Learning When to Trust Medical Knowledge: Regression-Safe Routing for Clinical Reasoning
Clinical LLMs must import external medical knowledge that can be poisoned, outdated, or hallucinated, yet the gravest risk is regression—turning a correct answer into an incorrect one. This paper introduces Med-TrustRouter, a lightweight per-instance router that selects among five knowledge-use actions using only leakage-free runtime signals, preserving the base answer unless another action is confidently better. On a new benchmark with seven attack families and paired clean controls, it raises the worst-case accuracy floor to 69.2%, well above any fixed-strategy competitor.
The paper presents a compelling, methodologically careful argument that instance-level routing beats any fixed RAG or reflection policy when medical knowledge may be adversarially poisoned. Its leakage-free training protocol, explicit harm-rejection calibration, and human medical audit give its benchmark and controller unusual rigor. However, as the authors acknowledge, "No single knowledge-use strategy is robust on this benchmark: even strong recent RAG methods collapse in at least one regime," which means the advance is purchased at the cost of roughly 5.8 LLM calls per question—far more than single-call methods—and the evaluation remains confined to synthetic poisoning of multiple-choice medical QA. The gains are genuine but narrow, and real-world clinical deployment would require testing against naturally occurring misinformation and open-ended diagnostic tasks.
The strongest aspect is the experimental hygiene. The authors deliberately withhold dataset-identity features from the controller and show that adding them inflates accuracy by letting the model cheat: "allowing leaky dataset-identity features raises both macro (+0.5) and worst-case (+1.9), as expected, because these features let the controller key on the benchmark rather than on the instance." The benchmark construction is equally careful, with four evidence and three reasoning-chain attack families passed through a three-judge filter and an independent human audit that confirmed a 93.9% permissive pass rate. The stability of the routing signal across estimator families—"Logistic, gradient-boosted, neural, and nearest-centroid heads all fall in a tight band on both DeepSeek and Kimi, suggesting that the routing signal is simple enough for a linear default"—is strong evidence that the gains come from the routing problem formulation rather than from expressive modeling.
The most immediate limitation is cost and complexity: the system requires running five candidate actions plus an evidence judge, totaling about 5.8 LLM calls per instance. As the authors note, "Computing the routing features requires running several candidate actions per instance—about 5.8 LLM calls versus one for a single fixed strategy—so budget-aware early-exit routing that stops before all candidates run is a priority for future work." Second, the evaluation scope is narrow. The core metrics come from synthetic poisoning of multiple-choice items on three public QA datasets; the open-form probe covers only 282 instances and relies on automated matching. The authors acknowledge this: "Our metrics are computed on multiple-choice items with synthetic poisoning across three solver LLMs and two evidence judges. An options-hidden probe (Supplementary Material Sec. C.6) indicates that the routing advantage persists when the solver generates free-text answers, while broader clinical tasks and naturally occurring clinical misinformation are left to future work." Finally, the hand-coded router collapses on qwen3-8b, but that solver's overall accuracy is low enough that the transfer claim, while valid, operates in a regime far from clinical usefulness.
The empirical evidence clearly supports the central "no free lunch" thesis. Table 2 shows that fixed strategies suffer complementary collapses: "Astute RAG excels on poisoned evidence but collapses when evidence is genuinely useful (54.8% on PubMedQA), while the strongest competitor on average, InstructRAG, collapses on reasoning-poisoned questions (54.6%)." The authors fairly reproduce baselines under the same protocol and disclose that "the macro gain over InstructRAG is smaller and within bootstrap noise," so the robust claim is worst-case, not average-case. One caveat is that the per-instance oracle over the same five candidates reaches 90.9% macro and 81.3% worst-case, meaning the router still leaves substantial headroom on the table. Comparisons to related work are generally fair, though the framing could more explicitly acknowledge that some competitors (e.g., FaithfulRAG at 44 calls) also spend large inference budgets without achieving comparable worst-case floors.
The controller itself is highly reproducible: training is CPU-only, uses standard scikit-learn and LightGBM, and "completes in minutes on a commodity laptop." The paper also supplies full prompts for all five actions and the judge, a complete 53-feature list, and a deterministic split protocol. Yet independent reproduction is bottlenecked by the need for access to several proprietary hosted LLMs: "The candidate actions and the evidence judge are hosted large language models accessed through their providers' inference APIs." Without the exact API versions, cached candidate outputs, and controller checkpoints, it would be expensive and slow for others to replicate the headline numbers exactly. The supplementary material mentions that "The repository prompt specification is the executable source of truth," but the authors do not explicitly commit to releasing code or checkpoints, which is a notable gap for a system whose value lies in its training and calibration details.
Clinical reasoning LLMs need external medical knowledge, but retrieved evidence and reasoning chains can be outdated, poisoned, or hallucinated. Harmful knowledge can cause regression: changing a correct answer into an incorrect one. We construct a medical knowledge-poisoning benchmark covering retrieved evidence and reasoning chains, with seven attack families filtered by a three-judge "subtle-but-wrong" vote and paired clean exams that separate poisoning effects from question difficulty. No fixed knowledge-use strategy is robust across these settings: strong RAG methods trade robustness to poisoned evidence against accuracy when evidence is useful. We formulate knowledge use as per-instance routing and introduce Med-TrustRouter, a lightweight controller that keeps the solver frozen. From leakage-free runtime signals, it estimates each action's expected correctness gain and uncertainty, preserving the base answer unless another action is confidently better. Across seven medical reasoning settings, Med-TrustRouter achieves 78.9 macro and 69.2 worst-case accuracy, matching the strongest competitor on macro accuracy while substantially improving the worst-case floor. Its gains transfer across solvers and evidence judges, unlike a hand-coded router using the same signals. Similar performance across linear, tree, and neural action-value heads suggests that the benefit comes from routing rather than estimator complexity. These results support learning when to trust external knowledge for robust clinical reasoning.
Pick a starting point or write your own. Challenges run in the background, so you can keep reading while the AI investigates.
No challenges yet. Disagree with the review? Ask the AI to revisit a specific claim.