A Novel Evaluation Benchmark for Medical LLMs: Illuminating Safety and Effectiveness in Clinical Domains

1 Introduction

• LLMs may assist with symptom analysis, common questions, and physician–patient communication, but inaccurate medical outputs can pose risks to patient health [8].Source: §1 · p. 2
• Existing assessments often rely on medical examinations and task-specific datasets, which do not establish real-world clinical readiness or systematically assess safety and effectiveness together.The introduction also identifies missing risk-stratification standards, limited real-world context, and subjective, poorly scalable human assessment as gaps.Source: §1 · p. 3
• Closed-ended QA is standardized but can distort clinical context, while open-ended QA better represents clinical scenarios yet faces weakly aligned language-generation metrics and costly human review.Recent work also explores simulated AI-agent interactions and patient simulators for automated evaluation [21] [22] [23] [24].Source: §1 · pp. 3–4
• CSEDB proposes an expert-defined, risk-driven framework with 30 safety and effectiveness criteria across 26 clinical departments, using open-ended QA and automated batch testing.Its criteria include 17 safety-focused and 13 effectiveness-focused indicators.Source: §1 · p. 4

2.1 Research Design

• CSEDB combines 30 expert-defined criteria across safety and effectiveness with 2,069 open-ended scenarios spanning 26 specialties, reviewed by 32 specialist physicians.It uses binary and graded scoring, weighted and normalized indicators, and combines automated assessment with manual concordance validation.Source: §2.1 · pp. 4–5

2.2 Core Performance Comparison: Overall Model Scores on Safety and Effectiveness

• Safety weaknesses clustered in contraindicated medications, dosage errors, fatal drug interactions, allergy history, fabricated information, and procedural non-compliance; effectiveness gaps included combination-therapy validity.MedGPT approached 1.0 in high-weight life-threatening safety scenarios and scored at least 0.90 on several high-value effectiveness tasks.Source: §2.2 · p. 6, Table 1 · p. 8
• 57.2% ± 24.5% was the six-model average; safety averaged 54.7% ± 26.1% versus effectiveness 62.3% ± 22.3%, while MedGPT exceeded the second-best overall by 15.3%.MedGPT scored consistently high and balanced across both dimensions, while general-purpose models had lower safety than effectiveness scores.Source: §2.2 · p. 6, Figure 2 · p. 7, §2.6 · p. 13

2.3 Core Model Performance Comparison Across Weighted Risk Levels

• High-risk scenarios lowered average scores by 13.3% versus ordinary-risk scenarios, while MedGPT led across all weight levels and model differences widened at weight 5.The framework proposes prioritizing high-risk control, high-value decisions, and then lower-impact scenarios in model optimization.Source: §2.3 · pp. 8–9, Figure 3 · p. 9

2.4 Core Model Performance Comparison Across Clinical Departments and Patient Populations

• No model led across all departments and populations: MedGPT showed broad safety strength, while general-purpose models had context-specific strengths and vulnerabilities.MedGPT's safety was stronger in complex patient subgroups; Deepseek-R1 had a relative neonatal-effectiveness advantage, and general-purpose models carried risks in specialized settings and vulnerable groups.Source: §2.4 · pp. 10, 12

2.5.1 Model Repeatability Evaluation

• At k = 10, Worst at k scores declined by approximately one-third for MedGPT and two-thirds for Gemini-2.5 and Qwen3-235B; Claude-3.7 had the lowest score, below 0.1.MedGPT consistently achieved significantly higher Worst at k scores than the other models across all k values.Source: §2.5.1 · p. 12

2.5.2 Consistency with Expert Evaluations

• Deepseek-R1’s scorer MF1 was 0.601, 0.024 below the 0.625 physician-consensus baseline, while physician MF1 varied by as much as 0.078.The authors note that the scorer remained short of consensus and may not capture clinical consensus, particularly in complex cases.Source: §2.5.2 · p. 13

2.7 Impact of Prompt Engineering on Output Quality

• Structured prompts significantly improved Deepseek-R1’s safety and effectiveness scores on 60 test cases, with a more pronounced safety gain.Paired-bootstrap tests found P < 0.01 for safety and P < 0.05 for effectiveness; confidence intervals for both improvements were entirely positive.Source: §2.7 · pp. 13, 16, Figure 7 · p. 16

3.1 Establishment of Safety Gate and Effectiveness Gate Evaluation Metrics

• The 30-item framework uses expert consensus and risk-weighted criteria across safety and effectiveness, with 17 safety metrics and 13 effectiveness metrics.Safety metrics prioritize life-threatening or severe-disability scenarios; effectiveness metrics use a 70%-20%-10% weighting scheme for high-value diagnostic decisions, intermediate management, and patient experience.Source: §3.1 · p. 17

3.2 Model Auto-Scoring Evaluation

• The automated judge scores 2,069 clinical questions against specialist-reviewed reference answers using prompts that specify criteria, scoring rules, and weights.Scores are normalized to 0–1; the engine was calibrated against human scores before formal evaluation.Source: §3.2 · pp. 17–18

3.3.1 Binary Scoring

• Eight safety metrics use binary scoring: responses receive 1.0 for full adherence to absolute contraindications and 0.0 for any violation.The method covers examples such as contraindicated medications in pregnancy and medications used with caution in children.Source: §3.3.1 · p. 18

3.3.2 Graded Scoring

• Graded scoring divides earned rule points by total possible points, rounds to four decimal places, and caps scores at 1.0.This approach covers nine dynamic safety items and all 13 effectiveness metrics, using weighted clinical rules aligned with guideline pathways.Source: §3.3.2 · pp. 18–19

3.4 Overall Model Score Calculation

• Test cases are weighted by associated clinical risk, so high-risk metrics influence total scores 3–5 times more than low-risk metrics.Safety and effectiveness scores aggregate cases within their respective gates.Source: §3.4 · p. 19

3.5 Departmental Score Calculation

• Department scores use the same weighted-score logic but include only relevant cases, with separate stratification by risk level and gate type.For example, level-5 cardiovascular safety cases can be scored separately to identify specialty-domain gaps.Source: §3.5 · pp. 19–20

3.6.1 Data Aggregation and Mean Calculation

• Each model is evaluated three times per case, and the arithmetic mean of those scores is used to calculate the final weighted model score.The final score uses the same weights as a single evaluation.Source: §3.6.1 · p. 20

3.6.2 Error Estimation and Visualization

• Bootstrap confidence intervals quantify variability; paired tests compare models on shared cases, independent tests compare cohorts, and Holm-Bonferroni adjusts 15 model-pair comparisons.Both bootstrap significance procedures use 10,000 resamples and two-tailed p-values.Source: §3.6.2 · p. 20

3.7 Evaluation of the Impact of Structured Prompt Engineering on Model Performance

• The prompt-optimization test uses 60 balanced cases spanning all 30 criteria and 26 departments, comparing Deepseek-R1 responses before and after structured prompts.Paired bootstrap testing evaluates score differences for the same cases.Source: §3.7 · pp. 20–21

3.8 Model Repeatability Evaluation

• For each of 60 test cases, models produced 10 scored responses; Worst@k averaged each case’s minimum score among k randomly sampled responses.The test set contained two cases per assessment criterion.Source: §3.8 · p. 21
• Worst@k scores across different k values produced performance-degradation curves for comparing model stability.The metric records the mean minimum score across cases after sampling k scores without replacement from each case’s 10 responses.Source: §3.8 · p. 21

3.9 Model Scoring Consistency Evaluation

• Scoring-engine credibility was evaluated through rule-based evaluation and outcome-variability analysis on 4,303 doctor-reviewed rules.Source: §3.9 · p. 21
• Binary consistency compared model and doctor judgments per rule, while graded consistency compared their judgments across multiple rules within each case.The binary and graded measures use rule-level and case-level comparisons, respectively.Source: §3.9 · p. 22

• Macro F1 was computed by comparing scorer predictions of “compliant” or “non-compliant” with physician annotations.Source: §3.10 · p. 22
• Positive F1 uses TP, FP, and FN, while negative F1 uses TN, FN, and FP.TP and TN are agreements on compliant and non-compliant rules; FP and FN are disagreements in opposite directions.Source: §3.10 · p. 22
• Inter-doctor Macro F1 served as the human-consistency baseline, while random guessing set a lower bound of Macro F1=0.5.The random-guessing probability of compliance was set to the positive-class frequency.Source: §3.10 · pp. 22–23

4 Discussion

• CSEDB combines 30 expert-consensus indicators, open-ended questions across 26 specialties, and automated scoring with expert verification to assess clinical utility and risk boundaries.The benchmark covers 2,069 scenario-based questions.Source: §4 · pp. 23–24
• 54.7% ± 26.1% average safety scores were significantly below effectiveness scores of 62.3% ± 22.3%, especially among general-purpose LLMs.Weaknesses included contraindicated medications and fatal drug interactions.Source: §4 · p. 23
• 13.3% performance decline in high-risk scenarios (p < 0.0001) underscores shortcomings in life-threatening situations and motivates CSEDB’s risk-weighted stratification.MedGPT maintained balanced, high-level performance across safety and effectiveness, while generalist models scored lower on safety than effectiveness.Source: §4 · pp. 23–24
• Low scores on combination-therapy validity (E13 ≤0.6) and follow-up-plan rationality (E09 ≤0.8) identify improvement priorities; structured prompts significantly improved safety and effectiveness (p < 0.01).Suggested priorities include stronger drug-safety databases, better decision logic for comorbidities, and high-risk scenario training.Source: §4 · p. 24
• Coverage remains limited for rare diseases and multimodal inputs; single-turn, Chinese-only text QA lacks multi-turn and cross-linguistic validation.The authors note these constraints may limit comprehensiveness and generalizability.Source: §4 · p. 24
• The authors call for clear task boundaries, validated reliability, and continued refinement toward safe and effective AI-assisted clinical care.They frame this as supporting a transition from assistive tools to trusted clinical partners.Source: §4 · p. 24

8 Author Contributions

• YY, NL, and JW designed and supervised the study; other contributors established clinical metrics, data standards, and risk modeling.The contribution statement names these activities and contributors.Source: §8 · p. 25
• Contributors collected clinical data and generated, formulated standards for, and reviewed the benchmark databases.The listed work also included revising the benchmark databases and standards.Source: §8 · p. 25
• Authors performed experiments, data analysis, and figure preparation, drafted and revised the manuscript, and approved its final version.All authors had access to the data, discussed results, and accepted responsibility for submission.Source: §8 · p. 25

9 Conflict of Interest

• SW, TG, YW, WS, ZL, KM, DY, HG, and LM are Medlinker Intelligent and Digital Technology employees; all other authors declared no conflicts.The company is identified as being in Beijing, China.Source: §9 · p. 25

10 Funding

• The authors declared no funding sources.Source: §10 · p. 26

11 Ethics Statement

• The authors state that all CSEDB data sources are publicly available and free to use without copyright infringement.Source: §11 · p. 26
• CSEDB questions are anonymized and contain no sensitive private patient information.Source: §11 · p. 26
• The authors do not foresee other possible negative societal impacts from this work.Source: §11 · p. 26

Supplementary

• Figure S1 compares LLM performance by department and weighted category.Source: Figure S1 · p. 29
• Figure S1 uses rows for departments and five panels for weight categories, marks departments without test questions as NA, and labels weighted scores.Source: Supplementary · p. 30
• Figure S2 compares six LLMs on simple and complex cases using bootstrap analysis, with error bars showing 95% confidence intervals.Source: Figure S2 · p. 30
• Figure S2 marks statistical significance as NS, *, **, or ****, corresponding to non-significant, p < 0.05, p < 0.01, or p < 0.0001.Source: Figure S2 · p. 30