The study investigates how medical AI agents can silently access protected health information (PHI) without revealing it, a practice that bypasses the HIPAA minimum‑necessary standard. By embedding canaries in synthetic patient records, the authors evaluated five language models across multiple boundary settings and attack scenarios, finding that some models accessed PHI unnecessarily while stricter boundaries and pre‑execution gates largely mitigated this behavior. The research demonstrates that output‑only evaluations fail to detect such covert access, underscoring the need for combined boundary controls, gating mechanisms, and access‑log audits.
By Jae Wang Lee, Abhirup Banerjee, Yeong Chan Lee
arXiv:2607. 13411v1 Announce Type: cross Abstract: Clinical AI models can expose patients to harm when adversarial vulnerabilities go undetected, yet formal security auditing requires statistical expertise, specialized tools, and significant time.
By Michael O. Eniolade
The paper introduces MIMIC-DOS, a dataset derived from MIMIC-IV that focuses on ICU cases where patient symptoms and medical signs are discordant. It presents CARE, a privacy‑compliant multi‑stage agentic reasoning framework that uses a proprietary LLM to generate structured categories and transitions, while a local LLM performs evidence acquisition and decision‑making. In retrospective evaluations on MIMIC‑DOS, CARE outperforms other LLMs and agentic workflows, demonstrating stronger handling of conflicting clinical evidence while preserving patient privacy.
By Haochen Liu, Weien Li, Rui Song, Zeyu Li, Chun Jason Xue, Xiao-Yang Liu, Sam Nallaperuma-Herzberg, Xue Liu, Ye Yuan
arXiv:2508. 00923v3 Announce Type: replace Abstract: Large language models (LLMs) are increasingly used to answer health-related questions and support healthcare workflows, yet evidence for their safety still relies heavily on static benchmarks that can rapidly become obsolete or be optimized against.
By Jiazhen Pan (Cherise), Bailiang Jian (Cherise), Paul Hager (Cherise), Yundi Zhang (Cherise), Che Liu (Cherise), Friederike Jungmann (Cherise), Hongwei Bran Li (Cherise), Julian Canisius (Cherise), Chenyu You (Cherise), Junde Wu (Cherise), Jiayuan Zhu (Cherise), Fenglin Liu (Cherise), Yuyuan Liu (Cherise), Niklas Bubeck (Cherise), Moritz Knolle (Cherise), Chen (Cherise), Chen (Cherise), Christian Wachinger, Zhenyu Gong, Cheng Ouyang, Georgios Kaissis, Benedikt Wiestler, Daniel Rueckert
MedDeID is an on‑premises framework that combines in‑house annotation, synthetic‑note generation, model training, inference, pseudonymisation and evaluation to de‑identify clinical text. On a Dutch hospital benchmark, a hospital‑trained transformer detected 98.9 % of identifying text while redacting only 0.24 % of non‑identifier text; a synthetic‑only model achieved 96.1 %. In primary‑care notes, the synthetic‑trained model outperformed the hospital‑trained model in recall and robustness to identifier‑format changes, and an English version trained without real text reached 99.7 % and 98.9 % detection on synthetic benchmarks.
By Stig Hellemans, Tom Stroobants, Elyne Scheurwegs, Pieter Meysman, Philippe G. Jorens, Kris Laukens
Synthetic Hospital is an open, fully synthetic longitudinal electronic health record benchmark created from public medical education material. It contains 1,268 patients and 5,602 encounters, with every diagnosis, finding, and temporal relation grounded in standard ontologies and traceable back to its source. Physicians could not reliably distinguish its records from real charts, and current frontier AI models perform significantly below human experts on tasks such as reconstructing problem lists and summarizing charts.
By Christine Park, Valerie Chen, Tim Dettmers
The paper introduces a lightweight screening tool that evaluates individual patient vulnerability to membership inference attacks across thousands of medical AI models. By measuring attack scores for each patient, the authors found that certain records consistently rank high in risk regardless of training settings, and that stronger weight decay can reduce overall exposure but not the identity of the most at‑risk patients. The tool uses four small models to flag high‑risk patients before a production model is trained, aiming to integrate privacy assessment into clinical AI data preparation.
By Konstantinos Vrettos, Eleftherios Tzanis, Haridimos Kondylakis, Evangelia E. Vassalou, Florence X. Doo, Michail E. Klontzas
arXiv:2607. 25485v1 Announce Type: new Abstract: Health AI is evolving from answering questions to agentic systems that converse with patients, reason about health records, and act on their behalf.
By Korosh Vatanparvar, Ashutosh Joshi, Maria Xenochristou, Mohammad Abuzar Hashemi, Prasad Kasu, Deepak Bansal, Daniel Lopez-Martinez, Anchal Nema, Ramya Ganesan, Will Kimbrough, Alex Woody, Yadunandana Rao, Dilek Hakkani-Tur, Wilko Schulz-Mahlendorf
arXiv:2606. 14149v1 Announce Type: new Abstract: Large Language Models (LLMs) are increasingly deployed in healthcare settings, yet their tendency to hallucinate poses risks when clinical decisions are involved.
By Muhammad Osama, Maheera Amjad, Zartasha Mustansar, Arslan Shaukat, Muhammad U. S. Khan
arXiv:2606. 00044v1 Announce Type: cross Abstract: The integration of artificial intelligence into clinical medicine creates a fundamental tension between algorithmic probabilistic reasoning and the experiential intuition of expert physicians; applying Lawrence Lessig's \enquote{Code is Law} framework, I argue that the architecture of clinical AI systems already functions as de facto medical regulation, reshaping liability and the standard of care.
By Aizierjiang Aiersilan
arXiv:2607. 15166v1 Announce Type: new Abstract: Most medical AI benchmarks measure whether a model knows the correct answer.
By Goktug Ozkan
The paper investigates how large language model agents can inadvertently leak confidential information by combining data from multiple documents—a phenomenon termed the "mosaic effect." Using 30 synthetic cybersecurity, medical, and military scenarios, the authors generate 10,800 simulated and 1,440 live answers from three LLM agents, finding that even the best model discloses forbidden composites in over 7% of simulated responses. While visible classification headers and aggregation rules reduce disclosure rates, unsafe disclosures remain in roughly one third of simulated answers, and increased refusals do not fully prevent leakage of prohibited conclusions.
By Daniel Ruiz, Luca Luceri, Emilio Ferrara