Large language models (LLMs) have revolutionized health care by enhancing patient care, streamlining administrative processes, and advancing medical research. For instance, LLMs are used to analyze patient data for disease management, assist in prior authorization processes by summarizing extensive clinical records, and even support clinical decision-making by providing diagnosis suggestions. Additionally, ambient scribing, where LLMs generate clinical notes from doctor-patient interactions, can significantly reduce the administrative burden on health care providers [1,2].

In such an increasingly LLM-mediated health care ecosystem, understanding LLM robustness—defined as the model’s ability to maintain consistent and accurate performance despite the presence of noise, ambiguity, or variability in input text—is crucial. This includes resilience to typographical errors, domain-specific jargon, abbreviations, and other real-world linguistic variations commonly found in clinical and patient-generated text [3,4]. Such real-world scenarios often invalidate the foundational assumption of many natural language processing systems that rely on clean datasets, especially in health care, where users are frequently tired, sick, or cognitively impaired, and may redact personal information from their queries, either accidentally or intentionally [5]. For instance, related studies suggest that roughly 14% of health search queries contain typos [3].

As a result, evaluations conducted under ideal conditions are not reflective of health care applications, where robustness to input variations is essential. Most existing evaluations focus on nonmedical contexts and do not prioritize robustness, sometimes narrowly construing robustness analysis as attempts to exploit the system for unsafe responses. An often-understudied approach is to assess how everyday users, seeking health information from LLMs, naturally introduce variations and errors in their inputs. Past research has identified several types of errors users make when typing search queries, including phonetic, morphological, orthographic, cognitive, and keyboard layout errors [6]. While there is significant literature on these variations in human input, their impact on LLM performance in health settings remains understudied. In this study, we systematically examine the effects of 3 common types of human variations and levels of perturbation on the performance of LLMs across various health-related tasks. To do so, we also develop and share a novel health–centric dataset with several types of human variations [7,8]. We systematically evaluate the resilience of 3 different LLMs to variations of the original text, particularly in health care contexts. As LLMs continue to be increasingly adopted in health care contexts by professionals and patients alike [9-11], studies like ours are important to find acceptable limits and set guardrails where necessary.

Contrary to expectations, our findings suggest that LLMs are quite robust to common textual perturbations. Furthermore, the impact of these perturbations is far from monotonic—that is, performance does not consistently degrade as input quality worsens. In fact, we observed several instances where model performance improved following certain perturbations. Among the 3 types of variations we studied, redaction—the removal or masking of information, often due to privacy concerns or cognitive lapses [12]—proved to be the most detrimental. This was followed by homophones (words that sound alike but have different meanings or spellings, such as “heal” vs “heel”) and typographical errors (misspellings or accidental keystrokes, such as “diabtes” instead of “diabetes”), which had comparatively milder effects. We hope that our perturbation dataset (Multimedia Appendix 1) and the findings will stimulate more research at the intersection of robustness and health using LLMs. Ensuring that LLMs can handle the imperfect real-world data encountered in health care settings will enhance their reliability and effectiveness, ultimately supporting better patient outcomes.

LLMs have made significant strides in health care applications, such as clinical decision support, medical question answering, and patient education, which constitute 62% of health care use cases [13]. The robustness of LLMs is viewed in terms of benchmarks of efficiency and reliability of models, or user experience metrics of applications [13,14]. Our work emphasizes the impact of user input variations in real-world health care applications.

Prior studies have investigated LLM robustness to word-level and typographical perturbations [15-17] and have also highlighted their capabilities in language error correction [18]. However, evaluating robustness at the intersection of LLMs and health care remains a critical step toward responsible and ethical innovation and adoption in medical settings. This study assesses LLM performance across a range of health-related tasks, including sentiment classification (eg, for patient diarization), medical note classification, and health care–focused question answering [8]. Notably, this study represents one of the earliest systematic efforts to measure and evaluate LLM robustness to human-like input variations within the health care domain.

Typographical errors frequently occur when patients input their symptoms or information, often under stress, sickness, or haste. Homophones are common when mediated by verbal communication (eg, text to speech for doctors’ notes), when written by individuals with limited understanding of medical terms or the English language, or when under cognitive impairments or fatigue [19,20]. Redaction is routinely used to protect sensitive patient information and can also happen under stress or duress [12]. In fact, masking certain words is one of the most common approaches for evaluating LLM model performance. Here, we do not infer intentionality but rather use redaction as a short-hand notation to describe this phenomenon of removing some of the words [18,21]. By focusing on these perturbations, our research aims to provide a targeted and practical assessment of LLM performance in health care settings, making our findings directly interpretable.

This research aims to provide insights into the following research questions (RQs):

We designed an experiment with 3 commonly occurring human variations over 3 medically relevant tasks for 3 different LLMs. We introduced various perturbation levels to input texts for each of the 3 tasks and examined the response from each of the LLMs [22,23]. For baseline comparisons, we also measured the LLM responses to the original unperturbed texts.

We evaluated the robustness of LLMs across 3 different medical tasks. The first task is a classification task that required the LLM to identify the sentiment of a given sentence. The second task is also a classification task in which the LLM determined a disease condition from a medical abstract given [7,8,24]. The sentiment task has 2 categories, and medical condition has 3 categories. This design is intended to evaluate the accuracy of the classification using both binary and ternary categories. The third task is a question-and-answer task in which the LLM responded to a question about a medical note provided [7,25].

The experiment workflow is shown in Figure 1. The input data obtained from each of the datasets is perturbed and packaged within the prompt. This prompt is sent to the LLM via an application programming interface (API), and the responses are recorded. These responses are compared and evaluated based on the ground truth available in the original database. The settings for each of the LLMs are summarized in part C in Multimedia Appendix 2.

End users and patients often turn to general-purpose tools, such as search engines and publicly available chatbots—even when more specialized health care models exist—for health-related information-seeking and decision support [5,26]. To reflect this real-world usage pattern, we selected both general-purpose and domain-specific LLMs for evaluation, with a focus on their utility in health-related tasks.

We perturbed the input text provided to the LLMs using 3 techniques intended to simulate typical human-based perturbations: first, we introduced typographical errors; second, we used homophones to replace words in the text (eg, disease vs decease); and third, we removed some words from the text [21]. The examples of such perturbations are shown in Table 1.

Different levels of perturbations elicit different responses from LLMs. Each perturbation technique is applied as a percentage of the textual data to systematically investigate the models’ robustness. In this study, we use 3 levels of perturbation: low, medium, and high. The operationalization for each type of perturbation is described below.

Perturbations are introduced as a percentage of the total number of characters. We test typographical errors at 10%, 30%, and 50%, which we refer to as low, medium, and high perturbation levels, respectively.

These perturbations are applied as a percentage of the total number of words, specifically at 10%, 20%, and 30%, which we refer to as low, medium, and high, respectively. Given that not all words have homophones, these lower percentages are realistic for evaluating the effects of homophone confusion in medical queries. We consider the first level of perturbation (eg, 10%) in each category to be low and the next 2 levels to be medium and high, respectively. By systematically varying these perturbation levels, we aim to understand how LLMs handle common errors in medical contexts, thereby assessing their practical utility and reliability in real-world health care applications.

Perturbations are implemented as a percentage of the total number of words. We examine the impact of word redaction at the 10%, 30%, and 50% levels, simulating scenarios where critical information might be partially obscured or omitted in medical documentation. Similar to typographical errors, we refer to these levels as low, medium, and high.

We selected 3 datasets as the tasks for this study: tweet emotions [27], medical abstracts [28], and question answering [29]. Our perturbation process targets semantically valid words, which we define based on their part-of-speech tags. Specifically, we consider adjectives, adverbs, verbs, and nouns as valid words for perturbation. Since sentences vary in the number of valid words they contain, we adjusted the perturbation to ensure that a specific percentage of words in each sentence is perturbed while only targeting valid words. For example, in a sentence containing 10 words, of which 5 are valid, a 10% perturbation rate corresponds to perturbing 1 valid word, effectively 20% of the valid words in that sentence.

After identifying the words to perturb, we applied one of the following transformations:

After applying perturbations, we retained only examples that could generate all specified perturbation percentages (eg, 10%, 30%, 50%). These perturbed representations are combined into a new dataset called Health-LLM-Perturbation Dataset that we will be sharing with the community to support similar research by others.

For generative language model experiments, we split the data as follows:

For Bidirectional Encoder Representation from Transformers (BERT)–based language model experiments, we randomized the dataset, excluding the same 1000 test samples, and divided the remaining data into an 80% training set and a 20% validation set. In question-answer experiments, even if a medical note had multiple associated questions in the original dataset, we selected only one of those questions to include in our dataset. Training, validation, and test sets were split based on unique medical notes to ensure no overlap between the sets.

The conversational prompt may take various forms depending on the medical task. We adopted a few-shot (n=5) prompting approach in this work. Few-shot prompting is a technique to guide LLMs to perform specific tasks by providing a few examples (or “shots”) within the prompt. The exact prompts for each of the tasks are given in part A of Multimedia Appendix 2. The basic structure of a 5-shot prompt consisted of a role assignment, 5 examples, specific instructions, input data, and other instructions (if necessary). In the case of classification tasks, this basic structure was followed. For the question-and-answer tasks, we additionally instructed the LLM to provide an answer based only on the medical note provided. With an API call to the LLM, each data text was tested within its own session. However, when testing manually, the LLMs sometimes responded based on previous prompts, especially if the medical notes were similar. As a precautionary measure, to ensure separation across medical cases, specific instructions were included to prevent LLM from being contaminated by short-term memory. To improve the accuracy of the response, we instructed the LLM to provide a short justification, and in case no justification could be provided, the LLM was instructed to respond accordingly. Asking the LLM to provide an explanation for the response helped the LLM provide a more accurate answer [23].

For classification tasks, such as sentiment and medical condition, 4 metrics were used for evaluation: accuracy, recall, precision, and F1. For the question-answer task, distance measures such as BLEU (Bilingual Evaluation Understudy) [30], ROUGE (Recall-Oriented Understudy for Gisting Evaluation) [31], and BERTScore (Bidirectional Encoder Representation from Transformers) [32] were used [33]. Although the 3 measures were used, only one of the measures would be used for analysis because averaging the 3 different measures would not be meaningful and introduce noise. The purpose of collecting data was to see if the patterns were different for the 3 measures. For researchers interested in any of the 3 measures, we make the results available in Tables S7 and S8 in Multimedia Appendix 2.

We evaluated the performance in terms of variation from the original average. For ease of interpretation, we split them into the following 4 categories [34-36]:

We used the statistical package of Microsoft Excel to perform statistical tests. To examine the effect of perturbations RQ1, we aggregated the results and determined the proportions of the levels of impact of perturbations. Then, we performed a Pearson chi-squared test to check if perturbation effects were independent across tasks and LLMs. To examine the relative impact of perturbations across dimensions RQ2, we conducted repeated measures ANOVA across tasks, perturbations, perturbation levels, and LLMs, which is reported in Table S9 in Multimedia Appendix 2. In order to strengthen our numerical analysis by assuming nonnormal data, we conducted a nonparametric Friedman chi-square test [37] across groups for each dimension, followed by post hoc tests using pairwise Conover tests with the Bonferroni correction. To examine the effect of perturbations on medical terms RQ3, we compiled the proportions of perturbed text that were medical terms and then evaluated the effects.

All study procedures complied with OpenAI’s usage policies and ethical guidelines. No personal or sensitive information was used or generated during the research, and all data were securely stored with access restricted to authorized research personnel. No human subject was involved, and all data used were based on publicly available sources. Therefore, an ethics approval was not sought. The overarching goal of this study is to contribute to the development of health LLMs that are safe and equitable across input variability. By systematically evaluating the impact of different levels of input variability on health LLMs, this exploratory work aims to support more inclusive and socially beneficial AI systems.

The performance observed for various perturbations for each task and at each level of perturbation is shown in Tables S1-S8 in Multimedia Appendix 2. In Table 2, we summarize the findings by groups as defined in the Methods section. For the question-answer task, all 3 measures of BLEU, ROUGE, and BERTScore had similar patterns. For purposes of analysis, we used ROUGE because these values were approximately between the other 2 measures and would greatly simplify our analysis without unnecessary complexity.

Our first observation was that the impact of perturbations was far from uniform or monotonic. While the performance on average decreased with perturbation, some notable findings are as follows:

The chi-squared tests across LLMs (χ²₆=81.25, P<.001) and tasks (χ²₆=44.74, P<.001) were both significant.

Next, we compared the impact of perturbations across the various dimensions by examining the variance of means. We performed a repeated measures ANOVA across the various dimensions, all of which were significant (part D of Multimedia Appendix 2, Table 1), and then followed up with post hoc t tests. In order to strengthen the numerical analysis in nonnormal conditions, we performed separate Friedman [37] chi-squared (Q) tests across the groups for perturbation types (Friedman χ²₂=8.66, P=.01), for LLMs (Friedman χ²₂=18.428, P<.001), for task types (Friedman χ²₂=7, P=.03), and for perturbation levels (Friedman χ²₂=26.547, P<.001). Since all 4 tests are significant, we performed post hoc tests using pairwise tests using the Conover with Bonferroni correction. The results of the Friedman test and post hoc tests are given in Table 3. Two of the effects show no effect, and the rest are either medium or large effects.

Here, we study how the impact of perturbation varies across types of perturbation. As shown in Figure 2, all the tasks are most prominently affected by redaction. Although the question-answer task is affected more by homophone perturbations than by typographical errors, both sentiment and medical abstract tasks are affected more by typographical errors than by homophones.

Table 4 shows that typographical errors and homophone-based perturbations have relatively limited impact, whereas redaction-based perturbations lead to a much more pronounced degradation in performance, especially in terms of the increased number of catastrophic responses.

Next, we consider the relative impact of the perturbations on a medical term versus a nonmedical term in the user prompt. The trends varied across settings and were not obvious in aggregate terms. To explore the nuanced effect of perturbation on medical terms, we examined the performances across different dimensions.

Figure 3 shows some variation in median ROUGE scores when measured by the percentage of perturbed medical terms in the LLM prompt. For low perturbations (10% perturbation level), there is visible variation. However, for medium and high levels of perturbations, the variation is not apparent. In general, the performance shows a decreasing trend with a higher ratio of medical words being perturbed.

We also conducted preliminary error analysis to understand the patterns in the data and interpret some of the macro observations identified above. This analysis was undertaken with the manual inspection of samples used in the classification of medical conditions.

At a macro level, consistent with the findings in Table 2, we found that minor perturbations often did not impact the model’s performance. In fact, in some cases, performance improved slightly at lower perturbation levels. This robustness was particularly evident when perturbations occurred in words that were less critical to the classification task, such as prepositions (“in” or “off”) that did not alter the medical context or disease description. These changes typically had negligible effects on the output, and the performance remained stable.

However, when perturbations targeted key medical terms critical for classification, the model’s performance declined, as expected. Interestingly, instances arose where both the LLM and a human nonexpert could become confused between 2 similar medical conditions, especially when there was overlapping information in the description. In such cases, if the perturbation affected the distractor (ie, the secondary, less relevant condition), the performance improved as the model’s focus shifted back to the correct classification. Conversely, when the perturbation impacted the primary condition, the degradation in performance was not as severe at low perturbation levels, as the LLM was already likely to be uncertain due to the inherent ambiguity of the input.

The following medical abstract is classified as a “Digestive System Disease” as per the ground truth in the dataset:

Even without any perturbation, the LLM incorrectly classified this as “Neoplasm” and failed to provide adequate justification for the misclassification. Notably, when key medical terms such as “carcinoma” or “cancer” were perturbed, the LLM correctly classified the abstract as a “Digestive System Disease.” This observation supports the hypothesis that low-level perturbations can impact distractors and potentially enhance LLM performance in cases where multiple potential medical conditions exist.

Our study systematically evaluated the robustness of LLMs to different types of perturbations in health care contexts. The results reveal several insights into how LLMs perform under various conditions, which are discussed in relation to our RQs.

The implications of our findings for health informatics are substantial. Ensuring the robustness of LLMs to real-world variations in input can significantly enhance their effectiveness and reliability in health care applications. This robustness is crucial for clinical decision support, patient education, and medical question answering, where accurate and dependable responses are paramount. While the general trend of robustness is encouraging, the potential for catastrophic drops is alarming. The variegated impact of different types of perturbations on performance in different settings can also inform the design of future health LLM systems on key aspects to prioritize building robust health LLMs. An incidental implication of our findings from error analysis of medical terms is the importance of medical experts in medical diagnosis and the use of LLMs as auxiliary support tools in health care. Further, the results suggest that designing ensemble methods that can combine the responses of multiple similar queries (some of which are perturbed versions of the original query) can be a useful pathway to increase LLM response accuracy. Further, our contribution to sharing a novel health-centric dataset with different types of human errors and levels of perturbation provides a valuable resource for further research. By making this dataset available, we aim to stimulate more research at the intersection of robustness and health LLMs, ultimately contributing to better patient outcomes and more efficient health care systems.

In alignment with the use cases of LLMs supporting clinical decision-making [10], our study has given empirical evidence of robustness levels in response to perturbation types and perturbation levels for LLMs across a variety of medical tasks. Sentiment analysis is an important component of clinical decision-making for both clinicians [38] and patients [39,40]. Autonomous systems that involve triaging patients and screening referrals similarly make use of question-answer tasks and medical condition summaries. This study also adds to the literature on the axis of human–artificial intelligence synergy and bias and data issues, which are 2 of the key dimensions of health care AI literature [41]. Beyond accuracy, error-tolerant prompts, and redaction-aware design, safe and reliable health care LLMs are contingent upon contextual cues, safety guardrails, and regulatory checks in routine care.

While our study provides valuable insights into LLM robustness in health care contexts, it has several limitations that we plan to address in future work. First, the perturbations used—typographical errors, homophones, and redactions—were synthetically generated to simulate common real-world variations. Although representative and a useful starting point, these do not capture the full range of linguistic and contextual variability seen in actual clinical and patient-generated text. In future work, we will expand the scope of perturbations to include additional forms, such as abbreviations, syntactic reordering, and multilingual input. We also aim to incorporate real-world user data to better reflect the diversity of health care communication. Additionally, our current evaluation focused on 3 LLMs; extending this analysis to a broader set of models will help generalize our findings across architectures and domains.

We are also actively exploring practical mitigation strategies for real-world deployment, including interactive input filters and automated detection of high-risk queries. These efforts aim to enhance the safety and reliability of LLM-powered health care tools. Importantly, we are releasing our novel perturbation dataset to the research community, providing a valuable resource for benchmarking and advancing robustness in health-related natural language processing applications.

Despite the limitations, this study represents a significant step forward in understanding how LLMs perform under realistic input conditions. By identifying key vulnerabilities and sharing tools to address them, we aim to catalyze the development of more resilient, equitable, and trustworthy AI systems in health care.

This study provides a comprehensive evaluation of the robustness of LLMs to multiple perturbations in health care contexts, specifically typographical errors, homophones, and redactions, revealing differing levels of resilience across health-related tasks. While LLMs exhibit adaptability to some input variations, redaction-based perturbations significantly impair their contextual understanding. These findings emphasize the necessity of robust evaluation frameworks that mirror real-world input variations to ensure the reliability of LLMs in applications, such as clinical decision support, patient education, and medical question answering. Our contribution to a health care–specific dataset with diverse perturbations aims to advance research by fostering the development of more resilient LLMs. Future research should explore additional perturbation types, include a broader range of LLMs, and incorporate diverse user interactions to better simulate real-world scenarios, ultimately driving the creation of dependable and impactful health informatics systems.