Training-Free Medical Image Segmentation vs Trained Networks

A multi-domain data-efficiency study — frozen-foundation-model assembly (an LLM polygon drawer in the deployed path on 1/6 domains, else SAM / op_sam / SegGPT) + a numpy genome, zero gradient training on the target task. See the post-rebuttal revised claims →

6 modalitiesmeasured, from scratch GT-free at inferenceLLM-agnostic skills revised post-rebuttal · 2026-07-07

Data-efficiency

The crossover — one panel per domain

Dice vs. label budget for the training-free LLM and the strongest trained net, regenerated from the same baselines_dataeff.json grid as the detailed CI figure below (so they agree). Where the lines cross is where enough labels make the net worth training.

▬ LLM training-free · ▬ strongest trained net (best of nnU-Net / SegFormer / U-Net) · large dot = N=100 endpoint

ISIC 2018 · dermoscopyLLM leads at every N

Kvasir · endoscopy polypNN ends ahead

MSD Spleen · CTLLM ends ahead

MSD Prostate · MRINN ends ahead

Chest X-ray · lungnear-tie

HC18 FetalHead · ultrasoundnear-tie

CI completing — the 3-seed CI sweep is still running (prostate + kvasir N=50 nnU-Net in progress). Prostate N=100 is contested: the old best-NN was 0.786 (LLM-leading), but a fresh 3-seed first-N nnU-Net scores 0.845 — which flips Prostate to NN-leading at N=100 (LLM 0.801). The robust story is the scarce regime (N≤10).

Detailed data-efficiency figure — 6 panels with 3-seed CI whiskers (same grid as the crossover)

Matched data-efficiency: training-free LLM pipeline (flat, measured) vs best trained NN across N — Six domains. Each panel: the best trained NN (gray, climbing with N) vs the training-free LLM pipeline (colored flat dashed — a single measured Dice; ~N-independent, since only a ≤40-label genome is fit; dotted = LLM median where a localization tail matters). Shading marks where the LLM leads; the bold label is its point-estimate margin at N=100. **Post-rebuttal caveat:** the N=100 margins on **ISIC** (0.880, +0.012) and **Spleen** (0.920, +0.013) are *within bootstrap 95% CIs* — near-ties, not significant leads (Spleen's is a seed artifact); the CI-separated lead is at **N≤25**. The LLM leads the best NN at N=10 and ties it at N=25 on **Kvasir** (0.824 vs best-NN 0.756/0.824 at those support budgets; the full-budget deployed number is 0.8646 at N=30 supports, the dense-correspondence localizer), and near-ties on **Chest X-ray** (deployed training-free **0.9497** via a swapped frozen non-SAM **SegGPT in-context drawer**, −0.005 from NN 0.9546) and the two new localizer modalities — **HC18 ultrasound** (deployed training-free **0.9667** via a swapped **retrieval-prompted SegGPT drawer**, median 0.9712, −0.004 from NN 0.9703 — a near-tie) and **prostate MRI** (deployed training-free **0.7877** via a complementary **SegGPT⊕op_sam edge-gated keep-best ensemble**, median 0.8483, −0.028 from NN 0.815). Both new modalities were lifted by the recent agent research (HC18 to **0.9667** via K=8 query-retrieved DINOv2-similar in-context supports, superseding the op_sam+SAM 0.9225 and the few-shot decoder 0.9328; prostate 0.715→0.744→0.760→**0.7877** — the op_sam box tightening + CLAHE prior-enhancement, then a per-image keep-best ensemble with a frozen SegGPT-retrieve drawer that rescues the slices op_sam misses, both drawers frozen/training-free).

Results — best trained NN across N vs the frozen-assembly pipeline

Strongest trained NN per cell — max of SegFormer (mit_b2), pretrained U-Net (resnet34), and nnU-Net, 2-seed means — at matched budgets N = 10 / 25 / 50 / 100, against the LLM pipeline (re-measured from scratch via eval_all_domains.py). The LLM's only label-fit module is a ~5–8-param genome; localization and SAM are GT-free/frozen — so the LLM number is ~flat in N while the NN climbs. Caveat (post-rebuttal): the N=100 column is a set of within-noise near-ties — best-NN@100 sits inside the LLM bootstrap 95% CI on 5/6 domains (stats.md), and 0/4 apparent N=100 leads survive as significant. The honest, CI-separated lead is at N≤25 (revised claims). Amber = within-CI near-tie; a green cell reflects the point estimate only, not significance.

Domain	best NN N=10	N=25	N=50	N=100	training-free LLM	few-shot decoder N=100 (oracle)
ISIC 2018 (derm)	0.815	0.829	0.832	0.868	0.880	0.911
MSD Spleen (CT)	0.633	0.802	0.859	0.907	0.920	0.953
Kvasir-SEG (endo)	0.756	0.824	0.833	0.889	0.8646	0.944
ChestXray (X-ray)	0.938	0.948	0.952	0.9546	0.9497 SegGPT in-context; fs-deploy 0.9488	0.9535
HC18 Fetal-Head (US) ·new	0.923	0.958	0.965	0.970	0.9667 retrieval SegGPT; was 0.9328 fs / 0.9225 tf	0.9665 tuned-decoder oracle
MSD Prostate (MRI) ·new	0.679	0.720	0.772	0.815	0.7877 SegGPT⊕op_sam ensemble; was 0.760	0.938

Two LLM columns: the training-free pipeline (zero gradient training — the study's headline) and the few-shot tuned decoder (generic-SAM init, encoder frozen, ~4M-param mask decoder tuned on N=100 labels, GT-box oracle). The few-shot decoder beats the from-scratch NN on four of six domains given a good box (ISIC/Spleen/Kvasir/Prostate) and ties the other two (CXR, HC18 — near-ceiling NNs at ~0.95–0.96) — the residual between it and the deployed training-free pipeline is mostly localization (the exception was CXR, where the frozen SAM decoder was the wall — now moved training-free by swapping in a different frozen decoder, the SegGPT in-context drawer, to 0.9497), detailed below.

CXR is now training-free again at 0.9497 — a swapped 4th frozen drawer backend (SegGPT in-context). The old CXR training-free headline (0.922, frozen box-SAM) is superseded by a different frozen decoder: SegGPT (BAAI/seggpt-vit-large, generic → leak-free, non-SAM) paints the whole lung mask in-context from K=8 spread-sampled train (image,mask) support pairs — no box, no SAM, no localizer, ZERO gradient training. Deployed 0.9497 (median 0.9616, n=107), within 0.005 of the from-scratch NN's 0.9546 — a near-tie, still not a win. This is the 4th backend at the model-coupled drawer seam (LLM polygon · frozen SAM · few-shot tuned decoder · in-context SegGPT): the seam is genuinely swappable, and CXR's gap was neither architectural nor requiring our labels — it was the particular frozen decoder (SAM). A separate, non-training-free few-shot lane remains documented: tuning only the ~4M-param SAM mask decoder on N=100 CXR labels (generic-vit_l init, encoders frozen, box-jittered, leak-free) + mask-bbox re-decode reaches 0.9488 (median 0.9608, 102/107 improve) — but the deployed CXR is now the training-free SegGPT 0.9497, which supersedes it. Frozen-decoder study (leak-free generic): among frozen alternatives the generic in-context SegGPT wins; SAM2 / SAM1-vit_h merely tie frozen SAM-HQ (no gain), and text-prompted CLIPSeg fails on grayscale X-ray (0.00) — the interesting frozen alternative is a generic in-context segmenter (few-shot at inference, zero gradient), not another SAM variant.

The pipeline wins the EXTREME scarce-label regime (N≤25) where the target is GT-free-localizable — ISIC and Spleen are CI-separated leads at N≤25 (fewshot_matched.md); at N=100 the numbers below (ISIC 0.880 vs 0.868, Spleen 0.920 vs 0.907) are within-CI near-ties, not significant leads (stats.md) — and on Kvasir polyp a frozen-DINOv2 dense-correspondence localizer (OP-SAM CPG + peak-CC box) lifts it 0.659→0.8646 — the gap was localization (frozen GT-box oracle 0.914 > NN), and this closes 89% of it; the median 0.9484 now beats the NN mean, though the mean stays just below best-NN 0.889. On Chest X-ray the deployed training-free path is now a swapped 4th frozen drawer — the SegGPT in-context drawer (K=8 support pairs, zero gradient) — reaching 0.9497 ≈ NN 0.9546 (−0.005, a near-tie), superseding the earlier box-SAM 0.922 and the separate few-shot-tuned decoder 0.9488 lane; the old "frozen-decoder cap ~0.93" was specific to SAM, not to architecture. On HC18 fetal-head the same story now plays out training-free: a swapped retrieval-prompted SegGPT drawer (K=8 query-retrieved DINOv2-similar in-context supports, zero gradient, SAM-free) reaches 0.9667 ≈ NN 0.9703 (−0.004, a near-tie), superseding the op_sam+SAM 0.9225 and the few-shot decoder 0.9328 — so FetalHead is no longer a few-shot lane. Honest headline (post-rebuttal): at N=100 these are within-CI near-ties — 0/4 apparent leads survive bootstrap 95% CIs (stats.md), and the Spleen "+0.019" is a seed-averaging artifact (best single U-Net seed 0.9323 > LLM 0.9262). The defensible lead is at N≤25 on localizable targets (ISIC / Kvasir / Spleen / Prostate), budget-matched and CI-separated. All 6 deployed paths are gradient-free frozen-model assembly, but the LLM drawer is out of the mask-producing path on 5/6 (llm_ablation.md) — Prostate, the last domain lifted off its floor, is a complementary 2nd frozen drawer (a SegGPT⊕op_sam edge-gated keep-best ensemble). SegFormer is the strongest NN in 10 of 12 sweep cells.

Segmentation galleries

Per-case GT-vs-prediction overlays for the deployed pipeline on every test image (all 465, sorted worst-Dice first) — open the 6-domain gallery hub → (ISIC · Kvasir · Spleen · Prostate · CXR · FetalHead). Green = ground truth, red = deployed prediction; overlays rendered from the committed mask_cache/.

Where is the wall — the decoder, or localization? A fair few-shot probe

Is the residual to the trained NN a decoder limit or a localization limit? MedSAM (SAM fine-tuned on ~1M medical masks) beats box-prompted SAM — but it is data-leaky (its training set likely includes these test distributions), so it is really "import a trained medical net." The fair, leak-free counterpart of the same operation: init from the generic SAM (no medical data), freeze the image + prompt encoders, and fine-tune only the ~4M-param mask decoder on our own N-label train split — GT never touches test. Given a good box (the GT-box oracle, which isolates the decoder), this few-shot-tuned decoder beats the from-scratch NN at every budget on 4 of 6 domains (ISIC/Spleen/Kvasir/Prostate — Prostate by +0.12) and ties on the other two (CXR, HC18 — both near-ceiling NNs at ~0.95–0.96), and it saturates at N=10 (pretrained features + a tiny adapted head), so its curve is flat-high while the NN climbs:

Domain (tuned decoder, oracle)	N=10	N=25	N=50	N=100	best NN N=100
ISIC 2018 (derm)	0.905	0.904	0.907	0.911	0.868
MSD Spleen (CT)	0.957	0.960	0.960	0.953	0.907
Kvasir-SEG (endo)	0.936	0.934	0.937	0.944	0.889
ChestXray (X-ray)	0.933	0.946	0.955	0.9535	0.9546
HC18 Fetal-Head (US) ·new	0.918	0.954	0.957	0.9665	0.970
MSD Prostate (MRI) ·new	0.906	0.931	0.932	0.938	0.815

Mostly localization — with CXR the telling exception. The oracle hands the decoder a good box; on most domains the gap between it and the deployed pipeline is localization. Kvasir is the proof: tuned-decoder oracle 0.944 vs the original deployed 0.659 — 0.285 of pure localization headroom, zero decoder; the frozen dense-correspondence localizer has since realized most of it (0.659→0.8646), exactly as this predicted, leaving only ~0.05 to the oracle box. Where localization is already solved, the tuned decoder is a clean deployable win over both production and the NN: CXR few-shot decoder 0.9488 > the earlier box-SAM production 0.922 ≈ NN 0.9546 (though the deployed training-free CXR is now the SegGPT in-context drawer 0.9497, which supersedes both); Spleen (3D volume-prior box) 0.942 > production 0.920 > NN 0.907. This is few-shot (N=100 labels = the NN's budget), not training-free — an explicit, leak-free counterpart to MedSAM. CXR is the exception that sharpens the rule: its wall was the particular frozen decoder (SAM), not localization and not architecture — swapping in a different frozen decoder, the SegGPT in-context drawer, moves it training-free to 0.9497 (≈ NN, zero gradient), and a few-shot-tuned SAM decoder independently reaches 0.9488. So of the residual "structural / architectural ceilings," the polyp boundary was a localization gap in disguise, while the CXR "decoder wall" was a SAM-specific wall breachable by another frozen decoder with none of our labels.

Is the medical pretraining (MedSAM) worth it? — a leaky benchmark

MedSAM is SAM already fine-tuned on ~1M medical masks — a leaky upper reference (its training likely saw these test distributions). Arch-matched (both vit_b, GT-box oracle, N=100), few-shot tuning of the GENERIC SAM matches or beats the leaky MedSAM on 3 of 6 domains, and stays within 0.015 on the other 3 — its own pretraining distributions (derm/US/MRI). Medical pretraining buys no consistent edge once the decoder is adapted, and where generic SAM is already strong (Kvasir/Spleen) it starts above MedSAM even frozen. Bold = better of the two few-shot columns.

Domain (N=100 oracle, vit_b)	from-scratch NN	generic frozen	generic few-shot (fair)	MedSAM frozen (leaky)	MedSAM few-shot (leaky)
ISIC 2018 (derm)	0.868	0.870	0.915	0.921	0.943
MSD Spleen (CT)	0.907	0.941	0.956	0.909	0.946
Kvasir-SEG (endo)	0.889	0.917	0.936	0.888	0.918
ChestXray (X-ray)	0.9546	0.925	0.954	0.935	0.952
HC18 Fetal-Head (US) ·new	0.970	0.769	0.965	0.904	0.972
MSD Prostate (MRI) ·new	0.815	0.895	0.928	0.807	0.941

Fair few-shot generic SAM vs leaky MedSAM benchmark, N=100 oracle — Fair few-shot tuning of **generic** SAM (dark blue) vs the leaky **MedSAM** (orange), each frozen + few-shot-tuned, vs the from-scratch NN (gray) — arch-matched vit_b, N=100 GT-box oracle. The fair generic few-shot ≥ leaky MedSAM few-shot on Spleen/Kvasir/ChestXray (**3/6**); MedSAM leads on its own pretraining distributions — derm (ISIC), US (HC18), MRI (prostate) — but by **<0.015** once the generic decoder is tuned, and generic-frozen still beats MedSAM-frozen on prostate (0.895 vs 0.807). Medical pretraining helps most exactly where MedSAM saw the data, yet few-shot tuning of the generic decoder nearly erases it — decoder adaptation, not medical pretraining, is the lever.

The MedSAM attack inverts once it is prompted fairly and tested OOD (ood_medsam.md). The oracle-box column above is a leaky upper reference. Give MedSAM a fair box (learned from N GT, not the oracle) and it drops +0.16..+0.59 Dice below the deployed pipeline in-distribution; take it out-of-distribution (DRIVE retinal vessels — a distribution MedSAM never trained on) and the gap widens to +0.51 while MedSAM collapses to 0.220 even handed the ORACLE box (vs ~0.90 in-distribution). MedSAM's in-distribution edge was its decoder recognizing box-shaped targets it had trained on — memorization that does not transfer; the pipeline's few-shot-refit GT-free localization is distribution-robust.

Can it be ONE domain-agnostic pipeline? — few-shot skills + a router, SAM frozen

Each domain has a distinct setup — so can it be a single domain-agnostic pipeline that few-shot-fits per domain WITHOUT tuning SAM? We test the transferable skill — a frozen-SAM-feature localizer prototype fit from N labeled images — with identical code across all six domains, SAM never touched.

Domain-agnostic few-shot skill transfer: skills few-shot-fit, topology is routed not tuned — **(A)** One fixed pipeline (prototype-sim localizer): the skill **few-shot-fits** — saturates by ~N=10 on every domain — and scores high where the target is prototype-localizable (ISIC 0.71, CXR 0.62, HC18 US 0.72), mid where it is a central structure (Prostate MRI 0.51), low where it needs a specialized localizer (Kvasir 0.35, Spleen 0.12). **(B)** **Routing** the per-domain topology (genome / static-box / op_sam dense-correspondence / volume-prior / ellipse-snap / volume-trajectory) + the few-shot skill recovers most of the deployed number (Kvasir 0.35→0.77→0.86, HC18 0.69→0.92, Prostate 0.51→0.76, Spleen 0.14→0.66→0.83@N=50).

Yes — a domain-agnostic pipeline = frozen SAM + a GT-free router + few-shot skills. The learning (localizer prototype + gate weights + genome) is domain-agnostic, few-shot (~10 labels; ~50 for the isodense spleen), and SAM-frozen — it transfers with identical code. The per-domain "distinct setup" you'd notice is which localizer topology to route to — a GT-free routing choice (learned config, the project's route.py), not SAM tuning. So onboarding a new domain is ~10 labels + a routing decision, zero gradient training. Robust localizer skill: the deployed default is now the op_sam frozen-DINOv2 dense-correspondence localizer (kvasir/HC18/prostate) — it transfers 10-shot support masks through the full patch cross-correlation, and superseded the earlier SAM+DINOv2 AMG-ranker ensemble on Kvasir (0.655→0.8646). The lesson holds and is now stronger: the polyp/fold and faint-skull walls yield to the right frozen feature space — dense correspondence, plus feature-diverse supports — not to distractor-verification tricks. The AMG-ranker ensemble (at/near the best single feature space on all three, Kvasir 0.65 / Spleen 0.64 / ISIC 0.67, never catastrophic where SAM-alone fails the isodense spleen 0.40) remains the LLM-agnostic fallback where a support set is too small for correspondence.

What we learned

ISIC: the LLM pipeline leads the best NN across low budgets — CI-separated at N≤25 (+0.116 at N=10) and narrowing to a within-CI near-tie by N=100 (+0.025 point estimate, not significant, stats.md). Genuinely more label-efficient for dermoscopy in the scarce-label regime, and the one domain where the LLM drawer is in the deployed path (+0.128, llm_ablation.md).
Spleen: a stack of GT-free skills — within-volume prior, cross-slice geometry, selective multi-prototype, a SAM re-prompt boundary polish, and a pyramid keep-best (higher-resolution re-decode of the tiny tip slices) — lifts 0.786 → 0.920, a within-CI near-tie with the best trained NN at N=100 (0.920 vs 0.907; the apparent "+0.019" is a seed-averaging artifact — best single U-Net seed 0.9323 > LLM 0.9262, stats.md; the CI-separated lead is at N≤25). The pyramid and the volume prior see the tip slices two different ways — resolution vs siblings — and combine additively via a valid soft-tissue gate.
Kvasir: a frozen-DINOv2 dense-correspondence localizer (OP-SAM CPG label transfer + peak-connected-component box) lifts the polyp 0.659→0.8646 — the biggest single gain in the study, closing 89% of the−0.230 gap to the NN. The gap was pure localization (the frozen GT-box→SAM oracle is 0.914 > NN 0.889, so there is no decoder wall); the unlock is transferring few-shot support masks by dense correspondence, not a mean prototype (which washes out on polyp≈mucosa, and defeated four verification signals). The prior peak lands in the polyp 94% of the time; median 0.9484 now beats the NN mean, the mean stays just below best-NN 0.889 (residual = a gate-bound tail of hard localizations). A support-coverage lever — rebuilding the op_sam supports from the first-30 (was first-10) train images (+0.032, an N=30 support budget, still scarce; polyps want coverage/count, not FPS-diversity) — closed most of the remaining tail. Grounded in the domain's published frozen-SAM SOTA (OP-SAM, ICCV'25), leak-free, no tuning.
Chest X-ray: a few-shot static lung box + a mask-bbox self-reprompt + a repair agent (trims out-of-lung over-seg) + a catastrophic fix (SAM negative-point re-prompt on the worst spilled masks) + a letterbox trim (drops blobs over near-black padding) lift the training-free LLM 0.825→0.898→0.911→0.914→0.920→0.922 — the deployed gap was box localization, not architecture. The frozen SAM decoder does cap even a perfect GT box at ~0.93, which long looked architectural — but that cap is specific to SAM: swapping in a different frozen non-SAM in-context drawer, SegGPT (K=8 support pairs, zero gradient, leak-free), paints the lung mask training-free to 0.9497 ≈ the U-Net's 0.9546 (−0.005, a near-tie) — now the deployed training-free CXR drawer (the 4th backend at the swappable drawer seam), superseding the box-SAM 0.922. A separate few-shot lane (tuning only the ~4M-param SAM mask decoder on N=100 labels, encoder frozen, leak-free) independently reaches 0.9488. So CXR's real wall was the particular frozen decoder (SAM), not localization and not architecture, and it is breachable training-free by another frozen decoder — CXR still does not beat NN (−0.005), so it stays a near-tie, not an LLM-lead domain.

When does iterative feedback deploy? — the fix is general, the gate is the wall

We built a full repair-agent → verbal + visual feedback → SAM re-prompt → keep-best loop: the repair stage renders a diagnosis overlay (current mask + a GT-free "out-of-region" heat-map + a coordinate grid), the vision LLM looks, says what is wrong verbally, and marks the over-segmentation as SAM negative points; SAM re-decodes; a GT-free keep-best gate accepts or rejects; repeat. On chest X-ray the LLM's visual negatives beat the heuristic catastrophic fix (CHNCXR_0447 0.849→0.902, MCUCXR_0055 0.860→0.955).

CXR loop vs feed-forward — The cases the GT-free gate accepted (top = feed-forward catfix, bottom = the loop). The LLM's visual negatives tighten SAM off the mediastinum/abdomen better than the spill heuristic. Full-107: 0.9216→**0.9240** (+0.0024), zero-regression, gate near-perfect (oracle 0.9241).

But the fix is domain-general — the LLM can place negatives on any over-seg it sees. What decides deployability is the gate: whether a GT-free signal can rank candidate masks by true Dice. We measured that gate↔Dice correlation on all four domains:

Gate-validity across domains — The loop deploys **iff the GT-free gate is valid** — a property of the *domain*, not the loop. CXR (+0.63, lung darkness+atlas) and Spleen (+0.56, soft-tissue) have valid gates and the loop deploys; Kvasir (+0.04 — polyp≈mucosa, no signal) and ISIC (−0.23 — the gate prefers over-grown high-contrast masks) do not, so no amount of good feedback can be deployed. **2 of 4 domains.**

The core lesson. Iteration is not the lever — perception, or its GT-free proxy, is. The same wall shows up as the SIZE law, the structural-ceiling taxonomy, and here as gate-validity: a feedback loop is only as deployable as the GT-free mask-quality signal in that domain. Where the target is cheaply separable (dark lung air, soft-tissue organ edges) a gated fix pays off; where it is not (polyp on mucosa) neither a loop nor a single fix can deploy without ground truth.

Honest-reporting note: earlier drafts carried optimistic hardcoded values (ISIC 0.885, Kvasir 0.860, CXR 0.855). This report uses numbers re-measured from scratch with the current pipeline: ISIC 0.880, Spleen 0.920 (CV-held-out), Kvasir 0.8646, CXR 0.9497 (training-free, SegGPT in-context drawer; was 0.922 box-SAM). (Kvasir was 0.659 before the dense-correspondence localizer.)

Pipeline

One image, end to end. A GT-free router selects skills per image; the drawer seam (amber) is the only model-coupled point, now with 4 swappable backends — (1) an LLM polygon/grid drawer, (2) a frozen SAM dense decoder, (3) a few-shot-tuned SAM decoder, and (4) a frozen non-SAM in-context drawer (SegGPT), the new deployed training-free CXR path. A config-driven one dispatch_localizer picks per domain among an LLM polygon drawer, a frozen SAM-feature prototype, a frozen-DINOv2 dense-correspondence (CPG) localizer, or a static box — and everything downstream is numpy/config. Green boxes (🔄) are iterative loops: SAM fixed-point re-prompts and the spleen two-pass within-volume prior.

Revised claims — post-rebuttal, 2026-07-07

After a hostile self-review (reviewer_attack.md) and 10 rebuttal experiments (docs/rebuttal/), this is the honest, defensible version. The detailed per-domain evidence above is all valid; the claims wrapping it are corrected here. The old headline — "training-free, within ≤0.005 of the best trained NN on 4/6 domains at N=100" — does not survive and is retracted.

Retracted — these do not survive scrutiny

The N=100 "within ≤0.005 / ties NN on 4/6" framing. Bootstrap 95% CIs (stats.md): best-NN@100 sits inside the LLM CI on 5/6 domains (statistically indistinguishable) — 0/4 claimed leads survive as significant. The lone Spleen "+0.019" is a seed-averaging artifact: the single best U-Net seed (0.9323) beats the LLM (0.9262).
"LLM+SAM pipeline" as the identity. The Claude drawer is in the deployed inference path on 1/6 domains (ISIC, contributing +0.128). On 5/6, SAM / op_sam / SegGPT / genome do the work (llm_ablation.md). Honest identity: frozen-foundation-model assembly, with the LLM one swappable drawer.
Universal OOD skill transfer. The blind auto-onboarder applied to a genuinely unseen domain (Heart) scores 0.384 — below a 10-label U-Net (lodo.md). Transfer holds only inside the competence envelope (below), not universally.

Refuted attacks — these stay strengths

Baselines are NOT strawmen (baselines.md): "best NN" is the max over ImageNet-pretrained SegFormer-b2, pretrained U-Net-r34, and real nnU-Net self-config, with augmentation + validation early-stopping. From-scratch nets were correctly excluded.
Retrieval is NOT leakage (leakage.md): rebuilt subject-disjoint, HC18 is 0.9667→0.9666 (leak surface 1/100 queries); Prostate is structurally volume-disjoint (0/30 same-volume in top-8). The +0.038 retrieval lift is real cross-subject generalization.

The surviving thesis — measured, CI-backed

Training-free frozen-model assembly wins the EXTREME scarce-label regime (N≤25) on GT-free-localizable targets — and its edge is distribution-robust localization, not memorization.

Budget-matched and CI-separated at N≤25 (fewshot_matched.md, the LLM's own budget capped to first-N): the lead survives on the size-law / localization-bound domains — ISIC, Kvasir, Spleen, Prostate — and does not survive on near-ceiling anatomy (CXR, FetalHead). This is exactly the predicted split, now CI-measured.
It beats a FAIR few-shot MedSAM in-distribution, and the margin WIDENS out-of-distribution (ood_medsam.md): a fair few-shot MedSAM (box learned from N GT, not the oracle box) is +0.16..+0.59 Dice below the LLM in-distribution; on OOD-for-MedSAM data (DRIVE) the gap widens to +0.51 while MedSAM collapses to 0.220 even with the oracle box (vs ~0.90 in-distribution). MedSAM's edge was memorization, not generalization.

The core science — the real contribution

The two-walls law. A keep-best fix deploys IFF (1) a valid GT-free gate exists AND (2) the candidate family holds a mask better than the deployed base — and the two trade off: on gate-bound Prostate a 6-mechanism diverse family raises the oracle to 0.89, but every GT-free selector over it scores below the deployed 0.79. Manufacturing family headroom makes GT-free selection strictly harder.
The GT-free-localization wall IS the training-free frontier (frontier_crossing.md). Deliberately crossing it — gradient-training a localizer head over a frozen decoder — ties the NN only at N=10, is overtaken by N=25, and forfeits "training-free." Crossing the wall lands you AT, not above, the trained net.
A characterized competence envelope on two independent axes: size / localizability (blind auto-onboard liver 0.78 vs Heart 0.35, a tiny 0.7% isodense blob) and structure type (vessels / filaments are a genuine learned-dense ceiling — a trained U-Net 0.80 beats the pipeline's ~0.75).
A GT-free competence predictor — draw self-consistency (ρ+0.63), op_sam prior_iou / concentration (ρ+0.42..0.54) — the deployable signal for which side of the frontier a new image or domain sits on.

One-line thesis. Frozen-foundation-model assembly is the right tool below the GT-free-localization frontier (scarce labels, localizable targets); across it, you must train — and then you are the NN. We characterize that frontier and give a GT-free predictor for it.

agenticSeg · training-free frozen-foundation-model assembly for medical segmentation (LLM drawer in the deployed path on 1/6 domains) · github.com/R9-Hu/agenticSeg
Skills are LLM-agnostic numpy/config; every result reproducible via eval_all_domains.py. AI-assisted (Claude Code).