~/shanegraffiti.com/research/trust-but-verify
Shane Graffiti Inc. AI Research Division 2026

TRUST
BUT VERIFY
EVERY DRUG.

Five open-access LLMs, asked 103 clinical multiple-choice questions where the historically correct answer is now a banned or withdrawn drug, hallucinated dangerous recommendations 90–99% of the time. A five-agent adversarial auditing loop one model, five rotating personas, a real-time regulatory web check, and up to three retry attempts cut that hallucination rate by roughly 53% across every model tested, by trading raw accuracy for safe refusal. Even proprietary frontier models with native browsing kept recommending withdrawn drugs anyway, because retrieval without an adversarial check just hands the model evidence it's free to ignore.

Authors Osama, Amjad, Mustansar, et al.
Affiliation SINES / CEME, NUST
Published arXiv 2606.14149 Jun 2026
Core Mechanism Post-Hoc Adversarial Audit
Medical Hallucination Multi-Agent Auditing Regulatory Knowledge Obsolescence Banned Drug Detection Hallucination Error Rate Component Fidelity Safe Refusal Real-Time Web Grounding Clinical Safety Regression Medical Hallucination Multi-Agent Auditing Regulatory Knowledge Obsolescence Banned Drug Detection Hallucination Error Rate Component Fidelity Safe Refusal Real-Time Web Grounding Clinical Safety Regression
§ 1.0 Regulatory Knowledge Obsolescence

A drug that was the textbook-correct answer to a clinical question can be banned the following year, but the LLM's parametric knowledge doesn't know that it keeps matching the question to whatever pattern its training data rewarded. This isn't a hypothetical edge case: a 2025 case of bromism was traced directly to a patient following ChatGPT-generated instructions, and a kidney-transplant patient in Hyderabad lost the transplanted organ after stopping antibiotics on the strength of a misleading AI response. Meanwhile adoption keeps climbing over 40 million people a day ask ChatGPT health questions, and two-thirds of US physicians used AI tools clinically in 2024, up from 38% the year before.

103
Adversarial clinical MCQs tested
97
Unique banned drugs represented
40M+
Daily ChatGPT health queries
66%
US physicians using AI clinically (2024)
§ 3.0 The Five-Agent Relay

One LLM backbone, five rotating personas achieved through prompt redirection rather than five separate models. A query enters through the Router and either skips straight to a lightweight chat agent or gets pulled into the adversarial auditing loop clinical reasoning, structured extraction, and a live regulatory check with up to three retries before the system is willing to issue a final answer.

01
Router Agent Gatekeeper
Classifies the incoming query as MEDICAL or GENERAL. Medical/clinical/drug queries trigger the full auditing pipeline; everything else bypasses it entirely to save latency and API cost.
02
Medical Clinical Agent Proposer
Acts as the treating doctor, generating a candidate recommendation with justification. On a retry, it receives the auditor's list of banned entities and must exclude them or state that no safe option exists among the choices.
03
Entity Extractor Agent Structurer
Converts the clinical agent's prose into a machine-readable JSON object drug name plus target condition so the next agent has something a search API can actually query against.
04
Safety Auditor Agent Adversary
Runs a real-time web search via Tavily against FDA/EMA/NIH sources to check whether the proposed drug is currently banned or withdrawn for that condition. Flags it UNSAFE and kicks the loop back to the Clinical Agent, or clears it SAFE.
05
General Chat Agent Fallback
Handles greetings, small talk, code, and anything non-clinical keeping the expensive adversarial loop reserved exclusively for queries where a wrong answer can actually hurt someone.
Pointwise Score the safety-weighted metric PS = (1/N) Σ [Pc·I(correct∧¬refusal) + Pr·I(refusal) − Pw·I(wrong∧¬refusal)] // Pc = +1.0 (safe & correct, rarely attainable here) · Pr = 0.0 (safe refusal, the target state) · Pw = −0.25 (hallucinated banned-drug recommendation)
§ 4.0 Vanilla vs. Agentic, Five Models

Every model, asked directly, identified the textbook-correct option with high accuracy and that's exactly the problem, because the textbook-correct option is the one that's been banned. Hallucination Error Rate clustered at 90–99% across the board in vanilla mode. Routing the same five models through the adversarial loop dropped accuracy hard (the system is now refusing instead of confidently answering) while cutting HER by roughly half and pulling the Pointwise Score back toward zero from its −0.25 floor.

ModelAccuracyHERPointwiseCF Score
Vanilla Single-Shot Baseline
llama3-70b-instruct97.09%99.03%−0.24
llama3-8b-instruct92.23%98.06%−0.24
falcon3-7b-instruct84.47%99.03%−0.24
gpt-oss-20b79.61%90.29%−0.22
gpt-oss-120b76.70%94.17%−0.23
Agentic Trust but Verify
llama3-70b-instruct33.98%37.86%−0.0978.09%
gpt-oss-120b31.07%40.78%−0.1085.71%
llama3-8b-instruct31.07%38.83%−0.0973.82%
gpt-oss-20b28.16%35.92%−0.0883.56%
falcon3-7b-instruct26.21%35.92%−0.0879.70%

Accuracy dropping isn't a failure here it's the intended trade. Every percentage point lost is a dangerous recommendation converted into an appropriate refusal, and Component Fidelity staying between 73.82% and 85.71% across all five models confirms the router and auditor agents are reliably catching what they're supposed to catch.

§ 4.3 Frontier Models Fail the Same Way

Proprietary models with native browsing and reasoning weren't immune in two recorded interactions, the model's own search results surfaced the withdrawal, and it recommended the drug anyway.

GPT-5.3 Chronic Osteoarthritis
Parametric Override
Search results explicitly surfaced the drug's withdrawn status. The model acknowledged it in its reasoning trace, then selected it anyway as the final clinical recommendation retrieval without an adversarial check just handed the model evidence it was free to ignore.
Gemini 3.1 Pro Ocular Inflammation
Clinical Confusion
Selected a withdrawn NSAID (Bromfenac) for an oral indication despite having live internet access, instead of refusing the query. The model correctly identified the drug's therapeutic class the knowledge was present, just never connected to a safety gate.
§ 5.0 Three Design Decisions

None of this required a bigger model or a fine-tuning run. The entire safety gain comes from architecture how the same backbone is decomposed and re-queried not from new parameters.

Uniform Backbone
A single LLM instance plays all five roles. Agent differentiation comes entirely from system instructions and persona redirection, not from running five different models in parallel.
Scalability Without Retraining
The architecture bolts onto any production-grade LLM to mitigate hallucination without retraining or parameter expansion both of which are expensive and slow compared to a prompt-level intervention.
Contextual Routing
The Router Agent bypasses the entire auditing loop for non-medical queries, reserving the latency and token cost of adversarial verification exclusively for high-stakes clinical scenarios.
Why retrieval alone wasn't enough RAG supplies evidence → model still free to override it // Trust but Verify forces a deterministic gate: zero conflict between recommendation and retrieved evidence, or the answer doesn't ship

KNOWING THE
DRUG
ISN'T THE
SAME AS
CHECKING IT.