Beyond Benchmarks: Dynamic, Automatic And Systematic Red-Teaming Agents For Trustworthy Medical Language Models

Beyond Benchmarks: Dynamic, Automatic And Systematic Red-Teaming Agents For Trustworthy Medical Language Models | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Article Beyond Benchmarks: Dynamic, Automatic And Systematic Red-Teaming Agents For Trustworthy Medical Language Models Jiazhen Pan, Bailiang Jian, Paul Hager, Yundi Zhang, Che Liu, and 17 more This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-7237079/v1 This work is licensed under a CC BY 4.0 License Status: Under Review Version 1 posted You are reading this latest preprint version Abstract Ensuring the safety and reliability of large language models (LLMs) in clinical practice is critical to prevent patient harm. However, LLMs are advancing so rapidly that static benchmarks quickly become obsolete or prone to overfitting, yielding a misleading picture of model trustworthiness. Here we introduce a Dynamic, Automatic, and Systematic (DAS) red-teaming framework that continuously stress-tests LLMs across four safety-critical axes: robustness, privacy, bias/fairness, and hallucination. Validated against board-certified clinicians with high concordance, a suite of adversarial agents autonomously mutates clinical test cases to uncover vulnerabilities in real time. Applying DAS to 15 proprietary and open-source LLMs revealed a profound gap between high static benchmark performance and low dynamic reliability - the ''Benchmarking Gap''. Despite median MedQA accuracy exceeding 80%, 94% of previously correct answers failed our dynamic robustness tests. Crucially, this brittleness generalized to the realistic, open-ended HealthBench dataset, where top-tier models exhibited failure rates exceeding 70% and stark shifts in model rankings across evaluations, suggesting that high scores on established static benchmarks may reflect superficial memorization. We observed similarly high failure rates across other domains: privacy leaks were elicited in 86% of scenarios, cognitive-bias priming altered clinical recommendations in 81% of fairness tests, and we identified hallucination rates exceeding 74% in widely used models. By converting medical LLM safety analysis from a static checklist into a dynamic stress-test, DAS provides a foundational, scalable, and living platform to surface the latent risks that must be addressed before the next generation of medical AI can be safely deployed. Health sciences/Health care/Health services Health sciences/Health care/Health policy Medical Red-teaming AI Agents Adversarial Testing Medical LLMs Audit Trustworthy AI Full Text Additional Declarations There is NO Competing Interest. Cite Share Download PDF Status: Under Review Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-7237079","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Article","associatedPublications":[],"authors":[{"id":592592195,"identity":"35b4fcac-aaa3-4e12-9994-a3c91028f1b9","order_by":0,"name":"Jiazhen Pan","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA1klEQVRIiWNgGAWjYBACxmYGBmYY+wGYOkCCFmaDA8RoASuF0mwSRGlhbmd+/Lmg4g6DOfvZY9Uf27Yx8B1vIOQwNgPjGWeeMVj25KXdONh2m0HyDAFrgH4xSOZtO8xgcCDHDKzF4EYCIS3sHw7z/gNqOf/GrACs5f4DQlp4DJt5G4BabuSYMUBswa8DpKWYmefYYR7LGW+MJc6cu80jeYaAwwz7j2/+zFNzWM6cP8fwQ0XZbTm+4wcIaGmA0DwGUAEeAs5iYJCHMQzwqRoFo2AUjIKRDQC2n0eBFMxu7gAAAABJRU5ErkJggg==","orcid":"","institution":"Technical University of Munich","correspondingAuthor":true,"prefix":"","firstName":"Jiazhen","middleName":"","lastName":"Pan","suffix":""},{"id":592592196,"identity":"750c49b9-414c-41a8-82b0-3f35fc6fe731","order_by":1,"name":"Bailiang Jian","email":"","orcid":"https://orcid.org/0009-0009-2419-0420","institution":"Technical University of Munich","correspondingAuthor":false,"prefix":"","firstName":"Bailiang","middleName":"","lastName":"Jian","suffix":""},{"id":592592197,"identity":"dd9bccc0-4700-4764-9cb1-854b41411416","order_by":2,"name":"Paul Hager","email":"","orcid":"https://orcid.org/0000-0003-2166-0262","institution":"Institute for AI and Informatics, Klinikum rechts der Isar, Technical University of Munich","correspondingAuthor":false,"prefix":"","firstName":"Paul","middleName":"","lastName":"Hager","suffix":""},{"id":592592198,"identity":"64dc8eb5-21e3-428d-96f3-c18735a02cd2","order_by":3,"name":"Yundi Zhang","email":"","orcid":"","institution":"Technical University of Munich","correspondingAuthor":false,"prefix":"","firstName":"Yundi","middleName":"","lastName":"Zhang","suffix":""},{"id":592592199,"identity":"e8dab1ea-cb04-4a6e-a340-ad402b3be094","order_by":4,"name":"Che Liu","email":"","orcid":"","institution":"Imperial College London","correspondingAuthor":false,"prefix":"","firstName":"Che","middleName":"","lastName":"Liu","suffix":""},{"id":592592200,"identity":"648d40cb-11b3-4c6b-902d-947737d9a6bf","order_by":5,"name":"Friederike Jungmann","email":"","orcid":"https://orcid.org/0000-0002-9600-4094","institution":"Technische Universität München","correspondingAuthor":false,"prefix":"","firstName":"Friederike","middleName":"","lastName":"Jungmann","suffix":""},{"id":592592201,"identity":"6ed21c20-25b9-4f0a-ba43-8dce6db6dd4e","order_by":6,"name":"Hongwei Li","email":"","orcid":"","institution":"Harvard Medical School","correspondingAuthor":false,"prefix":"","firstName":"Hongwei","middleName":"","lastName":"Li","suffix":""},{"id":592592202,"identity":"b00aa166-08d8-4d5e-a91a-dec98dcaf3b9","order_by":7,"name":"Chenyu You","email":"","orcid":"https://orcid.org/0000-0001-8365-7822","institution":"Stony Brook University","correspondingAuthor":false,"prefix":"","firstName":"Chenyu","middleName":"","lastName":"You","suffix":""},{"id":592592203,"identity":"10346453-618c-4faf-a250-1e11a37b7d8e","order_by":8,"name":"Junde Wu","email":"","orcid":"","institution":"University of Oxford","correspondingAuthor":false,"prefix":"","firstName":"Junde","middleName":"","lastName":"Wu","suffix":""},{"id":592592204,"identity":"92fddff9-43b7-440f-9c33-eb71bf46bc62","order_by":9,"name":"Jiayuan Zhu","email":"","orcid":"","institution":"University of Oxford","correspondingAuthor":false,"prefix":"","firstName":"Jiayuan","middleName":"","lastName":"Zhu","suffix":""},{"id":592592205,"identity":"eb8b7bd9-59b3-4dd6-bf9a-599a4904b4cb","order_by":10,"name":"Fenglin Liu","email":"","orcid":"https://orcid.org/0000-0001-7715-5228","institution":"University of Oxford","correspondingAuthor":false,"prefix":"","firstName":"Fenglin","middleName":"","lastName":"Liu","suffix":""},{"id":592592206,"identity":"08a188a5-ff51-4c8f-88fe-b0a2ee2445bb","order_by":11,"name":"Yuyuan Liu","email":"","orcid":"","institution":"University of Oxford","correspondingAuthor":false,"prefix":"","firstName":"Yuyuan","middleName":"","lastName":"Liu","suffix":""},{"id":592592207,"identity":"5a2fd5cb-d2c4-4f5a-9a11-e805f8f7fd70","order_by":12,"name":"Niklas Bubeck","email":"","orcid":"","institution":"Technical University of Munich","correspondingAuthor":false,"prefix":"","firstName":"Niklas","middleName":"","lastName":"Bubeck","suffix":""},{"id":592592208,"identity":"4a691d71-9cab-46d3-bda9-0a838a619005","order_by":13,"name":"Christian Wachinger","email":"","orcid":"https://orcid.org/0000-0002-3652-1874","institution":"Technical University of Munich","correspondingAuthor":false,"prefix":"","firstName":"Christian","middleName":"","lastName":"Wachinger","suffix":""},{"id":592592209,"identity":"dfb75588-2416-4f55-a84b-f0ad2cf892a0","order_by":14,"name":"Chen Chen","email":"","orcid":"","institution":"University of Sheffield","correspondingAuthor":false,"prefix":"","firstName":"Chen","middleName":"","lastName":"Chen","suffix":""},{"id":592592210,"identity":"f083cdfc-1e1f-43d6-a215-a151d282d38e","order_by":15,"name":"Zhenyu Gong","email":"","orcid":"","institution":"Technical University of Munich","correspondingAuthor":false,"prefix":"","firstName":"Zhenyu","middleName":"","lastName":"Gong","suffix":""},{"id":592592211,"identity":"eb4adfa2-81e9-4fb7-ab63-00829e4eedd7","order_by":16,"name":"Cheng Ouyang","email":"","orcid":"","institution":"University of Oxford","correspondingAuthor":false,"prefix":"","firstName":"Cheng","middleName":"","lastName":"Ouyang","suffix":""},{"id":592592212,"identity":"7e0ff689-8f4f-40e3-a853-49927ec3ab5b","order_by":17,"name":"Georgios Kaissis","email":"","orcid":"https://orcid.org/0000-0001-8382-8062","institution":"Technical University of Munich","correspondingAuthor":false,"prefix":"","firstName":"Georgios","middleName":"","lastName":"Kaissis","suffix":""},{"id":592592213,"identity":"166e66e5-e734-40ab-bf87-505fe923539f","order_by":18,"name":"Benedikt Wiestler","email":"","orcid":"https://orcid.org/0000-0002-2963-7772","institution":"Klinikum Rechts der Isar","correspondingAuthor":false,"prefix":"","firstName":"Benedikt","middleName":"","lastName":"Wiestler","suffix":""},{"id":592592214,"identity":"f636e7f2-5a14-45d1-a69c-c2667ec974f9","order_by":19,"name":"Daniel Rückert","email":"","orcid":"","institution":"Institute for Artificial Intelligence in Medicine \u0026 Healthcare, School of Medicine, TUM","correspondingAuthor":false,"prefix":"","firstName":"Daniel","middleName":"","lastName":"Rückert","suffix":""},{"id":592592215,"identity":"b4123256-b637-4be3-a825-00d1bcdfa60f","order_by":20,"name":"Julian Canisius","email":"","orcid":"","institution":"Technical University of Munich","correspondingAuthor":false,"prefix":"","firstName":"Julian","middleName":"","lastName":"Canisius","suffix":""},{"id":592592216,"identity":"6a1268df-59a0-494a-b461-704a561e476f","order_by":21,"name":"Moritz Knolle","email":"","orcid":"","institution":"Technical University of Munich","correspondingAuthor":false,"prefix":"","firstName":"Moritz","middleName":"","lastName":"Knolle","suffix":""}],"badges":[],"createdAt":"2025-07-28 20:35:59","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-7237079/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-7237079/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":105565605,"identity":"bff52c13-f831-4905-8b43-88ba90f79533","added_by":"auto","created_at":"2026-03-27 12:53:44","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":12818354,"visible":true,"origin":"","legend":"Article File","description":"","filename":"RevisedManuscript.pdf","url":"https://assets-eu.researchsquare.com/files/rs-7237079/v1_covered_fba262a5-f5d6-4581-accc-57d96690cd10.pdf"}],"financialInterests":"There is \u003cb\u003eNO\u003c/b\u003e Competing Interest.","formattedTitle":"Beyond Benchmarks: Dynamic, Automatic And Systematic Red-Teaming Agents For Trustworthy Medical Language Models","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":true,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"nature-portfolio","isNatureJournal":true,"hasQc":false,"allowDirectSubmit":false,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"","title":"Nature Portfolio","twitterHandle":"","acdcEnabled":false,"dfaEnabled":false,"editorialSystem":"ejp","reportingPortfolio":"","inReviewEnabled":true,"inReviewRevisionsEnabled":false},"keywords":"Medical Red-teaming, AI Agents, Adversarial Testing, Medical LLMs Audit, Trustworthy AI","lastPublishedDoi":"10.21203/rs.3.rs-7237079/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-7237079/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"Ensuring the safety and reliability of large language models (LLMs) in clinical practice is critical to prevent patient harm. However, LLMs are advancing so rapidly that static benchmarks quickly become obsolete or prone to overfitting, yielding a misleading picture of model trustworthiness. Here we introduce a Dynamic, Automatic, and Systematic (DAS) red-teaming framework that continuously stress-tests LLMs across four safety-critical axes: robustness, privacy, bias/fairness, and hallucination. Validated against board-certified clinicians with high concordance, a suite of adversarial agents autonomously mutates clinical test cases to uncover vulnerabilities in real time. Applying DAS to 15 proprietary and open-source LLMs revealed a profound gap between high static benchmark performance and low dynamic reliability - the ''Benchmarking Gap''. Despite median MedQA accuracy exceeding 80%, 94% of previously correct answers failed our dynamic robustness tests. Crucially, this brittleness generalized to the realistic, open-ended HealthBench dataset, where top-tier models exhibited failure rates exceeding 70% and stark shifts in model rankings across evaluations, suggesting that high scores on established static benchmarks may reflect superficial memorization. We observed similarly high failure rates across other domains: privacy leaks were elicited in 86% of scenarios, cognitive-bias priming altered clinical recommendations in 81% of fairness tests, and we identified hallucination rates exceeding 74% in widely used models. By converting medical LLM safety analysis from a static checklist into a dynamic stress-test, DAS provides a foundational, scalable, and living platform to surface the latent risks that must be addressed before the next generation of medical AI can be safely deployed.","manuscriptTitle":"Beyond Benchmarks: Dynamic, Automatic And Systematic Red-Teaming Agents For Trustworthy Medical Language Models","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2026-02-18 03:24:34","doi":"10.21203/rs.3.rs-7237079/v1","editorialEvents":[],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"nature-health","isNatureJournal":true,"hasQc":false,"allowDirectSubmit":false,"externalIdentity":"nathealth","sideBox":"Learn more about [Nature Health](https://www.nature.com/naturehealth/)","snPcode":"44360","submissionUrl":"https://mts-nathealth.nature.com","title":"Nature Health","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"ejp","reportingPortfolio":"Nature","inReviewEnabled":true,"inReviewRevisionsEnabled":false}}],"origin":"","ownerIdentity":"090eeee5-62e1-49a1-93fb-d1cf27c5fe27","owner":[],"postedDate":"February 18th, 2026","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"under-review","subjectAreas":[{"id":63054367,"name":"Health sciences/Health care/Health services"},{"id":63054368,"name":"Health sciences/Health care/Health policy"}],"tags":[],"updatedAt":"2026-04-24T07:50:57+00:00","versionOfRecord":[],"versionCreatedAt":"2026-02-18 03:24:34","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-7237079","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-7237079","identity":"rs-7237079","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}