Where the false claim sits
The misinformation came from three places: public-forum and social media dialogues, real hospital discharge notes into which a single false recommendation had been inserted, and 300 physician-validated simulated vignettes. Each prompt was posed once in a neutral base form and ten more times framed as a named logical fallacy, such as an appeal to authority or to popularity.
One false claim, posed eleven ways: once neutrally, then once for each named fallacy. Blue marks the eight framings that lowered acceptance against the neutral prompt, crimson the two that raised it, with all 20 models and the three sources pooled.
In base prompts the models accepted the false claim 31.7% of the time (50,108 of 158,000). Inside a real discharge note the rate rose to 46.1%; in social media dialogues it was 8.9%, and in the simulated vignettes 5.1%. A fabrication written in the voice of a clinical note got through most often.
accepted when the false recommendation sat inside a real discharge note
accepted when the misinformation came from a social media dialogue
for Gemma-3-4B-it, the most susceptible model reported; GPT models were the least
The fallacy paradox
Wrapping the misinformation in a logical fallacy mostly made the models more careful. Eight of the ten framings lowered susceptibility, led by appeal to popularity, which cut it to 11.9%, 19.8 percentage points below the neutral prompt. Two framings raised it: slippery slope, to 33.9%, and appeal to authority, to 34.6%.
The same pattern held inside the discharge notes, where appeal to popularity cut acceptance from 46.1% to 17.4% and slippery slope raised it to 50.0%. In social media dialogues, neither slippery slope nor appeal to authority changed it.
The models absorbed fabrications most readily in authoritative clinical prose, and grew warier when the same claims arrived as a rhetorical trick.
All sources, neutral prompt: 31.7% accepted (50,108 of 158,000). Each framing below is drawn from this line.
The share of prompts in which the models accepted the false claim, all 20 models combined. Each framing is drawn from the neutral prompt's line, crimson where it raised acceptance, blue where it lowered it and gray where the change was not significant. The paper's text gives no slippery-slope value for the vignettes. Tap or hover a row for the counts. Data from the Results section of the paper.
Across the 20 models
Susceptibility varied widely by model. GPT models were the least susceptible and the most accurate at naming the fallacy, while Gemma-3-4B-it accepted the false claim in 63.6% of its base prompts (5,023 of 7,900).
The paper combines the two measures into one composite score, the geometric mean of resisting the claim and calling the fallacy correctly. GPT-4o scored highest, at 0.895. gpt-oss-20b accepted the fewest false claims, 0.7% of its prompts, but called the fallacy correctly only 74.1% of the time. The medical fine-tuned models did worse than the general ones, with composite scores between 0.43 and 0.57; MediPhi looked immune only because it refused most prompts.
Fallacy called correctly
GPT-4o: accepted the false claim in 10.6% of its prompts and called the fallacy correctly in 89.7%. Composite score 0.895, ranked 1 of 20.
Each tile is one model, across all eleven prompt forms and the three sources: how often it accepted the false claim, and how often it called the fallacy correctly, leaving a neutral prompt unflagged and flagging a framed one. Up and to the left is better. Tap or hover a tile for its values. Data from the Table of the paper.
Safety depends less on model scale than on fact-grounding and guardrails that understand clinical context.
Large language models still absorb harmful medical fabrications, above all when they are written as authoritative clinical prose. Tools that work on discharge notes and after-visit summaries handle exactly that kind of text, and need safeguards built for it.
Mahmud Omar, Vera Sorin, Lothar H. Wieler, Alexander W. Charney, Patricia Kovatch, Carol R. Horowitz, Panagiotis Korfiatis, Benjamin S. Glicksberg, Robert Freeman, Girish N. Nadkarni, Eyal Klang
Girish N. Nadkarni and Eyal Klang contributed equally.
Mount Sinai Health System, Icahn School of Medicine at Mount Sinai, Mayo Clinic
The Lancet Digital Health 8(1), 100949 (2026)