TLDR: A new study introduces MedQA-Followup, a framework to evaluate medical large language models (LLMs) in realistic multi-turn conversations. It finds that while LLMs are somewhat robust to initial misleading information (shallow robustness), they exhibit severe vulnerabilities when challenged in follow-up turns (deep robustness), with accuracy dropping significantly. Indirect context-based interventions are often more damaging than direct suggestions. The research highlights that current medical LLMs are not yet reliable for complex clinical dialogues and require further development for safe deployment.
Large language models (LLMs) are quickly becoming a part of medical practice, but how reliable they are in real-world, multi-turn conversations is not well understood. Most current evaluation methods only look at single questions under ideal conditions, ignoring the complexities of medical consultations where conflicting information, misleading context, and authority figures often influence discussions.
Researchers have introduced MedQA-Followup, a new framework designed to systematically evaluate how robust medical LLMs are in multi-turn question-answering scenarios. This framework differentiates between ‘shallow robustness’ – a model’s ability to resist misleading initial context – and ‘deep robustness’ – its capacity to maintain accuracy when its answers are challenged across multiple turns. It also explores whether interventions are ‘indirect’ (contextual framing) or ‘direct’ (explicit suggestions).
Using controlled tests on the MedQA dataset, the team evaluated five state-of-the-art LLMs. They found that while models performed reasonably well when faced with minor initial disruptions, they showed significant vulnerabilities in multi-turn settings. For instance, Claude Sonnet 4’s accuracy plummeted from 91.2% to as low as 13.5% under certain multi-turn challenges. Surprisingly, indirect, context-based interventions often proved more damaging than direct suggestions, causing larger accuracy drops across models and highlighting a major risk for clinical deployment.
The study also revealed differences among models. Some models experienced further performance drops with repeated interventions, while others partially recovered or even improved. These findings underscore that multi-turn robustness is a crucial yet underexplored aspect for the safe and reliable deployment of medical LLMs. The dataset and code for this research are publicly available on HuggingFace and GitHub. For more details, you can read the full paper: Shallow Robustness, Deep Vulnerabilities: Multi-Turn Evaluation of Medical LLMs.
Understanding the Interventions
The framework categorizes interventions into four types:
- Neutral re-evaluation (rethink): Prompts that encourage the model to re-evaluate its answer without biasing it towards a specific alternative. This acts as a control to see if re-evaluation alone affects accuracy.
- Plausible wrong options (wrong_op): Replacing incorrect multiple-choice options with more plausible ones to mislead the model. This is primarily a single-turn intervention.
- Context manipulation (context): Introducing additional context, framed as background information or from another source, that implicitly supports an incorrect option or casts doubt on the correct one.
- Wrong suggestion (inc_letter): Explicitly attempting to sway the model towards an incorrect answer, often by using appeals to authority or social influence.
Key Findings
The research showed that single-turn interventions had only a modest impact on model performance. However, in multi-turn settings, robustness issues became much more significant. While neutral re-evaluation interventions caused little change, misleading or biased information in follow-up turns led to substantial accuracy drops. Context interventions, in particular, caused dramatic performance degradation across all models, with some experiencing over 30% drops from their baseline accuracy.
Interestingly, indirect context manipulations were often more detrimental than direct suggestions, even though they didn’t explicitly push for an incorrect answer. The study also found that clinical application questions (Steps 2&3 of the USMLE) were consistently more vulnerable than basic science questions (Step 1). The ‘Social Sciences (Ethics/Communication/Patient Safety)’ domain was the most fragile, while ‘Biostatistics & Epidemiology/Population Health’ showed the greatest resilience.
Regarding the length of misleading context, longer passages generally amplified performance degradation for GPT-4.1 and MedGemma 27B. Claude Sonnet 4, however, showed diminishing returns and even recovered accuracy with increasing lengths for certain context types, suggesting it might discount longer, less relevant passages.
When multiple interventions were compounded, the effects were complex. Most combinations showed ‘sub-additive’ behavior, meaning the combined effect was less severe than simply adding up the individual degradations. This suggests that the fragility of LLMs to stacked interventions might have natural limits, with MedGemma 4B even showing recovery from earlier losses.
Also Read:
- MedKGEval: A New Framework for Evaluating Clinical LLMs in Multi-Turn Patient Interactions
- Evaluating AI’s Clinical Judgment: A New Benchmark for Sequential Reasoning
Implications for Medical AI
These findings highlight a critical gap between ‘shallow’ and ‘deep’ robustness in medical AI. While models might handle initial prompts well, their ability to maintain correct reasoning through complex, interactive dialogues is severely lacking. The study emphasizes the urgent need for robust evaluation frameworks before medical LLMs are widely adopted in clinical settings. Future work should focus on adversarial training, developing confidence-weighted resistance to prevent models from abandoning correct answers, and implementing safeguards like flagging significant answer shifts for human review. For deployment, clinicians should have transparent access to retrieved evidence rather than relying solely on model-interpreted summaries, and multi-turn evaluation with careful human oversight must become standard practice alongside traditional accuracy benchmarks.
