Prompt injection in wearable health monitoring AI

Four adversarial injection surfaces in wearable health monitoring AI

1. Continuous glucose monitoring (CGM) AI dosing injection (Dexcom G7 AI, Abbott FreeStyle Libre 3, Medtronic Guardian AI)

Modern CGM systems including Dexcom G7, Abbott FreeStyle Libre 3, and Medtronic Guardian 4 transmit interstitial glucose measurements every 1–5 minutes to smartphone receiver apps and cloud data platforms that apply AI analysis to the continuous glucose time-series data. When rendered as trend visualization images for AI interpretation — glucose trend charts showing glucose level curves, rate-of-change arrows, target range bands, and predictive trend projections — this data enters vision-based AI systems used by Dexcom Clarity’s pattern analysis, by closed-loop insulin delivery systems (Tandem t:slim X2 with Control-IQ, Insulet Omnipod 5) that process CGM data for automated basal adjustment, and by clinical care coordination platforms (Glooko, LibreView) that clinicians use to review patient CGM trend visualizations and adjust insulin regimens. AI-assisted insulin dosing guidance for bolus insulin calculations also processes CGM trend data and meal photographs together in platforms like DarioHealth and Nutrisense, creating a multimodal AI pipeline where the CGM trend visualization is one input alongside the meal image in an AI that generates an insulin dose recommendation.

The adversarial attack against CGM dosing AI targets the rendered glucose trend visualization at the cloud platform ingestion boundary — before the trend chart image is submitted to the AI pattern recognition engine. Adversarial pixel perturbations applied to glucose trend visualization images can cause the AI to suppress predictive hypoglycemia alerts for trend charts showing glucose declining toward the hypoglycemia threshold (70 mg/dL), to generate false hypoglycemia recovery signals for trend charts showing glucose remaining below 70 mg/dL, or to misclassify the magnitude of a glucose spike in charts used for post-meal bolus recommendations. In closed-loop insulin delivery systems where the AI’s automated basal rate adjustment operates without manual user confirmation for small adjustments, adversarial CGM trend injection can influence automated insulin delivery without user awareness. The clinical consequences of adversarial CGM dosing manipulation are acute and severe: severe hypoglycemia (glucose below 54 mg/dL) causes seizures, loss of consciousness, and if untreated, cardiac arrest and death; the American Diabetes Association estimates 300,000 emergency department visits annually for hypoglycemia in insulin-treated diabetes patients, a patient population in which accurate CGM alert generation is a primary safety mechanism. FDA’s 510(k) clearances for CGM devices and AI-assisted dosing software classify these tools as Class II medical devices; the SaMD Cybersecurity Guidance applies to CGM platform AI components as it does to other AI/ML SaMD categories, but does not require inference-time adversarial pixel scanning specifically for rendered sensor data visualizations.

The insurance fraud dimension of CGM AI manipulation is financially significant in the context of CGM reimbursement expansion. Medicare Part B CGM coverage was expanded in 2023 to cover all insulin-requiring diabetes patients, creating a CGM device reimbursement market of approximately $3 billion annually. Third-party CGM data vendors and clinical care coordination platforms that process CGM trend data for Medicare Advantage managed care payers have incentive structures where manipulated AI-generated CGM analytics (showing worse average glucose control than actually achieved) could support justification for higher-intensity (and higher-cost) diabetes management interventions billed under RPM CPT codes 99454 and 99457.

2. ECG atrial fibrillation AI injection (Apple Watch ECG, Samsung Galaxy Watch ECG, iRhythm Zio Patch AI)

The Apple Watch ECG generates a single-lead (Lead I) electrocardiogram by detecting the electrical potential difference between the wearer’s wrist contact electrode and the finger touching the digital crown, producing a 30-second ECG strip that Apple’s on-device AI classifies as sinus rhythm, atrial fibrillation, inconclusive, or poor recording. FDA clearance K192729 (September 2018) and K223274 (Apple Watch Series 8, September 2022) authorized the classification algorithm as a 510(k) Class II de novo device. Samsung Galaxy Watch 6 and Withings ScanWatch Horizon have received equivalent FDA clearances for their single-lead ECG AFib detection algorithms. The ECG waveform data — the digitized electrical trace over 30 seconds — is stored on device and synced to the HealthKit/Health Connect ecosystem, from which third-party cardiac AI platforms (AliveCor KardiaMobile, Cardiogram AI, HeartMath), EHR integration workflows (Epic MyChart with wearable data integration), and clinical decision support systems receive the ECG trace as a rendered waveform image for further AI analysis or human physician review.

The adversarial attack against ECG cardiac AI operates at two points in the ECG data pipeline. The first attack boundary is at the point where the ECG waveform data is rendered as a display image for AI analysis — when the raw ECG trace numerical data is converted to a waveform visualization image before being submitted to a vision-based AI system (cardiac EHR review AI, second-opinion AI models used by cardiologists) for classification. Adversarial pixel perturbations can cause the AI to classify an AFib-pattern waveform as sinus rhythm, or to classify a normal sinus rhythm waveform as AFib — either of which can drive incorrect clinical decisions: missed AFib leads to missed anticoagulation therapy that leaves patients at 5-fold increased stroke risk; false AFib detection generates unnecessary anticoagulation prescriptions (warfarin, apixaban, rivaroxaban) with direct bleeding risk. The second attack boundary is at the downstream EHR integration point where wearable ECG data is transmitted to clinical care management platforms; at this boundary, the wearable manufacturer’s on-device AI has already made a classification, but the ECG waveform image and classification output are further processed by hospital AI systems that aggregate wearable data with other clinical signals. iRhythm’s Zio XT Patch, an FDA-cleared Class II continuous ECG monitoring device that patients wear for up to 14 days, transmits its recorded ECG data to iRhythm’s cloud AI analysis platform — the highest-stakes single ECG AI analysis pipeline by data volume (14 days of continuous recording) and clinical consequence (physician review of AI-analyzed long-term ECG is the basis for AFib treatment initiation or medication adjustment decisions that can change a patient’s stroke risk trajectory for years).

3. PPG photoplethysmography vitals AI injection (Garmin Health AI, Fitbit/Google Health AI, WHOOP AI, Biofourmis RPM)

Photoplethysmography (PPG) sensors in consumer wearables measure blood volume changes through optical detection of reflected or transmitted light at the skin surface, generating a pulse wave signal from which AI algorithms derive resting heart rate, heart rate variability (HRV), blood oxygen saturation (SpO2), respiratory rate, and stress index. When submitted to cloud-based AI analysis, the PPG raw signal is typically rendered as a visualization — pulse wave charts, HRV time-domain and frequency-domain spectrograms, SpO2 trend graphs, respiratory rate pattern visualizations — that forms the input to pattern recognition AI models on cloud platforms. Fitbit Premium’s Wellness Report, Garmin Health API’s body battery and stress detection AI, and WHOOP Coach AI all process PPG-derived visualization data through AI models that generate health insights and behavioral recommendations that large user populations act on. Clinical RPM platforms that use consumer-grade or medical-grade PPG sensors — Current Health, Biofourmis BiovitalsHF for heart failure monitoring, Masimo’s SafetyNet hospital-at-home platform — apply AI to PPG visualization data to detect early signs of clinical deterioration (SpO2 decline, heart rate trajectory changes) that trigger physician review and intervention.

The adversarial attack against PPG vitals AI targets the rendered PPG visualization image at the cloud AI analysis ingestion boundary. Adversarial perturbations applied to SpO2 trend visualization images can suppress desaturation alerts in patients with nocturnal hypoxemia (sleep apnea, COPD exacerbation, heart failure decompensation), where the RPM platform’s AI would normally generate a nurse notification for SpO2 below 90%. For hospital-at-home programs where Biofourmis BiovitalsHF and similar platforms replace in-hospital monitoring for heart failure patients, adversarial suppression of SpO2 or heart rate variability deterioration signals delays physician notification of developing decompensation, potentially converting a manageable outpatient intervention into a hospitalization-requiring emergency. Masimo’s SafetyNet platform, which provides continuous pulse oximetry monitoring for COVID-19 patients and other acutely ill patients managed at home, processes SpO2 trend data through AI alert algorithms with direct consequence for emergency dispatch decisions. For consumer wellness AI platforms (Garmin, Fitbit, WHOOP), the adversarial attack consequence is less immediately life-threatening but creates regulatory exposure: FTC Act §5 unfair or deceptive practices claims have been brought against health AI wellness product makers whose AI outputs materially misrepresented health status, with FTC settlements including Luminary Labs, Noom, and multiple digital health wellness companies.

4. Fall detection and emergency response AI injection (Apple Watch, Samsung Galaxy, Medical Guardian, Bay Alarm Medical)

Fall detection AI in consumer wearables processes accelerometer and gyroscope sensor data — rendered as three-axis acceleration time-series visualizations and motion pattern images — to identify the characteristic impact signature and post-fall immobility pattern of a fall event, triggering automatic emergency calls to the wearer and emergency services if the wearer is immobile for 60 seconds after the detected fall. Apple Watch Fall Detection (available since Series 4) uses on-device AI to classify accelerometer event sequences as fall or non-fall, generating SOS alert with GPS location to Emergency Medical Services if the user does not dismiss the alert within 60 seconds. Samsung Galaxy Watch Active2 and subsequent Galaxy Watch models implement equivalent fall detection AI. Medical alert device companies — Medical Guardian, Bay Alarm Medical, Life Alert, GreatCall (Lively) — operate cloud-connected personal emergency response systems (PERS) where AI-assisted fall detection from wearable motion sensor data triggers dispatch center alerts. Hospital RPM programs monitoring elderly patients for fall risk use AI analysis of wearable accelerometer pattern visualizations to identify gait deterioration patterns predictive of fall events before falls occur.

The adversarial attack against fall detection AI targets the rendered accelerometer motion pattern visualization at the cloud AI intake boundary or at the PERS monitoring platform AI analysis stage. Adversarial perturbations applied to accelerometer pattern visualization images can cause the AI to suppress fall detection for motion sequences matching the fall signature — critical for elderly patients with fall risk who depend on the automatic SOS generation to summon emergency services because they cannot self-summon after a fall. The adversarial consequence in this context is patient abandonment: a patient who falls in their home, activates an automatic SOS under normal AI operation, but whose adversarially perturbed sensor data causes the fall detection AI to suppress the alert, may remain on the floor for hours without assistance — a documented cause of hypothermia, pressure sores, dehydration, and aspiration. The inverse attack — generating false fall detection events — imposes financial costs on medical alert dispatch operations ($50–$150 per false dispatch response) and erodes patient and family trust in the monitoring system. From an insurance fraud perspective, adversarial false fall detection generation in RPM contexts where fall events trigger higher-intensity monitoring service billing codes creates a direct fraudulent billing vector under the False Claims Act for Medicare- and Medicaid-reimbursed fall monitoring programs.

Integration: wearable health AI sensor visualization ingestion with Glyphward pre-scan

The Glyphward scan gate belongs at the sensor data visualization ingestion point in each wearable health AI pipeline — before the CGM trend chart, ECG waveform image, PPG signal visualization, or accelerometer motion pattern chart is passed to the AI analysis engine. The async pattern below handles all four wearable health AI contexts through a shared scan_wearable_ai_image function, with patient-safety-calibrated thresholds and structured audit output suitable for FDA SaMD Cybersecurity Guidance evidence and HIPAA §164.312 audit control requirements.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Per-context thresholds reflecting wearable health AI patient-safety severity
CGM_DOSING_THRESHOLD      = 50  # Dexcom / Abbott / Medtronic CGM dosing AI
ECG_CARDIAC_THRESHOLD     = 50  # Apple Watch / Samsung Galaxy / iRhythm Zio ECG AI
PPG_VITALS_THRESHOLD      = 55  # Garmin / Fitbit / WHOOP / Biofourmis RPM AI
FALL_DETECTION_THRESHOLD  = 55  # Apple Watch Fall / Medical Guardian / Bay Alarm AI


class WearableHealthAIContext(Enum):
    CGM_DOSING     = "cgm_dosing"     # threshold 50
    ECG_CARDIAC    = "ecg_cardiac"    # threshold 50
    PPG_VITALS     = "ppg_vitals"     # threshold 55
    FALL_DETECTION = "fall_detection" # threshold 55


_CONTEXT_THRESHOLDS: dict[WearableHealthAIContext, int] = {
    WearableHealthAIContext.CGM_DOSING:     CGM_DOSING_THRESHOLD,
    WearableHealthAIContext.ECG_CARDIAC:    ECG_CARDIAC_THRESHOLD,
    WearableHealthAIContext.PPG_VITALS:     PPG_VITALS_THRESHOLD,
    WearableHealthAIContext.FALL_DETECTION: FALL_DETECTION_THRESHOLD,
}


class AdversarialWearableAIImageError(Exception):
    """Raised when Glyphward detects adversarial pixel content in a
    wearable health AI sensor visualization image above the context threshold.

    Attributes:
        scan_id: Glyphward scan identifier for the audit record.
        score: Adversarial signal score (0-100).
        context: The WearableHealthAIContext in which detection occurred.
        flagged_region: Optional dict describing the flagged pixel region.
    """

    def __init__(
        self,
        scan_id: str,
        score: int,
        context: WearableHealthAIContext,
        flagged_region: dict | None = None,
    ) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial wearable health AI image detected: "
            f"context={context.value} score={score} scan_id={scan_id}"
        )


async def scan_wearable_ai_image(
    image_path: Path,
    context: WearableHealthAIContext,
    user_id_hash: str,
    device_serial_hash: str,
    recording_ts: str,
    client: httpx.AsyncClient,
) -> dict:
    """Scan a wearable health AI sensor visualization for adversarial pixel content.

    Args:
        image_path: Absolute path to the sensor visualization image.
        context: WearableHealthAIContext enum value identifying the AI pipeline.
        user_id_hash: SHA-256 hash of user account ID (not the ID itself — HIPAA).
        device_serial_hash: SHA-256 hash of device serial number.
        recording_ts: ISO 8601 timestamp of sensor recording start.
        client: Shared httpx.AsyncClient for connection reuse.

    Returns:
        Glyphward scan result dict: scan_id, score, flagged_region, modality.

    Raises:
        AdversarialWearableAIImageError: if score exceeds context threshold.
        httpx.HTTPStatusError: on Glyphward API errors (fail-closed: do not pass image).
    """
    threshold = _CONTEXT_THRESHOLDS[context]
    image_bytes = image_path.read_bytes()
    image_hash = hashlib.sha256(image_bytes).hexdigest()

    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"wearable:{context.value}:{recording_ts}",
        "metadata": {
            "user_id_hash": user_id_hash,
            "device_serial_hash": device_serial_hash,
            "recording_ts": recording_ts,
            "image_sha256": image_hash,
        },
    }

    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=5.0,
    )
    resp.raise_for_status()
    result = resp.json()

    await write_wearable_scan_audit(
        image_hash=image_hash,
        scan_id=result["scan_id"],
        score=result["score"],
        context=context,
        threshold=threshold,
        user_id_hash=user_id_hash,
        device_serial_hash=device_serial_hash,
        recording_ts=recording_ts,
        flagged=result["score"] > threshold,
    )

    if result["score"] > threshold:
        raise AdversarialWearableAIImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            flagged_region=result.get("flagged_region"),
        )

    return result


async def write_wearable_scan_audit(
    *,
    image_hash: str,
    scan_id: str,
    score: int,
    context: WearableHealthAIContext,
    threshold: int,
    user_id_hash: str,
    device_serial_hash: str,
    recording_ts: str,
    flagged: bool,
) -> None:
    """Append structured JSON audit record to wearable health AI scan log.

    Satisfies HIPAA §164.312(b) audit controls and FDA SaMD Cybersecurity
    Guidance adversarial input detection evidence requirements.
    Hashed IDs avoid PHI in the scan log itself.
    """
    record = {
        "ts": datetime.now(timezone.utc).isoformat(),
        "scan_id": scan_id,
        "image_sha256": image_hash,
        "context": context.value,
        "score": score,
        "threshold": threshold,
        "flagged": flagged,
        "user_id_hash": user_id_hash,
        "device_serial_hash": device_serial_hash,
        "recording_ts": recording_ts,
    }
    audit_path = Path("/var/log/glyphward/wearable_ai_scan_audit.jsonl")
    audit_path.parent.mkdir(parents=True, exist_ok=True)
    with audit_path.open("a") as fh:
        fh.write(json.dumps(record) + "\n")


async def process_wearable_image_batch(
    images: list[tuple[Path, WearableHealthAIContext, str, str, str]],
) -> list[dict]:
    """Process a batch of (path, context, user_hash, device_hash, ts) tuples."""
    async with httpx.AsyncClient() as client:
        tasks = [
            scan_wearable_ai_image(
                image_path=path,
                context=ctx,
                user_id_hash=uid,
                device_serial_hash=dsh,
                recording_ts=ts,
                client=client,
            )
            for path, ctx, uid, dsh, ts in images
        ]
        results = []
        for coro in asyncio.as_completed(tasks):
            try:
                results.append(await coro)
            except AdversarialWearableAIImageError as exc:
                results.append({
                    "status": "quarantined",
                    "context": exc.context.value,
                    "scan_id": exc.scan_id,
                    "score": exc.score,
                    "flagged_region": exc.flagged_region,
                })
        return results

Deploy scan_wearable_ai_image at the sensor visualization ingestion boundary: before the CGM trend chart reaches Dexcom Clarity AI or closed-loop dosing AI; before the ECG waveform image reaches iRhythm Zio AI or Apple Health ECG integration AI; before the PPG SpO2 trend visualization reaches Biofourmis BiovitalsHF or Masimo SafetyNet alert AI; and before the accelerometer motion pattern image reaches fall detection AI in PERS or RPM platforms. Get early access

Coverage matrix

Related questions

Further reading

• Prompt injection in telehealth and remote patient monitoring AI — clinical context and CMS RPM billing
• HIPAA-compliant AI security — §164.312 audit controls for medical wearable data pipelines
• Multimodal prompt injection in healthcare imaging AI — FDA SaMD cybersecurity guidance
• Prompt injection in mental health and digital health AI — behavioral health monitoring pipelines
• Prompt injection scanning API free tier — 10 scans/day, no card required