ai-research-survey

scan.json (19267B)

---

 {
   "paper": {
     "title": "Cross-Platform Evaluation of Large Language Model Safety in Pediatric Consultations: Evolution of Adversarial Robustness and the Scale Paradox",
     "authors": ["Vahideh Zolfaghari"],
     "year": 2025,
     "venue": "",
     "doi": ""
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "GitHub repositories provided: https://github.com/vzm1399/PediatricAnxietyBench and https://github.com/vzm1399/PediatricAnxietyBench-CrossPlatform with evaluation, scoring, statistical analysis, and visualization scripts."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "PediatricAnxietyBench dataset (300 queries) and all 900 model responses are released via the GitHub repositories under MIT License."
       },
       "environment_specified": {
         "applies": true,
         "answer": true,
         "justification": "Paper specifies Python 3.10, SciPy v1.11.0, scikit-learn v1.3.0, NumPy v1.24.0, and mentions README files with step-by-step setup instructions including requirements.txt."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": true,
         "justification": "Paper states 'README files in each repository provide step-by-step instructions for setup, execution, and result reproduction.' Code availability section lists specific scripts for each pipeline stage."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": true,
         "justification": "95% confidence intervals computed via bias-corrected and accelerated (BCa) bootstrapping with 10,000 iterations are reported throughout results and figures."
       },
       "significance_tests": {
         "applies": true,
         "answer": true,
         "justification": "Paired t-tests for model comparisons and independent t-tests for adversarial vs non-adversarial subsets, with p-values reported (e.g., p=0.0001, p=0.051)."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Cohen's d reported for all comparisons (e.g., d=0.225 for Llama-3.1-8B vs Llama-3.3-70B, d=0.72 for Mistral adversarial effect, d=1.52 for hedging-safety correlation)."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No power analysis or justification for why 300 queries (or 30 adversarial) were chosen. The limitations section acknowledges n=30 adversarial queries provided limited statistical power but does not justify the original choice."
       },
       "variance_reported": {
         "applies": true,
         "answer": true,
         "justification": "Standard deviations reported (e.g., SD=1.45 vs SD=2.90 for Llama models). Distribution plots and violin plots show variance across models."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Three models compared against each other, and temporal comparison with prior evaluation of earlier model generations on the same benchmark provides a baseline."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": false,
         "justification": "Only three open-source models evaluated (Llama-3.3-70B, Llama-3.1-8B, Mistral-7B). No proprietary frontier models (GPT-4, Claude, Gemini) included. The paper acknowledges this as a limitation but does not compare against the most capable current systems."
       },
       "ablation_study": {
         "applies": false,
         "answer": false,
         "justification": "The paper evaluates existing models as black boxes via APIs; there is no system with components to ablate."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Composite safety score (0-15) plus five sub-dimensions (diagnostic restraint, referral adherence, hedging language, emergency recognition, prescriptive resistance), plus individual metric breakdowns (inappropriate diagnosis rate, referral rate, hedging frequency)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": true,
         "justification": "Clinical expert review of a random sample (n=50) showed 86% agreement with automated scores, validating the automated safety scoring approach."
       },
       "held_out_test_set": {
         "applies": false,
         "answer": false,
         "justification": "No model training or tuning is performed; all queries are used for evaluation of pre-existing models. There is no train/dev/test split needed."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Per-topic breakdowns across 10 clinical categories provided (e.g., seizures, post-vaccination, infant crying), with Figure 5 showing topic-specific safety scores."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Specific failure modes discussed: seizure queries (33% inappropriate diagnosis rate), post-vaccination concerns (elevated safety issues), universal failure in emergency escalation language across all models."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Universal failure in emergency escalation is reported as a critical negative result. Also reports that the adversarial effect for Llama-3.3-70B was borderline non-significant (p=0.051)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims about scale paradox (smaller model outperforming larger), safety score ranges, Cohen's d values, and adversarial robustness reversal are all supported by results in the paper."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses causal language ('challenging assumptions that scale monotonically predicts safety') based on comparing only three models. The scale paradox claim is correlational at best with N=3 model sizes, and confounds scale with architecture, training data, and alignment approach."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "Limitations section explicitly bounds generalization: English-only, U.S. healthcare context, three open-source models, specific system prompt dependency, proxy metrics not actual health outcomes."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Discussion addresses alternative explanations for the scale paradox (version-specific regressions vs inherent scale limitations, alignment quality vs parameter count, compute-optimal training). Limitations discuss temporal confounds in cross-generation comparisons."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Specific model versions given: Llama-3.3-70B-Versatile, Llama-3.1-8B-Instant (via Groq), Mistral-7B-Instruct-v0.2 (via HuggingFace). These are specific version identifiers."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "The standardized system prompt is provided in full in the paper (6-point safety instruction list). Adversarial query generation prompt template referenced in Supplementary Materials."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Generation parameters explicitly stated: temperature=0.7, max_tokens=500, top_p=1.0."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding used; models are queried directly via APIs with a single system prompt and query."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Describes benchmark composition (150 authentic from HealthCareMagic, 150 synthetic adversarial), adversarial generation process, and handling of malformed responses (3 excluded from Llama-3.3-70B, sensitivity analysis performed)."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Dedicated 'Limitations' section spanning approximately 28 lines discussing seven specific limitations."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Specific threats discussed: n=30 adversarial subset limiting statistical power (p=0.051 borderline), rule-based metrics missing 14% of contextually appropriate responses, temporal confounding in cross-generation comparison, prompt engineering dependency."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Explicitly states: English-only queries, U.S. healthcare contexts, three open-source models only, metrics are safety proxies not actual health outcomes, results reflect specific prompt design interaction."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": true,
         "justification": "All 900 model responses, safety scores, and the benchmark queries are released via GitHub repositories."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Describes 150 authentic queries from HealthCareMagic dataset and 150 adversarial queries generated via Claude 3.5 Sonnet with systematic prompt template. API endpoints and platforms specified."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants recruited; the study evaluates LLM outputs on a benchmark dataset."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "Pipeline documented: query generation, API submission across platforms, response collection, automated safety scoring with five sub-dimensions, statistical analysis. Sensitivity analysis for excluded malformed responses also documented."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Funding statement explicitly states: 'This research received no specific grant from any funding agency in the public, commercial, or not-for-profit sectors.'"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliation listed: Medical Sciences Education Research Center, Mashhad University of Medical Sciences. No conflict with evaluated products (open-source models via third-party APIs)."
       },
       "funder_independent_of_outcome": {
         "applies": false,
         "answer": false,
         "justification": "Research is explicitly unfunded per the funding statement."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement found in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "No training data cutoff dates stated for any of the three models evaluated. This matters because PediatricAnxietyBench queries could appear in training data."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether benchmark queries (especially the 150 from HealthCareMagic) could have appeared in model training data."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "HealthCareMagic is a public dataset; the authentic queries could plausibly be in training corpora of the evaluated models. This contamination risk is not discussed."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants; the study evaluates LLM outputs on a benchmark."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Ethics statement notes IRB exemption since no human subjects were involved."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference costs, API costs, or latency reported despite using production APIs (Groq, HuggingFace). The paper discusses practical deployment implications but does not quantify evaluation costs."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget, hardware, or wall-clock time reported for the 900 API calls."
       }
     }
   },
   "claims": [
     {
       "claim": "Smaller Llama-3.1-8B (8B parameters) significantly outperformed larger Llama-3.3-70B (70B parameters) on safety by +0.66 points (p=0.0001, Cohen's d=0.225)",
       "evidence": "Results section reports paired t-test with p=0.0001, Cohen's d=0.225, mean scores 10.36 vs 9.70.",
       "supported": "strong"
     },
     {
       "claim": "Adversarial queries elicited higher safety scores than neutral queries (reversal of prior findings), with Mistral-7B showing the strongest effect (Cohen's d=0.72)",
       "evidence": "Results section with paired comparisons, 95% CIs, and p-values. Mistral significant (p=0.0002), Llama-3.1-8B significant, Llama-3.3-70B borderline (p=0.051).",
       "supported": "moderate"
     },
     {
       "claim": "84% improvement in baseline safety and complete reversal of adversarial vulnerability compared to prior model generations",
       "evidence": "Temporal comparison with prior evaluation using same benchmark. However, temporal confounds acknowledged (different infrastructure, scorer implementation).",
       "supported": "moderate"
     },
     {
       "claim": "No model produced explicit emergency escalation language for potentially life-threatening scenarios",
       "evidence": "Universal failure documented across all three models and both evaluations (prior and current).",
       "supported": "strong"
     },
     {
       "claim": "Strong positive correlation between hedging language frequency and overall safety scores (r=0.89, p<0.001, Cohen's d=1.52)",
       "evidence": "Regression analysis with 95% CI shown in Figure 4, with statistical test results.",
       "supported": "strong"
     }
   ],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "Smaller, well-aligned LLMs (Llama-3.1-8B, Mistral-7B) outperformed a larger model (Llama-3.3-70B) on pediatric consultation safety, challenging the assumption that scale monotonically predicts safety. Adversarial parental anxiety queries paradoxically elicited safer responses than neutral queries in current model generations, reversing findings from prior evaluations. Despite overall safety improvements, all models universally failed to produce explicit emergency escalation language for potentially life-threatening scenarios, representing a persistent critical gap.",
   "red_flags": [
     {
       "flag": "Benchmark contamination risk unaddressed",
       "detail": "HealthCareMagic is a public dataset; 150 authentic queries could appear in model training data. No contamination analysis performed despite this being a benchmark evaluation."
     },
     {
       "flag": "Scale paradox claim from N=3 models",
       "detail": "The 'scale paradox' (smaller models safer than larger) is based on comparing only three models that differ in architecture, training data, and alignment approach, not just scale. The claim is correlational but framed as challenging a general assumption."
     },
     {
       "flag": "Single-author automated evaluation",
       "detail": "Safety scoring is entirely rule-based by a single author. While clinical expert validation (n=50, 86% agreement) is mentioned, the expert review details are thin and no inter-rater reliability metrics are provided for the expert validation itself."
     }
   ],
   "cited_papers": [
     {
       "title": "Adversarial Prompt Detection in Large Language Models: A Comprehensive Survey",
       "authors": ["Ergun AE", "Onan A"],
       "year": 2025,
       "relevance": "Survey on adversarial prompt detection methods for LLMs, directly relevant to LLM safety evaluation."
     },
     {
       "title": "Chain-of-thought prompting elicits reasoning in large language models",
       "authors": ["Wei J", "Wang X", "Schuurmans D"],
       "year": 2022,
       "relevance": "Foundational prompting technique paper relevant to LLM capability evaluation."
     },
     {
       "title": "How medical AI devices are evaluated: limitations and recommendations from an analysis of FDA approvals",
       "authors": ["Wu E", "Wu K", "Daneshjou R"],
       "year": 2021,
       "relevance": "Analysis of AI evaluation limitations relevant to methodological quality assessment of AI systems."
     },
     {
       "title": "Training compute-optimal large language models",
       "authors": ["Hoffmann J"],
       "year": 2022,
       "relevance": "Chinchilla scaling laws paper, relevant to understanding compute-optimal training and the scale-safety relationship."
     },
     {
       "title": "Towards Monosemanticity: Decomposing Language Models With Dictionary Learning",
       "authors": ["Bricken T"],
       "year": 2023,
       "relevance": "Mechanistic interpretability work relevant to understanding LLM internal safety representations."
     },
     {
       "title": "Med-PaLM 2",
       "authors": ["Singhal K"],
       "year": 2023,
       "relevance": "Medical LLM evaluation demonstrating that model scale alone does not guarantee clinical safety."
     }
   ]
 }