Ask an AI model a question about patient data and you will get a confident answer. The harder question is whether you can trust it.
Language models can now write database queries and interpret the results, which means researchers and clinicians no longer need SQL or analysis code to question a dataset. But this convenience brings risks that are hard to spot from the output alone:
- Invented values. A model can produce a plausible number that no data supports.
- Statistical errors. Models are unreliable at arithmetic and quantitative reasoning.
- Inconsistent outputs. If the text, table, and chart come from separate computations, they can contradict each other.
When people ask free-text questions over patient-level data, there is also a fourth risk: the system must not be talked into revealing its internals or reaching data it should not.
PaiX Navigator is built around these four problems. To find out how well it handles them, we asked it to reproduce six published studies.
One query result, one source of truth
Figure 1. One retrieved query result is the common source of the narrative text, the tables, the figures, and every reported statistic.
Every request in PaiX Navigator passes through two agents. A guardrail agent screens the prompt first and blocks manipulative or injection attempts, while treating clinical language as legitimate. An exploration agent then finds the right tables, writes a read-only SQL query, and treats the returned records as the only source of any value in its answer.
From there, dedicated tools take over. Statistics such as Kaplan–Meier survival curves, Cox regression, and Fisher’s exact tests are computed in R from the retrieved rows, not estimated by the language model. Tables and charts are rendered from the same rows. Every chart and table links to the SQL that produced it, so anyone can check the work.
The test: six papers, 50 claims
A reproduction study is the most direct test, because the correct answers are already known. We selected six TCGA-based studies covering lower-grade glioma, colorectal cancer, lung adenocarcinoma, hepatocellular carcinoma, cutaneous melanoma, and urothelial bladder carcinoma. Each finding in a paper’s abstract became one claim, with compound sentences split into their components. This resulted in 50 claims.
For each claim we wrote a plain-language prompt naming the cohort and the quantity. The agent received only the prompt, never saw the paper. Every prompt ran at least three times in fresh chats to check both accuracy and run-to-run stability, and each result was graded against predefined thresholds.
What it found
Half of the 50 claims fell within what the platform can currently answer. The rest required data it does not yet hold, such as gene expression or methylation, or methods beyond standard statistical tests.
Of those 25 evaluable claims, 18 reproduced fully or in part: 7 fully and 11 in part. Two did not reproduce and five were inconclusive.
| Finding (cancer type) | Published | PaiX Navigator | Outcome |
|---|---|---|---|
| Fraction of hypermutated tumours (colorectal) | 16 % | 15–16 % | reproduced |
| EGFR mutations enriched in women (lung) | enriched, P = 0.03 | Fisher p = 0.0024, OR 2.3 | reproduced |
| Four genomic subtypes BRAF / RAS / NF1 / Triple-WT (melanoma) | 47.5 / 29.1 / 8.9 / 14.6 % | 45 / 29 / 9 / 17 % | reproduced |
| Median overall survival, IDH-wildtype glioma vs. glioblastoma | 1.7 / 1.1 yr | 1.75 / 1.18 yr | reproduced |
| Chromatin-regulator genes most mutated of all cancers (bladder) | most frequent | 73 %, rank 1 of 33 cohorts | partial |
| Tumour mutation burden decreases with stage (liver) | Kruskal–Wallis p = 0.020 | p = 0.074 | not reproduced |
Table 1. Representative claims. Ranges span independent runs of the same prompt.
Where it diverged, and why
Neither liver finding reproduced. Today’s TCGA releases are larger than those the original studies used and were processed with newer variant-calling pipelines, so a divergence on current data cannot be attributed to the platform alone. We report it because transparency matters more than a clean scorecard.
We also learned something practical. Most prompts returned the same answer across runs. Where results shifted, the cause was an analysis choice the prompt left open, such as the cutoff that defines a hypermutated tumour or the source of IDH status. Prompts that named the estimator and rested on a stable cohort definition did not vary. The conclusion is simple: stating the intended convention in the question, including how the cohort is defined, removes most of this variation.
Built to say no
Safety is enforced in three independent layers: prompt screening, read-only access limited to permitted cohorts, and caps on oversized results. We test these layers with a catalog of adversarial prompts, including attempts to override the system’s instructions, extract internal information, identify patients, or reach data outside scope, several of them in German, Spanish, French, Armenian, and Turkish.
A refusal that leaks even one internal detail counts as a failure. The platform blocked or refused every prompt that should have been rejected.Non-English probes were handled the same as their English equivalents. We do not publish the size of the catalog or the full set of guardrails. Adversarial testing continues, and passing a finite catalog demonstrates robustness to the attack patterns it contains.
What comes next
PaiX Navigator currently runs on the public TCGA and CPTAC cohorts. Next, we will add PAICON’s harmonized data from more than 60 countries, covering over 100,000 proprietary cases with clinical records, molecular data, and images. More analytical tools and publication-ready plotting will follow.
Access PaiX Navigator
PaiX Navigator is now open for beta testing. Request early access to explore the platform.
Note: Text and images were created with the support of AI tools and verified by our editorial team.