Prompt injection in dental AI

Four adversarial injection surfaces in dental AI pipelines

1. Periapical and bitewing radiograph AI bypass (Overjet AI, Pearl Second Opinion, VideaHealth diagnostic AI)

Overjet’s AI analysis pipeline ingests digital periapical and bitewing radiograph images exported from dental practice management imaging systems — Eaglesoft, Dentrix Ascend, Curve Dental, and open-standard DICOM export — and processes them through a convolutional neural network trained to detect and annotate caries lesions, periapical pathology (abscess, granuloma, cyst), bone level changes indicating periodontal disease, and restorative margin quality on existing crowns and fillings. The AI generates structured output in the form of finding annotations overlaid on the original radiograph image, with confidence scores per finding that downstream workflows use for treatment recommendation and insurance prior authorization. Overjet’s clearance for caries detection is predicated on the AI’s sensitivity and specificity on FDA-reviewed validation datasets; the adversarial threat is that those validation-set performance characteristics do not extend to adversarially perturbed inputs that the FDA’s static validation framework does not test.

Pearl AI’s Second Opinion platform similarly ingests exported radiograph images and generates finding reports covering 40+ dental conditions, operating both at the chairside level (annotations appearing in the imaging software during the clinical appointment) and at the payer level (Pearl’s findings used by dental insurance plans to adjudicate prior authorization requests submitted with attached radiograph images). The adversarial attack against Pearl and Overjet radiograph AI targets the pixel content of the radiograph image at the point of export from the imaging system or at the API submission point before the AI inference backend. An adversary who controls the imaging workstation software, the image export workflow, or the API integration layer can apply adversarial pixel perturbations to the radiograph image bytes before they reach the AI, causing the AI to fail to annotate caries lesions present in the underlying radiograph, generate false positive annotations for caries lesions not present in the underlying radiograph, or misclassify the severity of periapical pathology. The clinical consequence of adversarial caries detection suppression is untreated dental caries that progress to pulp involvement and eventual tooth loss; the insurance fraud consequence of adversarial false positive generation is claim approval for restorative procedures on healthy teeth, with direct financial exposure under the False Claims Act 31 USC §3729 for dental providers participating in Medicare Advantage dental benefits (expanding since 2019) and Medicaid dental programs serving 75 million Medicaid enrollees.

VideaHealth’s integration with Dentsply Sirona imaging hardware creates an embedded AI pipeline where the radiograph AI runs within the imaging software ecosystem rather than as a separate API call, increasing the attack surface because the adversarial injection point moves from the API boundary to the image acquisition and software rendering pipeline within the dental practice IT environment. VideaHealth’s AI finding reports are increasingly used in treatment plan documentation submitted to insurance payers as supporting evidence for major restorative and surgical claim authorizations, creating financial incentives for adversarial manipulation by both providers seeking authorization for high-value procedures and patients seeking to avoid identifying conditions requiring expensive treatment.

2. CBCT cone beam CT implant planning AI injection (Planmeca ProAI, DEXIS ConeBeam AI, Romexis AI)

Cone beam computed tomography (CBCT) provides three-dimensional volumetric imaging of dental anatomy, and AI-assisted CBCT analysis has become integral to implant placement planning, surgical guide fabrication, orthodontic assessment, and temporomandibular joint (TMJ) evaluation in oral and maxillofacial surgery. Planmeca Romexis AI, integrated into Planmeca’s CBCT systems deployed in more than 11,000 dental offices in over 120 countries, applies AI to CBCT volumetric data to perform automatic segmentation of bone anatomy, tooth structures, and neural anatomy (inferior alveolar nerve canal tracing), generating implant site assessments that clinicians use to plan implant depth, angulation, and diameter relative to available bone volume. DEXIS ConeBeam AI and Carestream Dental’s AI-assisted CBCT analysis perform equivalent analysis, with the AI outputs directly feeding into surgical implant planning software that generates stereolithographic (STL) surgical guide designs used during implant placement surgery to physically constrain drill angulation and depth.

The adversarial attack against CBCT implant planning AI targets the volumetric image data at the DICOM export stage, before the AI analysis pipeline processes the 3D dataset. A CBCT volume is a stack of hundreds of 2D cross-sectional slices stored in DICOM format; adversarial perturbations applied to individual slice images within the DICOM stack can cause the AI bone segmentation to over-report available bone volume at a candidate implant site, misrepresent the inferior alveolar nerve canal position relative to the planned implant trajectory, or fail to identify pathological bone quality (osteoporosis-pattern trabecular density, post-extraction socket resorption) that would contraindicate implant placement. The surgical consequence of adversarially inflated bone volume reporting is implant placement that penetrates the inferior alveolar nerve canal, causing permanent paresthesia or anesthesia of the lower lip and chin (a recognized implant complication with documented malpractice exposure), or implant failure due to insufficient primary stability in bone of inadequate density or volume. Dental implant malpractice claims involving nerve injury have resulted in jury verdicts exceeding $1 million in jurisdictions including California, New York, and Florida; the AI-generated surgical guide’s role in the clinical decision chain creates product liability exposure for CBCT AI vendors under Restatement (Third) of Torts: Products Liability §2 when the AI output contribution to a surgical plan can be demonstrated. FDA’s 510(k) clearance pathway for dental CBCT AI does not require demonstration of adversarial robustness; the SaMD Cybersecurity Guidance of October 2023 identifies adversarial inputs as a specific cybersecurity threat category for AI/ML-enabled medical devices but does not prescribe mandatory adversarial scanning architecture.

The financial stakes of CBCT AI manipulation extend beyond malpractice liability into implant case economics: full-arch implant reconstruction cases typically bill $25,000–$80,000 per arch at premium implant centers, with CBCT AI-assisted planning documentation used to support insurance authorization for implant procedures covered by some dental plans under the expanding dental benefit provisions of Medicare Advantage. Adversarial manipulation of CBCT AI findings to support authorization of implant cases that would not meet clinical indication criteria constitutes healthcare fraud under 18 USC §1347, with FCA treble damages available in Medicare and Medicaid-covered implant cases.

3. Periodontal scoring and bone level measurement AI injection (Pearl Second Opinion, Overjet periodontal AI)

Periodontal disease affects 47% of US adults over 30 and 70% of those over 65, and AI-assisted periodontal assessment from dental radiographs has emerged as a major clinical application of dental AI. Pearl AI’s Second Opinion platform includes automated bone level measurement that identifies alveolar bone crest levels relative to cementoenamel junctions on periapical radiographs and generates quantitative bone loss percentage estimates that are used to stage periodontal disease severity under the 2018 AAP/EFP Classification of Periodontal and Peri-implant Diseases. Overjet’s periodontal AI performs equivalent bone level analysis, with its outputs used in insurance prior authorization for periodontal therapy (scaling and root planing, osseous surgery) that requires radiographic documentation of bone loss severity to support medical necessity. Dental AI companies have also partnered with periodontal practice management systems to integrate AI bone level measurements into treatment planning workflows at specialist periodontal offices.

The adversarial attack against periodontal AI targets the pixel content of periapical and bitewing radiographs at the imaging system export point. Adversarial perturbations designed to cause the AI to under-report alveolar bone loss — reporting bone crest levels as normal when the underlying radiograph shows significant horizontal or vertical bone loss — serve an adversarial purpose in insurance fraud contexts where a provider submitting a periodontal therapy prior authorization wants the attached radiograph AI finding to support the claim while the underlying clinical condition does not meet payer medical necessity criteria. Conversely, adversarial perturbations that cause the AI to over-report bone loss on healthy radiographs serve a different fraud vector: inflating apparent periodontal disease severity to support authorization of periodontal surgery procedures that will not improve patient outcomes but generate provider revenue. The ADA CDT code set for periodontal services includes D4341 and D4342 (scaling and root planing per quadrant) at average insurance reimbursements of $200–$300 per quadrant, D4260 (osseous surgery) at $800–$1,500 per quadrant, and D4910 (periodontal maintenance) as an indefinite recurring service; the financial magnitude of fraudulent periodontal claim authorization supported by adversarially manipulated AI findings is substantial at DSO scale. OIG dental fraud enforcement actions under the False Claims Act and anti-kickback statutes have resulted in multi-million dollar settlements against dental service organizations and affiliated practices in recent years, establishing a documented enforcement environment in which AI-evidence chain integrity is operationally material.

4. Dental insurance claim image AI bypass (Vyne Dental, Dental Intelligence, Eaglesoft AI claim processing)

Dental insurance claim processing has increasingly incorporated AI-assisted review of radiograph images, intraoral photographs, and clinical documentation images attached to claim submissions for prior authorization and adjudication. Vyne Dental’s clearinghouse platform processes over 350 million dental claim transactions annually and operates AI tools that analyze claim-attached radiograph images to verify clinical necessity indicators for major restorative, periodontal, and surgical procedures. Dental Intelligence, used by more than 10,000 dental practices, includes AI analytics that process clinical documentation including radiograph images to generate treatment acceptance metrics and insurance claim approval rate analysis. Payer-side dental AI is deployed by Delta Dental (the largest US dental benefits provider, covering 80 million members), MetLife Dental, and Cigna Dental to automate prior authorization review of claim-attached radiograph images — a process previously performed entirely by human benefit reviewers but increasingly automated using AI classification models trained on approved-claim historical radiograph datasets.

The adversarial attack against dental claim AI targets the radiograph image attached to the claim submission at the clearinghouse API submission point or at the payer’s claim intake portal. A dental practice or billing service that submits adversarially perturbed radiograph images with claim attachments can cause the payer’s AI to approve claims for procedures the underlying radiograph does not clinically support, or deny claims for procedures that the underlying radiograph clearly indicates. The fraud vector is AI approval manipulation: the adversarial perturbation is designed to cause the AI reviewer to find clinical necessity indicators (caries lesion, bone loss, periapical pathology) in a radiograph image where the underlying dental condition does not meet the payer’s coverage criteria. Because the adversarially perturbed radiograph is visually indistinguishable from the unperturbed original to a human benefit reviewer, the fraud is detectable only through adversarial pixel analysis of the submitted image — exactly the scanning function that text-only fraud detection systems (which analyze claim metadata, billing codes, and procedure-frequency patterns) cannot provide. National Health Care Anti-Fraud Association estimates dental fraud accounts for $100 billion annually across all dental benefit programs; the subset attributable to radiograph AI manipulation is currently unquantified because payer AI systems do not perform adversarial image scanning on submitted claim attachments.

Integration: dental AI radiograph ingestion with Glyphward pre-scan

The Glyphward scan gate belongs at the radiograph image ingestion point in each dental AI pipeline — before the periapical radiograph, bitewing X-ray, CBCT slice, intraoral camera frame, or claim attachment image is passed to the AI analysis engine. The async pattern below handles all four dental AI contexts through a shared scan_dental_ai_image function, with context-specific thresholds reflecting the patient safety severity of each decision type and structured audit output suitable for HIPAA §164.312(b) audit control evidence and ADA/CDT claim integrity documentation.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Per-context thresholds reflecting dental AI patient-safety risk profile
PERIAPICAL_BITEWING_THRESHOLD  = 50  # Overjet / Pearl / VideaHealth diagnostic inputs
CBCT_IMPLANT_PLANNING_THRESHOLD = 50  # Planmeca ProAI / DEXIS ConeBeam AI
PERIODONTAL_SCORING_THRESHOLD  = 55  # Pearl / Overjet periodontal bone level AI
CLAIM_CODING_THRESHOLD         = 55  # Vyne Dental / payer claim attachment AI


class DentalAIContext(Enum):
    PERIAPICAL_BITEWING   = "periapical_bitewing"    # threshold 50
    CBCT_IMPLANT_PLANNING = "cbct_implant_planning"  # threshold 50
    PERIODONTAL_SCORING   = "periodontal_scoring"    # threshold 55
    CLAIM_CODING          = "claim_coding"           # threshold 55


_CONTEXT_THRESHOLDS: dict[DentalAIContext, int] = {
    DentalAIContext.PERIAPICAL_BITEWING:   PERIAPICAL_BITEWING_THRESHOLD,
    DentalAIContext.CBCT_IMPLANT_PLANNING: CBCT_IMPLANT_PLANNING_THRESHOLD,
    DentalAIContext.PERIODONTAL_SCORING:   PERIODONTAL_SCORING_THRESHOLD,
    DentalAIContext.CLAIM_CODING:          CLAIM_CODING_THRESHOLD,
}


class AdversarialDentalAIImageError(Exception):
    """Raised when Glyphward detects adversarial pixel content in a
    dental AI input image above the context threshold.

    Attributes:
        scan_id: Glyphward scan identifier for the audit record.
        score: Adversarial signal score (0-100).
        context: The DentalAIContext in which detection occurred.
        flagged_region: Optional dict describing the pixel region containing the signal.
    """

    def __init__(
        self,
        scan_id: str,
        score: int,
        context: DentalAIContext,
        flagged_region: dict | None = None,
    ) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial dental AI image detected: "
            f"context={context.value} score={score} scan_id={scan_id}"
        )


async def scan_dental_ai_image(
    image_path: Path,
    context: DentalAIContext,
    patient_id_hash: str,
    study_uid: str,
    practice_npi: str,
    client: httpx.AsyncClient,
) -> dict:
    """Scan a dental AI input image for adversarial pixel content.

    Args:
        image_path: Absolute path to the radiograph or image file to scan.
        context: DentalAIContext enum value identifying the AI pipeline.
        patient_id_hash: SHA-256 hash of patient MRN (not the MRN itself — HIPAA).
        study_uid: DICOM Study Instance UID or practice imaging study reference.
        practice_npi: Dental practice NPI for audit correlation.
        client: Shared httpx.AsyncClient for connection reuse.

    Returns:
        Glyphward scan result dict with keys: scan_id, score, flagged_region, modality.

    Raises:
        AdversarialDentalAIImageError: if score exceeds threshold.
        httpx.HTTPStatusError: on Glyphward API errors.
    """
    threshold = _CONTEXT_THRESHOLDS[context]
    image_bytes = image_path.read_bytes()
    image_hash = hashlib.sha256(image_bytes).hexdigest()

    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"dental:{context.value}:{study_uid}",
        "metadata": {
            "patient_id_hash": patient_id_hash,
            "study_uid": study_uid,
            "practice_npi": practice_npi,
            "image_sha256": image_hash,
        },
    }

    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=5.0,
    )
    resp.raise_for_status()
    result = resp.json()

    await write_dental_scan_audit(
        image_hash=image_hash,
        scan_id=result["scan_id"],
        score=result["score"],
        context=context,
        threshold=threshold,
        patient_id_hash=patient_id_hash,
        study_uid=study_uid,
        practice_npi=practice_npi,
        flagged=result["score"] > threshold,
    )

    if result["score"] > threshold:
        raise AdversarialDentalAIImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            flagged_region=result.get("flagged_region"),
        )

    return result


async def write_dental_scan_audit(
    *,
    image_hash: str,
    scan_id: str,
    score: int,
    context: DentalAIContext,
    threshold: int,
    patient_id_hash: str,
    study_uid: str,
    practice_npi: str,
    flagged: bool,
) -> None:
    """Append a structured JSON audit record to the dental AI scan log.

    Audit record satisfies HIPAA §164.312(b) audit control requirements
    (records access to ePHI-adjacent AI systems) without storing ePHI
    (patient_id_hash is SHA-256 of MRN, not the MRN itself).
    Suitable for ADA/CDT claim integrity documentation and OIG audit evidence.
    """
    record = {
        "ts": datetime.now(timezone.utc).isoformat(),
        "scan_id": scan_id,
        "image_sha256": image_hash,
        "context": context.value,
        "score": score,
        "threshold": threshold,
        "flagged": flagged,
        "patient_id_hash": patient_id_hash,
        "study_uid": study_uid,
        "practice_npi": practice_npi,
    }
    audit_path = Path("/var/log/glyphward/dental_ai_scan_audit.jsonl")
    audit_path.parent.mkdir(parents=True, exist_ok=True)
    with audit_path.open("a") as fh:
        fh.write(json.dumps(record) + "\n")


async def process_dental_image_batch(
    images: list[tuple[Path, DentalAIContext, str, str, str]],
) -> list[dict]:
    """Process a batch of (path, context, patient_hash, study_uid, practice_npi) tuples."""
    async with httpx.AsyncClient() as client:
        tasks = [
            scan_dental_ai_image(
                image_path=path,
                context=ctx,
                patient_id_hash=pid,
                study_uid=uid,
                practice_npi=npi,
                client=client,
            )
            for path, ctx, pid, uid, npi in images
        ]
        results = []
        for coro in asyncio.as_completed(tasks):
            try:
                results.append(await coro)
            except AdversarialDentalAIImageError as exc:
                results.append({
                    "status": "quarantined",
                    "context": exc.context.value,
                    "scan_id": exc.scan_id,
                    "score": exc.score,
                    "flagged_region": exc.flagged_region,
                })
        return results

Deploy scan_dental_ai_image at the image ingestion boundary of each dental AI pipeline: before the periapical radiograph reaches Overjet, Pearl, or VideaHealth; before the CBCT slice stack reaches Planmeca ProAI or DEXIS ConeBeam AI; and before the claim attachment radiograph reaches Vyne Dental or payer AI adjudication. The patient_id_hash pattern (SHA-256 of MRN) produces a correlation key for clinical audit without storing ePHI in the scan log, satisfying HIPAA §164.312(b) audit control requirements and HITECH §13402 breach notification threshold assessment. Get early access

Coverage matrix

Related questions

Further reading

• Prompt injection in healthcare radiology AI — DICOM triage injection, PACS metadata dictation injection
• Multimodal prompt injection in healthcare imaging AI — clinical context and FDA SaMD cybersecurity guidance
• HIPAA-compliant AI security — §164.312 audit controls and integrity requirements for multimodal AI
• Prompt injection in digital pathology and clinical laboratory AI
• Prompt injection scanning API free tier — 10 scans/day, no card required