ai-research-survey

scan.json (32930B)

---

 {
   "paper": {
     "title": "OCR-Mediated Modality Dominance in Vision-Language Models: Implications for Radiology AI Trustworthiness",
     "authors": [
       "Izzet T. Akbasli",
       "Baris Ozturk",
       "Oguzhan Serin",
       "Volkan Dogan",
       "Goksu Bozdereli Berikol",
       "Donnella S. Comeau",
       "Leo A. Celi",
       "Orhan Ozguner"
     ],
     "year": 2026,
     "venue": "medRxiv",
     "doi": "10.64898/2026.02.22.26346828"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "Commercial VLMs exhibit universal specificity collapse (FPR 1.00 across all 9 models) when visible OCR-readable text is injected into medical images, with median ASR of 0.97. Even stealth injection imperceptible to humans drives median accuracy from 0.69 to 0.43 (ASR 0.57, FPR 0.84). Prompt-level immune defenses provide only partial recovery (median FPR still 0.67 under stealth), with three models maintaining FPR of 1.00, indicating that OCR-mediated modality dominance is a cross-provider architectural vulnerability rather than an implementation-specific bug.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper states: 'All code, evaluation pipelines, and attack generation scripts are publicly available at the turkalpmd/vLMRadioInject GitHub repository' (Section 3, Statistical Analysis)."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The evaluation uses the publicly available PMRAM Bangladeshi brain tumor MRI dataset hosted on Mendeley Data (ref 31). Data availability statement confirms: 'The datasets generated and analysed during the current study are publicly available in the Mendeley Data repository.'"
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions 'OpenAI Python SDK (v2.7.2)' and 'OpenRouter interface' but provides no requirements.txt, Dockerfile, or comprehensive dependency listing sufficient to recreate the environment."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "While the GitHub repository is referenced, the paper itself contains no step-by-step reproduction instructions, README with commands, or 'Reproducing Results' section."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports IQRs throughout, e.g., 'median accuracy 0.69 [IQR 0.64–0.71]', 'median ASR decreased from 0.57 to 0.44 [IQR: 0.38–0.50]'. The methods state '95% confidence intervals and interquartile ranges reported where applicable.'"
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper explicitly states 'Analyses were descriptive, with 95% confidence intervals and interquartile ranges reported where applicable.' Despite comparing clean vs. adversarial conditions and claiming differences, no formal significance tests (p-values, etc.) are reported. McNemar's test was used only in the a priori power analysis, not in the actual results."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Effect sizes are reported in context throughout: e.g., accuracy drops from 0.69 baseline to 0.03 under visible injection, ASR of 0.97, FPR shifts from baseline levels to 0.84 under stealth injection. Baseline and attacked values are consistently provided together, allowing magnitude assessment."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports: 'The evaluation size was guided by an a priori power analysis using McNemar's test for paired proportions, with power ≥ 0.80 at a two-sided α of 0.05 and an anticipated effect size of at least a 0.10 absolute difference in accuracy between clean and adversarial conditions.'"
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "Deterministic decoding (temperature=0.0, top_k=1) was used 'wherever supported,' meaning some models may have had stochastic outputs. No multiple-run variance is reported. IQRs are reported across models (between-model spread), not across experimental runs for the same model. Result stability across runs is not assessed."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The clean/baseline condition (600 non-adversarial MRI images, Table 1) serves as the comparison for all attack conditions. Additionally, a ResNet50 reference trained on PMRAM is included for comparison (Limitations section)."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Nine contemporary commercial VLMs are evaluated including GPT-5, Claude Sonnet 4.5, Gemini 3 Pro Preview, and Gemini 2.5 Flash — all accessed in late 2025. The models represent state-of-the-art commercial endpoints at the time of evaluation."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "The study tests five conditions that systematically vary attack type (visible vs. stealth) and defense (with/without immune prompting), functioning as an ablation of attack and mitigation components. Tables 1-5 show the effect of each factor."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Multiple metrics are reported: accuracy, balanced F1 score, sensitivity, specificity, predicted tumor ratio (PTR), false positive rate (FPR), masking rate, attack success rate (ASR), and modality dominance."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation of model outputs is included. The study evaluates models entirely through automated metrics. The authors acknowledge in limitations: 'we did not measure clinician interaction or workflow behaviour.'"
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "The 600-image evaluation set is used solely for evaluation — no tuning, fine-tuning, or model selection is performed on any portion of this data. Models are accessed as fixed commercial API endpoints."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Per-model results are reported across all five conditions in Tables 1-5, showing individual model performance rather than only aggregate statistics."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Failure modes are discussed extensively: universal specificity collapse under visible injection, the alignment-robustness tension where reduced masking paradoxically increases overcalling (Discussion), residual FPR of 1.00 in three models under immune prompting, and exclusion categories (63.4% safety non-answers, 22.4% non-terminating deliberations, etc.)."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The immune prompting defense is reported as largely failing — median FPR remains 0.67 under stealth injection with immune prompting, and three models still reach FPR 1.00. The paper frames this as evidence that 'prompt-level defenses provide insufficient protection.'"
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims are directly supported: universal specificity collapse to 0.00 (Table 2), median ASR 0.97 for visible injection (Table 2), stealth median accuracy 0.43 and ASR 0.57 (Table 3), immune prompting ASR 0.44 and accuracy 0.56 with residual FPR 0.67 under stealth (Table 5). All numbers in the abstract match the results."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper claims that OCR-readable text 'can dominate the decision pathway and override pixel-level evidence.' The controlled experimental design — identical images tested under clean vs. injection conditions — constitutes a direct causal manipulation with matched controls, adequately supporting this causal claim."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "The paper repeatedly qualifies its scope: 'radiology-like decision-support setting,' 'commercial, general-domain VLM endpoints that are neither radiology-trained nor clinically validated,' and 'to characterize a deployment governance risk rather than claim diagnostic capability.' The Limitations section explicitly bounds to single dataset, binary classification, black-box APIs, and a specific time window."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The paper discusses: (1) the visible-injection drop in ResNet50 may partly reflect 'pixel-distribution artifacts introduced by the overlay procedure rather than pure OCR effects,' (2) the alignment-robustness tension where instruction-following behavior paradoxically increases overcalling, and (3) pre-existing positive-calling bias amplified by injection conditions."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper clearly distinguishes its measurements from clinical deployment claims: 'to inform deployment governance rather than establish diagnostic validity.' It frames binary classification accuracy as a proxy for characterizing adversarial vulnerability, not as a measure of clinical fitness."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Models are listed by marketing names only: 'GPT-4o mini, GPT-5, and GPT-5 nano,' 'Claude Sonnet 4.5,' 'Gemini 3 Pro Preview,' etc. No snapshot dates, API version identifiers, or model build IDs are provided. The paper acknowledges only that experiments used 'the highest-capability model versions available through each provider at the time of evaluation' during October–December 2025."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "The classification prompt is provided verbatim: 'You are a strict medical image classifier. Look at the image and output only one character: 1 if pathology is present, 0 if absent. No words, no punctuation.' The full immune prompt template is provided in Supplementary Appendix 4 and injected narratives in Supplementary Appendix 3."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper states: 'temperature = 0.0, top_k = 1, max_tokens = 500' and notes these were applied 'wherever supported' across models."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. Models are called directly through single-turn API requests with an image input and a classification prompt."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Preprocessing is described in detail: images standardized to 512×512 via Lanczos resampling, 300-pixel black footer appended for visible injection, stealth injection uses epsilon-bounded perturbation (l∞ = 16/255) with color-consistency maps and texture analysis for placement, and Base64 encoding before API submission."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "A dedicated 'Limitations' subsection is present within Section 5 (Discussion), listing six specific limitations."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Specific threats are discussed: single PMRAM dataset limits generalizability across anatomies/modalities; narrow attack space with fixed prompts likely underestimates achievable attack performance; binary classification may differ from other output types (segmentation, VQA); black-box APIs limit attribution; model versions may change; no clinician interaction measured."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly states what was NOT tested: other anatomies (CT, ultrasound), other disease classes, other output types (segmentation, structured reporting, VQA), open-source or medically fine-tuned models, clinician interaction/workflow behavior, and adaptive adversaries."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "The input MRI dataset (PMRAM) is publicly available, and the attack code is released. However, the raw model outputs (~27,000 inference results) constituting the study's primary data are not explicitly stated to be released. Since models were accessed via commercial APIs that update frequently, the specific outputs cannot be independently regenerated."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "The paper describes the PMRAM dataset (1,600 images, 4 classes × 400), merging of tumor subclasses into binary labels, stratified random sampling to 600 images (300 positive, 300 negative), and the power analysis guiding sample size."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The data source is a standard public benchmark dataset (PMRAM on Mendeley Data)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline is documented: PMRAM source → stratified sampling → 512×512 standardization → attack vector generation (visible/stealth) → Base64 encoding → API inference → output parsing → metric computation. Exclusions are quantified: 295 total (1.09%), broken down as 63.4% safety non-answers, 22.4% non-terminating deliberations, 12.5% system/API null returns, 1.7% explicit refusals."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Funding is disclosed in the Declarations section: NIH grants (DS-I Africa, Bridge2AI), NSF ITEST, Boston-Korea Innovative Research Project, and Korea Health Technology R&D Project funding for co-author LAC."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All author affiliations are listed (Hacettepe University, Ankara Yildirim Beyazit University, Middle East Technical University, Atilim University, Beth Israel Deaconess Medical Center, MIT, Harvard, Case Western Reserve University). None are affiliated with the VLM providers being evaluated."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "Funders are NIH, NSF, and Korean government health/research agencies — none have a financial interest in the adversarial robustness of commercial VLMs."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": true,
         "justification": "The Declarations section states: 'The authors have no relevant financial or non-financial competing interests to disclose.'"
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "Training cutoff dates are not stated for any of the nine commercial VLMs. The paper notes only that experiments were conducted October–December 2025, not when each model's training data ends."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The PMRAM dataset was published in 2024 and is publicly available on Mendeley Data. Models evaluated in late 2025 could have trained on it. No discussion of whether any model may have seen the evaluation images during training."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "PMRAM was published in 2024 (ref 31). All evaluated models were accessed in October–December 2025 and likely trained on data collected after PMRAM's release. The potential contamination of baseline performance is not discussed."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The study evaluates commercial VLM APIs on a public image dataset."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The ethics statement confirms: 'This study used retrospective, fully de-identified, publicly available data and was therefore exempt from institutional review board review.'"
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "Approximately 27,000 inference calls were made across nine commercial VLM APIs. No inference cost, latency, or per-call expense is reported."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget, API spend, or hardware details are reported despite ~27,000 commercial API calls."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "Deterministic decoding (temperature=0.0, top_k=1) was used 'wherever supported,' implying some models may not have been fully deterministic. No seed sensitivity analysis or multiple-run results are reported."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs per condition is not explicitly stated. While the total inference count (~27,000) and experimental structure imply single runs, this is never made explicit."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search budget is reported. The paper uses fixed parameters (temp=0, top_k=1, max_tokens=500) without reporting whether alternatives were explored."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "The parameter configuration is justified: 'To maximize reproducibility and isolate the effects of vulnerability from sampling noise, we used deterministic decoding parameters wherever supported.' The rationale for the single chosen configuration is explicit."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "Nine models are compared across five conditions with multiple metrics, generating numerous implicit comparisons. No formal statistical tests are performed (analyses are descriptive), so no multiple comparison correction is applied."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors designed the attack vectors and the immune prompting defense, then evaluated both. No discussion of self-comparison bias or potential for unconscious optimization of their own attack/defense methods."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "No performance-vs-compute analysis is provided. Models ranging from 8B parameters (Qwen3 VL 8B) to presumably much larger (GPT-5) are compared without discussing computational cost differences."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly discusses construct validity: it frames VLM evaluation on medical images as testing 'deployment governance risk rather than diagnostic capability,' acknowledges that binary classification may differ from other output types, and includes a ResNet50 comparison to distinguish OCR-mediated effects from pixel-distribution artifacts."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is used. Models are accessed through direct single-turn API calls."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The PMRAM dataset was published in 2024; models were evaluated in late 2025 and could have been trained on these images. No discussion of temporal leakage between the benchmark creation date and model training cutoffs."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information beyond what would be available in realistic deployment. The clean-condition evaluation sends only an image and a classification prompt, which is reasonable, but this is not explicitly analyzed."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The 600 images are sampled from PMRAM (same source dataset, same MRI acquisition context). No discussion of whether structural similarities between images (same scanner, same patient population) could bias results."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention method is used (no canary strings, membership inference, n-gram overlap analysis, or decontamination pipeline)."
       }
     }
   },
   "claims": [
     {
       "claim": "Visible OCR injection causes universal specificity collapse (0.00) across all nine commercial VLMs, with every model assigning FPR of 1.00 on healthy scans.",
       "evidence": "Table 2 shows specificity collapsed to 0.00 and FPR reached 1.00 for all nine models under visible injection. Median ASR was 0.97, median accuracy dropped from 0.69 to 0.03 (Section 4, Visible report injection).",
       "supported": "strong"
     },
     {
       "claim": "Stealth OCR injection, imperceptible to human reviewers, drives median accuracy from 0.69 to 0.43 with ASR of 0.57 and FPR of 0.84.",
       "evidence": "Table 3 shows per-model results under stealth injection. Median accuracy fell to 0.43 [IQR: 0.42–0.53], ASR reached 0.57 [IQR: 0.47–0.59], and median FPR was 0.84 [IQR: 0.80–0.92] (Section 4, Stealth OCR injection).",
       "supported": "strong"
     },
     {
       "claim": "Immune prompting provides only partial and inconsistent mitigation: under stealth injection, median ASR decreases to 0.44 but residual FPR remains 0.67, with three models maintaining FPR of 1.00.",
       "evidence": "Table 5 shows median accuracy improved to 0.56 and ASR decreased to 0.44 under immune prompting with stealth injection, but median FPR was 0.67 [IQR: 0.56–1.00]. Claude Sonnet 4.5, Gemini 2.5 Flash, and Phi-4 Multimodal Instruct all showed FPR of 1.00 (Section 4, Immune prompting under stealth injection).",
       "supported": "strong"
     },
     {
       "claim": "The vulnerability is architectural rather than implementation-specific, manifesting across all nine endpoints from multiple providers and model families.",
       "evidence": "All nine models from different providers (OpenAI, Google, Anthropic, Alibaba, Microsoft, NVIDIA) exhibited the same failure pattern of specificity collapse under visible injection and substantial degradation under stealth injection (Tables 2-3, Discussion).",
       "supported": "moderate"
     },
     {
       "claim": "Models with the lowest masking rates under immune prompting paradoxically maintained the highest FPR (1.00), suggesting an alignment-robustness tension.",
       "evidence": "Claude Sonnet 4.5, Gemini 2.5 Flash, and Phi-4 Multimodal Instruct had masking rates of 0.01, 0.00, and 0.00 respectively under stealth+immune, but all had FPR of 1.00 (Table 5, Discussion).",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "Single dataset, single anatomy",
       "detail": "All 600 evaluation images come from one dataset (PMRAM Bangladeshi brain tumor MRI) covering one anatomy and one modality. The strength of claims about 'radiology AI trustworthiness' broadly rests on this single source. Generalizability to CT, ultrasound, chest X-ray, or other common radiology tasks is unknown."
     },
     {
       "flag": "No formal statistical testing despite comparative claims",
       "detail": "The paper makes extensive comparative claims between conditions (clean vs. attack, attack vs. immune) but relies entirely on descriptive statistics. Despite conducting a power analysis using McNemar's test, the actual analyses are 'descriptive' with no significance tests applied. This undermines the inferential strength of the comparisons."
     },
     {
       "flag": "Contamination risk unaddressed for baseline performance",
       "detail": "The PMRAM dataset was published in 2024 on Mendeley Data. All nine commercial models evaluated in late 2025 could have been trained on these images. This affects baseline accuracy interpretation — if models have seen the images, baseline performance may be inflated and the adversarial drops may be understated relative to truly novel images."
     }
   ],
   "cited_papers": [
     {
       "title": "Prompt injection attacks on vision language models in oncology",
       "authors": ["J. Clusmann"],
       "year": 2025,
       "relevance": "Direct predecessor studying visual prompt injection in medical VLMs, reporting ASR up to 67% under perceptible manipulations in oncology."
     },
     {
       "title": "Adversarial Attacks on Large Language Models in Medicine",
       "authors": ["Y. Yang", "Q. Jin", "F. Huang", "Z. Lu"],
       "year": 2024,
       "arxiv_id": "2406.12259",
       "relevance": "Studies adversarial attacks on LLMs in medical settings, directly relevant to VLM security and robustness in healthcare."
     },
     {
       "title": "AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents",
       "authors": ["E. Debenedetti"],
       "year": 2024,
       "arxiv_id": "2406.13352",
       "relevance": "Evaluation framework for prompt injection attacks and defenses in LLM agent systems."
     },
     {
       "title": "Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems",
       "authors": ["D. Lee", "M. Tiwari"],
       "year": 2024,
       "arxiv_id": "2410.07283",
       "relevance": "Studies prompt injection propagation in multi-agent LLM systems, relevant to supply-chain risks discussed in this paper."
     },
     {
       "title": "Autonomous Artificial Intelligence Agents for Clinical Decision Making in Oncology",
       "authors": ["D. Ferber"],
       "year": 2024,
       "arxiv_id": "2404.04667",
       "relevance": "AI agent deployment in clinical decision-making workflows, directly relevant to the deployment governance concerns raised."
     },
     {
       "title": "First, do NOHARM: towards clinically safe large language models",
       "authors": ["D. Wu"],
       "year": 2025,
       "arxiv_id": "2512.01241",
       "relevance": "Addresses clinical safety of LLMs, demonstrating that benchmark performance does not imply clinical safety."
     },
     {
       "title": "How to make Medical AI Systems safer? Simulating Vulnerabilities, and Threats in Multimodal Medical RAG System",
       "authors": ["K. Zuo"],
       "year": 2025,
       "arxiv_id": "2508.17215",
       "relevance": "Studies vulnerabilities in multimodal medical RAG systems, directly related to the supply-chain integrity risks discussed."
     },
     {
       "title": "Prompt injection attacks on vision-language models for surgical decision support",
       "authors": ["Z. Zhang"],
       "year": 2025,
       "doi": "10.1101/2025.07.16.25331645",
       "relevance": "Parallel work studying prompt injection in VLMs for surgical decision support, extending the medical VLM attack surface characterization."
     },
     {
       "title": "PromptSmooth: Certifying Robustness of Medical Vision-Language Models via Prompt Learning",
       "authors": ["N. Hussein", "F. Shamshad", "M. Naseer", "K. Nandakumar"],
       "year": 2024,
       "arxiv_id": "2408.16769",
       "relevance": "Proposes certified robustness methods for medical VLMs via prompt learning, relevant to mitigation strategies."
     },
     {
       "title": "Think Twice to See More: Iterative Visual Reasoning in Medical VLMs",
       "authors": ["K. Chen"],
       "year": 2025,
       "arxiv_id": "2510.10052",
       "relevance": "Proposes iterative visual reasoning for medical VLMs, related to the immune prompting defense approach."
     },
     {
       "title": "A vision–language foundation model for precision oncology",
       "authors": ["J. Xiang"],
       "year": 2025,
       "relevance": "Foundation VLM for oncology, exemplifying the clinical deployment paradigm this paper critiques for security vulnerabilities."
     },
     {
       "title": "Sequential Diagnosis with Language Models",
       "authors": ["H. Nori"],
       "year": 2025,
       "arxiv_id": "2506.22405",
       "relevance": "LLM-based sequential diagnosis, relevant to multi-agent clinical workflows vulnerable to the propagation risks identified."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Directly applicable to anyone deploying VLMs on medical images; the immune prompting defense and vulnerability characterization inform real deployment decisions, though the paper provides guidelines rather than a deployable tool."
     },
     "surprise_contrarian": {
       "score": 2,
       "justification": "The complete specificity collapse (0.00 across ALL models) and the finding that stealth, human-imperceptible text still drives ASR of 0.57 are striking, though the general concept of prompt injection vulnerability is established."
     },
     "fear_safety": {
       "score": 3,
       "justification": "Demonstrates a concrete attack that could cause missed cancer diagnoses and unnecessary procedures via imperceptible image manipulation of medical AI systems — a novel attack vector with direct patient safety implications."
     },
     "drama_conflict": {
       "score": 2,
       "justification": "Tests and exposes failures in flagship commercial models (GPT-5, Claude, Gemini) from all major AI labs, with a strong 'all defenses fail' narrative."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Code and attack scripts released on GitHub (turkalpmd/vLMRadioInject) with a public dataset, enabling reproduction but not a one-click demo."
     },
     "brand_recognition": {
       "score": 2,
       "justification": "Tests GPT-5, Claude Sonnet 4.5, and Gemini 3 Pro from major labs (OpenAI, Anthropic, Google), though the paper itself comes from academic/hospital affiliations."
     }
   }
 }