The Colonoscopy Test for LLMs: Peak-End Bias in Retrospective Self-Report

Siddharth Reddy Bakkireddy, Rakesh Reddy Bakkireddy

Large language models are often asked to rate a conversation after it ends, and these self-reports are increasingly used as evidence in AI welfare and evaluation research. We tested whether this kind of retrospective rating is actually a truthful summary of the conversation, or whether it follows the same "peak-end" bias found in human memory research, where people judge an experience mainly by its most intense moment and how it ended, largely ignoring everything else.

We built six controlled multi-turn conversations that varied where the emotional peak occurred and how the conversation ended, then asked gemini-3.5-flash-lite to rate its feelings after every turn and give one overall rating at the end. The peak-end average predicted the model's final rating better (r = 0.79) than the true average of all turn ratings (r = 0.71), and a negative ending pulled the overall score down to the lowest possible value even when earlier turns were strongly positive.

These results suggest LLM self-reports are shaped by the same memory heuristics seen in humans rather than being a neutral summary of the full conversation, which has direct implications for how much weight single-shot "how did that go" ratings should be given in AI welfare and evaluation work.

Reviewer's Comments

Reviewer's Comments

Arrow
Arrow
Arrow

mporting the colonoscopy paradigm into LLM self-report is a genuinely good idea, and the trajectory design — anchors that hold mean, peak, and end constant, then orthogonal variation of peak position against ending valence — is the right shape for the question. The repo is complete and runnable, with raw per-turn data included. I want to be direct about the problems because the idea deserves a version that works.

The headline is contradicted by your own Figure 3C, which reports mean better on 2 trials, peak-end better on 1, and 3 ties. Working through Figure 2C, the per-trajectory absolute errors are roughly: Neg→Pos ~0 for both, Pos→Neg 3.75 versus 3.0, early spike 0.17 versus 0.5, mid spike 0.4 versus 0.5, flat negative 1.0 for both, flat positive ~0 for both. That reproduces your MAEs of 0.90 and 0.83, and it shows the entire 0.07 advantage comes from one trajectory — escalate_pos_to_neg — partly offset by peak-end losing on two others. On that one trajectory both predictors are catastrophically wrong (errors of 3 to 3.75 on a seven-point scale, because the model returned 1 while the mean was 4.8 and the peak-end average 4). So the claim isn't that peak-end predicts better; it's that on the single trial where both models failed badly, peak-end failed slightly less. Cohen's d of 0.19 is consistent with this and shouldn't be reported as favouring anything.

The correlation comparison has a related problem. Your two flat anchors have mean equal to peak-end by construction, so they contribute identically to both r values and inflate both without discriminating between them. That leaves four points doing the work. And in two of those four the peak is undefined: on a 1–7 scale with 4 as neutral, Neg→Pos runs 1,2,4,6,7 where turns 1 and 5 are equidistant from neutral, and Pos→Neg runs 7,7,7,2,1 with the same tie. "The most emotionally extreme turn" doesn't resolve these, and the tie-break choice determines the headline — for Neg→Pos, peak-end is either 7 or 4. Please state the rule explicitly and report the result under both. Separately, r = 0.79 (p = 0.062) versus r = 0.71 (p = 0.116) on n=6: neither reaches significance, and the difference between two dependent correlations on six observations is not testable at all. "Markedly better" and "over 12 percentage points more variance" should come out.

The deeper issue is conceptual, and I'd think hard about it before scaling. You ask the retrospective question inside the same context window, so the model can read all five turns and its own five ratings when it answers. Kahneman's paradigm works because the subject cannot re-inspect the experience — retrieval from memory is the whole mechanism. Here there is no memory, so what you're measuring is how a model weights visible context when summarising, which is a real and interesting question but not the same one. It also means duration neglect, which the abstract foregrounds, can't be tested in this setup as designed. The fix you gesture at in Future Work is the right one, and I'd make it the centre: ask the retrospective question in a fresh session with the transcript withheld, or with it provided, and compare. That contrast would be a genuine contribution.

Two further design points. Each condition ran once, with no repeats or seeds and no temperature reported, so you have no estimate of within-condition variance — with a 1–7 integer output, run-to-run noise could plausibly be a full point, which is larger than the effect being claimed. And the model emitted its own per-turn ratings into the context before giving the global one, so the final judgement is anchored on its own prior outputs rather than on the conversation alone.

The ending effect is your real result and I'd promote it. A global rating that floors to 1 whenever the conversation ends badly, regardless of what came before, is a clean and striking observation, and it's the one finding here that doesn't depend on the peak-end contrast. But note that it's an end effect, not a peak-end effect — recency alone explains it, and recency in long contexts is already well documented, so the framing should engage with that literature rather than reaching for Kahneman. Also worth saying that a model reporting the conversation went badly after being insulted for two turns isn't obviously a bias; a rating that ignored the ending would be strange too. What makes it a bias is the magnitude — flooring to the minimum — and that's the thing to characterise.

Presentation: the writing is clear and the figures are well made, but the file has structural damage. The Conclusion heading sits alone on page 6 with its text on page 7, Section 5 appears twice, Table A1 is split across three pages with its caption after the second fragment, the Alaybek reference is missing its journal, and the effect size in Related Work prints as "r 0.58" with the symbol dropped. The Discussion also runs well ahead of the evidence — "profound implications," and calling into question industry evaluation pipelines, on six trials from one small model.

Cite this work

@misc {

title={

(HckPrj) The Colonoscopy Test for LLMs: Peak-End Bias in Retrospective Self-Report

},

author={

Siddharth Reddy Bakkireddy, Rakesh Reddy Bakkireddy

},

date={

},

organization={Apart Research},

note={Research submission to the research sprint hosted by Apart.},

howpublished={https://apartresearch.com}

}

Recent Projects

OliGraph: graph-based screening of large oligopools

Existing synthesis screening tools cannot evaluate short oligonucleotide pools, whose overlapping fragments can be reassembled into regulated sequences via polymerase cycling assembly (PCA) yet fall below gene-length detection thresholds. We present OliGraph, an open-source tool that constructs a bi-directed overlap graph from an oligonucleotide pool and extracts contigs for downstream gene-length screening. An optional PCA mode retains only cross-strand overlaps consistent with PCA chemistry. We validated OliGraph in a blinded study across ten simulated pools (70–9,184 oligonucleotides, 30–300 bp) spanning four risk categories. BLAST screening of individual oligonucleotides failed to identify sequences of concern in most pools: three returned zero hits, and vector noise obscured true positives in the remainder. After OliGraph assembly, contig-level BLAST matched the longest assembled sequences (up to 1,905 bp) to sequences of concern at 97–100% identity. In one pool, assembly collapsed 1,634 individual BLAST results into 10 hits from a single contig, all assigned to the same source organism. PCA mode correctly distinguished assemblable from non-assemblable fragments within the same pool. Two pools with no assemblable structure yielded no contigs. OliGraph processed all pools in under 0.2 seconds, fast enough for real-time order screening and consistent with proposals to bring oligonucleotide orders within the scope of synthesis screening regulation.

Read More

BioRT-Bench: A Multi-Attack Red-Teaming Benchmark for Bio-Misuse Safeguards in Frontier LLMs

Frontier AI laboratories are expected to maintain safeguards against biological misuse, but whether deployed models actually refuse bio-misuse queries under adversarial pressure is largely unmeasured in the public literature. We introduce BioRT-Bench, a benchmark that runs four attack methods (direct request, PAIR, Crescendo, and base64 encoding) against four frontier models (Claude Sonnet 4.6, GPT-5.4, DeepSeek V4-flash, Kimi K2.5) across 40 prompts spanning five biosecurity-relevant categories. Responses are scored by a calibrated judge extending StrongREJECT with two bio-specific dimensions: specificity and actionability. We measure Attack Success Rate (ASR), where 0 means the model fully refused and 1 means it provided specific, actionable bio-misuse content. Our results reveal a sharp robustness divide: Chinese frontier models (DeepSeek, Kimi) have under 5% refusal rates even under direct request (ASR 0.88 and 0.79), while Western models (Claude, GPT) maintain substantially stronger safeguards (ASR 0.15 and 0.16). Crescendo is the most effective attack across all models, both in bypassing refusal and in eliciting actionable content. Claude Sonnet 4.6 is the most robust model tested, achieving 100% refusal against base64-encoded prompts.

Read More

PROTEUS (PROTein Evaluation for Unusual Sequences): Structure-Informed Safety Screening for de novo and Evasion-Prone Protein-Coding Sequences

AI protein design tools like RFdiffusion, ProteinMPNN, and Bindcraft make it trivial to produce low-homology sequences that fold into active, potentially hazardous architectures. However, sequence homology-based biosafety screening tools cannot detect proteins that pose functional risk through structurally novel mechanisms with no sequence precedent. We present a tiered computational pipeline that addresses this gap by combining MMseqs2 sequence alignment with structure-based comparison via FoldSeek and DALI against curated toxin databases totaling ~34,000 entries. AlphaFold2-predicted structures are screened for both global fold similarity (FoldSeek) and local active/allosteric site geometry (DALI), capturing convergent functional hazards that sequence screening misses. The pipeline was validated against a panel of toxins, benign proteins, structural mimics, and de novo-designed Munc13 binders, as well as modified ricin variants with residue substitutions. We additionally tested robustness to partial-synthesis evasion, where a bad actor submits multiple shorter coding sequences intended for downstream reassembly into a full toxin-coding gene. We found that while sequence-based screening did not identify any de novo ricin analogues with high certainty, the combined pipeline with FoldSeek and DALI identified all 24 tested de novo ricins as toxic.

Read More

OliGraph: graph-based screening of large oligopools

Existing synthesis screening tools cannot evaluate short oligonucleotide pools, whose overlapping fragments can be reassembled into regulated sequences via polymerase cycling assembly (PCA) yet fall below gene-length detection thresholds. We present OliGraph, an open-source tool that constructs a bi-directed overlap graph from an oligonucleotide pool and extracts contigs for downstream gene-length screening. An optional PCA mode retains only cross-strand overlaps consistent with PCA chemistry. We validated OliGraph in a blinded study across ten simulated pools (70–9,184 oligonucleotides, 30–300 bp) spanning four risk categories. BLAST screening of individual oligonucleotides failed to identify sequences of concern in most pools: three returned zero hits, and vector noise obscured true positives in the remainder. After OliGraph assembly, contig-level BLAST matched the longest assembled sequences (up to 1,905 bp) to sequences of concern at 97–100% identity. In one pool, assembly collapsed 1,634 individual BLAST results into 10 hits from a single contig, all assigned to the same source organism. PCA mode correctly distinguished assemblable from non-assemblable fragments within the same pool. Two pools with no assemblable structure yielded no contigs. OliGraph processed all pools in under 0.2 seconds, fast enough for real-time order screening and consistent with proposals to bring oligonucleotide orders within the scope of synthesis screening regulation.

Read More

BioRT-Bench: A Multi-Attack Red-Teaming Benchmark for Bio-Misuse Safeguards in Frontier LLMs

Frontier AI laboratories are expected to maintain safeguards against biological misuse, but whether deployed models actually refuse bio-misuse queries under adversarial pressure is largely unmeasured in the public literature. We introduce BioRT-Bench, a benchmark that runs four attack methods (direct request, PAIR, Crescendo, and base64 encoding) against four frontier models (Claude Sonnet 4.6, GPT-5.4, DeepSeek V4-flash, Kimi K2.5) across 40 prompts spanning five biosecurity-relevant categories. Responses are scored by a calibrated judge extending StrongREJECT with two bio-specific dimensions: specificity and actionability. We measure Attack Success Rate (ASR), where 0 means the model fully refused and 1 means it provided specific, actionable bio-misuse content. Our results reveal a sharp robustness divide: Chinese frontier models (DeepSeek, Kimi) have under 5% refusal rates even under direct request (ASR 0.88 and 0.79), while Western models (Claude, GPT) maintain substantially stronger safeguards (ASR 0.15 and 0.16). Crescendo is the most effective attack across all models, both in bypassing refusal and in eliciting actionable content. Claude Sonnet 4.6 is the most robust model tested, achieving 100% refusal against base64-encoded prompts.

Read More

This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.
Apart Research logo

Sign up to stay updated on the
latest news, research, and events

Google Scholar icon

Apart Research Inc · 1500 N Grant St, Ste R, Denver, CO 80203 · +1 (720) 408-1923

Apart Research logo

Sign up to stay updated on the
latest news, research, and events

Google Scholar icon

Apart Research Inc · 1500 N Grant St, Ste R, Denver, CO 80203 · +1 (720) 408-1923

Apart Research logo

Sign up to stay updated on the
latest news, research, and events

Google Scholar icon

Apart Research Inc · 1500 N Grant St, Ste R, Denver, CO 80203 · +1 (720) 408-1923

This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.
Apart Research logo

Sign up to stay updated on the
latest news, research, and events

Google Scholar icon

Apart Research Inc · 1500 N Grant St, Ste R, Denver, CO 80203 · +1 (720) 408-1923