Prompt injection in blood bank transfusion medicine AI

Four adversarial injection surfaces in blood bank transfusion medicine AI

1. ABO/Rh blood typing and crossmatch AI from gel card agglutination images (Grifols DG System, Bio-Rad ID-System, Ortho VISION Max, Immucor Neo, Beckman Coulter PK7300/PK7400)

Gel card technology, invented by Bio-Rad’s DiaMed division and now deployed across all major immunohematology platforms, works by separating agglutinated red cell aggregates from free red cells during centrifugation through a column of dextran-acrylamide gel or glass microbeads. A 4+ reaction — the strongest positive reaction — produces a compact red cell pellet trapped at the top of the gel column; a 0 reaction (no agglutination) produces a concentrated red cell pellet at the bottom of the column after unimpeded passage through the gel. The intermediate reactions (1+, 2+, 3+) produce characteristic distribution patterns of red cell aggregates within the column that an experienced blood bank technologist can visually interpret, and that modern immunohematology analyzers capture with integrated high-resolution camera systems and classify using convolutional neural network models trained on large libraries of annotated gel card images.

The Grifols DG System (DG Gel Neo, DG Gel Coombs, DG Gel ABO-D) represents the highest global market penetration for automated gel card immunohematology, installed in hospital blood banks across Europe, Latin America, and North America. Bio-Rad’s ID-System, the original gel card platform acquired from DiaMed (whose founder Dr. Yves Lapierre invented the gel card technology in 1985), remains the market leader in Western Europe. Ortho Clinical Diagnostics’ VISION Max analyzer uses a column agglutination technology equivalent to gel cards and is the dominant platform in large US academic medical center blood banks. Immucor’s Neo analyzer uses glass bead column technology (the LISS/Coombs column) rather than acrylamide gel, but the imaging and AI classification pipeline is architecturally equivalent. All of these platforms classify the gel or column reaction image using an AI model whose output — the reaction grade from 0 to 4+ — determines whether the ABO forward type (patient red cells plus anti-A and anti-B reagents), the ABO reverse type (patient plasma plus A1 and B screening cells), the Rh type (patient red cells plus anti-D reagent), and the crossmatch (patient plasma plus donor red cells) are compatible for transfusion.

The adversarial attack against ABO crossmatch AI targets the gel card image at the point of ingestion by the AI classification engine — either within the instrument’s onboard AI module, at the connection point between the instrument and the laboratory information system (LIS) middleware (SCC SoftBank, Mediware Hemocare, Epic Beaker Transfusion, or Sunquest Blood Bank), or at the cloud AI secondary review platform that several major blood banking networks use for remote AI-assisted crossmatch review. A carefully crafted adversarial perturbation in the crossmatch gel card image — imperceptible in pixel-level noise to the human eye but engineered to shift the AI’s classification decision boundary — can cause the AI to classify a 4+ incompatible reaction image (red cell agglutination trapped at the gel column top, indicating ABO incompatibility) as a 0 (no agglutination, compatible) result. The blood bank’s AI-mediated workflow then approves the incompatible blood product for transfusion. The clinical outcome is AHTR beginning within minutes of transfusion initiation in the patient.

The FDA FATALITIES REPORT 2022 documents 5 of 24 transfusion fatality reports as ABO-incompatible transfusion events. The historical baseline for ABO-incompatible transfusion from pre-AI immunohematology was approximately 1 per 50,000–100,000 transfusions according to data from the SHOT (Serious Hazards of Transfusion) hemovigilance program in the UK and the French hemovigilance system. FDA regulatory oversight of immunohematology analyzers falls under 21 CFR Part 864 (hematology and pathology devices) for the instrument hardware and under 21 CFR Part 606 (Current Good Manufacturing Practice for Blood and Blood Components) for the blood bank operational procedures in which AI-classified crossmatch results are used. The SaMD cybersecurity guidance applies to AI software components in immunohematology analyzers as AI/ML-enabled in vitro diagnostic devices, but the specific adversarial pixel injection threat to gel card image AI classification is not addressed in existing FDA guidance or AABB Technical Manual 21st edition blood bank AI risk management frameworks. CLIA 42 CFR Part 493 laboratory standards require that blood bank testing meet specific performance accuracy thresholds, and CAP (College of American Pathologists) blood bank accreditation requires participation in proficiency testing programs — both of which evaluate AI crossmatch performance under standard (non-adversarial) conditions only.

2. Antibody identification AI from panel cell reactivity images (Immucor ECHO Analyzer, Grifols DG Gel system)

When a blood bank screening test detects a red cell alloantibody — an antibody produced by a patient who has been immunized against a red cell antigen foreign to their own red cells through prior transfusion or pregnancy — the antibody must be identified to determine its clinical significance and guide antigen-negative blood product selection for subsequent transfusions. Antibody identification is performed using an 11-cell antibody identification panel: a set of 11 panel cell suspensions, each from a donor with a fully characterized red cell antigen phenotype (including all clinically relevant antigens: Kell, Duffy, Kidd, Jk(a), Jk(b), S, s, M, N, Fya, Fyb, C, c, E, e, and others). The patient’s plasma is tested against each of the 11 panel cells using gel card technology, producing an 11-column reaction image grid where each column displays the agglutination reaction of the patient’s plasma with one panel cell.

The resulting 11-cell panel reaction grid — a visual matrix of gel column reaction images showing positive and negative reactions across 11 panel cell specimens — is submitted to antibody identification AI systems, including the Immucor ECHO Analyzer’s pattern recognition AI and Grifols’ DG Gel system antibody identification module, for automated panel interpretation. The AI applies pattern recognition to the 11-column reaction grid: comparing which panel cells are positive (patient plasma reactive) against which antigens each panel cell expresses and does not express, using a rule-out logic algorithm (if a cell is negative for antigen X and the patient reacts positively, antigen X is not the target) and a pattern-matching algorithm to identify the alloantibody specificity consistent with the observed reaction pattern. The AI generates a report identifying the alloantibody as, for example, anti-Kell (anti-K) or anti-Jka (anti-Kidd a) — which directs the blood bank to provide K-negative or Jka-negative red cells for future transfusions to that patient.

The adversarial attack against antibody identification panel AI targets the rendered 11-cell panel reaction grid image at the AI ingestion boundary. An adversarial perturbation applied to the panel reaction grid image can suppress AI detection of positive reaction columns in the grid, causing the AI to misclassify a positive anti-Kell reaction pattern as a negative result — reporting that no alloantibody was detected, or misidentifying the antibody as a less clinically significant specificity. The consequence is that K-positive (Kell antigen-positive) red cells are transfused to a patient with anti-Kell antibody. Anti-Kell is one of the most potent and clinically significant alloantibodies in transfusion medicine: it causes severe immediate and delayed hemolytic transfusion reactions, hemolytic disease of the fetus and newborn (HDFN), and in alloimmunized sickle cell disease patients (homozygous HbSS) — who have extremely high rates of red cell alloimmunization from chronic transfusion therapy and in whom delayed hemolytic transfusion reaction (DHTR) is a major cause of acute sickle cell disease mortality — antigen-positive transfusion can trigger life-threatening hyperhemolysis syndrome. The American Sickle Cell Anemia Association and AABB’s sickle cell disease transfusion guidelines specifically address the heightened risk of alloimmunization and DHTR in HbSS patients as a primary safety concern in chronic transfusion programs. 21 CFR Part 606.151 governs compatibility testing procedures for blood components, requiring that all crossmatch and antibody screening results be recorded and traceable; the adversarial injection attack on antibody ID panel AI specifically subverts the AI-automated interpretation step of the compatibility testing record, leaving a false-negative AI result documented in the transfusion record under 21 CFR Part 606.160 (records).

3. Blood irradiation dose verification and leukoreduction QC AI (Fresenius Kabi Leukocheck AI, Haemonetics MCS+ leukoreduction AI, Gammex/Radcal irradiation dose card imaging)

Transfusion-associated graft-versus-host disease (TA-GvHD) is one of the rarest and most invariably fatal complications of blood transfusion: donor lymphocytes in cellular blood products (red blood cells containing residual viable lymphocytes, platelets) engraft in an immunocompromised recipient unable to reject them, recognize host tissues as foreign, and mount a graft-versus-host immune attack on the recipient’s skin, liver, gastrointestinal tract, and bone marrow. TA-GvHD mortality exceeds 90 percent; there is no established treatment once the diagnosis is confirmed. Prevention is absolute: cellular blood products for immunocompromised recipients (congenital immunodeficiency patients, hematopoietic stem cell transplant recipients, patients receiving certain immunosuppressive chemotherapy regimens, neonates, intrauterine transfusions) must be irradiated to a minimum dose of 25 Gy to the central zone of the blood bag using a cesium-137 or X-ray blood irradiator. The irradiation inactivates donor lymphocytes with sufficient DNA damage to prevent T-cell proliferation while preserving red cell and platelet function.

Blood irradiation QC relies on two image-based verification technologies. First, irradiation dose indicator labels — chemical dye strips that undergo a colorimetric shift when exposed to ionizing radiation above the threshold dose — are affixed to blood product bags and imaged before and after irradiation; the Gammex/Radcal RadTag indicator system and the Blood Irradiator Dose Indicator Labels (BIDILs) are standard in US blood bank practice. The post-irradiation image of the dose indicator label is captured by the irradiator’s integrated imaging system and submitted to AI for QC pass/fail determination: the AI classifies the dye color change against a calibrated reference scale to confirm that the dose threshold was reached. Second, leukoreduction QC uses residual WBC count measurement from filtered blood product samples: the Fresenius Kabi Leukocheck system and the Haemonetics MCS+ leukoreduction AI analyze microscopic or flow cytometric images of the filtered blood product residual sample to verify that WBC count meets the AABB standard of less than 5 × 10&sup6; residual leukocytes per unit (for prestorage leukoreduction meeting the AABB 95th percentile standard). The AI QC pass/fail determination based on these images is the gating decision for whether irradiated, leukoreduced cellular blood products are released for transfusion to immunocompromised patients.

The adversarial attack against irradiation QC AI targets the dose indicator label image or the leukoreduction residual sample image at the AI ingestion boundary. An adversarial perturbation applied to the dose indicator colorimetric image can cause the AI to classify an under-irradiated indicator image (showing the pre-irradiation dye color, indicating insufficient dose) as a pass result. The blood bank’s irradiation QC workflow approves the under-irradiated cellular product for release. When that product is transfused to an immunocompromised recipient, viable donor lymphocytes are present; TA-GvHD can result. The AABB Standard 5.6 (21st edition) requires that irradiation dose be verified by dosimetry for each irradiated product; 21 CFR Part 606.122 requires that blood bank equipment be calibrated and QC procedures performed and documented. The adversarial injection attack against irradiation QC AI specifically compromises the AI-automated step in the equipment QC documentation chain, substituting a false-pass AI result in the 21 CFR Part 606 QC record for the true-fail result that would have blocked product release.

4. Blood inventory management and expiration AI (Haemonetics BloodTrack Hub, Mediware Hemocare, Epic Beaker Transfusion, Soft Computer Consultants SoftBank, Blood Systems bloodOptix)

Hospital blood banks operate under tight inventory management constraints driven by the short shelf life of blood products: red blood cells stored in additive solution (AS-1, AS-3, AS-5) expire after 42 days of refrigerated storage at 1–6°C; platelets stored at room temperature (20–24°C) with continuous agitation expire after 5–7 days; fresh frozen plasma (FFP) must be transfused within 4 hours of thawing. Blood inventory management AI platforms — Haemonetics BloodTrack Hub AI, Mediware Hemocare (now part of Versiti), Epic Beaker Transfusion module AI, Soft Computer Consultants SoftBank AI, and Blood Systems bloodOptix — process blood product inventory data including barcode scan images, RFID tag data visualizations, blood product label images, and inventory dashboard visualizations to manage stock levels, predict utilization, generate expiration alerts, and optimize blood product age-of-blood ordering strategies for inventory rotation.

The adversarial attack against blood inventory AI targets blood product label barcode images, expiration date field images, and inventory dashboard visualizations at the AI ingestion boundary. Adversarial perturbations applied to blood product label images (the 2D barcode and donation date/expiration date fields on the standard ISBT 128-formatted blood product label) can cause the inventory AI to misread the expiration date, suppress the expiration alert for a product approaching or past its expiration date, or miscategorize an expired unit as available for transfusion in the inventory dashboard. If an expired red blood cell unit is transfused, the storage lesion in overdue RBCs — accumulation of lysed cell membrane fragments, elevated potassium from intracellular leakage, decreased 2,3-DPG (affecting oxygen delivery), and accumulation of procoagulant microparticles — represents a patient safety risk, particularly in neonatal and pediatric patients who receive comparatively large volumes relative to blood volume and in cardiac surgery patients where transfusion of high-potassium storage lesion blood into cardioplegia circuits creates hyperkalemia risk. 21 CFR Part 606.122 requires blood bank facilities to maintain records of blood product expiration dates, and AABB Standards require that expired units be segregated and not issued for transfusion. The adversarial injection attack on inventory AI specifically subverts the automated expiration alert system in the AI-managed inventory workflow, creating a record in the blood bank information system showing an erroneously extended or suppressed expiration record while the physically expired unit is issued for transfusion.

The financial incentive dimension of blood inventory AI adversarial manipulation is also clinically significant: a single unit of packed red blood cells costs approximately $200–$400 to collect, test, and process; hospital blood bank budgets for large academic centers exceed $10 million annually in blood product acquisition costs. Inventory AI platforms that optimize age-of-blood management and reduce blood product wastage from expiration represent significant cost savings — and adversarial manipulation of inventory AI to suppress true wastage tracking or inflate apparent inventory efficiency creates audit trail distortion under AABB Standards for blood bank accreditation and Medicare/Medicaid cost reporting requirements for hospital laboratory services.

Integration: blood bank AI gel card and panel image ingestion with Glyphward pre-scan

The Glyphward scan gate belongs at the AI ingestion boundary in each blood bank AI pipeline — before the gel card agglutination image reaches the crossmatch AI classifier, before the antibody panel reaction grid image reaches the panel interpretation AI, before the irradiation dose indicator image reaches the QC pass/fail AI, and before the blood product label image reaches the inventory management AI. The async implementation below defines a BloodBankAIContext Enum with the four blood bank AI contexts and their patient-safety-calibrated thresholds, including the uniquely low threshold of 40 for ABO crossmatch AI reflecting the instant lethality of ABO-incompatible transfusion. The structured JSONL audit output satisfies 21 CFR Part 606 / AABB accreditation record retention requirements for blood bank QC documentation.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Per-context thresholds reflecting blood bank AI patient-safety severity
# ABO crossmatch AI: threshold 40 — uniquely lowest across all clinical AI verticals
# ABO incompatibility is instantly life-threatening (AHTR onset within minutes of transfusion)
ABO_CROSSMATCH_THRESHOLD       = 40  # Grifols DG System / Bio-Rad ID-System / Ortho VISION Max / Immucor Neo / Beckman Coulter PK7300
ANTIBODY_ID_THRESHOLD          = 45  # Immucor ECHO Analyzer / Grifols DG Gel antibody panel AI
IRRADIATION_QC_THRESHOLD       = 45  # Fresenius Kabi Leukocheck AI / Haemonetics MCS+ / Gammex dose card AI
INVENTORY_EXPIRATION_THRESHOLD = 55  # Haemonetics BloodTrack Hub / Mediware Hemocare / Epic Beaker / SoftBank / bloodOptix


class BloodBankAIContext(Enum):
    ABO_CROSSMATCH       = "abo_crossmatch"       # threshold 40 — gel card agglutination image
    ANTIBODY_ID          = "antibody_id"           # threshold 45 — 11-cell panel reaction grid image
    IRRADIATION_QC       = "irradiation_qc"        # threshold 45 — dose indicator / leukoreduction image
    INVENTORY_EXPIRATION = "inventory_expiration"  # threshold 55 — blood product label / barcode image


_CONTEXT_THRESHOLDS: dict[BloodBankAIContext, int] = {
    BloodBankAIContext.ABO_CROSSMATCH:       ABO_CROSSMATCH_THRESHOLD,
    BloodBankAIContext.ANTIBODY_ID:          ANTIBODY_ID_THRESHOLD,
    BloodBankAIContext.IRRADIATION_QC:       IRRADIATION_QC_THRESHOLD,
    BloodBankAIContext.INVENTORY_EXPIRATION: INVENTORY_EXPIRATION_THRESHOLD,
}


class AdversarialBloodBankImageError(Exception):
    """Raised when Glyphward detects adversarial pixel content in a blood bank
    AI image above the context-specific patient-safety threshold.

    Attributes:
        scan_id: Glyphward scan identifier for the 21 CFR Part 606 audit record.
        score: Adversarial signal score (0-100).
        context: The BloodBankAIContext in which detection occurred.
        flagged_region: Optional dict describing the flagged pixel region.
    """

    def __init__(
        self,
        scan_id: str,
        score: int,
        context: BloodBankAIContext,
        flagged_region: dict | None = None,
    ) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial blood bank AI image detected: "
            f"context={context.value} score={score} scan_id={scan_id}"
        )


async def scan_blood_bank_ai_image(
    image_path: Path,
    context: BloodBankAIContext,
    unit_isbt_hash: str,
    patient_mrn_hash: str,
    specimen_accession: str,
    client: httpx.AsyncClient,
) -> dict:
    """Scan a blood bank AI input image for adversarial pixel content.

    Args:
        image_path: Absolute path to the blood bank AI input image (gel card,
            antibody panel grid, irradiation dose card, or blood product label).
        context: BloodBankAIContext enum value identifying the AI pipeline.
        unit_isbt_hash: SHA-256 hash of the ISBT 128 donation identification
            number (DIN) — not the DIN itself, to avoid PHI in audit log.
        patient_mrn_hash: SHA-256 hash of patient MRN for crossmatch contexts
            (use empty string for irradiation QC and inventory contexts).
        specimen_accession: Blood bank specimen accession number for audit trail.
        client: Shared httpx.AsyncClient for connection reuse.

    Returns:
        Glyphward scan result dict: scan_id, score, flagged_region, modality.

    Raises:
        AdversarialBloodBankImageError: if score exceeds context threshold.
            For ABO_CROSSMATCH context this threshold is 40 — fail-closed at
            the lowest clinical AI threshold in the Glyphward framework.
        httpx.HTTPStatusError: on Glyphward API errors (fail-closed: do not
            pass image to blood bank AI under any API error condition).
    """
    threshold = _CONTEXT_THRESHOLDS[context]
    image_bytes = image_path.read_bytes()
    image_hash = hashlib.sha256(image_bytes).hexdigest()

    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"blood_bank:{context.value}:{specimen_accession}",
        "metadata": {
            "unit_isbt_hash": unit_isbt_hash,
            "patient_mrn_hash": patient_mrn_hash,
            "specimen_accession": specimen_accession,
            "image_sha256": image_hash,
        },
    }

    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=5.0,
    )
    resp.raise_for_status()
    result = resp.json()

    await write_blood_bank_scan_audit(
        image_hash=image_hash,
        scan_id=result["scan_id"],
        score=result["score"],
        context=context,
        threshold=threshold,
        unit_isbt_hash=unit_isbt_hash,
        patient_mrn_hash=patient_mrn_hash,
        specimen_accession=specimen_accession,
        flagged=result["score"] > threshold,
    )

    if result["score"] > threshold:
        raise AdversarialBloodBankImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            flagged_region=result.get("flagged_region"),
        )

    return result


async def write_blood_bank_scan_audit(
    *,
    image_hash: str,
    scan_id: str,
    score: int,
    context: BloodBankAIContext,
    threshold: int,
    unit_isbt_hash: str,
    patient_mrn_hash: str,
    specimen_accession: str,
    flagged: bool,
) -> None:
    """Append structured JSON audit record to blood bank AI scan log.

    Satisfies 21 CFR Part 606 / 21 CFR Part 606.160 record requirements and
    AABB Standards for blood bank QC documentation. Hashed identifiers avoid
    PHI in the scan log while preserving audit traceability. The audit record
    provides evidence for FDA inspection under 21 CFR Part 606.122 equipment
    QC and AABB Standards 5.6 (irradiation) and 5.4 (compatibility testing).
    """
    record = {
        "ts": datetime.now(timezone.utc).isoformat(),
        "scan_id": scan_id,
        "image_sha256": image_hash,
        "context": context.value,
        "score": score,
        "threshold": threshold,
        "flagged": flagged,
        "unit_isbt_hash": unit_isbt_hash,
        "patient_mrn_hash": patient_mrn_hash,
        "specimen_accession": specimen_accession,
        "cfr_references": ["21 CFR 606.122", "21 CFR 606.151", "21 CFR 606.160"],
    }
    audit_path = Path("/var/log/glyphward/blood_bank_ai_scan_audit.jsonl")
    audit_path.parent.mkdir(parents=True, exist_ok=True)
    with audit_path.open("a") as fh:
        fh.write(json.dumps(record) + "\n")


async def process_blood_bank_image_batch(
    images: list[tuple[Path, BloodBankAIContext, str, str, str]],
) -> list[dict]:
    """Process a batch of (path, context, unit_isbt_hash, mrn_hash, accession) tuples."""
    async with httpx.AsyncClient() as client:
        tasks = [
            scan_blood_bank_ai_image(
                image_path=path,
                context=ctx,
                unit_isbt_hash=unit_hash,
                patient_mrn_hash=mrn_hash,
                specimen_accession=accession,
                client=client,
            )
            for path, ctx, unit_hash, mrn_hash, accession in images
        ]
        results = []
        for coro in asyncio.as_completed(tasks):
            try:
                results.append(await coro)
            except AdversarialBloodBankImageError as exc:
                results.append({
                    "status": "quarantined",
                    "context": exc.context.value,
                    "scan_id": exc.scan_id,
                    "score": exc.score,
                    "flagged_region": exc.flagged_region,
                })
        return results

Deploy scan_blood_bank_ai_image at each blood bank AI image ingestion boundary: before the gel card agglutination image reaches the Grifols DG System or Ortho VISION Max crossmatch AI (threshold 40, fail-closed on any Glyphward API error); before the 11-cell panel reaction grid image reaches the Immucor ECHO Analyzer antibody ID AI (threshold 45); before the irradiation dose indicator or leukoreduction residual sample image reaches the Fresenius Kabi Leukocheck or Haemonetics MCS+ QC AI (threshold 45); and before the blood product label image reaches the Haemonetics BloodTrack Hub or Epic Beaker Transfusion inventory AI (threshold 55). Get early access

Related questions

Further reading

• Prompt injection in healthcare radiology AI — PACS imaging pipelines and diagnostic AI adversarial attacks
• Prompt injection in digital pathology and clinical laboratory AI — slide scanning AI and lab result injection
• HIPAA-compliant AI security — §164.312 audit controls for medical image AI pipelines
• Prompt injection in biometric identity verification AI — patient ID and access control AI adversarial attacks
• Prompt injection scanning API free tier — 10 scans/day, no card required