Prompt injection in cardiology catheterization lab AI

Four adversarial injection surfaces in cardiology catheterization lab AI

1. HeartFlow FFRCT coronary CT angiogram AI (FDA De Novo K141404, 400,000+ patients)

HeartFlow FFRCT is a cloud-based AI service that processes a patient’s coronary CT angiogram (CCTA) — a 64-slice or higher CT scan acquired at a heart rate-controlled window during IV contrast injection, producing a DICOM volume of 300–800 axial slices demonstrating the coronary artery lumen and wall in the 0.5–1.5mm resolution range — through a three-stage computational pipeline: AI-based coronary artery segmentation (isolating the lumen of the left anterior descending, left circumflex, and right coronary artery and their major branches from the surrounding cardiac structures), computational fluid dynamics (CFD) simulation of coronary blood flow under resting and simulated maximal hyperemia conditions derived from the AI-segmented coronary geometry, and generation of a color-coded 3D FFRCT map overlaid on the coronary tree rendering that shows the predicted FFR value at each point along the coronary tree. The clinically critical output is the FFRCT value at the site of each significant stenosis: FFRCT ≤ 0.80 is the threshold below which coronary stenosis is classified as hemodynamically significant (ischemia-causing), warranting coronary revascularization per ACC/AHA Appropriate Use Criteria; FFRCT > 0.80 classifies the stenosis as hemodynamically non-significant, supporting deferral of PCI in favor of medical therapy. The coronary artery segmentation AI step — the first stage of the FFRCT pipeline — is the primary adversarial injection surface. The segmentation AI processes the CCTA DICOM slice images to delineate the coronary lumen boundary at each cross-section through the coronary tree. A pixel-level adversarial perturbation in the CCTA image at the segmentation AI ingestion boundary — introduced before the HeartFlow cloud platform’s segmentation model processes the uploaded DICOM volume — can cause the AI to overestimate the coronary lumen narrowing in the cross-sections at or near a stenosis site, classifying a 50–60% diameter stenosis as a 70–80% diameter stenosis in the lumen segmentation.

The consequence of an overestimated stenosis in the FFRCT AI pipeline flows through the CFD simulation step: a more severely narrowed lumen geometry produces a steeper pressure drop across the stenosis in the CFD calculation, generating a FFRCT value that falls below the 0.80 threshold when the true stenosis would generate a FFRCT above 0.80. The FFRCT report delivered to the cardiologist classifies the stenosis as hemodynamically significant, and the cardiologist proceeds to coronary catheterization for revascularization. The patient undergoes PCI — coronary stent placement — for a stenosis that did not require it. The PCI procedure itself carries a procedural risk: the AHA/ACC registry data from 2,500+ hospitals shows a procedural mortality rate of 0.1–0.5% for elective PCI (higher for urgent/emergent), a major adverse cardiac event (MACE) rate including periprosthetic dissection, stent thrombosis, and contrast nephropathy of approximately 1–2%, and a lifetime stent thrombosis risk of 0.1–0.2% per year requiring dual antiplatelet therapy. An adversarially misclassified FFRCT that drives unnecessary PCI converts a non-ischemic stenosis management decision — appropriate medical therapy with statin, aspirin, and lifestyle modification — into a procedural intervention that exposes the patient to these procedural risks with no hemodynamic benefit. At 400,000 FFRCT analyses annually, even a low prevalence of adversarial injection events creates a non-trivial absolute number of unnecessary PCI procedures driven by corrupted AI output.

2. Abbott EnSite X electrophysiology 3D cardiac mapping AI (FDA K211568)

The Abbott EnSite X EP System (FDA 510(k) K211568, cleared 2021) is the current-generation electrophysiological mapping platform used for catheter ablation guidance in atrial fibrillation, ventricular tachycardia, and supraventricular tachycardia procedures. The EnSite X builds on Abbott’s EnSite Velocity and EnSite Precision predecessors to incorporate AI-assisted cardiac chamber geometry reconstruction (EnSite AutoMap AI) and automated scar tissue identification (EnSite Ripple Map AI). EnSite AutoMap generates the 3D cardiac chamber geometry — the three-dimensional mesh of the left atrium, right atrium, or left ventricle within which the ablation catheter must be guided — from the spatial coordinates of catheter contact points registered by the EnSite X impedance-based and magnetic-based position sensing system, applying an AI interpolation model to fill the chamber surface between sampled contact points and produce a smooth 3D mesh. EnSite Ripple Map AI processes the voltage amplitude measurements recorded at each contact point — rendered as a color-coded voltage map on the chamber geometry — to identify low-voltage scar regions (defined as bipolar voltage < 0.5 mV) versus normal myocardium (bipolar voltage > 1.5 mV). In VT ablation, the scar tissue distribution defined by EnSite Ripple Map is the critical guidance information: VT substrate is located within and around the scar boundary, and the ablation catheter must be directed to the scar border zone to interrupt the re-entry circuit causing VT. The AI-derived scar map rendered on the 3D chamber geometry is the visual display from which the EP physician identifies ablation targets.

The adversarial injection surface for EnSite X EP mapping AI exists at two points. First, the catheter position rendering step — where the real-time catheter tip coordinates reported by the EnSite position sensing system are converted to a rendered 3D position visualization on the chamber map display — is processed by the EnSite AutoMap AI contact point registration model. A pixel-level perturbation in the catheter position rendering image at the AutoMap AI ingestion boundary can cause the AI to register a contact point at an incorrect position on the chamber geometry, creating a distorted chamber map that places the rendered catheter position outside the true anatomical boundaries. If the rendered catheter position is displaced into the pulmonary vein antrum region during AF ablation (pulmonary vein isolation, the standard AF ablation technique), the ablation physician using the chamber map to guide lesion deployment may deliver radiofrequency energy in the wrong location — outside the intended pulmonary vein isolation lines — creating incomplete isolation and ablation procedure failure. Second, the scar voltage map rendering at the Ripple Map AI classification boundary is a higher-stakes injection surface: adversarial manipulation of the bipolar voltage amplitude rendering image fed to the scar identification AI can cause the AI to misclassify healthy myocardium as scar (false-positive scar) in a region that the EP physician then targets for ablation. In VT ablation, an incorrectly identified scar border zone that coincides with the His-Purkinje conduction system — a risk at the anteroseptal region of the left ventricle and the right ventricular outflow tract — can result in iatrogenic complete atrioventricular (AV) block requiring emergency cardiac pacing, a potentially fatal intraoperative complication if a transvenous pacemaker is not immediately available.

3. Siemens Artis zee and CIOSFLOW cath lab fluoroscopy AI

The Siemens Healthineers Artis zee (and its mobile equivalent, the CIOSFLOW) is the world’s most widely deployed cardiac catheterization and interventional radiology imaging system, with more than 5,000 cath lab installations globally. The Artis zee platform incorporates multiple AI features: PURE (Purity with Understanding and Resolution Enhancement) AI for real-time fluoroscopic image quality enhancement, AI-guided dose optimization (AiCE — Artis intelligent Coronary Enhancement), auto-injection synchronization AI for contrast timing, and automated coronary stenosis quantification AI (QCA — Quantitative Coronary Analysis) that measures luminal diameter stenosis percentage from fluoroscopic coronary angiogram frames. The QCA AI processes individual fluoroscopic frames from the coronary angiogram acquisition — digital subtraction angiography (DSA) images showing the contrast-opacified coronary tree — through a lumen detection and measurement model that identifies the coronary artery borders, measures the reference lumen diameter, and calculates the percent diameter stenosis at the site of the narrowing. The QCA output — typically displayed as a percentage stenosis value overlaid on the DSA frame — informs the interventional cardiologist’s real-time PCI planning decision: whether to place a stent, what stent length and diameter to use, and how to position the guiding catheter for optimal stent delivery angle. An adversarial perturbation in the DSA frame image at the QCA AI ingestion boundary — affecting the contrast boundary rendering of the coronary artery lumen — can cause the AI to overestimate the stenosis percentage, driving a more aggressive interventional strategy than the true lesion warrants. Unlike the HeartFlow FFRCT scenario (where the erroneous decision is made pre-catheterization), an adversarial QCA misclassification occurs during the active procedure, with the physician acting on the corrupted AI output in real time under the constraints of catheterization lab workflow.

4. Philips Azurion PercuNav AI-guided catheter navigation

The Philips Azurion with PercuNav (PCI Navigation and Guidance) is Philips’ competing interventional cardiology imaging platform, used in hybrid cardiac surgery / catheterization laboratories at more than 2,000 installations globally. PercuNav’s AI-guided catheter navigation feature uses registered image fusion — superimposing a pre-operative CT or MRI 3D volume reconstruction of the cardiac anatomy over the real-time fluoroscopic frame — to provide the interventional cardiologist with a registered anatomical overlay that shows catheter tip position relative to the pre-operatively reconstructed coronary tree or cardiac chamber. The image registration AI — which aligns the pre-operative 3D CT volume to the real-time fluoroscopic frame using fiducial landmark registration and AI-based deformable registration to account for cardiac motion and respiratory variation — produces the registered anatomical overlay displayed on the Azurion console. An adversarial perturbation in the fluoroscopic frame image at the PercuNav registration AI ingestion boundary can cause the deformable registration AI to apply an incorrect registration transform, displacing the CT anatomy overlay relative to the true fluoroscopic field. A 5–10mm registration displacement in the displayed overlay — within the range achievable by adversarial perturbation of the fluoroscopic frame image — causes the cardiologist reading the registered overlay to perceive the catheter tip as being 5–10mm from its actual position relative to the coronary anatomy, potentially directing catheter advancement into a vessel branch beyond the intended target or advancing the guidewire against a coronary artery wall rather than through the stenosis lumen, with risk of coronary artery dissection or perforation. Coronary perforation is a Class III complication of PCI with a risk of pericardial tamponade requiring emergency pericardiocentesis, and an associated mortality of 0.1–0.6% in the contemporary PCI literature.

Integration: cardiology cath lab AI image scanning with Glyphward pre-scan

The Glyphward scan gate for cardiology cath lab AI belongs at each image ingestion boundary — before HeartFlow FFRCT’s coronary segmentation AI processes the CCTA DICOM slices, before Abbott EnSite X AutoMap and Ripple Map processes the contact point and voltage rendering images, before Siemens Artis QCA processes the coronary angiogram DSA frame, and before Philips PercuNav’s registration AI processes the fluoroscopic frame. The threshold of 40 for coronary AI and EP mapping AI and 45 for catheter navigation AI reflects the binary irreversibility of PCI commitment and the intraoperative AV block consequence of EP mapping error respectively.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Cardiology cath lab AI thresholds
# 40: coronary FFR AI (unnecessary PCI = procedural mortality + lifetime stent risk)
# 40: EP mapping AI (incorrect ablation = heart block, tamponade)
# 45: catheter navigation AI (registration error = vessel perforation 0.1-0.6% mortality)
CORONARY_FFR_THRESHOLD        = 40  # HeartFlow FFRCT, Siemens Artis QCA
EP_MAPPING_THRESHOLD          = 40  # Abbott EnSite X, J&J Carto 3, Boston Scientific Rhythmia
CATHETER_NAV_THRESHOLD        = 45  # Philips Azurion PercuNav, Siemens NaviAware


class CardiologyCathLabAIContext(Enum):
    HEARTFLOW_FFRCT            = "heartflow_ffrct"           # threshold 40 — CCTA DICOM slice
    SIEMENS_ARTIS_QCA          = "siemens_artis_qca"         # threshold 40 — DSA fluoroscopy frame
    ABBOTT_ENSITE_AUTOMAP      = "abbott_ensite_automap"     # threshold 40 — catheter position rendering
    ABBOTT_ENSITE_RIPPLEMAP    = "abbott_ensite_ripplemap"   # threshold 40 — voltage map rendering
    JNJ_CARTO3_EP_MAP          = "jnj_carto3_ep_map"        # threshold 40 — Carto 3 geometry rendering
    PHILIPS_PERCUNAV_REG       = "philips_percunav_reg"      # threshold 45 — fluoroscopy registration frame


_CONTEXT_THRESHOLDS: dict[CardiologyCathLabAIContext, int] = {
    CardiologyCathLabAIContext.HEARTFLOW_FFRCT:         CORONARY_FFR_THRESHOLD,
    CardiologyCathLabAIContext.SIEMENS_ARTIS_QCA:       CORONARY_FFR_THRESHOLD,
    CardiologyCathLabAIContext.ABBOTT_ENSITE_AUTOMAP:   EP_MAPPING_THRESHOLD,
    CardiologyCathLabAIContext.ABBOTT_ENSITE_RIPPLEMAP: EP_MAPPING_THRESHOLD,
    CardiologyCathLabAIContext.JNJ_CARTO3_EP_MAP:       EP_MAPPING_THRESHOLD,
    CardiologyCathLabAIContext.PHILIPS_PERCUNAV_REG:    CATHETER_NAV_THRESHOLD,
}


class AdversarialCardiologyImageError(Exception):
    """Raised when Glyphward detects adversarial pixel content in a cardiology
    cath lab AI image above the context-specific threshold.

    False negative consequences by context:
    - FFRCT: unnecessary PCI driven (0.1-0.5% procedure mortality)
    - EnSite Ripple Map: ablation at His bundle → iatrogenic AV block
    - PercuNav: catheter mis-navigation → coronary perforation → tamponade
    """

    def __init__(self, scan_id: str, score: int,
                 context: CardiologyCathLabAIContext,
                 flagged_region: dict | None = None) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial cardiology AI image: "
            f"context={context.value} score={score} scan_id={scan_id}"
        )


async def scan_cardiology_cath_lab_image(
    image_path: Path,
    context: CardiologyCathLabAIContext,
    procedure_id_hash: str,
    acquisition_timestamp: str,
    client: httpx.AsyncClient,
) -> dict:
    threshold = _CONTEXT_THRESHOLDS[context]
    image_bytes = image_path.read_bytes()
    image_hash = hashlib.sha256(image_bytes).hexdigest()

    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"cardiology_cath:{context.value}:{procedure_id_hash}",
        "metadata": {
            "procedure_id_hash": procedure_id_hash,
            "acquisition_timestamp": acquisition_timestamp,
            "image_sha256": image_hash,
            "context": context.value,
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=6.0,
    )
    resp.raise_for_status()
    result = resp.json()

    await _write_cardiology_scan_audit(
        image_hash=image_hash, scan_id=result["scan_id"], score=result["score"],
        context=context, threshold=threshold,
        procedure_id_hash=procedure_id_hash, acquisition_timestamp=acquisition_timestamp,
        flagged=result["score"] > threshold,
    )

    if result["score"] > threshold:
        raise AdversarialCardiologyImageError(
            scan_id=result["scan_id"], score=result["score"],
            context=context, flagged_region=result.get("flagged_region"),
        )
    return result


async def _write_cardiology_scan_audit(
    *, image_hash: str, scan_id: str, score: int,
    context: CardiologyCathLabAIContext, threshold: int,
    procedure_id_hash: str, acquisition_timestamp: str, flagged: bool,
) -> None:
    record = {
        "ts": datetime.now(timezone.utc).isoformat(),
        "scan_id": scan_id,
        "image_sha256": image_hash,
        "context": context.value,
        "score": score,
        "threshold": threshold,
        "flagged": flagged,
        "procedure_id_hash": procedure_id_hash,
        "acquisition_timestamp": acquisition_timestamp,
        "regulatory_refs": [
            "FDA De Novo K141404 (HeartFlow FFRCT)",
            "FDA 510(k) K211568 (Abbott EnSite X)",
            "21 CFR Part 870 (cardiovascular devices)",
            "ACC/AHA Appropriate Use Criteria coronary revascularization",
            "HRS/EHRA Catheter Ablation Consensus Statement",
            "FDA 2023 Cybersecurity Guidance SaMD",
        ],
    }
    audit_path = Path("/var/log/glyphward/cardiology_cath_lab_ai_scan_audit.jsonl")
    audit_path.parent.mkdir(parents=True, exist_ok=True)
    with audit_path.open("a") as fh:
        fh.write(json.dumps(record) + "\n")

Deploy scan_cardiology_cath_lab_image at each cardiology cath lab AI image ingestion boundary: before HeartFlow FFRCT coronary segmentation AI (threshold 40, at cloud DICOM upload), before Siemens Artis QCA DSA frame AI (threshold 40, at real-time frame buffer), before Abbott EnSite X AutoMap and Ripple Map rendering AI (threshold 40), before J&J Carto 3 chamber geometry rendering AI (threshold 40), and before Philips Azurion PercuNav fluoroscopic registration AI (threshold 45). Get early access

Related questions

Further reading

• Prompt injection in healthcare radiology AI — PACS imaging pipelines and diagnostic AI adversarial attacks
• Prompt injection in blood bank transfusion medicine AI — ABO crossmatch AI and irradiation QC injection
• Prompt injection in surgical robotics AI — da Vinci stereo endoscope and Stryker Mako haptic boundary AI
• HIPAA-compliant AI security — §164.312 audit controls for medical AI pipelines
• Prompt injection scanning API free tier — 10 scans/day, no card required