{ "abstract": "Large language models (LLMs) are increasingly used to answer health-related questions and support healthcare workflows, yet evidence for their safety still relies heavily on static benchmarks that can rapidly become obsolete or be optimized against. Here we introduce a Dynamic, Automatic and Systematic (DAS) red-teaming audit framework that continuously stress-tests LLMs for health across four safety-critical axes: robustness, privacy, bias and hallucination. Validated against board-certified clinicians, a suite of adversarial agents autonomously mutates health-related test cases to uncover vulnerabilities in real time. Applying DAS to 15 state-of-the-art LLMs revealed a profound gap between high static benchmark performance and low dynamic reliability—the ‘benchmarking gap’. Despite median MedQA accuracy exceeding 80%, 94% of previously correct answers failed under dynamic robustness testing. This brittleness generalized to the realistic, open-ended HealthBench dataset, where top-tier models exhibited failure rates exceeding 70%, suggesting that high scores on established static benchmarks may reflect superficial memorization. We observed similarly high failure rates across other domains: privacy leaks were elicited in 86% of scenarios, cognitive bias priming altered recommendations in 81% of fairness tests and hallucination rates exceeded 74% in widely used models. By converting LLM safety evaluation for health from a static checklist into a living adversarial audit, DAS provides a scalable framework for surfacing latent risks before such systems are deployed in consumer-facing health assistants and broader clinical workflows.", "abstract_shown": true, "affiliations": [ "Department of Engineering Science, University of Oxford, Oxford, UK", "Munich Center for Machine Learning, Munich, Germany", "School of Computation, Information and Technology, Technical University of Munich, Munich, Germany", "School of Medicine, TUM University Hospital, Munich, Germany", "Department of Computing, Imperial College London, London, UK", "Department of Diagnostic Radiology, National University of Singapore, Singapore, Singapore", "Department of Computer Science, Stony Brook University, Stony Brook, NY USA", "School of Computer Science, University of Sheffield, Sheffield, UK", "School of Medicine and Health, Technical University of Munich, Munich, Germany", "Department of Neurosurgery/Neuro-Oncology, State Key Laboratory of Oncology in South China, Guangdong Provincial Clinical Research Center for Cancer, Sun Yat-sen University Cancer Center, Guangzhou, China", "Department of Diagnostic and Interventional Neuroradiology, TUM University Hospital, Munich, Germany" ], "article_type": "research article", "arxiv": null, "author_total": 22, "authors": [ { "affs": [ 0, 1, 2, 3 ], "name": "Jiazhen Pan", "orcid": "0000-0002-6305-8117" }, { "affs": [ 1, 2, 3 ], "name": "Bailiang Jian", "orcid": "0009-0009-2419-0420" }, { "affs": [ 2, 3 ], "name": "Paul Hager", "orcid": "0000-0003-2166-0262" }, { "affs": [ 2, 3 ], "name": "Yundi Zhang", "orcid": "0009-0008-7725-6369" }, { "affs": [ 4 ], "name": "Che Liu" }, { "affs": [ 2, 3 ], "name": "Friedrike Jungmann", "orcid": "0000-0002-9600-4094" }, { "affs": [ 5 ], "name": "Hongwei Li", "orcid": "0000-0002-5328-6407" }, { "affs": [ 3 ], "name": "Julian Canisius", "orcid": "0009-0002-4490-8021" }, { "affs": [ 6 ], "name": "Chenyu You", "orcid": "0000-0001-8365-7822" }, { "affs": [ 0 ], "name": "Junde Wu" }, { "affs": [ 0 ], "name": "Jiayuan Zhu", "orcid": "0000-0002-7028-9968" }, { "affs": [ 0 ], "name": "Fenglin Liu", "orcid": "0000-0001-7715-5228" }, { "affs": [ 0 ], "name": "Yuyuan Liu" }, { "affs": [ 2, 3 ], "name": "Niklas Bubeck", "orcid": "0009-0003-9043-3298" }, { "affs": [ 2, 3 ], "name": "Moritz A. Knolle", "orcid": "0000-0002-3065-2363" }, { "affs": [ 7 ], "name": "Chen Chen" }, { "affs": [ 1, 8, 3 ], "name": "Christian Wachinger", "orcid": "0000-0002-3652-1874" }, { "affs": [ 9 ], "name": "Zhenyu Gong", "orcid": "0000-0002-7376-4816" }, { "affs": [ 0 ], "name": "Cheng Ouyang" }, { "affs": [ 2, 3 ], "name": "Georgios A. Kaissis", "orcid": "0000-0001-8382-8062" }, { "affs": [ 10, 1, 3 ], "name": "Benedikt Wiestler", "orcid": "0000-0002-2963-7772" }, { "affs": [ 4, 1, 2, 3 ], "name": "Daniel Rueckert", "orcid": "0000-0002-5683-5889" } ], "bibtex": "https://research.draconitic.com/paper/8cbn21s1bwwfn.bib", "cited_by": 24, "doi": "10.1038/s44360-026-00152-8", "fulltext_url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC13727685/", "id": "8cbn21s1bwwfn", "issns": [ "3005-0693" ], "landing_url": "https://doi.org/10.1038/s44360-026-00152-8", "language": "en", "licence": "CC-BY-4.0", "licence_label": "CC BY 4.0", "licence_source": "article", "licence_url": "https://creativecommons.org/licenses/by/4.0/", "metadata_licence": null, "native_subjects": [ [ "heading", "Article" ], [ "openalex", "2718|Artificial Intelligence in Healthcare and Education" ] ], "openalex": "W7168388434", "pdf_url": "https://www.nature.com/articles/s44360-026-00152-8.pdf", "pmcid": "PMC13727685", "pmid": "42978863", "published": "2026-07-15", "publisher": "Springer Science+Business Media", "ris": "https://research.draconitic.com/paper/8cbn21s1bwwfn.ris", "sources": [ { "first_seen": "2026-11-06T12:23:31Z", "native_id": "PMC13727685", "source": "pmc", "url": "https://doi.org/10.1038/s44360-026-00152-8" }, { "first_seen": "2026-11-07T13:20:57Z", "native_id": "W7168388434", "source": "openalex", "url": "https://doi.org/10.1038/s44360-026-00152-8" } ], "subjects": [ { "field": "medicine", "origin": "openalex:2718|Artificial Intelligence in Healthcare and Education", "subfield": "epidemiology-public-health" } ], "title": "Addressing benchmarking gaps in large language models for health and medicine with dynamic red-teaming", "title_text": "Addressing benchmarking gaps in large language models for health and medicine with dynamic red-teaming", "type": "peer-reviewed", "updated_at": "2026-11-09T13:21:15Z", "url": "https://research.draconitic.com/paper/8cbn21s1bwwfn", "venue": "Nature Health", "versions": [] }