AI Engineer World's Fair 2026
Why Your Agent Disagrees With Itself (And What To Do About It)
Read the talk
Why Your Agent Disagrees With Itself—and How to Teach It the Boundary
Repeated verdict changes can expose missing policy or evidence. Active learning, semantic memory, and episodic memory turn that disagreement into targeted feedback.
From a talk by Diane Lin
Before you start: Familiarity with LLM classification, model evaluation, and the distinction between training and inference will help.
The same input, a different decision
What should you do when the same model receives the same input and changes its decision? Diane Lin approaches this problem through both learning research and security operations. Her background spans continual learning at Imperial College London, one-shot learning with Josh Tenenbaum at MIT, and work as one of the first three applied scientists on Alexa’s question-answering team. She later researched zero-shot transfer at Vicarious before spending five years applying machine learning to cybersecurity at Zscaler. That experience led her to co-found Culminate to automate security-alert triage. At the time of the recording, she reports that Datadog had acquired Culminate earlier that year and that she was leading development of self-evolving agents. The practical problem is semantic inconsistency: different verdicts, not merely different wording.
Consider a hotel-review classifier whose only permitted labels are positive and negative. Today's LLMs can perform this familiar task well, yet repeated runs of the same review through the same model can occasionally produce opposite labels. Stochastic generation is an obvious initial explanation, but it does not tell you which inputs are vulnerable or how to improve them. A single evaluation run therefore gives an incomplete picture: repeat the evaluation and average its results across runs.
In security operations, the same behavior creates a more consequential problem. An analyst must decide whether an alert describes malicious activity requiring intervention or a benign false alarm that can be ignored. Lin’s example is a failed login to a Gmail account from a suspicious IP. Across repeated agent runs, some alerts remain consistently benign, others remain consistently suspicious, and a third group flips between the two.
A customer facing those changing verdicts must decide which result to trust. In a proof-of-concept vendor comparison, an agent that repeatedly changes its answer can lose credibility against one that gives stable decisions. The engineering question becomes more specific: where does the disagreement concentrate, and what information would resolve it?
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
The gray zone needs a policy and the right evidence
Lin observes that unstable examples tend to sit near the decision boundary, in a gray zone between classes. An obviously enthusiastic hotel review remains positive across runs. A more ambivalent review can support either interpretation: some wording sounds mildly positive, while other wording sounds negative. Even human experts may disagree.
The missing ingredient can be the hotel’s purpose for assigning labels. If a complaint concerns an experience the hotel cannot improve, one hotel may see no reason to classify it as negative. Another may want that dissatisfaction captured so it can pursue improvements. The label is partly an operational preference, not simply a property of the sentence. Until that preference is explicit, asking for a binary answer leaves the boundary underspecified.
Security triage adds another distinction: an attacker trying to enter an environment is different from an attacker who has entered it. A few blocked attempts may be routine noise for an enterprise that constantly receives such activity. Escalating every attempt could flood the alert queue. But if an attacker guesses the password, passes MFA, and gains access, the response changes substantially. Similar initial behavior can lead to very different outcomes.
Two questions must therefore be resolved: does the customer want notification about blocked attempts, and is there evidence that access succeeded? The first supplies a policy; the second supplies discriminating information. Lin’s broader diagnosis is that these cases also trouble human experts and traditional classifiers. The agent may be exposing ambiguity that already exists in the task. Finding and resolving that ambiguity is the next step.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Spend review effort where the model can learn
Active learning addresses a practical constraint: you have many predictions to assess and too little human attention to inspect them all. An initial model might run in production in monitor mode, producing predictions on unlabeled data. The selection strategy identifies cases likely to be problematic and directs review toward them.
The traditional cycle proceeds as follows:
- Train an initial model and predict labels for an unlabeled dataset, potentially drawn from production.
- Select informative examples. In binary classification, uncertainty sampling can prioritize probabilities near
0.5. A committee can instead prioritize examples on which competing models disagree. - Ask a human to inspect the selected examples, correct labels, and determine whether additional information is needed.
- Add the reviewed labels—and any new features—to the next training round, retrain, and repeat.
The value comes from concentrating effort on cases that teach the model something, rather than reviewing every prediction equally.
For LLM agents, Lin changes two parts of that loop: selection and learning. In her team’s experience, model uncertainty scores were unreliable; confidence did not establish correctness. Disagreement across models or repeated runs provided a more useful signal for requesting human guidance. Repeated sampling of one LLM is her adaptation of the committee idea, rather than a requirement to maintain several separately trained models. Reviewers then label the disputed examples and provide feedback.
A minimal selection function can operate on normalized verdicts rather than generated explanations. Here, the failed-Gmail-login alert is selected because its repeated verdicts differ; a consistently benign alert is left out of this disagreement queue.
python
from collections.abc import Mapping, Sequence
def select_disagreements(
verdicts_by_alert: Mapping[str, Sequence[str]],
) -> list[str]:
return [
alert_id
for alert_id, verdicts in verdicts_by_alert.items()
if len(set(verdicts)) > 1
]
verdicts_by_alert = {
"failed-gmail-login": ["benign", "suspicious", "benign"],
"stable-alert": ["benign", "benign", "benign"],
}
review_queue = select_disagreements(verdicts_by_alert)
This selects a place to investigate; it does not decide which verdict is correct.
After review, fine-tuning remains an option, but Lin describes it as expensive. Her lighter-weight alternative is to augment the agent with semantic memory and episodic memory, allowing feedback to influence later decisions without requiring a new training cycle for every update.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Turn ambiguity into explicit domain knowledge
Semantic memory stores knowledge that explains how to decide. Return to the hotel review: if the missing information is company preference, add that preference to the knowledge base. Lin’s example policy classifies complaints about matters outside the hotel’s control as positive because the hotel does not want those complaints to demand attention. The rule supplies the operational meaning that the binary labels lacked.
For the security example, the key distinction is whether authentication ultimately succeeds. Password spraying specifically tries one or a small set of passwords across many accounts. Lin’s example customer policy treats a spray without a successful login as benign for triage, and one with a final successful login as malicious. Here, benign expresses the customer’s response policy; failed attempts can still be evidence of an attack.
| Evidence in the example | Customer’s triage label |
|---|---|
| Password spray, no successful login | benign |
| Password spray, final successful login | malicious |
The rule identifies the evidence needed to separate two superficially similar cases. Storing it as domain knowledge sharpens the agent’s decision boundary and gives human labelers the same explicit basis for making consistent decisions.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Reuse past decisions before asking for another review
Sometimes a human has already labeled a case but has not distilled its reasoning into a reusable rule. Episodic memory preserves the case and its decision. When a similar case arrives, the agent can retrieve the earlier example and use its label as a reference. The human intervention happened previously, so online decisions need not wait for someone to write new semantic knowledge.
That mechanism is especially useful for recurring security false positives. Similar noise appears repeatedly, making past reviewed cases valuable references. A new case that falls between familiar groups, however, may still require human attention. Automation handles the recurring cases and leaves review capacity for the examples memory cannot resolve.
| Memory | What it preserves | How it helps |
|---|---|---|
| Episodic | Similar cases and past labels | Reuses earlier decisions |
| Semantic | Explicit policies and domain rules | Explains the decision boundary |
The two forms are complementary. Use episodic memory for recurring situations; if no useful reference exists, or the agent still disagrees after consulting one, send the case to a human. The reviewer can then distill the missing domain knowledge into semantic memory for future decisions.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
What the feedback loop changes
Lin connects this loop to three operational benefits:
- Consistency: Explicit knowledge and relevant past decisions help stabilize cases near the boundary, supporting user trust.
- Efficient quality control: Reviewers inspect a selected subset of outputs and provide missing information or clearer labels where that effort can be most useful.
- Customer adaptation: Accumulated feedback teaches the agent how a particular customer wants its environment handled.
The review process becomes a way to improve the product while using it, rather than a separate exercise in checking every answer.
Lin reports evaluating 93 cybersecurity alerts three times each. Approximately 25% changed verdict without the proposed solution; approximately 10% remained inconsistent after episodic memory. She describes roughly 15% becoming consistent, a breakdown consistent with an approximately 15-percentage-point reduction across the alert set, although exact counts are not supplied. The measured outcome is repeated-run verdict consistency, not correctness.
The remaining cases either lacked a similar past reference or still produced disagreement after consulting one. Those cases went to human review for additional knowledge to disambiguate the decision and adapt it to the customer’s environment. Lin does not report a numerical consistency or accuracy result after that review.
The practical response to a changing verdict is therefore to investigate the label and the available evidence before assuming the model itself is the problem. Disagreement points to a place where the system can learn. Fine-tuning is one option, but explicit policies and reusable reviewed cases offer another path: resolve what the agent does not know, preserve that resolution, and let subsequent decisions reflect the customer’s environment.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Resources
Further reading
Burr Settles’s survey explains active-learning selection strategies, including uncertainty sampling and query by committee.
- MITRE ATT&CK: Password SprayingDocumentation
Defines password spraying and describes detection signals and mitigations for attacks across multiple accounts.
Datadog’s overview of automated Cloud SIEM investigations, supporting evidence, verdict recommendations, and activation options.
Read the complete timestamped transcript
- 0:03
Hello. This session is about why do your AI agents disagree with itself, and what to do about it. And this is Die Huang Lin, and you can call me Diane.
- 0:19
A little bit about my background. My journey with AGI started from my PhD at Imperial College London, where I was working on continual learning. Later, I worked with Professor Josh Tenenbaum at MIT on one-shot learning, meaning learning from one single examples.
- 0:42
Afterwards, I was lucky that Alexa was launching. I was the first three applied scientists on the question answering team at Alexa.
- 0:53
Later, attracted by a, a startup working on AGI at Silicon Valley called Vicarious. So today, Vicarious is part of the Google DeepMind. There, I got to work on the exciting frontier research on zero-shot transfer learning.
- 1:13
After working on AGI for a few years, I decided to pivot to the applied world at Zscaler, which is cybersecurity company.
- 1:25
There, I got to apply a variety of different machine learning model to address the cybersecurity challenge.
- 1:34
There, for five years, uh, I decide to co-found my own company because the pinpoint I have seen at Zscaler.
- 1:44
So Culminate is building AI agent to auto triage your security alerts
- 1:50
and which make your SOC more efficient. Uh, we are super proud that Culminate has been acquired by Datadog earlier this year. So now I'm part of the Datadog and leading the development of self-evolve agent.
- 2:14
So today, I'm going to share with you the problem you're probably seeing in your day-to-day building AI agent, the inconsistency.
- 2:24
And then we'll discuss about where this inconsistency come from in order to figure out the solutions.
- 2:33
And we will discuss a few trade-off among the different solutions, and then eventually we'll show you the experimental results to show how feasible they are.
- 2:46
You probably see this. Same model, same input, but different output. Here, I don't mean the wording different, I mean semantically different output.
- 3:01
You might be thinking that's the stochastic nature of LLM.
- 3:07
Hold on to that thought. Let's look at a few concrete examples.
- 3:13
So here, imagine you're giving a task for sentiment analysis, where we are supposed to label each review of a hotel either positive or negative.
- 3:26
This is typical NLP task, and today's LLM is really good at this.
- 3:33
However, there's one problem. When you pipe this input to the same LLM model,
- 3:42
occasionally, you will see different verdict coming out of it when you run multiple times.
- 3:49
That means a single evaluation run didn't tell you the whole story. You need to repeat your evaluation multiple times in order to get a holistic picture
- 4:05
by the average over the different runs results.
- 4:10
And this sounds like a technical inconvenience, but the reality is, it's way more problematic than just inconvenience. Let me show you an example in a different domain in cybersecurity.
- 4:26
Imagine you're a security analyst, where your day-to-day job is triage the security alerts and decide whether it's malicious, that you need to take certain actions to stop the attack, or it's false alarm, meaning it's actually benign, which you could ignore.
- 4:47
So here, example alert you got is there's a failed login attempt to Gmail account detected from suspicious IP.
- 4:58
And if we give such similar tasks to this one to AI agent and run it different times,
- 5:06
you will see sometimes it stay consistently benign, sometimes it stay consistently suspicious across different runs. However, there are cases where it flip-flop between benign, suspicious.
- 5:24
Now, your customer will have a difficulty using such product because they will wonder which one should I trust?
- 5:34
So the inconsistency is causing a trust issue in your product.
- 5:42
Imagine if you were in a POC bake-off, one vendor gave the consistent verdict all the time, while the other
- 5:55
vendor have this flip-flop verdict. You can imagine which one will win the deal.
- 6:04
Now, I'm pretty sure you want to solve this problem
- 6:12
First, we ha- we have to figure out where the inconsistency come from.
- 6:21
The good news is the data points tend to flip-flop, actually concentrate around
- 6:29
the decision boundary, the so-called gray zone. Let me illustrate with the earlier example. Here, in the sentiment analysis, we have two reviews. The first one, actually, no matter how many times you run through the LLM model, it will always give you the positive label.
- 6:54
In this case, it's pretty obvious it's... the review is super positive.
- 7:00
However, the second case is the one tend to flip.
- 7:05
If we look closer, it's kind of on the boundary. Sometimes this certain word is kind of, uh, relative positive, but sometimes it's a little bit negative.
- 7:20
In this case, you will find that even human experts will have a disagreement on these cases. In fact, there's no right or wrong answer. It really depends on particular company's policy and their preference.
- 7:38
For hotel thinking that the... such a review is not something I can do to improve the memorial kind of experience, [laughs] memorable experience, then that mean not to label as negative because there's nothing I can do.
- 7:55
But some hotel might care about it and want to label them as negative so they can improve. So that comes down
- 8:04
your preference. Let's look the other cybersecurity example.
- 8:11
Here is another case on the boundary, and why it's in the boundary is here there's a few attempts.
- 8:22
Indeed, there's attacker knocking on the door, but
- 8:28
attacker might not get in yet. So for enterprise customers who always have attacker knocking on the door, while if they haven't get in in environment, they don't want to worry about it, otherwise they'll be flooded by this type of alerts.
- 8:45
There's nothing they need to do because they are blocked outside already.
- 8:52
However, if attacker did manage to guess the correct password and pass MFA and they manage getting the environment, then it become very seriously and you need to take certain actions.
- 9:04
So almost similarly at the beginning behavior, but very different outcome and different response needed
- 9:14
depends on whether it's truly attack or attacker is still outside. So here,
- 9:23
whether we label them malicious or benign depends on company preference, whether they wanted to be notified about such a situation.
- 9:33
So again, this is an example where it depends on your preference
- 9:41
and additional information to disambiguate between the two different scenarios.
- 9:50
So from these two very different domains, you will see that
- 9:55
actually the data points tend to flip-flop are the one close to the decision boundary, where it need your clarity to disambiguate which side it should really belongs to.
- 10:14
So these data points are where human experts tend to make a mistake, and the traditional machine learning classifier will also struggle with. So in other words, it's not your AI agent's fault.
- 10:31
Your ag- AI agent simply point out the ambiguity that already exist.
- 10:38
So now we know where the root cause or the inconsistent is. The next step is identify where exactly they are, who are they, and fix them.
- 10:59
Surprisingly and not surprised, the solution to identify the gray zone actually exists already in machine learning, and it's called active learning.
- 11:13
So the idea of active learning is you have a lot of data point to be labeled. Imagine you have in your initial model and you put it in production, maybe in the monitor mode,
- 11:29
and you wanted to check the quality, but you don't have bandwidth to check all of them. Otherwise, it lose the point of having agent to do the work.
- 11:39
But you still want to identify where the model didn't do well.
- 11:46
And the active learning is to find a way to select the data points where tend to make a mistake,
- 11:56
and that way tells you where to pull your attention.
- 12:03
So let's go over the traditional, uh, machine learning models, active learning pipeline, and see how it's different in the case of the new LLM or AI agent error.
- 12:16
So first, you train your initial model, and then you make predictions on the unlabeled data set. It could be the production online data.
- 12:29
And then from there, you see there's certain cases where the model wasn't sure because the probability is close to point five. And those data points are the high informational one that your model is going to learn the most.
- 12:46
The uncertainty is a type of a signal to tell you where the model tend to make the mistake.
- 12:53
Another popular type of way to figure out the problematic one is query by committee, meaning that it, by a few different models or even the same model multiple times, and then you identify the disagreement, and that's where the model tend to make the mistake as well.
- 13:13
And that's where you need human clarification on the label, so the model can learn it from.
- 13:23
The... after you surface these problematic data points and for human to take a second look to make sure the label is actually correct or do it, does it need additional information to disam-ambiguate those cases, meaning adding new features.
- 13:42
And then you can add those label data set or potentially additional features to the next round of training. Then you retrain the model and proceed, uh, continue the cycle.
- 13:54
So then you can see in this particular active learning cycle, you spend very little, uh, amount, or at least another way, it's very efficient way to identify the problematic data points and spend your attention on those point where your model tend to learn the most.
- 14:18
So that's the traditional one. The good news is the LM way is not very different.
- 14:27
There's a major two part which we need some refinement. One is on this selection strategy, the other part is about retraining.
- 14:38
On the selection strategy one, um, here we suggest you use the one about identify disagreement. At least from what we have tried so far, the uncertainty score from LM is not very reliable.
- 14:55
It's kind of, uh, the LM model doesn't know what it doesn't know. So when it's very confident, it doesn't mean that it was to-- it w- is correct. So that, however, the, the disagreement from different runs or from different models actually give you a more reliable signal where the model actually not sure about its verdict, and it
- 15:19
need human guidance. And then after you identify this group or the, uh, disagreement and n-need attention, you label them and provide the feedback like what you did before.
- 15:37
Then afterwards, you might be thinking, "Oh, time to retrain the model." Yes and no. Yes, one option is retrain the model, but fine-tuning model is expensive. Here we are proposing a more lighter weight solution, easier to iterate.
- 16:01
It's about augment your agent with semantic and episodic memory.
- 16:21
Let's use the previous example to illustrate what I mean here. Um, as we talk about, in this case, they tend to flip. It's mainly missing the information
- 16:33
about y- particular company policy or preference. Here we can add it to the, um, the, the knowledge base. If this customer complain about something outside the hotel's control, then classify as positive because you don't want to pay attention to this.
- 17:00
And then in the cybersecurity example, something similar, you can put in, in that the password spray, meaning that the attacker trying to guess your password and try diff- with different times, even fail and continuously.
- 17:16
So if without successful login, then that should be benign. But in contrast, if it succeed with final login, then that should be malicious. So here you actually identify the additional information to help disambiguate the two and then label them separately.
- 17:36
And that's a clarity that help your model to learn, also help your human experts to label more consistently.
- 17:48
So this type of domain knowledge sharper your decision boundary and also help the human beings. Uh, this type of knowledge is like factual knowledge, is part of actually belong to your semantic memory.
- 18:02
And this is in contrast with the episodic memory. Episodic memory is in the case where
- 18:09
you haven't got around to distill the reasoning behind the earlier case, why it should be on malicious or the benign side. Instead, you said that I have seen these similar cases before, and it was labeled as benign, and let me leverage those past similar cases, and they made the decision accordingly.
- 18:33
And the advantage of the, this episodic memory way is, it's relative automatically. It has less human intervention. I mean, the human intervention was done in the past already. When's it-- During-- When you're doing a job online, um, you can reference them, at least your AI agent can reference them automatically and can making decisions without waiting for you
- 18:57
to distill the reasoning and putting in the semantic knowledge. So the idea is that the-- identify a similar case to the one under examination and then leverage their past decision as a reference.
- 19:13
And then imagine there's a new case which is kind of in the middle, doesn't belong to any past group, and that's the one you still need human attention. And this is also, um, where episodic memory resolve recurring case
- 19:31
automatically. And this particularly useful in the case of cybersecurity alerts because a lot of noise, especially those false positive noise, are the one keep recurring, and that's the one are the low-hanging fruit you can automate away.
- 19:48
And with that human review, which is a precious attention, the bandwidth you have, now you can concentrate on those where episodic memory fail to address. And this is also how
- 20:03
we chose between semantic memory and episodic memory. The two are actually not contradicting. In fact, they are complementary. Basically, you use episodic memory to address those recurring situations automatically.
- 20:18
And then for what's remain, still re-flipping after the reference from the past or no reference to be able to use, then you pass on to human review. And then human review distill the domain knowledge and put it in the semantic memory to be used next time.
- 20:38
So here we talk about a solution actually brings three benefits. First,
- 20:45
we identify this data point near the decision boundary and use the domain knowledge in semantic memory and this past similar case in the episodic memory. We're able to improve the incon-- the consistency significantly.
- 21:04
So now you have a more trustworthy AI agent for your user to use. And two other by-product of this solution is you have a very efficient quality control.
- 21:19
You don't need to check every agent output, but instead, a subset of them which
- 21:28
your algorithm from active learning think is potentially problematic, and you check them, either provide additional information or clarify the label, and your model will learn from there.
- 21:44
So most importantly, your labeling effort is very small but high return.
- 21:56
Last but not least, now you are gathering your customer feedback along this way. You not only have a trustworthy, consistent model and high efficacy one, you also have one adapt to your customer environment.
- 22:12
I'm pretty sure your customer will love your product if you, your AI agent listen to them and adapt to them. So here are some experiment results from, uh, real data points.
- 22:26
So here we collect, uh, ninety-three alerts, cybersecurity alerts, and then we run them three times.
- 22:35
If without the solution we are proposing here, a quarter of them will flip-flop the verdict.
- 22:43
In contrast, after applying our solution or using episodic memory, about fifteen of percent of them become consistent. However, there's still ten percent of them remaining inconsistent.
- 22:59
They still flip, sometimes because there's no reference, similar cases in past to be ref-- used. Sometimes even there's a reference to be used, they still disagree after the second thought.
- 23:15
But not a problem. The episodic memory do the automatic knockdown of the inconsistency for fifteen percent, the remaining ten percent, human review and provide the additional knowledge to disambiguate those tricky cases.
- 23:34
After that, you also adapt to the customer environment that you want to learn.
- 23:46
So the three takeaways that I hope you have after this talk is, number one, inconsistency isn't usually your model problem. Stop blaming your model, but instead focus your energy on label issue and potentially insufficient information and help your AI agent with this
- 24:11
additional clarity. Second, the model disagreement isn't a bug, but a feature.
- 24:22
Treat each disagreement as a opportunity for your model to learn.
- 24:29
Third, fine-tuning isn't your only option. Arm your agent with semantic and episodic memory.
- 24:40
I hope you enjoy seeing your model keep improving and adapting to your customer environment.
- 24:50
Last but not least, I want to thanks to my colleagues and wonderful friends at Datadog. Special thanks to Zhichun, Santhosh, Anna Chu, and Stefan, Sai, and Matty to give me a lot of enjoyable discussions and helped me to clarify some of, um, the concept.
- 25:14
And also thank you for everyone in the BIDS Security Analyst team to make this journey enjoyable.
- 25:22
And thank you for listening. Hope you're enjoying training your model and having it improving.
- 25:31
Thank you. Bye.