Safety Evaluation Does Not Transfer: Domain-Specific Failure Patterns in Patient-Facing LLM Triage

Patient-facing large language models are increasingly used to guide care-seeking decisions, yet their safety is usually demonstrated in one clinical area and assumed to hold across others. Whether those findings generalise across domains remains unclear. Across 41 studies published 2023-2026 under a prospectively registered protocol, failures in physical-emergency studies concentrated toward both extremes of the urgency spectrum, with one stress-test under-triaging 51.6% of gold-standard emergencies and erring substantially on non-urgent ones. By contrast, suicide-risk studies located the most prominent failures among intermediate-risk cases. Across the studies reviewed, failure location varied with clinical domain rather than remaining a stable property of the models. A protocol validated on physical-emergency vignettes therefore cannot be assumed to detect the dominant failure pattern in suicide-risk stratification. This is a cross-study comparison, not a controlled experiment, so we also specify the matched experiment that would test transfer. Two further findings: crisis-safeguard activation appeared sensitive to contextual reassurance independently of stated risk, and grounding in a structured knowledge source raised sensitivity for true emergencies from 0.73 to 0.98, beyond any between-model difference here. Measured safety also varied substantially with evaluation design, including response format and requester framing, sometimes by more than the differences between models; with 27 of 41 studies using single-turn vignettes, the design mix risks optimistic estimates.