2 to A3 for executable tools, A3 to A4 for evidence retrieval, A4 to A5 for source-ranking and citation-alignment controls, and A5 to A6 for the conservative repair policy. The LLM-based configurations used OpenRouter with openai/gpt-oss-20b, while A1 was deterministic and did not use an LLM. The temperature was fixed at 0.2 and the maximum output length at 3000 tokens. The prompt context included the dataset schema, metadata, context profile, up to 10 sample records, and the profiling, tool, or evidence information enabled for each configuration. Model settings, retry logic, output constraints, and postprocessing were kept fixed across all LLM-based configurations. The output followed a fixed JSON schema containing candidate issues, requirements, validation rules, decisions, evidence references, provenance information, and audit indicators. This common schema made outputs comparable across configurations and allowed systematic postprocessing without manually interpreting free-form responses. When a response was malformed, the saved postprocessing pipeline applied schema normalization or JSON repair where needed, and these events were retained in the execution audit. The experiment was not rerun after analysis, and all reported results were computed from the saved postprocessed artifacts. Table 9: Controlled local evidence corpus used in the completed experiment. Corpus file

Records

common.jsonl

2

german_credit.jsonl

5

ehr_dataset.jsonl

5

radiation_dataset.jsonl

5

Total

17

Main contents Reference-free cleaning policy and provenance/reversibility policy shared across datasets. German Credit dataset card, UCI documentation metadata, financial-domain cleaning policy, valid ranges, and valid-signal preservation policy. EHR dataset card, Kaggle documentation metadata, clinical safety policy, identifier policy, and categorical-value policy. Radiation dataset card, radiation-monitoring context, anomaly-preservation policy, sensor validity checks, and temporal-consistency policy. Fixed project-local evidence records used by A4–A6 in the reported experiment.

For A5 and A6, retrieved evidence was ranked using the evidence-strength formulation introduced in Section 5. The implemented weights were 0.30 for authority, 0.25 for relevance, 0.20 for specificity, 0.15 for consistency, and 0.10 for temporal validity. These weights were fixed for all source-ranked runs and were used as an operational ranking heuristic rather than as a universally validated evidence-quality model. In the controlled local corpus, consistency was not separately annotated and therefore used a fixed value of 0.7 for all evidence records. Consequently, the consistency component did not differentiate evidence sources in the reported experiment.

8

Evaluation Protocol

The evaluation separates detection and repair effectiveness, safety, evidence grounding, operational cost, and reproducibility. Synthetic-corruption runs support detection, repair, and valid-signal preservation metrics because injected 11

A PREPRINT - AUGUST 18, 2026

ground truth is available. Original-data runs are interpreted descriptively because no trusted clean reference or manual adjudication is available. Execution indicators such as retries, JSON repair, schema normalization, and reversiblescript execution are reported separately as an audit and are not treated as measures of cleaning effectiveness. Table 10: Evaluation metrics for reference-free evidence-grounded cleaning. Metric Group

Metric

Definition

Detection

Precision

Detection

Recall

Detection Repair

F1-score Expected-repair match rate

Repair

Safe repair rate

Repair

Unsafe repair rate

Repair

Unnecessary modification rate Evidence coverage

In the controlled synthetic-corruption setting, the fraction of detected issues that match injected error ground truth. Original-data precision is not interpreted because no injected or manually validated ground truth is available. In the controlled synthetic-corruption setting, the fraction of injected errors detected by the agent. Original-data recall is not interpreted because no ground-truth error set is available. Harmonic mean of synthetic detection precision and recall. Among repair decisions matched to injected errors for which repair is expected, the fraction whose proposed repair contains the known expected correction. Fraction of repair-class decisions that match synthetic ground-truth cases for which repair is appropriate, excluding repairs applied to valid-signal or non-repair cases and repairs with no matching ground-truth issue. Fraction of repair-class decisions applied to synthetic cases marked as valid signals or cases whose expected action is preservation, flagging, or human review. Fraction of repair-class decisions whose associated issue does not match any synthetic ground-truth case. Fraction of decisions that reference at least one evidence record available in the agent output. Mean evidence-strength value across the evidence records available in the agent output, including profiling, tool, and controlled retrieved evidence. Fraction of generated validation rules that do not reference available evidence. Mean, across decisions, of the maximum Jaccard similarity between the decision text and its cited evidence statements, reported for configurations with citation-alignment checks enabled. Fraction of decisions classified as flag-only, preserve, human-review, or reject-repair. Among injected valid-signal cases detected as issues, the fraction assigned to preserve, flag-only, or human-review rather than repair. Fraction of decisions escalated for human review. Per-run execution time recorded in seconds and aggregated by dataset, mode, and configuration. Prompt, completion, and total token usage recorded for LLM-based runs. Pairwise exact agreement across repeated runs of decision signatures constructed from issue identifiers and their assigned decision classes within each dataset–mode–configuration group.

Evidence Evidence

Mean evidence-strength score

Evidence

Unsupported-rule rate

Evidence

Citation alignment

Safety

Conservative flag rate

Safety

Valid-signal preservation rate

Safety Operational

Human-review referral rate Runtime

Operational

Token use

Operational

Reproducibility

Table 11 summarises the roles and limitations of A0–A6. A0 and A1 provide contrasting LLM and deterministic baselines and are not treated as a single-factor ablation. A2 provides the profiling-aware LLM starting point for the progressive capability analysis. The more direct comparisons are A2 versus A3 for executable Python validation, A3 12

A PREPRINT - AUGUST 18, 2026

versus A4 for controlled evidence retrieval, A4 versus A5 for source ranking and citation alignment, and A5 versus A6 for the conservative repair policy. Table 11: Comparison baselines and progressive ablation configurations. Configuration

Implemented description

Expected limitation

May hallucinate requirements, miss data-derived patterns, or overinterpret values without profiling and executable evidence. A1: Deterministic Deterministic profiling, missingness analysis, duplicate Can detect profiling-and-checking detection, type inference, range checks, and provenance structural/statistical patterns baseline logging; no LLM call, retrieval, ranking/alignment, efficiently, but may treat conservative policy, or reversible scripts. statistical anomalies as errors without semantic, contextual, or conservative reasoning. A2: LLM with profiling LLM reasoning over profiling summaries with provenance May support explanation and summaries logging; no executable Python validation, retrieval, contextual reasoning, but still ranking/alignment, conservative policy, or reversible scripts. lacks executable validation and retrieved evidence support. A3: LLM with profiling and Adds executable Python checks for validation, parsing, Can validate candidate issues Python tools duplicates, consistency, reversible-script generation, and through executable checks, provenance logging; no retrieval, ranking/alignment, or but may still decide without conservative policy. retrieved contextual evidence or source-ranking controls. A4: Local-corpus Adds retrieval from the controlled local evidence corpus Makes evidence records evidence-retrieval while keeping profiling, Python tools, reversible scripts, and available, but retrieved configuration provenance logging; no source ranking or citation-alignment evidence may not be strictly checks. ranked, filtered, or aligned with final decisions. A5: Source-ranked evidence Adds source ranking, filtering, evidence extraction, and Can reduce unsupported-rule configuration citation-alignment checks on top of A4; the full conservative behavior through evidence repair policy is not enabled. controls, but citation alignment may remain weak and repair behavior may still be insufficiently conservative. A6: Full conservative Adds the conservative repair policy on top of A5 while More expensive and may flag, evidence-grounded retaining profiling, executable tools, controlled evidence preserve, refer, or reject configuration retrieval, source ranking, citation alignment, reversibility, uncertain cases instead of and provenance logging. performing direct repair; not expected to dominate all simpler configurations.

A0: Schema-only LLM baseline

LLM with schema and sample records only; no profiling summaries, executable checks, evidence retrieval, ranking/alignment, conservative policy, reversibility, or provenance logging.

No p-values, confidence intervals, or statistical significance tests are reported because they were not part of the completed analysis. The evaluation therefore focuses on observed means, execution-audit indicators, and exact reproducibility across repeated runs. The hypotheses are interpreted using the observed directional patterns rather than statistical significance. Original-data results are kept separate from the controlled synthetic evaluation because originaldata issues may represent true errors, unusual but valid values, or undocumented conventions and cannot be scored as correct or incorrect without independent adjudication.

9

Results

The results are organised around execution validity, synthetic-corruption performance, original-data descriptive behavior, evidence grounding, safety, operational cost, and reproducibility. They should be read as observed configuration trade-offs in the completed exploratory ablation. Synthetic-corruption results use injected ground truth and can support detection, repair, and valid-signal preservation metrics. Original-data results are descriptive because no trusted clean reference or manual adjudication exists. 13

A PREPRINT - AUGUST 18, 2026

The experiment produced the expected 126 successful runs, with no final failed runs. Table 12 shows that JSON repair was used in 30 runs, postprocessing changed 31 saved outputs, and all 126 final outputs were schema-valid after normalization. These are implementation and reproducibility facts; no agent was rerun and no new cleaning decisions were introduced during postprocessing. Table 12: Experiment completion and postprocessing audit. Audit item

Verified value

Expected design Rows in final run-level metrics Rows in final aggregate metrics Successful final runs Failed final runs Runs requiring retry before success Runs with JSON repair used Outputs changed by postprocessing Schema-invalid outputs before normalization Schema-invalid outputs after normalization Final schema-valid outputs Successful reversible-script executions

3 × 2 × 7 × 3 = 126 runs 126 42 126 0 4 30 31 25 0 126/126 72/72

Tables 13 and 14 report the controlled synthetic-corruption results, while Figure 2 provides a direct comparison of detection F1-score across configurations. A1, the deterministic profiling-and-checking baseline, achieved the highest detection F1-score at 0.561, with precision 0.687 and recall 0.484. Among the LLM-based configurations, A6 achieved the highest F1-score at 0.421, while A4 achieved the highest precision at 0.928. A0 performed poorly, with an F1-score of 0.013. Within the progressive LLM-based sequence, adding executable tools increased F1-score from 0.307 in A2 to 0.402 in A3. This pattern is consistent with H1, while the later configurations show that adding more capabilities does not consistently improve detection performance. Table 13: Controlled synthetic-corruption detection and repair metrics by configuration. Config.

Configuration

Issues

Decisions

Prec.

Rec.

F1

Repair match

Safe repair

A0 A1 A2 A3 A4 A5 A6

Schema-only Profiling/checks LLM + profiling Python tools Python + controlled evidence Source-ranked evidence Full conservative

3.222 22.556 9.444 10.111 11.222 12.667 12.778

3.222 22.556 6.111 5.333 7.000 4.667 3.444

0.074 0.687 0.727 0.884 0.928 0.804 0.885

0.007 0.484 0.200 0.267 0.277 0.264 0.302

0.013 0.561 0.307 0.402 0.407 0.376 0.421

0.000 0.000 0.000 0.028 0.000 0.000 0.000

0.000 0.770 0.000 0.444 0.556 0.222 0.000

Synthetic detection F1-score

0.6

0.561

0.402

0.407

A3 Configuration

A4

0.4

0.421 0.376

0.307

0.2

0.013

0 A0

A1

A2

A5

A6

Figure 2: Synthetic detection F1-score across the seven evaluated configurations. A0 and A1 are comparison baselines, while A2–A6 represent the progressive LLM-based capability sequence. 14

A PREPRINT - AUGUST 18, 2026

Table 14: Controlled synthetic-corruption safety and valid-signal metrics by configuration. Config.

Configuration

A0 A1 A2 A3 A4 A5 A6

Schema-only Profiling/checks LLM + profiling Python tools Python + controlled evidence Source-ranked evidence Full conservative

Unsafe repair

Unnecessary modification

Valid-signal preservation

0.000 0.064 0.000 0.000 0.000 0.000 0.000

0.222 0.167 0.111 0.000 0.000 0.000 0.000

0.000 1.000 0.556 0.000 0.000 0.000 0.000

A zero valid-signal preservation rate should be interpreted with care because the metric is defined only over injected valid-signal cases that were detected as issues. A value of zero may therefore also occur when no injected valid-signal case was detected. The repair and safety metrics require joint interpretation. A1 achieved the highest safe-repair rate at 0.770 and the highest valid-signal preservation rate at 1.000, but it also produced unsafe repairs and unnecessary modifications. The high safe-repair rate does not mean that the proposed corrections were accurate: its repair-match rate was 0.000. In fact, only A3 achieved a non-zero repair-match rate, at 0.028, showing that successful direct correction remained very limited across all configurations. A6 produced no unsafe or unnecessary modifications in the synthetic summary, but it also produced no repair-class decisions and therefore had zero safe repair and zero repair match. Its behavior is better interpreted as conservative non-repair rather than successful direct repair. These results show a clear trade-off between attempting repair and avoiding inappropriate modification. At dataset level, averaged over configurations and repetitions, EHR achieved the highest synthetic detection F1-score at 0.405, followed by German Credit at 0.380 and Radiation at 0.280. These differences are consistent with H5, showing that the relative effectiveness of the evaluated configurations varies across datasets. The current experiment does not isolate which specific dataset characteristics caused these differences. Original-data results are shown in Tables 15 and 16. These values describe agent behavior, not accuracy. A1 produced the largest mean number of issues and decisions, 10.000 for both, while A5 produced the fewest decisions, 2.222. A6 had evidence coverage of 0.556 and a human-review rate of 0.111 in the original-data summary, but it also had the highest original-data runtime and token consumption. Table 15: Original-data descriptive behavior and evidence indicators by configuration. Values are means over nine original-data runs per configuration: three datasets and three repeated runs. Config.

Configuration

Issues

Decisions

Evidence cov.

Unsupported rules

Conserv. flag

Human review

A0 A1 A2 A3 A4 A5 A6

Schema-only Profiling/checks LLM + profiling Python tools Python + controlled evidence Source-ranked evidence Full conservative

3.778 10.000 5.222 3.556 6.444 4.000 3.778

3.778 10.000 2.667 3.556 3.111 2.222 3.000

0.089 0.627 0.236 0.548 0.469 0.356 0.556

0.667 0.040 0.167 0.074 0.028 0.111 0.037

0.653 0.453 0.444 0.644 0.542 0.444 0.556

0.093 0.000 0.111 0.000 0.000 0.022 0.111

Table 16: Original-data operational cost and structured-output repair by configuration. Values are means over nine original-data runs per configuration. Config.

Configuration

A0 A1 A2 A3 A4 A5 A6

Schema-only Profiling/checks LLM + profiling Python tools Python + controlled evidence Source-ranked evidence Full conservative

15

Runtime (s)

Total tokens

JSON repair

25.209 0.081 52.616 61.958 43.521 34.356 138.938

4841.444 0.000 9346.222 9392.444 9918.111 10132.889 14803.000

0.222 0.000 0.556 0.111 0.333 0.222 0.333

A PREPRINT - AUGUST 18, 2026

Evidence metrics show partial but limited grounding. In synthetic runs, evidence coverage was 0.870 for A1, 0.778 for A4, and 0.722 for A2. A5 and A6 had lower evidence coverage, at 0.630 and 0.519, but achieved the lowest unsupported-rule rates, both at 0.037. Citation alignment was non-zero only for the configurations with citationalignment checks enabled, reaching 0.036 for A5 and 0.041 for A6. These low values show that retrieving, ranking, and recording evidence did not result in strong decision-level citation alignment. The results therefore distinguish evidence availability and rule support from direct alignment between cited evidence and individual cleaning decisions. Operational cost varied across configurations. A1 was the fastest because it used deterministic profiling and no LLM calls. Among the LLM-based configurations, token use generally increased as additional capabilities were enabled, while runtime did not increase monotonically. Across all runs, A6 had the highest mean runtime and token use, at 77.466 seconds and 12916.222 tokens. In original-data runs, A6 reached 138.938 seconds and 14803.000 tokens. Reproducibility, measured as exact agreement of decision signatures, was highest for A1 at 0.500, followed by A5 and A6 at 0.444. Because this metric requires exact agreement of issue identifiers and decision classes, it may count semantically similar outputs as different. Figure 3 visualises the configuration-level trade-off between synthetic detection performance and mean runtime across all runs. Comparison baselines

Progressive LLM sequence

Synthetic detection F1-score

0.6 A1

0.4

A6

A4

A3

A5 A2

0.2

0

A0

0

10

20

30 40 50 Mean runtime across all runs (s)

60

70

80

Figure 3: Configuration-level trade-off between synthetic detection performance and mean runtime across all 18 runs per configuration. Filled squares denote the comparison baselines, while open circles denote the progressive LLMbased sequence. Four runs required a second attempt before success, but all completed successfully. Structured-output enforcement was needed for consistent metric computation, as reflected by the JSON repair and postprocessing counts in Table 12. No separate qualitative case analysis was performed, so qualitative interpretation is limited to patterns recorded in the saved run artifacts and metrics.

10

Discussion

The results highlight a central characteristic of reference-free agentic data cleaning: adding capabilities changes different aspects of system behaviour, but does not lead to a monotonic improvement in overall cleaning performance. The strongest synthetic detection result was obtained by A1, the deterministic profiling-and-checking baseline, rather than by the most complete LLM configuration. At the same time, the schema-only LLM baseline A0 performed poorly, while incorporating profiling information in A2 substantially improved detection behaviour. This suggests that structured, data-derived evidence plays an important role in effective cleaning decisions and that LLM reasoning alone is not sufficient. However, because A0 and A1 differ in both reasoning mechanism and available capabilities, their difference should not be interpreted as a single-factor causal effect. Within the progressive LLM sequence, the clearest capability-level improvement appeared when executable tools were introduced. Moving from A2 to A3 increased synthetic detection F1-score from 0.307 to 0.402, and the generated reversible scripts were successfully executed. Even so, the repair-match rate remained only 0.028. Tool access therefore improved the agent’s ability to validate suspected problems without resolving the more difficult question of what the correct replacement value should be. This distinction is important in reference-free cleaning because identifying that a value may be problematic and determining how it should be repaired are separate tasks that require different levels of evidence. These observations are directionally consistent with H1 and help answer RQ1 and RQ2. 16

A PREPRINT - AUGUST 18, 2026

The evidence-related configurations show a similar distinction between having evidence available and actually grounding decisions in that evidence. A5 and A6 achieved the lowest synthetic unsupported-rule rates, both at 0.037, suggesting that source-ranking and citation controls were associated with better-supported validation rules. Their decisionlevel citation-alignment scores, however, remained very low at 0.036 and 0.041. The controlled local corpus improved reproducibility by keeping the available evidence fixed across runs, but retrieval, ranking, and provenance logging did not ensure that the evidence cited for a decision directly supported that decision. Evidence retrieval should therefore not be treated as equivalent to evidence grounding. In its current form, the system is better characterised as evidence-controlled and provenance-aware than as a mature citation-grounded autonomous repair system. Stronger decision-level alignment and independent validation of supporting evidence would be needed before such mechanisms could justify autonomous high-impact repairs. These findings address RQ3 and are consistent with H2. The conservative policy introduced in A6 produced another important trade-off. A6 made no unsafe or unnecessary modifications in the synthetic evaluation, but A5 had already achieved zero on both indicators before the conservative policy was added. The A5–A6 comparison therefore does not provide clear support for H3 on these two safety measures. The more noticeable effect of A6 was behavioural: it shifted the system toward abstention and escalation, producing no repair-class decisions in the synthetic setting and referring some original-data cases for human review. This behaviour is broadly consistent with H4 and addresses RQ4, but it is better interpreted as conservative non-repair than as improved repair effectiveness. In applications where an incorrect modification may be more harmful than leaving an anomaly unresolved, this type of behaviour may still be desirable. These additional controls also came with operational costs. A6 had the highest overall runtime and token consumption, whereas the deterministic A1 baseline was considerably less expensive because it required no LLM inference. Runtime did not increase monotonically across the intermediate LLM configurations, indicating that cost depends not only on how many capabilities are enabled but also on inference behaviour, retrieval, and tool execution. The results for RQ5 reinforce the multi-objective nature of reference-free cleaning: detection effectiveness, repair accuracy, evidence support, safety, reproducibility, and operational cost cannot be optimised independently. Simpler configurations may be sufficient for exploratory detection, whereas stronger evidence controls and conservative decision policies may be more appropriate when the consequences of an incorrect repair are greater. The dataset-level results also suggest that configuration effectiveness depends on data characteristics and cleaning context. Mean synthetic detection F1-score was highest for EHR at 0.405, followed by German Credit at 0.380 and Radiation at 0.280, which is directionally consistent with H5. The experiment does not isolate the causes of these differences. Temporal patterns and rare events, for example, may contribute to the lower Radiation results, while the prompt sample of up to 10 records may provide insufficient information for longer temporal patterns, rare environmental events, or entity-level relationships. These explanations remain hypotheses and would require targeted experiments before they could be attributed to specific dataset properties. The original-data runs provide a complementary view of system behaviour, but they should not be interpreted as an accuracy evaluation. Without a trusted clean reference or independent adjudication, these runs show how the configurations detect issues, use evidence, make conservative decisions, escalate cases, and consume resources rather than whether the resulting decisions are objectively correct. Keeping this distinction between controlled synthetic evaluation and original-data behavioural auditing is important for avoiding unsupported accuracy claims in a referencefree setting. Taken together, the hypotheses receive different levels of directional support. The A2–A3 improvement is consistent with the executable-validation component of H1, while the lower unsupported-rule rates of the source-ranked configurations, together with weak citation alignment, are consistent with H2. H3 is not clearly supported by the A5–A6 comparison because A5 already had zero unsafe and unnecessary modifications before the conservative policy was introduced. H4 is broadly consistent with the more conservative behaviour of A6 and its associated trade-offs in direct repair and operational cost. Finally, the differences across datasets are consistent with H5, although the specific dataset characteristics responsible for those differences were not isolated. Overall, the findings suggest that agentic data-cleaning systems are better viewed as combinations of separately evaluable capabilities than as monolithic agents whose performance is expected to improve simply by adding more reasoning, retrieval, or tools. Profiling, executable validation, evidence controls, conservative decision policies, and abstention affected different aspects of behaviour, and no configuration dominated across detection, repair, safety, evidence grounding, reproducibility, and operational cost. Capability composition should therefore be selected according to the cleaning objective, the evidence available, and the consequences of an incorrect modification. The main contribution of this study is an auditable framework and evaluation methodology for examining these trade-offs, rather than a claim that an autonomous agent can safely clean arbitrary datasets without expert oversight.

17

A PREPRINT - AUGUST 18, 2026

11

Threats to Validity

The findings should be interpreted in light of several threats to validity that reflect the exploratory ablation design, the reference-free setting, and the controlled implementation choices used in the experiment. • Construct validity. The metrics are operational approximations of safe reference-free cleaning and do not capture every downstream use of a cleaned dataset. Synthetic precision, recall, F1-score, expected-repair match, and valid-signal preservation are meaningful only when injected ground truth is available. Original-data metrics describe behavior, evidence use, cost, and reproducibility, not accuracy. Safe repair is also context-dependent: a transformation may be acceptable for reporting but unsafe for anomaly detection, auditing, or forensic analysis. In addition, the individual knowledge categories defined in the taxonomy were not independently ablated, so the experiment cannot determine whether any single category is necessary or sufficient. The structured context ΓX helps represent these factors but cannot replace domain judgement. • Evidence and citation validity. Evidence retrieval used a controlled local corpus rather than live online retrieval. Evidence-strength and citation-alignment scores therefore reflect the implemented evidence records and automated scoring procedures, not independent human verification of source quality or decision support. The low citationalignment values, and the fact that many final decisions cited profiling or executable-check evidence, limit claims about external evidence grounding. • Internal validity. Synthetic corruption provides partial ground truth, but injected errors may be more regular, visible, or reversible than natural errors. Original-data outputs were not manually adjudicated, so they cannot support detection or repair accuracy claims. A0 and A1 are contrasting baselines rather than a single-factor ablation because they differ in both reasoning mechanism and available profiling capabilities. Component-level interpretation is therefore stronger for the progressive A2–A6 comparisons. Prompt wording, output schema, temperature, model version, provider behavior, and postprocessing rules may also affect LLM-based decisions. Fixed prompts, three repeated runs, saved artifacts, and postprocessed metrics reduce these effects but do not remove them. Three repetitions are also insufficient for strong inferential claims about run-to-run variability. • External validity. The experiment uses three datasets from finance, healthcare, and environmental monitoring, but the results may not generalise to legal, geospatial, multilingual, relational, streaming, or image-derived data. The sample of up to 10 records supplied to the LLM may be insufficient for long temporal patterns, rare events, or entitylevel constraints. The study also used one LLM and provider setting for all LLM-based runs, so generalisation across models and providers remains to be evaluated. • Reproducibility and temporal validity. The controlled local evidence corpus improves reproducibility compared with live online retrieval but limits the range and freshness of available evidence. LLM services may also change because of model updates, routing, moderation, or infrastructure changes. The experiment records the model configuration, provider, inference parameters, retry behavior, responses, run metadata, and postprocessed metrics needed to audit the reported runs. Future experiments using online retrieval should preserve source snapshots or archived documents, while locally hosted or pinned open-weight models could further reduce model-version variability. • Implementation and evaluation bias. Profiling scripts, corruption generators, source-ranking functions, citationalignment checks, reversible-script generation, JSON repair, postprocessing, and metric computations may contain bugs or hidden assumptions. Taxonomy definitions, corruption scenarios, conservative policies, evaluation metrics, and evidence-ranking weights also reflect researcher judgement. Saved intermediate artifacts, execution logs, output audits, and explicit scoring logic reduce this risk but do not eliminate it. Independent domain experts and multiple reviewers should evaluate the framework in future replications.

12

Conclusion

This study examined how different capabilities affect reference-free data cleaning with LLM agents. It proposed an evidence-grounded framework that combines structured context, profiling, LLM reasoning, executable checks, controlled local evidence retrieval, source ranking, citation alignment, conservative repair, reversible scripts, and provenance logging. The experiment produced 126 successful runs across three datasets, two evaluation settings, and seven configurations. By separating controlled synthetic-corruption evaluation from original-data descriptive auditing, the study avoids treating unverified anomalies in the original data as ground-truth errors. The results show that the evaluated capabilities affect different aspects of the cleaning process and do not produce consistent improvements across all metrics. The deterministic profiling baseline achieved the highest synthetic detection F1-score, while adding executable tools improved detection within the progressive LLM-based sequence. Sourceranking and citation controls were associated with low unsupported-rule rates, although citation alignment remained 18

A PREPRINT - AUGUST 18, 2026

weak. The full conservative configuration avoided unsafe and unnecessary modifications in the synthetic summary, but these values were already zero in A5, and A6 performed no successful direct repairs. It also introduced the highest overall runtime and token use. Overall, no configuration dominated across detection, repair, safety, evidence grounding, reproducibility, and operational cost. Reference-free agentic data cleaning should therefore be viewed as a multi-objective problem involving trade-offs among these criteria. Future work should evaluate additional datasets, models, and evidence providers; compare controlled local and online evidence retrieval; include independent domain-expert review of original-data outputs; improve decision-level evidence alignment, repair evaluation, and semantic reproducibility measures; and examine individual knowledge categories through controlled ablation. In particular, independently adding or removing schema, temporal, entity, domain, policy, task, and risk knowledge would help determine which forms of knowledge are useful for different classes of reference-free cleaning decisions.

Declarations Conflict of Interest The author declares that there are no conflicts of interest. Ethics, Informed Consent, and Data Use This study did not recruit human participants or collect new human-subject data. The experiments used publicly available datasets obtained from the sources cited in the manuscript. No additional informed consent was sought for this secondary analysis. Use of AI Technology AI-based tools, including ChatGPT, were used to assist with language editing, clarity, manuscript organisation, and consistency checking. The author independently reviewed and verified all scientific claims, analyses, interpretations, and conclusions and remains fully responsible for the manuscript content. AI tools were not used to execute the reported experiments or generate the experimental data or results.

Data and Code Availability The datasets used in this study are publicly available from the sources cited in the manuscript. A blinded repository containing the source code, experiment scripts, configuration files, controlled evidence corpus, and saved experimental artefacts used to produce and inspect the reported results is available for review at: https://drive.google.com/ drive/folders/1Cqfxg_BxLBh_eMnMsFyTDPSQuSmo2uTW?usp=sharing. The blinded repository will be replaced by a permanent public archival record after acceptance.

References [1] Richard Y. Wang and Diane M. Strong. Beyond accuracy: What data quality means to data consumers. Journal of Management Information Systems, 12(4):5–33, 1996. [2] Yair Wand and Richard Y. Wang. Anchoring data quality dimensions in ontological foundations. Communications of the ACM, 39(11):86–95, 1996. [3] Leo L. Pipino, Yang W. Lee, and Richard Y. Wang. Data quality assessment. Communications of the ACM, 45(4):211–218, 2002. [4] Carlo Batini and Monica Scannapieco. Data Quality: Concepts, Methodologies and Techniques. Springer, Berlin, Heidelberg, 2006. [5] Erhard Rahm and Hong Hai Do. Data cleaning: Problems and current approaches. IEEE Data Engineering Bulletin, 23(4):3–13, 2000. [6] Ziawasch Abedjan, Xu Chu, Dong Deng, Raul Castro Fernandez, Ihab F. Ilyas, Mourad Ouzzani, Paolo Papotti, Michael Stonebraker, and Nan Tang. Detecting data errors: Where are we and what needs to be done? Proceedings of the VLDB Endowment, 9(12):993–1004, 2016. [7] Ihab F. Ilyas and Xu Chu. Data Cleaning. ACM Books, New York, NY, USA, 2019. 19

A PREPRINT - AUGUST 18, 2026

[8] Lan Li, Liri Fang, Bertram Ludäscher, and Vetle I. Torvik. AutoDCWorkflow: LLM-based data cleaning workflow auto-generation and benchmark. In Findings of the Association for Computational Linguistics: EMNLP 2025, pages 7766–7780, Suzhou, China, 2025. Association for Computational Linguistics. [9] Fabian Biester, Mohamed Abdelaal, and Daniel Del Gaudio. LLMClean: Context-aware tabular data cleaning via LLM-generated OFDs. arXiv preprint arXiv:2404.18681, 2024. [10] Zan Ahmad Naeem, Mohammad Shahmeer Ahmad, Mohamed Eltabakh, Mourad Ouzzani, and Nan Tang. RetClean: Retrieval-based data cleaning using LLMs and data lakes. Proceedings of the VLDB Endowment, 17(12):4421–4424, 2024. [11] Danrui Qi, Zhengjie Miao, and Jiannan Wang. CleanAgent: Automating data standardization with LLM-based agents. arXiv preprint arXiv:2403.08291, 2024. [12] Zezhou Huang and Eugene Wu. Cocoon: Semantic table profiling using large language models. arXiv preprint arXiv:2404.12552, 2024. [13] Shuo Zhang, Zezhou Huang, and Eugene Wu. Data cleaning using large language models. arXiv preprint arXiv:2410.15547, 2024. [14] Carlo Batini, Cinzia Cappiello, Chiara Francalanci, and Andrea Maurino. Methodologies for data quality assessment and improvement. ACM Computing Surveys, 41(3):16:1–16:52, 2009. [15] Hadi Fadlallah, Rima Kilany, Houssein Dhayne, Rami El Haddad, Rafiqul Haque, Yehia Taher, and Ali Jaber. Context-aware big data quality assessment: a scoping review. Journal of Data and Information Quality, 15(3):1– 33, 2023. [16] Flavia Serra, Verónika Peralta, Adriana Marotta, and Patrick Marcel. Use of context in data quality management: A systematic literature review. ACM Journal of Data and Information Quality, 16(3):19:1–19:41, 2024. [17] Hadi Fadlallah, Rima Kilany, Mitri Haber, and Ali Jaber. CTXDQ: An automated context-driven data quality assessment. In 2023 IEEE 4th International Multidisciplinary Conference on Engineering Technology (IMCET), pages 32–37. IEEE, 2023. [18] Felix Naumann. Data profiling revisited. ACM SIGMOD Record, 42(4):40–49, 2014. [19] Peter Christen. Data Matching: Concepts and Techniques for Record Linkage, Entity Resolution, and Duplicate Detection. Data-Centric Systems and Applications. Springer Berlin Heidelberg, 2012. [20] Varun Chandola, Arindam Banerjee, and Vipin Kumar. Anomaly detection: A survey. ACM Computing Surveys, 41(3):15:1–15:58, 2009. [21] Vijayshankar Raman and Joseph M. Hellerstein. Potter’s wheel: An interactive data cleaning system. In Proceedings of the 27th International Conference on Very Large Data Bases, pages 381–390. Morgan Kaufmann Publishers Inc., 2001. [22] Sean Kandel, Andreas Paepcke, Joseph M. Hellerstein, and Jeffrey Heer. Wrangler: Interactive visual specification of data transformation scripts. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, pages 3363–3372. Association for Computing Machinery, 2011. [23] Amr Ebaid, Ahmed K. Elmagarmid, Ihab F. Ilyas, Mourad Ouzzani, Jorge-Arnulfo Quiané-Ruiz, Nan Tang, and Si Yin. NADEEF: A generalized data cleaning system. Proceedings of the VLDB Endowment, 6(12):1218–1221, 2013. [24] Philip Bohannon, Michael Flaster, Wenfei Fan, and Rajeev Rastogi. A cost-based model and effective heuristic for repairing constraints by value modification. In Proceedings of the 2005 ACM SIGMOD International Conference on Management of Data, pages 143–154. Association for Computing Machinery, 2005. [25] Wenfei Fan and Floris Geerts. Foundations of Data Quality Management, volume 4 of Synthesis Lectures on Data Management. Morgan & Claypool Publishers, 2012. [26] Theodoros Rekatsinas, Xu Chu, Ihab F. Ilyas, and Christopher Ré. HoloClean: Holistic data repairs with probabilistic inference. Proceedings of the VLDB Endowment, 10(11):1190–1201, 2017. [27] Alexander K. Lew, Monica Agrawal, David Sontag, and Vikash K. Mansinghka. PClean: Bayesian data cleaning at scale with domain-specific probabilistic programming. In Proceedings of the 24th International Conference on Artificial Intelligence and Statistics, volume 130 of Proceedings of Machine Learning Research, pages 1927– 1935. PMLR, 2021. [28] Sanjay Krishnan, Jiannan Wang, Eugene Wu, Michael J. Franklin, and Ken Goldberg. Activeclean: Interactive data cleaning for statistical modeling. Proceedings of the VLDB Endowment, 9(12):948–959, 2016. 20

A PREPRINT - AUGUST 18, 2026

[29] Xu Chu, John Morcos, Ihab F. Ilyas, Mourad Ouzzani, Paolo Papotti, Nan Tang, and Yin Ye. KATARA: A data cleaning system powered by knowledge bases and crowdsourcing. In Proceedings of the 2015 ACM SIGMOD International Conference on Management of Data, pages 1247–1261. Association for Computing Machinery, 2015. [30] Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, Sebastian Riedel, and Douwe Kiela. Retrieval-augmented generation for knowledge-intensive NLP tasks. In Advances in Neural Information Processing Systems, volume 33, pages 9459–9474, 2020. [31] Hannah Rashkin, Vitaly Nikolaev, Matthew Lamm, Lora Aroyo, Michael Collins, Dipanjan Das, Slav Petrov, Gaurav Singh Tomar, Iulia Turc, and David Reitter. Measuring attribution in natural language generation models. Computational Linguistics, 49(4):777–840, 2023. [32] James Thorne, Andreas Vlachos, Christos Christodoulopoulos, and Arpit Mittal. FEVER: A large-scale dataset for fact extraction and VERification. In Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 809–819, 2018. [33] Peter Buneman, Sanjeev Khanna, and Wang-Chiew Tan. Why and where: A characterization of data provenance. In Database Theory – ICDT 2001, volume 1973 of Lecture Notes in Computer Science, pages 316–330. Springer, 2001. [34] James Cheney, Laura Chiticariu, and Wang-Chiew Tan. Provenance in databases: Why, how, and where. Foundations and Trends in Databases, 1(4):379–474, 2009. [35] World Wide Web Consortium. PROV-DM: The PROV data model. W3C recommendation, World Wide Web Consortium, April 2013. [36] Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao. ReAct: Synergizing reasoning and acting in language models. In International Conference on Learning Representations, 2023. [37] Timo Schick, Jane Dwivedi-Yu, Roberto Dessì, Roberta Raileanu, Maria Lomeli, Eric Hambro, Luke Zettlemoyer, Nicola Cancedda, and Thomas Scialom. Toolformer: Language models can teach themselves to use tools. In Advances in Neural Information Processing Systems, volume 36, 2023. [38] Avanika Narayan, Ines Chami, Laurel Orr, Simran Arora, and Christopher Ré. Can foundation models wrangle your data? Proceedings of the VLDB Endowment, 16(4):738–746, 2022. [39] Hans Hofmann. Statlog (German Credit Data). UCI Machine Learning Repository, 1994. https://doi.org/ 10.24432/C5NC77. [40] Gaurav Srivastav. EHR Dataset. Kaggle, 2024. https://kaggle.com/datasets/gauravsrivastav2507/ ehr-dataset. [41] Hadi Fadlallah, Yehia Taher, and Ali Jaber. RaDEn: A scalable and efficient radiation data engineering. In Proceedings of the 1st International Conference on Big Data and Cyber-Security Intelligence, volume 2343 of CEUR Workshop Proceedings, pages 89–93. CEUR-WS.org, 2018.

21

Related documents

• Agentic Data Cleaning Without a Clean Reference: An Experimental Study of Capabilities and Trade-offs#609194
• Evaluating Agentic Code Repair Capabilities in Distributed Systems#609283
• Evaluating Agentic Code Repair Capabilities in Distributed Systems#459635
• Configuration Smells in AGENTS.md Files: Common Mistakes in Configuring Coding Agents#282881
• AgentModernize: Preserving Business Logic in Legacy Modernization with Multi-Agent LLMs and Behavioral Specification Graphs#200560