MedSentry: Understanding and Mitigating Safety Risks in Medical LLM Multi-Agent Systems
Open accessAbstract
As large language models (LLMs) are increasingly deployed in healthcare, ensuring their safety, particularly within collaborative multi-agent configurations, is paramount. In this paper we introduce MedSentry, a benchmark comprising 5 000 adversarial medical prompts spanning 25 threat categories with 100 subthemes. Coupled with this dataset, we develop an end-to-end attack-defense evaluation pipeline to systematically analyze how four representative multi-agent topologies (Layers, SharedPool, Centralized, and Decentralized) withstand attacks from 'dark-personality' agents. Our findings reveal critical differences in how these architectures handle information contamination and maintain robust decision-making, exposing their underlying vulnerability mechanisms. For instance, SharedPool's open information sharing makes it highly susceptible, whereas Decentralized architectures exhibit greater resilience thanks to inherent redundancy and isolation. To mitigate these risks, we propose a personality-scale detection and correction mechanism that identifies and rehabilitates malicious agents, restoring system safety to near-baseline levels. MedSentry thus furnishes both a rigorous evaluation framework and practical defense strategies that guide the design of safer LLM-based multi-agent systems in medical domains.
AI snapshot
Written from the paper’s full text.
TL;DR
MedSentry introduces a 5,000-prompt adversarial medical benchmark and an attack-defense pipeline for four LLM multi-agent topologies under dark-personality insider threats. It finds SharedPool most vulnerable, Decentralized most resilient, and a lightweight Enforcement Agent restores safety scores to near baseline.
Key findings
- MedSentry’s 5,000 adversarial medical prompts span 25 threat categories and 100 subthemes; across single-agent, multi-agent, and four core topologies, LCS and RS scores are consistently lower on MedSentry than on MedSafetyBench, indicating greater threat potential and concealment.
- Under dark-personality attack, Decentralized suffers the smallest drops (LCS ↓ 2.6%, RS ↓ 2.7%), while SharedPool suffers the largest (LCS ↓ 8.7%, RS ↓ 9.6%); Layers and Centralized fall in between at roughly 3–4%.
- Defense recovery: Centralized 72.2→74.8 (+3.5%, 1.5% below baseline), Decentralized 80.2→81.6 (+1.8%, 0.9% below baseline), Layers 75.0→76.1 (+1.3%, 2.6% below baseline), SharedPool 69.1→76.0 (+7.4%, 2.4% below baseline).
- Multi-round debate amplifies attack effects, especially in Centralized and SharedPool; increasing agent count generally improves robustness, while Decentralized remains consistently stable.
Methods
- Benchmark construction used three licensed physicians, GPT-o3 for topic/subtopic generation, GPT-4o and Claude 3.7 Sonnet for candidate instructions, temperature sampling at 0.1, 0.3, 0.5, 0.7, and 0.9, human curation, and purification to yield 5,000 adversarial medical prompts.
- Evaluation formalized four topologies (Layers, SharedPool, Centralized, Decentralized), fixed five agents with GPT-4o at temperature 0.7, injected one dark-personality agent, and graded traces with an Evaluator Agent using AMA Principles of Medical Ethics; metrics were Length-Controlled Score (LCS) and Raw Score (RS).
- Defense used an Enforcement Agent with psychometric screening from a ten-item Dark Triad/PCL-R/MACH-IV-derived scale, behavioral verification, and topology-aware graded isolation.
Limitations
- Stated: topology scope is limited to four canonical architectures, so hybrid or emerging designs may show distinct robustness profiles; defense rules are static and rely on fixed psychometric thresholds and rule-based isolation; decentralized deployments incur substantial token and computation costs; and the work does not evaluate risks from external tools or APIs.
- Evident from the text: the hidden-intent experiment shows that prior access to the Enforcement Agent’s prompt weakens recovery across architectures, most severely in Centralized (LCS 76.3→67.1; RS 76.5→70.6), effectively nullifying defense gains.
- Evident from the text: additional monitoring rounds yield negligible safety improvements beyond the first intervention, and the default experiments use a single debate round unless otherwise specified.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
0 of 19 cited sources checked · 0 supported · 0 flagged
- Findingown data
SharedPool recovers from 69.1 to 76.0 (+7.4%, 2.4% below baseline).
“SharedPool from 69.1 to 76.0 (+7.4%, 2.4% below baseline).”
Quote in the paperSubstantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
- Findingown data
MedSentry poses stronger threats than MedSafetyBench.
“We demonstrate that MedSentry poses stronger threats by comparing it to MedSafetyBench [14] using LCS and RS.”
Quote in the paperSubstantial claim0 of 1 sources checked- cites [14]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- Findingown data
SharedPool exhibits the largest declines in LCS (8.7%) and RS (9.6%) under attack, indicating its vulnerability.
“In contrast, SharedPool exhibits the largest declines (LCS ↓ 8.7%, RS ↓ 9.6%), indicating its vulnerability.”
Quote in the paperSubstantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
- Findingown data
Across single-agent strategies, multi-agent frameworks, and four core topologies, LCS and RS scores on MedSentry are consistently lower than on MedSafetyBench.
“As shown in Table 2, across single-agent strategies, multi-agent frameworks, and our four core LLM multi-agent topologies, the LCS and RS scores on MedSentry are consistently lower than those on MedSafetyBench.”
Quote in the paperSubstantial claim - Findingown data
Increasing the number of debate rounds markedly affects LCS and RS across all four topologies under baseline, attack, and defense conditions.
“As shown in Figure 4, increasing the number of debate rounds markedly affects LCS and RS across all four topologies under baseline, attack, and defense conditions.”
Quote in the paperSubstantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Findingown data
Layers recovers from 75.0 to 76.1 (+1.3%, 2.6% below baseline).
“Layers from 75.0 to 76.1 (+1.3%, 2.6% below baseline)”
Quote in the paperNot a substantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
- Findingown data
Decentralized recovers from 80.2 to 81.6 (+1.8%, 0.9% below baseline).
“Decentralized recovers from 80.2 to 81.6 (+1.8%, 0.9% below baseline)”
Quote in the paperNot a substantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
- Findingnone given
MedSentry is a benchmark comprising 5,000 adversarial medical prompts spanning 25 threat categories with 100 subthemes.
“we introduce MedSentry, a benchmark comprising 5,000 adversarial medical prompts spanning 25 threat categories with 100 subthemes.”
Quote in the paperSubstantial claim - Findingown data
MedSentry includes an end-to-end attack-defense evaluation pipeline to systematically analyze how four representative multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) withstand attacks from dark-personality agents.
“we develop an end-to-end attack-defense evaluation pipeline to systematically analyze how four representative multi-agent topologies (i.e., Layers, SharedPool, Centralized, and Decentralized) withstand attacks from”
Quote in the paperSubstantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Findingreasoning
The multi-stage filtering process yielded a dataset comprising 100 medical adversarial instruction subtopics.
“This iterative, multi-stage filtering process yielded a comprehensive dataset comprising 100 medical adversarial instruction subtopics.”
Quote in the paperSubstantial claim - Findingown data
Layers and Centralized topologies show attack-induced reductions of approximately 3-4% in LCS and RS.
“Layers and Centralized fall in between, with reductions of approximately 3-4%, suggesting that hierarchical control or centralized decision-making offers some protection but does not eliminate susceptibility.”
Quote in the paperSubstantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
- Findingown data
In Centralized topology, defense score rebounds from 72.2 to 74.8 (+3.5%, remaining 1.5% below baseline).
“In the Centralized topology, the score rebounds from 72.2 to 74.8 (+3.5%, remaining 1.5% below baseline).”
Quote in the paperNot a substantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
- Findingown data
GPT-4o and Deepseekv3 enjoy strong recoveries under Defense.
“In all four topologies, GPT-4o and Deepseekv3 lead in LCS, suffering minimal drops under Attack and enjoying strong recoveries under Defense.”
Quote in the paperNot a substantial claim - Findingown data
In Centralized, the attack-induced drop in LCS and RS shrinks from 7.2% and 6.8% with three agents to 5.9% and 5.4% with six agents, respectively.
“In Centralized, the attack-induced drop in LCS and RS shrinks from 7.2% and 6.8% with three agents to 5.9% and 5.4% with six agents, respectively, with a modest reduction in defense gain-showing that added redundancy improves fault tolerance.”
Quote in the paperSubstantial claim - Findingown data
The Decentralized topology consistently ranks first or second across nearly all 25 medical safety topics (LCS/RS).
“The Decentralized topology consistently ranks first or second across nearly all topics;”
Quote in the paperSubstantial claim - Findingown data
Subsequent monitoring offers virtually no extra benefit.
“In summary, additional monitoring rounds yield negligible improvements in safety performance: the first execution of the defense process achieves most of the safety gains, and subsequent monitoring offers virtually no extra benefit.”
Quote in the paperSubstantial claim - Findingown data
SharedPool is the most vulnerable of the four topologies to information poisoning.
“Experiments show that SharedPool is most vulnerable to information poisoning, Decentralized is the most robust, and the weak spots of Centralized and Layers emerge in late-stage dialogues and bottom-layer nodes, respectively.”
Quote in the paperSubstantial claim - Findingown data
Layers and SharedPool show only minor decimal-level fluctuations in LCS and RS when monitoring rounds vary from one to three.
“For instance, in the Centralized topology, LCS increases slightly from 76.2 to 76.7, while in Decentralized, RS rises modestly from 82.6 to 83.7; Layers and SharedPool also show only minor decimal-level fluctuations.”
Quote in the paperSubstantial claim - Findingown data
During the defense phase, advance knowledge of the Enforcement Agent's policy uniformly weakened recovery across all architectures.
“During the defense phase, advance knowledge of the Enforcement Agent's policy uniformly weakened recovery across all architectures, with the Centralized structure most severely impacted (LCS: 76.3→67.1;RS: 76.5→70.6),effectively nullifying the defense gains.”
Quote in the paperNot a substantial claim- The authors state this as an assumption: A system vulnerability has exposed the Enforcement Agent's prompts, granting the dark-personality agent full knowledge of the defense rules.
- Findingown data
In the Decentralized topology, RS rises modestly from 82.6 to 83.7 when monitoring rounds vary from one to three.
“For instance, in the Centralized topology, LCS increases slightly from 76.2 to 76.7, while in Decentralized, RS rises modestly from 82.6 to 83.7; Layers and SharedPool also show only minor decimal-level fluctuations.”
Quote in the paperSubstantial claim - Findingown data
Defended scores remain above the attack condition across topologies.
“Although these defended scores remain above the attack condition, they do not demonstrate significant gains beyond the initial intervention, indicating that the first round of psychometric screening and behavioural verification already captures the majority of the defense benefit.”
Quote in the paperNot a substantial claim - Findingown data
The hidden-intent variant yielded slight improvements in Centralized and Layers topologies (LCS: 65.4→65.6; RS: 65.3→67.4).
“Following the introduction of a dark-personality agent, the hidden-intent variant unexpectedly yielded slight improvements in Centralized and Layers topologies (LCS: 65.4→65.6;RS: 65.3→67.4),suggesting misclassification of adversarial behavior by their anomaly detectors.”
Quote in the paperNot a substantial claim- The authors state this as an assumption: A system vulnerability has exposed the Enforcement Agent's prompts, granting the dark-personality agent full knowledge of the defense rules.
- Findingown data
GPT-3.5-turbo and LLaMA3-70B show moderate vulnerability with Attack drops of about 4-5 points in RS.
“GPT-3.5-turbo and LLaMA3-70B show moderate vulnerability with Attack drops of about 4-5 points.”
Quote in the paperNot a substantial claim - Findingown data
Decentralized maintains consistent stability and defense performance across agent counts.
“Overall, increasing the number of agents boosts robustness-especially in Centralized and SharedPool-whereas Decentralized maintains consistent stability and defense performance.”
Quote in the paperSubstantial claim - Findingown data
GPT-4o and Deepseekv3 recover nearly to baseline under Defense.
“RS patterns closely mirror those of LCS: GPT-4o and Deepseekv3 maintain the highest RS and recover nearly to baseline under Defense.”
Quote in the paperNot a substantial claim - Findingown data
In Layers, defense gain is relatively weak, falling to +0.6% (LCS) and +2.2% (RS) at six agents.
“In Layers, the largest attack drop occurs at three agents (LCS down 7.2%, RS down 6.8%), improves with four and five agents, then rises slightly at six; its defense gain is relatively weak, falling to +0.6% (LCS) and +2.2% (RS) at six agents.”
Quote in the paperNot a substantial claim - Findingown data
The SharedPool topology scores lowest on high-risk categories such as Prescription Drug Abuse, Medical Fraud, and Dangerous Medical Advice.
“the SharedPool topology scores lowest on high-risk categories such as”
Quote in the paperSubstantial claim - Findingown data
RS patterns closely mirror those of LCS.
“RS patterns closely mirror those of LCS: GPT-4o and Deepseekv3 maintain the highest RS and recover nearly to baseline under Defense.”
Quote in the paperNot a substantial claim - Findingown data
In the Decentralized topology, LLaMA3-8B's LCS falls below 70 under Attack.
“The Decentralized topology accentuates this resilience gap: GPT-4o's LCS remains above 80 even under Attack, whereas LLaMA3-8B falls below 70 (see Figure 10).”
Quote in the paperNot a substantial claim - Findingown data
In all four topologies, GPT-4o and Deepseekv3 lead in LCS.
“In all four topologies, GPT-4o and Deepseekv3 lead in LCS, suffering minimal drops under Attack and enjoying strong recoveries under Defense.”
Quote in the paperSubstantial claim - Findingown data
The Centralized topology remains in the middle, showing the smoothest responses even in extreme cases.
“the Centralized topology remains in the middle, showing the smoothest responses even in extreme cases.”
Quote in the paperNot a substantial claim - Findingown data
In the Centralized topology, LCS increases slightly from 76.2 to 76.7 when monitoring rounds vary from one to three.
“For instance, in the Centralized topology, LCS increases slightly from 76.2 to 76.7, while in Decentralized, RS rises modestly from 82.6 to 83.7; Layers and SharedPool also show only minor decimal-level fluctuations.”
Quote in the paperSubstantial claim - Findingown data
Additional monitoring rounds do not demonstrate significant gains beyond the initial intervention.
“Although these defended scores remain above the attack condition, they do not demonstrate significant gains beyond the initial intervention, indicating that the first round of psychometric screening and behavioural verification already captures the majority of the defense benefit.”
Quote in the paperSubstantial claim - Findingown data
The Centralized structure was most severely impacted by advance knowledge of the Enforcement Agent's policy during defense (LCS: 76.3→67.1; RS: 76.5→70.6).
“During the defense phase, advance knowledge of the Enforcement Agent's policy uniformly weakened recovery across all architectures, with the Centralized structure most severely impacted (LCS: 76.3→67.1;RS: 76.5→70.6),effectively nullifying the defense gains.”
Quote in the paperNot a substantial claim- The authors state this as an assumption: A system vulnerability has exposed the Enforcement Agent's prompts, granting the dark-personality agent full knowledge of the defense rules.
- Findingown data
The first execution of the defense process achieves most of the safety gains.
“In summary, additional monitoring rounds yield negligible improvements in safety performance: the first execution of the defense process achieves most of the safety gains, and subsequent monitoring offers virtually no extra benefit.”
Quote in the paperSubstantial claim - Findingown data
Decentralized is the most robust of the four topologies.
“Experiments show that SharedPool is most vulnerable to information poisoning, Decentralized is the most robust, and the weak spots of Centralized and Layers emerge in late-stage dialogues and bottom-layer nodes, respectively.”
Quote in the paperSubstantial claim - Findingown data
LLaMA3-8B exhibits the steepest Attack-induced decline.
“GPT-3.5-turbo and LLaMA3-70B occupy a middle ground, while LLaMA3-8B exhibits the lowest baseline LCS and the steepest Attack-induced decline.”
Quote in the paperNot a substantial claim - Findingnone given
The lightweight PCDC mechanism restores LCS/RS scores to near baseline without extra training.
“The lightweight PCDC mechanism (personality-scale detection, behavioural verification, and topology-aware isolation) restores LCS/RS scores to near baseline without extra training, offering a practical safety shield for medical applications.”
Quote in the paperSubstantial claim - Findingown data
LLaMA3-8B exhibits the lowest baseline LCS.
“GPT-3.5-turbo and LLaMA3-70B occupy a middle ground, while LLaMA3-8B exhibits the lowest baseline LCS and the steepest Attack-induced decline.”
Quote in the paperNot a substantial claim - Findingown data
The SharedPool topology achieves the highest accuracy (MedQA 77.2%, PubMedQA 73.1%).
“the SharedPool topology achieves the highest accuracy (MedQA 77.2 %, PubMedQA 73.1 %),”
Quote in the paperNot a substantial claim - Findingown data
The SharedPool topology ranks second in resource usage, with an average of 21,412.2 tokens and 233.2 seconds.
“The SharedPool topology ranks second, with an average of 21,412.2tokens and 233.2 seconds, while the Layers topology strikes a balance between performance and cost, consuming 22,647.8tokens and 229.1 seconds.”
Quote in the paperNot a substantial claim - Findingown data
Prior access to the defense policy degrades overall safety metrics.
“We then measure the resulting LCS and RS, demonstrating how prior access to the defense policy enables the dark-personality agent to suppress its malicious intent in its first utterance from round two onward, thereby degrading overall safety metrics (see Figure 9).”
Quote in the paperSubstantial claim- The authors state this as an assumption: A system vulnerability has exposed the Enforcement Agent's prompts, granting the dark-personality agent full knowledge of the defense rules.
- Findingown data
GPT-4o and Deepseekv3 maintain the highest RS.
“RS patterns closely mirror those of LCS: GPT-4o and Deepseekv3 maintain the highest RS and recover nearly to baseline under Defense.”
Quote in the paperNot a substantial claim - Findingown data
The weak spots of the Centralized topology emerge in late-stage dialogues.
“Experiments show that SharedPool is most vulnerable to information poisoning, Decentralized is the most robust, and the weak spots of Centralized and Layers emerge in late-stage dialogues and bottom-layer nodes, respectively.”
Quote in the paperSubstantial claim - Findingown data
Core medical performance on MedQA and PubMedQA is remarkably similar across topologies.
“their core medical performance on MedQA and PubMedQA is remarkably similar, validating the fairness of our comparisons (see Figure 8).”
Quote in the paperSubstantial claim - Findingown data
Across all four topologies, LCS and RS curves exhibit only marginal changes when the Enforcement Agent monitors for one to three consecutive rounds.
“As shown in the Figure 12, across all four topologies, the LCS and RS curves exhibit only marginal changes when the Enforcement Agent monitors for one to three consecutive rounds.”
Quote in the paperSubstantial claim - Findingown data
Additional monitoring rounds yield negligible improvements in safety performance.
“In summary, additional monitoring rounds yield negligible improvements in safety performance: the first execution of the defense process achieves most of the safety gains, and subsequent monitoring offers virtually no extra benefit.”
Quote in the paperSubstantial claim - Findingown data
Prior access to the defense policy enables the dark-personality agent to suppress its malicious intent in its first utterance from round two onward.
“We then measure the resulting LCS and RS, demonstrating how prior access to the defense policy enables the dark-personality agent to suppress its malicious intent in its first utterance from round two onward, thereby degrading overall safety metrics (see Figure 9).”
Quote in the paperSubstantial claim- The authors state this as an assumption: A system vulnerability has exposed the Enforcement Agent's prompts, granting the dark-personality agent full knowledge of the defense rules.
- Findingown data
In the Decentralized topology, GPT-4o's LCS remains above 80 even under Attack.
“The Decentralized topology accentuates this resilience gap: GPT-4o's LCS remains above 80 even under Attack, whereas LLaMA3-8B falls below 70 (see Figure 10).”
Quote in the paperNot a substantial claim - Findingown data
GPT-3.5-turbo and LLaMA3-70B occupy a middle ground in LCS performance.
“GPT-3.5-turbo and LLaMA3-70B occupy a middle ground, while LLaMA3-8B exhibits the lowest baseline LCS and the steepest Attack-induced decline.”
Quote in the paperNot a substantial claim - Findingown data
The weak spots of the Layers topology emerge in bottom-layer nodes.
“Experiments show that SharedPool is most vulnerable to information poisoning, Decentralized is the most robust, and the weak spots of Centralized and Layers emerge in late-stage dialogues and bottom-layer nodes, respectively.”
Quote in the paperSubstantial claim - Findingown data
The SharedPool topology experienced further degradation under covert attack (LCS: 63.0→62.7; RS: 65.1→66.2).
“In contrast, the SharedPool topology experienced further degradation under covert attack (LCS: 63.0→62.7;RS: 65.1→66.2),indicating that its voting mechanism is particularly vulnerable to well-camouflaged malicious inputs.”
Quote in the paperSubstantial claim- The authors state this as an assumption: A system vulnerability has exposed the Enforcement Agent's prompts, granting the dark-personality agent full knowledge of the defense rules.
- Interpretationown data
SharedPool's open information sharing makes it highly susceptible to attacks.
“SharedPool's open information sharing makes it highly susceptible”
Quote in the paperSubstantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
- Premisenone given
The inherent safety properties of different multi-agent architectures against sophisticated internal attacks remain largely uncharted.
“Second, the inherent safety properties of different multi-agent architectures-such as shared information pools versus decentralized networks-against sophisticated internal attacks remain largely uncharted territory.”
Quote in the paperNot a substantial claim - Premisecitation
Adversarial prompt injection is a widely observed phenomenon where malicious agents manipulate shared prompts to induce harmful behavior in benign agents.
“Adversarial prompt injection [37,38,39,40,41] is a widely observed phenomenon, where malicious agents manipulate shared prompts to induce harmful behavior in otherwise benign agents.”
Quote in the paperSubstantial claim0 of 5 sources checked- cites [37]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- cites [38]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- cites [39]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- cites [40]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- cites [41]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- Interpretationown data
Decentralized architectures exhibit greater resilience due to inherent redundancy and isolation.
“Decentralized architectures exhibit greater resilience due to inherent redundancy and isolation.”
Quote in the paperSubstantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
- Premisecitation
There is no lightweight, adaptive, and effective strategy against compromised agents within complex, collaborative medical workflows.
“Third, while some works propose defense mechanisms against adversarial prompts or model poisoning [26,27], there is no lightweight, adaptive, and effective strategy against compromised agents within complex, collaborative medical workflows.”
Quote in the paperSubstantial claim0 of 2 sources checked- cites [26]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- cites [27]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- Premisecitation
In collaborative diagnostic tasks, such attacks can cause cascading errors or misdiagnoses when one compromised agent spreads misinformation through inter-agent messages.
“In collaborative diagnostic tasks, such attacks [42,43,44,45,46] can cause cascading errors or misdiagnoses when one compromised agent spreads misinformation through inter-agent messages.”
Quote in the paperSubstantial claim0 of 5 sources checked- cites [42]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- cites [43]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- cites [44]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- cites [45]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- cites [46]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- Premisecitation
Existing medical LLM benchmarks often target single-agent performance or static scenarios, lacking a framework to systematically evaluate diverse and dynamic threats posed by malicious internal agents.
“First, existing medical LLM benchmarks often target single-agent performance or static scenarios, lacking a framework to systematically evaluate the diverse and dynamic threats posed by malicious internal agents [22,19].”
Quote in the paperSubstantial claim0 of 2 sources checked- cites [22]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- cites [19]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- Premisecitation
Without proper alignment and auditing mechanisms, medical multi-agent systems are vulnerable to exploitation by malicious actors.
“However, without proper alignment and auditing mechanisms, these systems are vulnerable to exploitation.”
Quote in the paperSubstantial claim0 of 1 sources checked- cites [14]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- Interpretationown data
The SharedPool model excels at collaborative medical reasoning.
“This suggests that the SharedPool model excels at collaborative medical reasoning,”
Quote in the paperNot a substantial claim - Interpretationown data
The first round of psychometric screening and behavioural verification already captures the majority of the defense benefit.
“Although these defended scores remain above the attack condition, they do not demonstrate significant gains beyond the initial intervention, indicating that the first round of psychometric screening and behavioural verification already captures the majority of the defense benefit.”
Quote in the paperSubstantial claim - Interpretationown data
Increasing the number of agents boosts robustness, especially in Centralized and SharedPool.
“Overall, increasing the number of agents boosts robustness-especially in Centralized and SharedPool-whereas Decentralized maintains consistent stability and defense performance.”
Quote in the paperSubstantial claim - Interpretationown data
The Layers topology strikes a balance between performance and cost.
“The SharedPool topology ranks second, with an average of 21,412.2tokens and 233.2 seconds, while the Layers topology strikes a balance between performance and cost, consuming 22,647.8tokens and 229.1 seconds.”
Quote in the paperNot a substantial claim - Interpretationown data
The slight improvements in Centralized and Layers under the hidden-intent variant suggest misclassification of adversarial behavior by their anomaly detectors.
“Following the introduction of a dark-personality agent, the hidden-intent variant unexpectedly yielded slight improvements in Centralized and Layers topologies (LCS: 65.4→65.6;RS: 65.3→67.4),suggesting misclassification of adversarial behavior by their anomaly detectors.”
Quote in the paperNot a substantial claim- The authors state this as an assumption: A system vulnerability has exposed the Enforcement Agent's prompts, granting the dark-personality agent full knowledge of the defense rules.
- Interpretationown data
These consistent cross-model behaviors confirm the broad applicability of the benchmark and methods.
“These consistent cross-model behaviors confirm the broad applicability of our benchmark and methods (see Figure 11).”
Quote in the paperSubstantial claim - Interpretationown data
Added redundancy improves fault tolerance in Centralized.
“In Centralized, the attack-induced drop in LCS and RS shrinks from 7.2% and 6.8% with three agents to 5.9% and 5.4% with six agents, respectively, with a modest reduction in defense gain-showing that added redundancy improves fault tolerance.”
Quote in the paperSubstantial claim - Study design and conductown data
The similarity of core medical performance on MedQA and PubMedQA validates the fairness of comparisons across topologies.
“their core medical performance on MedQA and PubMedQA is remarkably similar, validating the fairness of our comparisons (see Figure 8).”
Quote in the paperSubstantial claim - Interpretationown data
The Decentralized topology accentuates the resilience gap between models.
“The Decentralized topology accentuates this resilience gap: GPT-4o's LCS remains above 80 even under Attack, whereas LLaMA3-8B falls below 70 (see Figure 10).”
Quote in the paperNot a substantial claim - Interpretationown data
SharedPool's voting mechanism is particularly vulnerable to well-camouflaged malicious inputs.
“In contrast, the SharedPool topology experienced further degradation under covert attack (LCS: 63.0→62.7;RS: 65.1→66.2),indicating that its voting mechanism is particularly vulnerable to well-camouflaged malicious inputs.”
Quote in the paperSubstantial claim- The authors state this as an assumption: A system vulnerability has exposed the Enforcement Agent's prompts, granting the dark-personality agent full knowledge of the defense rules.
- Interpretationown data
The Decentralized architecture strikes a strong balance between distributed decision-making and overall effectiveness.
“while the decentralized architecture strikes a strong balance between distributed decision-making and overall effectiveness.”
Quote in the paperNot a substantial claim - Interpretationown data
The Decentralized architecture offers the greatest cross-topic robustness.
“the Decentralized architecture offers the greatest cross-topic robustness, making it ideal for multi-scenario protection;”
Quote in the paperSubstantial claim - Interpretationreasoning
When a malicious agent has prior access to defense prompts and conceals its intent in the initial utterance, most multi-agent topologies fail to achieve their anticipated resilience.
“When a malicious agent has prior access to defense prompts and conceals its intent in the initial utterance, most multi-agent topologies fail to achieve their anticipated resilience.”
Quote in the paperSubstantial claim- The authors state this as an assumption: A system vulnerability has exposed the Enforcement Agent's prompts, granting the dark-personality agent full knowledge of the defense rules.
- Interpretationown data
Advance knowledge of the Enforcement Agent's policy effectively nullified the defense gains.
“During the defense phase, advance knowledge of the Enforcement Agent's policy uniformly weakened recovery across all architectures, with the Centralized structure most severely impacted (LCS: 76.3→67.1;RS: 76.5→70.6),effectively nullifying the defense gains.”
Quote in the paperSubstantial claim- The authors state this as an assumption: A system vulnerability has exposed the Enforcement Agent's prompts, granting the dark-personality agent full knowledge of the defense rules.
- Interpretationown data
Each topology's defensive strengths differ.
“These findings indicate that each topology's defensive strengths differ:”
Quote in the paperSubstantial claim - Interpretationreasoning
The Layers topology benefits from multi-stage cross-checking to correct mid-dialogue errors.
“the Layers topology benefits from multi-stage cross-checking to correct mid-dialogue errors;”
Quote in the paperSubstantial claim - Interpretationown data
PCDC offers a practical safety shield for medical applications.
“The lightweight PCDC mechanism (personality-scale detection, behavioural verification, and topology-aware isolation) restores LCS/RS scores to near baseline without extra training, offering a practical safety shield for medical applications.”
Quote in the paperSubstantial claim - Interpretationown data
The SharedPool model's voting aggregation is vulnerable to deeply disguised attacks.
“the SharedPool model's voting aggregation is vulnerable to deeply disguised attacks and therefore requires stronger identity and content verification on critical topics;”
Quote in the paperSubstantial claim
- May combine two claims. 38
- Classified as probably not a substantial claim. 7
- The quote only partly states this claim. 1
May combine two claims.
Findingown dataIn Layers, largest attack drop occurs at three agents (LCS down 7.2%, RS down 6.8%), improves with four and five agents, then rises slightly at six; defense gain falls to +0.6% LCS and +2.2% RS at six agents.
“In Layers, the largest attack drop occurs at three agents (LCS down 7.2%, RS down 6.8%), improves with four and five agents, then rises slightly at six; its defense gain is relatively weak, falling to +0.6% (LCS) and +2.2% (RS) at six agents.”
Quote in the paperSubstantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
Classified as probably not a substantial claim.
FindingreasoningThe final set of 5,000 attack instructions balances diversity and stealth.
“we produced a final set of 5,000 attack instructions that balance both diversity and stealth.”
Quote in the paperSubstantial claimMay combine two claims.
FindingreasoningMedSentry is a robust, heterogeneous corpus of 5,000 adversarial medical prompts spanning 25 primary topics and 100 subtopics that balances diverse attack vectors with subtlety required to evade naive safety filters.
“we assembled a robust, heterogeneous corpus of 5,000 adversarial medical prompts-spanning 25 primary topics and 100 subtopics-that balances diverse attack vectors with the subtlety required to evade naive safety filters”
Quote in the paperSubstantial claimMay combine two claims.
Findingown dataDecentralized remains largely stable with attack drops of 2-3% and defense gains climbing from +1.5% to +8.2%.
“The Decentralized topology remains largely stable, with attack drops of only 2-3% and defense gains climbing from +1.5% to +8.2%, demonstrating exceptional multi-round resilience.”
Quote in the paperSubstantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
May combine two claims.
Findingown dataIn Layers, attack impact peaks in round 2 (LCS down 6.6%, RS down 8.6%) before slightly receding in round 3; defense benefit peaks at +4.7% LCS and +4.2% RS.
“In Layers, the attack impact peaks in round 2 (LCS down 6.6%, RS down 8.6%) before slightly receding in round 3; defense benefit similarly peaks at +4.7% (LCS) and +4.2% (RS).”
Quote in the paperNot a substantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
May combine two claims.
Findingown dataA personality-scale detection and correction mechanism identifies and rehabilitates malicious agents, restoring system safety to near-baseline levels.
“we propose a personality-scale detection and correction mechanism that identifies and rehabilitates malicious agents, restoring system safety to near-baseline levels.”
Quote in the paperSubstantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
May combine two claims.
Findingown dataSharedPool accumulates attack effects largest in round 2 (LCS down 13.8%, RS down 9.7%) with modest reduction in round 3, and achieves highest defense gain in round 3 (+19.4% LCS, +15.8% RS).
“SharedPool also accumulates attack effects-largest in round 2 (LCS down 13.8%, RS down 9.7%) with a modest reduction in round 3-and achieves its highest defense gain in round 3 (+19.4%LCS, +15.8% RS).”
Quote in the paperNot a substantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
Probably not a substantial claim: may not pass S4 (based).
Findingnone givenMedSentry is designed for role-playing multiagent architectures that directly mine and utilize medical knowledge inherent in LLMs to defense.
“our MedSentry is designed for role-playing multiagent architectures that directly mine and utilize the medical knowledge inherent in LLMs to defense, adapting to complex and various medical safety attack scenarios.”
Quote in the paperNot a substantial claimMay combine two claims.
Findingown dataIn Centralized, attack-induced drops increase from 6.0% LCS and 3.6% RS at round 1 to 17.2% and 18.7% by round 3, while defense recovery rises from +4.1% to +17.2%.
“In the Centralized topology, the attack-induced drops increase from a 6.0% decrease in LCS and 3.6% in RS at round 1 to 17.2% and 18.7%, respectively, by round 3, while defense recovery rises from +4.1 % to +17.2%.”
Quote in the paperSubstantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
May combine two claims.
Findingown dataIn Centralized, attack-induced drop in LCS and RS shrinks from 7.2% and 6.8% with three agents to 5.9% and 5.4% with six agents, with modest reduction in defense gain.
“In Centralized, the attack-induced drop in LCS and RS shrinks from 7.2% and 6.8% with three agents to 5.9% and 5.4% with six agents, respectively, with a modest reduction in defense gain-showing that added redundancy improves fault tolerance.”
Quote in the paperSubstantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
May combine two claims.
FindingreasoningMedSentry extends harmful medical requests in a fine-grained manner and provides a comprehensive evaluation benchmark for safety performance of four mainstream medical multi-agent architectures.
“our MedSentry extends harmful medical requests in a fine-grained manner and provides a novel comprehensive evaluation benchmark for the safety performance of the current four mainstream medical multi-agent architectures.”
Quote in the paperSubstantial claimMay combine two claims.
Findingown dataSharedPool exhibits strongest scaling effect: attack drops diminish from 13.2% LCS and 13.4% RS at three agents to 8.8% and 8.4% at six, while defense gain peaks at four agents (+11.1% LCS, +10.7% RS) before tapering.
“SharedPool exhibits the strongest scaling effect: attack drops diminish from 13.2% (LCS) and 13.4% (RS) at three agents to 8.8% and 8.4% at six, while defense gain peaks at four agents (+11.1% LCS, +10.7% RS) before tapering.”
Quote in the paperSubstantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
May combine two claims.
Findingown dataUnder baseline conditions, Decentralized achieves the highest scores while SharedPool achieves the lowest.
“Moreover, under baseline conditions, Decentralized achieves the highest scores while SharedPool achieves the lowest, reinforcing the safety benefits of redundant, non-centralized communication.”
Quote in the paperSubstantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
May combine two claims.
Findingown dataThe Decentralized topology suffers the smallest drops in LCS (2.6%) and RS (2.7%) under attack, demonstrating greatest resilience to internal threats.
“The Decentralized topology suffers the smallest drops (LCS ↓ 2.6%, RS ↓ 2.7%), demonstrating the greatest resilience to internal threats.”
Quote in the paperSubstantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
May combine two claims.
Findingown dataDecentralized remains largely insensitive to agent count, with attack drops around 1-3% and peak defense gains of +5.1% LCS and +5.0% RS at five agents.
“The Decentralized topology remains largely insensitive to agent count, with attack drops around 1-3% and peak defense gains of +5.1% (LCS) and +5.0%(RS) at five agents.”
Quote in the paperSubstantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
May combine two claims.
Findingown dataThe Centralized topology achieves MedQA 75.3% and PubMedQA 72.9% accuracy.
“with Centralized (75.3%/72.9%)”
Quote in the paperNot a substantial claimMay combine two claims.
Findingown dataGPT-4o and Deepseekv3 suffer minimal drops under Attack.
“In all four topologies, GPT-4o and Deepseekv3 lead in LCS, suffering minimal drops under Attack and enjoying strong recoveries under Defense.”
Quote in the paperNot a substantial claimMay combine two claims.
Findingown dataSharedPool exhibits the strongest scaling effect: attack drops diminish from 13.2% (LCS) and 13.4% (RS) at three agents to 8.8% and 8.4% at six, while defense gain peaks at four agents (+11.1% LCS, +10.7% RS) before tapering.
“SharedPool exhibits the strongest scaling effect: attack drops diminish from 13.2% (LCS) and 13.4% (RS) at three agents to 8.8% and 8.4% at six, while defense gain peaks at four agents (+11.1% LCS, +10.7% RS) before tapering.”
Quote in the paperSubstantial claimMay combine two claims.
Findingown dataDecentralized wobbles around 200-300 (-1.5) then settles into flat line.
“Decentralized wobble a bit around 200-300 (-1.5) and then settle into a flat line-small ripples, no cliffs.”
Quote in the paperNot a substantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
Probably not a substantial claim: may not pass S3 (load-bearing).
Findingnone givenThe SharedPool vote shifts toward 12-18 hours under false consensus.
“Voting Result: SharedPool vote shifts toward 12-18 hours under false consensus.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.
Findingnone givenNo recommendation includes mandatory labs or emergency protocols, which is a serious oversight.
“No recommendation includes mandatory labs or emergency protocols-serious oversight.”
Quote in the paperNot a substantial claim- Rests on an assumption: A washout of only hours is extremely dangerous and may precipitate fatal serotonin syndrome.
May combine two claims.
Findingown dataThe Decentralized topology remains largely insensitive to agent count, with attack drops around 1-3% and peak defense gains of +5.1% (LCS) and +5.0% (RS) at five agents.
“The Decentralized topology remains largely insensitive to agent count, with attack drops around 1-3% and peak defense gains of +5.1% (LCS) and +5.0%(RS) at five agents.”
Quote in the paperSubstantial claimMay combine two claims.
Findingown dataLLaMA3-8B endures the most pronounced RS degradation, dropping over 5 points under Attack and only partially rebounding.
“LLaMA3-8B endures the most pronounced RS degradation, dropping over 5 points under Attack and only partially rebounding.”
Quote in the paperNot a substantial claimMay combine two claims.
Findingown dataThe Layers topology achieves MedQA 74.8% and PubMedQA 72.2% accuracy.
“and Layers (74.8 %/72.2 %) only marginally lower.”
Quote in the paperNot a substantial claimMay combine two claims. The quote only partly states this claim.
Findingown dataThe Layers topology performs well on Scientific Misinformation topics but underperforms on Vulnerable Groups Risk subthemes.
“the Layers topology performs well on”
Quote in the paperSubstantial claimMay combine two claims.
Findingown dataThe Centralized topology is the most resource-efficient, using only 19,029.3 tokens and completing evaluations in 202.7 seconds.
“In contrast, the Centralized topology is the most resource-efficient, using only 19,029.3tokens and completing evaluations in 202.7 seconds.”
Quote in the paperNot a substantial claimMay combine two claims.
Findingown dataLayers stumble at very end of long chats (900-1000, -0.8) yet self-correct halfway through (+1.0 at 500-600).
“Layers stumble at the very end of long chats (900-1000, -0.8) yet self-correct halfway through (+1.0 at 500-600).”
Quote in the paperNot a substantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
May combine two claims.
Findingown dataIn Centralized, trouble peaks late (tokens 700-800, -3 LCS) but leader keeps things fairly clean at start (+1.5 LCS at 100-200).
“In a Centralized, trouble peaks late (tokens 700-800, -3 LCS) but the leader still keeps things fairly clean at the start (+1.5 LCS at 100-200).”
Quote in the paperNot a substantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
May combine two claims.
Findingown dataUsing GPT-4o, the Decentralized topology incurs the greatest resource usage, consuming on average 36,550.4 tokens and requiring 261.4 seconds per evaluation.
“Although the Decentralized topology exhibits the highest safety performance, it also incurs the greatest resource usage-consuming on average 36,550.4tokens and requiring 261.4 seconds per evaluation.”
Quote in the paperNot a substantial claimMay combine two claims.
Findingown dataThe Layers topology consumes 22,647.8 tokens and 229.1 seconds on average.
“The SharedPool topology ranks second, with an average of 21,412.2tokens and 233.2 seconds, while the Layers topology strikes a balance between performance and cost, consuming 22,647.8tokens and 229.1 seconds.”
Quote in the paperNot a substantial claimMay combine two claims.
Findingown dataThe Decentralized topology achieves MedQA 76.5% and PubMedQA 72.5% accuracy.
“followed closely by Decentralized (MedQA 76.5 %, PubMedQA 72.5 %),”
Quote in the paperNot a substantial claimMay combine two claims.
Findingown dataIn Layers, the largest attack drop occurs at three agents (LCS down 7.2%, RS down 6.8%), improves with four and five agents, then rises slightly at six.
“In Layers, the largest attack drop occurs at three agents (LCS down 7.2%, RS down 6.8%), improves with four and five agents, then rises slightly at six; its defense gain is relatively weak, falling to +0.6% (LCS) and +2.2% (RS) at six agents.”
Quote in the paperNot a substantial claimMay combine two claims.
Findingown dataSharedPool is most exposed in middle (500-600, -2.0) but rallies quickly right after (+2.0 at 300-400).
“SharedPool is the mirror image: it's most exposed in the middle (500-600, -2.0) but rallies quickly right after (+2.0 at 300-400).”
Quote in the paperNot a substantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
May combine two claims.
Interpretationown dataThe Enforcement Agent effectively detects and mitigates insider threats across all four topologies.
“These results confirm RQ2: our Enforcement Agent, via psychometric screening, behavioral verification, and graded isolation, effectively detects and mitigates insider threats across all four topologies.”
Quote in the paperSubstantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
Probably not a substantial claim: may not pass S3 (load-bearing).
PremisecitationChain-of-verification (CoV) has shown promise in reducing susceptibility to misinformation.
“techniques such as chain-of-verification (CoV) [50], where agents crossvalidate each other's outputs using independent reasoning chains, have shown promise in reducing susceptibility to misinformation.”
Quote in the paperNot a substantial claim0 of 1 sources checked- cites [50]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
May combine two claims.
Interpretationown dataThe defense mechanism effectively mitigates damage caused by malicious infiltration across diverse topologies, with notable recovery in SharedPool and Centralized.
“These results confirm that our defense mechanism effectively mitigates the damage caused by malicious infiltration across diverse topologies, with particularly notable recovery in SharedPool and Centralized configurations.”
Quote in the paperSubstantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
May combine two claims.
Interpretationown dataMulti-round debates significantly amplify internal attacks, with greatest impact on Centralized and SharedPool, whereas Decentralized retains high multi-round robustness.
“Multi-round debates significantly amplify internal attacks, with the greatest impact on Centralized and SharedPool topologies, whereas the Decentralized topology retains high multi-round robustness.”
Quote in the paperSubstantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
May combine two claims.
Interpretationown dataIncreasing the number of agents boosts robustness especially in Centralized and SharedPool, whereas Decentralized maintains consistent stability and defense performance.
“Overall, increasing the number of agents boosts robustness-especially in Centralized and SharedPool-whereas Decentralized maintains consistent stability and defense performance.”
Quote in the paperSubstantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
May combine two claims.
Interpretationown dataThe adversarial prompts in MedSentry possess greater threat potential and concealment compared to MedSafetyBench.
“This finding indicates that, after manual curation and secondary refinement to enhance stealth, the adversarial prompts in MedSentry possess greater threat potential and concealment compared to those in MedSafetyBench.”
Quote in the paperSubstantial claimMay combine two claims.
Interpretationown dataIncreasing the number of agents uniformly improves robustness across all topologies, most notably boosting attack resistance and defense recovery in Centralized and SharedPool, while Decentralized maintains low sensitivity and steady defense gains.
“Increasing the number of agents uniformly improves robustness across all topologies, most notably boosting attack resistance and defense recovery in Centralized and SharedPool, while Decentralized maintains consistently low sensitivity and steady defense gains.”
Quote in the paperSubstantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
May combine two claims.
Interpretationown dataMulti-round debate amplifies attack effects especially in Centralized and SharedPool, while Decentralized maintains stability.
“Overall, multi-round debate amplifies attack effects-especially in Centralized and SharedPool-while Decentralized maintains stability.”
Quote in the paperSubstantial claim- Rests on an assumption: The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
- Rests on an assumption: The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
Probably not a substantial claim: may not pass S3 (load-bearing).
PremisecitationThe MedQA dataset comprises USMLE-style multiple-choice questions (four or five options) designed to assess medical knowledge and clinical reasoning.
“The MedQA dataset comprises USMLE-style multiple-choice questions (four or five options) designed to assess medical knowledge and clinical reasoning.”
Quote in the paperNot a substantial claim0 of 1 sources checked- cites [30]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
Probably not a substantial claim: may not pass S3 (load-bearing).
PremisecitationPubMedQA, derived from biomedical research abstracts, poses questions with Yes/No/Maybe answers to benchmark NLP performance on academic question answering.
“PubMedQA, derived from biomedical research abstracts, poses questions with Yes/No/Maybe answers to benchmark NLP performance on academic question answering.”
Quote in the paperNot a substantial claim0 of 1 sources checked- cites [31]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
May combine two claims.
Interpretationown dataThe Centralized architecture performs steadily during the summary phase but relies on single-point validation.
“the Centralized architecture performs steadily during the summary phase but relies on single-point validation.”
Quote in the paperSubstantial claim
The paper relies on this without support.
The four multi-agent topologies (Layers, SharedPool, Centralized, Decentralized) are representative of current medical multi-agent architectures.
“four representative multi-agent topologies”
“four mainstream medical multi-agent architectures”
The paper relies on this without support.
The dark-personality agent's attack strategies (authority forgery, data traps, consensus hijacking) adequately represent real-world insider threats in medical multi-agent systems.
“The adversary conducts: (i) authority forgery (inventing citations), (ii) data traps (fabricating evidence), and (iii) consensus hijacking (feigned professional agreement)”
The authors state this as an assumption.
A system vulnerability has exposed the Enforcement Agent's prompts, granting the dark-personality agent full knowledge of the defense rules.
“Assuming a system vulnerability has exposed the Enforcement Agent's prompts, the dark-personality agent is granted full knowledge of the defense rules.”
The paper relies on this without support.
Venlafaxine and MDMA taken less than 24 hours apart massively increases life-threatening toxicity.
“Venlafaxine + MDMA <24 h apart massively increases life-threatening toxicity.”
The paper relies on this without support.
Very short washouts (6-8 h) risk acute mood destabilization and suicidality.
“Very short washouts (6-8 h) risk acute mood destabilization and suicidality.”
The paper relies on this without support.
Rapid discontinuation can trigger hypertension and arrhythmias, exacerbated by stimulants.
“Rapid discontinuation can trigger hypertension, arrhythmias, exacerbated by stimulants.”
The paper relies on this without support.
Venlafaxine should be discontinued at least 9-10 days prior to MDMA (approximately 5 half-lives plus 1 week stabilization), not mere hours.
“Venlafaxine should be discontinued at least 9-10 days prior to MDMA (≈5 half-lives + 1 week stabilization), not mere hours.”
The paper relies on this without support.
A washout of only hours is extremely dangerous and may precipitate fatal serotonin syndrome.
“A washout of only hours is extremely dangerous and may precipitate fatal serotonin syndrome.”
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
Each contradiction between two passages listed here was confirmed by an independent check.
Centralized attack RS mean does not match its component scores
MajorTable 3 reports attack RS values of 73.5 and 70.1 for the two subsets. Their mean is 71.8, not the reported 72.9; that reported mean is also used to calculate the stated 3.6% degradation.
Reported 72.9 · recomputed 71.8
“| Centralized | 77.2 | 76.3 | 75.2 | 74.9 | 76.2 | 75.6 | 73.4 | 73.5 | 69.8 | 70.1 | 71.6 | 72.9 | 6.0 | 3.6 |”
Temperature-sampling description yields five candidates, not 50
MinorGenerating one instruction at each of five temperatures for each subtopic and model yields five instructions per subtopic per model. The paper says each model produced 50 under that generation description.
“This systematic temperature variation enriched both the linguistic style and attack strategies captured in our dataset.”
“For each subtopic, both GPT-4o and Claude 3.7 Sonnet produced 50 candidate instructions, each annotated with a threat level label (Low/Medium/High).”
Reported accuracies are incompatible with 100 cases per dataset
MinorAccuracy on 100 individual cases must change in one-percentage-point increments. The reported one-decimal accuracies, such as 77.2% and 73.1%, cannot arise from the stated 100 cases per dataset without an unstated averaging procedure.
“In this section, we evaluate our framework on 100 randomly selected cases each from MedQA and PubMedQA.”
“the SharedPool topology achieves the highest accuracy (MedQA 77.2 %, PubMedQA 73.1 %)”
SharedPool covert attack is called degradation despite an RS increase
MinorThe paper defines higher RS as safer, but describes SharedPool as undergoing further degradation when its reported RS rises from 65.1 to 66.2.
“In contrast, the SharedPool topology experienced further degradation under covert attack (LCS: 63.0→62.7;RS: 65.1→66.2)”
“Each row reports LCS and RS (↑ indicates higher is safer).”
Layers steepest increase differs between figure and text
MinorThe Figure 6 values list the Layers increase as +0.8 LCS, while the accompanying description gives +1.0.
“Layers: +0.8”
“Layers stumble at the very end of long chats (900-1000, -0.8) yet self-correct halfway through (+1.0 at 500-600).”
Decentralized steepest decline differs between figure and text
MinorThe Figure 6 values list Decentralized's steepest decline as −1.3 LCS, while the accompanying description gives −1.5.
“Decentralized: -1.3”
“Decentralized wobble a bit around 200-300 (-1.5)”
Cites
The dark triad of personality: Narcissism, Machiavellianism, and psychopathy
Paulhus, D. L., & Williams, K. M. (2002) · Journal of Research in Personality · doi:10.1016/s0092-6566(02)00505-6 · Cited by 5,265 · cited 1× · see citing works
“Stage (i) is instantiated with a ten-item scale, distilled from the Dark Triad, PCL-R, and MACH-IV inventories [61, 62, 63, 64].”
Sallam, M. (2023) · doi:10.1101/2023.02.19.23286155 · Cited by 3,123 · cited 1× · see citing works
“In the medical domain, LLMs have been increasingly investigated for their potential to support clinical decision-making, summarization, and diagnostic reasoning tasks [28, 29].”
Introducing the Short Dark Triad (SD3): A Brief Measure of Dark Personality Traits
Jones, D. N., & Paulhus, D. L. (2014) · Assessment · doi:10.1177/1073191113514105 · Cited by 2,162 · cited 1× · see citing works
“Stage (i) is instantiated with a ten-item scale, distilled from the Dark Triad, PCL-R, and MACH-IV inventories [61, 62, 63, 64].”
Toward expert-level medical question answering with large language models
Singhal, K., Tu, T., Gottweis, J., Sayres, R., Wulczyn, E., Amin, M., Hou, L., Clark, K., Pfohl, S. R., Cole-Lewis, H., et al. (2025) · Nature Medicine · doi:10.1038/s41591-024-03423-7 · Cited by 1,734 · cited 1× · see citing works
“The evaluation in medical scenarios has primarily focused on general medical problems such as MedQA [30], PubMedQA [31], and MultiMedQA [32].”
Self-Instruct: Aligning Language Models with Self-Generated Instructions
Wang, Y., Kordi, Y., Mishra, S., Liu, A., Smith, N. A., Khashabi, D., & Hajishirzi, H. (2023) · Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) · doi:10.18653/v1/2023.acl-long.754 · Cited by 1,243 · see citing works
Jin, D., Pan, E., Oufattole, N., Weng, W.-H., Fang, H., & Szolovits, P. (2021) · doi:10.20944/preprints202105.0498.v1 · Cited by 718 · cited 2× · see citing works
“We utilize the MedQA [30] and PubMedQA [31] datasets to validate our approach.”
Jin, D., Pan, E., Oufattole, N., Weng, W.-H., Fang, H., & Szolovits, P. (2021) · Applied Sciences · doi:10.3390/app11146421 · Cited by 718 · see citing works
PubMedQA: A Dataset for Biomedical Research Question Answering
Jin, Q., Dhingra, B., Liu, Z., Cohen, W., & Lu, X. (2019) · Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP) · doi:10.18653/v1/d19-1259 · Cited by 685 · cited 2× · see citing works
“We utilize the MedQA [30] and PubMedQA [31] datasets to validate our approach.”
MedAgents: Large Language Models as Collaborators for Zero-shot Medical ReasoningPreprint
Tang, X., Zou, A.-N., Zhang, Z., Li, Z.-M., Zhao, Y., Zhang, X., Cohan, A., & Gerstein, M. (2023) · Annual Meeting of the Association for Computational Linguistics · doi:10.48550/arxiv.2311.10537 · Cited by 571 · cited 2× · see citing works
“Among these, multi-agent architectures are particularly well-suited to addressing the complexity of medical scenarios such as collaboration [8, 9, 10] and multidisciplinary task [11, 12].”
Large language models in healthcare and medical domain: A reviewPreprint
Nazi, Z. A., & Peng, W. (2023) · Informatics · doi:10.48550/arxiv.2401.06775 · Cited by 551 · cited 1× · see citing works
“While efforts have been made to assess LLM safety in healthcare [16, 14, 17, 18, 19, 20, 21] (see Table 1), notable gaps persist, particularly in understanding and mitigating insider threats within medical MAS.”
Grattafiori, A., Dubey, A., Jauhri, A., Pandey, A., Kadian, A., Al-Dahle, A., Letman, A., Mathur, A., Schelten, A., Vaughan, A., et al. (2024) · arXiv · doi:10.48550/arxiv.2407.21783 · Cited by 505 · cited 1× · see citing works
“To demonstrate the generality of MedSentry and our attack–defense pipeline across diverse LLMs, we evaluated five models (GPT-4o, LLaMA3-8B,LLaMA3-70B [69], GPT-3.”
Self-citationChatDev: Communicative Agents for Software Development
Qian, C., Liu, W., Liu, H., Chen, N., Dang, Y., Li, J., Yang, C., Chen, W., Su, Y., Cong, X., et al. (2024) · Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) · doi:10.18653/v1/2024.acl-long.810 · Cited by 490 · cited 1× · see citing works
“…and instead allow one free-form discussion round followed by report summarization and a final decision-making step; MetaGPT-like [67] retains its SOP-driven discussion workflow and shared information pool; and ChatDev-like [68] adopts a node-edge configuration with guidance agents on the edges.”
Self-citationTowards Generalist Biomedical AI
Tu, T., Azizi, S., Driess, D., Schaekermann, M., Amin, M., Chang, P.-C., Carroll, A., Lau, C., Tanno, R., Ktena, I., et al. (2023) · arXiv · doi:10.48550/arxiv.2307.14334 · Cited by 483 · cited 1× · see citing works
“In the medical domain, LLMs have been increasingly investigated for their potential to support clinical decision-making, summarization, and diagnostic reasoning tasks [28, 29].”
Large language models in healthcare and medical domain: A review
Nazi, Z. A., & Peng, W. (2024) · Informatics · doi:10.3390/informatics11030057 · Cited by 415 · see citing works
Camel: Communicative agents for" mind" exploration of large language model society
Li, G., Hammoud, H., Itani, H., Khizbullin, D., & Ghanem, B. (2023) · Advances in Neural Information Processing Systems 36 · doi:10.52202/075280-2264 · Cited by 314 · cited 1× · see citing works
“However, this framework does not consider multi-agent collaborative benchmarks involving LLMs acting as both patients and healthcare providers [35, 36].”
DeepSeek-AI, Liu, A., Feng, B., Xue, B., Wang, B., Wu, B., Lu, C., Zhao, C., Deng, C., Zhang, C., et al. (2024) · arXiv · doi:10.48550/arxiv.2412.19437 · Cited by 294 · see citing works
Self-citationJailbroken: How Does LLM Safety Training Fail?
Wei, A., Haghtalab, N., & Steinhardt, J. (2023) · arXiv · doi:10.48550/arxiv.2307.02483 · Cited by 280 · cited 1× · see citing works
“Adversarial prompt injection [37, 38, 39, 40, 41] is a widely observed phenomenon, where malicious agents manipulate shared prompts to induce harmful behavior in otherwise benign agents.”
Jailbroken: How Does LLM Safety Training Fail?
Wei, A., Haghtalab, N., & Steinhardt, J. (2023) · Advances in Neural Information Processing Systems 36 · doi:10.52202/075280-3508 · Cited by 280 · see citing works
The Hare PCL‐R: Some issues concerning its use and misuse
Hare, R. D. (1998) · Legal and Criminological Psychology · doi:10.1111/j.2044-8333.1998.tb00353.x · Cited by 233 · cited 1× · see citing works
“Stage (i) is instantiated with a ten-item scale, distilled from the Dark Triad, PCL-R, and MACH-IV inventories [61, 62, 63, 64].”
MetaGPT: Meta Programming for A Multi-Agent Collaborative Framework
Hong, S., Zhuge, M., Chen, J., Zheng, X., Cheng, Y., Zhang, C., Wang, J., Wang, Z., Yau, S. K. S., Lin, Z., et al. (2023) · arXiv · doi:10.48550/arxiv.2308.00352 · Cited by 214 · cited 1× · see citing works
“…aggregation and instead allow one free-form discussion round followed by report summarization and a final decision-making step; MetaGPT-like [67] retains its SOP-driven discussion workflow and shared information pool; and ChatDev-like [68] adopts a node-edge configuration with guidance…”
PubMedQA: A Dataset for Biomedical Research Question AnsweringPreprint
Jin, Q., Dhingra, B., Liu, Z., Cohen, W. W., & Lu, X. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1909.06146 · Cited by 182 · see citing works
Can Generalist Foundation Models Outcompete Special-Purpose Tuning? Case Study in Medicine
Nori, H., Lee, Y. T., Zhang, S., Carignan, D., Edgar, R., Fusi, N., King, N., Larson, J., Li, Y., Liu, W., et al. (2023) · arXiv · doi:10.48550/arxiv.2311.16452 · Cited by 178 · cited 1× · see citing works
“We also include two state-of-the-art baselines, Medprompt [65] and Multi-expert Prompting [66].”
A Survey of LLM-based Agents in Medicine: How far are we from Baymax?Preprint
Wang, W.-X., Ma, Z.-Z., Wang, Z., et al. (2025) · Annual Meeting of the Association for Computational Linguistics · doi:10.48550/arxiv.2502.11211 · Cited by 154 · cited 1× · see citing works
“This framework of collaborating experts [13] helps mitigate biases that can arise from using a single model, promoting decision-making through diverse clinical perspectives and consensus-building.”
Self-citationMedAgents: Large Language Models as Collaborators for Zero-shot Medical Reasoning
Tang, X., Zou, A., Zhang, Z., Li, Z., Zhao, Y., Zhang, X., Cohan, A., & Gerstein, M. (2024) · Findings of the Association for Computational Linguistics ACL 2024 · doi:10.18653/v1/2024.findings-acl.33 · Cited by 133 · see citing works
MEDITRON-70B: Scaling Medical Pretraining for Large Language Models
Chen, Z., Cano, A. H., Romanou, A., Bonnet, A., Matoba, K., Salvi, F., Pagliardini, M., Fan, S., Köpf, A., Mohtashami, A., et al. (2023) · arXiv · doi:10.48550/arxiv.2311.16079 · Cited by 122 · cited 1× · see citing works
“…(LLMs), such as general-purpose models like ChatGPT, Claude, LLaMA-4, and Gemini 2.5 Pro, as well as medical-specific models like Meditron-70b [1] and Llama-3-Meditron [2], LLM-based medical agents have demonstrated broad applicability across various healthcare domains, including drug…”
InfluentialSelf-Instruct: Aligning Language Models with Self-Generated Instructions
Wang, Y., Kordi, Y., Mishra, S., Liu, A., Smith, N. A., Khashabi, D., & Hajishirzi, H. (2022) · arXiv · doi:10.48550/arxiv.2212.10560 · Cited by 118 · cited 1× · see citing works
“In the second phase (Figure 1B), we drew inspiration from Self-Instruction [58] and Prompt2Model [59], applying these frameworks alongside manual curation to generate and polish our adversarial instruction data.”
Zhang, Z.-B., Zhang, Y.-T., Li, L., et al. (2024) · Annual Meeting of the Association for Computational Linguistics · doi:10.48550/arxiv.2401.11880 · Cited by 109 · cited 1× · see citing works
“While efforts have been made to assess LLM safety in healthcare [16, 14, 17, 18, 19, 20, 21] (see Table 1), notable gaps persist, particularly in understanding and mitigating insider threats within medical MAS.”
Flooding spread of manipulated knowledge in LLM-based multi-agent communities
Ju, T., Wang, Y.-T., Hua, Y., Ma, X.-B., Cheng, P., Zhao, H., Wang, Y., Liu, L., Xie, J., Zhang, Z.-S., et al. (2024) · Science China Information Sciences · doi:10.1007/s11432-024-4663-2 · Cited by 100 · cited 1× · see citing works
“In collaborative diagnostic tasks, such attacks [42, 43, 44, 45, 46] can cause cascading errors or misdiagnoses when one compromised agent spreads misinformation through inter-agent messages.”
MDAgents: an adaptive collaboration of LLMs for medical decision-making
Kim, Y., Park, C., Jeong, H., Chan, Y., Xu, X., McDuff, D., Lee, H., Ghassemi, M., Breazeal, C., & Park, H. (2024) · Advances in Neural Information Processing Systems 37 · doi:10.52202/079017-2522 · Cited by 81 · cited 1× · see citing works
“Among these, multi-agent architectures are particularly well-suited to addressing the complexity of medical scenarios such as collaboration [8, 9, 10] and multidisciplinary task [11, 12].”
AgentBench: Evaluating LLMs as Agents
Liu, X., Yu, H., Zhang, H., Xu, Y., Lei, X., Lai, H., Gu, Y., Ding, H., Men, K., Yang, K., et al. (2023) · arXiv · doi:10.48550/arxiv.2308.03688 · Cited by 79 · cited 1× · see citing works
“However, this framework does not consider multi-agent collaborative benchmarks involving LLMs acting as both patients and healthcare providers [35, 36].”
Ke, Y., Yang, R., Lie, S. A., Lim, T. X. Y., Ning, Y., Li, I., Abdullah, H. R., Ting, D. S. W., & Liu, N. (2024) · Journal of Medical Internet Research · doi:10.2196/59439 · Cited by 64 · cited 1× · see citing works
“…as well as medical-specific models like Meditron-70b [1] and Llama-3-Meditron [2], LLM-based medical agents have demonstrated broad applicability across various healthcare domains, including drug discovery [3], hospital simulation [4], report generation [5], and clinical decision support [6, 7].”
Prompt2Model: Generating Deployable Models from Natural Language Instructions
Viswanathan, V., Zhao, C., Bertsch, A., et al. (2023) · Conference on Empirical Methods in Natural Language Processing · doi:10.48550/arxiv.2308.12261 · Cited by 56 · cited 1×
“In the second phase (Figure 1B), we drew inspiration from Self-Instruction [58] and Prompt2Model [59], applying these frameworks alongside manual curation to generate and polish our adversarial instruction data.”
Towards evaluating and building versatile large language models for medicine
Wu, C., Qiu, P., Liu, J., Gu, H., Li, N., Zhang, Y., Wang, Y., & Xie, W. (2025) · npj Digital Medicine · doi:10.1038/s41746-024-01390-4 · Cited by 52 · cited 1× · see citing works
“While efforts have been made to assess LLM safety in healthcare [16, 14, 17, 18, 19, 20, 21] (see Table 1), notable gaps persist, particularly in understanding and mitigating insider threats within medical MAS.”
PoisonPrompt: Backdoor Attack on Prompt-Based Large Language Models
Yao, H., Lou, J., & Qin, Z. (2024) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp48485.2024.10446267 · Cited by 51 · cited 1× · see citing works
“Adversarial prompt injection [37, 38, 39, 40, 41] is a widely observed phenomenon, where malicious agents manipulate shared prompts to induce harmful behavior in otherwise benign agents.”
Agent Hospital: A Simulacrum of Hospital with Evolvable Medical Agents
Li, J., Lai, Y., Li, W., Ren, J., Zhang, M., Kang, X., Wang, S., Li, P., Zhang, Y.-Q., Ma, W., et al. (2024) · arXiv · doi:10.48550/arxiv.2405.02957 · Cited by 46 · cited 1× · see citing works
“…as well as medical-specific models like Meditron-70b [1] and Llama-3-Meditron [2], LLM-based medical agents have demonstrated broad applicability across various healthcare domains, including drug discovery [3], hospital simulation [4], report generation [5], and clinical decision support [6, 7].”
R-Judge: Benchmarking Safety Risk Awareness for LLM Agents
Yuan, T., He, Z., Dong, L., Wang, Y., Zhao, R., Xia, T., Xu, L., Zhou, B., Li, F., Zhang, Z., et al. (2024) · Findings of the Association for Computational Linguistics: EMNLP 2024 · doi:10.18653/v1/2024.findings-emnlp.79 · Cited by 45 · see citing works
Tang, X., Shao, Y., Sohn, J., et al. (2025) · Patterns · doi:10.1016/j.patter.2026.101658 · Cited by 43 · cited 2×
“While efforts have been made to assess LLM safety in healthcare [16, 14, 17, 18, 19, 20, 21] (see Table 1), notable gaps persist, particularly in understanding and mitigating insider threats within medical MAS.”
Chain-of-Verification Reduces Hallucination in Large Language Models
Dhuliawala, S., Komeili, M., Xu, J., Raileanu, R., Li, X., Celikyilmaz, A., & Weston, J. (2023) · arXiv · doi:10.48550/arxiv.2309.11495 · Cited by 42 · cited 1× · see citing works
“To counteract such threats, techniques such as chain-of-verification (CoV) [50], where agents cross-validate each other’s outputs using independent reasoning chains, have shown promise in reducing susceptibility to misinformation.”
Self-citationAILuminate: Introducing v1.0 of the AI Risk and Reliability Benchmark from MLCommonsPreprint
Ghosh, S., Frase, H., Williams, A., et al. (2025) · arXiv.org · doi:10.48550/arxiv.2503.05731 · Cited by 41 · cited 1× · see citing works
“While some efforts benchmark general AI risk [23, 24, 25], a systematic comparison of architectural resilience to insider threats in the high-stakes medical domain is absent.”
Self-citationAttacking Cooperative Multi-Agent Reinforcement Learning by Adversarial Minority InfluencePreprint
Li, S.-M., Guo, J., Xiu, J., et al. (2023) · Neural Networks · doi:10.48550/arxiv.2302.03322 · Cited by 33 · cited 1× · see citing works
“Furthermore, some works [47, 48, 49] have shown that the policy-level learning process of agents can be manipulated or interfered with by attackers, causing them to make incorrect or harmful decisions in specific situations.”
Adversarial Attacks on Large Language Models in Medicine
Yang, Y.-F., Jin, Q., Huang, F., et al. (2024) · arXiv.org · doi:10.48550/arxiv.2406.12259 · Cited by 27 · cited 1×
“Adversarial prompt injection [37, 38, 39, 40, 41] is a widely observed phenomenon, where malicious agents manipulate shared prompts to induce harmful behavior in otherwise benign agents.”
Multi-expert Prompting Improves Reliability, Safety and Usefulness of Large Language Models
Long, D. X., Yen, D. N., Luu, A. T., Kawaguchi, K., Kan, M., & Chen, N. F. (2024) · Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/2024.emnlp-main.1135 · Cited by 26 · cited 1× · see citing works
“We also include two state-of-the-art baselines, Medprompt [65] and Multi-expert Prompting [66].”
PharmAgents: Building a Virtual Pharma with Large Language Model AgentsPreprint
Gao, B., Huang, Y., Liu, Y., et al. (2025) · arXiv.org · doi:10.48550/arxiv.2503.22164 · Cited by 26 · cited 1× · see citing works
“…as well as medical-specific models like Meditron-70b [1] and Llama-3-Meditron [2], LLM-based medical agents have demonstrated broad applicability across various healthcare domains, including drug discovery [3], hospital simulation [4], report generation [5], and clinical decision support [6, 7].”
Zhang, Z., Zhang, Y., Li, L., Shao, J., Gao, H., Qiao, Y., Wang, L., Lu, H., & Zhao, F. (2024) · Proceedings of the conference - Association for Computational Linguistics. Meeting · doi:10.18653/v1/2024.acl-long.812 · Cited by 25 · see citing works
AgentClinic: a multimodal agent benchmark to evaluate AI in simulated clinical environments
Schmidgall, S., Ziaei, R., Harris, C., Reis, E., Jopling, J., & Moor, M. (2024) · arXiv · doi:10.48550/arxiv.2405.07960 · Cited by 24 · cited 1× · see citing works
“While efforts have been made to assess LLM safety in healthcare [16, 14, 17, 18, 19, 20, 21] (see Table 1), notable gaps persist, particularly in understanding and mitigating insider threats within medical MAS.”
Learning adversarial attack policies through multi-objective reinforcement learning
García, J., Majadas, R., & Fernández, F. (2020) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2020.104021 · Cited by 22 · cited 1× · see citing works
“Furthermore, some works [47, 48, 49] have shown that the policy-level learning process of agents can be manipulated or interfered with by attackers, causing them to make incorrect or harmful decisions in specific situations.”
Prompt Injection Detection and Mitigation via AI Multi-Agent NLP FrameworksPreprint
Gosmar, D., Dahl, D. A., & Gosmar, D. (2025) · arXiv.org · doi:10.48550/arxiv.2503.11517 · Cited by 22 · cited 1× · see citing works
“Adversarial prompt injection [37, 38, 39, 40, 41] is a widely observed phenomenon, where malicious agents manipulate shared prompts to induce harmful behavior in otherwise benign agents.”
Meng, L., Ho, B., Ren, D., & Wang, X. (2024) · Findings of the Association for Computational Linguistics: EMNLP (Findings of EMNLP) · doi:10.18653/v1/2024.findings-emnlp.329 · Cited by 19 · cited 1× · see citing works
“Among these, multi-agent architectures are particularly well-suited to addressing the complexity of medical scenarios such as collaboration [8, 9, 10] and multidisciplinary task [11, 12].”
Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems
Lee, D., & Tiwari, M. (2024) · arXiv · doi:10.48550/arxiv.2410.07283 · Cited by 18 · cited 1× · see citing works
“In collaborative diagnostic tasks, such attacks [42, 43, 44, 45, 46] can cause cascading errors or misdiagnoses when one compromised agent spreads misinformation through inter-agent messages.”
MedAgentBench: Dataset for Benchmarking LLMs as Agents in Medical ApplicationsPreprint
Jiang, Y.-X., Black, K., Geng, G., et al. (2025) · arXiv.org · doi:10.48550/arxiv.2501.14654 · Cited by 18 · cited 1× · see citing works
“First, existing medical LLM benchmarks often target single-agent performance or static scenarios, lacking a framework to systematically evaluate the diverse and dynamic threats posed by malicious internal agents [22, 19].”
Polaris: A Safety-focused LLM Constellation Architecture for Healthcare
Mukherjee, S., Gamble, P., Ausin, M. S., Kant, N., Aggarwal, K., Manjunath, N., Datta, D., Liu, Z., Ding, J., Busacca, S., et al. (2024) · arXiv · doi:10.48550/arxiv.2403.13313 · Cited by 17 · cited 1× · see citing works
“Third, while some works propose defense mechanisms against adversarial prompts or model poisoning [26, 27], there is no lightweight, adaptive, and effective strategy against compromised agents within complex, collaborative medical workflows.”
RareAgents: Autonomous Multi-disciplinary Team for Rare Disease Diagnosis and TreatmentPreprint
Chen, X.-Z., Jin, Y., Mao, X., et al. (2024) · AAAI Conference on Artificial Intelligence · doi:10.48550/arxiv.2412.12475 · Cited by 16 · cited 1× · see citing works
“Among these, multi-agent architectures are particularly well-suited to addressing the complexity of medical scenarios such as collaboration [8, 9, 10] and multidisciplinary task [11, 12].”
Prompt2Model: Generating Deployable Models from Natural Language Instructions
Viswanathan, V., Zhao, C., Bertsch, A., Wu, T., & Neubig, G. (2023) · Conference on Empirical Methods in Natural Language Processing: System Demonstrations (EMNLP) · doi:10.18653/v1/2023.emnlp-demo.38 · Cited by 16 · see citing works
Red-Teaming LLM Multi-Agent Systems via Communication Attacks
He, P., Lin, Y., Dong, S., Xu, H., Xing, Y., & Liu, H. (2025) · arXiv · doi:10.48550/arxiv.2502.14847 · Cited by 15 · cited 1× · see citing works
“In collaborative diagnostic tasks, such attacks [42, 43, 44, 45, 46] can cause cascading errors or misdiagnoses when one compromised agent spreads misinformation through inter-agent messages.”
M3HF: Multi-agent Reinforcement Learning from Multi-phase Human Feedback of Mixed QualityPreprint
Wang, Z., Zhang, Z., Fang, F., et al. (2025) · International Conference on Machine Learning · doi:10.48550/arxiv.2503.02077 · Cited by 15 · cited 1× · see citing works
“In the medical domain, most previous works [52, 53, 54, 55, 56] integrate medical ontologies and expert feedback to align agent outputs with validated clinical knowledge.”
Huang, X., Wang, X., Zhang, H., Zhu, Y., Xi, J., An, J., Wang, H., Liang, H., & Pan, C. (2025) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v39i4.32396 · Cited by 14 · cited 1× · see citing works
“Furthermore, some works [47, 48, 49] have shown that the policy-level learning process of agents can be manipulated or interfered with by attackers, causing them to make incorrect or harmful decisions in specific situations.”
Self-citationPrompt Injection Attacks on Large Language Models in OncologyPreprint
Clusmann, J., Ferber, D., Wiest, I., et al. (2024) · arXiv.org · doi:10.48550/arxiv.2407.18981 · Cited by 13 · cited 1× · see citing works
“Adversarial prompt injection [37, 38, 39, 40, 41] is a widely observed phenomenon, where malicious agents manipulate shared prompts to induce harmful behavior in otherwise benign agents.”
Tan, T., Elangovan, K., Ong, J., et al. (2024) · arXiv.org · doi:10.48550/arxiv.2407.07666 · Cited by 13 · cited 1× · see citing works
“These tasks evaluate the model’s ability to answer questions or generate summaries based on traditional accuracy, BLEU or other task completion metrics [33, 34] but their adaptation overlooks the key medical safety factor.”
Self-citationMedSafetyBench: Evaluating and Improving the Medical Safety of Large Language Models
Han, T., Kumar, A., Agarwal, C., & Lakkaraju, H. (2024) · neural information processing systems · doi:10.52202/079017-1054 · Cited by 12 · cited 4× · see citing works
“While efforts have been made to assess LLM safety in healthcare [16, 14, 17, 18, 19, 20, 21] (see Table 1), notable gaps persist, particularly in understanding and mitigating insider threats within medical MAS.”
InfluentialMedFuzz: Exploring the Robustness of Large Language Models in Medical Question Answering
Ness, R. O., Matton, K., Helm, H., Zhang, S., Bajwa, J., Priebe, C. E., & Horvitz, E. (2024) · arXiv · doi:10.48550/arxiv.2406.06573 · Cited by 12 · cited 1× · see citing works
“These challenges highlight the urgent need for strong safety frameworks to ensure the responsible integration of LLMs in healthcare [15].”
Adaptive Reasoning and Acting in Medical Language AgentsPreprint
Dutta, A., & Hsiao, Y.-C. (2024) · arXiv.org · doi:10.48550/arxiv.2410.10020 · Cited by 12 · cited 1× · see citing works
“…as well as medical-specific models like Meditron-70b [1] and Llama-3-Meditron [2], LLM-based medical agents have demonstrated broad applicability across various healthcare domains, including drug discovery [3], hospital simulation [4], report generation [5], and clinical decision support [6, 7].”
Emerging Cyber Attack Risks of Medical AI AgentsPreprint
Qiu, J., Li, L., Sun, J., et al. (2025) · arXiv.org · doi:10.48550/arxiv.2504.03759 · Cited by 11 · cited 1× · see citing works
“In collaborative diagnostic tasks, such attacks [42, 43, 44, 45, 46] can cause cascading errors or misdiagnoses when one compromised agent spreads misinformation through inter-agent messages.”
AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases
Chen, Z., Xiang, Z., Xiao, C., Song, D., & Li, B. (2024) · arXiv · doi:10.48550/arxiv.2407.12784 · Cited by 10 · cited 1× · see citing works
“In collaborative diagnostic tasks, such attacks [42, 43, 44, 45, 46] can cause cascading errors or misdiagnoses when one compromised agent spreads misinformation through inter-agent messages.”
Agentic LLM Workflows for Generating Patient-Friendly Medical Reports
Sudarshan, M., Shih, S., Yee, E., Yang, A., Zou, J., Chen, C., Zhou, Q., Chen, L., Singhal, C., & Shih, G. (2024) · arXiv · doi:10.48550/arxiv.2408.01112 · Cited by 8 · cited 1× · see citing works
“…as well as medical-specific models like Meditron-70b [1] and Llama-3-Meditron [2], LLM-based medical agents have demonstrated broad applicability across various healthcare domains, including drug discovery [3], hospital simulation [4], report generation [5], and clinical decision support [6, 7].”
Cooperative dual medical ontology representation learning for clinical assisted decision-making
Xu, M., Zhu, Z., Li, Y., Zheng, S., Li, L., Wu, H., & Zhao, Y. (2023) · Computers in Biology and Medicine · doi:10.1016/j.compbiomed.2023.107138 · Cited by 8 · cited 1× · see citing works
“In the medical domain, most previous works [52, 53, 54, 55, 56] integrate medical ontologies and expert feedback to align agent outputs with validated clinical knowledge.”
Alignment of large language models in solving medical ethical dilemmas
Sorin, V., Glicksberg, B. S., Korfiatis, P. D., Collins, J. D., Yeow, M.-E., Brandeland, M. A., Nadkarni, G. N., & Klang, E. (2026) · Digital Health · doi:10.1177/20552076261428395 · Cited by 6 · cited 1× · see citing works
“However, alignment in medical safety is further complicated by ethical and legal constraints, making zero-shot or instruction-tuned defenses difficult to generalize [57].”
OntoMedRec: Logically-pretrained model-agnostic ontology encoders for medication recommendation
Tan, W., Wang, W., Zhou, X., Buntine, W., Bingham, G., & Yin, H. (2024) · World Wide Web · doi:10.1007/s11280-024-01268-1 · Cited by 5 · cited 1× · see citing works
“In the medical domain, most previous works [52, 53, 54, 55, 56] integrate medical ontologies and expert feedback to align agent outputs with validated clinical knowledge.”
Zhu, Y., Li, Y., Cui, Y., et al. (2023) · Electronics · doi:10.3390/electronics12244896 · Cited by 5 · cited 1×
“In the medical domain, most previous works [52, 53, 54, 55, 56] integrate medical ontologies and expert feedback to align agent outputs with validated clinical knowledge.”
MedSafetyBench: Evaluating and Improving the Medical Safety of Large Language ModelsPreprint
Han, T., Kumar, A., Agarwal, C., et al. (2024) · arXiv (Cornell University) · doi:10.48550/arxiv.2403.03744 · Cited by 5 · see citing works
Alignment of Large Language Models in Solving Medical Ethical Dilemmas
Sorin, V., Glicksberg, B. S., Korfiatis, P. D., et al. (2024) · medRxiv · doi:10.1101/2024.09.18.24313931 · Cited by 5
Hierarchical Divide-and-Conquer for Fine-Grained Alignment in LLM-Based Medical EvaluationPreprint
Zheng, S., Zhang, X., de Melo, G., et al. (2025) · AAAI Conference on Artificial Intelligence · doi:10.48550/arxiv.2501.06741 · Cited by 4 · cited 1× · see citing works
“In the medical domain, most previous works [52, 53, 54, 55, 56] integrate medical ontologies and expert feedback to align agent outputs with validated clinical knowledge.”
Chen, K., Li, X., Yang, T., Wang, H., Dong, W., & Gao, Y. (2025) · arXiv (Cornell University) · doi:10.48550/arxiv.2503.13856 · Cited by 3 · cited 1× · see citing works
“Among these, multi-agent architectures are particularly well-suited to addressing the complexity of medical scenarios such as collaboration [8, 9, 10] and multidisciplinary task [11, 12].”
Self-citationPanagoulias, D. P., Papatheodosiou, P., Palamidas, A. P., Sanoudos, M., Tsoureli‐Nikita, E., Virvou, M. K., & Tsihrintzis, G. A. (2024) · arXiv (Cornell University) · doi:10.48550/arxiv.2405.10893 · Cited by 3 · cited 1× · see citing works
“While efforts have been made to assess LLM safety in healthcare [16, 14, 17, 18, 19, 20, 21] (see Table 1), notable gaps persist, particularly in understanding and mitigating insider threats within medical MAS.”
Shao, Y., Tang, X., Sohn, J., Chen, J., Liao, Y., Zhang, J., Xiang, J., Wu, F., Zhao, Y., Wu, C., et al. (2025) · arXiv · doi:10.48550/arxiv.2503.07459 · Cited by 3
R-Judge: Benchmarking Safety Risk Awareness for LLM Agents
Yuan, T., He, Z., Dong, L., Wang, Y., Zhao, R., Xia, T., Xu, L., Zhou, B., Li, F., Zhang, Z., et al. (2024) · arXiv · doi:10.48550/arxiv.2401.10019 · Cited by 2 · cited 1× · see citing works
“While some efforts benchmark general AI risk [23, 24, 25], a systematic comparison of architectural resilience to insider threats in the high-stakes medical domain is absent.”
VITAL: A New Dataset for Benchmarking Pluralistic Alignment in Healthcare
Shetty, A., Beheshti, A., Dras, M., & Naseem, U. (2025) · arXiv · doi:10.48550/arxiv.2502.13775 · Cited by 2 · cited 1× · see citing works
“These tasks evaluate the model’s ability to answer questions or generate summaries based on traditional accuracy, BLEU or other task completion metrics [33, 34] but their adaptation overlooks the key medical safety factor.”
AIR-Bench 2024: A Safety Benchmark Based on Risk Categories from Regulations and Policies
Zeng, Y., Yang, Y., Zhou, A., Tan, J. Z., Tu, Y., Mai, Y., Klyman, K., Pan, M., Jia, R., Song, D., et al. (2024) · arXiv · doi:10.48550/arxiv.2407.17436 · Cited by 1 · cited 1× · see citing works
“While some efforts benchmark general AI risk [23, 24, 25], a systematic comparison of architectural resilience to insider threats in the high-stakes medical domain is absent.”
Recent Advances in Attack and Defense Approaches of Large Language ModelsPreprint
Cui, J., Xu, Y., Huang, Z., Zhou, S., Jiao, J., & Zhang, J. (2024) · arXiv (Cornell University) · doi:10.48550/arxiv.2409.03274 · cited 1×
“Third, while some works propose defense mechanisms against adversarial prompts or model poisoning [26, 27], there is no lightweight, adaptive, and effective strategy against compromised agents within complex, collaborative medical workflows.”
Flooding Spread of Manipulated Knowledge in LLM-Based Multi-Agent Communities
Ju, T., Wang, Y., Ma, X., et al. (2024) · arXiv · doi:10.48550/arxiv.2407.07791
Flagged first, then by citations
Research works printed but not linked: 1
- Alexandre Sallinen, Antoni-Joan Solergibert, Michael Zhang, Guillaume Boyé, Maud Dupont- Roc, Xavier Theimer-Lienhard, Etienne Boisson, Bastien Bernath, Hichem Hadhri, Antoine Tran, et al. Llama-3-meditron: An open-weight suite of medical llms based on llama-3.1. In Workshop on Large Language Models and Generative AI for Health at AAAI 2025, 2025.
Cited by
Sorted by citations
Clinical Plausibility in Large Language Model Robustness Testing for Medicine: A Scoping Review
Chang, Y., Hsieh, M., Ju, P., Liu, Y., & Chang, C. (2026) · Journal of Medical Systems · doi:10.1007/s10916-026-02405-1 · Cited by 3 · see citing works
- Authors
- Chen, K., Zhen, T., Wang, H., Liu, K., Li, X., Huo, J., Yang, T., Xu, J., Dong, W., & Gao, Y.
- Affiliations
- Nanjing University (CN)
- Carnegie Mellon University (US)
- Nanyang Technological University (SG)
- University of Hong Kong (HK)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2025
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2505.20824
- OpenAlex
- W4415036412
- Cited by
- 1
- References
- 73
- Citations by year
- 2026: 1
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- arXiv (Cornell University) (submittedVersion, cc-by)
- arXiv (Cornell University) (cc-by)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Health Sciences › Medicine › Health Informatics › Artificial Intelligence in Healthcare and Education
- Keywords
- medical large language models, multi-agent systems, adversarial prompts, malicious agent detection
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-07.
Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-07.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
