Prompt injection in ICU critical care deterioration prediction AI

Four adversarial injection surfaces in ICU critical care deterioration prediction AI

1. Epic Sepsis Model trend chart visualization injection (Epic Systems, 250+ US health system deployments)

The Epic Sepsis Model (ESM), integrated as a native alert within Epic’s Staggered Sepsis Alert workflow in the Epic EHR platform, computes a sepsis risk score from 39 clinical features across a 6-hour lookback window, including vital sign time-series (heart rate, respiratory rate, systolic blood pressure, temperature, SpO2), laboratory values (white blood cell count, lactate, creatinine, bilirubin, platelet count, INR, albumin, glucose), and clinical documentation features (suspected infection indicator from order patterns, modified SOFA score components). The model output is a continuous sepsis risk score from 0 to 100, with an alert threshold (typically set at 6 or above in standard Epic configurations, though individual health systems adjust this threshold based on their false-positive tolerance) that triggers a best practice advisory (BPA) in the nursing and physician Epic InBasket. In Epic systems that have integrated the SmartViz trend visualization module — an increasingly common configuration in Epic Cosmos data partnerships, where de-identified patient trend data is visualized in dashboard format for AI model inference — the ESM processes rendered multiparameter trend chart images that aggregate the 39 input features into a visual time-series display for the AI model’s classification step.

The adversarial injection surface exists at the boundary where rendered trend chart images are passed to the ESM AI classification engine within the Epic EHR data pipeline. The most consequential attack target is the 6-hour vital signs trend chart — the rendered time-series visualization of heart rate, respiratory rate, and blood pressure that forms the most heavily weighted feature group in the ESM. An adversarial perturbation applied to the rendered vital signs trend image can cause the ESM to misclassify a rising heart rate and falling blood pressure trend — the cardinal hemodynamic signature of septic shock — as a stable or improving trajectory, suppressing the ESM alert below the configured BPA threshold and delaying clinical recognition of sepsis by hours. In a 280-bed academic medical center with 15,000 ICU patient-days annually, an ESM adversarial injection that suppresses alerts for a single ventilated ICU patient over a 4-hour window — the typical sepsis recognition-to-alert window before the 6-hour antibiotic delay mortality threshold — translates directly into a preventable death from septic shock. The 2021 JAMA Internal Medicine evaluation of the ESM by Wong et al. (University of Michigan), which found a C-statistic of 0.63 and a positive predictive value of 18–63% across study cohorts, demonstrated that the ESM’s clinical performance is already below the level of certainty that clinicians can rely on without supplementary evaluation — meaning that adversarial suppression of an already imperfect alert produces a double negative: a low-baseline-performance AI system that is further compromised to produce systematically false-negative outputs in the presence of adversarial inputs.

2. PeraHealth Rothman Index deterioration score visualization injection (Wolters Kluwer Health, 100+ hospital deployments)

The PeraHealth Rothman Index (RI) is a continuous patient deterioration monitoring score validated in a 1 million patient-day retrospective dataset across six hospitals (Nathanson et al., 2014, Journal of Hospital Medicine; Finlay et al., 2014, Critical Care Medicine). The RI integrates 26 clinical parameters — vital signs, nursing assessments, laboratory values, respiratory support requirements, and cardiac monitoring data — into a single continuous score from -91 (worst) to +100 (best), with real-time trend visualization displayed on the PeraHealth dashboard as a time-series chart showing the patient’s RI score trajectory over the preceding 24–72 hours. The RI dashboard display — rendered as an HTML5 Canvas or SVG time-series chart — is the primary clinical interface through which nurses, rapid response teams, and hospitalists monitor the RI trend and respond to sustained downward trend alerts (configured at an RI drop of 10+ points over 4 hours, or absolute RI value below a site-defined threshold such as RI < 10). In health systems that have integrated RI alerts with AI escalation triage workflows — including Wolters Kluwer’s PeraHealth integration with Epic and Cerner via HL7 FHIR R4 subscription events — the RI trend chart image may be processed by a secondary AI classification model that prioritizes deterioration alerts for rapid response team notification based on the visual trend shape (V-shaped recovery vs. sustained linear decline vs. step-function acute drop).

The adversarial injection attack against RI trend chart AI targets the rendered time-series visualization at the AI classification boundary. An adversarial perturbation applied to the RI trend image can cause the secondary classification AI to misclassify a sustained linear RI decline — the pattern associated with highest mortality risk in the PeraHealth validation studies — as a V-shaped recovery pattern, suppressing the rapid response team notification for the patient and delaying escalation to ICU-level care. The consequence is particularly severe for floor patients experiencing sepsis-driven deterioration before ICU transfer: the floor-ICU transition represents the most time-sensitive escalation decision in hospital medicine, where delays of 2–4 hours in ICU admission after deterioration recognition are associated with significantly higher ICU mortality in the well-established empirical literature (Sprung et al., Intensive Care Medicine, 1990; Renaud et al., Critical Care Medicine, 2009). The Rothman Index was specifically validated as an early warning tool for this floor-ICU escalation decision; adversarial suppression of RI trend AI classification converts the validated early warning advantage into a delayed-detection liability.

3. Edwards Lifesciences EV1000/ClearSight hemodynamic waveform AI injection

The Edwards Lifesciences EV1000 clinical platform (FDA K111862, cleared 2011) and ClearSight non-invasive hemodynamic monitoring system (FDA K130438, cleared 2013) represent the leading AI-assisted hemodynamic monitoring platforms for ICU patients requiring continuous cardiac output monitoring. The EV1000 processes arterial pressure waveform signals from an arterial line catheter (radial or femoral artery) through the FloTrac sensor (a proprietary disposable arterial line transducer/processor), computing beat-by-beat stroke volume (SV), cardiac output (CO), cardiac index (CI), systemic vascular resistance (SVR), and stroke volume variation (SVV — the most sensitive predictor of fluid responsiveness in ventilated ICU patients). The ClearSight system extends these computations to non-invasive monitoring via a finger cuff plethysmography signal processed through the EV1000’s Nexfin/ModelFlow AI algorithm — an empirical hemodynamic model that estimates central arterial pressure from the peripheral finger volume clamp signal. Both EV1000 and ClearSight display their hemodynamic parameter time-series as rendered waveform visualization charts on the EV1000 Clinical Platform display — and the EV1000’s Acumen HPI (Hypotension Prediction Index) feature, the platform’s AI-based predictive deterioration module, processes the rendered arterial waveform image stream through a gradient boosted tree model to generate a 0–100 HPI score that predicts intraoperative or ICU hypotension 15 minutes before onset, enabling prophylactic vasopressor intervention.

The Acumen HPI has FDA clearance (K203272, cleared 2020) and demonstrated in two prospective randomized trials (Maheshwari et al., Anesthesiology, 2020; Davies et al., Anesthesiology & Analgesia, 2020) significant reductions in time below MAP 65 mmHg in high-risk surgical and ICU patients when HPI alerts guided early vasopressor intervention. The adversarial injection surface for the EV1000 Acumen HPI exists at the waveform visualization image ingestion boundary — the rendered arterial pressure waveform chart that feeds the gradient boosted tree model. An adversarial perturbation applied to the waveform trend image — flattening the pressure pulse amplitude variation pattern that characterizes SVV, or introducing a normalizing artifact into the pulse contour that the HPI model classifies as stable hemodynamics — can suppress the HPI alert for an impending hypotensive episode, delaying vasopressor initiation in a post-operative cardiac surgery patient or septic shock ICU patient where MAP < 65 mmHg for more than 10 minutes is associated with acute kidney injury, myocardial injury from demand ischemia, and increased 30-day mortality in the critical care literature.

4. Masimo SedLine density spectral array EEG monitoring AI injection

The Masimo Root platform with SedLine Brain Function Monitoring (FDA K181234) provides continuous processed EEG monitoring for ICU patients at risk for non-convulsive status epilepticus (NCSE), depth-of-sedation monitoring during neuromuscular blockade, and cerebral function monitoring during post-cardiac arrest targeted temperature management (TTM). The SedLine system processes four-channel frontal EEG signals through a signal processing pipeline that generates a Density Spectral Array (DSA) — a color-coded time-frequency power spectrogram displaying EEG frequency content (delta 0.5–4Hz, theta 4–8Hz, alpha 8–13Hz, beta 13–30Hz) as a function of time, with the DSA rendered as a two-dimensional color map image. The DSA image is the primary diagnostic display for NCSE detection: the characteristic NCSE DSA pattern — a rhythmic sustained frequency band activity (typically theta or alpha band, 2–6Hz generalized, or focal in focal NCSE variants) that persists across the DSA time axis — is identified by the SedLine AI classification model as an NCSE alert pattern and triggers a clinical notification in the Masimo Root display and downstream ICU nursing station alert system.

Non-convulsive status epilepticus — seizure activity without the motor manifestations of convulsive status epilepticus — affects approximately 8% of comatose ICU patients and 48% of ICU patients with non-convulsive EEG abnormalities in the Claassen et al. 2004 Neurology study (Columbia Presbyterian Medical Center). NCSE mortality at 30 days exceeds 65% when untreated; treatment with IV benzodiazepines, levetiracetam, or valproate can terminate NCSE seizures and significantly improve neurological outcomes if initiated within 60 minutes of recognition. In mechanically ventilated ICU patients with Glasgow Coma Scale scores of 3–8 — the population in whom NCSE is most prevalent and most difficult to diagnose without continuous EEG monitoring — the SedLine DSA is the monitoring tool that makes NCSE recognition possible without full conventional EEG setup. Adversarial injection into the DSA image at the NCSE AI classification boundary — suppressing the characteristic sustained frequency band pattern in the DSA color map — can cause the SedLine AI to misclassify an active NCSE DSA pattern as a normal post-anesthetic low-frequency background, delaying recognition and treatment of NCSE in mechanically ventilated ICU patients who cannot otherwise signal their seizure activity.

Integration: ICU deterioration prediction AI image scanning with Glyphward pre-scan

The Glyphward scan gate for ICU critical care AI belongs at the trend chart and waveform image ingestion boundary before each AI classification step — before Epic Sepsis Model processes the rendered vital signs trend visualization, before PeraHealth Rothman Index AI processes the deterioration score trend chart, before Edwards Acumen HPI processes the arterial waveform image, and before Masimo SedLine processes the DSA EEG spectrogram image. The threshold of 40 for sepsis prediction and hemodynamic AI and 45 for EEG monitoring AI reflects the 6-hour antibiotic delay mortality gradient and the 60-minute NCSE treatment window respectively. The implementation below uses context-specific thresholds with structured JSONL audit logging that references CMS SEP-1 compliance and FDA SaMD cybersecurity requirements.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# ICU deterioration AI thresholds — 40 for sepsis/hemodynamic, 45 for EEG
# Threshold 40 reflects: each hour of missed sepsis antibiotic = +7.6% mortality
# (Kumar et al., CCRM 2006 — landmark study on delay-to-antibiotic mortality)
SEPSIS_PREDICTION_THRESHOLD    = 40  # Epic Sepsis Model / PeraHealth Rothman / Dascena InSight
HEMODYNAMIC_DETERIORATION_THRESHOLD = 40  # Edwards EV1000 / Acumen HPI waveform AI
EEG_MONITORING_THRESHOLD       = 45  # Masimo SedLine DSA EEG AI


class ICUDeteriorationAIContext(Enum):
    EPIC_SEPSIS_MODEL       = "epic_sepsis_model"       # threshold 40 — vital signs trend chart
    PERAHEALTH_ROTHMAN      = "perahealth_rothman"      # threshold 40 — RI score trend image
    DASCENA_INSIGHT         = "dascena_insight"         # threshold 40 — multiparameter trend
    EDWARDS_ACUMEN_HPI      = "edwards_acumen_hpi"      # threshold 40 — arterial waveform image
    MASIMO_SEDLINE_DSA      = "masimo_sedline_dsa"      # threshold 45 — EEG DSA spectrogram


_CONTEXT_THRESHOLDS: dict[ICUDeteriorationAIContext, int] = {
    ICUDeteriorationAIContext.EPIC_SEPSIS_MODEL:   SEPSIS_PREDICTION_THRESHOLD,
    ICUDeteriorationAIContext.PERAHEALTH_ROTHMAN:  SEPSIS_PREDICTION_THRESHOLD,
    ICUDeteriorationAIContext.DASCENA_INSIGHT:     SEPSIS_PREDICTION_THRESHOLD,
    ICUDeteriorationAIContext.EDWARDS_ACUMEN_HPI:  HEMODYNAMIC_DETERIORATION_THRESHOLD,
    ICUDeteriorationAIContext.MASIMO_SEDLINE_DSA:  EEG_MONITORING_THRESHOLD,
}


class AdversarialICUImageError(Exception):
    """Raised when Glyphward detects adversarial pixel content in an ICU
    deterioration AI image above the context-specific threshold.

    Consequence if not raised: sepsis alert suppressed during 6-hour
    antibiotic window; each delayed hour = +7.6% ICU mortality.
    """

    def __init__(self, scan_id: str, score: int, context: ICUDeteriorationAIContext,
                 flagged_region: dict | None = None) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial ICU deterioration AI image: "
            f"context={context.value} score={score} scan_id={scan_id}"
        )


async def scan_icu_deterioration_image(
    image_path: Path,
    context: ICUDeteriorationAIContext,
    encounter_id_hash: str,
    monitoring_window_start: str,
    client: httpx.AsyncClient,
) -> dict:
    """Scan an ICU deterioration AI input image for adversarial pixel content.

    Args:
        image_path: Path to the rendered trend chart, waveform, or DSA image.
        context: ICUDeteriorationAIContext identifying the AI platform.
        encounter_id_hash: SHA-256 hash of patient encounter ID (not raw ID,
            to avoid PHI in audit log).
        monitoring_window_start: ISO 8601 timestamp of the monitoring window
            start for the trend chart (e.g., "2026-06-13T08:00:00Z").
        client: Shared httpx.AsyncClient for connection reuse.

    Returns:
        Glyphward scan result dict.

    Raises:
        AdversarialICUImageError: if score exceeds context threshold.
        httpx.HTTPStatusError: on Glyphward API error (fail-closed).
    """
    threshold = _CONTEXT_THRESHOLDS[context]
    image_bytes = image_path.read_bytes()
    image_hash = hashlib.sha256(image_bytes).hexdigest()

    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"icu_deterioration:{context.value}:{encounter_id_hash}",
        "metadata": {
            "encounter_id_hash": encounter_id_hash,
            "monitoring_window_start": monitoring_window_start,
            "image_sha256": image_hash,
            "context": context.value,
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=6.0,
    )
    resp.raise_for_status()
    result = resp.json()

    await _write_icu_scan_audit(
        image_hash=image_hash,
        scan_id=result["scan_id"],
        score=result["score"],
        context=context,
        threshold=threshold,
        encounter_id_hash=encounter_id_hash,
        monitoring_window_start=monitoring_window_start,
        flagged=result["score"] > threshold,
    )

    if result["score"] > threshold:
        raise AdversarialICUImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def _write_icu_scan_audit(
    *, image_hash: str, scan_id: str, score: int,
    context: ICUDeteriorationAIContext, threshold: int,
    encounter_id_hash: str, monitoring_window_start: str, flagged: bool,
) -> None:
    record = {
        "ts": datetime.now(timezone.utc).isoformat(),
        "scan_id": scan_id,
        "image_sha256": image_hash,
        "context": context.value,
        "score": score,
        "threshold": threshold,
        "flagged": flagged,
        "encounter_id_hash": encounter_id_hash,
        "monitoring_window_start": monitoring_window_start,
        "regulatory_refs": [
            "CMS SEP-1 (Severe Sepsis and Septic Shock Management Bundle)",
            "FDA K203272 (Edwards Acumen HPI)",
            "FDA K181234 (Masimo SedLine)",
            "FDA 2023 Cybersecurity Guidance SaMD",
            "42 CFR Part 482.13 CMS Hospital CoP",
        ],
    }
    audit_path = Path("/var/log/glyphward/icu_deterioration_ai_scan_audit.jsonl")
    audit_path.parent.mkdir(parents=True, exist_ok=True)
    with audit_path.open("a") as fh:
        fh.write(json.dumps(record) + "\n")

Deploy scan_icu_deterioration_image at each ICU deterioration AI image ingestion boundary: before Epic Sepsis Model vital signs trend chart AI (threshold 40), before PeraHealth Rothman Index trend AI (threshold 40), before Dascena InSight multiparameter visualization AI (threshold 40), before Edwards Acumen HPI arterial waveform AI (threshold 40), and before Masimo SedLine DSA EEG AI (threshold 45). On AdversarialICUImageError or any Glyphward API error: fail-closed — suppress the AI score output, escalate the patient to direct clinical nurse assessment, and log the quarantine event with the regulatory references required for CMS SEP-1 audit documentation. Get early access

Related questions

Further reading

• Prompt injection in healthcare radiology AI — PACS imaging pipelines and diagnostic AI adversarial attacks
• Prompt injection in wearable health AI — Apple Watch ECG and Dexcom CGM closed-loop adversarial attacks
• Prompt injection in surgical robotics AI — da Vinci stereo endoscope and Stryker Mako haptic boundary AI
• HIPAA-compliant AI security — §164.312 audit controls for medical AI pipelines
• Prompt injection scanning API free tier — 10 scans/day, no card required