Radiology VLM Reproducibility Audits: Singapore Hospital Procurement Guide

A recent forensic reproducibility audit of a chest radiograph vision-language model (VLM) benchmark has uncovered a troubling reality: the published performance metrics that hospitals use to select AI vendors may not reflect what actually runs in production [1]. For Singapore hospital AI teams evaluating radiology AI systems—especially as the HSA AI-SaMD sandbox pathway matures—this finding demands a fundamental shift in procurement due diligence.

This post is for hospital CIOs, clinical informatics leads, radiology department heads, and AI procurement teams in Singapore and Asia who are evaluating or deploying vision-language models for chest X-ray interpretation, radiology report generation, or clinical decision support.

Key takeaways

  • Benchmark artifacts diverge: A retrospective audit of a preserved chest X-ray VLM pilot found that datasets, DICOM rendering pipelines, prompts, provider APIs, automated labels, statistical code, manuscripts, and repository releases often disagree—yet agreement is usually assumed rather than tested [1].
  • Validation is not deployment: Peer-reviewed evidence now shows that clinical AI systems exhibit post-deployment fragility even after successful validation, with performance degrading longitudinally due to data drift, workflow changes, and infrastructure updates [2].
  • VLM confabulation is structured: When vision-language models are queried with demographic descriptors but no image attached, they do not abstain—they confabulate diagnoses that are systematically biased by patient demographics [6].
  • Singapore hospitals need forensic procurement: Before signing radiology AI contracts, teams should demand reproducibility audits that verify benchmark claims against the actual deployed artifact, not just the published paper.

What is a forensic reproducibility audit, and why does it matter?

Medical-imaging AI benchmarks are complex assemblies: they combine datasets, DICOM rendering pipelines, prompts, provider APIs (e.g., OpenAI, Anthropic, Google), automated labeling scripts, statistical analysis code, manuscripts, and public repository releases [1]. Each of these artifacts can drift independently.

A forensic reproducibility audit is a retrospective inspection of a preserved benchmark run—no model is called again, no image is re-rendered—to verify that the published performance metrics match what the code, data, and prompts actually produced [1]. The recent arXiv preprint describes such an audit for a chest radiograph VLM pilot, revealing discrepancies across the artifact chain that would not be visible from the published paper alone.

For Singapore hospitals, this matters because:

  1. Procurement decisions rely on benchmark claims: When evaluating radiology AI vendors, hospital teams compare published AUC, sensitivity, and specificity figures. If those figures reflect an idealized research pipeline rather than the deployed system, the hospital inherits hidden risk.
  2. HSA AI-SaMD sandbox requires evidence: The 2026 HSA exemption pathway for low-risk AI-SaMD still requires documented evidence of safety and performance see our earlier coverage. If the vendor's benchmark is not reproducible, that evidence is unreliable.
  3. PACS integration introduces new failure modes: As we documented in our PACS integration architecture guide, DICOM rendering, pixel spacing normalization, and worklist routing all introduce opportunities for silent degradation—exactly the artifacts that forensic audits inspect [1].

Why do radiology vision-language models fail reproducibility audits?

The forensic audit identified several common failure modes [1]:

DICOM rendering pipeline drift

Chest X-ray DICOM files contain metadata (window/level settings, pixel spacing, orientation) that must be rendered into pixel arrays before a VLM can process them. Small changes in rendering libraries (e.g., pydicom version updates, JPEG compression settings) can alter pixel values without changing the image visually. If the benchmark paper does not version-pin rendering dependencies, the published results may not be reproducible.

Prompt engineering is not documented

VLMs are sensitive to prompt phrasing. The audit found that the actual prompts sent to the API often differed subtly from the prompts described in the manuscript—extra whitespace, different few-shot examples, or revised system messages [1]. These differences can shift performance by several percentage points, yet they are rarely disclosed in supplementary materials.

Provider API versioning

Commercial VLM APIs (GPT-4V, Claude Opus, Gemini Pro Vision) are updated continuously. A benchmark run in January 2026 may call gpt-4-vision-preview, while a hospital deploying in July 2026 calls gpt-4o-2026-07-15. The audit showed that API version changes can introduce performance drift even when the model architecture is nominally the same [1].

Automated label disagreement

Many radiology benchmarks use automated labeling (e.g., extracting diagnoses from radiology reports via NLP). The audit found that the labels used for evaluation sometimes disagreed with the labels described in the data processing code, because intermediate CSV files were manually edited or filtered without documentation [1].

For Singapore hospital teams, these failure modes are not academic curiosities—they are procurement risks. If a vendor's benchmark is not reproducible, the hospital cannot verify that the deployed system will perform as advertised.

How does post-deployment fragility compound benchmark unreliability?

Even when a radiology AI system is validated successfully in a prospective trial, longitudinal evidence now shows that performance degrades post-deployment [2]. A peer-reviewed study in PLOS Digital Health documents several mechanisms:

  • Data drift: Patient demographics, imaging protocols, and disease prevalence shift over time. A chest X-ray AI trained on 2023 data may degrade when applied to 2026 patients with different comorbidities or COVID-19 vaccination histories.
  • Workflow changes: Radiology departments update PACS configurations, change referring physician ordering patterns, or introduce new imaging equipment. Each change can silently degrade AI performance if the model was not trained to handle the new distribution.
  • Infrastructure updates: Operating system patches, DICOM library updates, or GPU driver changes can introduce numerical drift in model inference, especially for quantized or optimized models.

The study concludes: "Validation is not enough" [2]. Singapore hospitals need continuous monitoring of deployed radiology AI, not just pre-deployment validation. We covered this in our clinical deterioration AI fragility guide, and the same principles apply to imaging AI.

What about vision-language model confabulation?

A separate preprint, Hearsay: Vision-Language Medical Diagnoses Without an Image, reveals a disturbing failure mode: when frontier VLMs (Claude Opus-4.7, GPT-5.4, Gemini-3.1-Pro) are queried with a demographic descriptor but no image attached, they do not abstain—they confabulate a diagnosis [6].

The confabulation is not random. It is structured by patient demographics. For chest X-rays, brain MRIs, and dermatology images, the models generate diagnoses that reflect demographic stereotypes even when no clinical data is provided [6].

For Singapore hospitals deploying VLMs for radiology report generation or clinical decision support, this finding has immediate implications:

  1. Failure-to-attach detection is mandatory: The system must verify that an image is actually attached before generating a report. This is not a default feature in most VLM APIs.
  2. Demographic bias auditing is required: Even when an image is attached, VLMs may still anchor on demographic descriptors in the prompt. Singapore hospitals should audit whether model outputs vary systematically by race, age, or gender when the image is held constant.
  3. Transparency requirements apply: Under the EU AI Act provisions tested in a recent PLOS Digital Health study, users need transparency about when and how demographic data influences AI outputs [3]. Singapore hospitals should adopt similar disclosure standards.

Why this matters in Singapore and Asia

Singapore's multi-ethnic population (Chinese, Malay, Indian, and others) makes demographic bias in radiology AI especially salient. If a chest X-ray VLM confabulates diagnoses based on race or ethnicity, it could exacerbate existing health disparities.

Moreover, Singapore hospitals are early adopters of clinical AI services, and procurement decisions made in 2026 will set precedents for the region. If Singapore hospital teams demand forensic reproducibility audits and continuous post-deployment monitoring, vendors will respond by improving their engineering practices. If hospitals accept benchmark claims at face value, the region will inherit fragile AI systems.

The HSA AI-SaMD sandbox pathway provides regulatory flexibility for low-risk AI, but it does not eliminate the need for rigorous procurement due diligence. Hospital teams should treat reproducibility audits as a minimum standard, not an optional extra.

What to do next

If you are evaluating radiology vision-language models for your Singapore hospital:

  1. Demand reproducibility artifacts: Ask vendors to provide version-pinned code, DICOM rendering pipelines, exact prompts, API version logs, and automated labeling scripts. If the vendor cannot reproduce their own benchmark, do not proceed.
  2. Audit for confabulation: Test whether the VLM generates diagnoses when no image is attached, or when demographic descriptors are varied while the image is held constant. Document the results before deployment.
  3. Plan for continuous monitoring: Implement longitudinal performance tracking with monthly or quarterly audits of sensitivity, specificity, and demographic subgroup performance. Use the failure taxonomy from our safety monitoring guide.
  4. Integrate with PACS governance: Ensure that DICOM rendering, worklist routing, and report generation are version-controlled and monitored. See our PACS integration architecture guide for implementation details.
  5. Engage clinical champions early: Radiologists must understand the limitations of VLM benchmarks and participate in procurement decisions. Schedule a workshop with your radiology department before issuing RFPs.

If you need help designing a reproducibility audit protocol or continuous monitoring pipeline for radiology AI, start a project with our team.

FAQ

What is the difference between a reproducibility audit and a validation study?

A validation study tests whether an AI system performs well on a held-out dataset, typically in a prospective trial. A reproducibility audit verifies that the published benchmark results match what the code, data, and prompts actually produced when the benchmark was run. Validation answers "Does this work?"; reproducibility answers "Can we trust the evidence?"

Do Singapore hospitals need to audit every radiology AI vendor?

Not every vendor, but every deployed system. If you are procuring a radiology AI system that will influence clinical decisions, you should verify that the vendor's benchmark is reproducible and that the deployed artifact matches the validated version. This is especially important for vision-language models, which are sensitive to prompt engineering and API versioning.

How do I test for VLM confabulation in a hospital setting?

Create a test set of prompts with demographic descriptors (age, gender, race) but no image attached. Query the VLM and record the outputs. If the model generates diagnoses instead of abstaining, document the failure mode and escalate to the vendor. Repeat the test with images attached, varying only the demographic descriptor, to check for demographic bias.

What should I include in a radiology AI procurement RFP?

Require vendors to provide: (1) version-pinned code and dependencies, (2) DICOM rendering pipeline documentation, (3) exact prompts and API version logs, (4) automated labeling scripts and ground-truth label provenance, (5) evidence of longitudinal performance monitoring in at least one deployed site, and (6) a plan for continuous post-deployment auditing. If the vendor cannot provide these artifacts, the proposal is incomplete.

Sources

[1] Forensic Reproducibility Audit of a Radiology Vision-Language Model Benchmark: From Intended Protocol to Released Artifact. arXiv cs.CL+medical, July 28, 2026. https://arxiv.org/abs/2607.25589v1

[2] Validation is not enough: Longitudinal evidence of post-deployment fragility in clinical AI systems. PLOS Digital Health, July 27, 2026. https://journals.plos.org/digitalhealth/article?id=10.1371/journal.pdig.0001534

[3] Transparency in healthcare AI: Testing EU regulatory provisions against users' transparency needs. PLOS Digital Health, July 24, 2026. https://journals.plos.org/digitalhealth/article?id=10.1371/journal.pdig.0001594

[6] Hearsay: Vision-Language Medical Diagnoses Without an Image. arXiv cs.CL+medical, July 29, 2026. https://arxiv.org/abs/2607.26886v1