Learning When to Trust Medical Knowledge: Regression-Safe Routing for Clinical Reasoning
Organizations: Beijing Institute of Technology · Shanghai Jiao Tong University · Xi’an Jiaotong University
Abstract
Clinical reasoning LLMs need external medical knowledge, but retrieved evidence and reasoning chains can be outdated, poisoned, or hallucinated. Harmful knowledge can cause regression: changing a correct answer into an incorrect one. We construct a medical knowledge-poisoning benchmark covering retrieved evidence and reasoning chains, with seven attack families filtered by a three-judge "subtle-but-wrong" vote and paired clean exams that separate poisoning effects from question difficulty. No fixed knowledge-use strategy is robust across these settings: strong RAG methods trade robustness to poisoned evidence against accuracy when evidence is useful. We formulate knowledge use as per-instance routing and introduce Med-TrustRouter, a lightweight controller that keeps the solver frozen. From leakage-free runtime signals, it estimates each action's expected correctness gain and uncertainty, preserving the base answer unless another action is confidently better. Across seven medical reasoning settings, Med-TrustRouter achieves 78.9 macro and 69.2 worst-case accuracy, matching the strongest competitor on macro accuracy while substantially improving the worst-case floor. Its gains transfer across solvers and evidence judges, unlike a hand-coded router using the same signals. Similar performance across linear, tree, and neural action-value heads suggests that the benefit comes from routing rather than estimator complexity. These results support learning when to trust external knowledge for robust clinical reasoning.
Figures & tables
| Adversarial setting | Channel | Families | Items |
|---|---|---|---|
| Med-Adv | evidence | 4 | 2,400 |
| Reflection-Adv | reasoning | 3 | 1,503 |
| MedReason-MedAdv | evidence † | 4 | 241 |
| MedReason-ReflAdv | reasoning † | 3 | 301 |
| Method | M-Adv | MMCQA | MedQA | MR-MAdv | MR-RAdv | PubMQA | Refl-Adv | Macro | Worst |
|---|---|---|---|---|---|---|---|---|---|
| Single knowledge-use actions | |||||||||
| Direct | 86.41 | 74.90 | 85.71 | 72.94 | 68.04 | 48.13 | 88.67 | 74.97 | 48.13 |
| Retrieval (RAG) ( Lewis et al. 2020 ) | 54.69 | 75.30 | 87.05 | 34.12 | 21.65 | 69.71 | 52.16 | 56.38 | 21.65 |
| Reflection | 57.82 | 74.90 | 84.82 | 41.18 | 30.93 | 72.20 | 60.43 | 60.33 | 30.93 |
| Verifier | 85.87 | 71.66 | 83.93 | 65.88 | 71.13 | 46.89 | 88.85 | 73.46 | 46.89 |
| Heuristic / fixed-policy baselines | |||||||||
| Action-value backend | DeepSeek | Kimi |
|---|---|---|
| Macro / Worst | Macro / Worst | |
| Logistic (linear, default) | 78.94 / 69.18 | 81.61 / 68.24 |
| Gradient-boosted (LightGBM) | 79.11 / 68.04 | 80.44 / 65.88 |
| Neural MLP | 78.83 / 68.00 | 81.52 / 67.06 |
| Nearest-centroid | 78.12 / 66.39 | 80.08 / 67.06 |
| Configuration | Macro | Worst |
|---|---|---|
| Med-TrustRouter (full) | 78.77 | 68.24 |
| Reconcile-Knowledge (4 actions) | 76.89 | 63.92 |
| Evidence gate | 78.74 | 63.90 |
| Macro calibration | 78.80 | 68.24 |
| Leaky features (no drop) | 79.30 | 70.10 |
| Setting | Channel | Attack families | Accepted | Evaluated |
|---|---|---|---|---|
| Med-Adv | Evidence | Outdated guideline; look-alike disease; contraindication flip; subtle distractor support | 2,406 | 2,400 |
| Reflection-Adv | Reasoning chain | Plausible-but-wrong CoT; premature conclusion; over-checking flip CoT | 1,503 | 1,503 |
| MedReason-MedAdv | Evidence | Same four evidence families on the harder MedReason source | 241 | 241 |
| MedReason-ReflAdv | Reasoning chain | Same three reasoning-chain families on the harder MedReason source | 301 | 301 |
| Family | MedQA | MedReason | Poisoned-artifact behavior |
|---|---|---|---|
| Evidence channel | |||
| Outdated guideline | 600 | 60 | Plausible but outdated or superseded clinical framing. |
| Look-alike disease | 604 | 60 | Shifts interpretation toward a clinically similar distractor. |
| Contraindication flip | 600 | 60 | Reverses treatment or contraindication implications. |
| Subtle distractor support | 602 | 61 | Selectively supports an incorrect answer option. |
| Reasoning-chain channel | |||
| Subset | Items | Plaus. | Subtle | W.-supp. | Strict | Perm. |
|---|---|---|---|---|---|---|
| All audited artifacts | 196 | 91.3% | 37.2% | 85.7% | 33.2% | 93.9% |
| Evidence channel | 112 | 97.3% | 65.2% | 82.1% | 58.0% | 89.3% |
| Reasoning channel | 84 | 83.3% | 0.0% | 90.5% | 0.0% | 100.0% |
| contraindication_flip | 28 | 100.0% | 92.9% | 92.9% | 92.9% | 96.4% |
| look_alike_disease | 28 | 100.0% | 85.7% | 67.9% | 67.9% | 85.7% |
| subtle_distractor_support | 28 | 96.4% | 82.1% | 75.0% | 71.4% | 82.1% |
| Alias | Role | Developer (API host) | Decoding |
|---|---|---|---|
| DeepSeek-V4-Pro | Main solver | DeepSeek (own API) | temp. |
| glm-5 | Main evidence judge | Zhipu GLM (DashScope) | temp. |
| Kimi-k2.5 | Transfer solver; poison generator | Moonshot Kimi (DashScope) | temp. |
| Qwen3.7-Plus | Transfer evidence judge | Alibaba Qwen (DashScope) | temp. |
| qwen3-8b | Small open solver | Alibaba Qwen (DashScope) | temp. |
| Threshold | Candidate values | Locked | |||
|---|---|---|---|---|---|
| Risk aversion | |||||
| Uncertainty ceiling | |||||
| Score floor | |||||
| Margin | |||||
| Method class | Uses poison artifact | Extra judge | Dev tuning | Recorded evidence |
|---|---|---|---|---|
| Direct answer | No | No | No | Prompt in Section B.2 ; parser in the baseline cache. |
| Single retrieval action | Evidence channel only | No | No | Evidence prompt, parser, and cached outputs. |
| Self-reflection action | Reasoning channel only | No | No | Reflection prompt, chain source, and cached outputs. |
| Verifier action | Candidate answer + question | Yes | No | Verifier prompt, judge model-family separation, and answer-selection rule. |
| Recent RAG competitors | Method dependent | Method dependent | Only if reported | Prompt, call budget, poisoned-artifact access policy, and multiple-choice adaptation notes. |
| Learned router | Cached actions + runtime signals | Evidence judge only | Thresholds on dev | Feature list, forbidden-feature filter, threshold grid, and locked seed protocol. |
| Family | # | Features |
|---|---|---|
| Evidence judge scalars | 15 | evidence_available ; evidence_reliability ; evidence_relevance_score ; evidence_sufficiency_score ; evidence_consistency ; direct_option_support ; prompted_option_support ; retrieval_top_score ; retrieval_margin ; evidence_poison_signal ; evidence_poison_unknown ; evidence_predicted_poison ; reflection_poison_signal ; reflection_poison_unknown ; reflection_predicted_poison . |
| Evidence judge one-hot | 19 | evidence_judge_trust_ {trust, reject, uncertain, no_evidence, missing}; evidence_judge_relevance_ {high, partial, low, none, missing}; evidence_judge_sufficiency_ {sufficient, partial, insufficient, none, missing}; reflection_judge_trust_ {trust, reject, uncertain, missing}. |
| Agreement | 12 | prompted_equals_direct ; naive_equals_direct ; verifier_equals_direct ; prompted_disagrees_direct ; naive_disagrees_direct ; verifier_disagrees_direct ; verifier_equals_reflection ; verifier_disagrees_reflection ; reflection_is_outlier ; n_agree_with_direct ; direct_is_majority ; verifier_equals_majority . |
| Confidence | 2 | direct_confidence ; direct_vote_entropy . |
| Validity | 5 | has_prompted_rag ; has_naive_reflection ; has_verifier ; prompted_valid ; naive_valid . |
| Excluded (leakage) | 21 | question_chars ; question_tokens ; option_count ; context_chars ; dataset_ {medqa, medmcqa, pubmedqa, medreason, med_adv, reflection_adv}; evidence_status_ {none, clean, conflicting, poisoned, unknown}; harm_type_ {none, retrieval, reflection, verifier, counterfactual, constraint}. |
| Control | Calls/question | Macro | Worst | Interpretation |
|---|---|---|---|---|
| Five-action plurality vote | 5.81 | 75.81 | 59.75 | Same action pool and budget, no learned routing. |
| Five-action confidence-weighted vote | 5.81 | 77.20 | 51.87 | Same action pool and budget, non-learned weighting. |
| Five-action per-instance oracle | 5.81 | 90.88 | 81.33 | Non-deployable upper bound for the action pool. |
| Med-TrustRouter | 5.81 | 78.94 | 69.18 | Learned router, five-seed headline. |
| Ablation | Macro | Worst | Purpose |
|---|---|---|---|
| Full locked Med-TrustRouter seed-0 | 78.77 | 68.24 | Reference operating point for appendix ablations. |
| Evidence-judge signal | 77.30 | 56.02 | Trust, relevance, sufficiency, poison features: decisive for worst-case. |
| Agreement signal | 75.57 | 58.76 | Cross-action agreement features: largest macro drop. |
| Internal-only action pool | 76.62 | 61.83 | Drop retrieval + reconcile: heterogeneity matters ( worst). |
| Five-action plurality vote | 75.81 | 59.75 | Learned routing replaced by naive same-budget vote. |
| Outcome counts (base router) | Rates (%) | ||||||
|---|---|---|---|---|---|---|---|
| Adversarial setting | C C | C W | W C | W W | AHR | Regr. | Corr. |
| Med-Adv | 769 | 32 | 48 | 78 | 91.79 | 4.00 | 38.10 |
| Reflection-Adv | 465 | 28 | 31 | 32 | 88.19 | 5.68 | 49.21 |
| MedReason-MedAdv | 54 | 8 | 4 | 19 | 82.98 | 12.90 | 17.39 |
| MedReason-ReflAdv | 59 | 7 | 10 | 21 | 85.71 | 10.61 | 32.26 |
| Method | Calls/q | Input tokens/q | Output tokens/q | USD/1k q | Notes |
|---|---|---|---|---|---|
| Direct | 1.00 | 237.10 | 48.68 | 0.866 | Single action. |
| Retrieval | 1.00 | 487.74 | 67.97 | 1.520 | Single retrieval action. |
| Reflection | 2.00 | 448.74 | 50.80 | 1.306 | Answer, then self-reflect. |
| Verifier | 2.00 | 0.00 | 83.90 | 0.672 | Answer, then independent verify; input tokens are a lower bound (final output only cached). |
| Astute RAG | 2.00 | 0.00 | 103.21 | 0.824 | Recall, then reconcile; input tokens are a lower bound (final output only cached). |
| Med-TrustRouter routing cache | 5.81 | 1715.05 | 438.64 | 6.942 | Sum of direct, retrieval, reflection, verifier, evidence verification, and reconciliation components. |
| Method (options hidden) | Macro | Worst | Note |
|---|---|---|---|
| Med-TrustRouter (frozen) | 80.63 | 66.67 | MCQ-trained controller, no retraining. |
| Reconcile-Knowledge (Astute) | 80.28 | 64.71 | Strongest fixed action on this split. |
| Preserve-Direct | 78.81 | 60.61 | Base answer; do-no-harm anchor. |
| Verify-Answer | 78.38 | 56.06 | Independent judge, question only. |
| Use-Retrieval | 60.17 | 23.81 | Collapses under poisoned evidence. |
| Reflection | 60.14 | 23.81 | Collapses under poisoned reasoning. |
Medical Reasoning
Medical reasoning studies how AI systems use clinical evidence, patient context, and multimodal data to make and explain medical decisions.
See all 31 papers