Source-linked AI summary
Review Before Trust: Source-Grounded Integrity Gates for AI-Assisted Personal Health Records
Nora Girda, Adrian Groza
TL;DR
Persisting unsupported model-extracted health data creates integrity risks because later record functions may reuse it. The paper introduces deterministic evidence-gated promotion and evaluates it through conformance tests and replay, finding stronger source locality reduced automatic admission while increasing review routing.
Problem
Persistent reuse of generated health information creates an integrity risk when unsupported claims enter longitudinal record functions.
Method
The paper uses a purpose-scoped transition model with an independent deterministic monitor that validates evidence, preserves provenance, and admits verified candidates for specified downstream uses.
Results
The replay shows stronger source locality reduced automatic admission from 94 packet-level candidates to 72 row-local admissions while increasing review routing from 3.1% to 25.8%.
Takeaways & Limitations
Evidence-gated promotion is technically feasible for a narrow laboratory integrity boundary that prevents selected unsupported candidates from entering observation history while preserving them for review.
Takeaways & Limitations
The study does not establish clinical truth, clinical safety, complete mediation, or tamper resistance, and its subset labels lack clinician adjudication and inter-rater agreement.
Abstract
from arXiv · showhide
Large language models can convert medical documents into structured data, but plausible output may still be unsupported by the source. Persisting such output in a longitudinal health record, a record that accumulates patient information over time, therefore creates an integrity risk: unverified data may influence later summaries, trends, or preventive-care computations. We introduce an evidence-gated trust-promotion model that keeps generated data provisional until a deterministic monitor verifies it against the source document. The monitor admits a candidate for a specified downstream use only when the source contains a unique supporting quotation, the relevant fields occur within the same laboratory row, and the required provenance is preserved. The generator cannot approve its own output, missing or ambiguous evidence causes refusal, and refused candidates remain available for human review rather than being silently discarded. We implement the model in Medical DataCloud, a personal health-record application, and evaluate it through automated tests and a replay of saved extraction outputs. All 22 conformance and mutation tests pass. The replay covers nine historical laboratory PDF reports containing 102 manually labelled rows. The reports produce 97 numeric candidates: schema validation accepts all 97, an earlier packet-level evidence check accepts 94, and the hardened quotation- and row-level policy admits 72 while retaining 25 for review. The study evaluates system integrity rather than clinical correctness or clinical safety. The results demonstrate the technical feasibility of an enforceable boundary that prevents generated claims from authorizing their own reuse in a longitudinal health record.
1. Introduction
The paper frames persistent LLM-derived health data as an integrity problem: plausible candidates may later become reusable record inputs without adequate source support. It proposes a separate deterministic gate that verifies evidence before purpose-specific promotion while preserving refused candidates for review.
- Motivation: Persistent health records turn transient model outputs into reusable inputs for trends, preventive-care rules, exports, and later model context.The integrity question is whether a particular downstream use should be permitted, not merely whether the value appears plausible.
- Motivation: A candidate is a schema-conforming proposition, not an authoritative observation; unsupported promotion can place a schema-valid value into a trend despite citing another number.The paper calls this transition unauthorized promotion.
- Motivation: Confidence and citation alone do not resolve the problem because confidence is generator-controlled and citations may be absent, ambiguous, duplicated, or unrelated.Human review and governance guidance do not themselves prevent an unchecked write.
- Approach: The system treats every candidate as untrusted and uses a separate deterministic gate to compare it with preserved source text before projecting it into a purpose-specific observation.Trusted means admitted under the explicit integrity policy, not clinically correct, authentic, or safe.
- Implementation: Medical DataCloud preserves documents, extracts bounded packets, validates evidence in server code, stores verified and refused facts, and projects only verified numeric laboratory candidates into observations.The laboratory path supports longitudinal views, preventive workflows, and export.
- Contributions: The study contributes a purpose-scoped integrity model, a narrow laboratory enforcement design, and evaluation through 22 tests plus replay of progressively stronger admission policies.The evaluation supports architectural feasibility for this path but not clinical readiness or population-level performance.
2. Related work and security foundations
The paper places evidence-gated promotion between generated content and protected record functions, drawing on provenance, reference-monitor, integrity, and abstention concepts. Its transition model independently checks structural eligibility and source support, routes failures to review, and offers only conditional assurance for a narrow laboratory path.
- Related work: Existing grounding, abstention, provenance, and governance approaches address support, withholding, traceability, or oversight but do not by themselves enforce authorization before persistence.The paper focuses on an application-level integrity decision between generated content and persistent record functions.
- Security foundations: Clark–Wilson provides an analogy in which LLM candidates are unconstrained input, observations are protected data, and evidence checking followed by projection is the transformation.The paper does not claim a full Clark–Wilson implementation because organizational separation and formal certification procedures are absent.
- Security foundations: A reference monitor should mediate protected operations, resist tampering, and remain analyzable; here the protected operation is creation of an AI-derived observation.The prototype monitors one laboratory write path but does not prove system-wide complete mediation or tamper resistance.
- Transition model: The model represents preserved sources S, bounded packets X, generated candidates C, retained review candidates R, and downstream purposes P.A purpose names an allowed reuse such as inclusion in an observation history or export.
- Transition model: For each purpose, Kp checks structural eligibility while Ep independently checks source support, separating admission authority from generator-controlled metadata.The transition model also defines purpose-specific projection, review mapping, and lineage recording.
- Transition model: Admission for one purpose does not imply admission for another, so evidence supporting display of a laboratory value may not support a clinical interpretation or alert.The prototype implements one principal class for document-derived observations; finer-grained policies remain modeled but are not implemented.
- Integrity properties: The integrity properties require mediated promotion, non-self-certification, provenance preservation, fail-closed admission, and uncertainty preservation.Absent, unmatched, multiply matched, or inconsistent evidence routes candidates to review rather than the authorized output set.
- Threat model: The threat model treats the generator as potentially faulty or adversarial, with generator-controlled fields alone unable to authorize promotion.Trusted code and database state form the relevant computing base for packet derivation, validation, routing, projection, and repository writes.
3. Prototype instantiation
Medical DataCloud instantiates the study as a persistent personal medical-data workspace with a staged laboratory extraction path. The prototype preserves source lineage and supports review, but its persisted facts are not immutably bound to every decision context and therefore only partially satisfy P3.
- Workspace: Medical DataCloud lets users upload documents, inspect extracted information, review uncertain results, follow laboratory values, and export structured history.The application is a personal medical-data workspace rather than an electronic health record, diagnostic system, or clinical decision-support system.
- Laboratory path: The laboratory path validates and hashes uploads, stores encrypted originals and extracted text, derives source-linked packets, and requests schema-constrained laboratory candidates.The staged path preserves document and text identifiers before generating candidate observations and evidence fields.
- Laboratory path: Evidence checking requires a bounded quote with one source match and same-row support for the analyte, numeric value, and any supplied unit or reference bounds.Duplicate matches fail closed, and numeric values must occur as complete tokens rather than substrings.
- Provenance: The implementation preserves document, packet, quote, offset, and validation provenance, but persisted facts and observations are not immutably bound to the exact extraction, verifier, and policy versions.The prototype therefore implements source-level lineage but only partially satisfies P3.
4. Evaluation
The evaluation tests the laboratory path under faults and compares evidence policies using fixed extraction outputs from historical reports. It shows interface conformance and a substantial reduction in automatic admission under row-local verification, while separating source support from semantic correctness and clinical error.
- Evaluation design: The evaluation asks whether the path conforms under faults, how policy strength changes admission and review routing, and how candidates agree with labelled source rows.These questions distinguish integrity enforcement, policy effects, and field-level agreement.
- Tests: 22 conformance and mutation tests cover evidence validation, laboratory tasks, repository boundaries, forged verification, verified-only projection, and unverified persistence.The suites contain 17 evidence-validation tests, three laboratory-task tests, and two repository-boundary tests.
- Replay: The replay uses nine laboratory PDFs, 102 manually labelled rows, and the same 97 emitted numeric candidates to remove model-run variation from policy comparisons.The labels were representative row subsets and were not adjudicated by clinicians or a second rater.
- Results: All 22 tests passed, but the exercised interfaces do not establish complete mediation across the whole application.The tests recomputed forged verification, failed closed on ambiguous and cross-row evidence, excluded unsupported candidates from mapping, and rejected an unverified write.
- Policy replay: Schema-only admission accepted all 97 candidates, packet-level evidence accepted 94, and row-local verification accepted 72 while retaining 25 for review.The row-local policy requires a unique source anchor and same-row support for supplied fields; failure establishes insufficient support, not falsity.
- Field agreement: On 80 matched rows, agreement was 100% for units, 94.6% for lower bounds, 93.8% for upper bounds, 86.3% for interpretation, and 85.0% for effective dates.The gate checks selected local field occurrences but does not validate effective-date or interpretation semantics, so source support and semantic correctness remain separate evaluations.
5. Discussion
The paper places authority for record admission in a separate deterministic evidence gate rather than in the generator, while retaining refused candidates for review. Its narrow laboratory evaluation supports containment on the exercised path but leaves domain, privacy, authenticity, clinical, and workflow boundaries unresolved.
- Authority and containment: Evidence-gated promotion assigns the database transition to a separate deterministic component, rather than allowing prompts, confidence, or model metadata to authorize reuse.The evaluated boundary retains failed candidates as facts without making them document-derived observations.
- Evidence predicate: The replay shows that packet-level co-occurrence admitted candidates refused by the stronger row-local evidence predicate.The hardened policy is designed to resist duplicate evidence, cross-row borrowing, and numeric-substring matches.
- Evidence predicate: Review routing increased from 3.1% to 25.8% under the stronger policy, while the replay did not establish that every refusal was correct.Deployment evaluation should therefore measure false admission, false review, correction outcomes, and reviewer time.
- Operational burden: The gate adds no model call, but its computational overhead was not measured and the application lacks a complete correct-and-reverify workflow or clinician-facing review interface.The gate performs bounded quote search, normalization, and same-row field matching; refused facts remain visible with source context.
- Scope boundaries: Extending the model beyond laboratory data requires domain-specific predicates, and the present results cannot be generalized across other domains, patients, laboratories, languages, scanners, or layouts.Medication, allergy, diagnosis, and narrative candidates require different identity, status, negation, and temporal checks.
- Scope boundaries: Integrity admission does not authorize disclosure or indefinite retention, so deployments need separate controls for minimization, access, third-party processing, export, and deletion.Preserving sources, quotes, refused candidates, and lineage increases sensitive material held for audit.
- Scope boundaries: The lexical verifier cannot establish document authenticity, patient identity, OCR correctness, clinical meaning, or medical correctness, and the evaluation lacked clinician adjudication and independent security assessment.The paper calls for multi-subject and multi-center reports, double annotation, predeclared error metrics, timed review, adversarial documents, penetration testing, and prospective evaluation.
6. Conclusion
The paper demonstrates a narrow integrity boundary that separates generation from authorization of persistent health-record reuse. In the Medical DataCloud laboratory path, deterministic source checks and verified-only mapping prevent selected unsupported candidates from entering observation history while preserving them for review, but the study does not establish clinical truth, safety, workflow acceptability, or complete healthcare-system mediation.
- Conclusion: 22 tests demonstrate conformance of the exercised interfaces, while replay shows stronger source locality reduces automatic admission and increases review demand.The conclusion limits these findings to feasibility for a narrow integrity boundary.
- Conclusion: Deterministic source checks, verified-only mapping, and a repository assertion prevent selected unsupported candidates from entering observation history while preserving them for review.This separates generation from the authorization decision for persistent record reuse.
- Conclusion: The study does not establish clinical truth, clinical safety, acceptable workflow burden, or complete mediation across a healthcare system.These are explicit boundaries on the paper’s conclusion.