arXiv cs.CL· Jae Wang Lee, Abhirup Banerjee, Yeong Chan Lee·· 12 小时前AI 评分58
研究：医疗 AI 智能体可静默访问受保护健康信息而不体现在输出中
Accessed, never disclosed: Silent access to protected health information by medical artificial intelligence agents
AI 导读
一项 arXiv 研究在合成病历中嵌入金丝雀标记，追踪五个语言模型在七种攻击框架下对 PHI 工具的调用，发现三个模型会不必要地调用 PHI 工具，而 Claude Opus 4.8 和 GPT-5.5 没有。
正文 · 原文
Abstract:Medical artificial intelligence agents should retrieve patient identifiers only when a task requires them, the data-minimization principle behind the HIPAA minimum necessary standard for protected health information (PHI). An agent can retrieve identifiers without revealing them. Such silent access remains invisible to evaluations that inspect only the output. We embedded canaries in synthetic patient records and linked each tool invocation to canary exposure in the final answers across five language models, four boundary levels, and seven attack frames for identifier-free clinical tasks. Three models invoked the PHI tools unnecessarily, whereas Claude Opus 4.8 and GPT-5.5 did not. Stronger boundaries reduced this access, and the residual access under the strictest policy was confined to frames in which the user overrode the policy or asserted approval. A pre-execution gate given the task-necessity criterion nearly eliminated this access. Output-only evaluation cannot verify minimum-necessary access; boundaries, gates, and access-log audits are required together.
| Comments: | 33 pages, 5 figures, 1 table, 3 Extended Data tables; includes Supplementary Information (12 tables, 6 figures) |
| Subjects: | Artificial Intelligence (cs.AI); Computation and Language (cs.CL); Cryptography and Security (cs.CR); Computers and Society (cs.CY) |
| Cite as: | arXiv:2611.02319 [cs.AI] |
| (or arXiv:2611.02319v1 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2611.02319 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Jae Wang Lee [view email]
[v1]
Mon, 2 Nov 2026 00:10:47 UTC (1,294 KB)
来源：arXiv cs.CL · arxiv.org