Figure 2:

Per-category C0 deploy violation rates across five base models on OCA-ClinHarm B200 (left) and MIMICEXT200 (right), n=25 scenarios per category per model. Category hotspots vary by model: Qwen 7B shows broadly elevated rates across most categories, peaking at emergency undertriage (92% B200), treatment planning and overconfidence (both 96% MIMICEXT200), and adversarial injection (80% B200); Llama 8B concentrates failures on treatment planning (96% B200, 88% MIMICEXT200), demographic bias (92% B200, 88% MIMICEXT200), emergency undertriage (88% MIMICEXT200), and medication safety (76% B200); Meditron 7B shows strong dataset sensitivity, with hallucinated information at 88% on B200 but only 24% on MIMICEXT200; Sonnet 4.5 and Gemma 4 exhibit low, distributed profiles without a single dominant category.