MedMisBench: Medical LLM Resilience Benchmark

• MedMisBench is a large-scale benchmark designed to assess epistemic resilience in medical LLMs under adversarial context injections.
• It quantifies model vulnerability via two protocols—focused and all-option injections—revealing drastic performance drops in accuracy.
• Stratification by content corruption and provenance framing provides actionable insights for enhancing clinical risk mitigation and fine-tuning LLMs.

MedMisBench is a large-scale static benchmark specifically designed to assess epistemic resilience—that is, the capacity of LLMs to preserve correct medical judgment when exposed to plausible-yet-misleading context. Conceived to address the structural blind spot in prevailing LLM evaluations, MedMisBench focuses on adversarial challenge scenarios in clinical question answering, systematically quantifying model vulnerability to context corruption. The benchmark encompasses 10,932 medical question items and 48,889 misleading context-option pairs, providing fine-grained stratification by both content- and provenance-level taxonomy of falsehood. Empirical results across 11 commercial and open-source LLM configurations document severe drops in performance under targeted adversarial context, with substantial clinical risk identified by a multi-country expert review panel (Zhou et al., 10 Jun 2026).

1. Theoretical Foundation: Epistemic Resilience and Attack Success Rate

MedMisBench operationalizes epistemic resilience as a model's ability to retain correct responses to medical questions after adversarial injection of contextually plausible but false information. Let $N$ denote the total test items, $q_i$ the $i$th question, $a_i^*$ its gold answer, and $m(q_i)$ the model's answer. Clean accuracy is

$$\mathrm{acc}_{\mathrm{clean}} = \frac{1}{N} \sum_{i=1}^N \mathbf{1}\{ m(q_i) = a_i^* \}$$

Post-injection accuracy under adversarial protocol $p$ (Type 1: focused; Type 2: all-option) is

$$\mathrm{acc}_{\mathrm{mislead}}^{(p)} = \frac{1}{N_p} \sum_{i \in S_p} \mathbf{1}\{ m(q_i + x_i) = a_i^* \}$$

where $S_p$ is the clean-correct set for $p$ and $q_i$0 the misleading context. Attack success rate (ASR) is then: $q_i$1 In Type 1, targeted ASR (TASR) quantifies the fraction of cases where the chosen distractor specifically supplants the gold answer.

2. Construction and Taxonomy of Adversarial Context

MedMisBench draws from five public medical QA benchmarks (MedQA, MedMCQA, MedXpertQA, MedJourney, HLE), filtered for answer-grounded multiple-choice format and applicability for plausible context injection, yielding 10,932 questions. Each incorrect answer option is paired with a tailored misleading sentence, resulting in 48,889 context-option instances.

The taxonomy of misleading-context is two-layered:

• Content Corruption (5 types):
  1. Relationship/Sequence Inversion
  2. Threshold/Reference Corruption
  3. Cue Remapping
  4. Spurious Anchoring
  5. Exception Poisoning

• Provenance Framing (3 types):

  1. Neutral False Statement
  2. Patient Self-Diagnosis/Belief
  3. Authority (Guideline/Note/SOP)

A dedicated applicability filter ensures only questions amenable to systematic context corruption are included. Content is generated primarily via Gemini-3-flash, with verification of qualitative consistency against GPT-5.4.

3. Evaluation Protocols and Metrics

The evaluation protocol defines two principal delivery types:

• Type 1: Focused injection—presents a single misleading statement corresponding to one distractor.

• Type 2: All-option injection—offers all misleading options plus a truthful sentence affirming the correct answer.

Metrics are reported conditional on the clean-correct subset $q_i$2, including clean accuracy, post-injection accuracy, ASR, and (for Type 1) TASR.

Benchmark coverage spans 11 model configurations, including commercial APIs (e.g., GPT-5.4, Gemini-3.1-pro, Claude-sonnet-4.6), open-weight models (Gemma 4, Qwen 3.6), and a medical-domain-tuned model (MedGemma 27B).

4. Empirical Findings and Taxonomy-Stratified Model Vulnerability

Aggregate results across models show a pronounced decrement in performance under focused misleading context:

• Clean accuracy: 71.1%
• Type 1 (focused) accuracy: 38.0%
• Type 1 ASR: 51.5%
• Type 1 TASR: 45.4%
• Type 2 (all-option) accuracy: 70.5%
• Type 2 ASR: 18.7%

Resilience varies substantially by context provenance:

• Authority-framed falsehoods: Type 1 ASR 69.5%
• Neutral: 65.2%
• Patient: 18.5%

Content corruption classes also exhibit varying disruption rates (Type 1 ASR): Exception Poisoning (64.1%), Threshold/Reference Corruption (60.9%), Relationship/Sequence Inversion (53.4%), Cue Remapping (50.4%), Spurious Anchoring (20.9%).

Model-level extremes include Gemini-3.1-pro (high reasoning) with highest clean accuracy (83.5%) but a Type 1 ASR of 65.0% and GPT-5.4 (medium reasoning) with the lowest ASR (36.1%).

5. Expert Validation and Clinical Risk Assessment

A 14-member clinician panel from seven countries validated a stratified 89-item sample using a five-dimensional rubric (base-item validity, answer preservation, falsehood clarity, attack-type fidelity, and clinical plausibility). Composite item quality was high (1.76/2.00, 95% CI 1.71–1.81), with all criteria exceeding an 80% pass rate.

Expert risk review on 89 model-response tasks revealed:

• 38.2% of reviewed cases involved outputs that were incorrect, incorporated the misleading context, and posed serious potential for clinical harm (95% CI 28.8–48.6)
• 98.1% concordance between automatic label and clinician correctness assessment
• Gwet’s AC2 inter-rater reliability: 0.94 correctness, 0.95 uptake, 0.84 harm, 0.78 grounding

A plausible implication is that LLM evaluation strictly on clean data fails to capture the real-world risk profile of such systems in clinical deployment.

6. Implications for Benchmark and Model Development

MedMisBench exposes a fundamental shortcoming of prevailing LLM evaluation practices in medicine: existing benchmarks measure only the conditional knowledge of models absent adversarial context. Key insights include:

• A single focused false statement (Type 1) can halve model accuracy, whereas mixed (Type 2) context dilutes but does not abrogate the effect.
• Authority-framed and formal, rule-like corruptions (e.g., exception poisoning, guideline misstatements) are especially potent in flipping correct answers.
• Increased use of chain-of-thought or high-reasoning settings does not necessarily yield higher epistemic resilience and may worsen susceptibility in certain configurations.

Recommendations for the field include:

1. Embedding adversarial context injections in future medical QA benchmarks to capture model resilience properties.
2. Stratifying benchmarks by corruption and provenance taxonomies to enable fine-grained vulnerability analysis.
3. Incorporating retrieval or debiasing modules capable of verifying context prior to answer emission.
4. Developing fine-tuning regimes that penalize deference to superficially authoritative but incorrect claims (“resilience fine-tuning”).
5. Maintaining clinician-in-the-loop review for risk assessment, recognizing the limitations of purely automated metrics.

7. Relation to Adjacent Benchmarks and Future Directions

MedMisBench is methodologically distinct from error-replication datasets such as MedMistake-Bench, which synthesizes and validates QA errors automatically generated from simulated clinical conversations (Proniakin et al., 24 Dec 2025). Whereas MedMistake-Bench focuses on reproducing established LLM mistakes, MedMisBench systematically probes active epistemic disturbance in a controlled, adversarial setting spanning thousands of task instances.

Continued development is expected to address specialty coverage gaps, enhance calibration of clinical risk labeling, and further integrate human expert review with large-scale automated challenge generation. A plausible implication is the convergence of adversarial and error-replication paradigms could define the next phase of medical LLM evaluation, foregrounding resilience as a core safety criterion.