Prompt injection in radiation therapy treatment planning AI

Four adversarial injection surfaces in radiation therapy treatment planning AI

1. CT/MRI organ-at-risk (OAR) auto-segmentation AI injection (Varian Ethos AI, Elekta Atlas segmentation, RayStation AI, Brainlab Elements Smart Segmentation FDA 510(k) K190563)

Organ-at-risk auto-segmentation is the first major AI step in the external beam radiotherapy planning workflow. After a patient undergoes a CT simulation scan — a dedicated treatment planning CT scan acquired with the patient in treatment position — AI segmentation tools automatically delineate critical normal tissue structures from the CT density data. Varian Ethos AI performs real-time auto-contouring of OARs including parotid glands, spinal cord, brainstem, mandible, and esophagus as part of the adaptive therapy workflow, generating contours on the daily CT reconstruction that feed directly into the adaptive dose plan calculation. Elekta’s Atlas-based segmentation uses a library of expert-contoured CT datasets to drive AI delineation across the same OAR set. RayStation AI segmentation, integrated into the RaySearch Laboratories TPS, applies deep learning segmentation models for multi-structure OAR delineation from CT and MRI planning images, with validated models for brain, thorax, abdomen, and pelvis OAR sets. Brainlab Elements Smart Segmentation, cleared under FDA 510(k) K190563, provides AI auto-contouring of OARs including kidneys, bowel, rectum, bladder, and spinal cord from CT and MRI planning scans. In each system, the AI delineates the OAR boundaries, and the resulting contour defines the dose constraint that the plan optimizer must satisfy — for example, a maximum brainstem dose of 54 Gy or a spinal cord maximum of 45 Gy based on the QUANTEC organ tolerance dose-volume relationships.

The adversarial attack against OAR segmentation AI targets the CT or MRI planning image at the point it is submitted to the segmentation AI model. Adversarial pixel perturbations applied to the CT planning image — modifications to specific pixel intensity values within the image while maintaining the visual appearance of a normal CT scan — can cause the AI segmentation model to systematically expand or shrink the predicted OAR contour boundaries. A contour expansion attack on brainstem segmentation causes the AI to delineate a brainstem volume that extends beyond the true brainstem boundary; the dose optimizer, constraining dose to the AI-generated (expanded) contour, applies the 54 Gy brainstem maximum to a region that includes non-brainstem tissue, leaving the actual brainstem partially unconstrained and potentially receiving doses above the tolerance threshold during the optimized plan. The inverse contour shrinkage attack on parotid gland segmentation causes the AI to delineate a smaller-than-actual parotid volume, reducing the effective dose constraint coverage for parotid sparing and allowing higher parotid dose in the optimized plan than the treating physician intended — with chronic xerostomia (severe dry mouth) as the clinical consequence for head and neck cancer patients. At Glyphward’s threshold of 45 for OAR segmentation AI contexts, adversarial perturbations that achieve a segmentation manipulation score above this level are quarantined before the CT image is submitted to the Varian Ethos, Elekta, or RayStation segmentation model, and the scan event is recorded for physics review under AAPM TG-218 quality assurance documentation requirements.

2. Dose plan optimization AI injection (Varian Eclipse IMRT/VMAT optimization AI FDA 510(k) K210421, Elekta Monaco Monte Carlo AI, RayStation Robust Optimization AI)

After OAR and tumor target volume (PTV, GTV, CTV) contours are finalized — either by AI auto-segmentation with physician review or by manual physician delineation — the treatment planning system’s dose optimization engine calculates the beam angles, fluence maps, and monitor unit weightings that deliver the prescribed dose to the tumor target while minimizing dose to surrounding OARs. Varian Eclipse’s IMRT and VMAT optimization engine, cleared under FDA 510(k) K210421, uses AI-assisted beam arrangement and fluence optimization to generate dose plans for intensity-modulated and volumetric arc therapy treatments, reading the CT Hounsfield Unit density map as a grayscale image to calculate radiation transport through tissue. Elekta Monaco TPS applies Monte Carlo dose calculation AI that models photon and electron radiation transport through the CT density map with statistical precision, generating dose distributions used for Monaco’s biological optimization objectives. RayStation’s Robust Optimization AI accounts for geometric uncertainties in patient positioning by optimizing across a set of shifted CT scenarios, requiring the AI to evaluate dose distributions across multiple perturbed CT image sets simultaneously.

The adversarial attack against dose optimization AI targets the CT density map image submitted to the dose calculation engine — the same CT planning scan that is used for OAR segmentation, but processed by the dose optimizer as a material density input for radiation transport modeling. Adversarial pixel perturbations applied to the CT image at the dose calculation input boundary can cause the AI-assisted optimization engine to calculate incorrect tissue attenuation along specific beam paths, shifting isodose line positions in the calculated dose distribution. When isodose lines are shifted adversarially, the 95% isodose surface (D95) that defines PTV coverage can appear adequate in the plan visualization — the 95% isodose line appears to encompass the PTV — while the actual radiation dose delivered to the tumor when the perturbed CT density values are corrected for true tissue composition falls below the prescription dose. This geometric miss — delivering a systematically lower tumor dose than prescribed across an entire treatment course — represents one of the most serious dosimetric errors in radiotherapy, reducing the probability of tumor control without the treating team’s awareness that the prescription was not met. For stereotactic body radiotherapy (SBRT) and stereotactic radiosurgery (SRS) plans where dose gradients are steep and the difference between tumor control and normal tissue toxicity is measured in millimeters, adversarial isodose shifting at the CT density input boundary creates clinically unacceptable dose delivery uncertainty. The Glyphward scan gate positioned before CT image submission to the Eclipse, Monaco, or RayStation dose optimizer at threshold 45 detects adversarially perturbed CT density images before they influence fluence optimization.

3. Patient-specific QA (PSQA) portal dosimetry AI injection (Sun Nuclear SunCHECK Patient AI FDA 510(k) K183082, IBA Dosimetry myQA, PTW OCTAVIUS AI)

Patient-specific quality assurance is the final verification step before a radiation therapy treatment plan is approved for patient treatment delivery. PSQA verifies that the treatment plan can actually be delivered by the linear accelerator with the calculated dose distribution — checking that the physical MLC leaf positions, gantry angles, and monitor units of an IMRT or VMAT plan translate to a measured dose distribution that matches the calculated dose distribution within clinical tolerance limits. Sun Nuclear’s SunCHECK Patient AI, cleared under FDA 510(k) K183082, is the market-leading PSQA software platform used by hundreds of radiation oncology departments; it ingests portal dosimetry images — dose images acquired by the linear accelerator’s electronic portal imaging device (EPID) during a verification delivery — and compares them to the planned dose distribution using gamma analysis. AAPM Task Group 218 establishes the clinical standard for PSQA: a 3%/3mm gamma criterion (3% dose difference and 3mm distance-to-agreement) with a passing rate above 90–95% is required before a plan can be approved for treatment. IBA Dosimetry’s myQA and PTW OCTAVIUS AI similarly apply AI-assisted gamma analysis to portal dosimetry images for pass/fail PSQA determination.

The adversarial attack against PSQA portal dosimetry AI targets the portal dose image submitted to the gamma analysis AI. The EPID portal dose image — a 2D array of measured dose values rendered as a grayscale image — is submitted to the SunCHECK, myQA, or OCTAVIUS AI for comparison against the planned dose distribution. Adversarial pixel perturbations applied to the portal dose image can cause the gamma analysis AI to evaluate the perturbed comparison as passing the 3%/3mm criterion when the actual unperturbed portal dose image would fail — meaning the adversarially manipulated image produces a false-pass PSQA result for a plan that has real dosimetric errors. When a treatment plan with real dosimetric errors is approved for patient treatment on the basis of a falsely passed PSQA check, the systematic dose error — which may involve underdosing of the tumor target, overdosing of an OAR, or a fluence delivery artifact — is delivered to the patient across all treatment fractions. For a typical IMRT treatment of 25–35 fractions, a systematic 10% dose delivery error that PSQA was designed to catch represents a total dose discrepancy of several Gray across the full treatment course. The adversarial attack is particularly dangerous because PSQA is the last independent verification before treatment delivery; there is no further checkpoint downstream. Glyphward’s scan at threshold 45 applied to portal dose images before SunCHECK, myQA, or OCTAVIUS AI submission detects adversarially perturbed portal dosimetry images that would otherwise falsely pass PSQA review, with scan records structured for AAPM TG-218 quality management documentation and 21 CFR Part 820 quality system record requirements.

4. Adaptive radiotherapy CBCT image registration AI injection (Varian Ethos Adaptive AI, Elekta Unity MR-Linac, ViewRay MRIdian AI)

Adaptive radiotherapy represents the most AI-intensive segment of the radiation therapy delivery workflow. Before each treatment fraction in an adaptive RT program, the patient undergoes daily imaging at the treatment unit — a cone-beam CT (CBCT) acquired on a conventional linear accelerator like Varian Ethos, or a magnetic resonance image (MRI) acquired on Elekta Unity MR-Linac or ViewRay MRIdian — and AI deformable image registration (DIR) maps the daily image to the original planning CT to detect changes in patient anatomy, tumor position, and OAR position that have occurred since the original plan was created. Varian Ethos Adaptive AI performs online adaptive planning — generating a new optimized dose plan within minutes, during the patient’s treatment appointment, based on the AI-registered daily CBCT — enabling the radiation dose to be conformed to the patient’s anatomy as it changes day to day during the treatment course. Elekta Unity MR-Linac combines a 1.5 Tesla MRI with a linear accelerator, enabling real-time MRI-guided treatment delivery with AI DIR between the daily treatment MRI and the planning MRI. ViewRay MRIdian uses a 0.35 Tesla MRI with a 60Co source array or linear accelerator for MR-guided adaptive radiotherapy with AI-based online re-planning.

The adversarial attack against adaptive RT image registration AI targets the daily CBCT or daily MRI submitted to the AI deformable registration engine. Adversarial pixel perturbations applied to the daily CBCT image can cause the AI DIR model to calculate a deformation vector field that systematically shifts the registered anatomy relative to the planning CT — reporting, for example, that the patient’s prostate has shifted 8mm posteriorly when the actual shift is only 2mm anteriorly. The adaptive plan generated from the adversarially misregistered daily image then directs high-dose radiation to a position displaced from the true tumor location, delivering excess dose to adjacent OARs (rectum or bladder in prostate adaptive RT; bowel in pancreatic adaptive RT) while underdosing the tumor target. For ViewRay MRIdian and Elekta Unity, where real-time MRI enables beam gating — the beam is held until the tumor is within a defined position gate — adversarial registration injection can corrupt the gating boundary definition itself, allowing beam delivery when the tumor is outside the intended position gate. The Glyphward threshold for adaptive RT CBCT registration AI contexts is 50, reflecting the fact that daily CBCT images undergo more preprocessing (scatter correction, noise reduction, Hounsfield Unit calibration) than planning CT images, creating greater benign image variation that the threshold must accommodate while still intercepting adversarial perturbations crafted to shift the DIR output beyond clinically acceptable limits.

Integration: radiation therapy AI image pipeline with Glyphward pre-scan

The Glyphward scan gate belongs at the image ingestion boundary for each radiation therapy AI subsystem — before the CT planning image reaches the OAR segmentation model, before the CT density map enters the dose optimization engine, before the portal dose image is submitted to the PSQA gamma analysis AI, and before the daily CBCT is fed to the adaptive registration engine. The async pattern below handles all four radiotherapy AI contexts through a shared scan_radiotherapy_ai_image function, with physics-calibrated thresholds and structured JSONL audit output compatible with AAPM TG-218 QA records and 21 CFR Part 820 device history record requirements.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Per-context thresholds reflecting radiotherapy AI patient-safety severity
OAR_SEGMENTATION_THRESHOLD     = 45  # Varian Ethos / Elekta Atlas / RayStation / Brainlab AI
DOSE_OPTIMIZATION_THRESHOLD    = 45  # Varian Eclipse / Elekta Monaco / RayStation Robust AI
PSQA_DOSIMETRY_THRESHOLD       = 45  # Sun Nuclear SunCHECK / IBA myQA / PTW OCTAVIUS AI
ADAPTIVE_REGISTRATION_THRESHOLD = 50  # Varian Ethos Adaptive / Elekta Unity / ViewRay MRIdian AI


class RadiotherapyAIContext(Enum):
    OAR_SEGMENTATION     = "oar_segmentation"      # threshold 45
    DOSE_OPTIMIZATION    = "dose_optimization"     # threshold 45
    PSQA_DOSIMETRY       = "psqa_dosimetry"        # threshold 45
    ADAPTIVE_REGISTRATION = "adaptive_registration" # threshold 50


_CONTEXT_THRESHOLDS: dict[RadiotherapyAIContext, int] = {
    RadiotherapyAIContext.OAR_SEGMENTATION:      OAR_SEGMENTATION_THRESHOLD,
    RadiotherapyAIContext.DOSE_OPTIMIZATION:     DOSE_OPTIMIZATION_THRESHOLD,
    RadiotherapyAIContext.PSQA_DOSIMETRY:        PSQA_DOSIMETRY_THRESHOLD,
    RadiotherapyAIContext.ADAPTIVE_REGISTRATION: ADAPTIVE_REGISTRATION_THRESHOLD,
}


class AdversarialRadiotherapyAIImageError(Exception):
    """Raised when Glyphward detects adversarial pixel content in a
    radiation therapy AI planning image above the context threshold.

    Attributes:
        scan_id: Glyphward scan identifier for the audit record.
        score: Adversarial signal score (0-100).
        context: The RadiotherapyAIContext in which detection occurred.
        flagged_region: Optional dict describing the flagged pixel region.
    """

    def __init__(
        self,
        scan_id: str,
        score: int,
        context: RadiotherapyAIContext,
        flagged_region: dict | None = None,
    ) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial radiotherapy AI image detected: "
            f"context={context.value} score={score} scan_id={scan_id}"
        )


async def scan_radiotherapy_ai_image(
    image_path: Path,
    context: RadiotherapyAIContext,
    patient_id_hash: str,
    plan_id: str,
    fraction_number: int | None,
    modality: str,
    client: httpx.AsyncClient,
) -> dict:
    """Scan a radiation therapy AI planning image for adversarial pixel content.

    Args:
        image_path: Absolute path to the CT, MRI, CBCT, or portal dose image.
        context: RadiotherapyAIContext enum value identifying the AI pipeline.
        patient_id_hash: SHA-256 hash of MRN (not the MRN itself — HIPAA).
        plan_id: Treatment plan identifier from the TPS (not PHI).
        fraction_number: Treatment fraction number (None for planning images).
        modality: Image modality string: 'CT', 'MRI', 'CBCT', 'EPID'.
        client: Shared httpx.AsyncClient for connection reuse.

    Returns:
        Glyphward scan result dict: scan_id, score, flagged_region, modality.

    Raises:
        AdversarialRadiotherapyAIImageError: if score exceeds context threshold.
        httpx.HTTPStatusError: on Glyphward API errors (fail-closed: quarantine image).
    """
    threshold = _CONTEXT_THRESHOLDS[context]
    image_bytes = image_path.read_bytes()
    image_hash = hashlib.sha256(image_bytes).hexdigest()

    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"radiotherapy:{context.value}:{modality}:{plan_id}",
        "metadata": {
            "patient_id_hash": patient_id_hash,
            "plan_id": plan_id,
            "fraction_number": fraction_number,
            "modality": modality,
            "image_sha256": image_hash,
        },
    }

    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=5.0,
    )
    resp.raise_for_status()
    result = resp.json()

    await write_radiotherapy_scan_audit(
        image_hash=image_hash,
        scan_id=result["scan_id"],
        score=result["score"],
        context=context,
        threshold=threshold,
        patient_id_hash=patient_id_hash,
        plan_id=plan_id,
        fraction_number=fraction_number,
        modality=modality,
        flagged=result["score"] > threshold,
    )

    if result["score"] > threshold:
        raise AdversarialRadiotherapyAIImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            flagged_region=result.get("flagged_region"),
        )

    return result


async def write_radiotherapy_scan_audit(
    *,
    image_hash: str,
    scan_id: str,
    score: int,
    context: RadiotherapyAIContext,
    threshold: int,
    patient_id_hash: str,
    plan_id: str,
    fraction_number: int | None,
    modality: str,
    flagged: bool,
) -> None:
    """Append structured JSON audit record to radiotherapy AI scan log.

    Satisfies AAPM TG-218 PSQA documentation requirements, HIPAA §164.312(b)
    audit controls, and 21 CFR Part 820 device history record requirements.
    Hashed patient IDs avoid PHI in the scan log itself.
    """
    record = {
        "ts": datetime.now(timezone.utc).isoformat(),
        "scan_id": scan_id,
        "image_sha256": image_hash,
        "context": context.value,
        "score": score,
        "threshold": threshold,
        "flagged": flagged,
        "patient_id_hash": patient_id_hash,
        "plan_id": plan_id,
        "fraction_number": fraction_number,
        "modality": modality,
    }
    audit_path = Path("/var/log/glyphward/radiotherapy_ai_scan_audit.jsonl")
    audit_path.parent.mkdir(parents=True, exist_ok=True)
    with audit_path.open("a") as fh:
        fh.write(json.dumps(record) + "\n")


async def process_radiotherapy_image_batch(
    images: list[tuple[Path, RadiotherapyAIContext, str, str, int | None, str]],
) -> list[dict]:
    """Process a batch of (path, context, patient_hash, plan_id, fraction, modality) tuples."""
    async with httpx.AsyncClient() as client:
        tasks = [
            scan_radiotherapy_ai_image(
                image_path=path,
                context=ctx,
                patient_id_hash=pid,
                plan_id=plan,
                fraction_number=frac,
                modality=mod,
                client=client,
            )
            for path, ctx, pid, plan, frac, mod in images
        ]
        results = []
        for coro in asyncio.as_completed(tasks):
            try:
                results.append(await coro)
            except AdversarialRadiotherapyAIImageError as exc:
                results.append({
                    "status": "quarantined",
                    "context": exc.context.value,
                    "scan_id": exc.scan_id,
                    "score": exc.score,
                    "flagged_region": exc.flagged_region,
                })
        return results

Deploy scan_radiotherapy_ai_image at four points in the radiation therapy planning pipeline: before the CT planning image reaches Varian Ethos AI, Elekta Atlas, RayStation AI, or Brainlab Elements segmentation; before the CT density map enters Eclipse IMRT/VMAT, Monaco Monte Carlo, or RayStation Robust Optimization dose calculation; before the portal dose image is submitted to SunCHECK Patient, myQA, or OCTAVIUS gamma analysis; and before the daily CBCT or treatment MRI enters Ethos Adaptive, Unity MR-Linac, or MRIdian deformable registration. Get early access

Related questions

Further reading

• Prompt injection in healthcare radiology AI — diagnostic imaging and PACS AI adversarial surfaces
• Prompt injection in digital pathology and clinical laboratory AI — whole slide image and diagnostic AI pipelines
• HIPAA-compliant AI security — §164.312 audit controls for medical imaging AI pipelines
• Prompt injection in clinical trials and pharmaceutical AI — regulatory submission and trial data AI pipelines
• Prompt injection scanning API free tier — 10 scans/day, no card required