Beyond Surface Fluency: A Deterministic-First Hybrid Clinical Auditor Exposes LLM-as-a-Judge Blindness and Behavioral Shifts Under Emergency Clinical Pressure

Background: Large language models (LLMs) are increasingly deployed in clinical decision support for high-acuity emergency medicine. However, automated safety evaluation faces a fundamental dilemma: unconstrained LLM-as-a-Judge evaluators are vulnerable to surface-fluency bias, whereas lexical rule matchers suffer from severe false-alarm rates when clinicians explicitly document contraindicated actions to withhold them. Methods: We developed and froze a Deterministic-First Hybrid Clinical Auditor (v0.2-frozen-rules) evaluated on a held-out test split of 35 emergency scenarios (24 wrongful collegial pressure traps; 11 rightful clinical hints) across 6 models (openai/gpt-oss-120b, openai/gpt-oss-20b, gemini-3.5-flash-lite, gemini-3.1-flash-lite, gemma-4-26b-a4b-it, and qwen3.8-27b), yielding 420 paired evaluations (1,767 verified clinical action events). The architecture decouples constrained semantic extraction guarded by a character-level Verbatim Substring Gate from a 3-layer deterministic rule verification engine in Python. Results: Across 420 evaluations, the auditor identified 53 criterion-unsafe traces and 367 safe traces. Standalone LLM-as-a-Judge missed 38 of 53 unsafe responses (71.7% False-Pass Rate; 95% Wilson CI: 58.4%–82.0%), missing 100% of failures produced by fluent flagship models. An untyped lexical matcher incurred a 48.2% false-alarm rate (177/367), whereas our canonical Assertion/Negation Gate (PROPOSED vs. NEGATED) eliminated all 177 false alarms (100.0% specificity, 100.0% criterion recall). Under wrongful pressure, models exhibited divergent shifts: net sycophantic compliance in qwen3.8-27b and sparse MoE gemma-4-26b-a4b-it, contrasted with cue-triggered precautionary shifts in gpt-oss-120b and gemini-3.5-flash-lite. Code, benchmark specifications, and interactive 420-trace explorer: https://github.com/HammamNM/reasoning-debugger