构建首个急诊医学强化学习安全评估环境，检验大模型在真实压力下的全流程安全性。
HealthCraft: A Reinforcement Learning Safety Environment for Emergency Medicine
- 基于FHIR标准构建动态医疗环境，用24个工具模拟真实急诊流程
- 两模型在多步任务中表现骤降至1%以下，安全失败率超27%
- 专设双层评分体系，任一关键安全项违规即归零，适合临床AI安全验证
前沿语言模型正快速部署于临床工作流，但评估基础设施滞后。静态医疗问答基准无法捕捉急诊中的关键失效模式：轨迹级安全崩溃、工具误用及持续临床压力下的退化。我们提出HealthCraft，首个公开的强化学习安全评估环境，基于Corecraft改造，采用FHIR R4世界状态，包含14类实体与3,987个种子实体，提供24个MCP工具，并定义双层评分机制——任一安全关键指标违反即得零分。共发布195个任务，覆盖六个类别，依据2,255个二元评判标准（其中515个为安全关键）；后置10个负样本任务扩展至205个任务和2,337个评判标准。对两个前沿模型的测试显示，Claude Opus 4.6在Pass@1上为24.8% [21.5-28.4]，GPT-5.4为12.6% [10.2-15.6]，安全失败率分别为27.5%和34.0%。在多步工作流（最接近真实急诊场景）中，性能几乎归零（Claude 1.0%，GPT-5.4 0.0%），尽管单步任务尚有部分能力。从v2到v8的六处基础设施漏洞修复导致模型表现排序变化，表明评估环境保真度本身影响结果。通过确定性LLM裁判叠加控制评估噪声，60轮负样本烟雾测试显示奖励信号不可直接用于训练：约束条件通过率为0.929，虽可容忍于评估，但训练奖励不可接受。环境支持与Megatron+SGLang+GRPO循环耦合，训练奖励消融留作未来工作。环境、任务、评分标准与评估框架已开源，许可为Apache 2.0。
原文摘要 · Abstract (English)
Frontier language models are being deployed into clinical workflows faster than the infrastructure to evaluate them safely. Static medical-QA benchmarks miss the failure modes that matter in emergency medicine: trajectory-level safety collapse, tool misuse, and capitulation under sustained clinical pressure. We present HealthCraft, the first public reinforcement-learning environment that rewards trajectory-level safety under realistic emergency-medicine conditions, adapted from Corecraft. It is built on a FHIR R4 world state with 14 entity types and 3,987 seed entities, exposes 24 MCP tools, and defines a dual-layer rubric that zeroes reward whenever any safety-critical criterion is violated. We release 195 tasks across six categories, graded against 2,255 binary criteria (515 safety-critical); a post-hoc 10-task negative-class slate extends this to 205 tasks and 2,337 criteria. V8 results on two frontier models show Claude Opus 4.6 at Pass@1 24.8% [21.5-28.4] and GPT-5.4 at 12.6% [10.2-15.6], with safety-failure rates of 27.5% and 34.0%. On multi-step workflows - the closest proxy to real emergency care - performance collapses to near zero (Claude 1.0%, GPT-5.4 0.0%) despite partial competence on individual steps. Six infrastructure bugs fixed between pilots v2 and v8 re-ordered which model "looks stronger," evidence that infrastructure fidelity is part of the measurement. A deterministic LLM-judge overlay bounds evaluator noise, and a 60-run negative-class smoke pilot shows the reward signal is not drop-in training-safe: restraint criteria pass at 0.929 prevalence, a gameability an eval harness can tolerate but a training reward cannot. We scaffold coupling to a Megatron+SGLang+GRPO loop per Corecraft Section 5.2 and leave training-reward ablations as future work. Environment, tasks, rubrics, and harness are released under Apache 2.0.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。