Prompt injection in dermatology and clinical AI — patient-submitted skin condition photos, wearable device images, wound care telehealth, and AI triage severity manipulation

Four multimodal injection surfaces in dermatology and clinical AI

1. Dermatology skin lesion photo triage AI — adversarial manipulation of malignancy risk scores. Consumer and clinical dermatology AI apps process patient-submitted photos of skin lesions, moles, rashes, and other dermatological presentations to generate risk assessments and triage recommendations. Platforms like Skin Analytics DERM, used within the NHS teledermatology pathway, apply AI classification to lesion photos to generate a two-tier triage: “needs urgent referral” vs “can wait for routine appointment”. This triage output directly affects clinical follow-up timing — patients classified as low-risk by the AI are routed to longer-wait pathways than patients classified as high-risk. Adversarial manipulation of this triage output has bidirectional clinical significance: adversarially crafted lesion images that cause the AI to downgrade a genuinely high-risk presentation may delay referral for a malignant lesion; adversarially crafted images that cause the AI to upgrade a low-risk presentation cause unnecessary urgent referrals that consume clinical capacity. Both outcomes represent patient safety risks. The patient submits their own skin photos — the adversarial injection point is the photo capture and upload step. While most patients would not deliberately manipulate a dermatology AI triage, the attack surface is not only patient-intentional: platform compromise, adversarial photo filter applications, and photo processing intermediaries that modify images before platform upload are all potential adversarial injection vectors outside patient intent. A Glyphward pre-scan on lesion photos before AI triage classification detects adversarial payloads regardless of injection source.

2. Telehealth wound care platform image injection in remote wound progression monitoring. Telehealth wound care platforms serve patients with chronic wounds — diabetic foot ulcers, post-surgical wounds, pressure injuries — who require regular monitoring between clinical visits. Patients photograph their wounds on a schedule (daily or weekly) and upload photos to platforms like Tissue Analytics, Nuo Therapeutics MIST, and similar wound care AI systems. These AI systems measure wound dimensions from photos (area, depth indicators from shadow analysis), classify tissue type composition (healthy granulation, slough, eschar, epithelialising), generate automated PUSH score calculations, and alert clinical care coordinators when wound progression indicators suggest deterioration. These outputs directly affect care escalation decisions: a wound progression alert triggers a clinical callback or in-person visit; a suppressed alert means a deteriorating wound goes unmonitored until the scheduled assessment. Adversarially crafted wound progression photos — genuine wound photos with injected payloads that suppress deterioration signals — can cause the AI to underreport wound area increase, misclassify necrotic tissue as granulation tissue, or suppress PUSH score escalation alerts. For vulnerable patient populations (elderly, immunocompromised, diabetic) where wound deterioration can progress rapidly to sepsis-level risk, delayed escalation based on suppressed AI wound alerts represents a direct patient safety concern. A Glyphward pre-scan on wound progression photo uploads detects adversarial content before AI wound assessment runs.

3. Wearable device photo submission injection in device onboarding and clinical monitoring setup. An increasingly common clinical AI workflow involves patients photographing wearable medical devices during setup and calibration: continuous glucose monitor (CGM) sensor placement photos submitted to AI placement validation systems, ECG patch electrode placement confirmation photos, oxygen saturation probe placement images, and wound VAC (vacuum-assisted closure) device setup photos. These device setup photos are processed by AI validation tools to confirm correct placement and return placement quality scores — a valid placement score is the gate that activates clinical data collection. Adversarially crafted device placement photos — genuine setup photos with injected instruction payloads — can cause the AI placement validation to confirm correct placement for an incorrectly positioned device, generating false positive placement validation that allows clinical data collection to proceed from a mis-positioned sensor. A CGM incorrectly positioned but validated as correct by adversarial photo injection will produce systematically biased glucose readings — a patient management risk for diabetes care. The device placement photo is entirely patient-controlled and is submitted to an AI validation system with no independent physical verification step. The attack is most significant for device types where placement accuracy directly affects measurement quality and where the AI validation score is the sole confirmation mechanism.

4. Primary care AI triage system photo submission injection in symptom severity classification. Primary care AI triage tools embedded in NHS 111 digital pathways, Kaiser Permanente’s digital triage, and consumer health platforms like Ada Health increasingly incorporate photo submission for symptom assessment: photos of visible symptoms (rashes, swellings, throat presentations, eye conditions, ear canal presentations) submitted to AI symptom classifiers that generate urgency tier outputs. These urgency tier outputs determine routing: “call emergency services immediately”, “attend urgent care within two hours”, “book GP appointment within 48 hours”, “manage at home with self-care guidance”. Adversarial manipulation of urgency tier outputs in either direction creates patient safety risk: downgraded urgency for a genuine emergency presentation delays emergency response; upgraded urgency for a non-emergency presentation generates unnecessary emergency service utilisation and causes secondary delay for genuine emergencies competing for the same capacity. The AI triage photo submission point is a patient-controlled input that enters the clinical urgency pipeline with no adversarial content screening. Platforms running AI triage at scale across millions of user sessions have a systemic safety exposure if adversarial injection techniques capable of manipulating urgency tier outputs become accessible to motivated actors. A Glyphward pre-scan at the photo submission step provides adversarial detection before the urgency classification AI processes the image.

Integration: clinical photo intake with Glyphward pre-scan

import base64
import hashlib
import requests
from datetime import datetime, timezone

GLYPHWARD_KEY = "<your-glyphward-api-key>"

# Clinical photo threshold is 55, stricter than the general default of 65.
# Patient safety stakes in clinical AI triage justify a lower threshold:
# the cost of a missed adversarial payload is a potential incorrect
# clinical decision, not just a data quality issue.
# False positives route to human clinical review — an acceptable cost.
GLYPHWARD_THRESHOLD_CLINICAL = 55

def scan_clinical_photo(
    image_bytes: bytes,
    photo_type: str,  # "dermatology_lesion" | "wound_progression" | "device_placement" | "symptom_triage"
    patient_id: str,  # pseudonymised / hashed patient identifier
    session_id: str,
) -> dict:
    """
    Pre-clinical-AI scan for patient-submitted health photos.
    Returns scan audit record for clinical safety and HIPAA audit trail.
    Raises ValueError on adversarial detection; RuntimeError on scan failure.

    patient_id must be a pseudonymised/hashed identifier, not PHI,
    to comply with data minimisation requirements when sending to
    third-party scan services. Do not send name, DOB, or NHS/SSN number.
    """
    encoded = base64.b64encode(image_bytes).decode()
    image_hash = hashlib.sha256(image_bytes).hexdigest()

    scan_resp = requests.post(
        "https://glyphward.com/v1/scan",
        headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
        json={"image": encoded},
        timeout=5,
    )

    audit_record = {
        "patient_id_hash": patient_id,
        "session_id": session_id,
        "photo_type": photo_type,
        "image_sha256": image_hash,
        "scanned_at": datetime.now(timezone.utc).isoformat(),
        "scan_status": None,
        "scan_id": None,
        "scan_score": None,
        # HIPAA and NHS DSPT audit trail field
        "clinical_ai_safety_gate": "glyphward_multimodal_pi_scan",
    }

    if scan_resp.status_code != 200:
        # Fail-closed: route to human clinical review when scan gate is
        # unavailable. Never auto-process clinical AI on unscannable image.
        audit_record["scan_status"] = "error_routed_to_human_clinical_review"
        persist_clinical_audit_record(audit_record)
        raise RuntimeError(
            f"Glyphward scan unavailable: type={photo_type} session={session_id}"
            f" — photo routed to human clinical review"
        )

    scan = scan_resp.json()
    audit_record["scan_id"] = scan["scan_id"]
    audit_record["scan_score"] = scan["score"]

    if scan["score"] >= GLYPHWARD_THRESHOLD_CLINICAL:
        audit_record["scan_status"] = "adversarial_blocked_clinical_review"
        persist_clinical_audit_record(audit_record)
        # Route to human clinical review; log scan_id as safety event.
        raise ValueError(
            f"Adversarial clinical photo blocked: type={photo_type} "
            f"session={session_id} score={scan['score']} "
            f"scan_id={scan['scan_id']} — routed to human clinical review"
        )

    audit_record["scan_status"] = "clean_passed"
    persist_clinical_audit_record(audit_record)
    return audit_record

def persist_clinical_audit_record(record: dict):
    # Append to HIPAA-covered / NHS DSPT audit log alongside clinical session.
    # Retain per applicable clinical records retention requirement.
    # Do not store PHI in the audit record fields — only the pseudonymised hash.
    pass

Note the patient_id_hash field: send only a pseudonymised/hashed patient identifier to the Glyphward scan API, not raw PHI. The image bytes themselves do not contain PHI unless the patient has photographed identifying documents — scan the clinical image without metadata that would constitute PHI under HIPAA or UK GDPR. Persist every audit_record to the clinical session audit log, retaining the scan_id as evidence that each submitted photo was adversarial-content-checked before clinical AI processing. This satisfies the clinical AI safety audit requirement under the EU AI Act Annex III (medical device AI systems in high-risk categories) and provides a documented safety event log for HIPAA-covered entities. See HIPAA-compliant AI security for the full compliance context. Get early access

Coverage matrix

Related questions

Further reading

• Healthcare imaging AI prompt injection — DICOM and radiology — broader clinical imaging attack surface beyond patient-submitted photos
• Prompt injection in healthcare AI — general scanner page — full healthcare AI attack surface reference
• HIPAA-compliant AI security — HIPAA compliance context for clinical AI image processing
• EU AI Act Article 15 — adversarial robustness for high-risk AI — medical AI systems are high-risk under Annex III
• Glyphward API free tier — scan clinical images today at no cost