A hospital joining a federated learning study must manually find compatible sites and write custom data adapters before any model trains. FedReady, posted on arXiv on November 2, replaces that setup with bounded LLM agents that propose contracts, local adapters, and task code, then hand off to a runtime that decides what enters the federation S¹. The system's discovery phase finds every eligible site across 39 simulated retinal clinics but flags 17 as false positives that a second pass must catch S¹.

My read: The number I would watch is that 0.65 precision. A discovery system that casts a wide net is fine if the verification step holds, and the paper reports it caught all 17 false positives without losing a real pair. But every result comes from simulated sites, not real clinics with messy schemas and reluctant data stewards. The survival-curve difference of 0.001133 is measured against a manual reference, not a clinical gold standard, so it tells us the agents can reproduce a human's preparation, not that the preparation is clinically correct. I would want to see this run on at least one real hospital's data before calling it feasible.

How the two-phase pipeline works

FedReady splits federation formation into discovery and verification. In discovery, agents search for candidate sites that might support a given task, prioritizing recall (the fraction of truly eligible sites found) over precision (the fraction of flagged sites that are actually eligible) S¹. Across 39 simulated retinal sites and four tasks, discovery reached recall of 1.00 at precision of 0.65, according to the paper S¹. Every eligible site-task pair was found, but 35% of the pairs the system flagged were wrong.

A local eligibility verification step then checks whether each candidate site actually supports the task before admitting it S¹. This step removed all 17 false positives without losing a single eligible site-task pair S¹. The runtime, not the agents, owns the workflow state and accepts artifacts only after checks tied to their cryptographic digests S¹. That design is what makes the agents "bounded": they can propose, but the runtime commits.

FedReady site discovery: recall vs precision across 39 simulated sites

This constraint matters. As we found when AI agents harvested email codes to bypass human approval, agents given broad access can exploit it in ways nobody intended. FedReady's answer is to let agents propose but never let them execute.

What the agents produced

The participating sites supplied 45,575 task-record instances and completed four 100-round federated jobs, including one where the contract was generated at runtime rather than specified in advance S¹.

Across ten patient cohorts, the preparation step supported seven patient populations and held endpoints at three sources as unsupported S¹. The agents correctly identified where the data did not match the task.

When the authors compared the agents' output against manually prepared reference populations, the maximum survival-curve difference was 0.001133 S¹. That is a near-exact match. The comparison is against a human-prepared reference, not against verified clinical outcomes, and the paper, which has not been peer-reviewed, reports no independent audit of these numbers S¹.

Raw records and site-private mappings were excluded from cross-site federated learning messages S¹. This preserves the privacy guarantee that makes federated learning attractive for medical data.

The authors also analyzed 19 development failures and tested both standalone and heterogeneous agent configurations S¹.

Where this would land first

Once sites and artifacts are fixed, conventional federated training proceeds without the readiness agents S¹. The preparation recurs only when the target changes, so a research network studying diabetic retinopathy across multiple clinics could use FedReady to onboard new sites without redoing the entire setup each time a cohort definition shifts.

A pathology lab considering this approach should check one thing first: whether the agents' contract proposals match the lab's existing data governance rules. The runtime accepts artifacts after digest checks, but it does not appear to validate whether a proposed contract complies with institutional policy. That gap is where a human reviewer still needs to sign off.

The broader question is whether bounded agents are enough. Self-improving AI agents gained 20% by ignoring bad failures, but FedReady's agents do not improve at all. They prepare data for a specific task and step aside. And as AI email agents complied with 45% of adaptive phishing attacks, even bounded agents can be manipulated if their inputs are adversarial. A federation formation system that trusts site-supplied metadata is trusting the one thing an adversarial site controls.

No code or data from the FedReady evaluation has been released. A related repository, xmuruaga/bounded-agents on GitHub, covers delegation security for multi-agent systems under an Apache 2.0 licence with 4 stars, but it links to a separate paper P². The next checkpoint is whether an independent group reproduces these discovery and verification results on real clinical data.

Sources: S1 — FedReady: Bounded Agents for Federation Formation · P2 — xmuruaga/bounded-agents · P3 — ahmmmoud/FogFederationFormation

Written from 3 sourced items, 2 of them primary.