When Patients Cut In: Extending Clinical Conversational AI Safety to Interruptions

Abstract Clinical voice agents are now deployed in routine care, where real patients do not wait their turn: they interrupt. These systems typically use a cascaded architecture (speech-to-text → LLM →text-to-speech), so when a patient cuts the agent off mid-utterance, clinically required content can be lost even when the model handles cooperative transcripts well. Yet clinical conversational-AI benchmarks almost universally assume patients wait for the agent to finish, missing interruption-induced loss of required content. We present a transcript-based evaluation of interruption recovery, adapting conversation-analytic overlap categories into three operational types (recognitional, competitive, transitional sub-unit) and testing four deployment-oriented, non-reasoning LLM configurations across four cells spanning historytaking (information gathering) and FAQ (information provision), scored on whether the agent preserves the clinically required content. In the gathering cells, target-question failure varied across models; in the provision cells, where arms are directly comparable, failure rose for every model. Rankings differ across cells, and competitive FAQ interruption produced 30/30 provision-coverage failures for all four models (Wilson 95% CI: 88.6–100.0%; baseline 0/30 for three, 4/30 for Llama). A brief apology marker (“sorry to interrupt”) shifts recovery by tens of percentage points, inconsistently across models, and for one it reduces recovery. Interruption robustness therefore cannot be a single score: evaluation must be content-grounded, reported per cell, and matched to the deployment’s interruption profile.1

Introduction. LLM-based conversational agents are increasingly being deployed in clinical settings, including outpatient intake, mental-health support, structured data extraction from records, and scheduling (Artsi et al., 2025; Adams et al., 2025). Many production voice agents in this space use a cascaded architecture: speech-to-text feeds an LLM, which then feeds text-to-speech (Allbert et al., 2025; Qiu et al., 2026). While the audio stack determines what the model hears and when turns are cut, the language model is typically responsible for deciding how the dialogue should continue. As a result, an important part of the safety case for clinical voice agents is the robustness of the LLM to the dialogue context it receives. A central failure mode in voice interaction is interruption. When a patient cuts the agent off mid-utterance, the agent must decide whether to abandon what it was saying, return to it, or incorporate the new input before continuing. Recent voice-agent benchmarks therefore place interruption handling at the centre of evaluation (Modi et al., 2026; Lin et al., 2026b,a; Ray et al., 2026). In cascaded systems, however, once an interruption has been detected and the agent turn has been truncated, the downstream recovery problem is textual: the LLM receives a partial dialogue history and must decide what clinically relevant content to preserve. This makes interruption recovery an LLM behaviour that can be evaluated without requiring full audio simulation. The clinical stakes are concrete: an unfinished history-taking question can mean an unrecorded symptom, and a truncated safety-netting caveat can leave the patient without the escalation criteria the agent was about to give (Figure 1). Existing evaluations do not directly test this setting. Clinical conversational-AI evaluations typically score agent content against reference rubrics, but largely assume cooperative turn-taking (Lim et al., 2025; He et al., 2025; Ellis et al., 2026; Kyung et al., 2025; Johri et al., 2025). Voice-agent interruption benchmarks evaluate whether agents can reorient after being interrupted, but focus on To answer this, we make three contributions. We adapt a conversation-analytic taxonomy of overlap (Sacks et al., 1974; Schegloff, 2000; French and Local, 1983) into three operational interruption types: transitional sub-unit, recognitional, and competitive. We instantiate four evaluation cells across two clinical phases, history-taking (gathering) and FAQ (provision), scoring model responses against reference clinical content units. We evaluate four LLMs in non-reasoning configurations chosen for the latency constraints of cascaded voice deployment (Llama 3.1 8B, GPT-5.4 mini, Claude Haiku 4.5, and Gemini 2.5 Flash).

Related work. Clinical conversational AI safety evaluation. Clinical conversational-AI evaluation has increasingly moved from generic correctness metrics toward reference-based and hazard-grounded scoring. MATRIX (Lim et al., 2025) encodes a safetyengineering taxonomy into multi-agent clinical dialogue simulations and uses hazard-specific LLM judges validated against clinician annotations. Its central methodological move is to evaluate whether a specific clinical safety obligation was violated, rather than whether the response was generally appropriate. We adopt the same principle for gathering cells, where the relevant failure is an unsafe omission of clinically required information. ASTRID (He et al., 2025) evaluates retrievalaugmented clinical question answering by decomposing answers into atomic content points and scoring whether each point is conveyed; we use the same reference-point framing for provision cells. WER-is-Unaware (Ellis et al., 2026) similarly shows that surface-level speech metrics can miss clinically meaningful distortions introduced by ASR errors. Patient-simulator and multi-agent frameworks further show that clinical LLM performance degrades in interactive settings (Kyung et al., 2025; Johri et al., 2025). However, this literature largely assumes cooperative turn-taking, with interruption rarely treated as a primary evaluation condition.

Interruption and voice-agent benchmarks. A parallel literature has begun to evaluate interruption handling in full-duplex and cascaded voice agents. EchoChain (Modi et al., 2026) injects interruptions into in-progress agent responses and identifies response-side failures such as ignoring new information, acknowledging it and then overwriting it, or abandoning the original task. IHBench (Salimi et al., 2026) scores post-interruption recovery in enterprise workflow agents by task fulfilment and recovery quality, not preservation of clinically required content. Full-Duplex-Bench v1.5 (Lin et al., 2026b) formalises overlap scenarios including interruption, backchannels, background speech, and talking-to-others, while its multi-turn successor extends this setup with an automated examiner and broader task families (Lin et al., 2026a). Other recent benchmarks evaluate text-to-voice capability gaps, multi-round duplex interaction, turn-taking dynamics, human-interruption corpora, and composite enterprise voice-agent metrics (Ray et al., 2026; Zhang et al., 2026; Arora et al., 2025; Wang et al., 2026; Bogavelli et al., 2026). These benchmarks establish interruption handling as a central voice-agent capability, but their outcome variables are task completion, turn-taking behaviour, or duplex correctness. They do not ask whether safetycritical clinical content survives the interruption.

Method. We adapt a CA-grounded interruption taxonomy worked out in collaboration with conversation analysts. The CA literature distinguishes overlap by where it lands in the current speaker’s turn (transitional, recognitional, progressional, terminal) and by whether it competes for the floor (cooperative vs competitive). These categories matter for clinical AI evaluation because each lands the cut in a structurally different place in the agent’s utterance, and the kind of clinical content at risk depends on where the cut falls. A transitional sub-unit overlap during a multi-clause agent answer can drop a later clause. A recognitional overlap during a top-level history-taking question can be read by the agent as an answer to a truncated stem. A competitive overlap mid-FAQ-response can remove the safety caveats entirely. For this evaluation we use three types that fire meaningfully across our four cells. CA transcript examples for each type appear in Appendix D.1. We use transition-relevance place (TRP) to refer to a structural point in the current speaker’s turn at which another speaker may legitimately begin (e.g. the end of a complete linguistic unit).

Transitional sub-unit overlap. The agent produces a multi-unit turn (for example, an FAQ answer that opens with a reassurance and then adds escalation criteria and mild-case advice). The patient treats an earlier linguistic unit as the completed turn and begins their response, overlapping a later agent unit. Transitional sub-unit overlap only fires on multi-unit agent turns; a single-unit follow-up question does not give the patient an early-unit TRP to act on.

Recognitional overlap. The agent is producing a turn that may be multi-unit. The patient recognises the gist of what the agent is conveying from partial cues (sentence structure or pragmatic context) and starts their response before the agent’s turn reaches a TRP. The clinical risk is that the patient’s response addresses a truncated stem with a different semantic interpretation than the full turn.

Competitive overlap. The agent is typically within the interior of a turn, far from any natural completion point. The patient cuts in to redirect or correct. We use the interactional CA label competitive (French and Local, 1983); this is the category Schegloff (2000) calls progressional or interjacent and describes as structurally the most “interruptive” placement. Our cells vary how the patient acts, not where the cut lands. The interactional label matches. The clinical risk is that mid-turn safetynetting or unfinished history-taking gets abandoned and the agent never returns to it. We exclude between-turn transitional overlap and terminal overlap. Between-turn transitional overlap occurs at turn boundaries and carries minimal semantic risk; terminal overlap truncates only the final words of an agent turn and is unlikely to remove safety-relevant content.

Empirical prevalence. A review of 35 cataract follow-up calls from a deployed clinical voice agent found that 20 contained at least one overlap during a safety-critical sequence (history-taking, FAQ, or summary). The 27 observed instances break down as 17 transitional sub-unit, 7 recognitional, and 3 competitive (Appendix A, Table 3).

We evaluate an example conversational agent in the domain of post-operative cataract follow-up phone conversations. The conversations move through two main components: information gathering (history-taking; the agent asks structured toplevel symptom questions and follow-ups) and information provision (FAQ; the agent answers patientinitiated questions). A cell is the intersection of an interruption type with a conversational moment that hosts it. We evaluate four cells (Table 1).

Our simulator drives the patient side of each clinical conversation through a three-stage pipeline (Figure 1; prompts in Appendix D.4). Stage one is an LLM classifier that reads each agent utterance and decides whether to fire an interrupt on it.

Discussion. Interruption failure here is not a generic degradation of dialogue quality. It is a structured clinical safety failure: the tested cells place different clinical obligations at risk, and model recovery differs between cells. Evaluation therefore has to be cellbased, content-grounded, and deployment-specific, not reducible to a single interruption robustness score.

Interruption recovery is structured, not generic. The cleanest evidence sits in the gathering pair (Figure 2). Recognitional and competitive overlap share every design parameter except the patient’s interactional move on the same top-level question, and the cross-model rank ordering does not survive that change. The same agent population reorganises into a different failure profile between the two cells. Interruption robustness is therefore not a scalar model property. It is conditional on the interactional form of the interruption and the clinical obligation at risk. The methodological point is direct. A benchmark that exercises only one interruption type per phase may not generalise: a model that looks robust on one cell can fail badly on another even when the cells share every parameter except the patient’s move. Reporting a single interruption robustness score from a single cell is unsafe. Llama’s relative invariance across the two gathering cells suggests that some models may apply a more stable recovery policy, but our experiments do not identify the mechanism, and we do not over-read it.

Clinical risk comes from lost obligations, not awkward turn-taking. Existing interruption benchmarks for consumer and enterprise voice agents can count a recovery as successful if the agent reorients smoothly or completes the user’s new task. The failures we report are different in kind. The agent does not break the dialogue contract; it loses a specific clinical obligation. In the gathering cells, a top-level symptom question that should have been asked is not asked. In the provision cells, a reference content point that should have been conveyed, including safety-netting and escalation criteria, is dropped. The provision-competitive cell sharpens this. All four models collapse to a 100% provision-coverage failure rate under competitive topic-change, from a near-zero baseline on the same content (0/30 for three models and 4/30 for Llama; Table 2; Figure 3). The problem is not that the agent stops talking or produces a low-quality turn. The patient’s next interactional move displaces the unfinished clinical content, and no model in our panel recovers it under the standard agent prompt. This is a different failure surface than the one general voice-agent benchmarks measure, and it is the one a clinical agent has to be evaluated against. The defensive-prompt variants on the same cell show that prompt-level recovery scaffolding does not rescue this case (Table 7). The strongest defensive prompt, which instructs the agent to resume after interruption, leaves three of four models at 100% failure and only moves the fourth to 90%.

Surface cues affect recovery, but cannot be relied on. The marker ablation isolates a brief apology preface (“sorry to interrupt”) on an otherwiseidentical patient interruption (Figure 4). The effects are large (up to 67pp on gathering, up to 60pp on provision), they vary across models, and in one case run in the opposite direction. Marker sensitivity appears model-dependent rather than uniformly beneficial. Two implications follow. The marker is not a generic mitigation that a deployment can layer on top of any model: deployments cannot assume that patient interruptions will be explicitly marked, and on the panel we evaluate the unmarked condition is the harder one for most cells.

Conclusion. This paper treated interruption recovery as a clinical safety problem in cascaded voice agents. Given a truncated agent utterance and an interrupting patient turn, the central safety question is not whether the agent maintains conversational flow, but whether it preserves the clinical content it was required to elicit or convey. We built a texttractable evaluation around three interruption types: recognitional, competitive, and transitional subunit overlap, and scored recovery against pathwayspecific clinical content obligations. Across history-taking and FAQ provision cells, every evaluated model failed under at least one interruption condition; outcomes varied across the tested cells, clinical phases, and models, and a minimal apology marker moved recovery inconsistently across models. These findings argue against aggregate interruption robustness scores for clinical voice agents. Evaluation should instead be contentgrounded, reported per cell, and aligned with the deployment’s interruption profile. For deployment, robust recovery likely requires interruption-aware state tracking of unresolved questions and advice points, not only stronger prompts.

Limitations. An initial, text-tractable study of a voice phenomenon. This paper presents an initial systematic study of how interruption affects LLM-based clinical conversational systems. The simulator operates on text transcripts with simulated truncation, and does not capture the prosodic, acoustic, or wall-clock-timing cues that shape interruption recognition in real voice deployments. The findings generalise to the cascaded-truncation class of voice architectures (transcript-truncating barge-in), and do not directly speak to systems that preserve full agent turns with marker tokens or that do no truncation at all. We intend this work as the first in a series of evaluations, and expect subsequent studies to extend the framework to real-time voice deployments with prosody, timing, and ASR error. Single clinical pathway. The evaluation covers cataract follow-up only. Other pathways such as fracture liaison service follow-up, neurology advice-and-guidance, or mental-health screening may exhibit different interruption profiles or different recovery scaffolding. Reference content points would need to be re-derived per pathway. English only. All components of the evaluation, including the patient simulator, the clinical agent, the judges, and the reference content units, operate in English.