Authority-Preserving Evaluation of Medical Vision-Language Assistants

Medical vision--language models (VLMs) are usually evaluated on intact image--question pairs, but trustworthy clinical use requires a stronger property: a model must recognise when the evidential basis for an answer has failed. We study this through silent failures under perturbed evidence, where a vision-required medical question is paired with a false premise, wording perturbation, knowledge-only rewrite, or ROI-corrupted image, yet the model returns a fluent non-refusal answer. We introduce medvigil, a 300-case evaluation suite drawn from four public medical VQA sources, supervised end to end by four board-certified radiologists: every gold answer, refusal option, candidate-answer set, paraphrase, false-premise trap, ROI box, and clinical risk tier is clinician-authored. Two attending radiologists annotate every case in parallel, a senior radiologist consolidates the released manifest, and a separate fourth radiologist independent of construction answers every probe to provide the human reference baseline. The release contains 2556 MCQ probes, 240 counterfactual triplets, physician-adjudicated risk-tier and answerability flags, ROI boxes, and a paired open-ended variant. We report seven correctness-conditioned audit metrics that summarise into the medvigil Composite Score (MCS), and audit 16 vision-capable models plus two text-only baselines. The independent radiologist scores MCS 83.3 at silent-failure rate 5.8%, leaving a 14.1-point composite headroom above the strongest audited model (Claude Opus 4.7 at 69.2). The benchmark and evaluation harness are publicly released.

An answer from a vision-language model (VLM) to a medical image question can be accepted without review only under a threshold bounding the error of accepted answers, and certifying that bound costs local labels. We ask what such labels can certify for nine confidence estimators on five general-purpose open-weight VLMs and three medical VQA benchmarks under Learn-then-Test, with the question as the exchangeable unit. Estimators trained on natural images transfer poorly: the best pooled certificate covers 11.5% of SLAKE answers at a 20% error tolerance and nothing on PATH-VQA. With 1,000 labeled SLAKE questions, adapting a probe on half of them raises pooled certified coverage from 6.8% to 37.6% (0.0% to 30.6% with the image as the unit), above the best threshold-only estimator (11.3%). On PATH-VQA, adaptation certifies 11.4% with 2,500 labels; thresholds alone certify nothing. Yet for strong single models, small budgets are better spent on the threshold. A question-only classifier recovers much of adaptation's ranking gain but certifies far less. Neither procedure yields a pooled certificate at 10%, and nothing is certified at 5%. A blank image removes 61% of correct answers, yet on GMAI-MMBench no trained probe is less confident on answers unchanged by image replacement.

Consistency under paraphrase, the property that semantically equivalent prompts yield identical predictions, is increasingly used as a proxy for reliability when deploying medical vision-language models (VLMs). We show this proxy is fundamentally flawed: a model can achieve perfect consistency by relying on text patterns rather than the input image. We introduce a four-quadrant per-sample safety taxonomy that jointly evaluates consistency (stable predictions across paraphrased prompts) and image reliance (predictions that change when the image is removed). Samples are classified as Ideal (consistent and image-reliant), Fragile (inconsistent but image-reliant), Dangerous (consistent but not image-reliant), or Worst (inconsistent and not image-reliant). Evaluating five medical VLM configurations across two chest X-ray datasets (MIMIC-CXR, PadChest), we find that LoRA fine-tuning dramatically reduces flip rates but shifts a majority of samples into the Dangerous quadrant: LLaVA-Rad Base achieves a 1.5% flip rate on PadChest while 98.5% of its samples are Dangerous. Critically, Dangerous samples exhibit high accuracy (up to 99.6%) and low entropy, making them invisible to standard confidence-based screening. We observe a negative correlation between flip rate and Dangerous fraction (r = -0.89, n=10) and recommend that deployment evaluations always pair consistency checks with a text-only baseline: a single additional forward pass that exposes the false reliability trap.