Multimodal prompt injection in healthcare imaging AI

The four multimodal attack surfaces in healthcare imaging AI

1. DICOM files from referring institutions — external-sourced adversarial pixel data in PACS-integrated AI workflows. Radiology AI second-read tools are commonly integrated with hospital PACS systems that receive DICOM files from referring institutions via DICOM network (C-STORE, C-MOVE) or DICOMweb REST API. The referring institution is an external entity with partial trust: the institution is a known clinical partner, DICOM TLS encrypts the transmission, DICOM conformance statements define the SOP classes exchanged, and the PACS audit log records the DICOM association — all controls on the integrity of the DICOM protocol exchange, not on the clinical integrity of the pixel data. An adversarially modified DICOM file — where the pixel data array carries an embedded adversarial payload alongside the legitimate medical image content — passes DICOM network validation (valid SOP class, valid pixel data format, valid DICOM metadata tags) and is stored in the PACS. The AI second-read tool retrieves the study from PACS, extracts the pixel array, runs its clinical AI model, and produces findings. The adversarial payload in the pixel data may direct the AI model toward a specific false finding: a false negative for a radiologically visible lesion (causing the AI not to flag a finding that would otherwise be flagged), or a specific false positive assertion (claiming a finding that is not present). In either case, the PACS audit trail, DICOM TLS, and HIPAA controls provide no signal that the pixel data was adversarially modified.

2. PACS-integrated AI second-read on archived studies — adversarial modification of historical image data. AI second-read tools operate not only on newly received studies but also on historically archived studies — retrospective AI review of prior imaging to flag studies that may have been misread, quality assurance audits of reporting accuracy, or research workflows that apply newer AI models to historical PACS data. Historical PACS archives contain images from past acquisitions across a range of imaging sources. PACS storage integrity is typically protected by WORM-equivalent storage policies, audit logs, and hash-based integrity checking of archived objects. If an adversarial modification occurred before the image entered the PACS archive — at the modality worklist acquisition step, at the DICOM routing layer, or at a third-party imaging service provider — the archived image contains the adversarial pixel payload with the hash-based integrity check computed over the adversarially modified pixel data. The AI second-read tool retrieves the archived study, extracts the pixel array, runs its model, and produces findings that reflect the adversarial payload — with the PACS integrity check confirming that the retrieved image matches the stored version, not that the stored image is free of adversarial modification. This attack surface is particularly relevant for AI retrospective review workflows that operate on large archived datasets at high throughput, where per-study adversarial image detection is not feasible without an automated pre-scan gate.

3. Pathology whole-slide imaging — adversarial regions in multi-gigapixel WSI files for digital pathology AI. Digital pathology AI analyses whole-slide images (WSI): multi-gigapixel image files produced by slide scanners (Aperio, Hamamatsu, Leica, Philips) and stored in formats including SVS, NDPI, SCN, and MRXS. WSI files are processed by AI in tiles: the WSI is divided into overlapping tile grids (typically 256×256 or 512×512 pixels per tile), and the AI model analyses each tile independently or in a multi-scale ensemble. Adversarial WSI attacks can target specific tile regions within the WSI: a maliciously prepared slide (prepared by an adversary with laboratory access, or a modified WSI file from an external laboratory) contains adversarial pixel content in one or more tile regions. These regions are analysed by the AI tile-processing pipeline and may produce specific false tile-level predictions that aggregate to a false slide-level finding. The attack requires adversarial knowledge of the AI model's tile-level classification boundaries — but this knowledge may be obtainable from published AI model papers (model architecture, training dataset) or through black-box probing of the AI system's API. WSI file integrity controls (hash-based storage verification, HIPAA audit trails) verify that the WSI file was not modified after ingestion, not that the WSI was prepared without adversarial intent before ingestion.

4. Telemedicine patient photo upload — adversarial images in AI-assisted dermatology and primary care triage. Telemedicine platforms that use AI to triage patient-submitted photos — dermatology lesion analysis, wound assessment, ophthalmology screening, primary care symptom assessment — process images submitted directly by patients through mobile apps or web portals. The patient is an external untrusted source by definition: while patients are not typically adversarial, telemedicine platforms serving large patient populations may also be accessed by individuals attempting to manipulate AI triage decisions — to obtain a referral for a condition they do not have, to avoid a referral for a condition they do, or to probe AI diagnostic boundaries for research or competitive purposes. Patient-submitted photos bypass the institutional trust controls applicable to DICOM-network-delivered clinical images: there is no DICOM TLS, no PACS integrity check, no institutional DICOM conformance statement. The AI triage system receives a JPEG or PNG from the patient's device and passes it directly to the vision model. Adversarially crafted patient photos — images that carry pixel-level payloads designed to trigger specific AI triage outputs — enter the AI pipeline with no layer of institutional validation between the patient's submission and the AI model's analysis.

Integration: pre-scan gate for DICOM-sourced healthcare imaging AI

import base64
import pydicom
import numpy as np
import requests
from PIL import Image
import io

GLYPHWARD_KEY = "<your-glyphward-api-key>"
GLYPHWARD_THRESHOLD = 65

def extract_pixel_array_as_jpeg(dicom_path: str) -> bytes:
    """
    Extract pixel array from DICOM file and convert to JPEG for scanning.
    Handles 16-bit grayscale (CT/MRI) and colour images (dermoscopy, pathology).
    """
    ds = pydicom.dcmread(dicom_path)
    pixel_array = ds.pixel_array

    # Apply window/level for grayscale modalities (CT, MRI, X-ray)
    if pixel_array.dtype != np.uint8:
        if hasattr(ds, "WindowCenter") and hasattr(ds, "WindowWidth"):
            center = float(ds.WindowCenter) if not isinstance(ds.WindowCenter, pydicom.multival.MultiValue) else float(ds.WindowCenter[0])
            width = float(ds.WindowWidth) if not isinstance(ds.WindowWidth, pydicom.multival.MultiValue) else float(ds.WindowWidth[0])
            lower = center - width / 2
            upper = center + width / 2
            pixel_array = np.clip(pixel_array, lower, upper)
            pixel_array = ((pixel_array - lower) / width * 255).astype(np.uint8)
        else:
            pixel_array = ((pixel_array - pixel_array.min()) / (pixel_array.max() - pixel_array.min()) * 255).astype(np.uint8)

    img = Image.fromarray(pixel_array)
    buf = io.BytesIO()
    img.save(buf, format="JPEG", quality=95)
    return buf.getvalue()

def scan_dicom_image(dicom_path: str) -> dict:
    """Scan DICOM pixel data for adversarial payloads before VLM analysis."""
    jpeg_bytes = extract_pixel_array_as_jpeg(dicom_path)
    encoded = base64.b64encode(jpeg_bytes).decode()

    response = requests.post(
        "https://glyphward.com/v1/scan",
        headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
        json={"image": encoded},
        timeout=5,
    )
    response.raise_for_status()
    return response.json()

def process_clinical_image(dicom_path: str, ai_model_call) -> dict:
    """
    Full clinical image processing pipeline with Glyphward pre-scan gate.
    Routes adversarial images to mandatory manual radiologist review.
    """
    try:
        scan = scan_dicom_image(dicom_path)
    except Exception as e:
        # Fail-closed: scan unavailability → mandatory manual review
        return {
            "status": "manual_review_required",
            "reason": "scan_unavailable",
            "error": str(e),
            "dicom_path": dicom_path,
        }

    if scan["score"] >= GLYPHWARD_THRESHOLD:
        # Adversarial image detected — route to mandatory manual review
        # Do NOT run AI model; do NOT generate AI finding
        return {
            "status": "manual_review_required",
            "reason": "adversarial_image_detected",
            "score": scan["score"],
            "scan_id": scan["scan_id"],
            "dicom_path": dicom_path,
            # Include in radiologist worklist with adversarial flag for awareness
        }

    # AI model call — only reached by non-adversarial images
    ai_finding = ai_model_call(dicom_path)
    return {
        "status": "ai_finding",
        "finding": ai_finding,
        "scan_id": scan["scan_id"],
        "dicom_path": dicom_path,
    }

The DICOM pixel extraction step applies window/level normalisation before scanning — this is important because adversarial payloads embedded in the original 12-bit or 16-bit pixel values of CT or MRI images may be structured to affect the VLM's interpretation after the standard windowing applied by the radiology viewing system. Scanning the windowed JPEG (as the VLM will process it) catches payloads targeting the windowed representation. For pathology WSI files, apply the scan gate to each tile batch rather than the full WSI: extract a representative sample of tiles (or all tiles in a high-throughput scan) and scan each tile; if any tile scan returns score >= 65, route the entire slide to manual pathologist review without AI analysis. Fail-closed is the correct default for clinical imaging: scan unavailability or adversarial detection routes to mandatory manual review, never to AI-assisted analysis under adversarial conditions. This is consistent with FDA guidance on AI/ML-based SaMD that requires human oversight pathways for high-risk AI-generated findings. Get early access

Coverage matrix

Related questions

Further reading

• OWASP LLM09 Misinformation — multimodal dimension — adversarially steered false claims in AI outputs; the medical imaging AI context is one of its four attack surfaces
• OWASP LLM01 Prompt Injection — multimodal dimension — the root attack mechanism behind adversarial clinical image payloads
• Prompt injection in document review platforms — the high-stakes external-counterparty threat model applied to legal AI; equivalent adversarial motivation structure to radiology AI from referring institutions
• Vision-language model security overview — comprehensive VLM attack surface taxonomy including medical imaging AI attack vectors
• Multimodal AI security checklist — structured security review covering DICOM-sourced imaging AI, patient photo upload pipelines, and clinical AI compliance requirements