Source-linked AI summary
TwinGuard-Lite: A Rule-Based State-Admission Gateway for Generative Patient Digital Twins
Wenhui Chu, Sheikh Rabiul Islam
TL;DR
Patient digital twins may retain identity-bound clinical state, but update wording alone does not establish whether a write is authorized, contradictory, or belongs to that patient. TwinGuard-Lite applies rule-based checks before state admission; in the evaluated benchmark it detects 90.5% of malicious writes at a 0.033% false-positive rate.
Problem
Persistent patient state can be corrupted or cross patient boundaries, and ordinary wording does not reveal whether an update has an authorized source, conflicts with the record, or belongs to another patient.
Source: §1 · p. 1Method
TwinGuard-Lite admits a write only when provenance, contradiction, and trusted-metadata namespace checks all pass.
Source: §3 · p. 2Results
90.5% of malicious writes were detected at a 0.033% false-positive rate in the evaluated benchmark.
Source: §4.3 · p. 5, §7 · p. 6Takeaways & Limitations
The conclusion recommends authenticated source and patient binding, rule checks before persistence, decision logging, and quarantine of flagged writes.
Source: §7 · p. 6Origin labels, namespace bindings, and attacks are generated, so the structured checks are strong partly by construction; the contradiction policy uses demonstration pairs and its recall is conditional on that list.
Source: §5 · p. 5
Abstract
from arXiv · showhide
Future generative patient digital twins may combine longitudinal health records with language-model agents and keep information across sessions. The wording of a proposed update does not reveal whether it comes from an allowed source, conflicts with the patient's record, or belongs to someone else. We present TwinGuard-Lite, a rule-based gateway that admits an update to a twin's persistent state only if it passes checkable approximations of two integrity properties. Grounded state consistency (GSC) is approximated by a provenance check and a contradiction check; cross-patient noninterference (CPN) is approximated by a namespace check against trusted transport metadata. We evaluate three attack families over 20 seeded person-level splits of a semi-synthetic stream built from the openly licensed eICU database demo, with 29,131 $\pm$ 2706 candidate updates per seed. A keyword filter and an anomaly detector detect 16% and 24% of attacks, respectively; a provenance-only ablation detects 59.9% but misses every cross-patient attack. Combining GSC and CPN yields 99.1% precision, 90.5% recall, a 94.6% F1 score, and a 0.033% false-positive rate. Every attack the full gateway admits falsely claims a trusted source; when the retrieval channel does so, 92.9% of retrieval attacks are admitted. The results hold under stated trust assumptions, and no language model, agent, or retriever is executed: TwinGuard-Lite is a mechanism-level proof of concept that motivates authenticated, patient-bound ingestion, not a clinical safeguard.
1. Introduction
Future patient digital twins may retain identity-bound clinical state across sessions, making a corrupted fact persistent and potentially able to spread between patients. Because invalid updates can be textually ordinary, the paper proposes explicit integrity rules and evaluates a rule-based gateway.
1. Introduction
- Persistent, identity-bound clinical state can preserve corrupted facts across sessions and spread them between patients when namespaces are not isolated.Patient digital twins remain largely preclinical, mostly simulation or monitoring models.Source: §1 · p. 1
- An update can be invalid because of its source, contradiction with the record, or owner—not because of its wording.Content filters and anomaly detectors are tempting defenses, but structurally invalid writes can look textually ordinary.Source: §1 · p. 1
- The paper defines four integrity properties, builds a gateway approximating two, and evaluates it on a semi-synthetic, real-data-backed benchmark.The evaluation uses three attack families, two surface baselines, and a check-by-check ablation.Source: §1 · p. 1
2. Model and Integrity Properties
The paper models patient state updates through four distinct integrity relations, then focuses its gateway on per-write approximations of grounded state consistency and cross-patient noninterference. Its threat model and scope depend on trusted patient-origin bindings and cover candidate writes rather than end-to-end retrieval poisoning.
2.1. Twin State and Candidate Writes
- Each input becomes a candidate write before state changes, and only authoritative evidence may write patient state.Candidate writes carry an event type, claimed namespace, origin label, episode, event time, and value; curated knowledge and untrusted context are separate trust zones.Source: §2.1 · pp. 1–2
2.2. Integrity Properties
- Grounded state consistency requires authoritative provenance and no declared-rule violation, while cross-patient noninterference protects another patient's state, memory, and action trace from untrusted inputs.Longitudinal transition integrity concerns valid state sequences; authorized action integrity requires actions to follow explicit policy.Source: §2.2 · p. 2
- The four properties mirror classical integrity policy: GSC aligns with Clark–Wilson validation, while CPN applies noninterference to patient namespaces.LTI and AAI also correspond to Clark–Wilson transformation and authorization rules, respectively.Source: §2.2 · p. 2
- The four properties are distinct, but TwinGuard-Lite enforces only per-write approximations of GSC and CPN on the canonical-state channel.The namespace check imposes a stronger per-write no-crossing condition; shared-store influence, such as retrieval, needs lineage tracking.Source: §2.2 · p. 2
2.3. Threat Model and Trust Assumptions
- The evaluated attacker may propose writes and spoof mutable origin labels, but cannot alter the policy engine or true originating namespace.The benchmark supplies true namespace as trusted transport metadata; the attacker knows the frozen contradiction policy and is nonadaptive at runtime.Source: §2.3 · p. 2
- CPN evaluation assumes a correct patient-origin binding, while retrieval poisoning is evaluated only after an item becomes a candidate write.A deployment must obtain the binding from an authenticated session or signed patient-bound envelope; index construction and retrieval ranking are not modeled.Source: §2.3 · p. 2
3. TWINGUARD-LITE: A Rule-Based Gateway
TwinGuard-Lite routes candidate writes through three checks and admits a write only when all pass. The checks are hard predicates, and every decision is logged with its triggering rule.
3. TWINGUARD-LITE: A Rule-Based Gateway
- The provenance check rejects non-authoritative medication, diagnosis, or laboratory labels, while the contradiction check rejects medication candidates matching a declared conflict pair in the same episode.The provenance check reads only a spoofable label and excludes treatment candidates; the prototype rejects every conflict match without an unresolved-conflict state.Source: §3 · p. 2
- The namespace check compares trusted transport metadata with the candidate's claimed namespace, except for types on a frozen shared-metadata allow-list.Source: §3 · p. 2
- A write is admitted only when the provenance, contradiction, and namespace checks all pass; any single failure rejects it.The checks are side-effect-free, so order affects only which rejection reason is logged, not the admission decision.Source: §3 · p. 2, Figure 1 · p. 3
- The prototype keeps admitted medication state only for contradiction checking and does not implement a full clinical twin state, memory store, capability system, or action trace.Every decision is appended to the ledger with its triggering rule, if any.Source: §3 · p. 3
4. Preliminary Evaluation
The preliminary evaluation tests TwinGuard-Lite on a person-split, semi-synthetic eICU stream with three injected attack families. The combined checks substantially outperform surface baselines, while their results depend on the benchmark’s trust assumptions and the contradiction rule has a measurable false-positive cost.
4.1. Benchmark
- The test benchmark used the eICU-CRD Demo v2.0.1, splitting 500 unit stays across 362 people into 253 calibration and 109 test people.The replay covered 424 hospital-admission episodes.Source: §4.1 · p. 3
- The reproducible cohort was not random: stay identifiers are not random with respect to hospital, and the event threshold favors data-rich stays.The authors caution against generalizing results across sites or acuities.Source: §4.1 · p. 3
- The benchmark injected prompt attacks, retrieval-mediated poisoning, and cross-patient copies into a stream averaging 29,131 ± 2706 candidate writes per seed.The benign stream is observed data, while adversarial writes, origin labels, and namespace bindings are generated by the benchmark.Source: §4.1 · p. 3
4.2. Defenses and Protocol
- The comparison included a loud-token keyword filter, a character-model anomaly detector, check-by-check gateway ablations, and a no-defense baseline.Metrics were macro-averaged over 20 seeds; the spread reflects resplitting one fixed cohort and redrawing attacks, not population sampling.Source: §4.2 · pp. 3–4, Table 1 · p. 4
4.3. Results
- 0.905 ± 0.008 recall, 0.991 ± 0.006 precision, 0.946 ± 0.005 F1, and 0.033% FPR; the combined gateway exceeded keyword-filter and anomaly-detector recall of 0.16 and 0.24.The table reports detection performance over 20 seeded person-level splits.Source: Table 1 · p. 4, §4.3 · p. 4
- GSC and CPN caught nearly disjoint attacks, sharing only 1 of 19,742 pooled true positives; CPN added no false positives.The gateway requires every check to pass for admission.Source: §4.3 · p. 4
- The contradiction check alone reached 0.028 ± 0.008 recall and stopped 144 otherwise-missed attacks, but caused all 187 benign rejections.Its value therefore depends on a better-sourced rule set.Source: §4.3 · p. 4
- 92.9% of retrieval attacks were admitted when retrieval falsely claimed an authoritative origin; with trusted binding, retrieval-mediated poisoning and cross-patient contamination had 0% success.The main-run 0% retrieval result reflects trust-zone enforcement, not robustness to poisoned retrieval.Source: §4.3 · p. 4
5. Discussion and Limitations
The evaluation’s structured checks depend on generated benchmark elements and trusted patient binding; provenance and contradiction rules also leave important coverage and validation limits. The study isolates admission decisions rather than testing an end-to-end generative pipeline.
5. Discussion and Limitations
- Generated origin labels, namespace bindings, and attacks make the structured checks strong partly by construction; neither baseline is state of the art.Source: §5 · p. 5
- CPN’s 0% cross-patient success assumes trusted true-origin binding, which this work does not establish; its allow-list is unvalidated and unused.The reported CPN numbers therefore reflect a deny-every-crossing rule.Source: §5 · p. 5
- The provenance check reads a label, and 92.9% of lying retrieval writes are admitted; it also leaves treatment writes unchecked.Authenticated, origin-bound provenance is central to usability; 12,172 treatment rows, 12% of the corpus, pass the check unexamined.Source: §5 · p. 5
- The two declared drug pairs are demonstration policy rather than clinically grounded rules, making contradiction recall an upper bound conditional on that list.Medication start and stop times are omitted, and amiodarone with digoxin can be deliberately prescribed; the authors recommend clinician adjudication of flagged writes.Source: §5 · p. 5
- No language model, agent, or retriever runs, so the study does not show how often real injected or retrieved content becomes a candidate write.The attacker is nonadaptive at run time; the authors identify an end-to-end study with an LLM agent and retrieval as the most important next experiment.Source: §5 · p. 5
6. Related Work
Prior work establishes agentic, retrieval, memory, and medical-model attack surfaces, while healthcare risk assessment identifies cross-patient contamination through poor memory isolation. TwinGuard-Lite focuses on enforcing integrity of persistent state, a scope distinct from within-execution control-flow defenses.
6. Related Work
- Prior benchmarks and defenses cover agentic prompt injection,,,, retrieval and memory poisoning,, medical-model poisoning, and adversarial-ML threat taxonomies.Source: §6 · p. 5
- Nagaraja and Bahsi identify cross-patient context contamination through poor memory isolation; Hallajiyan et al. study inference-time false data injection in medical devices.Both lines examine corrupted inputs reaching clinical systems; this work adds an enforcement point for the state they leave behind.Source: §6 · pp. 5–6
- CaMeL constrains untrusted data from steering control flow within one execution, whereas TWINGUARD-LITE governs persistence across executions and checks cross-patient histories.Neither subsumes the other: a protected run can still commit an unsourced fact, and a single trace cannot express CPN’s second-patient history.Source: §6 · p. 6
7. Conclusion
The conclusion presents TwinGuard-Lite as rule-level admission checks for structurally invalid writes and reports strong detection at a low false-positive rate. It frames the result as a mechanism-level proof of concept under stated trust assumptions, not clinical readiness.
7. Conclusion
- 90.5% of malicious writes are detected at a 0.033% false-positive rate by rule-level approximations of GSC and CPN.Every admitted attack is a provenance spoof, while every rejected benign write comes from the contradiction rule.Source: §7 · p. 6
- The practical workflow is to bind each write to an authenticated source and patient, check declared rules before persistence, log each decision, and quarantine flagged writes.Source: §7 · p. 6
- Because no language model, agent, or retriever runs, the results validate defined properties under stated trust assumptions, not clinical readiness.Source: §7 · p. 6
Ethics and Data
The study derives benign streams from a de-identified eICU demo subset and generates all adversarial writes. It reports no human-subject interaction or re-identification attempt and retains ODbL attribution for derived tables.
Ethics and Data
- Benign streams come from the open-access eICU-CRD Demo v2.0.1, a de-identified subset of the full eICU-CRD.Source: Ethics and Data · p. 6
- All adversarial writes are benchmark-generated; no real eICU record is labeled malicious.Source: Ethics and Data · p. 6
- The study involves no human-subject interaction or direct identifiers and makes no re-identification attempt; derived tables remain under ODbL 1.0 with attribution.The source demo is distributed by PhysioNet under ODbL 1.0 without a credentialing agreement.Source: Ethics and Data · p. 6