Mar 10, 2025

Medical Agent Controller

Quentin Marquet, Ouafae Moudni, Shakthivel Murugavel, Xavier Charles, Elise Racine

The Medical Agent Controller (MAC) is a multi-agent governance framework designed to safeguard AI-powered medical chatbots by intercepting unsafe recommendations in real time.

It employs a dual-phase approach, using red-team simulations during testing and a controller agent during production to monitor and intervene when necessary.

By integrating advanced medical knowledge and adversarial testing, MAC enhances patient safety and provides actionable feedback for continuous improvement in medical AI systems.

Reviewer's Comments

Reviewer's Comments

Arrow
Arrow
Arrow

Strengths:

-Comprehensive Literature Review: The paper demonstrates a strong understanding of existing literature, particularly around AI hallucinations, biases, and medical AI risks.

-Novel Methodology: The multi-agent controller framework is innovative and addresses a critical gap in regulating medical AI chatbots.

-Clear Methodology: The experimental design and methodology are well-documented, with detailed explanations of the red team and controller agents.

-Real-World Impact: The framework was tested in a controlled production environment, demonstrating its practical applicability and low-latency performance.

-Societal Relevance: The paper effectively connects AI safety challenges to real-world implications in healthcare, such as patient safety and ethical concerns.

Areas for Improvement:

-Limitations and Negative Consequences: The paper does not explicitly discuss the limitations of the framework or potential negative consequences of its implementation. Adding this would strengthen the analysis.

-Conclusion Expansion: The conclusion could be expanded to include more actionable recommendations and future research directions, particularly around scalability and cross-cultural applicability.

Suggestions for Future Work:

-Conduct larger-scale experiments to validate the findings and improve generalizability.

-Explore cross-disciplinary approaches (e.g., ethics, policy) to broaden the societal impact of the research.

-Investigate the framework’s performance in diverse cultural and regulatory contexts.

Thank you for submitting your work on ‘Medical Agent Controller’ - it was interesting to read. Please see below for some feedback on your project:

1. Strengths of your proposal/ project:

- The paper is well referenced and well structured

- This is a topical area, which is in need of more attention from researchers and people in industry

- This appears to be a novel contribution

2. Areas for improvement

- This paper needs to more strongly delineate between ‘AI-driven medical chatbots’ - which are regulated as medical devices in the UK (which isn’t mentioned), and general purpose AI models that aren’t regulated as medical devices. Could you expand upon why ‘many health chatbots remain unclassified as medical devices’? (p.2).

- It is good that you provide a threat model. This could be more fleshed out (e.g., with a Theory of Change, and/or examples), and it would be helpful if you outlined the implications of these threats. E.g., what is the impact/ implication of bias and discrimination?

- More specifics would be better re: methods - e.g., ‘Through thousands of simulated conversations orchestrated by the Red Team Agent’ - how many thousand? What conversations - can you provide an example?

- It would be helpful to understand a bit more about the background of MAC - has it been used elsewhere, etc?

Well written and clear. I like the pragmatic approach of designing a tool that seems like it could be combined with an arbitrary medical chatbot.

I would be even more excited if the project tried some more original approach - I feel a bit like you are playing it safe, sticking to rather established methods and well-known challenges. That said, the problem is real and important and the project seems well executed.

Cite this work

@misc {

title={

Medical Agent Controller

},

author={

Quentin Marquet, Ouafae Moudni, Shakthivel Murugavel, Xavier Charles, Elise Racine

},

date={

3/10/25

},

organization={Apart Research},

note={Research submission to the research sprint hosted by Apart.},

howpublished={https://apartresearch.com}

}

Recent Projects

View All

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

Feb 2, 2026

Fingerprinting All AI Cluster I/O Without Mutually Trusted Processors

We design and simulate a "border patrol" device for generating cryptographic evidence of data traffic entering and leaving an AI cluster, while eliminating the specific analog and steganographic side-channels that post-hoc verification can not close. The device eliminates the need for any mutually trusted logic, while still meeting the security needs of the prover and verifier.

Read More

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.
This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.