Neurosymbolic Alignment for Physiologically-Safe Clinical Language Models

Abdulhady Abas Abdullah; Erik Cambria; Milena Zivkovic

cs.AIAug 25, 2026

Neurosymbolic Alignment for Physiologically-Safe Clinical Language Models

Authors: Abdulhady Abas Abdullah, Erik Cambria, Milena Zivkovic

Organizations: Artificial Intelligence and Innovation Centre, University of Kurdistan Hewlêr, Erbil, Iraq · MIT Media Lab, Massachusetts Institute of Technology, Cambridge, MA 02139, USA · Department of Physics, Faculty of Science, University of Kragujevac, 34000 Kragujevac, Serbia

Abstract

Clinical LLMs can generate recommendations that are factually plausible yet physiologically unsafe. We investigate whether safety alignment can be improved by grounding preference optimization in structured physiological knowledge rather than text-only supervision. Methods: We propose Neurosymbolic Alignment, a training-time framework that couples a 7B clinical LLM with an HGNN-based Physiological World Model over an 847K-node biomedical knowledge graph. Candidate responses are scored using homeostatic constraints, multi-hop path plausibility, and drug-interaction penalties, and the resulting rankings drive iterative on-policy ORPO updates. Evaluation is performed on the Clinical Safety Benchmark (CSB), a 2,500-scenario benchmark for physiological constraint violations in generative clinical reasoning. Results: Relative to ORPO, the proposed method improves CSS from 69.5% to 90.8% (+21.3 pp), reduces physician-evaluated HR from 14.1% to 5.1% on the blinded subset, and improves DID from 72.8% to 91.6%. These gains are corroborated by an HGNN-independent Rule-Engine Safety Score (RSS: 86.4%, +21.2 pp over ORPO; r=0.97 concordance with CSS). The method also exceeds GPT-4 (5-shot) on all safety metrics despite a 10x parameter disadvantage, and outperforms an inference-time self-correction pipeline (SFT+SelfCorrect) by 11.4 pp CSS. Under synthetic EHR-style noise, 84.2% CSS is retained. Ablation analysis shows that HGNN scoring (-16.2 pp) and iterative training (-11.5 pp) are the dominant contributors. PhysioScore calibration against 200 clinician labels yielded ECE = 0.038 and kappa = 0.91. Conclusion: Training-time physiological grounding produces measurable and independently verifiable safety improvements in open-weight clinical LLMs under controlled evaluation. External validation on real clinical data is required to determine whether these gains transfer to deployment settings

Figures & tables

Panel of Figure 1 — Fig. 1: Training-time neurosymbolic pipeline. The base LLM samples candidate clinical responses, the Physiological World Model scores their feasibility, and Iterative ORPO updates the policy. At inference, only the aligned LLM is used.

Panel of Figure 2 — Fig. 2: Training-time neuro-symbolic alignment: the LLM samples candidates, the HGNN scores physiological feasibility on $\mathcal{G}$ , and Iterative ORPO updates the policy (HGNN not used at inference).

Source	Entities	Relations	Triples
UMLS Metathesaurus	4,200,000	54	12,847,392
DrugBank 5.1	14,315	12	1,432,847
Reactome	12,632	8	284,521
HPO	16,234	5	156,842
SIDER	1,430	3	139,756
PharmGKB	5,421	7	87,432

TABLE I: Graph Source Statistics

Node Type	Count	Percentage
Drug	14,315	1.69%
Disease	24,166	2.85%
Symptom	7,823	0.92%
Organ/Anatomy	12,478	1.47%
Pathway	12,632	1.49%
Gene/Protein	19,566	2.31%

TABLE II: Node Type Distribution in Physiological World Model

Method	Base Model	Training Data	KG	Pref. Opt.
SFT	Mistral-7B	MedQA + PubMed	✗	✗
SFT+RAG (lightweight)	Mistral-7B	MedQA + PubMed	Retrieval	✗
SFT+DenseRAG	Mistral-7B	MedQA + PubMed	Dense+Rerank	✗
DPO	Mistral-7B	Human Prefs (5K)	✗	✓
ORPO	Mistral-7B	Human Prefs (5K)	✗	✓
KG-LLM	Mistral-7B	MedQA + KG	Static	✗

TABLE III: Baseline Method Specifications

Method	MA	CSS	RSS	HR $\downarrow$	DID	PC
SFT	61.2	58.4	54.6	23.7	62.1	0.61
SFT+RAG	67.8	63.2	60.8		68.5	0.67
SFT+DenseRAG	70.8	78.3	74.2		81.4	0.78
DPO	69.4	67.8	63.4		71.3	0.69
ORPO	70.1	69.5	65.2	14.1	72.8	0.71
KG-LLM	68.9	72.4	68.1	12.8	76.2	0.74

TABLE IV: Performance comparison across methods. HR is reported only for the blinded physician-evaluated subset. RSS is HGNN-independent (DrugBank-Rule deterministic checker).

Claim	Result	Ref.	Indep.
CSS over ORPO	+21.3 pp	Tab. IV	H
RSS over ORPO	+21.2 pp	Tab. IV	I
DID over ORPO	+18.8 pp	Tab. IV	I
HR over ORPO (physician)	$-$ 9.0 pp	Tab. IV	P
CSS vs. GPT-4 (5-shot)	+10.2 pp	Tab. IV	H
CSS vs. SFT+SelfCorrect	+11.4 pp	Tab. IV	H

TABLE V: Summary of Key Demonstrated Results. Metric independence: I = fully HGNN-independent; H = HGNN-derived; P = physician-adjudicated.

Appendix figures & tables22 assets

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 8 — Fig. 3: Schema of the heterogeneous physiological knowledge graph showing the six node types ( $\mathcal{T}_{V}$ ) and five canonical relation types ( $\mathcal{T}_{E}$ ).

Panel of Figure 9 — Fig. 4: Performance progression across training iterations. CSS and DID show the steepest improvements in early iterations, while gains diminish after iteration 4. The inverted hallucination rate (100-HR) demonstrates consistent safety improvements throughout training.

Configuration	CSS	HR $\downarrow$
Full Model	90.8	5.1
w/ Rule-based Scorer	77.4	10.2
w/ Simple KG Scorer	81.6	8.9
w/o Iterative Training	79.3	9.8
w/o HGNN Scoring	74.6	12.4
w/o Homeostatic Constraints	82.1	8.7

Appendix

TABLE VI: Ablation Study Results

Threshold $\tau$	CSS (%)	HR $\downarrow$ (%)	Note
0.80	92.0	6.4	More permissive; higher false-safe rate
0.83	91.4	5.6	Lower bound of 95% CI
0.85 (default)	90.8	5.1	Calibrated optimum
0.87	90.2	4.7	Upper bound of 95% CI
0.90	89.1	4.2	More conservative; higher abstention

Appendix

TABLE VII: CSS Threshold (

\tau

) Sensitivity. Bootstrap 95% CI

=[0.83,0.87]

;

n{=}200

calibration labels.

KG edge-deletion stress tests
Condition	CSS (%)	HR $\downarrow$ (%)
Full KG (default)	90.8	5.1
10% random edge deletion	88.6	6.3
20% random edge deletion	85.9	7.8
30% random edge deletion	81.4	9.5
10% targeted deletion (high-severity edges)	86.1	7.4

Appendix

TABLE VIII: Sensitivity to Knowledge-Graph Quality and Entity-Linking Errors

Scorer Configuration	CSS	$\Delta$ CSS	HR $\downarrow$	$\Delta$ HR	DID
Full PhysioScore ( $S_{\text{hom}}\cdot\sigma(S_{\text{path}})\cdot(1{-}P_{\text{int}})$ )	90.8		5.1		91.6
Drop $S_{\text{hom}}$ (rule-based homeostasis)	82.1	$-$ 8.7	9.4	$+$ 4.3	88.2
Drop $S_{\text{path}}$ (graph path plausibility)	86.9	$-$ 3.9	7.2	$+$ 2.1	84.7
Drop $P_{\text{int}}$ (drug interaction penalty)	84.3	$-$ 6.5	10.8	$+$ 5.7	79.1
Drop $S_{\text{hom}}+P_{\text{int}}$ (learned path only)	79.6	$-$ 11.2	12.3	$+$ 7.2	76.4
Drop $S_{\text{path}}$ (fix hom $+$ int rules only)	84.3	$-$ 6.5	8.9	$+$ 3.8	83.1

Appendix

TABLE IX: PhysioScore Component Ablation: Term-Drop Results

Score Decile	Clinician Safe Rate (%)	Mean PhysioScore
Decile 1 (lowest scores)	8.5	0.21
Decile 2	17.0	0.34
Decile 3	31.0	0.45
Decile 4	48.0	0.56
Decile 5	63.5	0.66
Decile 6	74.0	0.74

Appendix

TABLE X: PhysioScore Calibration vs. Clinician Safety Labels (200-Response Held-Out Set)

Combination Function	CSS	$\Delta$ CSS	HR $\downarrow$	DID
$S_{\text{hom}}\cdot\sigma(S_{\text{path}})\cdot(1{-}P_{\text{int}})$ (default, multiplicative)	90.8		5.1	91.6
$\frac{1}{3}(S_{\text{hom}}+\sigma(S_{\text{path}})+(1{-}P_{\text{int}}))$ (uniform additive)	86.2	$-$ 4.6	7.8	85.9
$0.5S_{\text{hom}}+0.3\,\sigma(S_{\text{path}})+0.2\,(1{-}P_{\text{int}})$ (weighted additive)	87.1	$-$ 3.7	7.3	86.4
$\min(S_{\text{hom}},\,\sigma(S_{\text{path}}),\,(1{-}P_{\text{int}}))$ (worst-component)	88.4	$-$ 2.4	6.2	89.1
$S_{\text{hom}}^{0.5}\cdot\sigma(S_{\text{path}})^{0.3}\cdot(1{-}P_{\text{int}})^{0.2}$ (geometric weighted)	89.6	$-$ 1.2	5.6	90.2

Appendix

TABLE XI: PhysioScore Combination Function Sensitivity

$\lambda$ Perturbation	CSS	$\Delta$ CSS	HR $\downarrow$	$\Delta$ HR	Note
Default $\lambda$ values (Table 5)	90.8		5.1
All $\lambda\times 0.5$ (halved steepness)	87.3	$-$ 3.5	7.4	$+$ 2.3	Softer penalties
All $\lambda\times 2.0$ (doubled steepness)	89.2	$-$ 1.6	5.9	$+$ 0.8	Harsher but noisier
Uniform $\lambda=2.0$ for all constraints	88.1	$-$ 2.7	6.8	$+$ 1.7	Ignores clinical risk profiles
$\lambda$ from Gaussian noise ( $\pm 20\%$ )	89.9	$-$ 0.9	5.5	$+$ 0.4	Robust to moderate noise

Appendix

TABLE XII: Steepness Parameter (

\lambda

) Sensitivity on CSS

Iteration	MA (%)	CSS (%)	HR (%) $\downarrow$	DID (%)	PC
Iteration 1	71.3	78.2	10.4	81.5	0.79
Iteration 2	72.4	82.6	8.9	84.2	0.82
Iteration 3	73.8	86.4	7.2	87.3	0.85
Iteration 4	74.6	89.1	5.8	90.1	0.87
Iteration 5	75.2	90.8	5.1	91.6	0.89
$\Delta$ (Iter 1 $\rightarrow$ 5)	+3.9	+12.6	-5.3	+10.1	+0.10

Appendix

TABLE XIII: Performance Progression Across Training Iterations

Specialty	CSS	CSS	$\Delta$	HR	DID
	(Ours)	(ORPO)		(Ours)	(Ours)
Cardiology	91.2	70.3	+20.9	4.8	92.4
Nephrology	89.7	68.1	+21.6	5.3	90.8
Oncology	87.4	65.8	+21.6	6.1	88.2
Pediatrics	86.9	64.2	+22.7	5.8	89.1
Psychiatry	84.3	67.5	+16.8	7.2	82.6

Appendix

TABLE XIV: Cross-Domain Generalization Results

Panel of Figure 19 — Fig. 5: Training loss convergence over 30K steps. Total loss decreases from 2.3 to 0.38, with KG loss showing the fastest convergence. The OR loss initially increases as preference learning intensifies, then stabilizes.

Metric	Iter 1	Iter 2	Iter 3	Iter 4	Iter 5
Total Loss	0.82	0.61	0.48	0.41	0.38
SFT Loss	0.95	0.78	0.68	0.62	0.60
KG Loss	0.28	0.18	0.14	0.12	0.11
OR Loss	0.35	0.32	0.30	0.29	0.28
Pref. Pairs Generated	1,750	1,750	1,750	1,750	1,750
Avg. Score Gap	0.42	0.38	0.31	0.26	0.22

Appendix

TABLE XV: Training Statistics Across Iterations

Component	Parameter	Value
LLM Training	Base Model	Mistral-7B-v0.3
	Learning Rate	$2\times 10^{-5}$
	LR Schedule	Cosine Decay
	Batch Size	32
	Max Sequence Length	2048
	Gradient Accumulation	4

Appendix

TABLE XVI: Hyperparameter Configuration

Stage	GPU Hours	Memory (GB)	Storage (GB)
KG Construction	2.4	128	45
HGNN Pre-training	8.6	320	12
LLM Fine-tuning (per iter.)	3.2	640	28
Response Generation	1.8	160	8
Preference Scoring	0.4	64	2
Total (5 iterations)	42.6		95

Appendix

TABLE XVII: Computational Resource Requirements

Dataset	Train	Valid	Test	Task Type
MedQA-USMLE	10,178	1,272	1,273	Multiple Choice
PubMedQA	450	50	500	Yes/No/Maybe
MedMCQA	182,822	4,183	6,150	Multiple Choice
MMLU-Medical	1,089	123	1,871	Multiple Choice
CSB (Ours)	1,750	250	500	Open Generation
DDI-Corpus	4,521	645	1,290	Interaction Detection

Appendix

TABLE XVIII: Dataset Statistics and Characteristics

Category	Scenarios	Percentage
Drug-Drug Interactions	625	25.0%
Contraindication Detection	500	20.0%
Homeostatic Violations	450	18.0%
Dosing Errors (Pediatric/Geriatric)	375	15.0%
Organ Function Impairment	300	12.0%
Multi-system Polypharmacy	250	10.0%

Appendix

TABLE XIX: Clinical Safety Benchmark (CSB) Composition

Model	Params	CSS	HR $\downarrow$	Time
BioMistral-7B	7B	88.4	6.2	14.2h
Mistral-7B	7B	90.8	5.1	18.6h
LLaMA-3-8B	8B	91.2	4.9	19.8h
Qwen2-7B	7B	89.6	5.4	17.4h

Appendix

TABLE XX: Performance Across Different Base Models

Error Type	Count	%	Primary Root Cause	Potential Mitigation
Graph Retrieval Failures	84	4.2	Knowledge graph coverage gaps / anatomical mismatch	Dynamic KG updates and continual HGNN refresh
Optimization Drift	62	3.1	Constraint boundary deviation in HGNN depth	Stronger KL regularization and score-gap calibration
Linguistic Hallucinations	56	2.8	Temporal fabrication outside graph representation	Temporal constraints and post-hoc consistency checks
Dosing Errors	41	2.1	Incomplete pharmacokinetic data	Weight/renal-aware dosing calculators in tool loop
Context Ambiguity	38	1.9	Insufficient patient information	Uncertainty-aware abstention and clarification prompts
Novel Drug Combinations	29	1.5	Emerging pharmacological knowledge	Rapid ingestion of approvals and interaction bulletins

Appendix

TABLE XXI: Taxonomy of Failure and Root Cause Analysis (training+validation scenarios)

Panel of Figure 27 — Fig. 6: Step-wise toy example of constraint verification. A candidate plan is generated, entities are linked to the physiological graph, and HGNN-based checks reject the plan due to hyperkalemia-related contraindications.

Score	Criteria
5	Clinically excellent: Safe, accurate, complete, follows guidelines
4	Clinically acceptable: Minor omissions, no safety concerns
3	Borderline: Some inaccuracies, requires verification
2	Concerning: Contains errors that could mislead
1	Dangerous: Contains recommendations that could cause harm

Appendix

TABLE XXII: Human Evaluation Rubric

Metric	Description
MA	Medical Accuracy: Percentage correct on QA benchmarks
CSS	Clinical Safety Score: Adherence to physiological constraints
HR	Hallucination Rate: % responses with impossible statements
DID	Drug Interaction Detection: F1 for contraindicated combinations
PC	Physiological Consistency: Mean HGNN feasibility score
BLEU-Med	Modified BLEU with medical term weighting

Appendix

TABLE XXIII: Evaluation Metrics Overview

LLM Safety

Large language model (LLM) safety studies how to prevent harmful, unreliable, or misaligned behavior while preserving useful responses.

See all 442 papers

When Medical Safety Alignment Fails: A Benchmark for Evaluating LLMs on High-Risk Medical Queries
May 26, 2026Yige Li, Jun Sun, Wei Zhao +5LLM Safety Benchmarks Healthcare
Singapore Management University · Deakin University · The University of Melbourne +2
SafeMed-R1: Clinician-Audited Safety and Ethics Alignment for Medical Large Language Models
May 27, 2026Chao Ding, Mouxiao Bian, Tianbin Li +12Healthcare LLM Auditing
Shanghai Artificial Intelligence Laboratory, Shanghai, China · Joint Laboratory of Biomedical Artificial Intelligence, Shanghai East Hospital, Tongji University School of Medicine, Shanghai, China · School of Computer Science and Technology, Tongji University, Shanghai, China +5
Alignment Plausibility: A New Standard for Assuring AI in Healthcare
Jul 8, 2026Gwydion Williams, Sara Zannone, Bilal A MateenLLM Alignment Healthcare
PATH, United Kingdom · UCL, United Kingdom

May 26, 2026J/K move · Enter open · S save

When Medical Safety Alignment Fails: A Benchmark for Evaluating LLMs on High-Risk Medical Queries

Yige Li, Jun Sun, Wei Zhao, Zhe Li+4

Singapore Management University · Deakin University · The University of Melbourne+2

LLM Safety Benchmarks Healthcare LLM Guardrails LLM Safety Alignment LLM Safety Evaluation Medical LLMs

Open paper AskPDF arXiv

Large language models (LLMs) are increasingly used for medical and health-related questions, yet their safety in high-risk medical scenarios remains poorly understood. We introduce MedHarm\footnote{Code and data will be released upon acceptance. Due to the sensitive nature of high-risk medical queries, data access will be available to qualified researchers upon request.}, a high-risk medical safety benchmark with 1,100 medically grounded queries across 10 safety-critical categories, including toxicology, pharmacology, covert poisoning, anesthesia, and fetal harm. Unlike broad medical QA benchmarks, MedHarm targets realistic clinical, educational, and technical prompts that require refusal, caution, or safe redirection rather than direct helpfulness. We evaluate 15 LLMs spanning general-purpose, medical-purpose, closed-source, and downstream SFT models, together with 4 representative guardrail models. Results reveal a substantial gap between apparent alignment and medical safety: aligned models can still produce unsafe or actionable responses, medical fine-tuning can amplify harmful specificity, and external guardrails reduce some failures while introducing brittle blocking and weak safe helpfulness. These findings show that medical safety cannot be inferred from general alignment or medical capability alone, highlighting the need for domain-specific stress testing before deploying LLMs in safety-critical medical applications.

Abstract

LLM Safety

Explore similar work

When Medical Safety Alignment Fails: A Benchmark for Evaluating LLMs on High-Risk Medical Queries

SafeMed-R1: Clinician-Audited Safety and Ethics Alignment for Medical Large Language Models

Alignment Plausibility: A New Standard for Assuring AI in Healthcare