Trustworthy Medical Multimodal Large Language Models: Taxonomy, Evaluation, and Benchmarks

1. Introduction

The rapid evolution of Multimodal Large Language Models (MLLMs) has induced a paradigm shift in artificial intelligence research, extending capabilities from unimodal processing to the joint understanding of multiple modalities, including visual, textual, and temporal data [1,2,3]. In the medical domain, this convergence holds transformative potential: By integrating heterogeneous data sources, ranging from gigapixel Whole Slide Images (WSIs) [4] and volumetric radiology scans [1] to unstructured clinical notes [5] and longitudinal Electronic Health Records (EHRs) [2] and continuous physiological signals [3], Medical MLLMs hold the promise to revolutionize clinical workflows, including diagnostic support, report generation, and personalized treatment planning [6,7]. Unlike traditional task-specific models, which are limited to specific anatomical sites or single modalities, such MLLMs demonstrate remarkable flexibility, which allows them to operate across diverse clinical scales with little adoption, thus proposing a future where AI could serve as a universal “co-pilot” assistant for clinicians.

However, the transition of Medical MLLMs from research prototypes to real-world clinical deployment is significantly impeded by the fundamental barrier of Trustworthiness. Unlike general-domain applications, Medical MLLMs operate in high-stakes settings in which model outputs may directly inform clinical decisions. Because large-scale generative models cannot guarantee the correctness of their outputs, an undetected error may result in misdiagnosis, delayed or inappropriate treatment, serious patient harm, or ultimately loss of life. Consequently, clinicians must not only be able to trust model outputs but also be able to identify when those outputs are unreliable. Specifically, although hallucination and distribution shift are not unique to medical models, their clinical manifestations are distinct. A Medical MLLM may generate clinically plausible but entirely fabricated findings (Hallucination) [5,8], or exhibit performance degradation when faced with different scanning protocols, patient populations, and institutional acquisition standards (Robustness) [9]. Such errors may be difficult for non-specialists to detect, may resemble plausible clinical evidence, and may directly affect diagnosis, or treatment planning. Moreover, medical deployment often involves heterogeneous acquisition protocols, rare disease distributions, limited access to expert-verified data, and strict clinical workflow and regulatory constraints, making general-domain mitigation strategies insufficient without clinical adaptation. Furthermore, the dual-use potential of medical data necessitates rigorous safeguards for patient privacy [10] and resilience against adversarial manipulations that could lead to misdiagnosis (Safety) [11].

Recent studies indicate that the research landscape for Medical MLLMs is moving from static perception tasks to interactive, workflow-aware clinical applications [12,13] that are more representative of their role of a useful clinical assistant: Instead of answering isolated questions, Medical MLLMs need to integrate multimodal evidence[14], retrieve relevant clinical context[15], support multi-turn clarification[16], and produce verifiable outputs across longitudinal patient trajectories to succeed on such tasks. However, this shift also introduces new trustworthiness challenges: How can a Medical MLLM remain faithful to multimodal evidence across multiple rounds of interaction? How can its intermediate reasoning and evidence use be verified during longitudinal monitoring or clinical decision support? Current literature, while extensive in individual pillars of trust, still lacks a synthesized perspective that couples these technical dimensions with the practical demands of multi-scale clinical workflows.

While several surveys have explored the landscape of medical LLMs or general MLLMs, a comprehensive review focusing specifically on the trustworthiness of Medical MLLMs remains absent. As summarized in Table 1, existing works often exhibit specific limitations. Some focus primarily on textual LLMs without addressing multimodal fusion [17,18], while others concentrate on performance metrics over safety and reliability [23,24]. General trustworthy MLLMs surveys have provided valuable discussions of broad dimensions such as truthfulness, robustness, fairness, safety, privacy, and explainability, but these dimensions acquire different meanings and consequences in medical settings. In particular, Medical MLLMs operate on privacy-sensitive patient data, heterogeneous clinical modalities, expert-dependent annotations, and high-stakes decision pathways. Therefore, problems that may be tolerable or recoverable in general-domain applications can become critical in healthcare. For example, hallucinated content may be clinically plausible and difficult for non-specialists to identify; robustness failures may arise from scanner protocols, institutional practices, or rare disease distributions; privacy risks involve identifiable and regulated health information; and explanations must be interpretable not only to model developers but also to clinicians under clinical workflow constraints. Crucially, existing surveys rarely connect trustworthiness dimensions with the multimodal, multi-scale, and workflow-oriented characteristics of Medical MLLMs, which are essential for clinically reliable deployment.

To bridge these gaps, this survey provides a holistic taxonomy and evaluation framework for trustworthy Medical MLLMs, illustrated in Figure 1,. We systematically map the landscape along two intersecting axes: Clinical Granularity (from micro-scale tissues to macro-scale populations) and Core Trust Pillars (truthfulness, robustness, fairness, safety, privacy, and explainability). By grounding these pillars in clinical reality, we offer a road map for moving from “accuracy in controlled experiments” to “reliability in clincical practice”.

The main contributions are summarized as follows:

• Systematic Multi-Scale Clinical Landscape: We establish a holistic framework to categorize Medical MLLMs across four hierarchical clinical scales: tissue, organ, individual, and population. Beyond a simple taxonomy, we provide deep insights into how modality heterogeneity and clinical requirements evolve across these scales, offering a granular understanding of the current clinical landscape.
• Multidimensional Trustworthiness Framework: We propose a structured taxonomy centered on six core pillars of trust: truthfulness, robustness, fairness, safety, privacy, and explainability. For each dimension, we critically analyze failure modes of Medical MLLMs and discuss how these risks manifest in multimodal clinical settings. Each subsection is accompanied by an in-depth discussion of current limitations that need to be overcome in order to align technical evaluation metrics with reliability criteria required for clinical practice.
• Full-Lifecycle Evaluation and Benchmarking Synthesis: We provide a critical review of evaluation paradigms, transitioning from traditional rule-based metrics to frontier “LLM-as-a-Judge” and expert-centric assessments. By presenting a set of task-focused and trust-specific benchmarks, we identify gaps in current standardized testing and offer insights into developing more clinically-aligned evaluation protocols.
• Dynamic and Workflow-Oriented Evaluation: Different from previous literature, we further discuss emerging evaluation settings that move beyond static test cases, including multi-turn clinical dialog, longitudinal patient modeling, tool-supported evidence retrieval, and workflow-oriented simulation. We highlight how these settings expose trustworthiness issues that are difficult to capture with conventional benchmarks, such as evidence accumulation, interaction-induced errors, uncertainty handling, and workflow-level safety. This provides a forward-looking perspective on clinically aligned evaluation protocols for trustworthy Medical MLLMs.

2. Survey Methodology and Taxonomic Framework

This survey was conducted as a scope-oriented review of trustworthy Medical MLLMs, broadly defined as medical or healthcare AI systems that combine language-based understanding or generation with non-text clinical modalities, such as imaging, video, EHRs, physiological signals, omics data, or population-level health data. We included studies when multimodal language capability, language-conditioned clinical reasoning, report generation, dialogue, retrieval, or explanation formed a substantive part of the model design, evaluation, or trustworthiness analysis, without imposing a fixed parameter-count threshold for what qualifies as “large”. Candidate studies were identified through iterative searches of bibliographic databases and scholarly search platforms, including PubMed/MEDLINE, Web of Science, Scopus, IEEE Xplore, ACM Digital Library, Google Scholar, arXiv, medRxiv, bioRxiv, ACL Anthology, and OpenReview. The searches combined terms related to multimodal and large language modelling (e.g., “multimodal large language model”, “vision-language model”, “foundation model”, “medical LLM”, and “generalist medical AI”), clinical application domains (e.g., radiology, pathology, ophthalmology, dermatology, electronic health records, clinical dialogue, and decision support), and trustworthiness concerns (e.g., hallucination, factuality, robustness, fairness, bias, safety, privacy, explainability, evaluation, and benchmark). We further used backward and forward citation tracing from major Medical LLM/MLLM surveys and trustworthiness reviews to identify additional papers that were not captured by keyword search alone [8,10,17,18,23,24]. The literature corpus was last updated on July 2026. Because our objective was to map a rapidly evolving field and develop an analytic taxonomy rather than estimate a pooled effect, we used a scope-oriented narrative review.

Studies were included when they met at least one of the following criteria: (i) they proposed, adapted, or evaluated an MLLM or vision-language foundation model for a medical or healthcare task; (ii) they introduced a benchmark, dataset, or evaluation protocol that measures trustworthiness-relevant behaviour in Medical MLLMs; (iii) they analysed a concrete failure mode, such as hallucination, spurious reasoning, distribution shift, privacy leakage, unsafe recommendation, demographic bias, or lack of interpretability; or (iv) they presented mitigation strategies, governance considerations, or clinical deployment evidence directly relevant to trustworthy Medical MLLMs. We excluded papers whose primary contribution was purely unimodal, non-medical, or unrelated to model trustworthiness, unless they provided concepts or evaluation designs that have been explicitly adopted by Medical MLLM studies. Because the field is evolving rapidly and many Medical MLLM benchmarks first appear as preprints, we considered peer-reviewed articles, preprints, benchmark papers, dataset papers, and technical reports, while prioritizing works with clearly described data, tasks, evaluation protocols, or clinical relevance. Titles and abstracts were screened against these criteria, followed by full-text assessment when eligibility or categorization was unclear.

After screening, we used the included literature to derive the central taxonomy of this survey: six trustworthiness dimensions for Medical MLLMs, namely truthfulness, robustness, fairness, safety, privacy, and explainability. Rather than treating these dimensions as predefined labels, we synthesized them from recurring failure modes, evaluation targets, and mitigation strategies repeatedly emphasized across Medical MLLM studies and adjacent trustworthy AI literature. Specifically, hallucination, factual inconsistency, and lack of evidence grounding motivated the truthfulness dimension; distribution shift, data corruption, missing modalities, and prompt sensitivity motivated robustness; demographic, institutional, and site-level performance disparities motivated fairness; unsafe clinical recommendations, adversarial misuse, and workflow-level harm motivated safety; patient re-identification, memorization, and leakage of sensitive multimodal data motivated privacy; and the need for clinically meaningful rationales, uncertainty communication, and auditable reasoning motivated explainability [5,22,25,26,27]. The clinical granularity axis introduced above, including tissue-level, organ-level, individual-level, and population-level settings, was then used as a contextual lens for interpreting how these six dimensions manifest across different data modalities, workflows, and risk profiles.

Importantly, the six dimensions should be interpreted as an analytic taxonomy rather than as mutually independent categories. In clinical MLLM systems, trustworthiness failures often propagate across dimensions: hallucinated evidence can create unsafe recommendations; privacy-preserving training may affect fairness or robustness; robustness failures under distribution shift may amplify demographic bias; and explanation quality can influence how clinicians detect factual errors or unsafe reasoning. We therefore assign each study to the dimension that best reflects its primary contribution while explicitly noting secondary connections when they shape interpretation. This design also explains why some later discussions overlap across sections. Such overlap is not a redundancy, but reflects the coupled nature of trustworthy Medical MLLMs and motivates the integrative perspective developed in the final section of this survey.

3. Medical Multimodal Large Language Models: Scope and Clinical Landscapes

In this section, clinical granularity is used as an organizational lens rather than as a strict biological hierarchy. We define the four levels by the dominant clinical unit of analysis: tissue-level models focus on local morphology and cellular or lesion-scale evidence; organ-level models focus on anatomy, function, and procedural imaging; individual-level models integrate longitudinal patient information across modalities; and population-level models aggregate signals across cohorts, institutions, or public health systems. This definition clarifies how the same trustworthiness dimensions can manifest differently across data sources, workflows, and deployment risks.

3.1. Tissue Level: Morphological and Cellular Imaging

At the tissue level, Medical MLLMs focus on high-resolution visual evidence whose diagnostic signals are often distributed across cellular morphology, lesion texture, and local spatial organization. Pathology and dermatology therefore place different requirements on multimodal reasoning: pathology models must aggregate information from gigapixel WSIs and connect morphology to report-level semantics, whereas dermatology models must align surface appearance, lesion-level cues, and clinical context. This level consequently emphasizes multi-scale feature aggregation, fine-grained visual grounding, and morphology-aware image-text alignment so that model outputs remain traceable to observable tissue evidence.

3.1.1. Pathology

Pathology AI advances tissue- and cellular-level understanding by integrating gigapixel whole slide images (WSIs) with multimodal semantic information to support diagnostic reasoning and clinical decision-making [28,29]. Recent studies address these challenges from complementary perspectives: WSI-LLaVA introduces a morphology-aware benchmark (WSI-Bench) and a staged training strategy to enhance the explainability and trustworthiness of WSI-level multimodal LLMs [30]. CPath-Omni unifies patch-level and whole-slide-level modeling within a single multimodal foundation model, enabling robust multi-task and cross-scale generalization through a pathology-specialized CLIP framework [31]. PathAlign leverages pathology reports as supervisory signals to align visual and language representations, supporting retrieval, classification, and report generation at the slide level [32]. SlideChat constructs large-scale instruction-following data and benchmarks to enable conversational and instruction-driven understanding of gigapixel WSIs [33]. ChatEXAONEPath adopts a retrieval-based data generation and evaluation pipeline to support expert-level, pan-cancer multimodal reasoning from WSIs [34]. Prov-GigaPath employs ultra-long-context modeling to pretrain on complete WSIs from real-world clinical data, achieving strong performance across cancer subtyping and pathomics tasks [35]. TITAN aligns histopathology images with real and synthetic pathology reports via large-scale vision-language pretraining, demonstrating strong generalization in low-resource and zero-shot clinical scenarios [36].

3.1.2. Dermatology

Dermatology-focused multimodal AI advances tissue-level clinical understanding by integrating high-resolution skin imaging with clinical knowledge [37] to support diagnosis and longitudinal assessment. PanDerm [38,39] establishes a large-scale multimodal dermatology foundation model pretrained on over two million images, achieving robust performance across screening, segmentation, and early melanoma detection through extensive benchmarks and reader studies. To enhance dermatological vision-language alignment, MM-Skin [40] introduces a textbook-derived multimodal dataset, enabling SkinVL to deliver precise and interpretable skin disease understanding across VQA and zero-shot classification tasks. SkinGPT-4 [41] aligns visual encoders with LLM to support interactive dermatological diagnosis and clinically grounded reasoning from skin images. Derm1M [42] further scales vision-language learning with over one million ontology-aligned image-text pairs, enabling robust zero-shot recognition and cross-modal retrieval. Beyond discriminative modeling, DermINO [43] improves generalization and clinical applicability through hybrid pretraining, while SkinGEN [44] enhances transparency by visualizing diagnostic reasoning via image generation.

3.2. Organ Level: Anatomical and Functional Imaging

Compared with cell-level and tissue-level analyses, organ-level medical imaging exhibits substantially greater modality diversity. Common modalities include volumetric radiographic scans (e.g., CT [45] and MRI [46]), planar projection images (e.g., X-ray [47] and fundus photography [48]), and video streams [49] acquired during endoscopic examinations. Beyond visual–language alignment, organ-level analysis requires Medical MLLMs to capture organ-specific structural and functional characteristics and to support trustworthy clinical reasoning. Accordingly, Medical MLLMs must perform large-scale spatial reasoning, extract clinically meaningful semantic representations, and model temporal dynamics in order to generate verifiable and clinically reliable outputs.

3.2.1. Radiology

Radiology represents the most mature application domain for organ-level analysis in Medical MLLMs, largely due to the widespread availability of standardized DICOM imaging data and paired structured reports. Early multimodal systems primarily focused on two-dimensional X-ray interpretation [47], whereas more recent studies have extended to three-dimensional CT and MRI data [50,51]. LLaVA-Med [52] adapts general-purpose vision–language models to the biomedical domain through large-scale self-instruct multimodal data generation and curriculum-based instruction tuning, leading to substantial performance gains on two-dimensional radiograph question-answering tasks. CT2Rep [53] presents the first fully automated framework for radiology report generation from three-dimensional medical imaging. It employs a novel autoregressive causal transformer to encode volumetric CT data and generate clinically coherent chest CT reports. RadFM [1] projects both 2D and 3D radiological images into a unified three-dimensional visual representation space. By leveraging a Perceiver-based module to aggregate visual features and align them with LLMs, RadFM enables a range of downstream tasks, including visual question answering, report generation, and diagnostic reasoning.

3.2.2. Ophthalmology

Ophthalmology benefits from a high volume of standardized 2D imaging, including color fundus photography and optical coherence tomography, making it an ideal domain for Medical MLLMs. MDPipe [54] introduces a clinician-informed multimodal diagnostic pipeline that converts ocular images into quantifiable morphological descriptors, integrates these features with clinical metadata, and leverages LLMs for report summarization and reasoning. VisionUnite [55] constructs an ophthalmology-specific vision–language foundation model by pretraining on large-scale image–text pairs and further fine-tuning on MMFundus multi-turn dialogues. The framework injects sign-level clinical knowledge through a dedicated vision adapter covering six ocular sign categories and aligns visual embeddings with a large language model to support open-ended fundus diagnosis and explanation. However, the long-tailed distribution of ophthalmic diseases, together with limited sample availability, leads to severe underrepresentation of many rare conditions in existing datasets, thereby constraining the performance and generalization of Medical MLLMs. RetiZero [56] reformulates retinal disease recognition as a zero-shot vision–language reasoning problem by aligning fundus and OCT image representations with disease-level semantic descriptions, thereby enabling diagnosis of rare retinal diseases without task-specific training.

3.2.3. Gastroenterology

Unlike static imaging modalities, gastroenterology endoscopic video analysis extends Medical MLLMs into the temporal domain. Such data are often affected by motion artifacts, while frame-level annotation is costly and labor-intensive, substantially increasing the difficulty of supervised learning. ColonGPT [57] introduces a colonoscopy-oriented vision–language framework that aligns endoscopic visual features with LLMs to jointly support polyp detection, classification, and natural-language clinical interpretation. EndoBench [58] establishes a comprehensive benchmark for endoscopic vision–language models by unifying diverse gastrointestinal tasks, datasets, and evaluation protocols. EndoKED [59] proposes a knowledge-enhanced endoscopic vision–language framework that integrates structured medical knowledge with endoscopic visual representations to facilitate interpretable disease understanding and support more reliable diagnosis, reasoning, and explanation in gastrointestinal endoscopy.

3.2.4. Surgical Operation

Surgical robotics and computer-assisted intervention have long supported perception, navigation, and robotic control in the operating theatre. The emerging role of LLMs and MLLMs is not to replace these established foundations, but to add semantic understanding, workflow-level reasoning, natural-language interaction, and high-level surgical action planning on top of visual and sensor-based systems. Surgical AI therefore increasingly transforms the operating theatre into an intelligent environment by integrating high-frequency video streams, instrument trajectories, procedural context, and multimodal clinical data for real-time decision support. This evolution requires systems to maintain exceptional precision while navigating dynamic tissue deformations, intraoperative occlusions, and complex instrument interactions [60]. CSAP-Assist [61] is proposed to model tool-action interdependencies and concurrent multi-tool interactions in collaborative surgical planning. [62] presents an open-source embodied intelligence simulator and a hybrid paradigm to achieve zero-shot simulation-to-reality transfer for laparoscopic tasks. LLM-SAP [63] leverages a Near-History Focus Memory Module to generate future surgical action plans from visual inputs. [64] integrates MLLM-based high-level reasoning with deep reinforcement learning for motion execution to enable autonomous blood suction in robotic surgery. [65] develops a multi-teacher continual learning framework that addresses domain shifts and data imbalance in surgical visual question answering.

3.3. Individual Level: Holistic Patient Modeling

At the individual level, Medical MLLMs aim to build a “whole-patient” representation by integrating longitudinal clinical narratives, structured EHR variables, and continuous physiological signals. This level therefore emphasizes temporal continuity, patient-specific context, and evidence accumulation across encounters, which are essential for personalized diagnosis, prognosis, medication recommendation, and workflow-aware clinical decision support.

3.3.1. Electronic Health Records (EHRs)

The integration of Medical MLLMs with EHRs has become a major research focus in AI for healthcare. It aims to improve clinical diagnosis, disease prediction, and personalized treatment by integrating and analyzing heterogeneous data sources [2,66]. EHRs are inherently multimodal, comprising both unstructured clinical narratives (e.g., progress notes, discharge summaries, and nursing records) and structured tabular elements (e.g., laboratory tests, diagnosis codes, and demographic variables) [67]. The heterogeneity of these data, together with irregular temporal sampling and strong domain specificity, poses distinctive challenges for conventional modeling approaches [68]. Building on this heterogeneity, early deep learning efforts at scale demonstrated the feasibility of scalable representation learning and risk prediction on EHRs from routine clinical practice, laying the groundwork for subsequent work on unified patient state representations [69]. For structured EHRs, researchers have further modeled diagnosis sequences, medications, and encounters as a form of “medical language" and used pretraining based on Transformer architectures to learn transferable patient representations. BEHRT [70] and Med-BERT [71], for example, highlight the value of contextual modeling over serialized structured records and improved generalization when data are limited. For unstructured EHRs, clinical language models leverage pretraining on large clinical text corpora to strengthen the understanding and extraction of narrative evidence. GatorTron [72] exemplifies this direction for EHRs text, while MT-ClinicalBERT [73] systematically improves core clinical information extraction capabilities, including entity recognition and relation extraction, through multitask learning. This provides an important toolchain for converting free text into concepts that can be used reliably for reasoning. A further trend seeks a unified consumption interface across structured and unstructured sources. One representative approach converts multiple streams of structured EHR data into pseudo notes, enabling general purpose language models to ingest tabular information and longitudinal timelines in a more natural textual form for downstream decision support [74]. Meanwhile, generative patient trajectory modeling increasingly treats EHRs histories across repeated visits as a generative timeline for capturing disease evolution and forecasting risk. Representative examples include Foresight [75], which builds generative pretraining over EHR timelines, and DT-GPT [76], which performs inference in the manner of a digital twin over longitudinal health trajectories. These lines of work push unified patient state modeling from static representations toward longitudinal generation and prediction. At the clinical task level, medication recommendation from EHRs typically requires satisfying both effectiveness and safety constraints. GAMENet [77] incorporates knowledge graphs of drug interactions to recommend medication combinations, whereas SafeDrug [78] explicitly integrates molecular structure and interaction constraints into the recommendation objective. These results highlight the value of coupling patient state representations with medical knowledge constraints for prescribing in clinical practice.

3.3.2. Continuous Physiological Monitoring

For continuous physiological monitoring (ECG, EEG, wearables, and other temporal signals), data are typically collected through continuous sampling at a high rate to capture key physiological activities of the human body. These recordings exhibit pronounced temporal dynamics and cover diverse signal types, ranging from cardiac rhythms and brain activity to everyday wearable sensing [79,80,81]. In clinical practice, such data often need to be interpreted together with contextual information, including symptoms and chief complaints, past medical history, medication use, laboratory tests, and imaging findings, to provide a more comprehensive characterization of patient status and a more coherent clinical interpretation [82]. Accordingly, an increasing body of work has begun to incorporate “physiological signals, text, and clinical knowledge" into unified multimodal modeling paradigms to support understanding, retrieval, and generation in continuous monitoring scenarios. GEM [83] supports bidirectional understanding and generation between ECG and text for explanation, report writing, and question answering, while SensorLM [84] learns a wearable sensor language that enables natural language description and retrieval of temporal signal patterns. SuPreME [85] improves ECG pretraining by using textualized cardiac queries and descriptions, and K-MERL [86] incorporates multimodal ECG representations with explicit knowledge augmentation to strengthen the mapping between clinical concepts and signal patterns. NeuroLM [3] treats EEG as a foreign language, aligns EEG representations to the language space through a neural tokenizer, and applies multitask tuning with instruction data to support unified reasoning across tasks. Thought2Text [87] combines EEG embeddings with an instruction tuned language model to generate text directly from EEG, which supports interpretable descriptions of brain states. SzXAI [88] constructs concept embeddings from clinical notes using an LLM and aligns them with EEG encodings so that the system can output both seizure detection results and clinically grounded summaries of etiology and patterns, improving interpretability and trustworthiness.

3.3.3. Multimodal Integration

In individual level multimodal fusion research, a central line of work studies cross modality reasoning, which aligns and jointly infers evidence from organ level visual signals and patient level history, including chief complaints, past medical history, medications, laboratory trends, and related context. This supports more personalized care planning and risk assessment, rather than treating imaging interpretation and record understanding as isolated processes. In this setting, AdaCoMed [89] follows a collaboration paradigm that combines strong representations from multiple unimodal Medical MLLMs with a controllable multimodal fusion and reasoning module, and it uses collaborative learning to better handle limited paired multimodal data in clinical practice. CLIMB [90] complements this line of work by providing a benchmark for whole patient modeling that spans imaging, language, temporal signals, and structured information, enabling systematic and reproducible evaluation of multimodal pretraining and fusion strategies for cross modality reasoning.

Another rapidly growing direction studies workflow-aware Medical MLLMs for clinical decision support. Instead of treating multimodal fusion as a static feature-combination problem, these studies emphasize how patient history, imaging findings, laboratory results, guideline knowledge, and medication constraints can be organized into auditable reasoning processes. For example, clinical decision support systems have explored modular pipelines for EHRs order-set optimization, where evidence retrieval, verification, and recommendation aggregation are separated into interpretable stages [91]. For broader clinical reasoning and diagnostic dialogue, multi-turn conversational systems further highlight the importance of iterative information gathering, evidence accumulation, and consistency checking in complex cases [92,93]. Meanwhile, virtual EHRs environments and clinical interaction simulators are emerging to standardize the evaluation of tool use, retrieval, and staged clinical task execution [94,95]. These settings better reflect clinical reasoning under incomplete information, where hypotheses are progressively checked and conclusions are reached through evidence acquisition over time. Overall, individual-level multimodal integration is moving beyond static feature fusion or direct model outputs toward workflow-aware, auditable, and verifiable MLLMs systems, supported by evaluation protocols that more closely match clinical practice.

3.4. Population Level: Epidemiology and Public Health

At the population scale, the value of trustworthy Medical MLLMs lies in transforming decentralized, heterogeneous clinical data into system-level epidemiological insights and operational decisions. This macro-level synthesis facilitates public health intelligence, optimizes healthcare system management, and supports simulation-based evaluation for policy validation. Unlike individual-level modeling, population-level applications prioritize aggregate trends, resource allocation, surveillance reliability, and policy robustness, while requiring safeguards against ecological bias, uneven data coverage, and privacy risks from cohort-level linkage.

3.4.1. Public Health Intelligence

In the domain of Public Health Intelligence, the deployment of trustworthy MLLMs facilitates the rigorous synthesis of unstructured textual signals and complex spatiotemporal indicators. To address the proliferation of health misinformation on platforms like Twitter/X, Prompt-and-Align [96] synergizes visual evidence with textual claims through a prompt-learning paradigm. By aligning disparate modalities to detect inconsistencies in fragmented social media streams, it significantly reduces the cognitive load on analysts verifying rapid-fire outbreak reports. Complementing this in the realm of Epidemiological Forecasting, PromptCast [97] optimizes Outbreak Detection by utilizing a novel prompt-based learning mechanism that translates continuous historical infection rates and spatiotemporal context into language-aligned sequences. This approach effectively leverages the reasoning capabilities of LLMs to capture long-term pandemic dependencies superior to traditional numerical forecasters, empowering policymakers to preemptively optimize resource allocation strategies.

3.4.2. Healthcare System Management

The integration of MLLMs into hospital operations enables the holistic synthesis of Electronic Health Records (EHRs), bed turnover rates, and staff schedules to optimize critical workflows. AMIE [98] advances triage-oriented clinical dialogue by supporting multi-turn patient interaction and diagnostic reasoning, demonstrating strong performance in diagnostic accuracy and empathy. Such conversational Medical MLLMs can assist preliminary patient stratification and information collection, while still requiring appropriate clinical oversight in high-risk settings. To further streamline the interpretation of complex patient inquiries, CLIPSyntel [99] synergizes CLIP and LLMs to generate context-aware multimodal summaries from fragmented patient descriptions and images, significantly reducing the cognitive load on clinicians during initial screening. Addressing data complexity in Emergency Resource Allocation, Med-Gemini [100] leverages long-context reasoning to aggregate dispersed multimodal EHR data (including clinical notes and vital sign videos), facilitating the precise identification of high-risk patients. Complementing this, Glicksberg et al. [101] demonstrated that integrating LLMs with Retrieval-Augmented Generation (RAG) on triage notes significantly enhances the prediction of emergency department admissions, allowing administrators to preemptively identify bed shortages and optimize resource allocation strategies.

3.4.3. Simulation-Based Policy Evaluation

Beyond surveillance and resource forecasting, simulation-based evaluation provides a controllable way to examine how Medical MLLMs may support policy analysis under complex and evolving public health scenarios. Classical epidemic simulation studies, such as COVID-19 spread modeling with small-world networks [102], provide graph-based structures for representing physical contact patterns and rapid diffusion dynamics across densely connected populations. Recent hospital-scale simulation environments further extend this idea by constructing synthetic clinical workflows and multimodal patient records, including textual complaints and vital-sign logs, to evaluate patient flow, resource scheduling, and bed-turnover policies without exposing real patients to experimental risk [12]. From the perspective of trustworthy Medical MLLMs, the main value of these environments is not the autonomy of simulated roles, but their ability to provide dynamic, auditable, and risk-controlled testbeds for evaluating longitudinal reasoning, evidence accumulation, and workflow-level safety. Overall, simulation-based policy evaluation connects population-level data fusion with clinically aligned assessment, enabling researchers to examine how Medical MLLMs behave under distribution shifts, incomplete information, and evolving operational constraints.

This multi-scale clinical landscape is not intended to prioritize one clinical level or modality over another. Instead, it provides the clinical grounding for the trustworthiness taxonomy developed in the following section. Each trustworthiness dimension applies across tissue-, organ-, individual-, and population-level Medical MLLMs, but its concrete manifestation varies with the underlying data modality, clinical task, and deployment workflow. For example, truthfulness may refer to visual evidence grounding in pathology and radiology, consistency with longitudinal records at the individual level, or faithful aggregation of population-level signals in public health settings. Similarly, robustness, fairness, safety, privacy, and explainability must be interpreted in relation to the specific clinical scale at which the model operates. In this sense, the clinical landscape serves as the structural basis for analyzing how general trustworthiness principles become clinically specific in Medical MLLMs.

4. Taxonomy of Trustworthiness in Medical MLLMs

Building on the multi-scale clinical landscape introduced above, we organize trustworthiness in Medical MLLMs into six interrelated dimensions: truthfulness, robustness, fairness, safety, privacy, and explainability. These dimensions are not specific to medicine in name; rather, their clinical significance arises from how they interact with medical data, expert-dependent validation, patient safety requirements, privacy regulations, and workflow-level deployment constraints.

In this section, we present a unified taxonomy of trustworthiness for Medical MLLMs. This taxonomy is systematically synthesized from established ethical consensus in medical AI, recurring practical pain points in clinical deployment, and emerging regulatory frameworks [9,10,27,201,207]. Accordingly, we decompose trustworthiness into a set of core and interrelated dimensions that capture the stringent requirements for reliable application in high-stakes clinical settings, including truthfulness, robustness, fairness, safety, privacy, and explainability, as shown in Figure 2.

4.1. Truthfulness

4.1.1. Conceptual Overview

Hallucination Mitigation.

As shown in Figure 3, truthfulness in Medical MLLMs requires that key clinical statements in the model output are supported by verifiable evidence from the input and external resources, and that they remain evidence consistent across modalities and across multiple turns of interaction. Here, evidence includes visual or temporal signals such as medical images and physiological signals, as well as textual sources such as clinical notes, laboratory tests, and curated clinical knowledge resources. Conversely, when a model generates content that is not supported by evidence or that contradicts the evidence, it manifests the hallucination phenomenon that warrants particular caution in medical settings [8,103].

In Medical MLLMs, hallucination typically refers to cases where key clinical statements cannot be verified by the input evidence, or directly conflict with the evidence at the factual level [8,104,105]. Evidence includes not only organ level imaging and signals, such as CT, MRI, X-ray, ultrasound, and pathology, as well as ECG, EEG, and wearable time series data, but also patient level traceable information, such as clinical narratives, laboratory tests, diagnosis codes, and longitudinal timelines [106]. More concretely, these truthfulness failures can be summarized into two recurring forms with different risk profiles in medical visual question answering, report generation, and multi-turn dialogue: object hallucination and faithfulness hallucination [8].

Object hallucination occurs when a model generates clinically plausible findings or entities that are not supported by the input evidence. This issue is especially salient in automated radiology report generation and image interpretation systems, because models can be driven by frequent templates and disease co-occurrence patterns in training corpora, producing false positive descriptions where language priors dominate and visual grounding is weak. As a result, the system may fabricate pneumonia, pneumothorax, pleural effusion, fractures, or abnormal catheter positions that are not present, and such errors can propagate into downstream decisions, motivating clinically grounded factuality evaluation and deployment-time constraints [107,108]. Critically, object hallucination is not limited to imaging. In EHR-based settings, models may similarly complete non-existent diagnoses, symptoms, medication history, or laboratory results during note summarization or information extraction. Systematic evaluations on unstructured clinical notes report non-trivial hallucination and inconsistency, often expressed with high confidence, which poses practical safety risks [5]. Recent work also proposes structured evaluation and grading frameworks that treat clinical safety and hallucination rate as core metrics for summarization systems [103]. In continuous monitoring and waveform interpretation, object hallucination can appear when models provide specific and definitive arrhythmia types, seizure conclusions, or risk stratification explanations without sufficient signal evidence or key context; broader discussions of general-purpose LLM risks in medicine repeatedly emphasize the need to bind outputs to traceable records and to introduce verification and audit mechanisms in high-stakes steps [109,110]. Similar concerns extend to wearable device applications, where personal health language models can still produce statements that misuse user data or domain details in real-world evaluations, highlighting the importance of aligning generated content with sensor evidence and enforcing verifiable guardrails [111].

Faithfulness hallucination emphasizes a different failure mode where a relevant entity exists, but the model’s description is not faithful to the evidence. The model may not fabricate a completely new finding; it deviates in attributes, relations, negation polarity, or conclusions, so that the text cannot be supported in a closed loop by the input evidence. Typical forms include laterality or location errors, incorrect severity or extent judgments, wrong temporal trend, flipping negation and uncertainty, and structural inconsistencies. This failure is often subtle in multimodal reasoning and report generation, because the text can look professional while introducing directionally wrong conclusions that are not verifiable. For chest X-ray report generation, systematic evaluations show that conventional n-gram similarity metrics correlate weakly with clinical factuality, motivating explicit factuality metrics and fine-grained error taxonomies to capture cross-sentence and cross-paragraph unfaithfulness [107]. Clinician-centered evaluations further highlight that faithfulness errors directly affect clinical usability and trust formation, reinforcing the need for expert review and use context assessment when measuring consistency and safety [108]. Faithfulness hallucination also appears in EHR-centered generation and summarization tasks, for example through timeline confusion, mismatch of key history facts, or inconsistencies between conclusions and source records; comparative evaluations and clinical safety frameworks likewise identify faithfulness deviation as a distinct risk source that requires targeted characterization and constraints [103,112]. Methodologically, a common evaluation strategy is to leverage structured information extraction for factual alignment, such as using entity-relation graph schemas and labelers to compare generated and reference reports at the level of entities, attributes, and relations, enabling direct localization of laterality, negation, severity, and relation errors [113,114].

4.1.2. Mitigation Strategies

In domains of high risk such as healthcare, hallucination in Medical MLLMs severely limits their practical application. To address this challenge, existing research primarily explores effective methods to mitigate hallucinations from three key aspects: data quality control and enhancement, model architecture optimization, and strategies for decoding and processing during the inference stage.

High quality medical data form the foundation for mitigating hallucinations in Medical MLLMs, because the accuracy of training labels, the diversity of clinical coverage, and debiasing procedures directly shape whether seemingly plausible generations can be grounded in verifiable evidence. Early large scale deep learning on real-world EHRs demonstrated that, when cohorts are sufficiently large and when labeling and cleaning pipelines are reliable, models can learn scalable patient representations and deliver robust risk prediction. This established both the data and engineering basis for later work on unified patient state representations [69]. For structured EHRs, Med-BERT showed that pretraining on large structured longitudinal record sequences improves transfer performance for disease prediction tasks, which also highlights that standardized event representations, terminology normalization, and noise control are important prerequisites for improving truthfulness in downstream use [71]. In multimodal radiology, data level factuality evaluation and alignment are equally critical. Clinical evaluations for chest radiography indicate that generative reporting can produce false positive statements that describe absent abnormalities as present. This motivates clinically grounded factuality protocols and dataset constraints that suppress object hallucination induced by template priors and co occurrence bias during training [108]. Real-world studies of clinical documentation automation further suggest that, when training corpora contain noise and missingness in handoff notes or summaries, models may fabricate details during summarization and introduce unsafe content. High risk documentation tasks therefore require stricter data review, graded error annotation, and evidence traceability mechanisms [115]. At the augmentation level, recent vision language pretraining research improves grounding by constructing higher quality image text pairs and strengthening alignment supervision, for example through contrastive objectives and finer semantic alignment. This reduces reliance on language priors and increases dependence on visual evidence, providing an important data driven support for lowering image related hallucinations [116]. More recent work also constructs clinical controls or counterfactual style examples that align true evidence with confusable negative cases, training models to distinguish evidence supported statements from plausible but unsupported claims [117]. Another form of data control uses fine grained forgetting and data deletion, which removes selected samples or concepts after training to selectively weaken object hallucination tendencies [118].

From the perspective of architecture optimization, mitigating hallucinations in Medical MLLMs centers on reducing cases where strong language priors suppress multimodal evidence, and on ensuring that representations, alignment, and reasoning pathways remain evidence centered. One representative direction strengthens cross modal evidence injection and alignment through improved vision language connection designs, which increases the dependence of generation on input evidence. Flamingo injects visual tokens into a language model using gated cross attention, and this structural choice makes language generation condition more directly on visual content. Such controllable cross-attention designs have become an important paradigm for subsequent MLLMs [119]. In clinical settings, similar principles can be extended to joint inputs that combine imaging, text, and structured variables, so that conclusions follow an interpretable evidence fusion path rather than being produced from templated language patterns that lack support. A second major direction introduces structured medical knowledge as explicit constraints to reduce factual deviations and unsafe recommendations. Knowledge graphs and rule based constraints do not only add external knowledge, but also provide an auditable reasoning scaffold. This is especially important for safety critical tasks such as medication decision making. GAMENet [77] incorporates a drug drug interaction knowledge graph to reduce the risk of unsafe medication combinations. SafeDrug [78] further integrates molecular structure and interaction constraints into the recommendation objective, highlighting the value of jointly modeling patient representations and medical knowledge constraints for safe prescribing. For Medical MLLMs, the implication is that outputs involving high risk clinical statements should route key conclusions through knowledge based checks or filters, which helps suppress fabrication and attribute relation errors. In addition, real-world deployment faces distribution shift and continuous knowledge updates. Continual learning and drift monitoring therefore form an important architectural component. Prior work [120] in clinical environments emphasizes the need for ongoing monitoring, with update strategies triggered when drift or performance degradation is detected, to prevent the accumulation of inconsistent or erroneous inferences over time. Complementarily, foundation model pretraining for structured EHRs, which treats diagnosis, medication, and encounter sequences as a medical language and uses Transformer models to learn contextual patient representations, provides stronger bases for patient state understanding and reasoning [70,71]. This can indirectly reduce speculative generation that results from insufficient representations. Overall, architecture optimization for hallucination mitigation is typically a system-level design that closes the loop among evidence injection, knowledge constraints, and update ready deployment, making it harder for models to output professional sounding but unverifiable statements.

Inference-time post-processing and decoding strategies aim to bind model outputs to evidence and apply auditable verification or correction during generation or after generation, thereby reducing object hallucination and faithfulness errors. Retrieval-augmented generation introduces authoritative external sources such as guidelines, knowledge bases, prior records, and structured test results as explicit evidence during inference, which reduces factual drift that arises when models rely only on parametric memory [121]. The retrieval-augmented generation framework was first formalized in general generation and later adopted widely in medical text and imaging workflows to strengthen evidence traceability and factual consistency [122]. Verification based methods decompose answering into multiple stages. A model may first generate a candidate conclusion, then extract key claims at the statement level, and finally check each claim against available evidence, optionally using an independent verifier to audit factual consistency. In radiology reporting and clinical generation tasks, these pipelines are often combined with structured fact extraction tools that align text at entity, attribute, and relation levels. This makes it easier to localize clinically critical errors such as laterality, anatomical location, negation polarity, severity, and temporal trend [113,114]. Decoding and post-processing methods that intervene in token generation are also developing rapidly. A representative approach uses contrastive decoding to make language generation more strongly constrained by visual evidence, suppressing object hallucinations that appear plausible but are not supported by evidence. Visual contrastive decoding has been shown in top-tier work to systematically reduce hallucination tendencies in multimodal models [123]. Related visual retracing strategies trigger renewed attention to visual evidence when the model becomes uncertain or is likely to fabricate key details, mirroring clinical reading behavior that re-checks the original study, and reducing errors driven by modality priors [124]. Finally, uncertainty-aware decoding makes cautious behavior explicit, for example by suppressing low confidence segments, triggering abstention, or recommending additional tests. This is particularly important in high-risk medical settings, where trustworthy deployment requires uncertainty-aware generation, abstention mechanisms, and evidence-grounded workflow safeguards [125].

4.1.3. Insights

Truthfulness in Medical MLLMs is about whether each key claim is supported by traceable evidence and whether uncertainty is stated honestly. When this requirement is not enforced explicitly, the model can drift into hallucination. It may deliver confident diagnoses without sufficient visual support, rely on high-frequency textual associations to fill in rare or atypical cases, or present internal uncertainty as certainty. Therefore, hallucination mitigation should be framed as operationalizing truthfulness as a generation rule. The model should produce evidence grounding alongside the answer, such as referenced ROIs, slices, or structured clinical fields, and report calibrated confidence with risk stratification. It should also perform cross-modal verification and consistency checks as a validation gate, and trigger abstention or recommend additional tests when evidence is insufficient. Evaluation should move beyond accuracy to a joint framework that measures claim–evidence consistency, uncertainty calibration, and cost-sensitive clinical risk, and it should be aligned with tiered clinical workflows to achieve reliable, controllable, and auditable deployment. In this sense, reliability is treated as an operational consequence of truthfulness: truthful outputs should remain evidence-grounded, calibrated, and clinically dependable across repeated use.

4.2. Robustness

4.2.1. Conceptual Overview

Robustness in Medical MLLMs refers to the model’s stability and reliability under non-ideal or shifting conditions, ensuring consistent performance even when inputs deviate from the training distribution or contain imperfections [126,127].

A robust Medical MLLM should maintain stable, clinically consistent, and well-calibrated outputs across diverse clinical scenarios (different institutions, populations, modalities, etc.) while minimizing errors and avoiding catastrophic failures [128], as illustrated in Figure 4. This encompasses resilience to distribution shifts, noise and artifacts, missing or incomplete multimodal data, and variations in user prompts. Importantly, robustness also implies resistance to malicious manipulations, so that external perturbations or adversarial inputs do not compromise the model’s integrity [129].

Without sufficient robustness, an AI system that performs well in controlled settings may falter in real-world practice. For example, recent benchmark evaluations of medical VLMs found that introducing significant noise or unfamiliar imaging modalities causes models to make inaccurate judgments rather than safely abstaining [9]. Ensuring robust behavior is therefore foundational for trustworthy deployment in healthcare, closely tied to patient safety and consistent clinical decision support.

4.2.2. Distributional Robustness (Out-of-Distribution Generalization)

Distributional robustness refers to the ability of Medical MLLMs to maintain reliable performance when deployed under data distributions that differ from those observed during training [130]. In real-world healthcare environments, such distributional shifts are pervasive and arise along both cross-sectional and temporal dimensions. As Medical MLLMs are expected to operate across diverse institutions and over extended periods of time, robustness to these shifts is a foundational requirement for trustworthy clinical deployment.

Extensive empirical evidence from medical imaging has demonstrated that models trained on data from a single institution or scanner often exhibit substantial performance degradation when evaluated on data from unseen clinical sources [131,132]. Importantly, the severity of this degradation is modality-dependent. MRI-based models typically suffer the most pronounced performance decline due to high variability in pulse sequences and reconstruction pipelines, while X-ray models experience moderate drops, and CT models are relatively less affected, which has been attributed to stronger standardization of CT acquisition and reconstruction processes [133,134]. In the context of Medical MLLMs, cross-sectional distributional shifts are further amplified by the integration of heterogeneous modalities [135]. Beyond visual variability, textual and semantic shifts also arise from differences in clinical documentation styles, reporting conventions, terminologies, and institutional guidelines across healthcare centers [136,137]. When trained on limited or homogeneous clinical sources, Medical MLLMs may implicitly encode site-specific correlations, leading to fragile multimodal alignment and degraded reasoning performance under out-of-distribution conditions [138,139].

In addition to cross-sectional shifts, temporal distributional shifts, commonly referred to as concept drift, constitute another critical challenge for distributional robustness. Over time, healthcare data distributions evolve due to changes in disease prevalence, treatment guidelines, diagnostic criteria, coding standards, and clinical workflows [140]. Longitudinal analyses have shown that clinical AI systems can experience significant performance decay as these temporal changes accumulate, even when initial deployment performance was strong [141,142]. For example, a locked model that was calibrated on last decade’s patient population might mispredict outcomes when disease incidence or management protocols have changed. Indeed, studies have documented that even FDA-approved medical AI algorithms show accuracy decay over time due to changes in case mix and clinician behavior [143]. Therefore, for Medical MLLMs, temporal drift poses compounded risks, as both visual inputs and clinical language evolve over time, potentially disrupting learned multimodal alignments and reasoning pathways.

To address distributional shifts along both cross-sectional and temporal dimensions, recent studies on MLLMs highlight the necessity of training and evaluating models across heterogeneous institutions, imaging protocols, and patient populations, in order to improve out-of-distribution generalization under real-world clinical variability [163,164]. Beyond dataset-level interventions, domain-invariant and modality-aware representation learning strategies have been explored to mitigate domain-specific biases in Medical MLLMs, enabling more robust cross-site and cross-task transfer [165,166]. Furthermore, a lifecycle-oriented deployment paradigm has been increasingly advocated for medical foundation and multimodal models, emphasizing continuous performance monitoring, robustness auditing, and specification-aware evaluation to detect and mitigate temporal drift after deployment [167]. At the methodological level, adaptive inference strategies such as test-time adaptation (TTA) have recently been extended to medical vision-language models, allowing models to dynamically adjust modality-specific representations during deployment without requiring full retraining, thereby improving robustness under distributional shifts [168].

Collectively, robustness to both cross-sectional and temporal distributional shifts is essential for ensuring reliable out-of-distribution generalization and safe real-world deployment of Medical MLLMs.

4.2.3. Data Quality & Perturbation Robustness

Robustness also entails resilience to imperfections in the input data arising from natural variability or adversarial interference [144]. In clinical practice, data are often noisy or incomplete. Medical images may contain motion blur due to patient movement, low contrast, or noise caused by device limitations or low-dose acquisition, as well as modality-specific artifacts. Similarly, physiological signals and sensor data can suffer from dropouts or measurement noise. A trustworthy medical model should remain reliable under such conditions and avoid severe misinterpretations. Nevertheless, existing studies show that many current models are highly sensitive to these perturbations [126]. Common medical image artifacts, such as motion artifacts in OCT or metal-induced distortions in CT, can substantially degrade performance, leading to false positives by mimicking pathological patterns or false negatives by obscuring true abnormalities [145]. A recent robustness evaluation of MLLMs found that state-of-the-art medical models were insufficiently robust to common image artefacts: when tested on images with various simulated artefacts (noise, motion, cropping, etc.), all the models showed significant performance declines compared to clean data [146]. These findings underscore the need to explicitly incorporate data quality considerations into model design. Possible mitigation strategies include training data augmentation with realistic artefacts to make the model invariant to them, using image quality assessment modules to detect poor-quality inputs, or model architectures that can learn to discount uncertain regions. Ensuring robustness to natural corruptions means the model doesn’t overreact to minor data flaws, or at least knows when its input is too compromised to give a confident answer, instead of outputting a potentially dangerous guess [9].

Distinct from the above “natural” noise, adversarial perturbations refer to inputs intentionally crafted to fool the model while remaining nearly imperceptible to humans [147]. In high-stakes domains like medicine, such attacks could be used maliciously (e.g., altering an image or a clinical note to hide a critical finding or to trigger a false alarm). Research has demonstrated that even tiny pixel-level modifications can flip a model’s diagnosis from benign to malignant (or vice versa) without an obvious visual difference [148]. For instance, prior dermatology studies showed that adding a carefully computed noise pattern to a skin lesion image changed a classifier’s output from “benign mole” to “melanoma” with high confidence [149]. Similarly, in ophthalmology, applying adversarial noise to retinal images caused deep networks to miss diabetic retinopathy that was otherwise easily detected, with model accuracy dropping to nearly random guess levels under attack [150]. These adversarial vulnerabilities pose a serious threat: an attacker who gained access to imaging data or model inputs could potentially trick the system into misdiagnosing patients. A recent review on adversarial AI in radiology emphasizes that medical imaging models are indeed vulnerable to such imperceptible attacks and outlines how false negatives (e.g., subtle perturbations erasing signs of disease) or false positives can be induced by adversaries [151]. The clinical implications include not only direct patient harm from incorrect diagnoses but also erosion of trust if clinicians cannot be sure of a model’s reliability under potential tampering [152]. To bolster robustness against adversarial perturbations, researchers are exploring defense techniques like adversarial training (exposing the model to adversarial examples during training so it learns to resist them), input transformation or denoising steps, and certified robustness approaches that provide guarantees on model behavior under bounded input changes [146]. For Medical MLLMs that take both images and text, an adversarial attack could also come in the form of a carefully constructed clinical note or prompt that triggers an unsafe recommendation. Hence, robust models should incorporate verification steps, for example, cross-checking image findings with textual evidence, and possibly cryptographic or authenticated input pipelines [19] to ensure that what the model “sees” has not been surreptitiously altered. Robustness to adversarial perturbations ultimately means maintaining diagnostic integrity: the model’s outputs should not be easily manipulable by small, malicious tweaks, thereby protecting the safety and security of clinical decisions [169].

4.2.4. Modal Incompleteness (Missing Modality)

Trustworthy medical AI must handle the frequent occurrence of missing or incomplete data in real-world clinical settings. In multimodal tasks that integrate imaging, laboratory tests, and clinical text, some modalities are often unavailable for certain patients. A robust Medical MLLM should therefore support partial-modal inference, such that meaningful outputs can still be produced when one or more expected input modalities are missing [153]. In clinical practice, a model may normally rely on radiological images, pathology reports, and laboratory results to answer clinical questions. If laboratory results are unavailable at inference time, the model should continue to utilize the remaining available modalities and provide a reasonable prediction, ideally with appropriate uncertainty, rather than failing or producing unreliable outputs [154]. However, many existing multimodal models [155,156] are developed under the assumption of complete modality availability and lack explicit mechanisms to accommodate missing inputs. This rigidity can cause significant performance drops whenever a modality is absent at test time. Importantly, missingness in clinical workflows may also be informative rather than random. The absence of a laboratory test, prior imaging study, medication record, or physiological signal can reflect triage decisions, resource constraints, disease severity, or local documentation practice. Robust Medical MLLMs should therefore distinguish informative missingness from accidental data loss and avoid treating all absent inputs as interchangeable noise.

To combat this, researchers have proposed several strategies [170,171]. One approach is modality dropout training where during model training some inputs are randomly dropped out or masked [170]. This forces the model to learn redundancies and not become overly dependent on any single modality [172]. By simulating missing data scenarios, the model can learn to fall back on the available signals to maintain diagnostic integrity [173]. Another approach is to design special fusion architectures that can dynamically re-weight or re-route information depending on which modalities are present [174]. For example, some frameworks utilize modality-specific tokens or gating mechanisms that turn off the missing modality’s pathway and adjust the integration of remaining features [154,175]. In one study, a transformer-based fusion model with modality-specific tokens was able to maintain strong performance even when some inputs such as structured data or clinical text were absent, outperforming baseline models that would otherwise break when data were incomplete [154]. There are also efforts in imputation, generating a plausible substitute for the missing modality from the available ones, though this can be risky if the imputation results in misaligned or uncertain generations [171].

Overall, robustness to missing modalities requires that Medical MLLMs remain operational when certain inputs are unavailable, relying on the available information while appropriately reflecting increased uncertainty. In practical deployment, this entails explicitly conditioning predictions on the observed modalities rather than assuming complete data, thereby preserving reliability across real-world clinical scenarios where comprehensive inputs are often unavailable.

4.2.5. Prompt Robustness

Prompt robustness, often characterized as prompt volatility or instruction instability, refers to the susceptibility of Medical MLLMs to minor linguistic variations in input phrasing that do not alter clinical intent but trigger significant fluctuations in diagnostic output [25,157]. In safety-critical clinical environments, this sensitivity represents a fundamental barrier to deployment because identical queries phrased differently by different practitioners might elicit conflicting conclusions [158]. Recent empirical evaluations indicate that state-of-the-art models exhibit discrete disagreement rates as high as 36% when presented with semantically identical paraphrases [157]. This brittleness is largely attributed to a mapping deficiency where models fail to consistently associate learned visual features with synonymous semantic descriptors across varying prompt templates [159]. This issue is further compounded in specialized medical domains like fetal ultrasound, where near-synonymous terms for distinct pathologies are frequently conflated unless they are explicitly aligned through token-level disentanglement or domain-specific pre-training [160]. For clinical deployment, prompt robustness should also cover multilingual queries, low-health-literacy patient descriptions, abbreviation-heavy clinician notes, and institution-specific documentation styles. These inputs may express the same clinical intent but differ substantially in vocabulary, grammar, and implicit assumptions, making semantic invariance essential for safe interactive use.

Beyond single-turn stability, medical consultations require multi-turn robustness to remain reliable when confronted with misleading or biased context in subsequent interactions. Findings from the MedQA-Followup benchmark suggest that while models may perform reasonably well under shallow perturbations in an initial prompt, they exhibit severe vulnerabilities in multi-turn settings [161]. For instance, accuracy for some high-performing models has been observed to drop hard when their responses are challenged by a user [161]. Furthermore, current clinical safety evaluations reveal that models remain vulnerable to jailbreak prompts that subtly rephrase harmful instructions while simultaneously over-refusing safe queries that use atypical but clinically valid medical phrasing [162].

The objective of current research is to achieve semantic invariance, ensuring that model predictions are driven by foundational user intent rather than superficial articulation. To quantify this, researchers have introduced the Prompt Sensitivity Index (PSI), which is a dual-metric framework that measures token-level divergence and embedding-based similarity to assess output stability [157]. Modern benchmarks such as CareQA address these challenges by evaluating models across multi-step rephrasings to ensure that questions remain stable regardless of wording [176]. At the methodological level, techniques such as PromptSmooth utilize prompt learning to certify model robustness against input noise [177]. Automatic optimization frameworks like AutoMedPrompt leverage textual gradients to refine system prompts specifically for the complex reasoning patterns essential in clinical tasks [178]. Additionally, the adoption of Relaxed Perplexity as an evaluation metric allows for a more semantically-grounded assessment that prioritizes medical correctness over exact n-gram matching, which better accommodates the verbose reasoning traces common in instruction-tuned MLLMs [176].

4.2.6. Insights

Robustness in Medical MLLMs is a multi-dimensional system property that reflects the ability to maintain stable reasoning and prediction under compounded sources of uncertainty encountered in real-world clinical deployment. Rather than isolated failure modes, robustness emerges from the interaction of distributional generalization, data quality resilience, modality availability, and prompt stability. Recent studies increasingly suggest that robustness under distribution shift is closely tied to learning causal and domain-invariant representations, mitigating reliance on site-specific correlations and shortcut patterns. From a deployment perspective, semantic invariance and uncertainty-aware inference are essential to ensure that predictions are driven by clinical intent rather than superficial input variations, while remaining reliable under incomplete or degraded inputs.

Collectively, these observations indicate that robustness in Medical MLLMs is inseparable from safety and fairness. Models that generalize reliably across institutions, time, and user interactions are inherently less prone to harmful failures and unintended biases, underscoring the need to treat robustness as a core design and evaluation principle rather than a post-hoc performance attribute.

4.3. Fairness and Bias

4.3.1. Conceptual Overview

Equity and bias in Medical MLLMs are fundamentally determined by two structural challenges: dataset imbalance and spurious correlations, as illustrated in Figure 5. Dataset Imbalance is characterized by the significant under-representation of specific demographic cohorts or pathological classes within training corpora. The intrinsic heterogeneity of clinical data results in skewed class distributions, which directly degrades diagnostic precision and reliability for minority populations [179]. Furthermore, such imbalances risk perpetuating debunked race-based medical misconceptions embedded in historical data, leading models to propagate systemic healthcare inequities rather than correcting them [180]. Spurious Correlations, manifesting as shortcut learning [181], occur when models exploit non-causal associations between irrelevant artifacts and diagnostic labels rather than discerning robust pathological features [182]. This reliance on confounding variables, such as hospital-specific metadata or acquisition protocols, severely hinders the capacity of medical AI to generalize to external datasets or novel clinical environments [183].

4.3.2. Fairness Evaluation and Benchmarking

Fairness in Medical MLLMs extends beyond demographic variables such as age, sex, and ethnicity. It also includes clinical subgroups defined by disease prevalence, comorbidity burden, disability status, language, socioeconomic status, insurance or care access, institution, scanner protocol, geographic region, and rare disease representation [247].

To systematically quantify the impact of these structural challenges, MedFair[27] and CARES[9] established foundational frameworks for multi-dimensional benchmarking. These protocols utilize Pareto frontiers to explicitly visualize and quantify the intrinsic trade-offs between predictive utility and fairness, prioritizing metrics such as Group-wise Performance and Equalized Odds to detect subtle discrimination.

4.3.3. Mitigation Methods

To effectively counteract the structural inequities and distribution shifts identified in the evaluation phase, contemporary research has consolidated around two distinct methodological paradigms: data-centric generative augmentation and algorithm-centric inference refinement.

Data-Centric Approaches

At the data level, Generative Artificial Intelligence (GenAI) has emerged as a pivotal tool for rectifying dataset imbalances, moving beyond traditional re-sampling techniques. As systematically elucidated by [187], GenAI facilitates a paradigm shift in biomedicine by creating high-fidelity synthetic data that captures complex biological variabilities often missed by standard augmentations. Building on this foundation, [188] and [189] validate the specific efficacy of generative balancing strategies. Unlike simple oversampling, these methods synthesize diverse samples to actively populate the sparse regions of the minority class manifold, thereby significantly enhancing fairness metrics under distribution shifts without compromising predictive excellence. Furthermore, targeting the root cause of demographic scarcity, FairDiff [190] functions as a specialized domain-specific generation technique. This method employs a conditional point-to-image diffusion model, which leverages sparse spatial guidance to synthesize structurally consistent and inclusive training samples for underrepresented demographics. Nevertheless, synthetic data should be treated as a fairness aid rather than as a substitute for representative clinical evidence. If generative models reproduce artifacts, omit rare presentations, or synthesize unrealistic combinations of demographic and disease attributes, augmentation may mask rather than correct inequity. Fairness-oriented use of synthetic data therefore requires provenance tracking, subgroup validation, and clinician review.

Algorithm-Centric Approaches

In parallel, algorithmic interventions focus on enhancing the internal robustness of models against spurious correlations and calibrating the inference process of MLLMs. Addressing the instability inherent in few-shot scenarios, [191] scrutinized the calibration biases within in-context learning. It identified that demographic unfairness often stems from the model’s sensitivity to example selection and proposed calibration strategies to rectify decision boundaries, thereby aligning model confidence with clinical reality. Complementing this, [192] introduced a framework incorporating semantic interaction and adaptive refinement prompting. By dynamically adjusting prompt embeddings based on cross-modal feedback, this method iteratively suppresses intrinsic bias to ensure precise alignment between visual features and textual descriptions. From a causal perspective, [193] utilized counterfactual reasoning in medical question answering. By constructing counterfactual interventions, effectively asking “what if" questions regarding patient attributes, this approach disentangles pathological features from confounding demographic factors. Furthermore, scaling fairness to MLLMs, FairCLIP [184] enforces fairness constraints directly within the vision-language embedding space. By minimizing the mutual information between feature representations and sensitive attributes, FairCLIP prevents the encoding of demographic biases during the pre-training phase, ensuring generalizable equity across downstream tasks.

4.3.4. Insights

The trajectory from problem definition to mitigation strategies highlights a critical consensus: fairness in Medical MLLMs is not merely a statistical optimization objective but a fundamental structural and causal challenge. While definitions identify dataset imbalance and spurious correlations as the root sources of bias, advanced evaluation frameworks reveal that these vulnerabilities often remain latent in static benchmarks, only manifesting destructively under real-world distribution shifts. Consequently, the field is evolving beyond superficial corrective measures toward a holistic defense mechanism: leveraging GenAI to structurally reconstruct the data manifold and causal reasoning to mathematically disentangle pathology from demographic confounders. This convergence suggests that future robust medical AI must treat fairness as an intrinsic component of generalization capability, ensuring that models do not just predict accurately, but reason correctly across diverse clinical realities.

4.4. Safety

4.4.1. Conceptual Overview

The clinical deployment of Medical MLLMs introduces significant safety concerns, ranging from intentional adversarial exploitations to unintended diagnostic harms. This section categorizes current research into adversarial attacks, defense mechanisms, and evaluation benchmarks to provide a comprehensive overview of the safety landscape, as shown in Figure 6. To connect technical safety research with clinical practice, we distinguish between vulnerabilities that are merely demonstrable in controlled experiments and failures that are plausible, persistent, and clinically consequential in real workflows. Deployment decisions should therefore prioritize patient harm, escalation requirements, and workflow-level risk rather than adversarial novelty alone.

4.4.2. Attack

Adversarial attacks in the medical domain aim to compromise model integrity, leading to misdiagnosis or the dissemination of misinformation. These threats manifest through various stages of the model lifecycle, from pre-training to inference. At the data and training level, [194] demonstrates that replacing only 0.001% of training tokens with misinformation can make models generate harmful content, while [11] reveals that medical LLMs are vulnerable to both malicious prompt injections and fine-tuning with poisoned samples across multiple clinical tasks. Similarly, [195] shows that manipulating a tiny fraction of model weights via gradient-based methods can deliberately inject incorrect biomedical facts. Regarding multimodal-specific threats, [196] highlights a critical flaw where sub-visual prompts embedded in oncology images can trigger harmful misdiagnoses. 2M-attack and O2M-attack [197] further exploit these vulnerabilities by integrating clinical data with atypical natural phenomena to achieve cross-modality jailbreaking. Beyond direct output manipulation, ADA-Steal [198] presents a novel threat where attackers steal medical multimodal models using only publicly available natural images. Finally, models are shown to be highly susceptible to adversarial hallucination attacks in clinical decision support [199], contributing to a broader spectrum of cybersecurity threats including privacy breaches and unauthorized data manipulation [200].

4.4.3. Defense

Effective defense strategies must be multi-layered, encompassing technical alignment, real-time monitoring, and robust regulatory frameworks. These measures aim to mitigate the risks identified in adversarial research and ensure patient safety. From a technical perspective, [201] defines medical safety based on ethical principles and demonstrates that fine-tuning on safety-specific demonstrations significantly enhances model resilience. To address real-time operational risks, a guardrail framework [202] is proposed for pharmacovigilance to detect anomalies and convey uncertainty in generated medical content. Furthermore, [203] explores comprehensive mitigation strategies for privacy and security challenges across the generative AI lifecycle. Regarding human-centric safety, [204] critiques the limitations of clinician vigilance as a safeguard, while [205] and [206] emphasize the necessity of developing safe implementation guidelines and continuous monitoring to bridge safety gaps in clinical care. From a legal standpoint, the EU AI Act [207] establishes a risk-based regulatory framework that imposes compliance obligations on high-risk AI-enabled medical devices to ensure systemic safety.

4.4.4. Evaluation

Standardized evaluation is the cornerstone of building trustworthy medical AI, shifting the focus from mere performance to rigorous safety and ethical auditing. Modern benchmarks aim to simulate complex clinical environments and diverse failure modes. Comprehensive assessment tools have emerged to quantify these risks, most notably CARES [9], which evaluates Medical Vision-Language Models across 16 imaging modalities and five key trustworthiness dimensions. Complementing this, SafeBench [208] introduces a jury deliberation protocol to reveal widespread safety issues in mainstream MLLMs through a harmful query dataset. Specialized ethical evaluation is provided by MedSafetyBench [26], which tests models against 1,800 harmful medical requests based on professional medical ethics. To address the lack of standardized human-centric assessment, the QUEST framework [209] offers a structured protocol for evaluating information quality and safety in scenarios like patient triage. Ultimately, as argued by [210], the successful integration of these models into healthcare depends on regulators strictly enforcing such safety standards to mitigate the risks of layperson-facing health applications.

4.4.5. Insights

From the attack perspective, existing studies primarily demonstrate that Medical MLLMs are vulnerable to data poisoning, prompt injection, and multimodal jailbreaks under carefully constructed settings, yet these works often abstract away clinical context and do not distinguish between theoretically possible attacks and those that are practically scalable or clinically consequential. Future research should therefore emphasize threat models grounded in real-world deployment, prioritizing attacks by their feasibility, persistence, and potential for patient harm rather than by adversarial novelty alone. From the defense perspective, most current solutions rely on post hoc alignment, heuristic guardrails, or task-specific fine-tuning, which remain brittle under distribution shifts and adaptive adversaries. A more necessary direction is to embed safety mechanisms into the core system design, including uncertainty-aware generation, evidence-bounded reasoning, and fail-safe behaviors such as abstention and human escalation when confidence is insufficient. From the evaluation perspective, while recent benchmarks systematically probe harmful queries and ethical violations, they are largely static and disconnected from longitudinal clinical workflows. Future safety evaluation should move toward dynamic, scenario-driven protocols that assess cascading errors, cost-sensitive clinical risk, and system behavior under sustained interaction, better reflecting real-world medical decision-making environments.

4.5. Privacy

4.5.1. Conceptual Overview

Privacy in Medical MLLMs refers to the rigorous protection of sensitive patient information throughout the model lifecycle [211,212]. Patient data, including textual reports, imaging data, and other clinical modalities, inherently contains personally identifiable information that must be safeguarded [221,223]. Privacy preservation extends beyond data preprocessing to encompass model training and inference outputs. Accordingly, privacy-preserving strategies can be systematically categorized into three stages: preprocessing, training, and post-processing in Figure 7. This classification provides a structured framework for understanding and implementing trustworthy Medical MLLMs [10,227]. However, privacy should not be interpreted only as a technical optimization problem. In clinical deployment, privacy protection also depends on governance mechanisms such as data-use agreements, audit trails, access control, consent management, institutional review, and accountability for downstream model outputs.

4.5.2. Multimodal De-Identification (Pre-Processing)

Multimodal de-identification at the preprocessing stage forms the first line of defense for privacy preservation in Medical MLLMs by removing personally identifiable information from heterogeneous clinical data before model access, with recent studies addressing privacy risks in structured records, unstructured text, and medical imaging from complementary perspectives, Mandatory anonymization of structured and unstructured EHR data under regulatory constraints is emphasized as a prerequisite for compliant model development [211], locally deployed preprocessing pipelines are adopted to minimize data exposure by preventing sensitive information from leaving institutional boundaries [213], automated removal of protected health information from DICOM metadata and burned-in text is applied to enable compliant use of medical images [212], commonly used preprocessing practices such as DICOM tag removal and facial defacing are identified as dominant yet insufficiently standardized safeguards [214], NER-based de-identification pipelines are employed to eliminate sensitive entities from unstructured clinical text while preserving semantic integrity [215], and hybrid multimodal frameworks integrate metadata cleansing, pixel-level anonymization, and uncertainty-aware human-in-the-loop validation to address residual privacy risks in complex clinical data [216].

4.5.3. Privacy-Preserving Training

Privacy-preserving training aims to mitigate the leakage of sensitive patient information during model optimization, where privacy risks primarily stem from parameter updates, gradient sharing, and model memorization. In medical multimodal MLLMs, recent studies mainly explore this problem under federated learning and parameter-efficient fine-tuning settings [217,218,219,220,222].

Structural Constraints and Differential Privacy Integration

Several works achieve implicit privacy protection by structurally constraining the information exchanged during training. HierFedLoRA [217] proposes a hierarchical federated LoRA framework in which raw medical data remains localized and only low-rank adaptation parameters are shared. Although lacking formal differential privacy (DP) guarantees, the low-dimensional parameter sharing and hierarchical aggregation substantially limit potential information leakage during training. To provide formal privacy guarantees, multiple studies integrate differential privacy into federated LoRA training. FedASK [218] introduces a dual-stage randomized sketching mechanism that enables DP without fixing either LoRA matrix, alleviating noise amplification while preserving utility. FedSA-LoRA-DP [219] further reduces overhead by injecting DP noise exclusively into shared LoRA parameters, achieving lightweight DP-enabled training for medical models. Beyond theoretical guarantees, training stability under privacy constraints is also addressed. FFA-LoRA [220] stabilizes DP-enabled federated LoRA training under non-IID medical data by freezing one randomly initialized LoRA matrix. While not strengthening privacy guarantees, this method improves the practical robustness of privacy-preserving training.

Update Space Restriction, Machine Unlearning, and Dual-Privacy Protection

Other approaches implicitly reduce privacy exposure by constraining update spaces. FRLoRA [221] restricts federated updates to a low-rank residual subspace, which, although designed for heterogeneity mitigation, also limits sensitive information exposure during training. Privacy risks introduced during training are further addressed through training-aware rectification. Forget-MI [222] proposes a multimodal machine unlearning framework that selectively removes the influence of sensitive samples, reducing membership inference attacks. At the client level, Deng et al. [223] enable efficient client-level unlearning in federated medical imaging models to support regulatory requirements such as the right to be forgotten. FEDLPP [224] jointly considers data privacy and model privacy by distributing quantized and partially protected parameters, preventing global model reconstruction while enabling collaborative training. This work highlights an emerging direction of dual-privacy-preserving training for Medical MLLMs.

4.5.4. Privacy Alignment (Post-Processing)

Privacy alignment at the post-processing stage aims to prevent sensitive patient information from being disclosed through model outputs during inference, even when preprocessing and training are privacy-compliant. Early conceptual work distinguishes input privacy from output privacy and identifies generated responses as a primary source of privacy leakage, establishing output-stage regulation as a fundamental requirement for trustworthy Medical MLLMs [225]. Subsequent analyses demonstrate that training-time protections alone are insufficient, as inference-time generation may expose memorized or sensitive information, motivating output filtering and response sanitization as essential post-processing safeguards [10]. From a threat-oriented perspective, inference-time attacks such as data extraction and sensitive information regurgitation further confirm model outputs as the main attack surface, reinforcing the necessity of real-time output monitoring and interception [227]. These risks become more pronounced in multi-turn or stateful Medical MLLM applications, where privacy leakage may accumulate across sequential outputs, intermediate summaries, and retained context, highlighting the need for output review and behavioral constraints at the post-processing stage [228]. Beyond risk analysis, concrete post-processing mechanisms have been proposed, including inference-time frameworks that preserve semantic utility while preventing direct exposure of private information [229] and token-level response regulation methods that enforce differential privacy with formal guarantees [230]. Finally, adaptive output control frameworks dynamically determine content release based on contextual sensitivity, demonstrating practical and deployable post-processing strategies for privacy-aligned Medical MLLMs [226].

4.5.5. Insights

Privacy preservation in Medical MLLMs should be viewed as a full-lifecycle requirement, encompassing data preprocessing, model training, and output post-processing. Rather than isolated technical safeguards, these stages jointly ensure that sensitive patient information is protected throughout the entire input–output pipeline, which is a fundamental prerequisite for trustworthy deployment. Moreover, privacy protection is inherently connected to fairness and broader societal considerations, as different population groups (e.g., varying in age, gender, or ethnicity) may face unequal privacy risks and disparate impacts from model behaviors. Fairness-aware trustworthiness therefore entails not only safeguarding individual privacy but also preventing systematic biases or disproportionate risks toward specific groups. Ultimately, only by integrating lifecycle-level privacy protection with fairness considerations across diverse patient populations can Medical MLLMs earn sustained trust in real-world clinical practice.

4.6. Explainability

4.6.1. Definition and Taxonomy

Explainability is a foundational pillar of trustworthiness for Medical MLLMs [232]. Clinical adoption requires not only accurate predictions but also reasoning processes that are transparent, inspectable, and clinically meaningful. In contrast to conventional discriminative models that produce fixed probabilistic outputs, MLLMs generate free-form textual responses conditioned on both visual and textual inputs. This generative paradigm increases the risk of unfaithful reasoning, hallucinations, and reliance on spurious correlations. As a result, explainability becomes indispensable rather than optional in high-stakes medical settings.

In Figure 8, explainability in Medical MLLMs can be broadly categorized into post-hoc explainability and intrinsic explainability [231]. Post-hoc explainability refers to techniques applied after model inference to interpret otherwise opaque systems. Common examples include saliency maps [233], attention heatmaps [234], and feature attribution methods [235]. These approaches have been widely adopted in traditional medical imaging models. Post-hoc visualizations often produce low-resolution or visually plausible explanations. However, such explanations may fail to faithfully reflect the causal reasoning that underlies a generated clinical narrative.

In contrast, intrinsic explainability embeds interpretability directly into the model architecture or inference process [236]. Intrinsically explainable models are designed to reason explicitly, exposing intermediate decision steps that align visual evidence, clinical concepts, and textual reasoning. Recent advances reveal a paradigm shift from heuristic post-hoc interpretation toward reasoning-centric, glass-box architectures. This transition is particularly evident in models that incorporate chain-of-thought (CoT) reasoning [237], reinforcement learning–based reasoning incentives [238], and visual grounding reasoning [239].

4.6.2. Visual Explainability

Visual explainability seeks to reveal which visual evidence within input images contributes to diagnostic predictions or clinical descriptions generated by Medical MLLMs. Saliency map techniques remain the most widely used visual explanation methods in medical imaging [240]. These approaches identify image regions that are most critical to a given prediction by analyzing gradients or activation responses with respect to target outputs. With the rise of Transformer-based Medical MLLMs, attention visualization has emerged as an important mechanism for visual explainability [241]. It illustrates how the generation of specific medical terms attends to corresponding image regions by visualizing cross-modal attention weights between textual tokens and visual areas. Recent studies have further advanced visual explainability in Medical MLLMs through sparse representation learning. In particular, Kenza et al. [242] employ sparse autoencoders to analyze a radiology-specialized multimodal large language model. Their analysis identifies a set of sparse internal units that respond selectively to specific clinical features.

Beyond unidirectional interaction, bidirectional visual interaction has emerged as a powerful mechanism for explainability. MIMOSeg [243] that supports visual referring inputs allows clinicians to query specific regions of interest, while simultaneously producing pixel-level grounding outputs that justify their responses. This closed-loop interaction transforms the model from a passive report generator into an interactive clinical assistant, enabling spatially precise verification of both user intent and model claims.

4.6.3. Textual and Reasoning Explainability

Visual grounding links model predictions to perceptual evidence in the input images. In contrast, textual and reasoning explainability focus on the logical processes underlying medical decision-making. Clinical reasoning is inherently sequential. It typically involves observation, interpretation, differential diagnosis, and uncertainty assessment. This structured nature of clinical reasoning motivates the use of explicit reasoning mechanisms. Accordingly, CoT [244] reasoning has emerged as a central approach to intrinsic explainability in Medical MLLMs. Med-Gemini [246] introduces a chain-of-reasoning technique specifically for long-context tasks. By decomposing complex queries into sequential inference steps, the model can process extensive EHRs and identify subtle temporal patterns. V2T-CoT [245] introduces a vision-to-text chain-of-thought framework that explicitly generates clinically grounded, step-by-step diagnostic rationales by aligning localized visual evidence with structured textual reasoning, thereby enhancing the transparency and explainability of medical multimodal decision-making.

Recent studies show that explicitly generating step-by-step reasoning paths can improve both interpretability and diagnostic performance. Many existing models produce answers that appear plausible but lack rigorous logical justification. Pan et al. [238] address this limitation by proposing a novel reinforcement learning paradigm. Their method adopts a group relative policy optimization strategy. Under this framework, the model is rewarded not only for producing correct final answers but also for the quality of the intermediate reasoning steps. This training paradigm leads to improved performance.

Interactive reasoning further enhances explainability by allowing clinicians to probe model outputs through dialogue. Unlike static report generation systems, interactive frameworks enable repeated interrogation of the model’s reasoning process [52]. Clinicians can pose follow-up questions such as “Which features indicate malignancy?" or “Are there alternative diagnoses?" Such interactions compel the model to elaborate on its internal representations and intermediate reasoning steps. This interactive paradigm closely mirrors medical education practices. It provides a natural interface for assessing the depth and consistency of a model’s understanding.

4.6.4. Insights

Explainability in Medical MLLMs concerns whether clinicians can understand how conclusions are derived from multimodal evidence, rather than merely observing visually plausible explanations. Post-hoc visualizations may offer intuitive cues, but they do not guarantee that the displayed explanation reflects the model’s actual reasoning process. Trustworthy Medical MLLMs are expected to expose structured reasoning traces that explicitly bind visual evidence, clinical concepts, and textual conclusions, and to surface uncertainty when evidence is insufficient or ambiguous. Current Medical MLLMs are optimized to generate text that mimics human reasoning, but the resulting rationales may not faithfully reflect the underlying decision-making process. This illusion of reasoning introduces significant safety risks in clinical settings. Future research must therefore focus on enforcing causal alignment between internal inference mechanisms and external textual explanations, moving beyond surface-level coherence toward verifiable causal inference.

4.7. Interplay Among Trustworthiness Dimensions

The six trustworthiness dimensions discussed above should not be viewed as independent checklists. In Medical MLLMs, failures often emerge from their interactions. For example, low robustness under distribution shift can directly reduce truthfulness by increasing hallucinated or weakly grounded clinical claims. Insufficient explainability can make robustness failures harder to detect, because clinicians may be unable to verify whether a prediction is supported by the relevant image regions, clinical notes, or physiological signals. Privacy-preserving training may also affect fairness and robustness when certain institutions, demographic groups, or rare disease cases contribute limited information to the shared model. Similarly, safety mechanisms such as abstention and clinical guardrails depend on uncertainty awareness, evidence grounding, and interpretable reasoning traces.

This interaction suggests that the next generation of Medical MLLMs should be evaluated through integrated auditing pipelines rather than isolated metrics. As Medical MLLMs move toward omni-modal and workflow-oriented systems that combine images, text, speech, physiological signals, structured EHRs, tools, and multi-turn interactions, trustworthy deployment will require continuous auditing of evidence use, uncertainty, privacy leakage, subgroup performance, explanation quality, and workflow-level risk. Such auditing pipelines can serve as a bridge between technical evaluation and clinical governance, allowing hospitals, regulators, and model developers to monitor whether Medical MLLMs satisfy reliability requirements across different clinical contexts. Therefore, the proposed taxonomy should be understood not only as a classification of trust dimensions, but also as a basis for designing clinically aligned evaluation, auditing, and governance frameworks for future Medical MLLMs.

5. Evaluation Protocols and Benchmarks

Standardized evaluation is the cornerstone of building and verifying trustworthy Medical MLLMs. In this section, we systematically review the landscape of evaluation protocols. We first explore the evolution of evaluation paradigms, ranging from traditional rule-based automated metrics to frontier model-based and human-centric assessments. Subsequently, we detail key benchmarks across diverse clinical tasks and trustworthiness dimensions, and then examine the emerging field of dynamic assessment for evaluating interactive, workflow-oriented, and longitudinal Medical MLLMs.

5.1. Evaluation Paradigms

5.1.1. Rule-Based Automated Metrics

In the evaluation context of medical multimodal large language models (Medical MLLMs), rule-based automated metrics are often organized into four major categories according to the matching granularity and the abstraction level of the underlying rules.

N-gram matching metrics quantify surface similarity by measuring word or phrase overlap between a generated text and a reference, without explicitly modeling clinical semantics or factual consistency. For example, BLEU [248] was originally proposed for machine translation evaluation. It computes precision over n-grams of different lengths and applies a brevity penalty to account for length mismatch, and it has since been widely adopted in medical report generation and clinical text generation as a basic indicator of fluency and template-level similarity [249]. ROUGE is recall-oriented and evaluates whether a generation covers salient content from the reference, and it is commonly used for medical summarization and radiology report generation to approximate content coverage [250]. METEOR further introduces stemming, synonym matching, and alignment penalties on top of lexical matching to reduce biases caused by strict surface-form comparison [251]. Although these metrics remain standard automated baselines in medical text generation, substantial empirical evidence shows that their correlation with clinical factual correctness, medical consistency, and safety is limited, which makes them insufficient for reliably reflecting clinical usefulness [252,253].

Embedding-based semantic similarity metrics leverage contextual embeddings from pretrained language models to measure the overall semantic proximity between a generated text and a reference in a representation space. A representative method is BERTScore, which maps both texts into Transformer-based contextual representations and computes token-level maximum similarity matching, thereby partially alleviating the sensitivity of purely lexical metrics to synonymy and word order variation [254]. With the development of domain-specific pretrained models in medicine, researchers have further explored semantic evaluation based on biomedical and clinical encoders, for example by using embeddings from BioBERT [255] and ClinicalBERT [256] to better capture medical terminology, clinical phrasing, and domain context. In radiology report generation and medical question answering, embedding-level metrics are widely used to assess overall semantic relatedness and content alignment, and they are often more stable than traditional n-gram matching [252,253]. However, prior work also points out that embedding similarity primarily reflects global semantic closeness and still struggles to reliably detect high-risk clinical errors, such as directional conclusion shifts, negation polarity flips, severity misjudgment, or incorrect entity relations. Therefore, in medical multimodal generation, semantic similarity metrics are typically used as intermediate automated signals and are combined with structured concept matching or rule-driven factuality checks to more comprehensively characterize clinical utility and safety [8,103].

Structured medical concept matching metrics first parse free-text outputs into structured representations consisting of clinical entities, attributes, and their relations, and then perform alignment and matching at the structure level. A representative approach is RadGraph, which converts radiology reports into graphs where nodes correspond to clinical entities and edges represent modifier relations and anatomical relations, and then evaluates clinical consistency via entity and relation matching at the graph level [113]. Similarly, CheXbert maps text into a standardized set of chest X-ray observation labels and compares generated and reference reports in the label space, which reduces sensitivity to wording variations [114]. Because these methods explicitly model medical semantic structure such as finding, attribute, and relation, many studies argue that they better match the core concerns of radiology evaluation than lexical or embedding-based metrics, and they have been widely adopted in radiology report generation and medical imaging understanding [252,253]. Nonetheless, existing structured metrics often rely on domain-specific ontologies, annotation schemes, or information extraction models, which constrains coverage to predefined entity and relation sets. Moreover, they remain limited in settings that require cross-modal reasoning, long-range contextual consistency, or complex causal attribution, where truthfulness and reasoning reliability are harder to capture with fixed concept inventories.

Rule-driven factual consistency and constraint checking relies on manually defined medical logic, safety constraints, and clinical norms to validate key clinical statements in generated outputs for consistency, compliance, and safety. Rather than comparing surface similarity, these approaches typically apply predefined error taxonomies, rules for negation and uncertainty, timeline consistency constraints, or clinical safety boundaries to audit outputs statement by statement and to localize and attribute failures. In medical text generation and report evaluation, prior work has distinguished error types such as fabricated facts, attribute errors, directional or negation polarity errors, and omission of critical information, and it further links these errors to graded levels of potential clinical harm, thereby connecting model evaluation directly to safety risk [103,257]. Compared with similarity-based or embedding-based metrics, rule-driven methods emphasize interpretability and safety, and they can pinpoint where outputs violate medical knowledge, clinical logic, or practice constraints, which makes them particularly valuable for high-risk healthcare applications. However, they depend heavily on expert-crafted rules and domain knowledge, incur substantial maintenance and scaling costs, and cannot exhaustively cover the diversity of real clinical language. As a result, they are usually used as complementary evaluation tools together with automated metrics and clinician review [8,258].

5.1.2. Model-Based Evaluation (LLM-as-a-Judge)

The scalability limitations inherent in human expert review have catalyzed the emergence of the LLM-as-a-Judge paradigm, wherein frontier large language models serve as automated proxies for clinical evaluation. This approach codifies assessment rubrics into structured prompts, enabling systematic evaluation across thousands of test cases while maintaining semantic sophistication beyond traditional n-gram metrics. Despite this scalability, judge-based evaluation introduces its own reliability and bias risks. A model judge may inherit clinical blind spots from its training data, favor fluent or verbose answers over clinically safer responses, show positional or self-preference bias in pairwise comparison, and produce unstable ratings under small changes in rubric wording. For Medical MLLMs, LLM-as-a-Judge should therefore be calibrated against clinician review, tested for inter-rater consistency, and used with reference evidence or structured rubrics rather than treated as an authoritative substitute for expert assessment.

General Judges

General-purpose judges leverage frontier models such as GPT-4 or Claude to assess Medical MLLM outputs through Likert-scale scoring across multiple quality dimensions. LLaVA-Med [52] pioneered this paradigm by establishing a Teacher-Student scoring framework for biomedical chatbot evaluation. The methodology constructs test sets from unseen image-caption pairs, utilizing GPT-4 to generate both multi-round conversations and detailed description queries. A separate GPT-4 instance serves as the judge, evaluating student model responses on a 1 to 10 scale across four dimensions: Helpfulness, Relevance, Accuracy, and Level of Detail. VisIT-Bench [259] advances this paradigm through pairwise comparison rather than scalar scoring, presenting automated judges with two model outputs alongside human-authored reference captions. The judge declares outcomes as Win, Tie, or Lose, with extensive validation demonstrating high agreement between GPT-4 preferences and human annotators. This approach integrates the Elo rating system into MLLM evaluation, facilitating dynamic model ranking. This methodology proves particularly advantageous for assessing qualitative attributes, such as tone, empathy, and conciseness, which are inherently difficult to quantify using absolute metrics but are clearly discernible through pairwise comparisons. VHELM [260] extends general judge evaluation to a holistic nine-aspect taxonomy encompassing Visual Perception, Knowledge, Reasoning, Bias, Fairness, Multilinguality, Robustness, Toxicity, and Safety. For medical scenarios, VHELM aggregates 21 existing datasets under a unified protocol, testing robustness through input perturbations, such as image blurring and clinical history typos, and explicitly evaluating demographic performance disparities. Beyond conversational assessment, general judges have been deployed for hallucination detection and safety auditing. HallusionBench [261] employs GPT-4V to evaluate logical consistency through adversarial visual-question pairs, distinguishing between language hallucination and visual illusion. The evaluation emphasizes consistency over simple accuracy: a trustworthy model answering “Yes" to “Is the lung healthy?" must correspondingly answer “No" to “Is there pneumonia?" This work exposed the prevalent Yes-bias in MLLMs, shifting evaluation focus from aggregate accuracy to consistency auditing.

Reference-Guided Judges

Reference-guided evaluation enhances judge reliability by grounding assessments in established medical knowledge or gold-standard annotations. VITAL [262] pioneers the integration of clinician preferences into automated evaluation through a dual-judge architecture. They train a separate selection model that distills preferences from clinician-annotated data, demonstrating that this specialized judge often outperforms raw GPT-4 judgments in matching human preferences. This finding suggests that evaluation models, like task models, benefit substantially from domain-specific training and alignment. CheXagent [263] operationalizes reference-guided evaluation through clinically-aligned metric judges designed for radiology. The framework introduces Generative Radiology Report Evaluation and Error Notation (GREEN), a specialized metric functioning as an automated radiologist. Unlike generic NLP metrics measuring lexical overlap, GREEN performs semantic comparison between generated and ground-truth reports, verifying the presence or absence of clinically significant findings (e.g., pleural effusion, consolidation) based on medical ontology understanding. The Phrase-Grounded Fact-Checking framework [264] exemplifies this paradigm through specialized discriminative auditing. Rather than relying on generalist LLMs, this approach trains a dedicated fact-checking model on synthetically perturbed radiology reports, systematically altering findings (e.g., changing “left lower lobe opacity" to “right upper lobe opacity") to create controlled real and fake training pairs. The resulting multi-label contrastive regression network simultaneously predicts a veracity score and a bounding box. The aggregate FCScore metric represents the percentage of findings that are both factually accurate and visually grounded, offering interpretability through explicit pixel-level evidence for verification decisions.

5.1.3. Human-Centric Evaluation

While model-based metrics provide the scalability necessary for iterative development, they lack the legal, ethical, and clinical authority of human physicians. Consequently, clinicians must remain in the assessment loop to establish definitive standards for safety and clinical utility. Med-PaLM [6] establishes the most rigorous human-centric protocol for medical AI evaluation. The study conducted a double-blind side-by-side ranking of reports generated for 246 retrospective chest X-rays, with clinicians unaware whether reports originated from AI or human radiologists. Pairwise preference evaluation revealed that clinicians preferred AI-generated reports in up to 40.5% of cases, frequently citing completeness and structured clarity. Beyond preference, clinicians rated reports on specific safety axes: Alignment with Scientific Consensus, Evidence of Harm, Missing Content, and Bias. The protocol explicitly differentiates between omissions (failure to report findings present in the image) and hallucinations (fabrication of findings not present). This granular annotation reveals that even preferred reports may contain subtle inaccuracies, requiring safety-specific auditing. Med-Flamingo [7] advances interactive human evaluation through custom assessment applications for few-shot learning evaluation. Physicians interact with a blinded interface presenting clinical problems (image and text) alongside model-generated answers and rationales. The protocol distinctly assesses diagnostic accuracy and reasoning quality. A model may correctly diagnose “pneumonia” while providing the nonsensical explanation `Because the bone is broken.” Such lucky guesses prove catastrophic for clinical trust, and human evaluation remains the sole mechanism capable of detecting these failures. RadFM [265] introduces RadBench, a comprehensive evaluation framework for generalist radiology models assessed through multi-dimensional human evaluation. Radiologists evaluate model outputs on three distinct open-ended tasks: Medical Visual Question Answering, Radiology Report Generation, and Rationale Diagnosis. The protocol integrates absolute ratings, which utilize Likert scales to assess clinical correctness, completeness, and coherence, with relative comparisons, which involve pairwise evaluations against baseline model outputs.

5.2. Benchmarks

5.2.1. QA & VQA

Legacy datasets in Medical VQA constitute the foundational bedrock for evaluating cross-modal clinical understanding by prioritizing high-quality manual verification and task-specific scoping over scale. VQA-RAD [266] serves as a pioneering gold standard that comprises manually validated question-answer pairs on radiology images to rigorously assess reasoning consistency beyond statistical biases. Addressing the limitations of monolingual and coarse-grained annotations, SLAKE [267] introduces a bilingual semantically-labeled dataset with bounding-box supervision to facilitate object-aware reasoning and cross-lingual generalization. To support standardized evaluation in competitive environments, the VQA-Med series [268] establishes a task-oriented benchmark that evolved from general attribute classification to complex abnormality detection for testing models on clinically relevant visual signals. Expanding the domain horizon beyond radiology, PathVQA [269] bridges the gap in microscopic analysis by deriving open-ended questions from pathology textbooks to enable the evaluation of fine-grained morphological understanding in histopathology.

Beyond visual modalities, legacy benchmarks also targeted the comprehension of patient records, treating Electronic Health Records (EHRs) as a critical clinical modality. emrQA [270] stands as a seminal large-scale dataset for clinical reading comprehension, containing over 1 million question-answer pairs generated from unstructured clinical notes in the MIMIC-III database to evaluate information extraction from free-text medical narratives. Complementing this, MIMIC-SQL [271] focuses on structured clinical data, framing the task as a Text-to-SQL problem where models must convert natural language questions into executable queries to retrieve precise values (e.g., laboratory results, patient demographics) from tabular medical databases. These datasets laid the groundwork for current multimodal LLMs that integrate structured and unstructured patient history.

Benchmarks in this category necessitate expert-level domain knowledge, complex logical deduction, and instruction-following capabilities across heterogeneous data sources. MMMU [272] sets a rigorous standard for expert-level reasoning by aggregating college-level exams that require the synthesis of deep pathology knowledge with diverse visual inputs, ranging from radiological scans to complex chemical structures and medical diagrams. Addressing the challenge of modality fragmentation, OmniMedVQA [273] provides a comprehensive framework by unifying 73 distinct datasets across 12 imaging modalities, effectively testing the versatility and robustness of generalist Medical MLLMs in handling widely varying anatomical regions. Beyond general breadth, recent benchmarks focus on specialized reasoning structures and modalities. Emphasizing diagnostic authority in real-world settings, TeleQmA [274] aggregates high-difficulty clinical cases derived from authentic telehealth consultations, challenging models to process noisy, user-generated multimodal data and mimic expert-level differential diagnosis. Furthermore, PMC-VQA [275] leverages 149,000 images from biomedical literature to evaluate learning from rare diseases and scientific figures often absent in routine clinical records, while Quilt-1M [276] utilizes narrated histopathology educational videos to assess spatial grounding and diagnostic logic by leveraging time-aligned audio-visual correspondence comparable to human pathologists.

To ensure logical completeness across modalities, benchmarks for patient records have also evolved from simple extraction to complex reasoning over electronic health records (EHRs). MedCalc-Bench [277] addresses the critical deficiency of generalist models in numerical reasoning by evaluating their ability to extract values from clinical notes and perform calculations for risk scores and dosage adjustments. Furthermore, addressing the challenge of lengthy patient histories, LongHealth [278] serves as a benchmark for long-context clinical reasoning, requiring models to retrieve and synthesize information scattered across comprehensive patient discharge summaries involving thousands of tokens to answer questions that necessitate multi-hop deduction.

5.2.2. Report Generation

Current research on 2D radiology report generation (RRG) is supported primarily by public datasets in chest X-ray (CXR), which are typically organized as paired data of images and free-text radiology reports, often including Findings and Impression sections. Among them, MIMIC-CXR [279] is one of the largest and most widely used English CXR–report corpora, capturing real-world reporting styles and common thoracic abnormalities, and it therefore serves as a core benchmark for model training and standardized evaluation. As a classic comparison benchmark, IU X-Ray [280] is smaller in scale but historically influential; it provides CXR images with narrative reports and has been extensively used to validate early methods and lightweight models. To facilitate clinical entity/label consistency assessment and weakly supervised learning, CheXpert [281] offers a large-scale CXR dataset and derives 14 observation categories with uncertainty labels by automatically extracting information from reports; in report generation studies, it is frequently used for report-to-label alignment or as the basis for clinical consistency metrics. For multilingual and cross-domain settings, PadChest [282] provides large-scale Spanish CXR data with associated reports and multi-label annotations, enabling research on cross-lingual report generation, domain generalization, and robustness. For enhanced interpretability via grounding (i.e., aligning textual findings with visual evidence), PadChest-GR [283] is derived from PadChest and supplies bounding-box annotations for individual positive findings, together with bilingual (English/Spanish) finding sentences, making it suitable for training and evaluating grounded radiology report generation (GRRG). Targeting disease-specific scenarios and datasets with structured localization information, BIMCV COVID-19+ [284] aggregates imaging studies from COVID-19 patients (including CXR) and provides Spanish reports and associated finding/localization information, and is commonly used for COVID-focused report generation or evidence alignment tasks. Because real-world radiology reports often reference prior examinations or prior reports, models may learn to hallucinate non-existent priors during generation. CXR-PRO [285] addresses this issue by cleaning MIMIC-CXR reports to remove prior-related references, and is widely used to improve factual consistency and deployability of generated reports. MIMIC-III [286] provides structured and unstructured clinical data in the ICU setting (including imaging-related text/report entries), and is frequently leveraged to study conditional generation with “image + EHRs context,” conclusion consistency constraints, or multi-task joint modeling.

Across the aforementioned report generation datasets, researchers must contend not only with variations in reporting style across languages and institutions (e.g., English reports in MIMIC-CXR/IU X-Ray [280,281] versus Spanish reports in PadChest/BIMCV [282,284]), but also with heterogeneity in report structure (the organization into Findings and Impression sections), the availability of weakly supervised labeling resources (e.g., CheXpert observation labels [281]), and evidence-grounding annotations required for interpretability (e.g., the localization information provided by PadChest-GR [283]). Accordingly, evaluation of radiology report generation has gradually shifted from purely surface-level text similarity toward clinically grounded, composite protocols. On the one hand, structured extraction is used to map free-text reports into comparable clinical semantic representations (e.g., CheXbert-based observation label extraction and RadGraph-based entity–relation parsing) [113,114]; on the other hand, expert review is incorporated to account for clinical risk and safety considerations that are difficult to capture with automatic metrics alone, thereby mitigating the common mismatch between high textual similarity and clinically incorrect content [252,287,288]. In general, current evaluation priorities can be summarized into three interrelated dimensions. Factual Correctness assesses whether generated statements are supported by imaging evidence, with particular attention to clinically meaningful error and hallucination types, such as fabricated findings, laterality or anatomical site mistakes, inaccurate localization, and negation/affirmation polarity errors; in practice, this dimension is typically evaluated by combining automated consistency measures, often derived from structured extraction, with expert auditing to judge error severity and potential clinical risk [287,289]. Entity Coverage examines whether key abnormalities and critical entities are sufficiently reported, with a focus on omission risk; it is commonly quantified using structured label spaces or entity–relation extraction outputs, although a clear trade-off exists between maximizing coverage and maintaining correctness, as more aggressive coverage can increase hallucinations while overly conservative generation may exacerbate omissions [252,290]. Impression Generation targets higher-level clinical summarization, assessing whether the Impression is consistent with the Findings, captures the primary abnormalities, and provides actionable conclusions without introducing additional unverified facts; because Impression statements more directly influence clinical decision-making, evaluation of this dimension often emphasizes a stringent combination of structured alignment and human auditing, including expert preference testing and error grading, to jointly reflect accuracy and clinical utility [287,288].

5.2.3. Trustworthiness-Specific Benchmarks

Unlike traditional diagnostic performance benchmarks, trustworthiness-specific datasets focus on the adversarial resilience and regulatory compliance of Medical MLLMs. These benchmarks are designed to audit the model’s adherence to clinical ethics and data protection standards through specialized testing paradigms.

Safety & Ethics

Benchmarks in this category quantify the adherence of various models to professional medical standards and their resilience against harmful provocations. MedSafetyBench [26] establishes a foundational stress-testing suite comprising 1,800 harmful medical requests derived from the American Medical Association’s Principles of Medical Ethics to evaluate the moral reasoning of clinical models. To assess the broader vulnerabilities of mainstream MLLMs, SafeBench [208] introduces a systematic evaluation protocol utilizing high-quality multimodal harmful query datasets and a jury deliberation mechanism to identify safety violations. CARES [9] serves as a comprehensive multi-dimensional audit corpus, covering 16 imaging modalities and 41,000 question-answer pairs to quantify risks across various safety dimensions. Furthermore, MM-SafetyBench [295] incorporates a specialized “Health Consultation” scenario, which explicitly mandates that models declare a lack of relevant medical certifications and append risk warnings to their responses to ensure safe clinical interactions. For human-in-the-loop auditing, QUEST [209] formalizes a literature-derived evaluation protocol, providing structured metrics for planning, adjudication, and review of patient safety in clinical triage.

Hallucination

With the rapid development of Medical MLLMs, several benchmarks have recently been introduced to assess the risk of hallucinated content in their generations, as shown in Table 2. Med-HALT [291] proposes a medical-domain hallucination test suite designed to systematically evaluate medically plausible yet unreliable outputs from medical LLMs; it covers clinical examination scenarios across multiple countries and further distinguishes hallucinations triggered by reasoning versus those arising from memory/retrieval, enabling a more fine-grained characterization of failure modes. MedVH [292] introduces a benchmark for medical visual hallucinations to systematically evaluate hallucination risk in medical LVLMs under multimodal understanding and generation; it comprises six task categories spanning both discriminative settings (e.g., multiple-choice VQA) and long-form generation (e.g., report generation and overconfident justification), thereby revealing model vulnerability under adversarial or leading prompts. MedHallBench [293] presents an evaluation framework for hallucinations in medical LLMs by constructing clinically grounded test cases from expert-validated clinical scenarios and established medical knowledge sources; it incorporates the ACHMI automatic scoring scheme together with clinician assessment, and further proposes an RL-based automatic annotation pipeline and an RLHF-style procedure tailored to medical settings, supporting reproducible hallucination evaluation and baseline comparisons across diverse clinical contexts. CARES [9] offers a comprehensive trustworthiness benchmark for medical vision-language models, jointly assessing reliability/factuality (including hallucination) alongside robustness, fairness, safety, and privacy; it contains approximately 41K QA instances spanning 16 imaging modalities and 27 anatomical regions, enabling systematic evaluation under realistic cross-modal and safety/privacy constraints. Notably, most of the above benchmarks primarily focus on evaluating hallucinations arising from the visual modality and do not provide a comprehensive assessment of hallucination mitigation strategies. In contrast, MedHEval [294] evaluates hallucinations and mitigation strategies in medical LVLMs by classifying hallucinations into visual misinterpretation, knowledge deficiency, and context mismatch, and by assessing the effectiveness of different mitigation methods. It constructs both close-ended and open-ended medical VQA test sets with accompanying metrics, and conducts systematic comparisons across 11 medical LVLMs and seven categories of mitigation techniques, thereby identifying cause-specific challenges and limitations of current mitigation approaches.

Privacy

Regarding the evaluation of privacy preservation, recent benchmarks have evolved to quantify the efficacy of data protection across the entire model lifecycle, from pre-processing anonymization to post-deployment unlearning. [223] establishes the first hierarchical medical multimodal unlearning benchmark, utilizing a structured institution-patient-exam-report framework to measure the trade-off between sensitive data erasure and diagnostic utility retention. In the domain of raw data de-identification, [212] serves as a critical benchmark for the automated redaction of Protected Health Information from both DICOM metadata and burned-in pixel text. Furthermore, HierFedLoRA [217] establishes a metric for evaluating inter-institutional privacy leakage risks within federated learning environments by quantifying the balance between communication overhead and differential privacy noise levels. At the output stage, [230] provides an algorithmic benchmark for token-level privacy control, employing DP-based text generation evaluation to ensure that sensitive attributes are not regurgitated in model responses.

6. Perspective: Toward a Trust Architecture for Medical MLLMs

Medical MLLMs are moving from task-specific perception models toward general-purpose systems for clinical reasoning. This shift changes the meaning of trust. In conventional medical AI, trust is often assessed through performance on a defined task, such as classification accuracy, segmentation quality, or report generation scores. For Medical MLLMs, this view is no longer sufficient. These models operate across modalities, diseases, institutions, and user groups. They may retrieve medical knowledge, interpret images, summarize records, communicate with patients, and support clinical decisions within the same workflow. Trust therefore cannot be reduced to a single metric or a post hoc evaluation step. It must be treated as a structural property of the model, the data, the interaction, and the deployment environment.

The six dimensions proposed in this survey provide such a structural view. Truthfulness, robustness, fairness, safety, privacy, and explainability are not isolated requirements. Together, they define a trust architecture for Medical MLLMs. Truthfulness anchors model outputs in verifiable medical evidence. Robustness determines whether this evidence remains reliable under distribution shifts, noisy inputs, missing information, and heterogeneous clinical protocols. Fairness examines whether model benefits and risks are distributed equitably across populations, sites, languages, and disease groups. Safety constraints model behaviour when uncertainty is high, when instructions are ambiguous, or when outputs may affect clinical decisions. Privacy defines the boundary within which patient information can be learned, stored, retrieved, and shared. Explainability connects model reasoning to human judgment, allowing clinicians to inspect, challenge, and contextualize the output. In this sense, the six dimensions form an interdependent framework rather than a collection of evaluation axes.

This unified view suggests a different trajectory for the field. The future of Medical MLLMs should not be framed only as a race toward larger models, broader modality coverage, or higher benchmark scores. A more consequential direction is the development of clinically grounded systems that can reason with evidence, communicate uncertainty, preserve patient confidentiality, respect safety constraints, and remain accountable to human experts. Such systems would not simply answer medical questions. They would help organize clinical information, identify missing evidence, expose potential risks, and support more transparent decision-making. The central objective is therefore not autonomous diagnosis, but reliable clinical collaboration.

This perspective also reframes evaluation. Current benchmarks remain valuable, but they capture only a narrow part of clinical trust. Future evaluation should examine whether a model can maintain factual consistency across multimodal evidence, remain stable under realistic perturbations, protect sensitive information during interaction, avoid unsafe recommendations, perform consistently across demographic and institutional subgroups, and provide explanations that are useful to clinicians rather than merely plausible to annotators. These properties should be assessed across the full model lifecycle, from pretraining and alignment to clinical integration and post-deployment monitoring. Trustworthiness should therefore be regarded as a longitudinal requirement, not a static score reported at release.

The six-dimensional framework further points to new model capabilities. Trustworthy Medical MLLMs should be able to distinguish evidence from speculation, calibrated uncertainty from unsupported confidence, and patient-specific context from general medical knowledge. It should know when to answer, when to defer, when to ask for additional information, and when to recommend expert review. This requires progress beyond surface-level instruction following. Future systems will need memory mechanisms that are clinically bounded, retrieval systems that are evidence-aware, reasoning modules that can represent uncertainty, and interfaces that allow clinicians to audit both the input evidence and the generated conclusion. These capabilities would move Medical MLLMs toward a more mature form of clinical intelligence, where trust is built into the reasoning process rather than added after generation.

The broader impact of this shift could be substantial. In clinical care, trustworthy Medical MLLMs may support earlier risk recognition, more consistent documentation, safer triage, and better integration of imaging, laboratory, and textual evidence. In medical education, they may enable case-based training that is factually grounded, explainable, and sensitive to clinical uncertainty. In health-system management, they may help identify gaps in care, monitor model drift, and support quality control across institutions.

Taken together, the six dimensions define a research agenda for the next stage of Medical MLLMs. They encourage the field to move from model capability to model responsibility, from isolated benchmarks to lifecycle evaluation, and from human-AI interaction to clinically accountable collaboration. The goal is not to build models that merely appear competent in medical dialogue, but to develop Medical MLLMs that can operate within the epistemic, ethical, and practical constraints of healthcare. Under this perspective, trustworthy Medical MLLMs may become a new form of clinical reasoning infrastructure, supporting safer, more transparent, and more equitable medical intelligence.