PDI Verify: An Adversarial Audit Methodology for AI- Assisted Clinical Software Extended with Dual-Axis Clinical Context Preservation and Physician Assurance Layer

Version history: v1.0.0 (June 3, 2026) introduced the dual-axis A10+A11 certification standard and the tokenization-rehydration architecture (A10 CANNOT_CONFIRM pending implementation). v1.0.1 added Section 5.8 Transparency Posture. v1.0.2 closes A10 CANNOT_CONFIRM and introduces A12 Assurance Integrity.

The dual-axis standard (A10+A11): A10 tests whether PHI is removed from the pipeline. A11 tests whether clinical meaning survived the privacy process. Neither condition alone constitutes adequate certification for clinical AI — a system that strips all data is secure but useless; a system that preserves clinical content while leaking PHI is useful but breached. PDI Verified requires both simultaneously.

Tokenization-rehydration architecture: PHI is replaced client-side with reversible typed tokens before any API call, making PHI transmission to external AI services architecturally unnecessary. The 63-case adversarial red-team battery (AT-01 through AT-08) returned 63/63 BLOCKED. One real defect was found and fixed during the battery (PP-01 all-caps name variants), confirming the battery's function as a defect-finding tool. A10 CANNOT_CONFIRM from v1.0.0 is resolved.

A11 clinical context preservation: 21-case battery including paraphrase equivalence testing across three OB/GYN documentation styles (terse Epic bullets, dictated narrative, AI scribe template). 24/24 PRESERVED. The paraphrase equivalence result demonstrates that the parser extracts clinical meaning rather than documentation surface form.

A12 Assurance Integrity (v1.0.2): A new attack class derived by asking: if the physician-facing audit transparency layer were gameable, manipulated, or disconnected from actual validation results, how would that manifest? Eight attack cases (AC-01 through AC-08) test tamper resistance, deterministic generation, jargon-free legibility, and hash chain integrity. All 8 BLOCKED. The physician assurance layer — comprising a hash-chained BuildCertificate, a clinical-stakes PhysicianAssuranceSummary generated from raw validation results, a MaterialChangeNotification system, and a PublicAuditLedger — is now an architectural component of PDI Verify. It is generated automatically from cycle results, never manually authored, and verifiable independently by any party. The design principle A12 enforces: the assurance layer must be architecturally generated from validation results, never authored — because manual authorship is the attack vector.

Applied to PDI Med (v1.0), an OB/GYN clinical intelligence platform built with AI code assistance: 8 cycle-1 breaches, all remediated and re-attack confirmed. Cycle 2: zero breaches. A11: 24/24 PRESERVED. Tokenization: 63/63 BLOCKED. A12: 8/8 BLOCKED. PP-04 (BRCA variant/accession split) is proposed as a standard benchmark for clinical de-identification systems. PDI Med pursued Business Associate Agreements with all relevant vendors proactively and in parallel with these architectural protections.