Shake the Image, Watch the Report

Report generation models are increasingly deployed as a first-pass layer, particularly in resource-limited settings, producing a draft that a radiologist reviews. The position in the workflow is the crux of the problem. An automated report generator sits upstream of the radiologist and cannot request a reshoot. It produces a report on whatever it is handed.

If a model receives a marginal film and produces a confident, clean-sounding report, that report becomes an automation-bias hazard rather than a neutral artifact. A radiologist who was already uneasy about the image may override their own doubt when the AI reads it as normal. This is the specific harm the project was designed to detect: not diagnostic error in the ordinary sense, but silent, confident error on an input the model should have flagged.

In regards to prior work, there are 3 main literatures:

1. Synthetic augmentation studies (Ogawa et al. 2019; Zhou et al. 2021; Lin et al. 2024) apply rotation, contrast, brightness, and blur to medical images, almost always in the context of training-data augmentation rather than deployment-time robustness evaluation.

2. Clinical image-quality studies (Walz-Flannigan et al. 2018) document that real acquisition artifacts cause diagnostic error, but do not connect specific artifacts to specific model behaviors.

3. AI report evaluation studies (Guan et al. 2021; Nousiainen et al. 2021; Koh et al. 2021; Phillips et al. 2020) compare generated reports against reference reports using surface metrics, without varying image quality as an experimental factor.

The gap here is what we worked on: real-world image unusualness has not been connected to specific report failures. 

Synthetic-image pilot:

Before degrading anything, Ryan ran three synthetic images through all six report models: a cartoon chest, an image of the moon, and a field of vertical stripes. From these gimmick images, five of six models produced a confident, structured radiology report regardless.

The moon returned as "Mild cardiomegaly. Left rib fractures. External electronic device obscuring the left apex" from model-f. The stripe field returned as "There is a linear lucency through the posterior aspect of the left scapula. No definite fracture is identified" from model-a. The cartoon chest returned a clean normal report from model-c, and only model-d flagged the inputs as non-diagnostic.

This is the failure mode demonstrated at its most extreme, but isn’t evidence on its own. Reza Chavoshi (HITI Lab mentor) made this point directly during feedback rounds and he was right: these images would never reach a radiologist, so a model's behavior on them says little about deployment. What the pilot does establish is narrower, and still useful. A fluent report is not evidence that the model looked at a chest X-ray. Everything following asks whether this same thing happens at severities that actually reach a reader.

Mentor feedback from Reza Chavoshi and Hari Trivedi reshaped the perturbation design partway through. The point they made was that perturbations must be clinically possible. A 90-degree rotation gets corrected in the PACS viewer. A completely black image gets reshot. But a 10-degree rotation is difficult for the human eye to catch and nobody reshoots for it. Underexposure and overexposure happen. Patient rotation happens, and shows up as uneven clavicles. Motion blur happens.

In total, eight perturbation families were built, five of them at three ordered severity levels. Rotation runs at five to ten, ten to fifteen, and fifteen to twenty degrees, standing in for patient positioning error. Underexposure runs at dose fractions of 0.25, 0.10, and 0.04, standing in for acquisition parameter error. Motion blur runs at three, eight, and fifteen millimetres for movement during exposure. Anatomical clipping removes five, fifteen, and thirty percent of the field for collimation error. JPEG compression runs at quality factors twenty, eight, and three for storage and transmission loss. 3 further families run at a single level: grayscale inversion and laterality flip, both processing or display errors, and quantization to eight gray levels. However, quantization is labelled and functions only as a stress test throughout since real radiographs have 12-16 bits of depth, so 8 gray levels is not a real-world defect.

Two families run backwards from what the parameter name suggests, and both orderings were verified before any trend testing. Underexposure is parameterised as a dose fraction, so 0.04 is darker and worse than 0.25. JPEG uses the standard quality factor, so q03 is more compressed and worse than q20. Getting either ordering wrong would have inverted the direction of every trend test downstream. The full library with plausibility tiers is in Table 2 (above section), and the quality-control previews confirming each defect applied as specified are in Figure 2 below.

Motion blur is specified in millimetres, which requires an assumption, since PNG exports carry no pixel spacing. Image width is taken to span roughly thirty-five centimetres of chest.

Every model in the evaluation reads multiple views, which forced a decision about the lateral. Leaving it pristine would let a model recover a finding from the intact view, and the amount recovered would vary with how heavily each model weights its two inputs, so attenuation would differ across models for reasons having nothing to do with robustness. Both views were degraded at matched severity throughout.

As aforementioned, based on mentor feedback, our team also decided to look for perturbations in our existing data. Rather than asserting that a given perturbation severity is realistic, we measured how far each one moves an image from the natural distribution of real no-finding scans, in embedding space.

The result is a calibration curve placing every synthetic defect on the same axis as real clinical variation. Rotation, contrast adjustment, and mild motion sit inside the range of ordinary variation in the dataset. Quantization and heavy JPEG sit outside it.

Scale:

Total generated: 5,356 reports, compared against 15,858 human radiologist reports. Six report models, eight perturbation types at ordered severity, 150 reports per cell. Throughput was the main constraint. Roughly 1,000 studies through six models took eight to ten hours, with two concurrent API jobs permitted per team, so all generation ran overnight unattended.

This is the measurement layer I built.

Definitions and validation:

Every report gets scored on two binary questions. The first asks whether it contains uncertainty language, meaning words like possible, probable, may represent, cannot exclude, suggestive of, suspicious for, concerning for, questionable, likely, could represent, or differential. The second asks whether the report remarks on the image itself, meaning phrases like limited by, suboptimal, technically limited, rotated, underpenetrated, overpenetrated, motion, degraded, obscured by, poor inspiration, or difficult to evaluate. That second list explicitly excludes "no prior films available for comparison," which concerns missing priors rather than the image in hand and appears often enough that counting it would inflate the measure substantially. Both are computed at report level, meaning the fraction of reports containing at least one match rather than a count of matches within a report, which is what makes the numbers directly comparable to published prevalence figures reported the same way.

A homemade word list is the obvious attack surface for this kind of analysis, so I validated it three ways. List 1 is our original fourteen terms. List 2 is the same list with "most likely" excluded but bare "likely" retained, on the reasoning that the Brigham and Women's Hospital Diagnostic Certainty Scale (Shinagare et al. 2020) maps "most likely" to greater than 90% probability, which is assertion rather than hedging, and "likely" to 75 to 90%, which is hedging. In practice that distinction proved almost irrelevant, since across all 5,356 reports the two lists differ by at most 2.7 percentage points and the human rate moves only from 15.2% to 14.9%. "Most likely" is simply rare in radiology reports, which is itself worth knowing. List 3 is Callen et al. 2020, a published 44-term uncertainty lexicon validated on 642,569 report impressions from 171 radiologists.

The validation result is the important one. Callen's lexicon applied to our 15,858 human DS4 reports returns 24.7%, against Callen's reported 29.5% for general radiography, and the gap is consistent with DS4 being chest radiography exclusively rather than the full exam-type mix Callen covered. The pipeline reproduces a published prevalence on independent data, which is what converts a word list assembled in an afternoon into an instrument someone else can trust. A separate external check points the same direction, since our human quality-statement rate of 1.0% sits in the same range as Mabotuwana et al. (2018), who found technical quality concerns in 2.4% of 1.2 million radiology exams. Model rankings held across all three lists, and while the absolute numbers shift by roughly ten percentage points depending on lexicon breadth, the relative ordering between models and conditions does not, which is what the argument actually rests on.

LLM cross-check:

Keyword matching cannot handle negation, and negation carries most of the clinical content in a radiology report. The phrase "no suspicious nodule" contains suspicious and gets flagged as hedging despite being a confident negative. To bound that error, Gemma 4 31B Instruct at temperature zero re-read 600 reports drawn from the four cells carrying the project's claims, with explicit rules in the prompt: negation is not hedging, "most likely" is assertion under the BWH scale, "likely" alone is hedging, and recommendations such as "may benefit from additional views" are not diagnostic uncertainty.

Both methods agree on direction and magnitude in every cell, as shown in Table 3. The correction ran both ways, which is what makes it credible rather than merely confirmatory. The model caught contextual hedging no word list would find, including "questionable small left pleural effusion" and "minimal linear scar or atelectasis," where the uncertainty sits in the framing rather than in a hedge word. It also threw out recommendation phrasing that the broad Callen list had over-counted in model-a's underexposure cell, where matches on the bare word may were coming from sentences about repeating the study rather than about the diagnosis.

Results:

Cochran-Armitage trend tests were run across ordered severity at n of 150 per cell, giving eight tests across two models and four defect families, of which three came back significant. The full matrix is in Figure 6.

Model-a responds to underexposure and to nothing else. Its hedging climbs from 1.3% on clean images to 16.0% at four percent dose, a rise of 8.7 percentage points at p = 0.0002, and it names the problem outright, writing that the lung bases are not included in the image. Quality statements rise in parallel from 0.7% to 8.7% at p = 0.001. Motion, clipping and JPEG all return flat. Model-e reverses under motion blur, with hedging falling from 24.7% on clean images to 12.0% at fifteen millimetres, a drop of 12.7 points at p = 0.0003, monotonic across all three severity levels and confirmed by the clean-versus-severe comparison at p = 0.005. The more degraded the image, the more confident the report. That same model responds correctly to JPEG compression, climbing 8.6 points from 24.7% to 33.3% at p = 0.014, and returns flat on underexposure and clipping.

The flat cells are the finding rather than an absence of one. Neither model is calibrated across defect types and there is no overlap in what they catch, with model-e detecting a digital artifact and missing a physical one, which is close to the opposite of what clinical usefulness would require. Joining this to the erasure results gives the headline: motion blur erases the most findings and triggers the least warning. One plausible mechanism for the model-e reversal, though not one this study tests, is that severe blur collapses the visual signal so completely that the model falls back on a confident normal-template report, and distinguishing that from the alternatives would require attention analysis this project did not run.

Everything above imposes degradation. The complementary question, raised by Dr. Judy Gichoya during mentor rounds, is whether these defects already exist in real data, because if naturally degraded images can be found then no argument about the realism of synthetic perturbation is needed at all. Rohan Isaac led this track, with Kanika Bhalla and Myeisha Jaiswal.

Cohort and metric:

Starting from 15,858 DS4 image rows, a strict homogeneous cohort was built on adult age, exact PA view, No Finding = 1, image file present, non-portable evidence, and upright status confirmed or presumed. Portability was inferred conservatively from the current-exam report heading only, examining text before COMPARISON or FINDINGS so that a mention of a prior portable exam would not be misread as describing the current one. Forty-one studies were excluded for portable, mobile or bedside wording and three for missing, conflicting or unclear evidence, leaving a final cohort of 4,732 unique patients with one image and one study each. The point of all that filtering is that if every patient is a healthy adult imaged the same way, then any variation left between images cannot be explained by pathology or acquisition mode. It has to be the image.

For each image, take the global embedding, L2-normalize, reduce to 50 principal components, then compute the mean Euclidean distance to its q nearest neighbors within the cohort, written as d_q(i) = (1/q) Σ ||z_i − z_j||₂ over the q nearest neighbors of i. Higher mean neighbor distance means the image sits in a sparser region of embedding space, which is another way of saying that fewer similar images exist. Studies were ranked on that score and split into five percentile bands running from very typical to extremely unusual, with fifty randomly sampled from each.

What the bands show:

The archived clean reports for the sampled studies were scored against the human reports using BERTScore F1, RadGraph-F1, and a Gemma-scored clinical discrepancy metric, across five cohorts: No Finding plus pleural effusion, cardiomegaly, atelectasis and pneumothorax. Report quality degrades as images become more unusual, with BERTScore and RadGraph-F1 both falling across the bands while the Gemma discrepancy score rises.

One exception was informative. For pneumothorax, BERTScore F1 went up as images became more anomalous, opposite to every other cohort and metric. On manual inspection, BERTScore was scoring both the explicit presence and the explicit absence of pneumothorax as a match, since the surrounding language is nearly identical and the word appears either way. RadGraph and the Gemma judge caught the discrepancy that BERTScore could not. This is a concrete demonstration of why surface metrics fail on negation, and it is the same weakness the LLM cross-check was built to address in the hedging analysis, arrived at independently in a different track.

Kanika Bhalla and Myeisha Jaiswal then measured surface image properties directly on the sampled images, specifically mean brightness, standard deviation as a proxy for contrast, and pixel variance. All three correlate with the unusualness band, and that is what breaks the circularity in the track. The unusualness score derives from model embeddings and the reports come from the same models, so on its own "the model does worse on images it finds unusual" is close to tautological. Brightness, contrast and pixel variance are computed from raw pixels with no model involved anywhere, so the chain becomes physical property, then embedding position, then report degradation, with the first link grounded outside the model. Ryan noted during the presentation that the brightness differences, while more variant in anomalous images, remain within normal bounds, so the models are not simply reading brightness.

To join the two halves, the synthetic track imposed underexposure and motion blur whereas the natural track found that deviant images differ in brightness and pixel variance. Underexposure is a brightness reduction, and motion blur collapses pixel variance because blurring averages neighboring pixels toward one another. Two approaches developed in parallel by different people converged on the same physical axes, which means the synthetic defects are controlled versions of variation already present in the Emory data.

Our Contribution:

WILDS (Koh et al. 2021) captures natural distribution shift without synthetic corruption, while CheXphoto (Phillips et al. 2020) applies synthetic corruption to chest radiographs without grounding in real-world deviation. This project does both, calibrating corruption severities against a learned anomaly metric derived from real atypical images, which quantifies how realistic each perturbation actually is rather than asserting it.

On the hedging side, the closest published comparison is CheXthought (arXiv 2604.26288), which reports radiologists expressing uncertainty in 44.2% of chains-of-thought on optimal studies versus 84.1% on suboptimal ones. That figure is confounded for our purposes, because the same annotator rated the image quality and expressed the uncertainty within a structured framework that required commenting on technical adequacy. Our design assigns quality independently of whoever writes the report.

Dileep Gunda wrote a formal pre-registration at 04:45 on August 1, before any perturbed report existed, committing to the cohort, the primary outcome of CREST risk-weighted error per study measured within-model clean versus perturbed, five hypotheses, the analysis plan, and eleven stated limitations. Two of its hypotheses were interestingly predictive rather than retrospective. H1 predicted that models with a small vision encoder relative to their language model would shift toward fabrication under degradation as the language prior fills the gap, noting that model-e has a 1.3% vision share against model-c's 16.4%. H4 predicted that photometric inversion would separate the models more sharply than any graded defect, on the reasoning that a model returning a confident normal report on an inverted radiograph is not checking image quality at all. The document also contains a yardstick measured before any perturbation: different models disagree with model-a by 6.3 to 10.7 CREST points per study on identical clean images, which frames the scale of any defect effect against the effect of simply swapping models.

Limitations:

Compute limited the full severity grid to two models, so the hedging trend analysis covers model-a and model-e only. The design generalizes to any report generation model; the coverage does not yet, and no claim here should be read as a statement about report generation models in general.

DICOM view labels are unreliable, and laterals mislabeled as PA are present in the cohort. Hari Trivedi identified this during mentor rounds, noting that the standard correction is a learned view classifier rather than trusting the header field. Kanika produced a PA-only version of the contrast analysis to control for it in one place, but it is not controlled everywhere.

Keyword detection is imperfect and has no negation handling. It is applied identically to clean and degraded reports on the same studies, so it cannot manufacture a difference between them, but it is LLM-verified on only 600 of 5,356 reports and the rest carry that uncorrected error. Quantization to eight gray levels is not clinically possible and is labeled a stress test throughout; the pre-registration notes that the active-learning decision boundary in an exploratory analysis was driven by that cell rather than by realistic degradation.

The unusualness score is model-derived and partially circular by construction, with the brightness and contrast result being what grounds it externally. Model-c returned cosine similarity of exactly 1.0000 under every perturbation condition in the embedding analysis, flagged as possible embedding degeneracy rather than genuine invariance and never resolved. The two-patient sanity check, comparing two different patients' clean images under model-c, would settle it in minutes and remains the clearest open loose end in the project.

The images are presentation data rather than raw detector output, so the display LUT is already applied and pixel values are not linear in dose, which is why severity is reported by measured SNR rather than nominal dose. No radiologist adjudicated any output, with CREST risk weighting substituting for a clinical consequence grade. And the cohort skews toward normal, since roughly 70 to 80% of DS4 carries no positive finding, which shaped both sampling strategies and constrains every erasure denominator.

Deliverable + Next Steps:

What this produces is a reusable audit protocol for black-box report generation models: a small labelled defect benchmark with severities calibrated against real image variation, two metrics kept deliberately separate asking whether the finding holds and whether the model flags the image, and validated hedging and quality-statement detection with published-lexicon cross-reference. Any report generation model can be run against it without access to weights, training data, or internals.

The next steps are to validate the anomaly metric across imaging modalities beyond chest radiography, and to generate perturbations that mimic real anomalies automatically by learning the direction of real deviation in embedding space and synthesizing along it, which would move the field from hand-designed corruptions toward ones discovered from data.