Thesis map
Each thrust answers a question the previous one opened, and several of the answers are negative. The argument view below follows that chain. The chapter view shows how the dissertation is organized instead.
Nobody had measured how often a rephrased clinical question changes a medical model’s answer, at scale, on audited paraphrases.
Chapter 3
How often do equivalent questions change model answers?
PSF-Med evaluates six medical vision-language models on 92,856 audited paraphrase pairs built from 26,850 chest X-ray questions spanning three countries. Pairwise flip rates on the binary yes/no subset range from 6.4% to 54.7% (an 8.5x spread), and scale does not buy consistency. Two model-dataset cells with degenerate yes-bias (>98% positive on originals) are set aside rather than counted as consistency.
Main limitation The paraphrases are generated by a language model and filtered by an automated judge, not collected from clinicians, so the flip rates measure sensitivity to plausible rewrites rather than to the way clinicians actually phrase questions.
Measurement showed some models are strikingly consistent. That raised a harder question: is consistency evidence of good reasoning, or of ignoring the image?
Chapter 4
Does consistency mean the model is using the image?
A curated 107-pair set, three backends. The most consistent model, LLaVA-Rad at 6.5% flips, gives the same answer on nearly every question when you take the image away. The least consistent, MedGemma-4B at 42.1% here, is the one that reacts most when you swap the image for another. Across these three, consistency and text-reliance rise together. The set is small, hand-picked, and predates the equivalence audit, so read it as an illustration and not as an estimate.
Main limitation The flip/text-only correlation is computed over only three models on a pre-audit 107-pair set whose flip labels still contain operator-changing paraphrases; it is consistent with the text-shortcut hypothesis but does not establish a general law.
If consistency can be ungrounded, then reducing flips is only worth doing if it does not come from leaning further on the text. That means finding where the answer is decided.
Chapter 5
Can paraphrase flips be reduced without degrading observed accuracy?
The answer commits at layer 16, and a candidate two-stage account runs from Feature 3818 at layer 17 to Feature 12139 at layer 29. Both are exploratory. Ablating the single feature restores the original answer in only 6 of 76 flips, and the layers the diagnosis pointed at turn out not to be the best place to intervene: early layers beat them. The adapter still works. A targeted LoRA on layers 15 to 19, touching 0.10% of parameters, cuts the pairwise flip rate from 8.5% to 3.5% on a clean patient-disjoint set, about 59%, with no observed accuracy reduction.
Main limitation The mitigation does not preserve grounding: both adapters raise text-only agreement from 53.5% to about 77% and are statistically tied on image reliance, so they buy consistency by leaning harder on the question text; Targeted LoRA is the cheaper and more accurate route to the same consistency, not a more grounded one.
The adapter cut flips. Whether that made the model safer is a separate question, and it needs a screen that tests consistency and image dependence together.
Chapter 6
Do consistency improvements produce safer, more image-dependent behavior?
A four-quadrant audit crossing consistency with image reliance shows that, averaged across ten model-dataset settings, 81% of each model's consistent predictions are image-invariant (range 45-100%). Consistency-optimized adapters concentrate predictions in the Dangerous quadrant (consistent but text-reliant), reaching 84.1% for Targeted LoRA on PadChest. Correctness is a separate axis: on PadChest the text-reliant cell is often more accurate than the grounded one, so the screen flags behavior, not per-prediction error.
Main limitation The quadrant audit is a behavioral screen, not a per-prediction safety verdict: on PadChest the Dangerous cell can be more accurate than the grounded cell (Base 100% vs 33%), and the widely-quoted r=-0.86 consistency-grounding correlation is largely definitional, falling to r=-0.15 once conditioned on consistency.
If a consistent model can still be ungrounded, deployment cannot rely on consistency. Something has to flag the predictions a clinician should look at.
Chapter 7
Can uncertainty and audit signals identify predictions that should be escalated?
One forward pass is enough to rank flip risk. Predictive entropy predicts paraphrase flips at an AUROC of 0.823 and errors at 0.862 for Targeted LoRA on the PadChest flip bank, and it carries across architectures: LLaVA-Rad LoRA reaches 0.830 on PadChest and 0.905 on MIMIC. The gate is a different story. It is an offline readiness audit rather than something a clinic could run, since its region term needs a radiologist's bounding box that no undiagnosed patient has. And what it admits is mostly what the question text already answers: on the slice where text and image disagree, Targeted LoRA scores 2.9%.
Main limitation The gate is an offline readiness audit: its region term requires a radiologist bounding box that does not exist for an undiagnosed patient (available for 637 of 861 PadChest questions and none of MIMIC), and what it admits are text-answerable cases, not grounded ones, so the answer to whether gates select grounded predictions is no.
| Chapter | Title | Thrust | What it establishes |
|---|---|---|---|
| 1 | Introduction | — | Frames paraphrase sensitivity in medical Vision-Language Models, states the overarching question and its five-thrust decomposition, and motivates the deliberate restriction to binary presence questions about chest X-rays. |
| 2 | A Scoping Review of Trustworthiness Evaluation in Medical Vision-Language Models | — | Surveys how the field evaluates trustworthiness in medical VLMs and shows that the practices each thrust targets, such as paraphrase invariance testing and image-reliance checks, are routinely omitted. |
| 3 | Thrust 1: Measuring Paraphrase Sensitivity in Medical VLMs | Measurement | Builds the PSF-Med benchmark (92,856 audited evaluation pairs from 26,850 questions across MIMIC-CXR, PadChest, and VinDr-CXR) and measures pairwise flip rates from 6.4% to 54.7% across six models on the binary subset, with two degenerate yes-bias cells set aside. |
| 4 | Thrust 2: Diagnosing the Origin of Paraphrase Sensitivity | Diagnosis | Uses text-only evaluation, controlled image swaps, and attention analysis on a 107-pair diagnostic set to show that the most consistent backends rely least on the image; the three-model pattern is illustrative, not a population estimate. |
| 5 | Thrust 3: Mechanistic Diagnosis and Targeted Mitigation | Mitigation | Locates a general answer-commitment locus at layer 16 and candidate SAE features (L17/#3818, L29/#12139), then shows a targeted LoRA on layers 15-19 (0.10% of parameters) cuts the pairwise flip rate about 59% on a patient-disjoint set without observed accuracy reduction; a safety re-audit finds the adapters gain consistency by leaning harder on question text, not by restoring grounding. |
| 6 | Thrust 4: Safety Evaluation | Safety | Introduces a four-quadrant audit crossing consistency with image reliance: averaged across ten model-dataset settings, 81% of consistent predictions are image-invariant, and consistency-optimized adapters concentrate predictions in the consistent-but-text-reliant quadrant. Correctness is a separate axis, so the screen is not a per-prediction safety verdict. |
| 7 | Thrust 5: Calibrated Uncertainty and Deployment Gating | Deployment | Shows a single-forward-pass entropy signal predicts paraphrase flips (AUROC 0.823) and errors (AUROC 0.862) and transfers across architectures, but the deployment gate is an offline readiness audit whose region term needs radiologist boxes unavailable at inference; admitted cases are text-answerable rather than grounded, and the deep ensemble fails out of distribution without early warning. |
| 8 | Conclusion | — | Synthesizes the five thrusts under the central claim that a low paraphrase-flip rate is not sufficient evidence of reliable visual reasoning, and lays out future work including a same-polarity mechanistic screen and the designed but not yet conducted clinician deployment consultation. |
| — | Appendices: Supplementary Material; Extended Model Details and Hyperparameters; Reproducibility Information | — | Supplementary analyses and tables, extended model and hyperparameter details, and reproducibility information for the experiments in Chapters 3 through 7. |
Low paraphrase sensitivity is insufficient evidence of grounded visual reasoning. Consistency must be evaluated together with correctness, image dependence, and uncertainty.
That is a narrower claim than the one I set out to make. The mitigation works on its own terms and does not preserve grounding. The mechanism is a candidate account, not a proven circuit. The deployment audit admits the cases a text prior already answers. Those results are on this site with the same weight as the ones that worked.
Five bounds on the whole thing. Individual results carry their own limits under "Source, denominator, and limits".
The targeted adapter cuts paraphrase flips by about 59% with no observed accuracy reduction. It buys that consistency by leaning harder on the question text: text-only agreement rises from 53.5% to about 77%. On the clean patient-disjoint fleet, targeted and full adaptation are statistically tied on image reliance. The earlier claim that targeted adaptation preserves image dependence does not survive the clean re-audit.
Feature 3818 at layer 17 and Feature 12139 at layer 29 are the strongest individually recoverable features at their stages. They are not a complete circuit. And 39% of the flips in the canonical screen change the clinical operator, so the restoration numbers mix paraphrase sensitivity with operator handling. Every mechanistic and mitigation experiment also runs on MedGemma-4B alone: the behavior generalises across six models, the account of where the answer is decided does not.
81% of consistent predictions are image-invariant across ten model-dataset settings. The often-quoted correlation between flip rate and image-invariant fraction is largely definitional. That fraction is by construction a subset of the consistent predictions, and conditioning on consistency drops it to about -0.15. The level is the finding; the correlation is not used as evidence.
PSF-Med's paraphrases were written by a language model and filtered by embedding similarity and a rubric audit. That is what enables the scale, and it means the wordings are not a sample of how clinicians actually ask. The 1,200-pair clinician adjudication measures the judge rather than the benchmark, since it predates the PadChest regeneration and only 140 of its pairs remain in the evaluated set.
The evaluation covers yes/no questions on chest radiographs, tested at a single point in time on retrospective research datasets. Open-ended reporting, multi-label findings, other modalities, and prospective clinical use are outside what this evidence can speak to. The clinician equivalence adjudication is complete; the deployment-readiness consultation is designed and declared future work.
From the synthesis table in Chapter 8. The chip states how strongly the evidence supports the answer.
Paraphrase sensitivity is common in medical vision-language models: pairwise flip rates on the binary yes/no subset span 6.4% to 54.7% across six models and three chest X-ray datasets, an 8.5x spread.
Measured on binary presence questions in chest radiography only; two cells (MedGemma-1.5-4B on VinDr, LLaVA-Rad on PadChest) are degenerate yes-bias artifacts, not genuine consistency, and are set aside. Pairwise rates must never be mixed with query-level rates, which run 2-3x higher for the same model.
flip-rate-range · flip-rate-medgemma4b-mimic · flip-rate-medgemma4b-padchest · benchmark-eval-pairs
Scale does not buy paraphrase consistency: MedGemma-27B is the most consistent model on MIMIC (6.4%) but not on PadChest or VinDr, and no stable consistency ordering by parameter count exists across datasets.
Shown within the MedGemma family only (4B, 1.5-4B, 27B); it does not establish that scaling is useless in other families or at frontier scale, only that scale alone did not produce consistency here.
Low paraphrase sensitivity can coexist with output-level image-removal invariance: LLaVA-Rad reaches 96% text-only agreement at low flip rates while MedGemma-4B is more image-dependent but flips more, so a low flip rate is insufficient evidence of grounded visual reasoning.
A tendency across the models studied, not a deterministic law; the 107-pair three-backend diagnostic set predates the equivalence audit, and MedGemma-4B's flip rate on it (42.1%) is roughly 5x its headline rate, so these numbers must not be compared with the main benchmark.
text-only-llavarad-107 · text-only-medgemma4b-107 · swap-sensitivity-medgemma4b-107 · flip-textonly-correlation-107
A candidate two-stage mechanistic account localizes paraphrase sensitivity: Feature 3818 (layer 17) behaves as an operator/register feature and Feature 12139 (layer 29) as a downstream answer-selection feature, with layer 16 as a general answer-commitment locus.
Exploratory and associational, not a population-level causal claim. 39% of the verified MIMIC flips are negation-pattern changes, so restoration and mediation numbers conflate genuine same-polarity sensitivity with correct operator handling; a same-polarity screen with matched controls is the outstanding step. On operator-preserving pairs, single-feature ablation of 3818 restores the original answer in only 6 of 76 flips, and layer 16 commitment is general to answering, not paraphrase-specific.
feature3818-operator-preserving-top1 · feature3818-patch-recovery · layer16-commit-rate
Partly. Targeted LoRA on layers 15 to 19 touches 0.1% of parameters and cuts pairwise flips from 8.5% to 3.5% over five seeds, about 59%. McNemar p < 0.002 in every seed, and no observed accuracy reduction on a patient- and image-disjoint split. But it does not preserve visual grounding: both adapters raise text-only agreement from 53.5% to about 77%.
The accuracy interval ([-1.00, +1.51] pp) excludes a large accuracy cost but does not establish exact parity, so 'no accuracy cost' overstates it. The clean re-audit finds targeted and full LoRA statistically tied on image reliance: targeted is the cheaper and more accurate route to the same consistency, not a more grounded one. Out of distribution, the gain is accuracy and margin, not flip reduction.
lora-flip-reduction-pd · lora-accuracy-delta-pd · lora-param-fraction · lora-textonly-increase-pd
No: the best intervention layer does not match the diagnosis layer. Ablating early layers 0-10 reduces margin difference to 0.26 (86% reduction), beating the mechanistically identified layers 15-19 (0.38, 80%) by six points.
Locating where sensitivity manifests is not the same as locating where to intervene; the result rejects the hypothesis that mechanistic diagnosis pinpoints the optimal intervention site, but it does not explain why early layers work better, and it is measured on margin difference rather than the flip-rate endpoint.
Reducing flips can create a false sense of safety: averaged across ten model-dataset settings, 81% of each model's consistent predictions are image-invariant (range 45-100%), so consistency and grounding routinely come apart.
Stated as a level, not a correlation: the r = -0.86 between flip rate and the image-invariant fraction is largely definitional and falls to r = -0.15 conditioned on consistency. Correctness is a separate axis: on PadChest the text-driven cell is often more accurate than the grounded cell: so the quadrant screen classifies risk exposure, not per-prediction safety.
image-invariant-share · quadrant-dangerous-targeted-padchest · quadrant-dangerous-fulllora-mimic · definitional-correlation
No: attention does not reliably indicate grounding. True-box coverage only marginally exceeds a displaced box (0.296 vs 0.261 for Base), and patch-rank correlation between attention and causal occlusion importance is near zero across all three MedGemma variants.
Attention is a coarse localizer, not a faithful explanation: but not random: coverage is 5-6x the random-far baseline and ROI causal scores exclude zero, so the annotated region is causally used even though attention magnitude cannot say which patches matter. Assessed on the 637-box all-positive PadChest subset only.
Partially: the worst-calibrated model also shows the largest demographic disparities. Full LoRA has the worst calibration (ECE of about 0.25 or higher for every group) and the largest sex gaps, while Targeted LoRA has the smallest sex ECE gap (0.012) but the steepest age accuracy gradient (13 pp).
Not a universal link: Base is poorly calibrated yet nearly flat across age, and no model is uniformly most equitable because the sex and age axes disagree. PadChest only: MIMIC has no demographics on disk: and age gradients may partly reflect age-correlated case mix.
fairness-ece-sex-gap-targeted · fairness-age-gradient-targeted
Yes: single-pass predictive entropy predicts paraphrase flips (AUROC 0.823), not only errors (AUROC 0.862), on PadChest, and the flip bridge replicates across architectures (LLaVA-Rad LoRA 0.830 PadChest, 0.905 MIMIC).
Operating thresholds are model-specific and do not transfer. Softmax entropy, temperature-scaled entropy and absolute margin are rank-equivalent: one signal, not three methods: and a high AUROC ranks confidence without certifying that confident predictions are image-grounded.
No. Gates admit the cases the text already answers, not the ones grounded in the image. Admitted-case accuracy does rise, to 96.8% against 91.5% for Targeted LoRA on PadChest. Yet that same model scores 2.9% on the slice where text and image disagree, and Qwen2-VL gets 0 of 279 such questions right under every rule tried.
Judged per prediction, not per model, and the gate itself is an offline readiness audit: its region term needs a radiologist bounding box unavailable for an undiagnosed patient. Severity is dataset-dependent (the MIMIC text-disagrees slice sits at 68-86% accuracy), so the finding is that high-answerability environments amplify the text shortcut, not that gating is always this catastrophic.
gate-grounded-slice-failure · gate-admission-targeted-padchest
No: no single internal monitor transfers across model families. Gemma, LLaVA-Rad, and Qwen2-VL each require different monitors, and the multi-pass alternatives fail in family-specific ways: adapter-only Monte Carlo dropout is an uninformative epistemic probe and the MedGemma deep ensemble collapses out of distribution.
Three architecture families tested; the claim does not rule out a transferable monitor in untested families or with probes that perturb the frozen backbone rather than 0.1% adapter weights. The ensemble failure is specific to same-distribution LoRA checkpoints (the LLaVA-Rad ensemble does not collapse).
mcdropout-mi · ensemble-ood-failure · gate-grounded-slice-failure
A low paraphrase-flip rate is not sufficient evidence of reliable visual reasoning: safe deployment requires joint evaluation of semantic invariance, correctness, image-dependence, and calibration, because optimizing for consistency alone creates a false sense of safety.
Established for binary presence questions in chest radiography across six base models and three datasets; it does not quantify how often text-driven consistency harms patients in a live clinical workflow (the deployment-readiness clinician consultation was designed but not conducted), and the mechanistic account behind the failure remains exploratory.
image-invariant-share · flip-rate-range · lora-flip-reduction-pd · lora-textonly-increase-pd · quadrant-dangerous-targeted-padchest · entropy-flip-auroc