Prompt injection in ophthalmology AI

Four adversarial injection surfaces in ophthalmology AI pipelines

1. Diabetic retinopathy screening AI bypass (IDx-DR, Topcon AI, Google DeepMind retinal AI)

IDx-DR’s clinical workflow begins with the practice acquiring two fundus photographs of each eye using a Topcon NW400 non-mydriatic fundus camera (the specific camera model validated in the FDA De Novo submission), exporting the JPEG images from the camera, and uploading them through the IDx-DR software interface to the cloud-based AI inference backend. The AI analyzes the fundus photograph pixel content against its training on diabetic retinopathy grades — from mild non-proliferative retinopathy (NPDR) through severe NPDR to proliferative diabetic retinopathy (PDR) — and returns either “More than mild diabetic retinopathy detected, refer to eye care professional” or “Negative for more than mild diabetic retinopathy, rescreen in 12 months.” The binary, action-oriented output format was specifically designed for the autonomous diagnostic use case where no clinician reviews the image before the result is communicated to the patient.

The adversarial attack against IDx-DR targets the fundus photograph JPEG at the upload boundary — the point at which the camera-exported image enters the IDx-DR software upload workflow. An adversary with access to the image processing pipeline between the camera export and the IDx-DR upload — at a compromised practice workstation, a tampered imaging middleware, or a man-in-the-middle attack on the image transmission API — can apply adversarial pixel perturbations to the fundus photograph that cause IDx-DR to output a negative screening result for an image that shows diabetic retinopathy above the “more than mild” threshold. The adversarial perturbation is imperceptible to a human viewer: the modified fundus photograph appears identical to the original retinal image, showing the same retinal vasculature, optic disc, and macula detail that a trained ophthalmologist would use for clinical assessment. The AI, operating on a pixel representation processed through its convolutional feature extractor, classifies the adversarially modified image differently from the original. IDx-DR’s De Novo authorization was granted on the basis of its validated sensitivity (87.2%) and specificity (90.7%) on clean validation datasets; the FDA’s static validation framework evaluated performance on unperturbed photographs and does not characterize performance on adversarially perturbed inputs. Topcon AI and Google DeepMind’s retinal AI share this validation gap — their published clinical validation studies evaluated performance on standard clinical fundus photograph datasets, not on datasets containing adversarially perturbed images.

The clinical consequence of adversarial diabetic retinopathy screening bypass is well-documented through the non-adversarial literature on screening gaps: patients with proliferative diabetic retinopathy who do not receive timely referral for vitreoretinal surgery (vitrectomy, panretinal photocoagulation) have high rates of progression to tractional retinal detachment and vitreous hemorrhage, both sight-threatening conditions. Ophthalmology malpractice claims for missed diabetic retinopathy — historically arising from human screening failures — now include documented cases where AI-assisted screening results influenced the decision not to refer, establishing the clinical liability chain from adversarial AI failure to patient harm. ADA Standards of Medical Care in Diabetes require annual dilated eye exams for all patients with type 1 diabetes (starting 5 years after diagnosis) and type 2 diabetes (starting at diagnosis), generating an annual screening demand of approximately 30 million examinations that AI autonomous screening is explicitly positioned to address in rural and underserved communities where ophthalmologist access is limited — the same communities where adversarial injection detection infrastructure is least likely to be independently implemented.

2. OCT-based glaucoma progression AI injection (Heidelberg SPECTRALIS AI, Zeiss Cirrus AI, Optovue AngioVue AI)

Optical coherence tomography (OCT) provides micron-resolution cross-sectional imaging of retinal tissue layers, and AI-assisted analysis of OCT B-scan images has become the standard of care for glaucoma progression monitoring in ophthalmology practices and academic medical centers. Heidelberg Engineering’s SPECTRALIS AI, running within the SPECTRALIS imaging and analysis system deployed in more than 10,000 ophthalmology practices worldwide, processes peripapillary RNFL thickness maps — circular OCT scans centered on the optic nerve head — and generates RNFL thickness sector values (global, temporal, superior, nasal, inferior, temporal-superior-inferior-nasal-temporal sectors) that the AI compares against the normative database to classify each sector as within normal limits, borderline, or outside normal limits. The AI progression analysis module compares serial RNFL measurements across examination dates to detect statistically significant RNFL thinning that indicates progressive glaucomatous damage — the key clinical decision that determines whether a glaucoma patient’s current intraocular pressure target is controlling disease or whether treatment escalation (additional medications, selective laser trabeculoplasty, or filtration surgery) is indicated. Zeiss CIRRUS HD-OCT AI and Optovue AngioVue AI perform equivalent RNFL progression analysis, with Zeiss’s Guided Progression Analysis (GPA) providing a widely-used progression detection framework that ophthalmologists in academic centers and private practice rely on for treatment escalation decisions.

The adversarial attack against OCT glaucoma progression AI targets the OCT B-scan image export from the imaging device at the DICOM or proprietary format export boundary. Adversarial perturbations applied to the OCT B-scan image content — operating on the high-contrast OCT speckle pattern and layer boundary reflectance characteristics specific to retinal OCT imaging — can cause the SPECTRALIS AI or Zeiss Cirrus AI to over-report RNFL thickness (masking progressive thinning) or to classify RNFL sector values as within normal limits when the underlying OCT shows pathological thinning consistent with moderate or advanced glaucoma. The clinical consequence of adversarial OCT progression suppression is failure to escalate glaucoma treatment in a patient with progressive optic nerve damage — allowing intraocular pressure to continue damaging retinal ganglion cells at a rate that will progress the patient from moderate to advanced glaucoma and ultimately to severe visual field loss. Unlike diabetic retinopathy where surgical intervention can restore function, glaucomatous retinal ganglion cell loss is irreversible: neurons lost cannot be replaced, making early progression detection the sole clinical lever for preventing blindness. Glaucoma malpractice claims based on inadequate monitoring and failure to escalate treatment have resulted in multi-million dollar verdicts in multiple US jurisdictions; the integration of AI progression analysis into the monitoring decision chain creates a product liability dimension alongside the clinical negligence analysis when adversarial injection is demonstrated.

3. Age-related macular degeneration AI monitoring injection (Notal Vision Home OCT AI, Optos AI, Optovue AMD AI)

Age-related macular degeneration is the leading cause of severe vision loss in Americans over 50, affecting approximately 11 million people in the United States. The transition from dry AMD (geographic atrophy, drusen accumulation) to wet AMD (choroidal neovascularization, CNV) triggers sight-threatening subretinal fluid accumulation that can be arrested by anti-VEGF injections (Eylea, Lucentis, Beovu, Vabysmo) if detected and treated within weeks of onset — creating an AI monitoring use case with high stakes for timely detection. Notal Vision’s Home OCT device, an FDA-authorized home OCT imaging system that patients use daily to self-scan their macular OCT, transmits OCT B-scan images to Notal Vision’s cloud-based AI analysis platform that detects subretinal fluid onset and alerts the treating retinal specialist. Optos ultra-widefield AI detects peripheral CNV and AMD lesions not visible in standard fundus field imaging. Optovue’s AngioVue OCT-A AI analyzes OCT angiography images — flow-sensitive OCT scans that visualize retinal vasculature without fluorescein dye injection — to detect CNV lesion growth and treatment response at follow-up visits.

The adversarial attack against AMD monitoring AI targets the OCT B-scan image at the home imaging device upload boundary (Notal Vision) or at the clinical imaging export boundary (Optos, Optovue). Adversarial perturbations can cause the home OCT AI to suppress subretinal fluid detection signals in B-scans showing active wet AMD conversion — preventing the automated alert that would trigger urgent retinal specialist referral — or to generate false positive fluid signals in dry AMD B-scans, generating unnecessary urgent referrals that overwhelm retinal specialist clinic capacity and erode patient trust in the monitoring system. The financial stakes of AMD AI monitoring extend beyond malpractice liability: anti-VEGF injections cost $2,000–$8,000 per injection, and the treatment burden for active CNV (monthly or bimonthly injections for 1–3 years) creates a financial incentive landscape where adversarial manipulation of AMD activity status could serve insurance fraud purposes (suppressing AMD activity to avoid coverage obligations for anti-VEGF therapy) or fraudulent billing purposes (generating false AMD activity findings to support injection claims). Medicare Part B reimbursement for Eylea and Lucentis injections exceeds $1 billion annually; the anti-VEGF injection fraud risk is an established OIG enforcement priority.

4. Teleophthalmology and remote screening AI bypass (EyePACS, 1DocWay, Retinal AI in telehealth platforms)

Teleophthalmology screening programs have expanded dramatically since 2020, driven by rural healthcare access gaps, COVID-19 disruption of in-person ophthalmology visits, and the success of AI-assisted autonomous screening demonstrated by IDx-DR’s clinical deployment. EyePACS, the teleophthalmology platform used in the California Safety Net and Federally Qualified Health Center networks for diabetic retinopathy screening, operates a store-and-forward model in which fundus photographs captured at primary care clinics are transmitted to a reading center where remote ophthalmologists review AI-assisted annotations before issuing screening results. 1DocWay, Truscreen, and multiple state Medicaid teleophthalmology programs operate similar architectures where AI pre-processing assists human graders or, in fully autonomous implementations, replaces human graders with AI decision outputs. Retinal AI modules embedded in telemedicine platforms (Teladoc Health, MDLive, and platform-specific integrations) have extended AI-assisted retinal screening to consumer telehealth contexts where patients use smartphone fundus camera attachments — Peek Vision Retinal Imager, iExaminer by Welch Allyn — to acquire self-captured retinal images submitted for AI analysis.

The adversarial attack against teleophthalmology screening AI targets the fundus image at the most accessible attack boundary in the entire ophthalmic AI chain: the network transmission from the primary care site or patient device to the cloud-based AI analysis endpoint. Teleophthalmology images travel over standard HTTPS transport from clinic workstations, EHR integration APIs, and consumer smartphone apps; the network transmission path lacks the physical access controls that protect images acquired and processed within a hospital imaging department. A man-in-the-middle attack on the image upload API — feasible at poorly secured clinic network boundaries or through malicious software on the imaging workstation — can adversarially perturb fundus photograph images in transit before they reach the AI analysis backend. The consequence of adversarial bypass in community-based teleophthalmology screening is population-level: EyePACS serves hundreds of thousands of diabetes patients annually in high-risk communities; a systematic adversarial bypass affecting the fundus image transmission pipeline could suppress retinopathy detection across an entire primary care network. CMS reimbursement for teleophthalmology diabetic retinopathy screening (CPT 92227, 92228) has been formally established since 2021, creating an insurance billing infrastructure around teleophthalmology AI that makes adversarial result manipulation financially actionable under FCA anti-fraud provisions.

Integration: ophthalmology AI image ingestion with Glyphward pre-scan

The Glyphward scan gate belongs at the image ingestion point in each ophthalmic AI pipeline — before the fundus photograph, OCT B-scan, ultra-widefield image, or anterior segment photograph is passed to the AI analysis engine. The async pattern below handles all four ophthalmic AI contexts through a shared scan_ophthalmic_ai_image function with context-specific thresholds and structured audit output suitable for HIPAA §164.312 and FDA SaMD Cybersecurity Guidance evidence generation.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Per-context thresholds reflecting ophthalmic AI patient-safety severity
DR_SCREENING_THRESHOLD      = 50  # IDx-DR / Topcon AI / Google DeepMind retinal AI
OCT_GLAUCOMA_THRESHOLD      = 50  # Heidelberg SPECTRALIS AI / Zeiss CIRRUS AI
AMD_MONITORING_THRESHOLD    = 55  # Notal Vision Home OCT AI / Optos AI
TELEOPHTHALMOLOGY_THRESHOLD = 55  # EyePACS / 1DocWay / telehealth retinal AI


class OphthalmicAIContext(Enum):
    DR_SCREENING      = "dr_screening"      # threshold 50
    OCT_GLAUCOMA      = "oct_glaucoma"      # threshold 50
    AMD_MONITORING    = "amd_monitoring"    # threshold 55
    TELEOPHTHALMOLOGY = "teleophthalmology" # threshold 55


_CONTEXT_THRESHOLDS: dict[OphthalmicAIContext, int] = {
    OphthalmicAIContext.DR_SCREENING:      DR_SCREENING_THRESHOLD,
    OphthalmicAIContext.OCT_GLAUCOMA:      OCT_GLAUCOMA_THRESHOLD,
    OphthalmicAIContext.AMD_MONITORING:    AMD_MONITORING_THRESHOLD,
    OphthalmicAIContext.TELEOPHTHALMOLOGY: TELEOPHTHALMOLOGY_THRESHOLD,
}


class AdversarialOphthalmicAIImageError(Exception):
    """Raised when Glyphward detects adversarial pixel content in an
    ophthalmic AI input image above the context-specific threshold.

    Attributes:
        scan_id: Glyphward scan identifier for the audit record.
        score: Adversarial signal score (0-100).
        context: The OphthalmicAIContext in which detection occurred.
        flagged_region: Optional dict describing the pixel region with the signal.
    """

    def __init__(
        self,
        scan_id: str,
        score: int,
        context: OphthalmicAIContext,
        flagged_region: dict | None = None,
    ) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial ophthalmic AI image detected: "
            f"context={context.value} score={score} scan_id={scan_id}"
        )


async def scan_ophthalmic_ai_image(
    image_path: Path,
    context: OphthalmicAIContext,
    patient_id_hash: str,
    study_uid: str,
    facility_npi: str,
    client: httpx.AsyncClient,
) -> dict:
    """Scan an ophthalmic AI input image for adversarial pixel content.

    Args:
        image_path: Absolute path to the fundus/OCT/anterior-segment image.
        context: OphthalmicAIContext enum value identifying the AI pipeline.
        patient_id_hash: SHA-256 hash of patient MRN (not the MRN itself — HIPAA).
        study_uid: DICOM Study Instance UID or imaging study identifier.
        facility_npi: Facility or provider NPI for audit correlation.
        client: Shared httpx.AsyncClient for connection reuse.

    Returns:
        Glyphward scan result dict: scan_id, score, flagged_region, modality.

    Raises:
        AdversarialOphthalmicAIImageError: if score exceeds context threshold.
        httpx.HTTPStatusError: on Glyphward API errors (fail-closed: re-raise).
    """
    threshold = _CONTEXT_THRESHOLDS[context]
    image_bytes = image_path.read_bytes()
    image_hash = hashlib.sha256(image_bytes).hexdigest()

    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"ophthalmic:{context.value}:{study_uid}",
        "metadata": {
            "patient_id_hash": patient_id_hash,
            "study_uid": study_uid,
            "facility_npi": facility_npi,
            "image_sha256": image_hash,
        },
    }

    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=5.0,
    )
    resp.raise_for_status()
    result = resp.json()

    await write_ophthalmic_scan_audit(
        image_hash=image_hash,
        scan_id=result["scan_id"],
        score=result["score"],
        context=context,
        threshold=threshold,
        patient_id_hash=patient_id_hash,
        study_uid=study_uid,
        facility_npi=facility_npi,
        flagged=result["score"] > threshold,
    )

    if result["score"] > threshold:
        raise AdversarialOphthalmicAIImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            flagged_region=result.get("flagged_region"),
        )

    return result


async def write_ophthalmic_scan_audit(
    *,
    image_hash: str,
    scan_id: str,
    score: int,
    context: OphthalmicAIContext,
    threshold: int,
    patient_id_hash: str,
    study_uid: str,
    facility_npi: str,
    flagged: bool,
) -> None:
    """Append structured JSON audit record to ophthalmic AI scan log.

    Satisfies HIPAA §164.312(b) audit controls and FDA SaMD Cybersecurity
    Guidance adversarial input detection evidence requirements.
    patient_id_hash stores SHA-256 of MRN — not PHI itself.
    """
    record = {
        "ts": datetime.now(timezone.utc).isoformat(),
        "scan_id": scan_id,
        "image_sha256": image_hash,
        "context": context.value,
        "score": score,
        "threshold": threshold,
        "flagged": flagged,
        "patient_id_hash": patient_id_hash,
        "study_uid": study_uid,
        "facility_npi": facility_npi,
    }
    audit_path = Path("/var/log/glyphward/ophthalmic_ai_scan_audit.jsonl")
    audit_path.parent.mkdir(parents=True, exist_ok=True)
    with audit_path.open("a") as fh:
        fh.write(json.dumps(record) + "\n")


async def process_ophthalmic_image_batch(
    images: list[tuple[Path, OphthalmicAIContext, str, str, str]],
) -> list[dict]:
    """Process a batch of (path, context, patient_hash, study_uid, facility_npi) tuples."""
    async with httpx.AsyncClient() as client:
        tasks = [
            scan_ophthalmic_ai_image(
                image_path=path,
                context=ctx,
                patient_id_hash=pid,
                study_uid=uid,
                facility_npi=npi,
                client=client,
            )
            for path, ctx, pid, uid, npi in images
        ]
        results = []
        for coro in asyncio.as_completed(tasks):
            try:
                results.append(await coro)
            except AdversarialOphthalmicAIImageError as exc:
                results.append({
                    "status": "quarantined",
                    "context": exc.context.value,
                    "scan_id": exc.scan_id,
                    "score": exc.score,
                    "flagged_region": exc.flagged_region,
                })
        return results

Deploy scan_ophthalmic_ai_image at the image ingestion boundary of each ophthalmic AI pipeline: before the fundus photograph reaches IDx-DR, Topcon AI, or Google DeepMind retinal AI; before the OCT B-scan reaches Heidelberg SPECTRALIS AI or Zeiss CIRRUS GPA; before the home OCT image reaches Notal Vision cloud AI; and before the teleophthalmology fundus photograph enters EyePACS or any telehealth retinal AI API. The patient_id_hash pattern (SHA-256 of MRN) preserves the clinical audit chain without storing ePHI. Get early access

Coverage matrix

Related questions

Further reading

• Prompt injection in healthcare radiology AI — DICOM triage injection, PACS metadata injection
• Multimodal prompt injection in healthcare imaging AI — FDA SaMD cybersecurity guidance and EU MDR GSPR 17.4
• HIPAA-compliant AI security — §164.312 audit controls for multimodal clinical AI pipelines
• EU AI Act Article 15 — adversarial robustness requirements for high-risk medical AI systems
• Prompt injection scanning API free tier — 10 scans/day, no card required