PDI Verify: An Adversarial Audit Methodology for AI- Assisted Clinical Software Extended with Dual-Axis Clinical Context Preservation and Physician Assurance Layer

Version history: v1.0.0 (June 3, 2026) introduced the dual-axis A10+A11 certification standard and the tokenization-rehydration architecture (A10 CANNOT_CONFIRM pending implementation). v1.0.1 added Section 5.8 Transparency Posture. v1.0.2 closes A10 CANNOT_CONFIRM and introduces A12 Assurance Integrity.

The dual-axis standard (A10+A11): A10 tests whether PHI is removed from the pipeline. A11 tests whether clinical meaning survived the privacy process. Neither condition alone constitutes adequate certification for clinical AI — a system that strips all data is secure but useless; a system that preserves clinical content while leaking PHI is useful but breached. PDI Verified requires both simultaneously.

Tokenization-rehydration architecture: PHI is replaced client-side with reversible typed tokens before any API call, making PHI transmission to external AI services architecturally unnecessary. The 63-case adversarial red-team battery (AT-01 through AT-08) returned 63/63 BLOCKED. One real defect was found and fixed during the battery (PP-01 all-caps name variants), confirming the battery's function as a defect-finding tool. A10 CANNOT_CONFIRM from v1.0.0 is resolved.

A11 clinical context preservation: 21-case battery including paraphrase equivalence testing across three OB/GYN documentation styles (terse Epic bullets, dictated narrative, AI scribe template). 24/24 PRESERVED. The paraphrase equivalence result demonstrates that the parser extracts clinical meaning rather than documentation surface form.

A12 Assurance Integrity (v1.0.2): A new attack class derived by asking: if the physician-facing audit transparency layer were gameable, manipulated, or disconnected from actual validation results, how would that manifest? Eight attack cases (AC-01 through AC-08) test tamper resistance, deterministic generation, jargon-free legibility, and hash chain integrity. All 8 BLOCKED. The physician assurance layer — comprising a hash-chained BuildCertificate, a clinical-stakes PhysicianAssuranceSummary generated from raw validation results, a MaterialChangeNotification system, and a PublicAuditLedger — is now an architectural component of PDI Verify. It is generated automatically from cycle results, never manually authored, and verifiable independently by any party. The design principle A12 enforces: the assurance layer must be architecturally generated from validation results, never authored — because manual authorship is the attack vector.

Applied to PDI Med (v1.0), an OB/GYN clinical intelligence platform built with AI code assistance: 8 cycle-1 breaches, all remediated and re-attack confirmed. Cycle 2: zero breaches. A11: 24/24 PRESERVED. Tokenization: 63/63 BLOCKED. A12: 8/8 BLOCKED. PP-04 (BRCA variant/accession split) is proposed as a standard benchmark for clinical de-identification systems. PDI Med pursued Business Associate Agreements with all relevant vendors proactively and in parallel with these architectural protections.

Version 1.0.3 adds a fourth extension: live-target parser calibration methodology.

The A10 adversarial de-identification battery was run against real Epic production notes across five clinical note types — GYN office visits, UTI/vaginitis encounters, prenatal flowsheet notes, C-section operative reports, and GYN operative reports. This is the first live-target validation of the PDI Verify A10 battery against real EMR output, replacing synthetic-only testing for the de-identification pipeline.

Key findings from live-target testing:

Three rounds of calibration surfaced four failure mode categories invisible to synthetic adversarial testing: (1) Latinized microbiology organism names (Bacterial Vaginosis, Chlamydia Trachomatis, Neisseria Gonorrhoeae) that match name detection patterns; (2) prenatal flowsheet column headers specific to Epic's OB format; (3) OR operative note administrative labels; and (4) a partial name survival pattern requiring period-optional middle initial matching. All four categories were addressed, regression suite expanded to 45 tests, and the PDI Audit A10 battery rerun.

Cycle 3 result: PDI-CERT-0003 — A10 BLOCKED, zero breaches.

Battery: 9 × BLOCKED + 2 × BLOCKED_WITH_PRESERVATION. The BLOCKED_WITH_PRESERVATION outcome for PP-04 (BRCA variant/accession split) and PP-06 (relative name with clinical data) is confirmed as the correct and expected result — PHI stripped while clinically essential content (genetic variant notation, relative genotype data) is preserved. This outcome represents optimal de-identification behavior, not a partial pass.

Calibration queue architecture introduced.

Every de-identification pass generates a redaction report containing no PHI — only structural metadata about what was redacted and where. Physician corrections to AI-extracted clinical nodes generate a delta report at the structural level (correction patterns, not patient content). When 30 delta reports accumulate, a single API call sends them directly from the physician's browser to the AI model provider for pattern analysis. PDI Med servers are not in this data path. The calibration brief returned identifies systematic parser errors for targeted fixes. This architecture enables continuous parser improvement without PHI transmission and supports per-physician, per-EMR personalization as a byproduct of normal clinical use.

The three-phase live-target methodology — synthetic adversarial testing, live-target calibration, regression suite expansion — is documented as the approach that produces a de-identification pipeline sufficient for production clinical use. Synthetic testing finds anticipated failure modes. Live-target testing finds unanticipated ones. Both are necessary.