FROM PIXELS TO PROMPTS: A STRUCTURED NARRATIVE REVIEW OF SECURITY, PRIVACY, AND ADVERSARIAL ROBUSTNESS IN HEALTHCARE AI
DOI:
https://doi.org/10.31435/ijitss.4(52).2026.6340Keywords:
Adversarial Machine Learning, Healthcare Artificial Intelligence, Medical Image Analysis, Data Poisoning, Adversarial RobustnessAbstract
Artificial intelligence (AI) is increasingly used in healthcare, where evaluations usually ask whether a system is accurate on ordinary clinical data. This review asks instead what can happen when someone deliberately changes the data, instructions, or training to make a system fail, behave in hidden ways, or reveal confidential information, a field known as adversarial machine learning.
We reviewed 113 publications (2018–2026) and grouped the reported threats into six categories: altering an input after training; corrupting the training examples; teaching a hidden rule triggered later; using the model to learn private information; placing malicious instructions in language or image-and-language models; and attacking models trained jointly across hospitals or devices.
Laboratory studies showed that small deliberate changes to medical images could alter a diagnosis or a model's outline, corrupted training data could change what a model learned, and malicious prompts could produce unsafe medical responses. Effect sizes varied greatly across models, datasets, attacks, and test conditions. Several defenses helped in individual experiments, but no single defense was shown to work across all threats and settings; in one imaging study, attacks tailored to the tested defenses bypassed all five.
The studies do not show how often these attacks occur in practice or harm patients; their value is to demonstrate possible failure modes under controlled conditions. Medical AI should therefore be evaluated both on ordinary clinical data and in clearly described, clinically plausible attack scenarios.
References
Abd El-Aziz, A. A., El-Khoribi, R. A., & Khalifa, N. E. M. (2026). Adversarial threats in health care: A comprehensive analysis of vulnerabilities, defense mechanisms, and recent research. In Next-gen healthcare: AI-powered medical innovations (pp. 3–39). Springer Nature. https://doi.org/10.1007/978-3-032-07267-2_1
Abtahi, F., Seoane, F., Pau, I., & Vega-Barbas, M. (2026). Data poisoning vulnerabilities across health care artificial intelligence architectures: Analytical security framework and defense strategies. Journal of Medical Internet Research, 28, e87969. https://doi.org/10.2196/87969
Ahmed, U., Lin, J. C. W., & Srivastava, G. (2022). Mitigating adversarial evasion attacks by deep active learning for medical image classification. Multimedia Tools and Applications, 81(29), 41899–41910. https://doi.org/10.1007/s11042-021-11473-z
Akhtom, D., Singh, M. M., & Xinying, C. (2024). Unveiling hidden variables in adversarial attack transferability on pre-trained models for COVID-19 diagnosis. International Journal of Advanced Computer Science and Applications, 15(11), 1343–1350. https://doi.org/10.14569/ijacsa.2024.01511131
Akinci D’Antonoli, T., Tejani, A. S., Khosravi, B., Bluethgen, C., Busch, F., Bressem, K. K., Adams, L. C., Moassefi, M., Faghani, S., & Gichoya, J. W. (2025). Cybersecurity threats and mitigation strategies for large language models in health care. Radiology: Artificial Intelligence, 7(4), Article e240739. https://doi.org/10.1148/ryai.240739
Al-Dhabyani, W. (2026). Data privacy and security in large language models for medical fields. In Next-gen healthcare: AI-powered medical innovations (pp. 175–197). Springer Nature. https://doi.org/10.1007/978-3-032-07267-2_7
Albattah, A., & Rassam, M. A. (2023). Detection of adversarial attacks against the hybrid convolutional long short-term memory deep learning technique for healthcare monitoring applications. Applied Sciences, 13(11), Article 6807. https://doi.org/10.3390/app13116807
Alber, D. A., Yang, Z., Alyakin, A., Yang, E., Rai, S., Valliani, A. A., Zhang, J., Rosenbaum, G. R., Amend-Thomas, A. K., Kurland, D. B., Kremer, C. M., Eremiev, A., Negash, B., Wiggan, D. D., Nakatsuka, M. A., Sangwon, K. L., Neifert, S. N., Khan, H. A., Save, A. V., … Oermann, E. K. (2025). Medical large language models are vulnerable to data-poisoning attacks. Nature Medicine, 31(2), 618–626. https://doi.org/10.1038/s41591-024-03445-1
Alissa, K. A. (2026). A survey on privacy issues and mitigation strategies for LLMs in healthcare. The Journal of Supercomputing, 82(1), Article 26. https://doi.org/10.1007/s11227-025-08146-1
Allyn, J., Allou, N., Vidal, C., Renou, A., & Ferdynus, C. (2020). Adversarial attack on deep learning-based dermatoscopic image recognition systems: Risk of misdiagnosis due to undetectable image perturbations. Medicine, 99(50), Article e23568. https://doi.org/10.1097/md.0000000000023568
An, S., Xiao, C., Stewart, W. F., & Sun, J. M. (2019). LAVA: Longitudinal adversarial attack on electronic health records data. In The World Wide Web Conference (WWW 2019). Association for Computing Machinery.
Anand, D., Tank, D., Tibrewal, H., & Sethi, A. (2020). Self-supervision vs. transfer learning: Robust biomedical image analysis against adversarial attacks. In 2020 IEEE 17th International Symposium on Biomedical Imaging (ISBI 2020). IEEE.
Apostolidis, K. D., & Papakostas, G. A. (2021). A survey on adversarial deep learning robustness in medical image analysis. Electronics, 10(17), Article 2132. https://doi.org/10.3390/electronics10172132
Aroua, R., Kammoun, I., Louati, M. A., Adjeroh, D. A., & Duan, T. (2026). Recent advances in defending the privacy attacks of large language models for healthcare applications: A concise review. Frontiers in Artificial Intelligence, 9, Article 1816692. https://doi.org/10.3389/frai.2026.1816692
Ayensu, F., Turner, C., & Osunmakinde, I. (2025). Enhancing federated learning security with a defense framework against adversarial attacks in privacy-sensitive healthcare applications. International Journal of Advanced Computer Science and Applications, 16(5), 1–13. https://doi.org/10.14569/IJACSA.2025.0160501
Chen, L., Chen, Y., Ouyang, Z., Dou, H., Zhang, Y., & Sang, H. (2025). Boosting adversarial transferability in vision-language models via multimodal feature heterogeneity. Scientific Reports, 15(1), Article 7366. https://doi.org/10.1038/s41598-025-91802-6
Chen, L., Zhao, L., & Chen, C. Y. (2021). Enhancing adversarial defense for medical image analysis systems with pruning and attention mechanism. Medical Physics, 48(10), 6198–6212. https://doi.org/10.1002/mp.15208
Chuang, Y. S., Sarkar, A. R., Hsu, Y. C., Mohammed, N., & Jiang, X. (2025). Robust privacy amidst innovation with large language models through a critical assessment of the risks. Journal of the American Medical Informatics Association, 32(5), 885–892. https://doi.org/10.1093/jamia/ocaf037
Clusmann, J., Ferber, D., Wiest, I. C., Schneider, C. V., Brinker, T. J., Foersch, S., Truhn, D., & Kather, J. N. (2025). Prompt injection attacks on vision language models in oncology. Nature Communications, 16(1), Article 1239. https://doi.org/10.1038/s41467-024-55631-x
Dao, B. T., Ma, V. D., Vu, T. A., Nguyen, H. T., Tran, K. P., & Truong, T. H. (2026). HyperShield: A personalized hypernetwork-based defense against poisoning attacks in federated learning for healthcare. Expert Systems with Applications, 299, Article 130237. https://doi.org/10.1016/j.eswa.2025.130237
Darzi, E., Dubost, F., Sijtsema, N. M., & van Ooijen, P. M. A. (2024). Exploring adversarial attacks in federated learning for medical imaging. IEEE Transactions on Industrial Informatics, 20(12), 13591–13599. https://doi.org/10.1109/tii.2024.3423457
Das, A., Tariq, A., Batalini, F., Dhara, B., & Banerjee, I. (2024). Exposing vulnerabilities in clinical LLMs through data poisoning attacks: Case study in breast cancer. AMIA Annual Symposium Proceedings, 2024, 339–348.
de Aguiar, E. J., Traina, C., Jr., & Traina, A. J. M. (2024). RADAR-MIX: How to uncover adversarial attacks in medical image analysis through explainability. In 2024 IEEE 37th International Symposium on Computer-Based Medical Systems (CBMS 2024). IEEE.
Dietrich, N., Gong, B., & Patlas, M. N. (2025). Adversarial artificial intelligence in radiology: Attacks, defenses, and future considerations. Diagnostic and Interventional Imaging, 106(11), 375–384. https://doi.org/10.1016/j.diii.2025.05.006
Dong, J., Chen, J., Xie, X., Lai, J., & Chen, H. (2024). Survey on adversarial attack and defense for medical image analysis: Methods and challenges. ACM Computing Surveys, 57(3), Article 79. https://doi.org/10.1145/3702638
El Azzouzi, M., Bellafqira, R., Coatrieux, G., Cuggia, M., & Bouzille, G. (2026). Recovering sensitive medical text in federated learning. Studies in Health Technology and Informatics, 336, 1466–1470. https://doi.org/10.3233/shti260452
Faraoun, H., Bellafqira, R., Coatrieux, G., & Kallas, K. (2026). A durable backdoor attack on medical imaging via federated learning. Studies in Health Technology and Informatics, 336, 600–604. https://doi.org/10.3233/shti260241
Ghaffari Laleh, N., Truhn, D., Veldhuizen, G. P., Han, T., van Treeck, M., Buelow, R. D., Langer, R., Dislich, B., Boor, P., Schulz, V., & Kather, J. N. (2022). Adversarial attacks and adversarial robustness in computational pathology. Nature Communications, 13(1), Article 5711. https://doi.org/10.1038/s41467-022-33266-0
Güler, I., Kraus, A., Grieb, G., Satir, T., Eberz, P., & Stelling, H. (2026). AI in dermato-oncology: Diagnostic performance and prompt-injection vulnerability of vision-language models in dermoscopic skin cancer assessment. Cancers, 18(11), Article 1750. https://doi.org/10.3390/cancers18111750
Hanif, A., Shamshad, F., Awais, M., Naseer, M., Khan, F. S., Nandakumar, K., Khan, S., & Anwer, R. M. (2024). BAPLe: Backdoor attacks on medical foundational models using prompt learning. In Medical image computing and computer assisted intervention – MICCAI 2024 (Part XII). Springer.
Harada, Y. (2026). Robustness of a large language model (LLM)-based virtual patient for Japanese history-taking training under direct and indirect instructional contamination. Cureus, 18(5), Article e109161. https://doi.org/10.7759/cureus.109161
He, Y. M., Pang, S. C., Du, A. N., Chen, H. C., Cong, L. L., & Orgun, M. M. (2024). ADDM: Adversarial defenses with diffusion model for medical imaging data mining. In Advanced data mining and applications (ADMA 2024) (Part IV). Springer.
Hossain, K. F., Kamran, S. A., Tavakkoli, A., & Ma, X. J. (2022). ECG-ATK-GAN: Robustness against adversarial attacks on ECGs using conditional generative adversarial networks. In Applications of medical artificial intelligence (AMAI 2022). Springer.
Huang, X. J., Wang, X. Y., Zhang, H. T., Zhu, Y. H., Xi, J. W., An, J. K., Wang, H., Liang, H., & Pan, C. W. (2025). Medical MLLM is vulnerable: Cross-modality jailbreak and mismatched attacks on medical multimodal large language models. In Proceedings of the 39th AAAI Conference on Artificial Intelligence (AAAI-25) (Vol. 39, No. 4). AAAI Press.
Imam, N. H. (2024). Adversarial examples on XAI-enabled digital twin for smart healthcare systems. Sensors, 24(21), Article 6891. https://doi.org/10.3390/s24216891
Jeribi, F., Tahir, A., Alsabi, K. H., Ramakrishnan, J., & Rana, N. (2025). Defense against adversarial attack on medical imaging. In AI revolution: Research, ethics and society (AIR-RES 2025) (Part II). Springer.
Jin, R., & Li, X. (2023). Backdoor attack and defense in federated generative adversarial network-based medical image synthesis. Medical Image Analysis, 90, Article 102965. https://doi.org/10.1016/j.media.2023.102965
Joe, B., Park, Y., Hamm, J., Shin, I., & Lee, J. (2022). Exploiting missing value patterns for a backdoor attack on machine learning models of electronic health records: Development and validation study. JMIR Medical Informatics, 10(8), Article e38440. https://doi.org/10.2196/38440
Joseph, N., George, S. N., Ameer, P. M., & Raja, K. (2026). Securing medical AI: Adversarial attack detection and mitigation in CAD systems. IEEE Transactions on Emerging Topics in Computational Intelligence. Advance online publication. https://doi.org/10.1109/tetci.2026.3692606
Joseph, N., Jeffrey, D., George, S. N., Ameer, P. M., & Raja, K. (2026). Stealth-black-box attack on Industry 4.0 medical AI: A low-rank perturbation approach. IEEE Transactions on Industrial Informatics, 22(3), 2458–2468. https://doi.org/10.1109/tii.2025.3640725
Joshi, S., Mehta, M. A., Mendoza, M., Rivera, Y. M., & Singh, V. K. (2026). Differences in safety risks across languages in health-relevant queries: Vulnerability analysis of large language model responses. JMIR Formative Research, 10, Article e87465. https://doi.org/10.2196/87465
Kalpana, R. N. L. S., Patro, A. K., & Rao, D. N. (2025). Survey on robustness of deep learning techniques on adversarial attacks in WBAN. In Lecture notes in electrical engineering. Springer.
Kaviani, S., Han, K. J., & Sohn, I. (2022). Adversarial attacks and defenses on AI in medical imaging informatics: A survey. Expert Systems with Applications, 198, Article 116815. https://doi.org/10.1016/j.eswa.2022.116815
Kishan, K., & Kumar, B. V. (2026). Adversarial attack detection in secure medical images using deep learning. Information Security Journal: A Global Perspective, 35(4), 601–615. https://doi.org/10.1080/19393555.2025.2547206
Krall, A., Finke, D., & Yang, H. (2020). Gradient mechanism to preserve differential privacy and deter against model inversion attacks in healthcare analytics. In 42nd Annual International Conference of the IEEE Engineering in Medicine and Biology Society (EMBC’20). IEEE.
Krzton, K., Kolodziej, J., Widlak, A., Nawrocki, M., & Sigut, J. (2025). Vulnerabilities of machine learning algorithms to adversarial attacks in medical images. In Proceedings of the 39th ECMS International Conference on Modeling and Simulation (ECMS 2025). European Council for Modeling and Simulation.
Kwon, H., & Jeong, J. (2022). AdvU-Net: Generating adversarial example based on medical image and targeting U-Net model. Journal of Sensors, 2022, Article 4390413. https://doi.org/10.1155/2022/4390413
Lee, R. W., Jun, T. J., Lee, J. M., Cho, S. I., Park, H. J., & Suh, J. (2025). Vulnerability of large language models to prompt injection when providing medical advice. JAMA Network Open, 8(12), Article e2549963. https://doi.org/10.1001/jamanetworkopen.2025.49963
Lee, S. B. (2025). Gradual poisoning of a chest x-ray convolutional neural network with an adversarial attack and AI explainability methods. Scientific Reports, 15(1), Article 21779. https://doi.org/10.1038/s41598-025-02294-3
Levy, M., Amit, G., Elovici, Y., & Mirsky, Y. (2024). The security of deep learning defenses in medical imaging. In Proceedings of the 2024 Workshop on Cybersecurity in Healthcare (HealthSec 2024). Association for Computing Machinery.
Li, W., & Zainon, W. (2026). Dual adversarial attacks on explainable deep learning in medical image classification. Computer Methods and Programs in Biomedicine, 273, Article 109125. https://doi.org/10.1016/j.cmpb.2025.109125
Li, W. Y., Zhang, Z., Lan, X. Y., & Wang, Y. W. (2025). Untargeted closed-box attack against healthcare image retrieval via rank manipulation. IEEE Transactions on Consumer Electronics, 71(2), 4544–4555. https://doi.org/10.1109/tce.2025.3559103
Li, X., & Zhu, D. X. (2020). Robust detection of adversarial attacks on medical images. In 2020 IEEE 17th International Symposium on Biomedical Imaging (ISBI 2020). IEEE.
Liyanage, S., Weerawardhane, V., Kheminda, J., Siriwardhana, Y., Weerasinghe, T., & Liyanage, M. (2025). SecFLH: Defending federated learning-based IoT health prediction systems against poisoning attacks. In 2025 Joint European Conference on Networks and Communications & 6G Summit (EuCNC/6G Summit). IEEE.
Lourdu Mahimai Doss, P., Gunasekaran, M., Padmakala, S., Samikannu, R., Yahya, A., Badruddin, I. A., Kamangar, S., & Rohini, R. (2026). Invisible poison attacks and holistic defense strategy for pyramid vision transformers in medical imaging. Scientific Reports. Advance online publication. https://doi.org/10.1038/s41598-026-58050-8
Lu, Z. M., Xu, N., Tian, H. S., Wang, L. J., & Liu, A. A. (2026). Medical VLP model is vulnerable: Toward multimodal adversarial attack on large medical vision-language models. IEEE Transactions on Circuits and Systems for Video Technology, 36(2), 2478–2491. https://doi.org/10.1109/tcsvt.2025.3602970
Ma, X. J., Niu, Y. H., Gu, L., Wang, Y., Zhao, Y. T., Bailey, J., & Lu, F. (2021). Understanding adversarial attacks on deep learning based medical image analysis systems. Pattern Recognition, 110, Article 107332. https://doi.org/10.1016/j.patcog.2020.107332
Mali, B., Singh, P. K., & Mazumdar, N. (2024). SAFe-Health: Guarding federated learning-driven smart healthcare with federated defense averaging against data poisoning. Security and Privacy, 7(5), Article e403. https://doi.org/10.1002/spy2.403
Malik, A., Qaisar, S. M., Khan, M. Z., Khan, M. N., Aldhyani, T. H. H., & Alsisi, R. H. (2026). An efficient framework for detecting model inversion attacks in connected healthcare systems. IEEE Transactions on Consumer Electronics, 72(2), 4528–4539. https://doi.org/10.1109/tce.2026.3658570
Menon, K., Bohra, V. K., Murugan, L., Jaganathan, K., & Arumugam, C. (2021). COVID-19 diagnosis from chest X-ray images using convolutional neural networks and effects of data poisoning. In Computational science and its applications (ICCSA 2021) (Part IX). Springer.
Mithsara, W. K. M., Shahid, A. R., & Yang, N. (2024). Zero-shot detection and sanitization of data poisoning attacks in wearable AI using large language models. In 2024 International Conference on Machine Learning and Applications (ICMLA). IEEE.
Mohammed, T. J., Xinying, C., Albahri, A. S., Alnoor, A., & Wah, K. K. (2025). A novel trusted framework for orthopedic disease detection with reliability against adversarial attacks. IEEE Access, 13, 160193–160220. https://doi.org/10.1109/access.2025.3609330
Mondal, I. (2021). BBAEG: Towards BERT-based biomedical adversarial example generation for text classification. In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL-HLT 2021). Association for Computational Linguistics.
Mondillo, G., Colosimo, S., Perrotta, A., Frattolillo, V., Indolfi, C., del Giudice, M. M., & Rossi, F. (2025). Jailbreaking large language models: Navigating the crossroads of innovation, ethics, and health risks. Journal of Medical Artificial Intelligence, 8, Article 6. https://doi.org/10.21037/jmai-24-170
Muoka, G. W., Yi, D., Ukwuoma, C. C., Mutale, A., Ejiyi, C. J., Mzee, A. K., Gyarteng, E. S. A., Alqahtani, A., & Al-antari, M. A. (2023). A comprehensive review and analysis of deep learning-based medical image adversarial attack and defense. Mathematics, 11(20), Article 4272. https://doi.org/10.3390/math11204272
Neethunath, M. R., Gladston, R. S., & Pradeepan, P. (2025). Adversarial robustness of deep learning in medical imaging: A comprehensive survey and benchmark of state-of-the-art architectures. International Journal of Advanced Computer Science and Applications, 16(12), 831–841. https://doi.org/10.14569/IJACSA.2025.0161278
Newaz, A., Haque, N. I., Sikder, A. K., Rahman, M. A., & Uluagac, A. S. (2020). Adversarial attacks to machine learning-based smart healthcare systems. In 2020 IEEE Global Communications Conference (GLOBECOM). IEEE.
Nikolaidis, C. C., & Efraimidis, P. S. (2025). A study of membership inference attacks on a federated health care application. Computing, 107(7), Article 149. https://doi.org/10.1007/s00607-025-01507-x
Ozbulak, U., Van Messem, A., & De Neve, W. (2019). Impact of adversarial examples on deep learning models for biomedical image segmentation. In Medical image computing and computer assisted intervention – MICCAI 2019 (Part II). Springer.
Pal, S., Rahman, S., Beheshti, M., Habib, A., Jadidi, Z., & Karmakar, C. (2024). The impact of simultaneous adversarial attacks on robustness of medical image analysis. IEEE Access, 12, 66478–66494. https://doi.org/10.1109/access.2024.3396566
Papangelou, K., Sechidis, K., Weatherall, J., & Brown, G. (2019). Toward an understanding of adversarial examples in clinical trials. In Machine learning and knowledge discovery in databases (ECML PKDD 2018) (Part I). Springer.
Paracha, A., Arshad, J., Ben Farah, M., & Ismail, K. (2024). Exploring data poisoning attacks against adversarially trained skin cancer diagnostics. In 2024 IEEE/ACM 17th International Conference on Utility and Cloud Computing (UCC). IEEE.
Paschali, M., Conjeti, S., Navarro, F., & Navab, N. (2018). Generalizability vs. robustness: Investigating medical imaging networks using adversarial examples. In Medical image computing and computer assisted intervention – MICCAI 2018 (Part I). Springer.
Paul, W., Cao, Y. Z., Zhang, M. M., & Burlina, P. (2021). Defending medical image diagnostics against privacy attacks using generative methods: Application to retinal diagnostics. In Clinical image-based procedures, distributed and collaborative learning, artificial intelligence for combating COVID-19 and secure and privacy-preserving machine learning (CLIP 2021, DCL 2021, LL-COVID19 2021, PPML 2021). Springer.
Pedarla, L. P., Zhang, X. Y., Zhao, L., & Khan, H. (2023). Evaluation of query-based membership inference attack on the medical data. In Proceedings of the 2023 ACM Southeast Conference (ACMSE 2023). Association for Computing Machinery.
Pipal, A. K., & Kannan, R. J. (2026). Graph attention layer-based WideResNet for efficient adversarial attack detection in wireless body area networks. Information Security Journal: A Global Perspective, 35(1), 203–217. https://doi.org/10.1080/19393555.2025.2493102
Qayyum, A., Qadir, J., Bilal, M., & Al-Fuqaha, A. (2021). Secure and robust machine learning for healthcare: A survey. IEEE Reviews in Biomedical Engineering, 14, 156–180. https://doi.org/10.1109/RBME.2020.3013489
Rahman, A., Hossain, M. S., Alrajeh, N. A., & Alsolami, F. (2021). Adversarial examples: Security threats to COVID-19 deep learning systems in medical IoT devices. IEEE Internet of Things Journal, 8(12), 9603–9610. https://doi.org/10.1109/jiot.2020.3013710
Rahman, S., Pal, S., Fallah, A., Doss, R., & Karmakar, C. (2025). RAD-IoMT: Robust adversarial defense mechanisms for IoMT medical image analysis. Ad Hoc Networks, 178, Article 103935. https://doi.org/10.1016/j.adhoc.2025.103935
Roth, H. R., Hatamizadeh, A., Xu, Z. Y., Zhao, C., Li, W. Q., Myronenko, A., & Xu, D. G. (2022). Split-U-Net: Preventing data leakage in split learning for collaborative multi-modal brain tumor segmentation. In Distributed, collaborative, and federated learning, and affordable AI and healthcare for resource diverse global health (DeCaF 2022, FAIR 2022). Springer.
Sahay, R., Lakshmi, L., Sai, P. V. J., Althobaiti, M. M., Salhi, A., Khan, M. I., & Ismoilov, M. (2026). Trust-centric mitigation of time-warping adversarial attacks in wearable sensor platforms. IEEE Transactions on Consumer Electronics, 72(2), 4932–4946. https://doi.org/10.1109/tce.2026.3681806
Sheikh, B. U. H., & Zafar, A. (2023). Untargeted white-box adversarial attack to break into deep learning based COVID-19 monitoring face mask detection system. Multimedia Tools and Applications. Advance online publication. https://doi.org/10.1007/s11042-023-15405-x
Shi, S. H., Haque, M. S., Parida, A., Zhang, C. Y., Linguraru, M. G., Hou, Y. T., Anwar, S. M., & Lou, W. J. (2025). MedLeak: Multimodal medical data leakage in secure federated learning with crafted models. In 2025 IEEE/ACM Conference on Connected Health: Applications, Systems and Engineering Technologies (CHASE). IEEE.
Singh, A., Singh, M. P., & Singh, A. K. (2025). Adversarially enhanced learning (AEL): Robust lightweight deep learning approach for radiology image classification against adversarial attacks. Image and Vision Computing, 154, Article 105405. https://doi.org/10.1016/j.imavis.2024.105405
Singkorapoom, P., & Phoomvuthisarn, S. (2023). Pre-trained model robustness against GAN-based poisoning attack in medical imaging analysis. In Artificial intelligence applications and innovations (AIAI 2023) (Part I). Springer.
Sipola, T., & Kokkonen, T. (2021). One-pixel attacks against medical imaging: A conceptual framework. In Trends and applications in information systems and technologies (WorldCIST 2021) (Vol. 1). Springer.
Sorin, V., Soffer, S., Glicksberg, B. S., Barash, Y., Konen, E., & Klang, E. (2023). Adversarial attacks in radiology: A systematic review. European Journal of Radiology, 167, Article 111085. https://doi.org/10.1016/j.ejrad.2023.111085
Soulb, H., Guelzim, I., Hirchoua, B., & Nait-Charif, H. (2025). Evaluating the robustness in federated learning for medical imaging. In 2025 6th International Conference on Data Analytics for Business and Industry (ICDABI 2025). IEEE.
Subbanna, N., Wilms, M., Tuladhar, A., & Forkert, N. D. (2021). An analysis of the vulnerability of two common deep learning-based medical image segmentation techniques to model inversion attacks. Sensors, 21(11), Article 3874. https://doi.org/10.3390/s21113874
Sun, L., Tian, J., & Muhammad, G. (2024). FedKC: Personalized federated learning with robustness against model poisoning attacks in the metaverse for consumer health. IEEE Transactions on Consumer Electronics, 70(3), 5644–5653. https://doi.org/10.1109/tce.2024.3386932
Sun, M. Y., Tang, F. Y., Yi, J. F., Wang, F., & Zhou, J. Y. (2018). Identify susceptible locations in medical records via adversarial attacks on deep predictive models. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining (KDD’18). Association for Computing Machinery.
Surekha, M., Sagar, A. K., & Khemchandani, V. (2024). Adversarial attack and defense mechanisms in medical imaging: A comprehensive review. In Proceedings – International Conference on Computing, Power, and Communication Technologies (IC2PCT 2024). IEEE.
Surekha, M., Sagar, A. K., & Khemchandani, V. (2025). Robustness against adversarial attacks through a hybrid defense approach in medical imaging. Electrica, 25(1), Article 0127. https://doi.org/10.5152/electrica.2025.25127
Tajak, W., Nurzynska, K., & Piórkowski, A. (2025). Vulnerability to one-pixel attacks of neural network architectures in medical image classification. Bio-Algorithms and Med-Systems, 21(1), 58–70. https://doi.org/10.5604/01.3001.0055.3261
Thota, P., Veerla, J. P., Guttikonda, P. S., Nasr, M. S., Nilizadeh, S., & Luber, J. M. (2024). Demonstration of an adversarial attack against a multimodal vision language model for pathology imaging. In 2024 IEEE International Symposium on Biomedical Imaging (ISBI 2024). IEEE.
Trabilsy, M., Prabha, S., Gomez-Cabello, C. A., Haider, S. A., Genovese, A., Borna, S., Wood, N., Gopala, N., Tao, C., & Forte, A. J. (2025). The PIEE cycle: A structured framework for red teaming large language models in clinical decision-making. Bioengineering, 12(7), Article 706. https://doi.org/10.3390/bioengineering12070706
Tsai, M. J., Lee, Y. C., Lien, H. Y., & Liang, C. C. (2025). Adversarial defense for medical images. Electronics, 14(22), Article 4384. https://doi.org/10.3390/electronics14224384
Tsai, M. J., Lin, P. Y., & Lee, M. E. (2023). Adversarial attacks on medical image classification. Cancers, 15(17), Article 4228. https://doi.org/10.3390/cancers15174228
Ul Haque, S. B., Zafar, A., ul Haque, S. M., ul Haq, S. R., & Ahmad, M. (2025). Securing AI in healthcare: A three-layer defense to mitigate adversarial noise impact in radiology imaging. Biomedical Signal Processing and Control, 109, Article 107969. https://doi.org/10.1016/j.bspc.2025.107969
Ullah, F., Mostarda, L., Cacciagrano, D., Alenazi, M. J. F., Chen, C. M., & Kumari, S. (2025). Federated edge intelligence for enhanced security in consumer intermittent healthcare devices using adversarial examples. IEEE Transactions on Consumer Electronics, 71(2), 4574–4585. https://doi.org/10.1109/tce.2024.3511615
Vali, E., Alexandridis, G., & Stafylopatis, A. (2023). Adversarial attacks & detection on a deep learning-based digital pathology model. In 2023 IEEE International Conference on Acoustics, Speech, and Signal Processing Workshops (ICASSPW). IEEE.
Wang, J., Kim, B. G., Rani, S., Li, K. Q., & Lv, J. H. (2026). HealthGuard: Privacy-preserving framework for consumer healthcare devices against adversarial inference attacks. IEEE Transactions on Consumer Electronics, 72(1), 1465–1476. https://doi.org/10.1109/tce.2025.3649226
Wang, W. J., Tang, P. F., Xiong, L., & Jiang, X. Q. (2020). RADAR: Recurrent autoencoder based detector for adversarial examples on temporal EHR. In Machine learning and knowledge discovery in databases: Applied data science track (ECML PKDD 2020) (Part IV). Springer.
Xi, B. H., Li, S. F., Li, J. C., Liu, H., Liu, H., & Zhu, H. J. (2021). BatFL: Backdoor detection on federated learning in e-health. In 2021 IEEE/ACM 29th International Symposium on Quality of Service (IWQOS). IEEE.
Xu, T., Zhang, J., Wang, M., He, H. Y., & Zou, X. B. (2025). On the limits of uncertainty-aware fine-tuning for robust diabetic retinopathy screening. In Ophthalmic medical image analysis (OMIA 2025). Springer.
Yang, Y., Jin, Q., Huang, F., & Lu, Z. (2025). Adversarial prompt and fine-tuning attacks threaten medical large language models. Nature Communications, 16(1), Article 9011. https://doi.org/10.1038/s41467-025-64062-1
Yang, Z. Y., Chen, Y. Y., Sun, M. Y., & Zhang, Y. (2024). Inject backdoor in measured data to jeopardize full-stack medical image analysis system. In Medical image computing and computer assisted intervention – MICCAI 2024 (Part VII). Springer.
Yu, Q. K., Zhang, C., Jin, G. J., Huang, T. J., Zhou, W., Li, W. H., Jin, X. B., Huang, B., Zhao, Y. T., Yang, G., Lip, G. Y. H., Zheng, Y. L., Villavicencio, A., & Meng, Y. D. (2026). StealthMark: Harmless and stealthy ownership verification for medical segmentation via uncertainty-guided backdoors. IEEE Transactions on Image Processing, 35, 1290–1304. https://doi.org/10.1109/tip.2026.3655563
Zahra, N. A., & Chin, Z. (2026). Prompt injection is all you need: A systemic framework for evaluating healthcare misinformation in LLMs. In Artificial intelligence in healthcare (AIiH 2025) (Part I). Springer.
Zbrzezny, A. M., & Grzybowski, A. E. (2023). Deceptive tricks in artificial intelligence: Adversarial attacks in ophthalmology. Journal of Clinical Medicine, 12(9), Article 3266. https://doi.org/10.3390/jcm12093266
Zhang, C. H., & Bonomi, L. (2022). Mitigating membership inference in deep learning applications with high dimensional genomic data. In 2022 IEEE 10th International Conference on Healthcare Informatics (ICHI 2022). IEEE.
Zhang, H., Lou, Q., & Wang, Y. (2024). Towards safe AI clinicians: A comprehensive study on large language model jailbreaking in healthcare. AMIA Annual Symposium Proceedings, 2024, 1519–1528.
Zhang, Z., Yan, C., & Malin, B. A. (2022). Membership inference attacks against synthetic health data. Journal of Biomedical Informatics, 125, Article 103977. https://doi.org/10.1016/j.jbi.2021.103977
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Patryk Sielaff, Artur Brudek, Adrian Nowakowski, Hubert Piwar, Jan Pawłasek, Monika Lis, Karolina Hernik, Mateusz Sucharski, Ewa Kacynel
This work is licensed under a Creative Commons Attribution 4.0 International License.
All articles are published in open-access and licensed under a Creative Commons Attribution 4.0 International License (CC BY 4.0). Hence, authors retain copyright to the content of the articles.
CC BY 4.0 License allows content to be copied, adapted, displayed, distributed, re-published or otherwise re-used for any purpose including for adaptation and commercial use provided the content is attributed.
