Prompt injection in pharmaceutical drug discovery AI

Four adversarial injection surfaces in pharmaceutical drug discovery AI

1. Cell viability and fluorescence microscopy image AI injection (Recursion Pharmaceuticals AI, BenevolentAI)

Cell viability and fluorescence microscopy image AI processes high-content imaging assay photographs, cell painting fluorescence microscopy images, automated cellular morphology visualisations, and phenotypic biomarker quantification displays submitted through AI-assisted phenomics platforms and phenotypic drug discovery tools that extract cytotoxicity classification results, cell morphology anomaly flags, phenotypic biomarker change quantifications, and hit compound activity determinations from high-content microscopy image inputs, generating hit compound advancement decisions, compound class elimination flags, and primary screening result records that govern which compound libraries advance from high-throughput phenotypic screening into secondary assay validation and lead optimisation campaigns. Recursion Pharmaceuticals AI operates its phenomics platform at a scale exceeding 5 petabytes of biological imaging data, with AI systems trained to classify cellular morphology changes in response to compound treatment across hundreds of morphological feature dimensions extracted from multi-channel fluorescence microscopy images — the LOWE platform processes cell painting assay images in which cells stained with fluorescent dyes across five or more channels reveal compound-induced phenotypic perturbations that the AI classifies into mechanism-of-action clusters, cytotoxicity buckets, and phenotypic biomarker change scores, with AI-generated phenotypic profiles directly determining which of thousands of compounds screened per week advance into the downstream drug programme pipeline under the Bayer collaboration and Recursion’s own internal programmes. BenevolentAI’s knowledge graph and phenomics platform combines AI-assisted analysis of biological imaging data with biomedical literature mining to generate target-disease association scores and mechanistic hypotheses; its AI-assisted phenomics components process cell morphology images and phenotypic assay outputs from partner laboratory data to validate target engagement hypotheses and confirm cellular phenotypic readouts that form part of the evidence base for target selection decisions in the AstraZeneca RA programme and other collaboration drug discovery efforts.

The adversarial injection surface is the high-content imaging assay photograph, cell painting fluorescence microscopy image, and automated cellular morphology visualisation submission pathway: assay images submitted through Recursion Pharmaceuticals AI phenomics platform APIs, BenevolentAI phenomics data ingestion interfaces, or any high-content imaging AI system that accepts externally sourced or laboratory information management system (LIMS)-linked microscopy image files for automated phenotypic classification and hit identification. An adversarially crafted fluorescence microscopy image — in which pixel perturbations applied to the cytotoxicity fluorescence channel indicator, nuclear morphology measurement display, or phenotypic biomarker quantification overlay on a high-content imaging assay photograph cause the AI to classify a compound-treated cell population as exhibiting normal morphology and within-range viability when the actual image documents cytotoxic cellular changes meeting the platform’s cell death and morphology anomaly thresholds that would flag the corresponding compound class as a cytotoxic hit requiring elimination from the advancement queue — can suppress a cytotoxicity classification that would otherwise remove a toxic compound from the primary screening hit list, allowing a compound class with documented cytotoxic activity at screening concentrations to advance into secondary assay validation and lead optimisation as a false positive phenotypic hit. In Recursion Pharmaceuticals’ high-throughput phenomics context where AI systems classify hundreds of thousands of individual cell images per screening campaign, adversarial suppression of cytotoxicity signals across a subset of compound-treatment images creates hit identification data records that misrepresent the compound’s phenotypic activity profile, potentially directing significant drug programme investment toward a compound series with undetected cytotoxic liability.

The regulatory consequences of adversarially suppressed cytotoxicity detection in high-content imaging AI span FDA GLP data integrity, ICH GCP, and IND safety reporting dimensions of substantial severity. FDA 21 CFR Part 58 (Good Laboratory Practice for Nonclinical Laboratory Studies) requires that nonclinical study data — including in vitro phenotypic assay data generated in GLP-compliant laboratories that contribute to IND safety packages — be recorded accurately and that data systems maintain audit trail integrity and prevent unauthorised data modification; adversarial manipulation of high-content imaging assay photograph inputs that causes AI to record false phenotypic classifications in GLP study data systems creates a 21 CFR Part 58 data integrity violation that can result in FDA disqualification of the affected GLP laboratory and rejection of all GLP data in the sponsor’s IND submission produced by that laboratory. FDA 21 CFR Part 312 (Investigational New Drug Application) requires IND sponsors to submit accurate and complete preclinical safety data in support of human clinical trial authorisation; IND safety data that includes AI-generated phenotypic classifications produced from adversarially manipulated assay images misrepresents the compound’s preclinical safety profile to FDA, creating IND data integrity consequences and potential clinical hold exposure if FDA identifies the misrepresentation during IND review. FDA’s 2018 data integrity guidance emphasises that pharmaceutical sponsors must implement technical controls that prevent manipulation of data at the input boundary of AI and computerised systems that generate safety-relevant records; pre-scan verification of high-content imaging assay photographs at the AI system ingestion boundary, before phenotypic classification results are written to GLP study records or LIMS databases, is the control that directly addresses this requirement. Threshold: 60 for cell microscopy AI — reflecting GLP data integrity primacy and IND safety reporting exposure.

2. Clinical trial histopathology and tissue sample AI injection (PathAI, IQVIA AI)

Clinical trial histopathology and tissue sample AI processes digitised H&E-stained histopathology slide photographs, immunohistochemistry (IHC) tissue section images, tissue biopsy examination images, and tumor response assessment slide photographs submitted through AI-assisted clinical trial pathology tools and CRO site monitoring platforms that extract drug-related toxicology finding classifications, tumor response classifications in oncology efficacy trials, histopathology endpoint determinations for primary and secondary study endpoints, and tissue biomarker quantification values from pathology slide image inputs, generating pathology report determinations, safety review flag assignments, and primary efficacy endpoint classifications that constitute core clinical study data for FDA NDA and BLA submission packages. PathAI processes digitised histopathology slide images through AI-assisted pathology tools deployed at AstraZeneca and Bristol-Myers Squibb — two of the world’s largest pharmaceutical companies — generating tumor response classifications for oncology clinical trials, histopathology endpoint determinations for pathological complete response (pCR) calculations in neoadjuvant chemotherapy trials, and tissue biomarker quantification values including PD-L1 expression scoring and tumor-infiltrating lymphocyte (TIL) density estimates that serve as companion diagnostic and efficacy biomarker endpoints in oncology drug registration trials; PathAI AI-generated pathology determinations in BMS and AstraZeneca oncology trials constitute primary efficacy data submitted to FDA as the evidentiary basis for oncology drug approval decisions. IQVIA AI processes clinical trial site monitoring images, source document verification photographs, remote monitoring visualisations, and imaging biomarker result displays through its CRO AI platform across hundreds of ongoing pharmaceutical clinical trials for global pharmaceutical sponsors, generating data quality flags, site monitoring alerts, protocol deviation classifications, and imaging data validity determinations that govern when FDA inspectors are recommended for clinical trial site audits and when imaging biomarker endpoint data is accepted or queried for re-adjudication.

The adversarial injection surface is the H&E histopathology slide photograph, immunohistochemistry tissue section image, tumor response assessment slide image, and clinical biopsy examination photograph submission pathway: pathology slide images submitted through PathAI clinical trial pathology AI interfaces, IQVIA AI site monitoring imaging tools, or any AI-assisted histopathology platform that accepts externally sourced or digital pathology scanner-generated slide image files for automated classification of clinical trial safety and efficacy endpoints. An adversarially crafted H&E histopathology slide photograph — in which pixel perturbations applied to the nuclear atypia morphology indicator, necrosis extent demarcation region, or drug-related hepatocellular injury feature area on a digitised pathology slide image cause the AI to classify the tissue section as showing no significant drug-related histopathological findings when the actual slide documents a hepatotoxicity or cardiotoxicity lesion grade meeting the clinical trial protocol’s definition of a dose-limiting toxicity or serious adverse drug reaction — can suppress a toxicology finding classification that would otherwise trigger a serious adverse event (SAE) reporting obligation under FDA 21 CFR Part 312 § 312.32, preventing the sponsor’s safety review team from receiving the AI-generated pathology alert that would initiate the SAE narrative completion and 15-day expedited report submission to FDA. In oncology efficacy trials where PathAI AI classifies histopathology slides for pathological complete response as a primary endpoint, an adversarially crafted tumor response assessment slide image that causes the AI to classify a non-complete-response tissue section as pCR generates a false positive primary efficacy endpoint determination — inflating the trial’s pCR rate, potentially producing a statistically significant efficacy result from a drug that did not produce the claimed clinical benefit, and creating the conditions for an FDA drug approval based on fabricated histopathology efficacy data.

The regulatory consequences of adversarially manipulated histopathology AI in clinical trials span FDA IND safety reporting obligations, GCP data integrity requirements, and FDA enforcement dimensions of the most severe category available under pharmaceutical law. FDA 21 CFR Part 312 § 312.32 (IND safety reporting) requires clinical trial sponsors to report serious and unexpected adverse drug reactions to FDA within 15 calendar days of first receiving information about the reaction, and within 7 calendar days for fatal or life-threatening unexpected serious adverse drug reactions; adversarial suppression of a PathAI histopathology toxicology finding classification that eliminates the AI-generated alert that would have triggered the sponsor’s SAE identification and reporting workflow creates a 21 CFR § 312.32 reporting violation, exposing the sponsor to FDA regulatory action including clinical hold imposition and referral to the Department of Justice for criminal prosecution of sponsor officers. ICH E6(R2) Good Clinical Practice requires that clinical trial data — including AI-generated histopathology endpoint determinations that constitute primary or secondary efficacy data — be recorded accurately, verifiably, and without unauthorised alteration; adversarially manipulated histopathology AI inputs that generate false endpoint classifications create GCP data integrity failures that FDA inspectors can identify through inspection of the sponsor’s CDISC clinical data submission, triggering FDA Form 483 observations, Warning Letter issuance, and potential clinical trial disqualification. FDA’s draft guidance on statistical approaches for clinical trial design and analysis establishes that imaging and histopathology endpoint AI tools must be validated for accuracy and that data integrity controls must prevent manipulation of the images from which AI endpoints are derived; the Glyphward pre-scan at the histopathology image ingestion boundary provides the technical data integrity control that fulfils this guidance requirement, creating an image-level audit record — including image_sha256, scan_id, and adversarial score — that sponsors can provide to FDA inspectors as evidence of image input validation controls. Threshold: 60 for histopathology AI — reflecting FDA GCP data integrity primacy and IND SAE reporting exposure.

3. Molecular structure and docking visualisation AI injection (Schrödinger AI, Insilico Medicine Chemistry42)

Molecular structure and docking visualisation AI processes molecular docking result screenshots, binding affinity heatmap images, free energy perturbation (FEP+) relative binding energy result displays, selectivity profile visualisation outputs, and computational lead optimisation scoring panel screenshots submitted through AI-assisted computational drug design platforms and molecular property prediction tools that extract binding affinity score classifications, selectivity ratio determinations, off-target liability flag assignments, and ADMET property prediction grade values from molecular visualisation image inputs, generating lead compound prioritisation recommendations, compound advancement or elimination flags, and computational drug candidate selection records that govern which synthetic chemistry programmes are initiated, which compound series receive medicinal chemistry optimisation investment, and which computational drug candidates are advanced into in vitro and in vivo experimental validation. Schrödinger AI underpins computational drug design for more than 2,000 pharmaceutical and biotechnology customers, with the Glide docking engine processing molecular docking pose visualisations and binding pocket interaction screenshots through AI-assisted virtual screening and structure-based drug design tools, the FEP+ platform generating relative binding free energy calculation result displays that inform lead series selection and potency optimisation at Pfizer, Merck, Novartis, and major global pharmaceutical sponsors, and the LiveDesign collaborative drug design platform aggregating computational docking score visualisations, selectivity heatmap displays, and ADMET prediction result panels from multiple computational chemistry tools into unified AI-assisted drug candidate triage interfaces used by medicinal chemistry and computational chemistry teams in real-time lead optimisation decision-making. Insilico Medicine’s Chemistry42 generative chemistry platform processes molecular structure generation output visualisations, ADMET property prediction result displays, and generative design scoring panel screenshots through AI-assisted computational lead identification and optimisation pipelines across more than 30 active drug programmes including the ISM001-055 idiopathic pulmonary fibrosis programme, generating AI compound ranking scores and advancement priority determinations that control which AI-generated molecular candidates are selected for synthesis in Insilico’s automated drug discovery pipeline.

The adversarial injection surface is the molecular docking visualisation screenshot, binding affinity heatmap image, FEP+ calculation result display, and selectivity profile visualisation submission pathway: computational chemistry result images submitted through Schrödinger LiveDesign AI triage interfaces, Insilico Medicine Chemistry42 generative compound scoring platforms, or any AI-assisted computational drug design tool that accepts externally sourced or computational chemistry engine-generated molecular visualisation images for automated lead prioritisation, selectivity classification, and off-target liability assessment. An adversarially crafted molecular docking visualisation screenshot — in which pixel perturbations applied to the binding affinity score display, docking energy value indicator, or off-target interaction flagging region on a Glide docking result visualisation image cause the AI to classify a molecular candidate’s binding profile as highly selective with acceptable off-target liability when the actual docking result documents significant off-target binding at kinase targets associated with cardiac toxicity or narrow therapeutic index enzymes that would generate an off-target liability flag requiring the compound series to be structurally modified or eliminated from the lead optimisation programme — can suppress an off-target liability flag determination that would otherwise redirect the medicinal chemistry programme toward structurally differentiated analogues with improved selectivity, allowing a compound class with documented in silico off-target cardiac liability to advance into synthesis and biological testing without the selectivity concern being registered in the computational lead optimisation data record. In Schrödinger LiveDesign environments where AI-assisted triage of hundreds of molecular candidates per lead optimisation cycle generates compound advancement recommendations consumed directly by medicinal chemistry project teams, adversarial suppression of a selectivity ratio classification or off-target flag across a series of docking visualisation submissions can systematically bias the AI-generated compound prioritisation output toward a compound class with undetected liability, misdirecting synthetic chemistry resources across multiple programme cycles before wet laboratory off-target assays reveal the selectivity deficiency.

The regulatory and drug development consequences of adversarially suppressed off-target liability detection in molecular docking AI span FDA guidance on computer-assisted drug design, ICH Q8 pharmaceutical development, and IND-enabling study design dimensions. FDA’s guidance on the use of computational approaches in pharmaceutical development and ICH Q8(R2) (Pharmaceutical Development) require that computational drug design tools used to support IND submissions be validated and that the data integrity of computational result records be maintained; adversarial manipulation of molecular docking visualisation inputs that generates false binding affinity or selectivity classifications in the sponsor’s computational drug design records creates ICH Q8 data integrity deficiencies in the IND chemistry, manufacturing, and controls (CMC) and pharmacology sections that FDA reviewers assess to determine whether the sponsor has adequately characterised the drug candidate’s molecular binding profile. The ICH Q8 development history documentation requirement means that adversarially manipulated computational docking result records — if submitted as part of the sponsor’s IND or NDA development history — constitute false or misleading regulatory submissions under 18 USC § 1001, with potential criminal liability for sponsor officers who certify the accuracy of the submission. At the drug candidate selection stage, where Schrödinger or Chemistry42 AI-generated docking scores and off-target liability assessments govern which compound series enter IND-enabling preclinical toxicology studies, adversarial suppression of a critical off-target flag can direct the preclinical safety programme toward a compound with predictable in vivo toxicity that only manifests in the IND-enabling GLP toxicology studies — wasting the eighteen to thirty-six months and tens of millions of dollars of preclinical development investment required before the toxic liability is identified. Threshold: 65 for molecular docking and computational drug design AI — reflecting drug candidate selection data integrity and the downstream IND regulatory consequences of false computational lead prioritisation.

4. In vivo pharmacology assay image AI injection (Exscientia AI, Certara PBPK AI)

In vivo pharmacology assay image AI processes dose-response curve visualisation images, pharmacokinetic (PK) parameter result display screenshots, pharmacodynamic (PD) biomarker measurement panel images, NOAEL (No Observable Adverse Effect Level) assessment display screenshots, and in vivo safety pharmacology study result visualisation images submitted through AI-assisted preclinical study data review platforms and PBPK (physiologically based pharmacokinetic) modelling tools that extract dose-response curve anomaly flags, PK/PD parameter outlier classifications, NOAEL threshold exceedance indicators, and ICH S7A/S7B safety pharmacology endpoint deviation determinations from preclinical assay visualisation image inputs, generating IND-enabling study adequacy determinations, first-in-human dose selection recommendations, and GLP study data acceptance or query flags that govern the sponsor’s IND filing data package assembly and FDA’s preclinical pharmacology and toxicology review assessment. Exscientia AI operates AI-driven closed-loop drug design platforms that integrate in vitro and in vivo assay result visualisations into automated compound advancement decision workflows, with AI systems processing dose-response curve images and selectivity assay result displays from partner laboratories to generate compound ranking scores and advancement recommendations consumed by Exscientia’s drug design engines in the Sanofi partnership (up to €5.1 billion in milestones), the Bristol-Myers Squibb collaboration, and Exscientia’s own internal pipeline; Exscientia’s AI platform is specifically designed to interpret preclinical assay result visualisations as structured data inputs that drive automated experimental design and compound selection decisions within the closed-loop discovery cycle, making the assay image the primary external data input to AI decision-making rather than a secondary visualisation of a separately recorded numerical result. Certara AI processes PBPK model output displays, clinical pharmacology simulation result visualisations, plasma concentration-time curve images, and dose-response relationship displays through the Simcyp PBPK platform and Phoenix pharmacokinetic analysis tools deployed at pharmaceutical sponsors for IND-enabling pharmacokinetic characterisation, IVIVC (in vitro/in vivo correlation) modelling, regulatory submission support for FDA and EMA, and first-in-human dose selection and clinical study design guidance — with Certara AI-generated PBPK model outputs included in IND submissions as the pharmacokinetic rationale for the starting dose and dose escalation scheme in Phase I clinical trials.

The adversarial injection surface is the dose-response curve visualisation image, PK parameter result display screenshot, NOAEL assessment display image, and in vivo safety pharmacology study result visualisation submission pathway: preclinical pharmacology and toxicology assay result images submitted through Exscientia AI closed-loop drug design data ingestion interfaces, Certara Simcyp PBPK model visualisation analysis tools, or any AI-assisted preclinical study data review platform that accepts externally sourced or laboratory data management system (LDMS)-generated assay visualisation images for automated pharmacokinetic parameter extraction, dose-response relationship classification, and NOAEL determination. An adversarially crafted NOAEL assessment display screenshot — in which pixel perturbations applied to the dose-group mean body weight change display, organ toxicity biomarker threshold indicator, or adverse effect classification boundary on a GLP toxicology study dose-response visualisation cause the AI to classify the next highest dose group as the NOAEL when the actual display documents adverse effects at that dose group meeting the ICH M3(R2) threshold for NOAEL assignment at the next lower dose — can suppress a NOAEL threshold exceedance indicator that would otherwise require the preclinical study to be re-evaluated with the NOAEL assigned at a lower dose, causing the IND-enabling study’s NOAEL-based first-in-human dose calculation to yield a starting dose that exceeds the true preclinical NOAEL by one full dose group — potentially exposing Phase I clinical trial participants to doses that exceed the highest non-adverse-effect dose in the species most sensitive to the compound’s toxicity. In Certara Simcyp PBPK contexts where AI analyses plasma concentration-time curve images to extract pharmacokinetic parameters for first-in-human dose prediction, adversarial perturbation of a concentration-time curve display that suppresses a Cmax outlier flag or AUC deviation classification can cause the PBPK model to generate an erroneously optimistic pharmacokinetic profile, producing a first-in-human dose recommendation that underestimates human exposure at the proposed clinical dose and overestimates the therapeutic window available for Phase I dose escalation.

The regulatory consequences of adversarially suppressed NOAEL and pharmacokinetic AI classification in IND-enabling preclinical studies span FDA GLP requirements, ICH preclinical safety guidance, and IND submission data integrity dimensions of exceptional severity. FDA 21 CFR Part 58 (Good Laboratory Practice for Nonclinical Laboratory Studies) requires GLP study data — including dose-response relationship records and NOAEL determinations from pivotal GLP toxicology studies that form the core of the IND preclinical safety section — to be recorded accurately and without unauthorised alteration, with study directors certifying the completeness and accuracy of GLP study reports; adversarial manipulation of GLP study dose-response visualisation inputs to AI-assisted data review systems that generates false NOAEL classifications in the GLP study record creates a 21 CFR Part 58 data integrity violation that invalidates the GLP study for IND submission purposes. ICH S7A (Safety Pharmacology Studies for Human Pharmaceuticals) and ICH S7B (Nonclinical Evaluation of the Potential for Delayed Ventricular Repolarisation) specify the preclinical safety pharmacology study designs and endpoint assessment requirements that must be completed before IND filing, including hERG channel inhibition assessment, in vivo cardiovascular safety pharmacology, and central nervous system safety pharmacology; adversarial suppression of AI-detected hERG inhibition signal flags or cardiovascular safety pharmacology endpoint exceedances in Certara or Exscientia AI visualisation analysis creates ICH S7A/S7B data gaps in the IND preclinical pharmacology section that FDA CDER pharmacology reviewers are specifically trained to identify as IND clinical hold grounds. FDA 21 CFR Part 312 § 312.23(a)(8) requires IND sponsors to include a pharmacology and toxicology section describing preclinical studies and their results with sufficient detail to allow FDA to assess the risks to human subjects; adversarial manipulation of AI-generated NOAEL determinations or pharmacokinetic parameter extractions that causes the IND submission to misrepresent the preclinical safety profile creates a § 312.23 data integrity violation with IND clinical hold, Warning Letter, and potential criminal referral consequences. Threshold: 65 for in vivo pharmacology assay AI — reflecting GLP study data integrity, NOAEL-based first-in-human dose safety, and IND preclinical data package integrity.

Integration: pharmaceutical drug discovery AI image ingestion with Glyphward pre-scan

Pharmaceutical drug discovery AI image ingestion flows from high-content imaging assay APIs, digital pathology scanner interfaces, computational chemistry visualisation export channels, and preclinical study data management system portals into phenomics hit identification AI, clinical trial histopathology AI, molecular docking triage AI, and pharmacokinetic modelling AI pipelines. Insert Glyphward’s pre-scan at the ingestion boundary before AI-generated output is committed to GLP study records, clinical trial pathology reports, computational lead optimisation databases, or IND preclinical data packages:

import asyncio
import base64
import hashlib
import os
import uuid
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = os.environ["GLYPHWARD_API_KEY"]
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Pharmaceutical drug discovery AI — FDA 21 CFR Part 312 (IND),
# FDA 21 CFR Part 58 (GLP), ICH E6(R2) GCP, ICH Q8, ICH S7A/S7B,
# FDA 2018 data integrity guidance.
# Suppression of cytotoxicity flags, histopathology findings, off-target
# liability scores, and NOAEL exceedances creates patient safety risk and
# IND/NDA data integrity regulatory consequences.
THRESHOLD_MICROSCOPY_HISTO  = 60  # cell microscopy, histopathology (GLP/GCP primacy)
THRESHOLD_DOCKING_PHARM     = 65  # molecular docking, in vivo pharmacology (IND safety)


class DrugDiscoveryAIContext(str, Enum):
    CELL_MICROSCOPY      = "cell_microscopy"      # Recursion Pharmaceuticals, BenevolentAI
    HISTOPATHOLOGY       = "histopathology"        # PathAI, IQVIA AI
    MOLECULAR_DOCKING    = "molecular_docking"     # Schrödinger AI, Insilico Medicine
    PHARMACOLOGY_ASSAY   = "pharmacology_assay"   # Exscientia AI, Certara PBPK AI


def threshold_for(context: DrugDiscoveryAIContext) -> int:
    if context in (
        DrugDiscoveryAIContext.MOLECULAR_DOCKING,
        DrugDiscoveryAIContext.PHARMACOLOGY_ASSAY,
    ):
        return THRESHOLD_DOCKING_PHARM
    return THRESHOLD_MICROSCOPY_HISTO


async def scan_drug_discovery_ai_image(
    image_path: str | Path,
    context: DrugDiscoveryAIContext,
    sponsor_id_hash: str,   # SHA-256 of pharmaceutical sponsor / CRO organisation ID
    study_ref: str,         # e.g. "GLP-TOX-2026-0441", "CT-ONCO-BMS-3317", "COMP-SCH-7821"
    assay_id: str,          # e.g. high-content imaging plate ID, histopathology slide ID,
                            #       docking run ID, or PBPK model run ID
    client: httpx.AsyncClient,
) -> dict:
    """
    Scan a pharmaceutical drug discovery AI image for adversarial injection
    payloads before forwarding to phenomics hit identification, clinical trial
    histopathology, molecular docking triage, or pharmacokinetic modelling AI.

    Raises AdversarialDrugDiscoveryAIImageError if score meets threshold:
      - CELL_MICROSCOPY:    threshold 60; FDA 21 CFR Part 58 GLP; ICH E6(R2) GCP;
                            FDA 2018 data integrity guidance; GLP cytotoxicity record
      - HISTOPATHOLOGY:     threshold 60; FDA 21 CFR Part 312 IND SAE reporting;
                            ICH E6(R2) GCP; false efficacy signal risk; NDA integrity
      - MOLECULAR_DOCKING:  threshold 65; FDA CADD guidance; ICH Q8; drug candidate
                            selection data integrity; off-target liability suppression
      - PHARMACOLOGY_ASSAY: threshold 65; FDA 21 CFR Part 58 GLP; ICH S7A/S7B;
                            NOAEL exceedance; IND filing data package integrity
    """
    image_bytes  = Path(image_path).read_bytes()
    image_b64    = base64.b64encode(image_bytes).decode()
    image_sha256 = hashlib.sha256(image_bytes).hexdigest()
    client_scan_id = str(uuid.uuid4())
    threshold = threshold_for(context)

    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json={
            "image": image_b64,
            "source": context.value,
            "metadata": {
                "drug_context":     context.value,
                "sponsor_id_hash":  sponsor_id_hash,
                "study_ref":        study_ref,
                "assay_id":         assay_id,
                "client_scan_id":   client_scan_id,
                "image_sha256":     image_sha256,
            },
        },
        timeout=8.0,
    )
    resp.raise_for_status()
    result = resp.json()

    audit_record = {
        "sponsor_id_hash":  sponsor_id_hash,
        "study_ref":        study_ref,
        "assay_id":         assay_id,
        "drug_context":     context.value,
        "scan_id":          result["scan_id"],
        "client_scan_id":   client_scan_id,
        "image_sha256":     image_sha256,
        "score":            result["score"],
        "flagged_region":   result.get("flagged_region"),
        "threshold":        threshold,
        "action":           "blocked" if result["score"] >= threshold else "allowed",
    }
    await write_drug_discovery_audit_record(audit_record)

    if result["score"] >= threshold:
        raise AdversarialDrugDiscoveryAIImageError(
            f"Drug discovery AI image blocked [{context.value}]: "
            f"scan_id={result['scan_id']} score={result['score']} "
            f"sponsor={sponsor_id_hash} study={study_ref} assay={assay_id}"
        )
    return result


async def write_drug_discovery_audit_record(record: dict) -> None:
    """Persist audit record to pharmaceutical sponsor GLP/GCP compliance audit store (stub)."""
    import json, sys
    print(json.dumps(record), file=sys.stderr)


class AdversarialDrugDiscoveryAIImageError(Exception):
    """Raised when a pharmaceutical drug discovery AI image exceeds the adversarial injection threshold."""
    pass

Call scan_drug_discovery_ai_image() with DrugDiscoveryAIContext.CELL_MICROSCOPY before forwarding fluorescence microscopy images and cell painting assay photographs to Recursion Pharmaceuticals AI or BenevolentAI phenomics platforms — the primary phenotypic hit identification integration point, where adversarial suppression of a cytotoxicity classification commits a false hit record to the LIMS database that may not be contradicted by secondary assay data until significant lead optimisation resources have been misdirected. Call with DrugDiscoveryAIContext.HISTOPATHOLOGY for PathAI or IQVIA AI histopathology slide images before AI toxicology finding classification and tumor response determination, preserving image_sha256 as the forensic anchor for FDA GCP inspection of clinical trial primary data records and IND SAE reporting audit trail documentation. Call with DrugDiscoveryAIContext.MOLECULAR_DOCKING for Schrödinger LiveDesign or Insilico Medicine Chemistry42 docking visualisation screenshots before AI lead prioritisation and off-target liability classification, with assay_id encoding the specific docking run identifier for ICH Q8 computational drug design data audit trail and FDA CADD guidance compliance documentation. Call with DrugDiscoveryAIContext.PHARMACOLOGY_ASSAY for Exscientia AI or Certara Simcyp PBPK assay result visualisations before AI dose-response classification and NOAEL determination, with study_ref linking the Glyphward scan record to the specific GLP study report identifier for FDA 21 CFR Part 58 GLP audit and IND preclinical pharmacology section data integrity verification. Get early access

Coverage matrix

Frequently asked questions

Further reading

• Indirect prompt injection via image — foundational attack pattern underlying all four pharmaceutical drug discovery AI injection surfaces; covers how adversarial pixel-level perturbations cause AI misclassification without detectable visual artefacts at human review resolution, including the optimisation methods used to craft images that evade AI quality control pre-filters.
• Vision-language model security — technical architecture of adversarial image attacks against vision-language models including perturbation classes applicable to fluorescence microscopy image AI and H&E histopathology slide classification models deployed in pharmaceutical drug discovery contexts.
• Clinical trials pharmaceutical AI prompt injection — broader clinical trial AI injection context covering adversarial image attacks across the full spectrum of clinical trial AI tools including imaging biomarker AI, electronic clinical outcome assessment AI, and site monitoring AI platforms.
• Digital pathology and clinical laboratory AI prompt injection — adversarial image injection in digital pathology AI platforms covering the broader class of histopathology and cytopathology AI injection applicable to drug discovery and clinical trial pathology contexts including companion diagnostic AI and laboratory developed test AI.
• Free tier — 10 scans/day, no card required — start scanning pharmaceutical drug discovery AI images at development volumes before committing to a production plan; the free tier supports all four DrugDiscoveryAIContext values with full image_sha256 audit trail generation.