发表机构
Daffodil International University; Boise State University（水仙花国际大学; 博伊西州立大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本研究通过试点审计发现，ReAct风格的医学影像工具调用智能体在散文标注的伪造结果下更易修改自身正确答案，顺从性远高于工具返回的伪造结果，该结果来自未达停止规则的小规模研究。
AI 中文摘要
目前正被提出将使用工具的智能体应用于医学影像领域，而当工具返回伪造结果时这类智能体的行为在很大程度上未被测量。我们审计了采用ReAct风格的工具调用智能体是否会在伪造结果出现时放弃自身已正确给出的答案，以及这种情况是否取决于结果的呈现方式。针对VQA-RAD数据集中的20个封闭问题，涉及四个供应商指定的模型层级，该智能体仅基于图像确定一个答案；随后以两种方式传递否定结果：一是智能体自身调用analyze_image工具后返回的JSON格式结果，二是标注为放射科医生的引述散文格式结果。我们的结果是未使用任何工具时已正确回答的案例中出现的错误率。在散文标注的结果下，顺从性要高得多：在最强层级，智能体在13个案例中有10个修改了正确答案，而在工具返回的结果下仅为13个案例中的1个（精确McNemar检验p=0.0039，Holm校正后p=0.012）。我们不声称这能分离出来源标签，在我们的设计中，属性与传递通道相伴，且暴露情况存在差异，因为工具结果仅在智能体调用工具时才会到达。该发现来自一项未达到预先指定停止规则的小规模试点研究，是来源与传递通道共同导致的不对称结果。
英文摘要
Tool-using agents are being proposed for medical imaging, and their behaviour when a tool returns a false finding is largely unmeasured. We audit whether a ReAct-style tool-calling agent abandons an answer it has already given correctly once a falsified finding arrives, and whether that depends on how the finding is presented. On 20 VQA-RAD closed questions across four vendor-designated model tiers, the agent commits to an answer from the image alone; a negated finding is then delivered either as JSON from an analyze_image tool the agent invokes itself, or as quoted prose attributed to a radiologist. Our outcome is the commission-error rate over cases answered correctly without any tool. Deference is much higher under the prose-attributed claim: at the strongest tier the agent revised its correct answer in 10 of 13 cases against 1 of 13 under the tool (exact McNemar p=0.0039, Holm-adjusted 0.012). We do not claim this isolates the source label. Attribution travels with the delivery channel in our design, and exposure differs because the tool claim reaches the agent only when it calls the tool. The finding is a joint source-and-delivery asymmetry from a small-scale pilot whose pre-specified stopping rule was not met.
