MedFuzz：探索大型語言模型在醫學問答中的穩健性

MedFuzz: Exploring the Robustness of Large Language Models in Medical Question Answering

June 3, 2024

作者: Robert Osazuwa Ness, Katie Matton, Hayden Helm, Sheng Zhang, Junaid Bajwa, Carey E. Priebe, Eric Horvitz

cs.AI

摘要

大型語言模型（LLM）在醫學問答基準上取得了令人印象深刻的表現。然而，高基準準確度並不意味著性能可以泛化到真實世界的臨床環境。醫學問答基準依賴與量化LLM性能一致的假設，但這些假設在臨床開放世界中可能不成立。然而，LLM學習了廣泛的知識，可以幫助LLM在實際條件下泛化，而不受慶祝基準中不切實際假設的影響。我們希望量化當基準假設被違反時，LLM醫學問答基準性能的泛化程度。具體來說，我們提出了一種對抗方法，稱為MedFuzz（用於醫學模糊）。MedFuzz試圖以混淆LLM為目的修改基準問題。我們通過針對MedQA基準中呈現的患者特徵的強假設展示了這種方法。成功的“攻擊”以一種不太可能欺騙醫學專家但仍然“欺騙”LLM從正確答案變為不正確答案的方式修改基準項目。此外，我們提出了一種排列測試技術，可以確保成功的攻擊在統計上具有顯著性。我們展示了如何使用在“MedFuzzed”基準上的性能，以及單個成功的攻擊。這些方法顯示了在更現實的環境中提供LLM運作穩健性洞察的潛力。

English

Large language models (LLM) have achieved impressive performance on medical question-answering benchmarks. However, high benchmark accuracy does not imply that the performance generalizes to real-world clinical settings. Medical question-answering benchmarks rely on assumptions consistent with quantifying LLM performance but that may not hold in the open world of the clinic. Yet LLMs learn broad knowledge that can help the LLM generalize to practical conditions regardless of unrealistic assumptions in celebrated benchmarks. We seek to quantify how well LLM medical question-answering benchmark performance generalizes when benchmark assumptions are violated. Specifically, we present an adversarial method that we call MedFuzz (for medical fuzzing). MedFuzz attempts to modify benchmark questions in ways aimed at confounding the LLM. We demonstrate the approach by targeting strong assumptions about patient characteristics presented in the MedQA benchmark. Successful "attacks" modify a benchmark item in ways that would be unlikely to fool a medical expert but nonetheless "trick" the LLM into changing from a correct to an incorrect answer. Further, we present a permutation test technique that can ensure a successful attack is statistically significant. We show how to use performance on a "MedFuzzed" benchmark, as well as individual successful attacks. The methods show promise at providing insights into the ability of an LLM to operate robustly in more realistic settings.