Prompt injection in neonatal intensive care AI

Four adversarial injection surfaces in neonatal intensive care AI

1. Transcutaneous bilirubin meter AI — phototherapy initiation threshold classification (BiliChek, SpectRx TruBili, Natus BiliCheck)

Transcutaneous bilirubinometry (TcB) — the non-invasive estimation of total serum bilirubin from skin spectrophotometry — is the primary screening tool for neonatal jaundice in hospital newborn nurseries and NICUs worldwide, enabling high-frequency bilirubin monitoring without the pain and sampling burden of repeated heel-stick blood draws for laboratory TSB measurements. The SpectRx BiliCheck device (FDA 510(k) K963743), the Philips BiliChek (the successor to SpectRx BiliCheck after Philips’ acquisition of SpectRx), and the Natus Medical NEC BiliCheck use a multi-wavelength LED spectrophotometer head that illuminates the neonatal skin surface (typically the forehead or sternum), measures the optical reflectance spectrum at 8–12 wavelengths across the visible and near-infrared range, and applies an AI spectral deconvolution algorithm to extract the dermal bilirubin concentration estimate from the overlapping spectral contributions of skin melanin, oxygenated and deoxygenated hemoglobin, and subcutaneous fat. The AI spectral deconvolution output is a TcB estimate in mg/dL that the neonatal nurse or physician compares against the AAP 2022 guideline’s hour-specific phototherapy threshold chart — a reference tool that provides phototherapy initiation and confirmatory TSB measurement thresholds as a function of the infant’s postnatal age in hours and neurotoxicity risk category. Infants whose TcB meets or exceeds the phototherapy threshold trigger a confirmatory laboratory TSB measurement; if confirmed, phototherapy is initiated.

The adversarial injection surface in TcB AI exists at two points in the clinical workflow. First, in NICU systems that use AI-assisted TcB trend analysis — rendering the serial TcB measurements as a trend chart image that feeds an AI phototherapy guidance algorithm — the rendered TcB trend chart is the adversarial injection surface. An adversarial perturbation in the TcB trend chart image can cause the phototherapy guidance AI to misclassify a rising TcB trend that is approaching the phototherapy threshold as a plateau or declining trend, suppressing the phototherapy initiation recommendation. Second, in the SpectRx/BiliChek spectral deconvolution AI itself, adversarial manipulation of the calibration reference chart image — a wavelength-specific reflectance calibration standard that the device reads before each measurement session — can cause the AI spectral deconvolution algorithm to apply an incorrect calibration correction, systematically biasing TcB estimates toward lower values than the true bilirubin concentration. The clinical consequence of adversarial TcB suppression is delayed phototherapy initiation. In a 35-week premature infant with TSB rising at 0.5–1.0 mg/dL per hour — a common rise rate in the first 24–48 hours of life — a 6-hour delay in phototherapy initiation caused by adversarially suppressed TcB readings allows TSB to rise 3–6 mg/dL above the phototherapy threshold, potentially crossing into the exchange transfusion threshold zone (where the risk of acute bilirubin encephalopathy is immediate) or into kernicterus territory at the extreme. The AAP Hyperbilirubinemia Subcommittee’s 2022 kernicterus registry review identified 170 kernicterus cases in the US since 2001; all were considered preventable with timely phototherapy or exchange transfusion. Adversarial TcB AI suppression directly targets the preventability of each kernicterus case by corrupting the phototherapy decision support tool.

2. Masimo FORE-SIGHT MC cerebral NIRS oximetry AI (FDA K200010)

The Masimo FORE-SIGHT MC cerebral oximeter (FDA 510(k) K200010, cleared 2020) uses near-infrared spectroscopy (NIRS) to measure cerebral regional oxygen saturation (rSO₂ — the weighted average of oxygenated and deoxygenated hemoglobin in the frontal cerebral cortex, predominantly reflecting venous/capillary hemoglobin saturation) continuously and non-invasively in neonatal patients through adhesive sensor pads applied to the forehead. The FORE-SIGHT MC processes the raw NIRS optical signal through an AI model that separates the cerebral hemoglobin absorption signal from the extracranial absorption contribution (superficial scalp tissue, skull) using a modified Beer-Lambert law model with spatial resolution correction. The output — a continuous rSO₂ value displayed as a time-series trend on the Masimo Root display — is the primary monitoring parameter for cerebral oxygenation in NICUs caring for premature infants undergoing cardiac surgery with cardiopulmonary bypass (CPB), premature infants with hemodynamic instability (patent ductus arteriosus, intraventricular hemorrhage, necrotizing enterocolitis), and term infants with hypoxic-ischemic encephalopathy (HIE) undergoing therapeutic hypothermia. A cerebral rSO₂ threshold of <55% (or >20% decrease from baseline) for more than 2–5 minutes is the intervention threshold used in most NICU FORE-SIGHT protocols for triggering clinical assessment and hemodynamic optimization to prevent cerebral ischemia.

The adversarial injection surface for FORE-SIGHT MC cerebral oximetry AI exists at the rSO₂ trend visualization rendering step, where the processed NIRS signal is rendered as a time-series trend image for the Masimo AI trend analysis and alert generation module. An adversarial perturbation applied to the rSO₂ trend image can cause the AI alert module to misclassify a sustained cerebral desaturation event — a rSO₂ below 55% for 5+ minutes — as a normal variability artifact, suppressing the cerebral desaturation alert and the clinical intervention prompt. In a premature infant (gestational age 26–28 weeks) following patent ductus arteriosus (PDA) ligation surgery — a procedure associated with significant hemodynamic instability and post-operative cerebral blood flow variability — a 5–10 minute cerebral desaturation event below rSO₂ = 55% that is not responded to represents a cerebral ischemia window in a brain with germinal matrix vasculature at high risk for periventricular leukomalacia (PVL), the white matter injury that is the primary substrate for cerebral palsy in premature infants. The NIRS literature — including the SAFEGUARD trial (multicenter RCT, Dempsey et al., JAMA Pediatrics 2023) and the NIRS registry of Sorensen et al. (Pediatric Research 2019) — documents that NICU FORE-SIGHT-guided cerebral oxygenation interventions can reduce the burden of hypoxic white matter injury biomarkers in premature infants when desaturation events are identified and corrected; adversarial suppression of FORE-SIGHT AI alerts eliminates the benefit demonstrated in these trials. The threshold of 40 for FORE-SIGHT AI — equal to the sepsis prediction AI threshold — reflects the irreversible nature of PVL, which cannot be corrected or treated once established: unlike sepsis where timely antibiotic therapy can reverse organ dysfunction, cerebral white matter injury is a permanent structural lesion that determines the child’s long-term neurodevelopmental trajectory.

3. Philips IntelliVue Guardian neonatal early warning AI and neonatal multiparameter deterioration scoring

The Philips IntelliVue NX10 neonatal monitor, deployed across neonatal critical care units globally, provides continuous monitoring of heart rate, respiratory rate, SpO₂, temperature, and blood pressure with the IntelliVue Guardian Solution — an AI-based early warning scoring platform that processes the multiparameter vital signs data stream through a deterioration prediction model trained on neonatal ICU patient outcome data. The Guardian neonatal AI generates a continuous Modified Early Warning Score for Neonates (MEWSN) or equivalent early warning score from the monitored parameters, rendering the score as a time-trend chart visualization that feeds the Guardian alert classification AI. The classification AI generates rapid-escalation alerts when the MEWSN trend shows a sustained score above a configurable threshold — typically MEWSN > 3 for escalation assessment in premature infants — or when the MEWSN displays the characteristic acute spike pattern associated with neonatal sepsis (sudden increase of 3+ points in <30 minutes). Neonatal sepsis — bacterial bloodstream infection in newborn infants in the first 90 days of life — kills approximately 3 million neonates annually worldwide; in the US, early-onset sepsis (EOS, <72 hours of age) and late-onset sepsis (LOS, >72 hours) in very low birth weight (VLBW) infants (<1,500g) carry a mortality of 15–40%, with significant neurodevelopmental morbidity in survivors (intraventricular hemorrhage, PVL, and white matter injury from the systemic inflammatory response).

The adversarial injection surface for neonatal MEWSN AI exists at the early warning score trend chart rendering step, where the multiparameter MEWSN time-series is rendered as a visualization image fed to the Guardian classification AI. An adversarial perturbation in the MEWSN trend chart image can cause the Guardian AI to misclassify the characteristic neonatal sepsis spike pattern — a MEWSN rise from 1 to 5–6 over 30–60 minutes, accompanied by apnea events and temperature instability — as a noise artifact or feeding-related physiological variation, suppressing the rapid-escalation alert and delaying neonatal sepsis recognition. In a 26-week premature infant with late-onset sepsis caused by coagulase-negative Staphylococcus (the most common LOS pathogen in VLBW infants), a 4–6 hour delay in antibiotic initiation after the first signs of deterioration represents the difference between a culture-positive sepsis episode treated with 14 days of vancomycin and a septic shock event with multiorgan failure requiring vasopressor support and mechanical ventilation. The AAP/NICHD neonatal sepsis risk calculator and the early antibiotic escalation protocols at centers of excellence in neonatal medicine are premised on the early detection of the clinical deterioration pattern that Guardian AI is designed to identify; adversarial suppression converts the AI’s early detection capability into a missed-detection scenario with the mortality and morbidity consequences of delayed treatment.

4. GE HealthCare Giraffe OmniBed and Dräger CALEO incubator thermoregulation AI

The GE HealthCare Giraffe OmniBed Carestation (FDA 510(k) K033777 and successive generations) and the Dräger CALEO Incubator (CE mark, UK MHRA) provide servo-controlled thermoregulation for premature infants who cannot maintain their own body temperature — a fundamental physiological challenge in premature infants (<32 weeks GA) whose brown adipose tissue thermogenesis and skin barrier to transepidermal water loss are both underdeveloped. The Giraffe OmniBed’s servo-thermoregulation AI controls incubator air temperature by processing a continuous skin temperature sensor reading from a servo-mode temperature probe attached to the infant’s abdomen, rendering the skin temperature vs. incubator air temperature trend as a visualization image that feeds the PID (proportional-integral-derivative) controller AI. The servo thermoregulation AI adjusts incubator heater output to maintain the infant’s skin temperature at a set point (typically 36.5°C for extremely premature infants) by processing the rendered temperature trend image to detect deviations from set point and anticipate temperature trajectory. Adversarial perturbation in the temperature trend rendering image at the servo AI processing boundary — suppressing the displayed temperature deviation from set point — can cause the thermoregulation AI to under-respond to a falling skin temperature event, allowing hypothermia (<36.0°C skin temperature) to develop in an extremely premature infant. Hypothermia in premature infants (<32 weeks GA) is associated with increased oxygen consumption, increased caloric expenditure, hypoglycemia, and — at extreme hypothermia — increased risk of cold stress-induced apnea, bradycardia, and metabolic acidosis; the WHO/AAP guidelines for premature infant thermal protection target a skin temperature range of 36.0–36.5°C to prevent both hypothermia and hyperthermia consequences.

Integration: NICU AI image scanning with Glyphward pre-scan

The Glyphward scan gate for NICU AI belongs at the image ingestion boundary before each classification step — before TcB phototherapy AI processes the calibration chart or trend rendering, before Masimo FORE-SIGHT MC processes the cerebral rSO₂ trend image, before Philips Guardian neonatal MEWSN AI processes the deterioration score chart, and before GE Giraffe OmniBed servo thermoregulation AI processes the temperature trend rendering. The threshold of 40 for bilirubin and cerebral oximetry AI and 45 for deterioration prediction AI reflects the irreversibility of kernicterus and PVL compared to the partial mitigation from parallel clinical assessment in the neonatal sepsis context.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# NICU AI thresholds
# 40: bilirubin / cerebral NIRS AI — irreversible kernicterus / PVL consequences
# 45: neonatal deterioration prediction AI — partial parallel clinical assessment
# 45: thermoregulation AI — hypothermia consequences serious but reversible
BILIRUBIN_AI_THRESHOLD         = 40  # TcB meter AI / phototherapy guidance AI
CEREBRAL_NIRS_THRESHOLD        = 40  # Masimo FORE-SIGHT MC cerebral oximetry AI
NEONATAL_DETERIORATION_THRESHOLD = 45  # Philips Guardian / Epic NeoNatal AI
THERMOREGULATION_THRESHOLD     = 45  # GE Giraffe OmniBed / Draeger CALEO AI


class NICUAIContext(Enum):
    TCB_BILIRUBIN_METER     = "tcb_bilirubin_meter"      # threshold 40 — TcB calibration/trend
    CEREBRAL_NIRS_OXIMETRY  = "cerebral_nirs_oximetry"   # threshold 40 — rSO2 trend image
    NEONATAL_DETERIORATION  = "neonatal_deterioration"   # threshold 45 — MEWSN trend chart
    THERMOREGULATION_SERVO  = "thermoregulation_servo"   # threshold 45 — temp trend rendering


_CONTEXT_THRESHOLDS: dict[NICUAIContext, int] = {
    NICUAIContext.TCB_BILIRUBIN_METER:    BILIRUBIN_AI_THRESHOLD,
    NICUAIContext.CEREBRAL_NIRS_OXIMETRY: CEREBRAL_NIRS_THRESHOLD,
    NICUAIContext.NEONATAL_DETERIORATION: NEONATAL_DETERIORATION_THRESHOLD,
    NICUAIContext.THERMOREGULATION_SERVO: THERMOREGULATION_THRESHOLD,
}


class AdversarialNICUImageError(Exception):
    """Raised when Glyphward detects adversarial pixel content in a NICU AI
    image above the context-specific patient-safety threshold.

    False negative consequences by context:
    - TCB_BILIRUBIN_METER: delayed phototherapy → TSB above kernicterus threshold
    - CEREBRAL_NIRS_OXIMETRY: undetected cerebral desaturation → PVL in premature brain
    - NEONATAL_DETERIORATION: delayed sepsis recognition → septic shock in VLBW infant
    - THERMOREGULATION_SERVO: hypothermia → cold stress apnea, metabolic acidosis
    """

    def __init__(self, scan_id: str, score: int, context: NICUAIContext,
                 flagged_region: dict | None = None) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial NICU AI image: "
            f"context={context.value} score={score} scan_id={scan_id}"
        )


async def scan_nicu_ai_image(
    image_path: Path,
    context: NICUAIContext,
    patient_mrn_hash: str,
    gestational_age_weeks: int,
    monitoring_timestamp: str,
    client: httpx.AsyncClient,
) -> dict:
    """Scan a NICU AI input image for adversarial pixel content.

    Args:
        image_path: Path to the rendered TcB trend, rSO2 trend, MEWSN chart,
            or temperature trend image.
        context: NICUAIContext identifying the NICU AI platform.
        patient_mrn_hash: SHA-256 hash of patient MRN (avoid PHI in audit log).
        gestational_age_weeks: Patient gestational age in weeks (non-PHI
            clinical context for threshold documentation).
        monitoring_timestamp: ISO 8601 timestamp of the monitoring window.
        client: Shared httpx.AsyncClient.

    Returns:
        Glyphward scan result dict.

    Raises:
        AdversarialNICUImageError: if score exceeds context threshold.
        httpx.HTTPStatusError: on Glyphward API error (fail-closed).
    """
    threshold = _CONTEXT_THRESHOLDS[context]
    image_bytes = image_path.read_bytes()
    image_hash = hashlib.sha256(image_bytes).hexdigest()

    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"nicu:{context.value}:{patient_mrn_hash}",
        "metadata": {
            "patient_mrn_hash": patient_mrn_hash,
            "gestational_age_weeks": gestational_age_weeks,
            "monitoring_timestamp": monitoring_timestamp,
            "image_sha256": image_hash,
            "context": context.value,
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=6.0,
    )
    resp.raise_for_status()
    result = resp.json()

    await _write_nicu_scan_audit(
        image_hash=image_hash, scan_id=result["scan_id"], score=result["score"],
        context=context, threshold=threshold,
        patient_mrn_hash=patient_mrn_hash, gestational_age_weeks=gestational_age_weeks,
        monitoring_timestamp=monitoring_timestamp, flagged=result["score"] > threshold,
    )

    if result["score"] > threshold:
        raise AdversarialNICUImageError(
            scan_id=result["scan_id"], score=result["score"],
            context=context, flagged_region=result.get("flagged_region"),
        )
    return result


async def _write_nicu_scan_audit(
    *, image_hash: str, scan_id: str, score: int, context: NICUAIContext,
    threshold: int, patient_mrn_hash: str, gestational_age_weeks: int,
    monitoring_timestamp: str, flagged: bool,
) -> None:
    record = {
        "ts": datetime.now(timezone.utc).isoformat(),
        "scan_id": scan_id,
        "image_sha256": image_hash,
        "context": context.value,
        "score": score,
        "threshold": threshold,
        "flagged": flagged,
        "patient_mrn_hash": patient_mrn_hash,
        "gestational_age_weeks": gestational_age_weeks,
        "monitoring_timestamp": monitoring_timestamp,
        "regulatory_refs": [
            "FDA 510(k) K200010 (Masimo FORE-SIGHT MC)",
            "AAP 2022 CPG Hyperbilirubinemia Management",
            "21 CFR Part 820 (QSR)",
            "HIPAA Security Rule 45 CFR 164.312(b)",
            "TJC NPSG.16.01.01 (respond to changes in patient condition)",
            "FDA 2023 Cybersecurity Guidance SaMD",
        ],
    }
    audit_path = Path("/var/log/glyphward/nicu_ai_scan_audit.jsonl")
    audit_path.parent.mkdir(parents=True, exist_ok=True)
    with audit_path.open("a") as fh:
        fh.write(json.dumps(record) + "\n")

Deploy scan_nicu_ai_image at each NICU AI image ingestion boundary: before TcB bilirubin meter calibration chart and trend AI (threshold 40), before Masimo FORE-SIGHT MC rSO₂ trend AI (threshold 40), before Philips Guardian neonatal MEWSN trend AI (threshold 45), and before GE Giraffe OmniBed thermoregulation trend AI (threshold 45). Fail-closed on any Glyphward API error: block the AI classification, escalate to direct nursing assessment, and log the quarantine event with the AAP 2022 CPG and FDA SaMD references required for audit documentation. Get early access

Related questions

Further reading

• Prompt injection in ICU critical care deterioration AI — Epic Sepsis Model and Edwards EV1000 hemodynamic AI
• Prompt injection in wearable health AI — Apple Watch ECG and Dexcom CGM adversarial attacks
• Prompt injection in blood bank transfusion medicine AI — ABO crossmatch AI bypass and TA-GvHD prevention
• HIPAA-compliant AI security — §164.312 audit controls for medical AI pipelines
• Prompt injection scanning API free tier — 10 scans/day, no card required