Evaluating Counterfactual Sensitivity to Patient Information in Medication-Safety Reasoning

# Evaluating Counterfactual Sensitivity to Patient Information in Medication-Safety Reasoning
Source: [https://arxiv.org/html/2608.03028](https://arxiv.org/html/2608.03028)
Zhitian Hou1, 2, Yuhang Liu1, 2, Pengkai Wang1, Zeyu Liu1, Guanghao Zhu1, Zheng Liu1, 2, Shuo Cai1, Congkai Xie2, Zhijie Sang2, Kun Zeng3, Hongxia Yang1, 2\\corresponding

###### Abstract

Applying a valid medication\-safety rule when its patient\-specific conditions are not met can produce an incorrect decision\. Existing medical evaluations largely use isolated and fixed scenarios\. A model may therefore answer correctly by recalling a drug\-risk association without showing that it used patient information to decide whether the rule applies\. To address this gap, we introduce MedPIC\-Bench, a benchmark of source\-verifiable recommendations and expert\-validated questions for patient\-specific medication\-safety reasoning\. It combines guideline\-following questions with paired counterfactual questions in which a controlled change in patient information changes whether a rule applies\. The benchmark contains 467 questions annotated along six clinical and reasoning dimensions\. Across 28 medical\-specific, general, and proprietary LLMs, every model performs worse on counterfactual questions, with mean accuracy falling from 63\.6% to 45\.1%\. Models perform well when an explicit patient attribute directly signals a familiar contraindication, but struggle when patient information must narrow or withdraw a safety warning\. Model rationales often acknowledge the changed patient information, yet the final answers retain the previous safety judgment\. This vulnerability persists among medical\-specific LLMs, whose average CF performance trails that of general LLMs\. MedPIC\-Bench therefore makes conditional rule application measurable and highlights the limitations of static medication\-safety accuracy for assessing patient\-specific reliability\.

## 1Introduction

![Refer to caption](https://arxiv.org/html/2608.03028v1/x1.png)Figure 1:Two paired counterfactual examples from MedPIC\-Bench\. A change in patient information reverses whether the safety rule applies, yet strong models often retain the original risk judgment\.Large language models \(LLMs\) are increasingly evaluated for medical decision\-making\. Existing benchmarks range from broad medical QA settings such as MultiMedQA\(Singhalet al\.[2023](https://arxiv.org/html/2608.03028#bib.bib1)\)and Med\-PaLM\(Singhalet al\.[2025](https://arxiv.org/html/2608.03028#bib.bib2)\)to open\-ended clinical assessment frameworks\(Aroraet al\.[2025](https://arxiv.org/html/2608.03028#bib.bib3)\)\. However, most medical benchmarks use fixed patient scenarios\. They test whether a model can identify a risky medication in a given case, but not whether it revises that judgment when relevant patient information changes\. In real prescribing, one variable, such as age, syndrome subtype, or comorbidity, can change the appropriate judgment\. A model can therefore succeed on a static question while failing to revise its answer when that variable changes, as illustrated in Figure[1](https://arxiv.org/html/2608.03028#S1.F1)\.

This distinction matters because medication\-safety rules are conditional\. A drug may be inappropriate within a specific age range, below a renal threshold, or in the presence of a particular clinical condition\. If evaluation presents only one fixed scenario, strong performance may reflect a memorized drug\-risk association rather than correct use of the condition that makes the rule applicable\. Recent benchmarks have moved beyond exam\-style medical QA\. MedGuide\(Liet al\.[2025](https://arxiv.org/html/2608.03028#bib.bib5)\)evaluates guideline\-based clinical decisions, RxSafeBench\(Zhaoet al\.[2025a](https://arxiv.org/html/2608.03028#bib.bib9)\)tests medication hazards in simulated consultations, and MedEinst\(Chenet al\.[2026b](https://arxiv.org/html/2608.03028#bib.bib13)\)probes diagnostic fixation through paired changes in clinical evidence\. However, they do not test whether models revise their medication\-safety judgments when patient information changes whether the underlying rule applies\.

MedPIC\-Bench addresses this gap through source\-verifiable recommendations and expert\-validated questions for patient\-specific medication\-safety reasoning\. It combinesguideline\-following \(GF\)questions with pairedcounterfactual \(CF\)questions\. GF questions test whether a model follows the applicable medication\-safety recommendation in a fixed patient case\. In each CF pair, a controlled change in patient information changes whether the underlying rule applies, while the remaining case details and answer options are kept fixed whenever possible\. MedPIC\-Bench contains 467 questions spanning 9 organ systems, 11 clinical departments, 66 drug categories, 8 patient\-information types, 3 special populations, and 5 reasoning operations, enabling fine\-grained analysis of where models fail\.

Across 28 medical\-specific, general, and proprietary LLMs, mean accuracy falls from 63\.6% on GF questions to 45\.1% on CF questions, with every model declining\. Paired analysis shows that the deficit is not limited to recalling medication risks\. Models frequently preserve a risk judgment after the patient information that triggered it has been removed, even when their rationales acknowledge the change\. A within\-family comparison indicates that medical adaptation can improve absolute accuracy, but the persistent deactivation gap shows that it does not resolve the underlying failure\. These results expose a gap between recognizing a medication risk and controlling whether that risk applies to the patient at hand\.

Our main contributions are as follows\.

- •We frame counterfactual sensitivity to patient information as a distinct requirement for medication\-safety reasoning\. Within this framing, we identify a recurring failure pattern in which models recognize relevant patient information but fail to let it constrain or withdraw a familiar drug\-risk judgment\.
- •We introduceMedRule2Pair, a source\-grounded construction pipeline that transforms heterogeneous clinical recommendations into verified, traceable rules and controlled GF and CF question variants, supporting reproducible evaluation and expansion\.
- •We instantiate this pipeline asMedPIC\-Bench, an expert\-validated benchmark of 467 questions annotated along six dimensions\. Across 28 evaluated models, every model declines from GF to CF\. Medical\-specific LLMs also do not outperform general LLMs on average, achieving a mean CF accuracy of 38\.3%, compared with 45\.5% for general LLMs\.

## 2Related Work

Medical LLM and guideline\-based evaluation\.Medical LLM evaluation has expanded from exam\-style question answering to broader assessments of clinical response quality and decision\-making\. MultiMedQA\(Singhalet al\.[2023](https://arxiv.org/html/2608.03028#bib.bib1)\)and the Med\-PaLM studies\(Singhalet al\.[2025](https://arxiv.org/html/2608.03028#bib.bib2)\)evaluate medical knowledge and reasoning across multiple question\-answering settings, while HealthBench\(Aroraet al\.[2025](https://arxiv.org/html/2608.03028#bib.bib3)\)evaluates open\-ended responses to realistic health conversations\. MultifacetEval\(Zhouet al\.[2024](https://arxiv.org/html/2608.03028#bib.bib4)\)probes medical knowledge from several complementary perspectives, and MedGuide\(Liet al\.[2025](https://arxiv.org/html/2608.03028#bib.bib5)\)evaluates clinical decisions against guideline\-derived criteria\. MedGuideX\(Shenet al\.[2026](https://arxiv.org/html/2608.03028#bib.bib6)\)goes further by transforming executable guideline logic into factual and counterfactual supervision for model post\-training\. These efforts broaden medical evaluation and guideline\-based reasoning, but they do not provide a dedicated benchmark for measuring whether source\-grounded medication\-safety rules are applied and withdrawn appropriately across controlled patient cases\.

Medication\-safety and prescribing benchmarks\.Recent benchmarks have begun to evaluate medication use more directly\. Rx\-LLM\(Zhaoet al\.[2025b](https://arxiv.org/html/2608.03028#bib.bib8)\)introduces clinician\-annotated tasks covering medication knowledge and safety\-critical pharmacy operations\. RxSafeBench\(Zhaoet al\.[2025a](https://arxiv.org/html/2608.03028#bib.bib9)\)embeds contraindications and drug interactions in simulated consultation scenarios to test safe medication selection, while RxEval\(Chenet al\.[2026a](https://arxiv.org/html/2608.03028#bib.bib10)\)presents detailed patient profiles and longitudinal clinical trajectories for prescription\-level medication recommendation\. These efforts move beyond generic medical QA and show that models can struggle to integrate medication knowledge with patient information\. Their evaluation units, however, remain individual tasks, consultations, or prescriptions\. Consequently, a correct response does not by itself establish whether the relevant patient information governed the decision\.

Counterfactual evaluation in clinical reasoning\.CounterBench\(Chenet al\.[2026c](https://arxiv.org/html/2608.03028#bib.bib7)\)evaluates formal counterfactual reasoning over synthetic causal structures\. In medicine, MediEval\(Qu and Färber[2026](https://arxiv.org/html/2608.03028#bib.bib14)\)jointly tests knowledge grounding and contextual consistency using factual and counterfactual statements linked to patient records\. Counterfactual Patient Variations\(Benkiraneet al\.[2025](https://arxiv.org/html/2608.03028#bib.bib11)\)and MEDEQUALQA\(Ghoshet al\.[2025](https://arxiv.org/html/2608.03028#bib.bib12)\)use controlled demographic changes to audit bias and reasoning stability, whereas MedEinst\(Chenet al\.[2026b](https://arxiv.org/html/2608.03028#bib.bib13)\)changes discriminative evidence across paired cases to expose diagnostic fixation\. MedPIC\-Bench instead asks whether models update medication\-safety judgments when patient information changes the applicability of a verified prescribing rule\. By combining guideline\-following evaluation with controlled counterfactual pairs, it measures both rule application in individual cases and whether decisions change in the correct direction across matched cases\.

## 3MedPIC\-Bench Construction

MedPIC\-Bench is built around two design requirements\. First, every answer must be traceable to a verified medication\-safety recommendation\. Second, each counterfactual comparison must isolate a targeted change in patient information\. We implement these requirements through MedRule2Pair, a two\-stage construction pipeline shown in Figure[2](https://arxiv.org/html/2608.03028#S3.F2)\. Source recommendations are first converted into structured rules and manually verified, and the verified rules are then used for question generation and expert validation\.

![Refer to caption](https://arxiv.org/html/2608.03028v1/x2.png)Figure 2:Overview of MedRule2Pair, our two\-stage pipeline for constructing source\-grounded medication\-safety questions\. First, recommendations collected from authoritative sources yield raw rules linked to explicit patient information\. Second, these rules are structured, manually verified against their sources, and used to generate GF questions with fixed patient information and CF questions with controlled changes, followed by expert validation\. The pipeline preserves source traceability while isolating the information that changes whether a rule applies\.### 3\.1Evidence Collection and Raw Rules

We compile medication\-safety recommendations from authoritative resources, including the American Geriatrics Society Beers Criteria\(2023 AGS Beers Criteria Update Expert Panel[2023](https://arxiv.org/html/2608.03028#bib.bib16)\), the Pregnancy and Lactation Labeling Rule \(PLLR\)111https://www\.fda\.gov/drugs/labeling\-information\-drug\-products/pregnancy\-and\-lactation\-labeling\-drugs\-final\-rule, the Australian Therapeutic Goods Administration \(TGA\) Prescribing Medicines in Pregnancy Database222https://www\.tga\.gov\.au/resources/health\-professional\-information\-and\-resources/australian\-categorisation\-system\-prescribing\-medicines\-pregnancy/prescribing\-medicines\-pregnancy\-database, and the 2025 KIDs List\(McPhersonet al\.[2025](https://arxiv.org/html/2608.03028#bib.bib17)\)\. From these sources, we retain recommendations that state a verifiable medication\-safety decision and make its applicability depend on explicit patient information, such as kidney function, concomitant medication use, age, or pregnancy status\.

### 3\.2Rule Structuring and Question Generation

![Refer to caption](https://arxiv.org/html/2608.03028v1/x3.png)Figure 3:Distribution of MedPIC\-Bench questions across six annotation dimensions\. The benchmark spans 9 organ systems, 11 clinical departments, 66 drug categories, 8 patient\-information types, 3 special populations, and 5 reasoning operations\. Percentages indicate the share of questions in each category\.BenchmarkRulegroundingControlledPI changeAnswer\-changingpairsFull expertvalidationMedGUIDE\(Liet al\.[2025](https://arxiv.org/html/2608.03028#bib.bib5)\)✓\\checkmark×\\times×\\times△\\triangleRxSafeBench\(Zhaoet al\.[2025a](https://arxiv.org/html/2608.03028#bib.bib9)\)✓\\checkmark×\\times×\\times×\\timesPsiBench\(Proulxet al\.[2026](https://arxiv.org/html/2608.03028#bib.bib15)\)✓\\checkmark×\\times×\\times✓\\checkmarkMediEval\(Qu and Färber[2026](https://arxiv.org/html/2608.03028#bib.bib14)\)×\\times×\\times×\\times△\\triangleMEDEQUALQA\(Ghoshet al\.[2025](https://arxiv.org/html/2608.03028#bib.bib12)\)×\\times✓\\checkmark×\\times×\\timesMedEinst\(Chenet al\.[2026b](https://arxiv.org/html/2608.03028#bib.bib13)\)×\\times✓\\checkmark✓\\checkmark△\\triangleMedPIC\-Bench✓\\checkmark✓\\checkmark✓\\checkmark✓\\checkmarkTable 1:Comparison of MedPIC\-Bench with representative medical benchmarks\. A checkmark, cross, and triangle indicate full support, no support, and partial support, respectively\. PI denotes patient information\. Rule grounding indicates that gold decisions are derived from explicit clinical guidelines or medication\-safety rules\. Answer\-changing pairs are linked cases in which the gold answer changes\. Full expert validation indicates item\-level review of the complete benchmark; partial validation denotes subset or indirect review\.We transform the collected recommendations into a common rule schema that records the medication or class, target population, relevant patient information, recommended action, and applicable exceptions\. Candidate rule fields are first drafted with LLM assistance from source tables, PDFs, and natural\-language recommendations\. Each draft is then verified field by field against its original source and finalized manually\. The finalized records preserve the action specified by each source recommendation, such as avoiding a medication or combination, adjusting a dose, or selecting an alternative treatment\. This process provides a source\-traceable ground truth for each generated question\.

We use deterministic generation scripts to construct questions from the verified rules\. The clinical setting and question wording vary across items to reflect the source recommendation and decision type, while the rule\-relevant patient information and ground truth remain controlled\. Each item comprises a patient vignette, a medication\-safety question, and a set of answer options\. Distractors are selected from other medications in the source tables or from commonly used medications that do not trigger the target rule in the stated context\. A “None of the above” option is included when appropriate\.

GF questions present a fixed patient case and ask which recommendation applies\. They cover medication avoidance, interaction checking, renal dose adjustment, and treatment\-selection decisions\. CF questions are generated from the same rule representation but change targeted patient information, such as age, pregnancy status, kidney function, disease presence, or an indication\-specific exception\. Within each linked comparison, the medication candidates and question are held fixed, while non\-target clinical details are preserved whenever possible\. The correct answer may therefore change from one or more medications to “None of the above,” or from one medication set to another\.

All generated questions undergo expert validation against the verified rules\. Experts follow a shared protocol that assesses source alignment, the correctness of patient information, the completeness of the ground\-truth answers, the validity of the distractors, and the consistency of each counterfactual comparison\. Questions that fail any criterion are excluded, including ambiguous items, counterfactual comparisons that do not produce a valid contrast, and questions that remain unresolved after expert discussion\. Initial inter\-reviewer agreement on item validity was 85\.3%\. After processing, MedPIC\-Bench contains 467 questions, comprising 284 GF and 183 CF questions\. To support fine\-grained analysis, each question is annotated by organ system, clinical department, drug category, special population, patient\-information type, and reasoning operation, as shown in Figure[3](https://arxiv.org/html/2608.03028#S3.F3)\. Initial labels are derived from the structured rules and source metadata and then manually reviewed\. Table[1](https://arxiv.org/html/2608.03028#S3.T1)further situates MedPIC\-Bench among representative medical benchmarks by comparing their source grounding, counterfactual design, and expert validation\.

## 4Experiments

Table 2:Performance of 28 models on the MedPIC\-Bench\. Arrows indicate the direction of better performance\.ΔGF−CF\\Delta\_\{\\mathrm\{GF\-CF\}\}is the GF\-minus\-CF accuracy gap\. Activation and Deactivation are computed over the corresponding reasoning operations, and Pair is the percentage of all linked counterfactual pairs for which both cases are answered correctly\. For performance metrics other than the GF–CF gap, best and second\-best results are shown in bold and underlined, respectively\.### 4\.1Experimental Setup

Evaluation Models\.We evaluate 28 models spanning medical\-specific, general, and proprietary LLMs\. The 12 medical\-specific models comprise HealthGPT\-Pro \(4B and 8B\)\(Linet al\.[2025](https://arxiv.org/html/2608.03028#bib.bib21)\), MedGemma \(4B and 27B\-Text\)\(Sellergrenet al\.[2025](https://arxiv.org/html/2608.03028#bib.bib22)\), Lingshu \(7B and 32B\)\(Xuet al\.[2025](https://arxiv.org/html/2608.03028#bib.bib23)\), Hulu\-Med\-7B\(Jianget al\.[2025](https://arxiv.org/html/2608.03028#bib.bib24)\), HuatuoGPT\-o1 \(8B and 70B\)\(Zhanget al\.[2023](https://arxiv.org/html/2608.03028#bib.bib25)\), Fleming\-R1 \(7B and 32B\)\(Liuet al\.[2026](https://arxiv.org/html/2608.03028#bib.bib26)\), and Baichuan\-M2\-32B\(Douet al\.[2025](https://arxiv.org/html/2608.03028#bib.bib27)\)\. The 9 general models comprise Gemma\-3 \(12B and 27B\)\(Teamet al\.[2025](https://arxiv.org/html/2608.03028#bib.bib28)\), Llama\-3\.1 \(8B and 70B\)\(Grattafioriet al\.[2024](https://arxiv.org/html/2608.03028#bib.bib29)\), GPT\-OSS \(20B and 120B\)\(Agarwalet al\.[2025](https://arxiv.org/html/2608.03028#bib.bib30)\), and Qwen3\.5 \(9B, 27B, and 35B\-A3B\)\(Team[2026](https://arxiv.org/html/2608.03028#bib.bib31)\)\. We additionally evaluate 7 proprietary models: Gemini\-2\.5\-Pro\(Comaniciet al\.[2025](https://arxiv.org/html/2608.03028#bib.bib32)\), Gemini\-3\.1\-Pro333https://deepmind\.google/models/gemini/pro/, Claude\-Sonnet\-4\.6444https://www\.anthropic\.com/news/claude\-sonnet\-4\-6, GPT\-5\(Singhet al\.[2025](https://arxiv.org/html/2608.03028#bib.bib33)\), GPT\-5\.2\(Singhet al\.[2025](https://arxiv.org/html/2608.03028#bib.bib33)\), DeepSeek\-V4\-Pro\(Xuet al\.[2026](https://arxiv.org/html/2608.03028#bib.bib34)\), and Qwen3\.5\-Plus\(Team[2026](https://arxiv.org/html/2608.03028#bib.bib31)\)\. The evaluated models include both text\-only and multimodal architectures, all of which receive the same inputs\.

Evaluation Metrics\.We use question\-level exact\-match accuracy, counting a prediction as correct only when its selected option set exactly matches the ground truth\. We report overall, GF, and CF accuracy, together with the GF–CF gap, defined asAccGF−AccCF\\mathrm\{Acc\}\_\{\\mathrm\{GF\}\}\-\\mathrm\{Acc\}\_\{\\mathrm\{CF\}\}\. For CF questions, we additionally report accuracy on risk activation and risk deactivation, as well as pair accuracy over the 89 linked pairs\. A pair is correct only when both of its questions are answered correctly\. To quantify statistical uncertainty, we report 95% cluster\-bootstrap confidence intervals for the principal aggregate results in theUncertainty Estimationsection of the supplementary material\.

Experiment Details\.Each model answers every question independently in a zero\-shot setting\. Members of a CF pair are presented separately without revealing their connection\. All models receive the same prompt, which requests a brief rationale followed by the selected option letter or letters in a designated answer field\. Open\-source inference is conducted on a Linux system with two NVIDIA A800 GPUs, each with 80 GB of memory\. We use PyTorch\(Paszkeet al\.[2019](https://arxiv.org/html/2608.03028#bib.bib18)\), Hugging Face Transformers\(Wolfet al\.[2020](https://arxiv.org/html/2608.03028#bib.bib19)\), and SGLang\(Zhenget al\.[2024](https://arxiv.org/html/2608.03028#bib.bib20)\)for open\-source models, whereas proprietary models are queried through APIs\. Further details, including the complete prompt and model\-specific inference configurations, are provided in theDetailed Experimental Setupsection of the supplementary material\.

![Refer to caption](https://arxiv.org/html/2608.03028v1/x4.png)Figure 4:Fine\-grained analysis of counterfactual performance\. \(a\) Activation and deactivation accuracy for individual models \(thin lines\) and model\-group means \(thick lines\)\. \(b\) Joint outcomes across 67 matched activation–deactivation pairs, aggregated over all model–pair evaluations within each group\. “Trigger only” and “Control only” indicate that only the rule\-triggering or rule\-inactive member is answered correctly, respectively\. \(c\) Model\-level CF accuracy across six patient\-information types, with black diamonds indicating the corresponding means\. Gestational\-week thresholds occur only in GF questions, while the pediatric–adult contraindication contrast contains only four CF questions and is excluded from the distributional comparison\.
### 4\.2Main Results

Guideline\-following performance consistently exceeds counterfactual performance\.Table[2](https://arxiv.org/html/2608.03028#S4.T2)reports the complete results for all 28 models\. Mean accuracy falls from 63\.6% on GF questions to 45\.1% on CF questions, and every model declines\. The 18\.5\-point gap remains positive under cluster bootstrap \(95% CI \[12\.6, 24\.0\] points\), showing that the aggregate decline is stable to resampling of question clusters\. Together with the model\-wise decline, this indicates that the deficit is not confined to a small subset of models or rule clusters\. Fixed\-case accuracy therefore does not fully reflect model performance when the same knowledge must be applied conditionally as patient information changes\. Mean pair accuracy is only 20\.0%\. Because pair accuracy requires both linked cases to be answered correctly, it distinguishes consistent conditional application from isolated success on one member of a comparison\. A small GF–CF gap does not necessarily indicate robustness because it can also result from low accuracy on both task families\. Even Gemini\-3\.1\-Pro, the strongest CF model, solves only 48\.3% of linked pairs\. Conversely, HealthGPT\-Pro\-4B has the smallest GF–CF gap but low CF and pair accuracy\. These contrasting profiles show why the GF–CF gap must be interpreted jointly with absolute CF and pair performance\. Inspection of the pairs solved by Gemini\-3\.1\-Pro suggests that its advantage comes from explicitly binding each judgment to the rule’s applicability conditions, rather than retaining familiar drug warnings\.

Models activate medication\-safety rules more reliably than they withdraw them\.Across the 28 models, mean accuracy falls from 57\.7% on activation to 37\.1% on deactivation, with 25 models exhibiting this asymmetry\. Figure[4](https://arxiv.org/html/2608.03028#S4.F4)\(a\) shows that the pattern holds across all three model groups rather than being driven by one class of models\. Figure[4](https://arxiv.org/html/2608.03028#S4.F4)\(b\) further separates the joint outcomes of matched comparisons\. Trigger\-only outcomes, in which only the rule\-active case is answered correctly, are more than twice as frequent as control\-only outcomes in every group\. Because the paired cases differ through a controlled change in patient information, this imbalance reflects a directional difficulty in withdrawing a warning rather than generic question difficulty alone\. Models therefore preserve medication warnings more reliably than they retract them\. The response analysis below examines why this asymmetry persists even when changed patient information is recognized\.

Medical specialization improves performance but does not resolve counterfactual failures\.Medical\-specific LLMs average 38\.3% on CF questions, compared with 45\.5% for general LLMs and 56\.2% for proprietary LLMs\. Pair accuracy follows the same ordering at 13\.8%, 19\.2%, and 31\.8%, respectively\. These group\-level comparisons conflate model scale, architecture, and training data, but MedGemma\-27B and Gemma\-3\-27B provide a closer within\-family comparison\. MedGemma raises CF accuracy from 33\.3% to 51\.4% and pair accuracy from 5\.6% to 23\.6%, indicating that medical adaptation can yield substantial gains\. Yet its activation accuracy reaches 76\.1% while deactivation remains at 32\.4%\. Medical adaptation therefore improves absolute performance without correcting the central asymmetry\. Representative errors further suggest that the remaining deficit is not simply a lack of medical knowledge\. Medical\-specific models often preserve a medically plausible risk while broadening its threshold, overlooking an indication\-specific exception, strengthening the recommended action, or applying a class\-level warning inconsistently\. Specialization may reinforce familiar drug\-risk associations without ensuring control over a rule’s threshold, exceptions, action strength, or drug\-class scope\.

### 4\.3Sensitivity across Dimensions

Figure[4](https://arxiv.org/html/2608.03028#S4.F4)\(c\) shows substantial variation across patient\-information types\. Mean CF accuracy ranges from 30\.0% for condition\-triggered rules to 84\.5% for pregnancy status\. Composite clinical contexts \(37\.7%\) and drug interactions \(39\.1%\) are also difficult, while age thresholds \(46\.8%\) and renal or dose thresholds \(51\.5%\) fall between these extremes\. Table[3](https://arxiv.org/html/2608.03028#S4.T3)shows a consistent gap between departments, with obstetrics and gynecology performing best and neurology and cardiology proving most difficult\. Rationale analysis provides a common explanation for both patterns\. Models are most reliable when an explicit patient attribute maps directly to a familiar contraindication, as in many pregnancy questions\. They struggle when patient information must delimit the scope or strength of a broader safety rule, or deactivate it entirely\. The central difficulty therefore lies not in recalling drug risks, but in controlling when and how those risks apply\. Results for the remaining dimensions are reported in theFull Analysis across Dimensionssection of the supplementary material\.

Table 3:Mean CF accuracy \(%\) by model group for clinical departments containing at least 20 CF questions\.
### 4\.4Rule\-Deactivation Failure Analysis

![Refer to caption](https://arxiv.org/html/2608.03028v1/x5.png)Figure 5:A representative rule\-deactivation failure by Lingshu\-32B\. The model initially identifies the rule\-consistent answer but then reverts to a broader concern about tramadol accumulation\.To distinguish failures of context recognition from failures of rule application, we analyze model responses to incorrect deactivation questions\. Models mention the changed patient information in 85\.6% of these responses, yet retain the same medication selection in 69\.8%\. Figure[5](https://arxiv.org/html/2608.03028#S4.F5)illustrates a clear instance of this disconnect, in which a correct intermediate judgment is overridden before the final answer\.

Lingshu\-32B recognizes the patient’s CrCl of 52 mL/min and explicitly identifies “None of the above” as correct\. Yet its final reasoning falls back on a generic concern about tramadol accumulation in renal impairment, extending the verified<30<30mL/min rule to this patient\. The model therefore uses the relevant patient information and reaches a rule\-consistent judgment, but allows a broader drug\-risk prior to override it before the final answer\. This example reflects a broader pattern in which models acknowledge changed patient information without allowing it to govern the final judgment\. Reducing such failures may require models to bind each safety judgment to its triggering condition and recheck that condition before producing the final answer\.

## 5Conclusion

Using MedRule2Pair, our source\-grounded construction pipeline, we created MedPIC\-Bench to test whether LLMs apply medication\-safety recommendations within their intended patient scope\. Its guideline\-following questions measure rule application in fixed cases, while controlled counterfactual pairs test whether judgments change when patient information alters rule applicability\. Across 28 LLMs, performance on static questions consistently overstates counterfactual performance\. Models activate safety rules more reliably than they withdraw them and frequently preserve medication warnings even after acknowledging that the triggering condition is absent\. Medical\-specific LLMs offer no consistent robustness advantage, and errors are most pronounced when patient information must constrain, weaken, or deactivate a familiar drug\-risk association\. These results identify control over rule applicability, rather than risk recall alone, as a central weakness in current medication\-safety reasoning\. MedPIC\-Bench provides a source\-traceable testbed for evaluating and developing models whose clinical judgments remain tied to the patient information that justifies them\.

## Ethical Statement

MedPIC\-Bench is intended for research evaluation, not clinical decision support\. Its synthetic vignettes reduce source recommendations to controlled rule\-applicability judgments and do not capture the uncertainty, patient preferences, local guidance, or clinician judgment involved in real prescribing\. Results should not be interpreted as treatment recommendations or evidence of readiness for clinical deployment\. The benchmark contains no patient records or personally identifiable information, and its release will include source provenance and documentation of these limitations\.

## References

- American geriatrics society 2023 updated ags beers criteria® for potentially inappropriate medication use in older adults\.Journal of the American Geriatrics Society71\(7\),pp\. 2052–2081\.Cited by:[§3\.1](https://arxiv.org/html/2608.03028#S3.SS1.p1.1)\.
- S\. Agarwal, L\. Ahmad, J\. Ai, S\. Altman, A\. Applebaum, E\. Arbus, R\. K\. Arora, Y\. Bai, B\. Baker, H\. Bao,et al\.\(2025\)Gpt\-oss\-120b & gpt\-oss\-20b model card\.arXiv preprint arXiv:2508\.10925\.Cited by:[§4\.1](https://arxiv.org/html/2608.03028#S4.SS1.p1.1)\.
- R\. K\. Arora, J\. Wei, R\. S\. Hicks, P\. Bowman, J\. Quiñonero\-Candela, F\. Tsimpourlas, M\. Sharman, M\. Shah, A\. Vallone, A\. Beutel,et al\.\(2025\)Healthbench: evaluating large language models towards improved human health\.arXiv preprint arXiv:2505\.08775\.Cited by:[§1](https://arxiv.org/html/2608.03028#S1.p1.1),[§2](https://arxiv.org/html/2608.03028#S2.p1.1)\.
- K\. Benkirane, J\. Kay, and M\. Perez\-Ortiz \(2025\)How can we diagnose and treat bias in large language models for clinical decision\-making?\.InProceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies \(Volume 1: Long Papers\),pp\. 2263–2288\.External Links:[Document](https://dx.doi.org/10.18653/v1/2025.naacl-long.114)Cited by:[§2](https://arxiv.org/html/2608.03028#S2.p3.1)\.
- S\. Chen, W\. Jiang, C\. Wang, X\. Wu, X\. Shi, Y\. Zhang, and J\. T\. Kwok \(2026a\)RxEval: a prescription\-level benchmark for evaluating llm medication recommendation\.arXiv preprint arXiv:2605\.14543\.Cited by:[§2](https://arxiv.org/html/2608.03028#S2.p2.1)\.
- W\. Chen, G\. Huang, W\. Wang, and Z\. Zhu \(2026b\)MedEinst: benchmarking the einstellung effect in medical llms through counterfactual differential diagnosis\.InProceedings of the 64th Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 39778–39798\.Cited by:[§1](https://arxiv.org/html/2608.03028#S1.p2.1),[§2](https://arxiv.org/html/2608.03028#S2.p3.1),[Table 1](https://arxiv.org/html/2608.03028#S3.T1.24.24.5.1.1)\.
- Y\. Chen, V\. K\. Singh, J\. Ma, and R\. Tang \(2026c\)CounterBench: evaluating and improving counterfactual reasoning in large language models\.InProceedings of the AAAI Conference on Artificial Intelligence,Vol\.40,pp\. 30350–30358\.Cited by:[§2](https://arxiv.org/html/2608.03028#S2.p3.1)\.
- G\. Comanici, E\. Bieber, M\. Schaekermann, I\. Pasupat, N\. Sachdeva, I\. Dhillon, M\. Blistein, O\. Ram, D\. Zhang, E\. Rosen,et al\.\(2025\)Gemini 2\.5: pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities\.arXiv preprint arXiv:2507\.06261\.Cited by:[§4\.1](https://arxiv.org/html/2608.03028#S4.SS1.p1.1)\.
- C\. Dou, C\. Liu, F\. Yang, F\. Li, J\. Jia, M\. Chen, Q\. Ju, S\. Wang, S\. Dang, T\. Li,et al\.\(2025\)Baichuan\-m2: scaling medical capability with large verifier system\.arXiv preprint arXiv:2509\.02208\.Cited by:[§4\.1](https://arxiv.org/html/2608.03028#S4.SS1.p1.1)\.
- R\. Ghosh, A\. Gupta, H\. McBride, A\. J\. Vaidya, and F\. Mahmood \(2025\)MEDEQUALQA: evaluating biases in LLMs with counterfactual reasoning\.InProceedings of the First Workshop on Human–LLM Collaboration for Ethical and Responsible Science Production,pp\. 25–37\.External Links:[Document](https://dx.doi.org/10.18653/v1/2025.sciprodllm-1.4)Cited by:[§2](https://arxiv.org/html/2608.03028#S2.p3.1),[Table 1](https://arxiv.org/html/2608.03028#S3.T1.20.20.5.1.1)\.
- A\. Grattafiori, A\. Dubey, A\. Jauhri, A\. Pandey, A\. Kadian, A\. Al\-Dahle, A\. Letman, A\. Mathur, A\. Schelten, A\. Vaughan,et al\.\(2024\)The llama 3 herd of models\.InNeural Information Processing Systems,Cited by:[§4\.1](https://arxiv.org/html/2608.03028#S4.SS1.p1.1)\.
- S\. Jiang, Y\. Wang, S\. Song, T\. Hu, C\. Zhou, B\. Pu, Y\. Zhang, Z\. Yang, Y\. Feng, J\. T\. Zhou,et al\.\(2025\)Hulu\-med: a transparent generalist model towards holistic medical vision\-language understanding\.arXiv preprint arXiv:2510\.08668\.Cited by:[§4\.1](https://arxiv.org/html/2608.03028#S4.SS1.p1.1)\.
- X\. Li, M\. Gao, Y\. Hao, T\. Li, G\. Wan, Z\. Wang, and Y\. Wang \(2025\)Medguide: benchmarking clinical decision\-making in large language models\.arXiv preprint arXiv:2505\.11613\.Cited by:[§1](https://arxiv.org/html/2608.03028#S1.p2.1),[§2](https://arxiv.org/html/2608.03028#S2.p1.1),[Table 1](https://arxiv.org/html/2608.03028#S3.T1.4.4.5.1.1)\.
- T\. Lin, W\. Zhang, S\. Li, Y\. Yuan, B\. Yu, H\. Li, W\. He, H\. Jiang, M\. Li, S\. Xiaohui,et al\.\(2025\)HealthGPT: a medical large vision\-language model for unifying comprehension and generation via heterogeneous knowledge adaptation\.InInternational Conference on Machine Learning,pp\. 37975–37995\.Cited by:[§4\.1](https://arxiv.org/html/2608.03028#S4.SS1.p1.1)\.
- C\. Liu, Y\. Shu, M\. Chen, H\. Piao, Z\. Duan, D\. Li, and B\. Dai \(2026\)Scaling is not all you need: clinical\-oriented reinforcement learning makes parameter\-efficient clinical reasoning\.InFindings of the Association for Computational Linguistics: ACL 2026,pp\. 15056–15068\.Cited by:[§4\.1](https://arxiv.org/html/2608.03028#S4.SS1.p1.1)\.
- C\. McPherson, R\. S\. Meyers, J\. Thackray, D\. L\. Stutzman, K\. P\. Mills, S\. J\. Said, K\. Patel, R\. C\. Hellinga, A\. L\. Potts, L\. Lubsch,et al\.\(2025\)Pediatric pharmacy association 2025 kids list of key potentially inappropriate drugs in pediatrics\.The Journal of Pediatric Pharmacology and Therapeutics30\(4\),pp\. 422–439\.Cited by:[§3\.1](https://arxiv.org/html/2608.03028#S3.SS1.p1.1)\.
- A\. Paszke, S\. Gross, F\. Massa, A\. Lerer, J\. Bradbury, G\. Chanan, T\. Killeen, Z\. Lin, N\. Gimelshein, L\. Antiga,et al\.\(2019\)Pytorch: an imperative style, high\-performance deep learning library\.Advances in neural information processing systems32\.Cited by:[§4\.1](https://arxiv.org/html/2608.03028#S4.SS1.p3.1)\.
- J\. Proulx, B\. Daines, M\. Barton, M\. E\. Leonard, J\. A\. Garcia, B\. Young, Q\. Snell, T\. W\. West, S\. R\. Watson, M\. AlQaseer,et al\.\(2026\)A three\-tier operational benchmark for evaluating large language models on hospital medication safety\.medRxiv,pp\. 2026–06\.Cited by:[Table 1](https://arxiv.org/html/2608.03028#S3.T1.12.12.5.1.1)\.
- Z\. Qu and M\. Färber \(2026\)MediEval: a unified medical benchmark for patient\-contextual and knowledge\-grounded reasoning in LLMs\.InProceedings of the 64th Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 16150–16164\.Cited by:[§2](https://arxiv.org/html/2608.03028#S2.p3.1),[Table 1](https://arxiv.org/html/2608.03028#S3.T1.16.16.5.1.1)\.
- A\. Sellergren, S\. Kazemzadeh, T\. Jaroensri, A\. Kiraly, M\. Traverse, T\. Kohlberger, S\. Xu, F\. Jamil, C\. Hughes, C\. Lau,et al\.\(2025\)Medgemma technical report\.arXiv preprint arXiv:2507\.05201\.Cited by:[§4\.1](https://arxiv.org/html/2608.03028#S4.SS1.p1.1)\.
- Y\. Shen, L\. Cao, S\. Du, Y\. Wang, J\. Zhou, H\. Peng, and Y\. Guo \(2026\)MedGuideX: internalizing decision logic from executable guidelines into large language models for clinical reasoning\.arXiv preprint arXiv:2605\.26567\.Cited by:[§2](https://arxiv.org/html/2608.03028#S2.p1.1)\.
- A\. Singh, A\. Fry, A\. Perelman, A\. Tart, A\. Ganesh, A\. El\-Kishky, A\. McLaughlin, A\. Low, A\. Ostrow, A\. Ananthram,et al\.\(2025\)Openai gpt\-5 system card\.arXiv preprint arXiv:2601\.03267\.Cited by:[§4\.1](https://arxiv.org/html/2608.03028#S4.SS1.p1.1)\.
- K\. Singhal, S\. Azizi, T\. Tu, S\. S\. Mahdavi, J\. Wei, H\. W\. Chung, N\. Scales, A\. Tanwani, H\. Cole\-Lewis, S\. Pfohl,et al\.\(2023\)Large language models encode clinical knowledge\.Nature620\(7972\),pp\. 172–180\.Cited by:[§1](https://arxiv.org/html/2608.03028#S1.p1.1),[§2](https://arxiv.org/html/2608.03028#S2.p1.1)\.
- K\. Singhal, T\. Tu, J\. Gottweis, R\. Sayres, E\. Wulczyn, M\. Amin, L\. Hou, K\. Clark, S\. R\. Pfohl, H\. Cole\-Lewis,et al\.\(2025\)Toward expert\-level medical question answering with large language models\.Nature medicine31\(3\),pp\. 943–950\.Cited by:[§1](https://arxiv.org/html/2608.03028#S1.p1.1),[§2](https://arxiv.org/html/2608.03028#S2.p1.1)\.
- G\. Team, A\. Kamath, J\. Ferret, S\. Pathak, N\. Vieillard, R\. Merhej, S\. Perrin, T\. Matejovicova, A\. Ramé, M\. Rivière,et al\.\(2025\)Gemma 3 technical report\.External Links:2503\.19786,[Link](https://arxiv.org/abs/2503.19786)Cited by:[§4\.1](https://arxiv.org/html/2608.03028#S4.SS1.p1.1)\.
- Q\. Team \(2026\)Qwen3\. 5\-omni technical report\.arXiv preprint arXiv:2604\.15804\.Cited by:[§4\.1](https://arxiv.org/html/2608.03028#S4.SS1.p1.1)\.
- T\. Wolf, L\. Debut, V\. Sanh, J\. Chaumond, C\. Delangue, A\. Moi, P\. Cistac, T\. Rault, R\. Louf, M\. Funtowicz,et al\.\(2020\)Transformers: state\-of\-the\-art natural language processing\.InProceedings of the 2020 conference on empirical methods in natural language processing: system demonstrations,pp\. 38–45\.Cited by:[§4\.1](https://arxiv.org/html/2608.03028#S4.SS1.p3.1)\.
- A\. Xu, B\. Lin, B\. Xue, B\. Wang, B\. Xu, B\. Wu, B\. Zhang, C\. Lin, C\. Dong, C\. Ling,et al\.\(2026\)Deepseek\-v4: towards highly efficient million\-token context intelligence\.arXiv preprint arXiv:2606\.19348\.Cited by:[§4\.1](https://arxiv.org/html/2608.03028#S4.SS1.p1.1)\.
- W\. Xu, H\. P\. Chan, L\. Li, M\. Aljunied, R\. Yuan, J\. Wang, C\. Xiao, G\. Chen, C\. Liu, Z\. Li,et al\.\(2025\)Lingshu: a generalist foundation model for unified multimodal medical understanding and reasoning\.arXiv preprint arXiv:2506\.07044\.Cited by:[§4\.1](https://arxiv.org/html/2608.03028#S4.SS1.p1.1)\.
- H\. Zhang, J\. Chen, F\. Jiang, F\. Yu, Z\. Chen, G\. Chen, J\. Li, X\. Wu, Z\. Zhiyi, Q\. Xiao,et al\.\(2023\)Huatuogpt, towards taming language model to be a doctor\.InFindings of the association for computational linguistics: EMNLP 2023,pp\. 10859–10885\.Cited by:[§4\.1](https://arxiv.org/html/2608.03028#S4.SS1.p1.1)\.
- J\. Zhao, L\. Xu, M\. Tan, L\. Zhang, A\. Argha, H\. Alinejad\-Rokny, and M\. Yang \(2025a\)RxSafeBench: identifying medication safety issues of large language models in simulated consultation\.In2025 IEEE International Conference on Bioinformatics and Biomedicine \(BIBM\),pp\. 4491–4496\.Cited by:[§1](https://arxiv.org/html/2608.03028#S1.p2.1),[§2](https://arxiv.org/html/2608.03028#S2.p2.1),[Table 1](https://arxiv.org/html/2608.03028#S3.T1.8.8.5.1.1)\.
- X\. Zhao, K\. Blotske, M\. Cargile, A\. Tilley, B\. Murray, Y\. Gao, K\. Henry, S\. E\. Smith, E\. F\. Barreto, S\. Bauer,et al\.\(2025b\)Rx\-llm: a benchmarking suite to evaluate safe large language model performance for medication\-related tasks\.medRxiv,pp\. 2025–12\.Cited by:[§2](https://arxiv.org/html/2608.03028#S2.p2.1)\.
- L\. Zheng, L\. Yin, Z\. Xie, C\. Sun, J\. Huang, C\. H\. Yu, S\. Cao, C\. Kozyrakis, I\. Stoica, J\. E\. Gonzalez,et al\.\(2024\)Sglang: efficient execution of structured language model programs\.Advances in neural information processing systems37,pp\. 62557–62583\.Cited by:[§4\.1](https://arxiv.org/html/2608.03028#S4.SS1.p3.1)\.
- Y\. Zhou, X\. Liu, C\. Ning, and J\. Wu \(2024\)MultifacetEval: multifaceted evaluation to probe llms in mastering medical knowledge\.InProceedings of the Thirty\-Third International Joint Conference on Artificial Intelligence,pp\. 6669–6677\.Cited by:[§2](https://arxiv.org/html/2608.03028#S2.p1.1)\.