PhysioTRACE: Provenance-Aware Stress Tests for Physiological Foundation Models

Physiological foundation models encode how a signal was recorded alongside the physiology it reflects. When recording conditions are associated with diagnosis, this acquisition provenance can become a shortcut, yet the two measurements usually offered as evidence, shifted transfer and provenance decodability, do not show whether a predictor uses it. We introduce PhysioTRACE, a four-axis behavioral audit for frozen encoders that separates what a probe can decode from what a fixed task head relies on. Recover scores how decodable provenance is; Stress reverses only the provenance-target association on the same held-out records; Intervene removes a train-localized provenance component; and Verify certifies that removal only if it beats matched random projections within a declared utility margin. Each audit thus ends in one of three verdicts: no reliance, or reliance with the remedy certified or refused. Across electroencephalography (EEG) and electrocardiography (ECG), five training objectives, and five frozen foundation models, the relation between Recover's calibrated score (Linear Provenance Information) and out-of-distribution utility changes sign between datasets, so neither predicts the other and neither can stand in for a reliance test. On paired EEG views where the shortcut is known by construction, the audit detects it (the head fitted under the association loses about 0.2 AUROC when the association is reversed, while a control head fitted without it is unaffected), localizes a rank-two component whose removal returns that head to control-level behavior without measurable loss of ordinary utility, and certifies the remedy for both encoder objectives tested. On real ECG device metadata it returns all three verdicts: it certifies a remedy that removes 91% of one model's excess vulnerability, finds no reliance where device and diagnosis are barely associated, and refuses the remedy for a second model whose localized direction also carries task signal. A claim that a physiological model is robust to how its inputs were recorded therefore needs a behavioral test, and PhysioTRACE turns it into a test that can pass, fail, or refuse a remedy. We release the protocol, splits, probes, and machine-readable results.