Marking the Wrong Symptoms: Evaluating LLM Watermarks in Medical Texts
06:00 · July 24, 2026 · arXiv cs.AI RSS
Large language models (LLMs) are increasingly integrated into clinical workflows, stressing the need for reliable traceability of model-generated output with watermarking. Yet, most watermarks are evaluated on general-purpose benchmarks, leaving domains like medicine, where small token-level perturbations can result in significant semantic changes, underexplored. In this work, we present the first rigorous study of how LLM watermarks affect medical performance, benchmarking 5 watermarking schemes across 11 LLMs and 7 VLMs on various tasks spanning unimodal and multimodal clinical reasoning. Importantly, we complement existing evaluations by introducing a human-expert-validated pipeline for systematically auditing medical reasoning quality, terminological precision, and induced hallucinations. Our results reveal that watermarking can induce substantial degradation across multiple failure modes, including lexical corruption, hallucinated terminology, and amplified misattribution or omission of image findings. Notably, we find that the absence of domain-specific analyses, combined with aggregate metrics that miss failures inherent to clinical text, can systematically obscure practical watermark-induced degradations. Our findings establish domain-specific evaluation as a prerequisite for the safe deployment of watermarked models in medicine, where current benchmarks can otherwise mask clinically consequential failures.
Summary
Large language models are entering clinical workflows at scale, where outputs influence patient histories, diagnostic suggestions and report drafting. Regulatory pressure, notably the EU AI Act’s provenance requirements, is accelerating the adoption of watermarking as the primary mechanism for tracing model-generated text. Yet most watermark evaluations rely on general-domain benchmarks and coarse proxies such as perplexity, leaving open the question of how token-level sampling changes affect domains in which small lexical shifts can alter clinical meaning.
This study supplies the first systematic examination of that gap. Five watermarking schemes—both distortionary and distortion-free—were applied to eleven language models and seven vision-language models and tested on MedQA and MedXpertQA-MM. In addition to standard accuracy metrics, the authors introduce a clinician-validated pipeline of three LLM-as-judge auditors that separately score reasoning quality, terminological precision and hallucination. The judges were calibrated against annotations from two board-certified physicians.
Results show that watermarking frequently preserves letter-grade accuracy while materially degrading the reasoning that supports the answer. The share of correct answers backed by flawed reasoning more than doubled on several models; fabricated medical entities rose by as much as 39 percentage points. On multimodal items, watermarks increased misattribution or omission of image findings. When both watermarked and unwatermarked outputs selected the correct diagnosis, up to 40 % of the pairs rested on mutually contradictory clinical statements. Restricting the watermark to the final answer rather than the reasoning trace largely avoided these side-effects, whereas watermarking the trace itself inflated output length and circular deliberation.
The authors conclude that aggregate benchmarks can mask clinically consequential failures and that domain-specific evaluation pipelines are a prerequisite for safe deployment of watermarked models in medicine.
Why it matters
Highly actionable for Dutch healthcare AI teams and regulators: demonstrates that generic benchmarks mask clinically critical failures and recommends domain-specific evaluation plus answer-only watermarking for reasoning models. Aligns with Netherlands' focus on ethical, transparent AI deployment under EU rules.
