Untangling the Mechanisms of Misleading Context in Medical Question Answering
Robin Linzmayer, Noémie Elhadad
cs.CL · cs.AI · cs.LG
Quick verdict
Bare answer assertions steer medical LLMs more than fabricated evidence and hide best; rigorous paired design, but key limits rest on one subset and one small model.
Summary
The paper traces how misleading context corrupts medical question answering in reasoning LLMs across four linked questions: susceptibility, disclosure, mechanism, and monitorability. On the medical reasoning subset of MedMisBench (8,627 items), each item's fabricated clinical claim (evidence cue) is paired with a matched content-free assertion of the same wrong option (answer cue) across five arms and three models (R1-14B, gpt-oss-120b, GPT-5.4). All three models adopt the asserted answer more often than the fabricated claim (paired gaps of +10.5 to +27.2 percentage points in the false direction), and patient-framed cues are heavily discounted. On a single Neutral×Cue-Remapping cell (n=1,153), cues are disclosed in 81–98% of reasoning traces but only 7–90% of visible responses, and most silent responses under the answer cue (61–88%) took the injected option. Transplant resampling on 40 silent R1-14B traces shows evidence influence entering early (median x50=0.35) and accumulating, while assertions redirect the conclusion near the end (x50=0.72). A guided gpt-4.1-mini monitor reading gpt-oss-120b traces catches 78% of corrupted decisions at 5% false positives, versus at most 32% from any response surface. Limitations: synthetic single-sentence injections in single-turn multiple choice; disclosure, mechanism, and monitorability restricted to one cell and, for mechanism, one 14B model; rollouts and judge labels available only on request.
Review complete
Assessment at a glance
4
risk flags identified
● high 0
● medium 2
● low 2
4 strengths · 4 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Bare answer assertions steer medical reasoning models more than fabricated clinical evidence, with paired per-item uptake gaps of +10.5 to +27.2 percentage points in the false direction across three models (Table 8).
- Injected cues are disclosed in 81–98% of reasoning traces but only 7–90% of visible responses, and the most-susceptible cue type (assertion) is disclosed least (§4, Fig 2).
- The two cue types corrupt reasoning through different temporal routes: evidence influence enters early (median x50=0.35) and accumulates, while assertion influence arrives near the end (x50=0.72) (§5).
- A guided LLM monitor reading gpt-oss-120b traces catches 78% of corrupted decisions at 5% false positives versus at most 32% from any response surface, making trace withholding a safety-relevant provider decision (§6, Table 12).
Strengths
Paired cue design isolates the comparison prior work could not make
Each MedMisBench item carries both its benchmark-provided fabricated claim and a matched content-free assertion at the same wrong option, run on identical stems across 5 arms × 3 models (129,405 completions, §3.4); the Answer−Evidence gaps are computed per-item (Table 8), so the headline ordering is not a cross-benchmark artifact.
Judge labeling validated with appropriate statistics
The GPT-4.1 disclosure judge separates restatement from same-topic clinical reasoning (Appendix D rubric) and is validated on 100 blind items at κ=0.94, with Gwet's AC1 reported alongside kappa because one class dominates (Appendix D.1) — a rigor rarely seen in LLM-judge pipelines.
Mechanism claims backed by a mirror analysis
Monitorability evaluated at a deployment-relevant operating point
Weaknesses
Disclosure, mechanism, and monitorability all live in one cell
Mechanism rests on 40 traces from one small distilled model
Single assertion template per provenance
Susceptibility corpus uses one completion per item per arm
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper organizes the lifecycle of a corrupted medical QA answer into four stages — susceptibility, disclosure, mechanism, monitorability (Table 1) — and advances four claims: (1) bare answer assertions steer medical reasoning models more than fabricated clinical evidence; (2) injected cues are verbalized in 81–98% of reasoning traces but only 7–90% of visible responses, with the assertion least disclosed; (3) the two cue types corrupt reasoning through different temporal routes; (4) trace access plus monitor guidance recovers corruption that response-only monitoring misses. All four are supported by experiments as described, with each claim's scope bounded by design choices the authors largely acknowledge (§7.1).
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 4 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is MedMisBench and how was it used in this paper?
MedMisBench is a clinician-reviewed benchmark of misleading-context medical QA. This study uses its medical reasoning subset — 8,627 items across MedMisQA, MedMisMCQA, and MedMisXpertQA — and appends to each item either a fabricated clinical claim or a matched bare assertion pointing to the same wrong answer.
Do LLMs follow fake evidence or bare assertions more in medical questions?
In this paper, all three tested reasoning models followed the bare assertion more: they adopted the asserted wrong answer 10 to 27 percentage points more often than they adopted the fabricated clinical claim, and patient-framed cues were discounted much more than authority- or neutrally-framed ones.
Can safety monitors detect when misleading context changed a model's medical answer?
Yes, but only with trace access: a GPT-4.1-mini monitor guided on corruption signatures caught 78% of corrupted decisions at a 5% false-positive rate when reading gpt-oss-120b's reasoning trace; the best it did on any visible response was 32%.
What are the main limitations of this study?
The cues are synthetic single sentences in single-turn multiple choice; disclosure, mechanism, and monitorability were tested on one subset cell (n=1,153); the mechanism analysis used only 40 silent traces from one 14B model; and rollouts and judge labels are available only on request rather than released outright.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures are raster content in the extraction; every number cited in this review comes from in-text reports, captions, and the appendix tables, which are complete — no plotted-only value was relied upon.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.