Training-Free Medical Image Segmentation vs Trained Networks

A multi-domain data-efficiency study — frozen-foundation-model assembly (an LLM polygon drawer in the deployed path on 1/6 domains, else SAM / op_sam / SegGPT) + a numpy genome, zero gradient training on the target task. See the post-rebuttal revised claims →

6 modalitiesmeasured, from scratch GT-free at inferenceLLM-agnostic skills revised post-rebuttal · 2026-07-07

Revised claims — post-rebuttal, 2026-07-07

After a hostile self-review (reviewer_attack.md) and 10 rebuttal experiments (docs/rebuttal/), this is the honest, defensible version. The detailed per-domain evidence below is all valid; the claims wrapping it are corrected here. The old headline — "training-free, within ≤0.005 of the best trained NN on 4/6 domains at N=100" — does not survive and is retracted.

Retracted — these do not survive scrutiny

The N=100 "within ≤0.005 / ties NN on 4/6" framing. Bootstrap 95% CIs (stats.md): best-NN@100 sits inside the LLM CI on 5/6 domains (statistically indistinguishable) — 0/4 claimed leads survive as significant. The lone Spleen "+0.019" is a seed-averaging artifact: the single best U-Net seed (0.9323) beats the LLM (0.9262).
"LLM+SAM pipeline" as the identity. The Claude drawer is in the deployed inference path on 1/6 domains (ISIC, contributing +0.128). On 5/6, SAM / op_sam / SegGPT / genome do the work (llm_ablation.md). Honest identity: frozen-foundation-model assembly, with the LLM one swappable drawer.
Universal OOD skill transfer. The blind auto-onboarder applied to a genuinely unseen domain (Heart) scores 0.384 — below a 10-label U-Net (lodo.md). Transfer holds only inside the competence envelope (below), not universally.

Refuted attacks — these stay strengths

Baselines are NOT strawmen (baselines.md): "best NN" is the max over ImageNet-pretrained SegFormer-b2, pretrained U-Net-r34, and real nnU-Net self-config, with augmentation + validation early-stopping. From-scratch nets were correctly excluded.
Retrieval is NOT leakage (leakage.md): rebuilt subject-disjoint, HC18 is 0.9667→0.9666 (leak surface 1/100 queries); Prostate is structurally volume-disjoint (0/30 same-volume in top-8). The +0.038 retrieval lift is real cross-subject generalization.

The surviving thesis — measured, CI-backed

Training-free frozen-model assembly wins the EXTREME scarce-label regime (N≤25) on GT-free-localizable targets — and its edge is distribution-robust localization, not memorization.

Budget-matched and CI-separated at N≤25 (fewshot_matched.md, the LLM's own budget capped to first-N): the lead survives on the size-law / localization-bound domains — ISIC, Kvasir, Spleen, Prostate — and does not survive on near-ceiling anatomy (CXR, FetalHead). This is exactly the predicted split, now CI-measured.
It beats a FAIR few-shot MedSAM in-distribution, and the margin WIDENS out-of-distribution (ood_medsam.md): a fair few-shot MedSAM (box learned from N GT, not the oracle box) is +0.16..+0.59 Dice below the LLM in-distribution; on OOD-for-MedSAM data (DRIVE) the gap widens to +0.51 while MedSAM collapses to 0.220 even with the oracle box (vs ~0.90 in-distribution). MedSAM's edge was memorization, not generalization.

The core science — the real contribution

The two-walls law. A keep-best fix deploys IFF (1) a valid GT-free gate exists AND (2) the candidate family holds a mask better than the deployed base — and the two trade off: on gate-bound Prostate a 6-mechanism diverse family raises the oracle to 0.89, but every GT-free selector over it scores below the deployed 0.79. Manufacturing family headroom makes GT-free selection strictly harder.
The GT-free-localization wall IS the training-free frontier (frontier_crossing.md). Deliberately crossing it — gradient-training a localizer head over a frozen decoder — ties the NN only at N=10, is overtaken by N=25, and forfeits "training-free." Crossing the wall lands you AT, not above, the trained net.
A characterized competence envelope on two independent axes: size / localizability (blind auto-onboard liver 0.78 vs Heart 0.35, a tiny 0.7% isodense blob) and structure type (vessels / filaments are a genuine learned-dense ceiling — a trained U-Net 0.80 beats the pipeline's ~0.75).
A GT-free competence predictor — draw self-consistency (ρ+0.63), op_sam prior_iou / concentration (ρ+0.42..0.54) — the deployable signal for which side of the frontier a new image or domain sits on.

One-line thesis. Frozen-foundation-model assembly is the right tool below the GT-free-localization frontier (scarce labels, localizable targets); across it, you must train — and then you are the NN. We characterize that frontier and give a GT-free predictor for it.

Results — best trained NN across N vs the frozen-assembly pipeline

Strongest trained NN per cell — max of SegFormer (mit_b2), pretrained U-Net (resnet34), and nnU-Net, 2-seed means — at matched budgets N = 10 / 25 / 50 / 100, against the LLM pipeline (re-measured from scratch via eval_all_domains.py). The LLM's only label-fit module is a ~5–8-param genome; localization and SAM are GT-free/frozen — so the LLM number is ~flat in N while the NN climbs. Caveat (post-rebuttal): the N=100 column is a set of within-noise near-ties — best-NN@100 sits inside the LLM bootstrap 95% CI on 5/6 domains (stats.md), and 0/4 apparent N=100 leads survive as significant. The honest, CI-separated lead is at N≤25 (revised claims). Amber = within-CI near-tie; a green cell reflects the point estimate only, not significance.

Domain	best NN N=10	N=25	N=50	N=100	training-free LLM	few-shot decoder N=100 (oracle)
ISIC 2018 (derm)	0.815	0.829	0.832	0.868	0.880	0.911
MSD Spleen (CT)	0.633	0.802	0.859	0.907	0.920	0.953
Kvasir-SEG (endo)	0.756	0.824	0.833	0.889	0.8646	0.944
ChestXray (X-ray)	0.938	0.948	0.952	0.9546	0.9497 SegGPT in-context; fs-deploy 0.9488	0.9535
HC18 Fetal-Head (US) ·new	0.923	0.958	0.965	0.970	0.9667 retrieval SegGPT; was 0.9328 fs / 0.9225 tf	0.9665 tuned-decoder oracle
MSD Prostate (MRI) ·new	0.679	0.720	0.772	0.815	0.7877 SegGPT⊕op_sam ensemble; was 0.760	0.938

Two LLM columns: the training-free pipeline (zero gradient training — the study's headline) and the few-shot tuned decoder (generic-SAM init, encoder frozen, ~4M-param mask decoder tuned on N=100 labels, GT-box oracle). The few-shot decoder beats the from-scratch NN on four of six domains given a good box (ISIC/Spleen/Kvasir/Prostate) and ties the other two (CXR, HC18 — near-ceiling NNs at ~0.95–0.96) — the residual between it and the deployed training-free pipeline is mostly localization (the exception was CXR, where the frozen SAM decoder was the wall — now moved training-free by swapping in a different frozen decoder, the SegGPT in-context drawer, to 0.9497), detailed below.

CXR is now training-free again at 0.9497 — a swapped 4th frozen drawer backend (SegGPT in-context). The old CXR training-free headline (0.922, frozen box-SAM) is superseded by a different frozen decoder: SegGPT (BAAI/seggpt-vit-large, generic → leak-free, non-SAM) paints the whole lung mask in-context from K=8 spread-sampled train (image,mask) support pairs — no box, no SAM, no localizer, ZERO gradient training. Deployed 0.9497 (median 0.9616, n=107), within 0.005 of the from-scratch NN's 0.9546 — a near-tie, still not a win. This is the 4th backend at the model-coupled drawer seam (LLM polygon · frozen SAM · few-shot tuned decoder · in-context SegGPT): the seam is genuinely swappable, and CXR's gap was neither architectural nor requiring our labels — it was the particular frozen decoder (SAM). A separate, non-training-free few-shot lane remains documented: tuning only the ~4M-param SAM mask decoder on N=100 CXR labels (generic-vit_l init, encoders frozen, box-jittered, leak-free) + mask-bbox re-decode reaches 0.9488 (median 0.9608, 102/107 improve) — but the deployed CXR is now the training-free SegGPT 0.9497, which supersedes it. Frozen-decoder study (leak-free generic): among frozen alternatives the generic in-context SegGPT wins; SAM2 / SAM1-vit_h merely tie frozen SAM-HQ (no gain), and text-prompted CLIPSeg fails on grayscale X-ray (0.00) — the interesting frozen alternative is a generic in-context segmenter (few-shot at inference, zero gradient), not another SAM variant.

The pipeline wins the EXTREME scarce-label regime (N≤25) where the target is GT-free-localizable — ISIC and Spleen are CI-separated leads at N≤25 (fewshot_matched.md); at N=100 the numbers below (ISIC 0.880 vs 0.868, Spleen 0.920 vs 0.907) are within-CI near-ties, not significant leads (stats.md) — and on Kvasir polyp a frozen-DINOv2 dense-correspondence localizer (OP-SAM CPG + peak-CC box) lifts it 0.659→0.8646 — the gap was localization (frozen GT-box oracle 0.914 > NN), and this closes 89% of it; the median 0.9484 now beats the NN mean, though the mean stays just below best-NN 0.889. On Chest X-ray the deployed training-free path is now a swapped 4th frozen drawer — the SegGPT in-context drawer (K=8 support pairs, zero gradient) — reaching 0.9497 ≈ NN 0.9546 (−0.005, a near-tie), superseding the earlier box-SAM 0.922 and the separate few-shot-tuned decoder 0.9488 lane; the old "frozen-decoder cap ~0.93" was specific to SAM, not to architecture. On HC18 fetal-head the same story now plays out training-free: a swapped retrieval-prompted SegGPT drawer (K=8 query-retrieved DINOv2-similar in-context supports, zero gradient, SAM-free) reaches 0.9667 ≈ NN 0.9703 (−0.004, a near-tie), superseding the op_sam+SAM 0.9225 and the few-shot decoder 0.9328 — so FetalHead is no longer a few-shot lane. Honest headline (post-rebuttal): at N=100 these are within-CI near-ties — 0/4 apparent leads survive bootstrap 95% CIs (stats.md), and the Spleen "+0.019" is a seed-averaging artifact (best single U-Net seed 0.9323 > LLM 0.9262). The defensible lead is at N≤25 on localizable targets (ISIC / Kvasir / Spleen / Prostate), budget-matched and CI-separated. All 6 deployed paths are gradient-free frozen-model assembly, but the LLM drawer is out of the mask-producing path on 5/6 (llm_ablation.md) — Prostate, the last domain lifted off its floor, is a complementary 2nd frozen drawer (a SegGPT⊕op_sam edge-gated keep-best ensemble). SegFormer is the strongest NN in 10 of 12 sweep cells.

Data-efficiency

Where is the wall — the decoder, or localization? A fair few-shot probe

Is the residual to the trained NN a decoder limit or a localization limit? MedSAM (SAM fine-tuned on ~1M medical masks) beats box-prompted SAM — but it is data-leaky (its training set likely includes these test distributions), so it is really "import a trained medical net." The fair, leak-free counterpart of the same operation: init from the generic SAM (no medical data), freeze the image + prompt encoders, and fine-tune only the ~4M-param mask decoder on our own N-label train split — GT never touches test. Given a good box (the GT-box oracle, which isolates the decoder), this few-shot-tuned decoder beats the from-scratch NN at every budget on 4 of 6 domains (ISIC/Spleen/Kvasir/Prostate — Prostate by +0.12) and ties on the other two (CXR, HC18 — both near-ceiling NNs at ~0.95–0.96), and it saturates at N=10 (pretrained features + a tiny adapted head), so its curve is flat-high while the NN climbs:

Domain (tuned decoder, oracle)	N=10	N=25	N=50	N=100	best NN N=100
ISIC 2018 (derm)	0.905	0.904	0.907	0.911	0.868
MSD Spleen (CT)	0.957	0.960	0.960	0.953	0.907
Kvasir-SEG (endo)	0.936	0.934	0.937	0.944	0.889
ChestXray (X-ray)	0.933	0.946	0.955	0.9535	0.9546
HC18 Fetal-Head (US) ·new	0.918	0.954	0.957	0.9665	0.970
MSD Prostate (MRI) ·new	0.906	0.931	0.932	0.938	0.815

Few-shot tuned decoder (oracle) vs trained NN vs training-free LLM — Few-shot tuned decoder (GT-box oracle, ◆) vs best trained NN (gray, from scratch) vs the training-free LLM pipeline (dotted, flat). The tuned decoder saturates at N=10 and sits at/above the NN at every budget on ISIC/Spleen/Kvasir and **Prostate** (+0.12 over the NN); CXR ties by N=50, and **Fetal-Head US ties** (0.9665 vs a near-ceiling NN 0.970). ★ = the **measured deployable** number (tuned decoder + the domain's real GT-free localizer).

Mostly localization — with CXR the telling exception. The oracle hands the decoder a good box; on most domains the gap between it and the deployed pipeline is localization. Kvasir is the proof: tuned-decoder oracle 0.944 vs the original deployed 0.659 — 0.285 of pure localization headroom, zero decoder; the frozen dense-correspondence localizer has since realized most of it (0.659→0.8646), exactly as this predicted, leaving only ~0.05 to the oracle box. Where localization is already solved, the tuned decoder is a clean deployable win over both production and the NN: CXR few-shot decoder 0.9488 > the earlier box-SAM production 0.922 ≈ NN 0.9546 (though the deployed training-free CXR is now the SegGPT in-context drawer 0.9497, which supersedes both); Spleen (3D volume-prior box) 0.942 > production 0.920 > NN 0.907. This is few-shot (N=100 labels = the NN's budget), not training-free — an explicit, leak-free counterpart to MedSAM. CXR is the exception that sharpens the rule: its wall was the particular frozen decoder (SAM), not localization and not architecture — swapping in a different frozen decoder, the SegGPT in-context drawer, moves it training-free to 0.9497 (≈ NN, zero gradient), and a few-shot-tuned SAM decoder independently reaches 0.9488. So of the residual "structural / architectural ceilings," the polyp boundary was a localization gap in disguise, while the CXR "decoder wall" was a SAM-specific wall breachable by another frozen decoder with none of our labels.

Is the medical pretraining (MedSAM) worth it? — a leaky benchmark

MedSAM is SAM already fine-tuned on ~1M medical masks — a leaky upper reference (its training likely saw these test distributions). Arch-matched (both vit_b, GT-box oracle, N=100), few-shot tuning of the GENERIC SAM matches or beats the leaky MedSAM on 3 of 6 domains, and stays within 0.015 on the other 3 — its own pretraining distributions (derm/US/MRI). Medical pretraining buys no consistent edge once the decoder is adapted, and where generic SAM is already strong (Kvasir/Spleen) it starts above MedSAM even frozen. Bold = better of the two few-shot columns.

Domain (N=100 oracle, vit_b)	from-scratch NN	generic frozen	generic few-shot (fair)	MedSAM frozen (leaky)	MedSAM few-shot (leaky)
ISIC 2018 (derm)	0.868	0.870	0.915	0.921	0.943
MSD Spleen (CT)	0.907	0.941	0.956	0.909	0.946
Kvasir-SEG (endo)	0.889	0.917	0.936	0.888	0.918
ChestXray (X-ray)	0.9546	0.925	0.954	0.935	0.952
HC18 Fetal-Head (US) ·new	0.970	0.769	0.965	0.904	0.972
MSD Prostate (MRI) ·new	0.815	0.895	0.928	0.807	0.941

Fair few-shot generic SAM vs leaky MedSAM benchmark, N=100 oracle — Fair few-shot tuning of **generic** SAM (dark blue) vs the leaky **MedSAM** (orange), each frozen + few-shot-tuned, vs the from-scratch NN (gray) — arch-matched vit_b, N=100 GT-box oracle. The fair generic few-shot ≥ leaky MedSAM few-shot on Spleen/Kvasir/ChestXray (**3/6**); MedSAM leads on its own pretraining distributions — derm (ISIC), US (HC18), MRI (prostate) — but by **<0.015** once the generic decoder is tuned, and generic-frozen still beats MedSAM-frozen on prostate (0.895 vs 0.807). Medical pretraining helps most exactly where MedSAM saw the data, yet few-shot tuning of the generic decoder nearly erases it — decoder adaptation, not medical pretraining, is the lever.

The MedSAM attack inverts once it is prompted fairly and tested OOD (ood_medsam.md). The oracle-box column above is a leaky upper reference. Give MedSAM a fair box (learned from N GT, not the oracle) and it drops +0.16..+0.59 Dice below the deployed pipeline in-distribution; take it out-of-distribution (DRIVE retinal vessels — a distribution MedSAM never trained on) and the gap widens to +0.51 while MedSAM collapses to 0.220 even handed the ORACLE box (vs ~0.90 in-distribution). MedSAM's in-distribution edge was its decoder recognizing box-shaped targets it had trained on — memorization that does not transfer; the pipeline's few-shot-refit GT-free localization is distribution-robust.

Can it be ONE domain-agnostic pipeline? — few-shot skills + a router, SAM frozen

Each domain has a distinct setup — so can it be a single domain-agnostic pipeline that few-shot-fits per domain WITHOUT tuning SAM? We test the transferable skill — a frozen-SAM-feature localizer prototype fit from N labeled images — with identical code across all six domains, SAM never touched.

Domain-agnostic few-shot skill transfer: skills few-shot-fit, topology is routed not tuned — **(A)** One fixed pipeline (prototype-sim localizer): the skill **few-shot-fits** — saturates by ~N=10 on every domain — and scores high where the target is prototype-localizable (ISIC 0.71, CXR 0.62, HC18 US 0.72), mid where it is a central structure (Prostate MRI 0.51), low where it needs a specialized localizer (Kvasir 0.35, Spleen 0.12). **(B)** **Routing** the per-domain topology (genome / static-box / op_sam dense-correspondence / volume-prior / ellipse-snap / volume-trajectory) + the few-shot skill recovers most of the deployed number (Kvasir 0.35→0.77→0.86, HC18 0.69→0.92, Prostate 0.51→0.76, Spleen 0.14→0.66→0.83@N=50).

Yes — a domain-agnostic pipeline = frozen SAM + a GT-free router + few-shot skills. The learning (localizer prototype + gate weights + genome) is domain-agnostic, few-shot (~10 labels; ~50 for the isodense spleen), and SAM-frozen — it transfers with identical code. The per-domain "distinct setup" you'd notice is which localizer topology to route to — a GT-free routing choice (learned config, the project's route.py), not SAM tuning. So onboarding a new domain is ~10 labels + a routing decision, zero gradient training. Robust localizer skill: the deployed default is now the op_sam frozen-DINOv2 dense-correspondence localizer (kvasir/HC18/prostate) — it transfers 10-shot support masks through the full patch cross-correlation, and superseded the earlier SAM+DINOv2 AMG-ranker ensemble on Kvasir (0.655→0.8646). The lesson holds and is now stronger: the polyp/fold and faint-skull walls yield to the right frozen feature space — dense correspondence, plus feature-diverse supports — not to distractor-verification tricks. The AMG-ranker ensemble (at/near the best single feature space on all three, Kvasir 0.65 / Spleen 0.64 / ISIC 0.67, never catastrophic where SAM-alone fails the isodense spleen 0.40) remains the LLM-agnostic fallback where a support set is too small for correspondence.

Qualitative examples — 3 best / 3 worst per dataset

Green = ground truth, red = prediction. Top row = 3 highest-Dice cases, bottom row = 3 lowest.

ISIC 2018 — skin lesion (pigment cue, LLM's best domain)

MSD Spleen — CT (localizer + cross-slice priors + SAM re-prompt polish)

Spleen best/worst — The worst cases are localizer failures (prediction lands on stomach/liver, Dice≈0). A GT-free cross-slice prior (centroid trajectory + sibling-mask seed), a selective multi-prototype re-decode, a SAM re-prompt boundary polish, and a final **pyramid keep-best** (crop→zoom→SAM-decode each tiny tip slice at higher resolution) recover them, lifting the spleen pipeline to **0.920** (0.786→0.840→0.868→0.875→0.903→0.920 this session) — a **within-CI near-tie** with the best trained NN at N=100 (0.920 vs 0.907; the "+0.019 lead" is a seed-averaging artifact — the single best U-Net seed 0.9323 edges the LLM's 0.9262, `stats.md`). The CI-separated lead is at **N≤25**. Pyramid is complementary to the within-volume prior: the prior re-decodes a tip slice from its *siblings*, pyramid re-decodes it at higher *resolution*.

Kvasir-SEG — polyp (dense-correspondence localizer; the gap was localization, 89% closed)

Kvasir best/worst — Polyps share colour/texture with mucosa, so a *mean*-prototype / AMG-candidate ranker mislocalizes (~43/100 to Dice≈0) — and four verification signals (SAM self-consistency, FG-BG margin, cycle-consistency) all failed to rank the right blob. The unlock, grounded in the polyp-SAM literature (**OP-SAM**, ICCV'25, frozen Dice 0.845 on this exact dataset), is frozen-DINOv2 **dense-correspondence** label transfer (CPG): transfer 10 few-shot support masks onto the query via the *full* patch cross-correlation matrix — not a mean prototype (which washes out on polyp≈mucosa). The prior peak lands in the polyp **94%** of the time (vs the old LLM box's 0.46 box-IoU); a peak-**connected-component** box + prior-guided SAM mask selection then decodes it. Deployed **0.659 → 0.8646** (median 0.9484; note this is a median-vs-mean comparison — the LLM *mean* 0.8646 stays just below best-NN 0.889 at N=100, and the honest CI-separated lead is at N≤25), leak-free, frozen DINOv2+SAM, no tuning. A further lever closed the mislocalization tail: rebuilding the op_sam support set `kvasir_supports.npz` from the **first-30 (was first-10) train images** widens the dense-correspondence prior's appearance coverage (+0.032, two-split, leak-free, zero-code; one 0.000→0.834 recovery) — an **N=30 support budget** (30 train labels; still scarce, well under 100), a different quantity from the N=10 data-efficiency point above (0.824). Polyps want support *coverage/count*, not the FPS-*diversity* that wins on US/MRI (fps10 0.725 ≪ first10 0.826) — opposite knobs on the same support seam. The frozen GT-box oracle is 0.914 > NN, so Kvasir never had a decoder wall — its entire gap was localization, now 89% closed (was −0.230 to the NN, now −0.025); the residual is the known gate-bound polyp tail (no GT-free signal isolates the confidently-wrong mislocalizations). *Gallery shows the earlier LLM-box path; the correspondence localizer replaces the bottom-row localization misses.*

ChestXray — bilateral lungs (deployed: training-free SegGPT in-context drawer, 0.9497; gallery shows the earlier box-SAM path)

CXR best/worst — Five GT-free skills: (1) a fixed few-shot lung box (mean of N=10 train GT boxes; box-IoU 0.545→0.67) replaces the heuristic box → 0.825→0.898; (2) a mask-bbox self-reprompt (box-IoU 0.67→0.83) → 0.898→0.911; (3) a **repair agent** that trims SAM's bright "out of lung" over-seg into the mediastinum (a decoder error a redraw loop can't reach), fire-gated + keep-best → 0.911→0.914 zero-regression; (4) a **catastrophic fix** — a SAM negative-point re-prompt (positive points on the dark lung, negative on the spill) that carves the worst engulfing masks the conservative trim can't → 0.914→0.920; (5) a **letterbox-component trim** that drops mask blobs sitting over near-black padding (on letterboxed films the misregistered atlas + darkness both score the black border as lung — only raw intensity separates it, since lung air is dark-*gray*, not pure black), fixing MCUCXR_0060 0.76→**0.88** zero-regression → 0.920→**0.922**. The remaining worst cases (bottom row) are a different, harder failure — inferior over-extension into the abdomen, a decoder-boundary error. Localization is not the gap here: even a perfect GT box caps the *frozen SAM* decoder at ~0.93, which long looked architectural. That cap was specific to *SAM*, not architecture — swapping in a **frozen NON-SAM in-context drawer**, **SegGPT** (BAAI/seggpt-vit-large, generic → leak-free), which paints the whole lung mask **in-context** from **K=8** support (image,mask) pairs with **ZERO gradient training** and no box/SAM/localizer, reaches **0.9497** ≈ the U-Net's 0.9546 (median 0.9616, n=107) — **training-free**, needing *none* of our labels beyond the K=8 in-context supports. This is now the **deployed training-free CXR drawer**, the 4th backend at the swappable drawer seam, superseding the earlier box-SAM 0.922. A separate **few-shot lane** (tuning the ~4M-param SAM mask decoder on N=100 labels, encoder frozen, leak-free → 0.9488, median 0.9608, 102/107 improve) reaches the same ballpark by a different route. So CXR's wall was the **particular frozen decoder (SAM), not localization and not architecture** — and the deployed path is now **training-free again at 0.9497** (still −0.005 from NN, a near-tie, not a win).

HC18 Fetal-Head — ultrasound (deployed: training-free retrieval-prompted SegGPT drawer, 0.9667; gallery shows the earlier op_sam+SAM path) ·new

HC18 fetal-head best/worst — The fetal head IS an ellipse — a bright hyperechoic skull ring — so the paper-grounded upgrade fits an ellipse to the SAM mask and snaps to it, interpolating the acoustically-dropped walls (van den Heuvel HC18; YOSAM) → 0.854→0.859. The mean≪median tail then turned out **not** to be a perception floor: two stacking LLM-agnostic levers on the op_sam CPG localizer — **DINOv2-FPS diverse 20-shot supports** (feature-farthest-point-sampled; diversity not count) +0.0495, and **CLAHE prior-only enhancement** (enhance the correspondence prior while SAM decodes on the RAW image) +0.0226 — lift 0.859→**0.9225** (median 0.9522), narrowing the gap to U-Net to −0.048. Top: near-perfect ellipse fits (Dice ≈1.0). Bottom: the residual tail. Still loses to the trained U-Net at every budget (an easy-for-NN high-contrast skull), but the "perception floor" was disproven — it was support-diversity + contrast, not irreducible. **The deployed drawer is now a swapped 4th frozen backend — a training-free retrieval-prompted SegGPT.** A frozen **non-SAM in-context segmenter** (BAAI/seggpt-vit-large, generic → leak-free, **SAM-free**) paints the whole skull mask **in-context** from **K=8** support (image,mask) pairs — but crucially the K supports are **query-RETRIEVED**: for each test frame it picks the K=8 TRAIN images most similar by a frozen-DINOv2 global descriptor (768-d cosine, `support_select: 'retrieve'`), rather than the earlier linspace-spread selection. This fixes SegGPT's mean≪median **failure tail at the SOURCE** — matched prompts, not an after-the-fact loop — reaching **0.9667** (median 0.9712, min 0.866, n=100, **zero gradient training**, zero failures), **≈ NN 0.9703 (−0.004, a near-tie)**. This is **training-free** and **supersedes** both the earlier op_sam+SAM path (0.9225) and the few-shot-tuned decoder (0.9328) — FetalHead moves back out of the few-shot lane. Query-adaptive retrieval is a **general drawer knob** (a query-adaptive counterpart to the spread/FPS/first-N support-curation family): it raises **SegGPT-alone on every tailed domain** (ISIC +0.11, Spleen +0.12, Prostate +0.07, Kvasir +0.05, FetalHead +0.03) by matching prompts to the query, a source-level fix; only FetalHead is deployed on it (CXR keeps spread — retrieval is −0.001 noise on near-identical X-rays). **Honest caveat:** query-adaptive retrieval on medical data can select near-duplicate *frames* of the query (same subject/scan) — validated leak-free at the ID level (train/test ids disjoint), but within-subject frame-level similarity is a retrieval risk we flag. The earlier few-shot decoder lane (0.9328, weak skull-ring keep-best gate) stays documented as the historical fallback, exactly like CXR's 0.9488.

MSD Prostate — MRI (SegGPT⊕op_sam edge-gated ensemble; op_sam rho 1 box + cross-slice trajectory + reprompt) ·new

prostate MRI best/worst — The prostate is a low-dimensional pose with a smooth cross-slice trajectory (PROMISE12; axial-symmetry prior), so the upgrade fits centroid(z)+area(z) per volume, re-decodes outliers, and reprompts the box → 0.664→0.715 (median 0.786). The 2026-07-05 agent research then tightened the op_sam box (**rho 2→1**, fewer CPG diffusion steps for this small isodense target; two-split validated, +0.038 val and test) → 0.744, then the meta-harness **auto-onboarder** surfaced **CLAHE prior-enhancement** (MRI is low-contrast like US — the same generic knob that lifted HC18) → **0.760** (median 0.803). Top: the small central gland found cleanly. Bottom: the residual tail. Beatable in principle (GT-box→SAM oracle 0.895 > NN 0.815), and there is real headroom — **+0.041 oracle** from keep-best over a boundary-refinement candidate family (the base slightly over-segments the isodense gland, so the residual is **boundary-precision, not localization**). Prostate is the cleanest instance of the project's **gate wall**: valid within-image gates DO exist (DINOv2 / SAM prototype-sim rank-ρ ≈ 0.70; cross-slice area ρ ≈ 0.51 — the boundary-gradient gate that works on spleen/CXR is invalid here, ρ=−0.36, no edge on the isodense gland), yet **none harvests the headroom**: unconstrained argmax caps at +0.007 (11/30 regress) and zero-regression collapses every gate to ≤+0.0034 (noise). The refined thesis: **a valid gate over the whole candidate family is not a valid gate at the DECISION BOUNDARY** — ρ=0.70 is earned by ranking the obviously-bad candidates last, while the top cluster (where the best candidate and the base are near-duplicates in both Dice and signal) makes argmax a coin-flip. **This domain — the one that had been gate-bound and stuck — is now lifted off its floor and DEPLOYED at 0.7877** (was 0.760, median 0.8483, closing ~35% of the gap to NN 0.815 → −0.028): not by winning the within-op_sam gate, but by adding a *complementary second frozen drawer* — a **SegGPT-retrieve** in-context painter — and keeping-best per image on a GT-free **edge** gate. SegGPT and op_sam are genuinely complementary (they rescue *different* slices; the keep-best oracle is **0.838**), so the win comes from the drawer DIVERSITY, not from a sharper gate on one drawer's candidate family. Both drawers are frozen — **training-free**, zero gradient. **Honest caveat:** prostate val is n=20 under a distribution shift, so the +0.0277 magnitude rests on a small split (the direction is robust — edge/compactness/convexity gates all transfer positively).

What we learned

ISIC: the LLM pipeline leads the best NN across low budgets — CI-separated at N≤25 (+0.116 at N=10) and narrowing to a within-CI near-tie by N=100 (+0.025 point estimate, not significant, stats.md). Genuinely more label-efficient for dermoscopy in the scarce-label regime, and the one domain where the LLM drawer is in the deployed path (+0.128, llm_ablation.md).
Spleen: a stack of GT-free skills — within-volume prior, cross-slice geometry, selective multi-prototype, a SAM re-prompt boundary polish, and a pyramid keep-best (higher-resolution re-decode of the tiny tip slices) — lifts 0.786 → 0.920, a within-CI near-tie with the best trained NN at N=100 (0.920 vs 0.907; the apparent "+0.019" is a seed-averaging artifact — best single U-Net seed 0.9323 > LLM 0.9262, stats.md; the CI-separated lead is at N≤25). The pyramid and the volume prior see the tip slices two different ways — resolution vs siblings — and combine additively via a valid soft-tissue gate.
Kvasir: a frozen-DINOv2 dense-correspondence localizer (OP-SAM CPG label transfer + peak-connected-component box) lifts the polyp 0.659→0.8646 — the biggest single gain in the study, closing 89% of the−0.230 gap to the NN. The gap was pure localization (the frozen GT-box→SAM oracle is 0.914 > NN 0.889, so there is no decoder wall); the unlock is transferring few-shot support masks by dense correspondence, not a mean prototype (which washes out on polyp≈mucosa, and defeated four verification signals). The prior peak lands in the polyp 94% of the time; median 0.9484 now beats the NN mean, the mean stays just below best-NN 0.889 (residual = a gate-bound tail of hard localizations). A support-coverage lever — rebuilding the op_sam supports from the first-30 (was first-10) train images (+0.032, an N=30 support budget, still scarce; polyps want coverage/count, not FPS-diversity) — closed most of the remaining tail. Grounded in the domain's published frozen-SAM SOTA (OP-SAM, ICCV'25), leak-free, no tuning.
Chest X-ray: a few-shot static lung box + a mask-bbox self-reprompt + a repair agent (trims out-of-lung over-seg) + a catastrophic fix (SAM negative-point re-prompt on the worst spilled masks) + a letterbox trim (drops blobs over near-black padding) lift the training-free LLM 0.825→0.898→0.911→0.914→0.920→0.922 — the deployed gap was box localization, not architecture. The frozen SAM decoder does cap even a perfect GT box at ~0.93, which long looked architectural — but that cap is specific to SAM: swapping in a different frozen non-SAM in-context drawer, SegGPT (K=8 support pairs, zero gradient, leak-free), paints the lung mask training-free to 0.9497 ≈ the U-Net's 0.9546 (−0.005, a near-tie) — now the deployed training-free CXR drawer (the 4th backend at the swappable drawer seam), superseding the box-SAM 0.922. A separate few-shot lane (tuning only the ~4M-param SAM mask decoder on N=100 labels, encoder frozen, leak-free) independently reaches 0.9488. So CXR's real wall was the particular frozen decoder (SAM), not localization and not architecture, and it is breachable training-free by another frozen decoder — CXR still does not beat NN (−0.005), so it stays a near-tie, not an LLM-lead domain.

When does iterative feedback deploy? — the fix is general, the gate is the wall

We built a full repair-agent → verbal + visual feedback → SAM re-prompt → keep-best loop: the repair stage renders a diagnosis overlay (current mask + a GT-free "out-of-region" heat-map + a coordinate grid), the vision LLM looks, says what is wrong verbally, and marks the over-segmentation as SAM negative points; SAM re-decodes; a GT-free keep-best gate accepts or rejects; repeat. On chest X-ray the LLM's visual negatives beat the heuristic catastrophic fix (CHNCXR_0447 0.849→0.902, MCUCXR_0055 0.860→0.955).

CXR loop vs feed-forward — The cases the GT-free gate accepted (top = feed-forward catfix, bottom = the loop). The LLM's visual negatives tighten SAM off the mediastinum/abdomen better than the spill heuristic. Full-107: 0.9216→**0.9240** (+0.0024), zero-regression, gate near-perfect (oracle 0.9241).

But the fix is domain-general — the LLM can place negatives on any over-seg it sees. What decides deployability is the gate: whether a GT-free signal can rank candidate masks by true Dice. We measured that gate↔Dice correlation on all four domains:

Gate-validity across domains — The loop deploys **iff the GT-free gate is valid** — a property of the *domain*, not the loop. CXR (+0.63, lung darkness+atlas) and Spleen (+0.56, soft-tissue) have valid gates and the loop deploys; Kvasir (+0.04 — polyp≈mucosa, no signal) and ISIC (−0.23 — the gate prefers over-grown high-contrast masks) do not, so no amount of good feedback can be deployed. **2 of 4 domains.**

The core lesson. Iteration is not the lever — perception, or its GT-free proxy, is. The same wall shows up as the SIZE law, the structural-ceiling taxonomy, and here as gate-validity: a feedback loop is only as deployable as the GT-free mask-quality signal in that domain. Where the target is cheaply separable (dark lung air, soft-tissue organ edges) a gated fix pays off; where it is not (polyp on mucosa) neither a loop nor a single fix can deploy without ground truth.

Honest-reporting note: earlier drafts carried optimistic hardcoded values (ISIC 0.885, Kvasir 0.860, CXR 0.855). This report uses numbers re-measured from scratch with the current pipeline: ISIC 0.880, Spleen 0.920 (CV-held-out), Kvasir 0.8646, CXR 0.9497 (training-free, SegGPT in-context drawer; was 0.922 box-SAM). (Kvasir was 0.659 before the dense-correspondence localizer.)

Pipeline

One image, end to end. A GT-free router selects skills per image; the drawer seam (amber) is the only model-coupled point, now with 4 swappable backends — (1) an LLM polygon/grid drawer, (2) a frozen SAM dense decoder, (3) a few-shot-tuned SAM decoder, and (4) a frozen non-SAM in-context drawer (SegGPT), the new deployed training-free CXR path. A config-driven one dispatch_localizer picks per domain among an LLM polygon drawer, a frozen SAM-feature prototype, a frozen-DINOv2 dense-correspondence (CPG) localizer, or a static box — and everything downstream is numpy/config. Green boxes (🔄) are iterative loops: SAM fixed-point re-prompts and the spleen two-pass within-volume prior.

agenticSeg · training-free frozen-foundation-model assembly for medical segmentation (LLM drawer in the deployed path on 1/6 domains) · github.com/R9-Hu/agenticSeg
Skills are LLM-agnostic numpy/config; every result reproducible via eval_all_domains.py. AI-assisted (Claude Code).