FlagThis

Abstract

Clinical AI models make consequential decisions in settings where adversarial vulnerabilities can translate directly into patient harm. Formal security auditing of these models requires statistical expertise, purpose-built software, and substantial time. Most clinical deployment teams lack at least one of those three. We describe an open evaluation task, built on METR Task Standard v0.3.0, that asks whether frontier AI agents can implement a structured clinical AI security evaluation specification autonomously. The agent executes each attack algorithm from pseudocode, aggregates the results without scaffolding code, and writes a structured report without human guidance. The task provides an agent with a pre-trained clinical prediction model, a patient dataset, and a written audit specification. The agent must implement four distinct adversarial attacks, aggregate the results into a Security Posture Score across FGSM robustness, membership inference resistance, expected calibration error, and boundary attack resistance, and write a structured JSON report in a Docker container through a bash tool interface, with no scaffolding code provided. Six task variants span two clinical datasets (Wisconsin Diagnostic Breast Cancer and MIMIC-IV ICU mortality) and three model architectures of increasing defense strength, with reference Security Posture Score values ranging from 55.60 to 90.41. We ran 54 evaluations across three frontier models, with each model completing three independent runs per variant to assess reproducibility. Claude Sonnet 4.6 and GPT-4.1 both achieved 100% task completion with perfect evaluator scores across all 18 runs apiece. GPT-4o completed 61% of runs and used roughly five times Claudes per-run token count by each providers own measure. Anthropic and OpenAI use different tokenization schemes, so that figure is a relative ordering, not a direct comparison. API charges tell a cleaner story: $8 for GPT-4.1, $12 for Claude Sonnet 4.6, and $27 for GPT-4o across 18 runs apiece. Three distinct failure modes explain the GPT-4o shortfall: early session termination before file writing, an arithmetic error in weighted aggregation, and an empty submission file. The task, scoring infrastructure, and all Wisconsin Breast Cancer assets are released at `https://github.com/MichaelEnny/clinical-ai-security-eval` . MIMIC-IV variants require separate PhysioNet credentialed access.