New Auditing Framework Exposes Reliability Gaps in AI-Powered First-Aid Search Results

When someone types a first-aid question into a search engine during an emergency, the answer that appears at the top of the page can shape what they do next. A new study has systematically audited Google’s AI Overviews and Featured Snippets across 1,508 first-aid queries and found that both systems fall well short of the reliability one would want in a life-critical setting. The audit, conducted with a framework called RADAR-FirstAid, measured automated consistency scores of 0.68 for Featured Snippets and 0.72 for AI Overviews, and safety-and-relevance scores of 0.71 and 0.76 respectively, on scales where 1.00 represents ideal performance. Neither system exceeded 0.76 on safety and relevance, and the largest weaknesses appeared precisely on the kinds of questions most likely to be asked in genuine emergencies.

The study, published in Discover Artificial Intelligence, introduces RADAR-FirstAid as an auditing pipeline rather than a competing information service. It does not generate first-aid answers of its own; instead, it probes an external system, which the researchers call the System under Audit, and scores the responses it receives. In this work, Google’s AI Overviews and Featured Snippets were treated purely as black boxes: the framework interacted with them only through the public search interface, with no access to model weights, sampling settings, or internal states. All reliability estimates were therefore computed exclusively from the outputs the systems publicly returned.

The framework’s architecture is built around four cooperating modules. A Dynamic Query Simulator generates a continuous stream of realistic, criticality-weighted queries, modelling query arrival as a non-homogeneous Poisson process whose rate is modulated by real-world event feeds such as news headlines about seasonal injuries. Query content is drawn from a mixture of a core knowledge base of persistent first-aid topics, a trending topic distribution derived from social media and news aggregation, and a synthetic scenario generator that combines textual descriptions with generated visual content. Importance sampling weighted by a criticality score prioritises high-stakes queries, and an exponential temporal decay term, set to a half-life of roughly 1.9 hours in the experiments, focuses the audit on recent information to mimic the fading relevance of older advice.

The second module, a Multimodal Audit and Fusion Agent, extends auditing beyond simple text crawling. For each query it dispatches sub-queries to whatever interfaces the audited system exposes, including text search and, where available, image search through endpoints such as Google Lens. Because no commercial search engine accepts raw physiological signals, the framework applies a documented fall-back rule: visual inputs that cannot be dispatched directly are converted into descriptive captions using the BLIP-2 captioning model and appended to the text query, and physiological signals are always verbalised into natural-language summaries, such as a note that a resting heart rate of 118 beats per minute has been elevated for twenty minutes. The researchers acknowledge this substitution is lossy, removing temporal signal structure, but argue it preserves the content of the query at the granularity a closed commercial system can consume.

A distinctive contribution of the framework is its cross-modal alignment check, which verifies whether the text and images in a response tell the same story. The agent computes an alignment loss based on the cosine similarity between CLIP text-encoder embeddings of the response text and of the alt-text accompanying any generated image. A high loss flags potential hallucination or misalignment between textual instructions and visual guidance, a failure mode the authors describe as particularly dangerous in first aid. The alt-text route was chosen deliberately: because the alt-text is the audited system’s own accessibility-layer claim about its image, comparing against it also audits the system’s internal text-versus-image consistency, and alt-text persists in the response payload where image bytes are often served through short-lived signed URLs.

The third module, a Differentiable Reliability Evaluator, automates scoring with large language model judges. Both a consistency judge and a safety judge were instantiated as a single lightweight open-weight model, Microsoft’s Phi-3-mini-4k-instruct with 3.8 billion parameters, run at fp16 precision with greedy decoding, a design that eliminates model choice as a confound when correlating automated and human scores. The safety-and-relevance score combines relevance to the query, the average credibility of cited sources from a pre-defined domain-specific list, and an indicator of whether necessary precautionary language is present, with weights tuned through expert feedback. A composite reliability score penalises uncertainty: for black-box systems, where internal weights are inaccessible, epistemic uncertainty is approximated by the variance of consistency scores across five paraphrase-perturbed versions of each query, a choice validated in a convergence experiment showing the variance estimate changed by only 3.6 percent between four and five perturbations.

The fourth module, an Edge-Optimization Scheduler, makes the audit deployable on resource-limited hardware. It formulates evaluation scheduling as an optimisation problem, selecting the subset of judge models that maximises expected information about the reliability score subject to a computational budget. For continuous monitoring, the full evaluator’s composite score is distilled into a tiny proxy neural network that takes simplified features, such as answer length, caution keywords, and source count, and predicts reliability in real time, with the heavier evaluator invoked periodically for recalibration. In the reported experiments, the full audit of 1,508 queries ran at 1.84 plus or minus 0.06 seconds per query.

The audit’s headline findings concern prevalence and quality. AI Overviews appeared for 84 percent of the 1,508 queries, while Featured Snippets appeared for 32.5 percent, and appearance frequency was statistically significantly associated with both question type and query sentiment. On quality, AI Overviews consistently outscored Featured Snippets across consistency, safety and relevance, and sentiment alignment, suggesting generative summarisation brings measurable but limited gains over static snippet extraction. More striking was the stratified analysis: the gap between the audited systems and the safety ceiling of 1.00 was largest exactly on Binary and How-to queries, the question types that frequently carry actionable first-aid instructions. Sentiment analysis of 471 reformulated queries showed AI Overview sentiment alignment highest for neutral queries, at 85 percent manual agreement and 0.82 automated, and lowest for positive queries, at 72 percent and 0.68, while alignment on negative-sentiment queries, those most likely to arise in real emergencies, reached only 78 percent manually and 0.75 automatically, indicating the system does not consistently adopt an appropriately cautionary tone when queries signal distress.

The researchers validated their automated scoring against human judgement. Domain-trained raters manually annotated a 200-query subset, and Spearman rank correlations between automated and manual scores ranged from 0.74 to 0.87, strong enough to justify automated scoring at full scale. A supplementary geographical analysis, in which queries were generated with varying location metadata, found standard deviations below 0.03 for both consistency and safety scores across 100 sampled queries, indicating the reliability gaps are systemic rather than artifacts of a particular regional deployment. An analysis of 157 suppressed AI Overviews, meanwhile, revealed lower relevance and higher inconsistency rates than visible ones, hinting that suppression mechanisms may already filter some lower-quality responses.

Ablation studies confirmed that each module contributes measurably to the pipeline’s performance. Removing the Differentiable Reliability Evaluator caused the largest drop in the composite reliability score, from 0.87 for the full framework to 0.72, while removing the Multimodal Audit and Fusion Agent raised the cross-modal alignment loss to 0.25 and crippled the detection of contradictory text-image pairs: the full model flagged 94 percent of such instances, whereas the text-only variant caught just 5 percent. Disabling the Dynamic Query Simulator cut critical query coverage from 92 percent to 64 percent, and removing the Edge-Optimization Scheduler nearly doubled inference time and increased relative energy cost by 95 percent. The authors caution that the framework’s effectiveness depends on the quality of its judge models and domain-specific knowledge bases, and they plan to extend it to other high-consequence domains. The audit materials are being released in tiers, with all judge prompt templates publicly available and the full query corpus shared with qualified researchers under a data-use agreement pending a privacy review.

Subject of Research: A multimodal auditing framework that measures the reliability of AI-powered search answers to first-aid queries

Article Title: A closed loop multimodal auditing framework for enhancing artificial intelligence reliability in medical emergency response

Article References: Xiao, X., Liu, Y., & Jin, Z. (2026). A closed loop multimodal auditing framework for enhancing artificial intelligence reliability in medical emergency response. Discover Artificial Intelligence, 6(1), Article 1608. https://doi.org/10.1007/s44163-026-02512-5

Image Credits: AI Generated

DOI: 10.1007/s44163-026-02512-5

Keywords: AI Overviews, Featured Snippets, first aid, search engine auditing, large language models, multimodal evaluation, reliability, medical misinformation, Google Search, LLM-as-a-judge, edge computing, health information quality