Prompt injection in nuclear medicine imaging AI

Four adversarial injection surfaces in nuclear medicine imaging AI

1. PET/CT SUV quantification AI for oncology staging (Siemens Biograph Vision, GE Discovery MI, Philips Vereos, United Imaging uMI 550)

FDG-PET/CT is the standard of care for initial staging and treatment response assessment across the most common FDG-avid malignancies — non-Hodgkin lymphoma, lung adenocarcinoma and squamous cell carcinoma, colorectal cancer with hepatic metastases, melanoma, and head-and-neck squamous cell carcinoma — with annual U.S. scan volume exceeding 2 million studies. The quantitative output of FDG-PET/CT AI analysis is the standardized uptake value (SUV): a decay-corrected, body-weight-normalized measure of regional FDG concentration in reconstructed PET images expressed in units of g/mL. SUVmax (the maximum voxel SUV within a defined volume of interest) is the primary AI-generated measurement used for oncology staging decisions: Lugano Classification for lymphoma response uses SUV thresholds relative to mediastinal blood pool and liver reference; PERCIST 1.0 treatment response criteria use a 30% decrease in SULpeak (SUV lean body mass corrected) to define partial metabolic response; and clinical SUV thresholds in the range of 2.5–4.0 are used to differentiate benign from malignant pulmonary nodules in SUV-assisted lung nodule AI analysis. AI software platforms integrated with or connected to PET/CT scanners — Siemens Syngo.via MI Oncology, GE AW Server Oncology, Philips IntelliSpace Portal PET Analysis, MIM Software PETCT Fusion — automatically extract SUVmax and SUVmean from segmented lesions in reconstructed PET DICOM images received from the PET/CT scanner reconstruction pipeline.

The adversarial injection surface for PET SUV AI is the reconstructed PET DICOM image at the point of transmission from the PET/CT scanner reconstruction workstation to the AI analysis platform over the hospital DICOM network or PACS integration pathway. Adversarial pixel perturbations applied to reconstructed PET DICOM image pixel data — perturbations that are visually subtle and within the range of normal reconstruction noise — can artifactually elevate SUVmax in a primary tumor lesion or regional lymph node volume of interest from a value below the malignancy threshold to a value above it, or suppress SUVmax in a known malignant lesion below the threshold used by AI to declare metabolic complete response. The clinical consequence of artifactual SUV elevation in lymph node staging is AJCC N-stage upstaging: a lung cancer patient whose mediastinal lymph node SUVmax is artifactually elevated from 2.1 to 4.9 would be misclassified from cN0 (node-negative, resectable stage I/II) to cN2 (ipsilateral mediastinal involvement, stage IIIA), redirecting treatment from surgical resection with curative intent to definitive concurrent chemoradiotherapy — a treatment change associated with substantially lower 5-year survival. The inverse attack — SUVmax suppression at a known malignant lymph node — generates a false metabolic complete response in a patient with residual active lymphoma after frontline chemotherapy, falsely indicating response and potentially delaying consolidation radiotherapy or salvage treatment until clinical relapse.

2. Myocardial perfusion imaging SPECT AI (Cedars-Sinai QPS/QGS, Emory Cardiac Toolbox, EXINI HeartSee AI, GE Myovation AI)

Myocardial perfusion imaging (MPI) SPECT is the highest-volume nuclear cardiology procedure in the United States, with approximately 9 million studies performed annually for evaluation of coronary artery disease (CAD), stress-induced ischemia, myocardial viability, and risk stratification. Cedars-Sinai Quantitative Perfusion SPECT / Quantitative Gated SPECT (QPS/QGS), developed at Cedars-Sinai Medical Center and licensed to vendors including Siemens Healthineers and GE Healthcare, is deployed in more than 80% of U.S. nuclear cardiology laboratories and is the reference AI platform against which other MPI SPECT AI systems are validated. QPS/QGS processes gated SPECT stress and rest image datasets — three-dimensional reconstructed SPECT volumes of the myocardium acquired with Tc-99m sestamibi or tetrofosmin (MIBI, CardioTec) after pharmacologic or exercise stress and at rest — to automatically segment the left ventricular myocardium, generate polar map perfusion displays (bull’s-eye plots), quantify perfusion defect extent as a percentage of total myocardial surface, calculate total perfusion deficit (TPD), and compute left ventricular ejection fraction and wall motion scores from gated SPECT frames. The structured QPS/QGS report output — perfusion defect extent, severity, reversibility (stress-rest difference), ejection fraction — is the primary quantitative data reviewed by cardiologists in determining whether to refer patients for invasive coronary angiography and revascularization. ACC/AHA and ASNC guidelines recommend coronary angiography referral for SPECT MPI findings of large perfusion defects (>10% myocardium), high-risk findings including transient ischemic dilation (TID), or reduced LVEF (<45%) on post-stress gated SPECT.

The adversarial injection surface for SPECT MPI AI is the reconstructed SPECT DICOM image dataset at transmission from the gamma camera reconstruction workstation (Siemens Symbia Intevo, GE Optima NM/CT 640, Philips BrightView XCT, Canon Medical Systems Celesteion) to the QPS/QGS or equivalent AI workstation. Gated SPECT datasets consist of multiple three-dimensional SPECT volumes — typically 8 or 16 gated frames per cardiac cycle — across stress and rest acquisition conditions, yielding a multi-volume DICOM series that the AI processes jointly for perfusion quantification and functional analysis. Adversarial pixel perturbations applied to the SPECT perfusion volume can suppress signal in an ischemic territory — the inferolateral wall, the anterior wall, or the apex — causing QPS/QGS AI to report normal perfusion in a region with significant Tc-99m sestamibi uptake reduction reflecting stress-induced ischemia from significant left circumflex, left anterior descending, or right coronary artery stenosis. The clinical consequence is failure to refer a patient with hemodynamically significant CAD for coronary angiography that would have revealed a stenosis amenable to percutaneous coronary intervention — leaving the patient at elevated risk of subsequent myocardial infarction and sudden cardiac death. The inverse attack — generating a false-positive perfusion defect in a normal SPECT study — directs an asymptomatic patient with normal coronary arteries to invasive coronary angiography, carrying a procedural complication risk (arterial access complications, contrast nephropathy, arrhythmia) of approximately 1 in 500 to 1 in 1,000 for diagnostic-only angiography.

3. Lu-177 / Y-90 radiopharmaceutical therapy dosimetry AI (MIM SurePlan, HERMES Dosimetry, Planet Dose AI, Quanteus Q.Dose AI)

Lutetium-177 radiopharmaceutical therapy — Lu-177-DOTATATE (LUTATHERA, Advanced Accelerator Applications/Novartis, FDA approved NDA 210922 in January 2018 for somatostatin receptor-positive gastroenteropancreatic neuroendocrine tumors) and Lu-177-PSMA-617 (PLUVICTO, Novartis, FDA approved NDA 215435 in March 2022 for metastatic castration-resistant prostate cancer) — delivers targeted beta-particle radiation to tumor cells expressing somatostatin receptors or prostate-specific membrane antigen (PSMA), with dose-limiting toxicity at critical organs including kidneys (23 Gy total absorbed dose limit) and bone marrow (2 Gy limit for red marrow). Personalized dosimetry — calculating the actual absorbed dose delivered to each patient’s organs and tumors from their individual pharmacokinetics as measured by quantitative SPECT/CT imaging — is performed using AI software platforms including MIM SurePlan (MIM Software, FDA 510(k) K180468), HERMES Dosimetry (HERMES Medical Solutions Gold Standard dosimetry platform), Planet Dose AI (Advanced Accelerator Applications/Sanofi), and Quanteus Global Q.Dose AI. These platforms acquire quantitative SPECT/CT images at 24, 48, and 168 hours post-injection for each therapy cycle, apply SUV-analogous quantitative SPECT reconstruction algorithms to convert image pixel values to absolute activity concentration (MBq/mL), fit multi-time-point activity-concentration curves to dosimetric models (OLINDA/EXM, MIRD S-values, voxel-level dosimetry), and generate cycle dose and cumulative dose reports for kidneys, liver, spleen, bone marrow, and target lesions that the treating nuclear medicine physician uses to determine the administered activity for the next treatment cycle under NRC 10 CFR Part 35.396.

The adversarial injection surface for dosimetry AI is the quantitative SPECT/CT DICOM image at each post-therapy imaging time point — the 24-hour, 48-hour, and 168-hour post-injection SPECT/CT acquisitions whose absolute pixel values represent radiotracer concentration in each voxel. Adversarial pixel perturbations that systematically suppress pixel intensity values in the renal cortex volumes of interest across one or more post-therapy time points cause the dosimetry AI to underestimate the area under the time-activity curve for the kidneys, generating a falsely low kidney absorbed dose calculation. A 25% underestimate in kidney dose across three Lu-177-DOTATATE cycles could result in cumulative kidney absorbed dose of 28–30 Gy against a target limit of 23 Gy — exceeding the tolerance threshold by a clinically meaningful margin that initiates radiation nephropathy, with progressive loss of GFR (glomerular filtration rate), proteinuria, and hypertension developing over 6–12 months post-therapy. The inverse attack — overestimating kidney dose — generates false dose-limiting nephrotoxicity findings that cause premature treatment termination after 2–3 cycles in a patient who would benefit from the full 4-cycle LUTATHERA regimen, reducing therapeutic efficacy in a population with limited treatment alternatives. Y-90 SIRT (selective internal radiotherapy) dosimetry — using HERMES Dosimetry and MIM SurePlan for Y-90 microsphere hepatic radioembolization — faces an equivalent adversarial surface in the quantitative SPECT Bremsstrahlung or PET (Y-90 PET, very low positron fraction) images used for post-procedure dosimetry, where adversarial manipulation of liver segment dose estimates affects reporting of dose coverage to hepatocellular carcinoma or hepatic metastases under IAEA Human Health Series No. 9 criteria.

4. Bone scan AI for cancer staging (EXINI BoneScan AI, EXINI Prostate AI, PyL PSMA PET AI, Progenics PSMA AI)

Tc-99m methylene diphosphonate (MDP) whole-body bone scan remains the workhorse imaging modality for detection of osseous metastases in prostate cancer, breast cancer, and lung cancer — more than 3 million whole-body bone scans are performed annually in the United States — and EXINI BoneScan AI (EXINI Diagnostics, acquired by Lantheus Holdings in 2021 for $70.8 million, deployed at more than 500 nuclear medicine sites globally) applies deep learning classification to whole-body planar bone scan images to automatically detect and count bone metastasis lesions, classify scan findings as normal, non-specific, or metastatic, and generate a Bone Scan Index (BSI) — a quantitative measure of the fraction of the skeleton involved by metastatic disease — that has been validated as a prognostic biomarker and treatment response endpoint in castration-resistant prostate cancer (CRPC) clinical trials. EXINI Prostate AI integrates bone scan AI with PSA kinetics and clinical data to generate an overall prostate cancer staging AI assessment. Alongside bone scintigraphy, PSMA PET/CT — using piflufolastat F-18 (PYLARIFY, Lantheus Holdings, FDA PMA P210013 approved May 2021) or 68Ga-PSMA-11 (FDA NDA 213074) — is increasingly used for initial staging of high-risk prostate cancer and for CRPC restaging, with AI analysis platforms quantifying PSMA-avid lesion burden across the skeleton and soft tissue.

The adversarial injection surface for bone scan AI is the whole-body planar scintigraphic image — an anterior and posterior whole-body projection image acquired on a dual-headed gamma camera (Siemens Symbia, GE Optima, Philips BrightView) — at the DICOM transmission boundary from the gamma camera workstation to the EXINI BoneScan AI or equivalent AI workstation over the hospital DICOM or HL7 FHIR network. Adversarial pixel perturbations applied to the whole-body bone scan image can suppress the focal increased tracer uptake in one or more vertebral or pelvic lesions, causing the AI to report a lower BSI than is present, reduce the lesion count (misclassifying metastatic disease as fewer lesions), or classify a metastatic scan as non-specific or normal. In the CRPC treatment response context — where serial bone scan AI BSI comparisons between baseline and on-treatment scans determine whether a patient is classified as having bone scan progressive disease (2 or more new lesions on sequential scans, PCWG3 Prostate Cancer Working Group 3 criteria) — adversarial suppression of new lesions from the AI-analyzed treatment scan generates a false stable disease classification, continuing a patient on a treatment that is failing to control bone metastatic disease. The inverse attack — generating artifactual focal uptake in normal bone — produces false positive lesion counts that trigger unnecessary bone biopsy, escalation to chemotherapy from hormonal therapy, or declaration of progressive disease that removes a patient from a clinical trial demonstrating benefit in their disease subgroup.

Integration: nuclear medicine AI image ingestion with Glyphward pre-scan

The Glyphward scan gate belongs at the DICOM image ingestion boundary in each nuclear medicine AI pipeline — between the scanner reconstruction workstation (or PACS retrieval) and the AI quantification engine. The async pattern below handles all four nuclear medicine AI contexts through a shared scan_nuclear_medicine_ai_image function, with patient-safety-calibrated thresholds reflecting the clinical severity of each AI quantification failure mode, and structured JSONL audit output for SNMMI/ACR nuclear medicine quality records and NRC 10 CFR Part 35 written directive documentation chains.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Per-context thresholds reflecting nuclear medicine AI patient-safety severity
PET_SUV_ONCOLOGY_THRESHOLD       = 45  # Siemens Syngo / GE AW / Philips ISP PET SUV AI
SPECT_MPI_CARDIAC_THRESHOLD      = 45  # Cedars-Sinai QPS/QGS / Emory CTB / EXINI HeartSee
DOSIMETRY_KIDNEY_THRESHOLD       = 45  # MIM SurePlan / HERMES Dosimetry / Planet Dose AI
BONE_SCAN_STAGING_THRESHOLD      = 50  # EXINI BoneScan AI / EXINI Prostate AI / PSMA PET AI


class NuclearMedicineAIContext(Enum):
    PET_SUV_ONCOLOGY  = "pet_suv_oncology"   # threshold 45
    SPECT_MPI_CARDIAC = "spect_mpi_cardiac"  # threshold 45
    DOSIMETRY_KIDNEY  = "dosimetry_kidney"   # threshold 45
    BONE_SCAN_STAGING = "bone_scan_staging"  # threshold 50


_CONTEXT_THRESHOLDS: dict[NuclearMedicineAIContext, int] = {
    NuclearMedicineAIContext.PET_SUV_ONCOLOGY:  PET_SUV_ONCOLOGY_THRESHOLD,
    NuclearMedicineAIContext.SPECT_MPI_CARDIAC: SPECT_MPI_CARDIAC_THRESHOLD,
    NuclearMedicineAIContext.DOSIMETRY_KIDNEY:  DOSIMETRY_KIDNEY_THRESHOLD,
    NuclearMedicineAIContext.BONE_SCAN_STAGING: BONE_SCAN_STAGING_THRESHOLD,
}


class AdversarialNuclearMedicineAIImageError(Exception):
    """Raised when Glyphward detects adversarial pixel content in a
    nuclear medicine AI image above the context threshold.

    Attributes:
        scan_id: Glyphward scan identifier for the SNMMI/ACR audit record.
        score: Adversarial signal score (0-100).
        context: The NuclearMedicineAIContext in which detection occurred.
        flagged_region: Optional dict describing the flagged pixel region.
    """

    def __init__(
        self,
        scan_id: str,
        score: int,
        context: NuclearMedicineAIContext,
        flagged_region: dict | None = None,
    ) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial nuclear medicine AI image detected: "
            f"context={context.value} score={score} scan_id={scan_id}"
        )


async def scan_nuclear_medicine_ai_image(
    image_path: Path,
    context: NuclearMedicineAIContext,
    patient_id_hash: str,
    accession_hash: str,
    acquisition_ts: str,
    client: httpx.AsyncClient,
) -> dict:
    """Scan a nuclear medicine AI image for adversarial pixel content.

    Args:
        image_path: Absolute path to the reconstructed DICOM image file
                    (PET volume, SPECT volume, SPECT/CT dosimetry, bone scan).
        context: NuclearMedicineAIContext enum value identifying the AI pipeline.
        patient_id_hash: SHA-256 hash of MRN (not the MRN itself — HIPAA §164.312).
        accession_hash: SHA-256 hash of DICOM accession number.
        acquisition_ts: ISO 8601 timestamp of image acquisition.
        client: Shared httpx.AsyncClient for connection reuse.

    Returns:
        Glyphward scan result dict: scan_id, score, flagged_region, modality.

    Raises:
        AdversarialNuclearMedicineAIImageError: if score exceeds context threshold.
        httpx.HTTPStatusError: on Glyphward API errors (fail-closed: quarantine image).
    """
    threshold = _CONTEXT_THRESHOLDS[context]
    image_bytes = image_path.read_bytes()
    image_hash = hashlib.sha256(image_bytes).hexdigest()

    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"nuclear_medicine:{context.value}:{acquisition_ts}",
        "metadata": {
            "patient_id_hash": patient_id_hash,
            "accession_hash": accession_hash,
            "acquisition_ts": acquisition_ts,
            "image_sha256": image_hash,
        },
    }

    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=5.0,
    )
    resp.raise_for_status()
    result = resp.json()

    await write_nuclear_medicine_scan_audit(
        image_hash=image_hash,
        scan_id=result["scan_id"],
        score=result["score"],
        context=context,
        threshold=threshold,
        patient_id_hash=patient_id_hash,
        accession_hash=accession_hash,
        acquisition_ts=acquisition_ts,
        flagged=result["score"] > threshold,
    )

    if result["score"] > threshold:
        raise AdversarialNuclearMedicineAIImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            flagged_region=result.get("flagged_region"),
        )

    return result


async def write_nuclear_medicine_scan_audit(
    *,
    image_hash: str,
    scan_id: str,
    score: int,
    context: NuclearMedicineAIContext,
    threshold: int,
    patient_id_hash: str,
    accession_hash: str,
    acquisition_ts: str,
    flagged: bool,
) -> None:
    """Append structured JSON audit record to nuclear medicine AI scan log.

    Satisfies HIPAA §164.312(b) audit controls, FDA SaMD Cybersecurity Guidance
    adversarial input detection evidence requirements, SNMMI/ACR nuclear medicine
    quality assurance records, and NRC 10 CFR Part 35 written directive
    documentation chains for therapeutic radiopharmaceutical administrations.
    Hashed IDs avoid PHI in the scan log itself.
    """
    record = {
        "ts": datetime.now(timezone.utc).isoformat(),
        "scan_id": scan_id,
        "image_sha256": image_hash,
        "context": context.value,
        "score": score,
        "threshold": threshold,
        "flagged": flagged,
        "patient_id_hash": patient_id_hash,
        "accession_hash": accession_hash,
        "acquisition_ts": acquisition_ts,
    }
    audit_path = Path("/var/log/glyphward/nuclear_medicine_ai_scan_audit.jsonl")
    audit_path.parent.mkdir(parents=True, exist_ok=True)
    with audit_path.open("a") as fh:
        fh.write(json.dumps(record) + "\n")


async def process_nuclear_medicine_image_batch(
    images: list[tuple[Path, NuclearMedicineAIContext, str, str, str]],
) -> list[dict]:
    """Process a batch of (path, context, patient_hash, accession_hash, ts) tuples."""
    async with httpx.AsyncClient() as client:
        tasks = [
            scan_nuclear_medicine_ai_image(
                image_path=path,
                context=ctx,
                patient_id_hash=pid,
                accession_hash=acc,
                acquisition_ts=ts,
                client=client,
            )
            for path, ctx, pid, acc, ts in images
        ]
        results = []
        for coro in asyncio.as_completed(tasks):
            try:
                results.append(await coro)
            except AdversarialNuclearMedicineAIImageError as exc:
                results.append({
                    "status": "quarantined",
                    "context": exc.context.value,
                    "scan_id": exc.scan_id,
                    "score": exc.score,
                    "flagged_region": exc.flagged_region,
                })
        return results

Deploy scan_nuclear_medicine_ai_image at the DICOM image ingestion boundary in each pipeline: before reconstructed PET volumes reach Siemens Syngo.via, GE AW Server, or MIM Software SUV quantification AI; before gated SPECT perfusion datasets reach Cedars-Sinai QPS/QGS, Emory Cardiac Toolbox, or GE Myovation AI; before post-therapy quantitative SPECT/CT dosimetry images reach MIM SurePlan or HERMES Dosimetry absorbed-dose AI; and before whole-body bone scan images reach EXINI BoneScan AI or PSMA PET analysis platforms. Get early access

Coverage matrix

Related questions

Further reading

• Prompt injection in healthcare radiology AI — CT, MRI, and X-ray AI pipeline adversarial surfaces
• Prompt injection in digital pathology and clinical laboratory AI — WSI and lab analyzer AI pipelines
• Prompt injection in clinical trials and pharmaceutical AI — endpoint adjudication and imaging core lab AI
• HIPAA-compliant AI security — §164.312 audit controls for nuclear medicine DICOM pipelines
• Prompt injection scanning API free tier — 10 scans/day, no card required