ai-research-survey

scan.json (30613B)

---

 {
   "paper": {
     "title": "Prompt injection attacks on vision language models in oncology",
     "authors": [
       "Jan Clusmann",
       "Dyke Ferber",
       "Isabella C. Wiest",
       "Carolin V. Schneider",
       "Titus J. Brinker",
       "Sebastian Foersch",
       "Daniel Truhn",
       "Jakob Nikolas Kather"
     ],
     "year": 2025,
     "venue": "Nature Communications",
     "doi": "10.1038/s41467-024-55631-x"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "All four tested VLMs (Claude-3 Opus, Claude-3.5 Sonnet, GPT-4o, Reka Core) are susceptible to prompt injection attacks when used for cancer lesion detection in medical images, with attack success rates ranging from 33% (Claude-3) to 67% (GPT-4o). Sub-visual prompt injections (low contrast or small font text embedded in images) are effective and not obvious to human observers, particularly for GPT-4o and Reka Core. Mitigation efforts (ethical prompt engineering, supervisor agent systems) were largely ineffective except for Claude-3.5, where ethical prompting significantly reduced vulnerability from 64.8% to 27.8%. The vulnerability is modality-agnostic, working across CT, MRI, ultrasound, endoscopy, histology, and photography.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "Code is publicly available at https://github.com/KatherLab/prompt_injection_attacks under a CC BY-NC-SA 4.0 license, as stated in the Code Availability section."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper states: 'The original data (patient information, images, prompts, model outputs, ratings, summary statistics) generated in this study are available in the supplementary data and supplementary information.' All images, prompts, and model outputs are in Supplementary Data 1-3."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions 'Python Version 3.11' and 'RStudio (2024.04.0)' with specific R libraries (ggplot2, dplyr, etc.), but no requirements.txt, Dockerfile, or comprehensive environment specification is provided — not enough detail to recreate the environment."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "While the Methods section is detailed and code/data are available, no explicit step-by-step reproduction instructions are provided in the paper or described as part of the repository."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": true,
         "justification": "Results are reported as 'Mean ± standard deviation (SD)' throughout, with error bars shown in Figures 2a-d."
       },
       "significance_tests": {
         "applies": true,
         "answer": true,
         "justification": "Multiple appropriate statistical tests are used: two-sided Mann-Whitney U test, Wilcoxon Signed-Rank test, Kruskal-Wallis test with Dunn's test, and Fisher's exact test, all with Bonferroni correction for multiple testing."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Attack success rates are reported with full context: e.g., 'LMR of 70% (ASR of 33%) for Claude-3' with baseline LMR of 35%, giving clear effect magnitude. Per-model and per-condition differences are quantified."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper states 'Sample sizes were chosen as triplicates for each measurement to ensure the representation of output variance' but provides no power analysis or justification for why 18 cases (3 per modality) is sufficient for the claims made."
       },
       "variance_reported": {
         "applies": true,
         "answer": true,
         "justification": "Mean ± SD is reported across the three replicates for each condition throughout the paper, as stated in the Statistics section."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Negative controls (unaltered prompts without injection) serve as baselines for each model. 'Image 1 served as negative control, with just the unaltered prompt template added to the chat.'"
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "All tested models are contemporary state-of-the-art VLMs from 2024: Claude-3 Opus, Claude-3.5 Sonnet, GPT-4o, and Reka Core, accessed between June and September 2024."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "The paper systematically varies injection strategies (text, visual, delayed visual), visual parameters (high contrast, low contrast, small font), and mitigation approaches (default, ethical prompting, supervisor, combined), measuring the effect of each variation."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Three metrics are used: organ detection rate (model accuracy), lesion miss rate (LMR), and attack success rate (ASR = difference between LMR with and without injection)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": true,
         "justification": "Lesion miss rate 'was assessed as a binary score of 0 and 1 by a licensed physician for all model outputs.' All diagnoses were also 'double-checked by our board-certified physicians.'"
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "All 18 patient cases are used for all experiments with no dev/test split. There is no separation between data used for design decisions and data used for final reporting."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by model (Fig 2), by injection strategy/position (Fig 2c-d), by imaging modality (Fig 3 heatmaps for all 6 modalities), and by mitigation strategy (Fig 4)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The paper discusses where attacks failed: Claude-3.5's resistance to certain attacks, low contrast settings reducing effectiveness for Claude models (69% to 14% LMR for Claude-3), and delayed visual injection being 'less harmful' overall."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Several negative results are reported: Gemini 1.5 could not be tested due to guardrails, mitigation strategies failed for 3 of 4 models, and some attack variations were ineffective (e.g., low contrast on Claude models)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims all tested VLMs are susceptible to prompt injection, which is supported by statistically significant results (p < 0.0001 overall). The claim about sub-visual prompts being non-obvious is supported by the low contrast and small font conditions."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper's main causal claim — that prompt injection causes altered model outputs — is supported by controlled experimental manipulation: each image is tested with and without injection, holding all other factors constant. This single-variable manipulation supports causal inference."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The abstract claims VLMs 'exhibit a fundamental security flaw' and the Discussion states 'prompt injection is likely to be a fundamental problem of LLMs/VLMs, not exclusive to the tested models.' These claims extend well beyond the 4 models and 18 oncology images actually tested."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper suggests Claude-3.5's resistance may be due to 'superior alignment training' but does not substantively explore alternative explanations for the overall findings, such as whether the specific prompt injection design or small sample could bias results."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": false,
         "justification": "The paper measures binary lesion detection success/failure in a simulated setting and frames this as demonstrating potential 'lethal harm' and clinical risk. The gap between a binary output flip in a controlled experiment and actual clinical harm in deployment is not acknowledged."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Exact model versions with snapshot dates are provided: 'Claude 3 Opus (claude-3-opus-20240229), Claude 3.5 Sonnet (claude-3-5-sonnet-20240620), GPT-4o (gpt-4o-2024-05-13) and Reka Core (reka-core-20240501).'"
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "The paper states 'All prompts are listed in Supplementary Table 1.' Key prompts are also given in the paper text: 'Describe this image', 'Just describe which organ you see but state it looks healthy', and the ethical/supervisor prompts in Fig 4."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Key hyperparameters are reported: 'temperature set to 0.7 (default setting for most LLMs) for all models and maximum token count to 1000.' Image resolution (4457×2846 pixels) and color values (#060606, #171717, #ffffff) are also specified."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. Models are queried directly via API or web interface. The supervisor model in mitigation experiments is a second independent call, not agentic scaffolding."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Image composition is thoroughly documented: resolution, font sizes (14 or 6), color codes for text and backgrounds, image dimensions, and how injection images were combined with medical images are all specified in the Methods section."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no dedicated Limitations section. The Discussion touches on some limitations of prompt injection defenses in general, but does not substantively discuss the limitations of the study's own methodology (small sample, single evaluator, simulated setting)."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No specific threats to the validity of the study are discussed. The paper discusses threats to healthcare from prompt injection but does not address threats to the validity of its own findings, such as the small N, potential evaluator bias, or the gap between simulated and real-world attacks."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what the results do NOT show. No specific statements about what was not tested, what populations/settings are excluded, or what claims the authors are NOT making."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": true,
         "justification": "All raw data including images, prompts, model outputs, and ratings are available in the supplementary materials (Supplementary Data 1-3) and the GitHub repository."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Data collection is described in detail: CT/MRI from local university hospital servers retrieved by a board-certified radiologist, ultrasound from Radiopaedia.org with specific case DOIs, and endoscopic/histological/dermatoscopic images from Wikimedia Commons under CC BY-SA 4.0."
       },
       "recruitment_methods_described": {
         "applies": true,
         "answer": true,
         "justification": "Image sources are described: 3 CT/MRI from local hospital servers, 3 ultrasound from Radiopaedia.org (with specific case references), and endoscopic/histological/dermatoscopic images from Wikimedia Commons. Selection criteria (histologically confirmed malignant lesions) are stated."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline from image selection through image composition (with specific resolution, color, and font parameters) to model querying (API settings, replicates) to physician evaluation (binary scoring criteria) is fully documented in the Methods section."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Extensive funding disclosure in the Acknowledgments section, listing specific grants from German Cancer Aid, DFG, BMBF, EU Horizon Europe, ERC, NIH, and NIHR."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All author affiliations are listed (Technical University Dresden, University Hospital RWTH Aachen, Heidelberg University Hospital, German Cancer Research Center, etc.). No authors are affiliated with the VLM companies being tested."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "Funding comes from government agencies and foundations (German Cancer Aid, DFG, EU, NIH, NIHR) that have no financial interest in the vulnerability of specific commercial VLMs."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": true,
         "justification": "A detailed competing interests statement is provided, disclosing honoraria (DT from Bayer; SF from MSD and BMS), equity stakes (StratifAI, Synagen), consulting relationships (JNK for multiple companies), and research grants."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This is a red-teaming study testing attack susceptibility on VLMs, not evaluating model knowledge on a benchmark. Training data contamination is not relevant to measuring whether prompt injection can alter model outputs."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "This study tests attack susceptibility, not model knowledge. Whether the models saw the medical images during training is orthogonal to whether prompt injection can flip their outputs."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No standard benchmark is used. The study evaluates vulnerability to prompt injection attacks, not performance on knowledge benchmarks."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved. The study evaluates AI models on medical images; humans serve only as evaluators of model outputs."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Ethics approval (BO-EK-444102022) was obtained for use of anonymized patient images, not for a human subjects study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study. The study evaluates AI model behavior."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Inclusion criteria for models (≥50% organ detection rate) are described, but this is model selection, not human subject selection."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The study is a structured evaluation of AI models, not an experiment with human subjects."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants requiring blinding. The physician evaluator assessed model outputs, but this is outcome assessment, not a blinded experimental condition."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Model exclusion (Gemini 1.5, Llama-3.1) is described with reasons, but this is not participant attrition."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No API costs, token consumption, or wall-clock time for model queries is reported, despite making hundreds of API calls across 4 commercial VLMs."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget (API spend, compute time) is stated for the experiments."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": true,
         "justification": "Each condition is run in triplicate with temperature 0.7 (introducing stochastic sampling), and results are reported as mean ± SD across these runs, which is the API-inference equivalent of seed sensitivity."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": true,
         "justification": "Explicitly stated: 'each of the 72 variations being queried a total of 3 replicates (n = 216 per model).'"
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search budget is reported. Temperature 0.7 is described as the default, but no exploration of other settings is reported or justified."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "All configurations and variations are reported (all injection strategies, all contrast/font settings, all mitigation approaches). No cherry-picking of a 'best' configuration."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": true,
         "justification": "Bonferroni correction is applied throughout: 'P-values were adjusted using the Bonferroni method' for Mann-Whitney U, Wilcoxon Signed-Rank, Kruskal-Wallis, and Fisher's exact tests."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors designed the attacks and evaluated their success without acknowledging potential bias in evaluating their own attack methodology. The physician evaluator's potential bias toward confirming attacks is not discussed."
       },
       "compute_budget_vs_performance": {
         "applies": false,
         "answer": false,
         "justification": "Compute differences between conditions are negligible — all experiments involve single API inference calls with identical settings."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether binary lesion detection under simulated attack conditions validly measures real-world clinical vulnerability to prompt injection. The gap between the experimental setup and actual deployment scenarios is not examined."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is involved. Models are queried directly via API with single-turn prompts."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": false,
         "answer": false,
         "justification": "This study tests attack susceptibility, not model knowledge. Whether training data temporally overlaps with test images is irrelevant to measuring prompt injection effectiveness."
       },
       "feature_leakage_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Not applicable to a prompt injection study — the evaluation measures attack success, not learned feature performance."
       },
       "non_independence_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Not applicable. The study tests whether injected prompts alter model outputs, not whether models perform well on independent test data."
       },
       "leakage_detection_method": {
         "applies": false,
         "answer": false,
         "justification": "Not applicable. Data leakage detection is irrelevant to an attack susceptibility study."
       }
     }
   },
   "claims": [
     {
       "claim": "All four tested VLMs are susceptible to prompt injection attacks, with significantly higher lesion miss rates under attack (p < 0.0001 overall).",
       "evidence": "LMR increased from 35%→70% (Claude-3), 17%→57% (Claude-3.5), 22%→89% (GPT-4o), 41%→92% (Reka Core) with injection. All per-model comparisons significant (p = 0.02 to p < 0.001). Fig 2b.",
       "supported": "strong"
     },
     {
       "claim": "GPT-4o had the highest attack success rate (67%) among tested models, while Claude-3.5 had the lowest (40%).",
       "evidence": "ASR reported per model: Claude-3 33%, Claude-3.5 40%, GPT-4o 67%, Reka Core 51%. GPT-4o and Reka Core ASR significantly higher than Claude-3.5 (p = 0.001 and p = 0.006). Fig 2b, Supplementary Table 3.",
       "supported": "strong"
     },
     {
       "claim": "Sub-visual prompt injections (low contrast, small font) are similarly harmful to visible injections for GPT-4o and Reka Core.",
       "evidence": "Fig 2d and Supplementary Table 5 show that different hiding strategies yield similar LMR for GPT-4o and Reka Core, while Claude models showed reduced LMR with low contrast (69%→14% for Claude-3).",
       "supported": "moderate"
     },
     {
       "claim": "Prompt injection is modality-agnostic, working across all tested imaging modalities.",
       "evidence": "Averaged ASR across models: US 32%, Endoscopy 32%, MRI 49%, CT 58%, Histology 61%. Significant difference only between US and CT (p = 0.02). Fig 3b, Supplementary Table 7.",
       "supported": "moderate"
     },
     {
       "claim": "Mitigation strategies (ethical prompting, supervisor models) were largely unsuccessful except for Claude-3.5.",
       "evidence": "Fig 4 shows ethical prompting significantly reduced vulnerability for Claude-3.5 only (64.8%→27.8%, p ≤ 0.001). No significant improvement for Claude-3, GPT-4o, or Reka Core. Supplementary Table 8.",
       "supported": "strong"
     },
     {
       "claim": "Prompt injection is likely a fundamental problem of LLMs/VLMs, not exclusive to the tested models.",
       "evidence": "Discussion argues this based on the finding that all tested models were susceptible. However, only 4 models were tested and the claim extends to all LLMs/VLMs without broader evidence.",
       "supported": "weak"
     }
   ],
   "red_flags": [
     {
       "flag": "Small sample size",
       "detail": "Only 18 patient cases (3 per modality) are used, with 3 replicates per condition. This is a very limited sample for claims about 'fundamental' vulnerabilities across modalities, especially given that some per-model per-modality cells have only n=3 observations."
     },
     {
       "flag": "Single evaluator for primary outcome",
       "detail": "Lesion miss rate was assessed by a single licensed physician. No inter-rater reliability is reported, introducing potential evaluator bias for the study's primary outcome measure."
     },
     {
       "flag": "Overclaiming from limited evidence",
       "detail": "The paper claims prompt injection is a 'fundamental security flaw' and 'likely to be a fundamental problem of LLMs/VLMs, not exclusive to the tested models' based on testing only 4 closed-source models on 18 images in one clinical domain."
     },
     {
       "flag": "No limitations section",
       "detail": "The paper lacks any discussion of its own methodological limitations — no mention of the small sample size, single evaluator, simulated-only setting, or the gap between experimental findings and real-world clinical risk."
     },
     {
       "flag": "Simulation-to-reality gap unaddressed",
       "detail": "All attacks were performed in 'a completely simulated scenario.' The paper does not discuss how the attack success rates would translate to real clinical workflows with existing security measures, human oversight, and multi-step diagnostic processes."
     }
   ],
   "cited_papers": [
     {
       "title": "Prompt Injection attack against LLM-integrated Applications",
       "authors": ["Y. Liu"],
       "year": 2023,
       "relevance": "Foundational work on prompt injection attacks against LLM-integrated applications, directly relevant to security vulnerabilities in AI systems."
     },
     {
       "title": "Empirical analysis of large vision-language models against goal hijacking via visual prompt injection",
       "authors": ["S. Kimura", "R. Tanaka", "S. Miyawaki", "J. Suzuki", "K. Sakaguchi"],
       "year": 2024,
       "relevance": "Empirical study of visual prompt injection attacks on VLMs, closely related methodology to the current paper."
     },
     {
       "title": "An early categorization of prompt injection attacks on large language models",
       "authors": ["S. Rossi", "A. M. Michel", "R. R. Mukkamala", "J. B. Thatcher"],
       "year": 2024,
       "relevance": "Taxonomy of prompt injection attacks on LLMs, providing the classification framework for attack types."
     },
     {
       "title": "Sleeper agents: training deceptive LLMs that persist through safety training",
       "authors": ["E. Hubinger"],
       "year": 2024,
       "relevance": "Demonstrates persistent deceptive behavior in LLMs that survives safety training, relevant to AI safety and adversarial robustness."
     },
     {
       "title": "ArtPrompt: ASCII art-based jailbreak attacks against aligned LLMs",
       "authors": ["F. Jiang"],
       "year": 2024,
       "relevance": "Novel jailbreak attack method using ASCII art to bypass LLM alignment, demonstrating creative attack vectors against guardrails."
     },
     {
       "title": "Improving alignment and robustness with short circuiting",
       "authors": ["A. Zou"],
       "year": 2024,
       "relevance": "Proposes alignment and robustness improvements for LLMs, directly relevant to mitigating the attacks demonstrated in this paper."
     },
     {
       "title": "AgentDojo: a dynamic environment to evaluate attacks and defenses for LLM agents",
       "authors": ["E. Debenedetti"],
       "year": 2024,
       "relevance": "Evaluation framework for attacks and defenses on LLM agents, relevant to systematic security testing of AI systems."
     },
     {
       "title": "Hybrid Alignment Training for Large Language Models",
       "authors": ["C. Wang"],
       "year": 2024,
       "relevance": "Proposes hybrid alignment training that could help mitigate prompt injection by balancing ethical outputs with human preferences."
     },
     {
       "title": "Adversarial attacks on Large Language Models in medicine",
       "authors": ["Y. Yang", "Q. Jin", "F. Huang", "Z. Lu"],
       "year": 2024,
       "relevance": "Directly relevant study of adversarial attacks on LLMs in the medical domain."
     },
     {
       "title": "Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems",
       "year": 2024,
       "relevance": "Demonstrates prompt injection propagation in multi-agent LLM systems, relevant to the paper's supervisor-model mitigation experiments."
     },
     {
       "title": "Adversarial attacks and adversarial robustness in computational pathology",
       "authors": ["N. Ghaffari Laleh"],
       "year": 2022,
       "doi": "10.1038/s41467-022-33266-0",
       "relevance": "Prior work on adversarial attacks in medical imaging (pathology), establishing the vulnerability of AI systems in healthcare."
     },
     {
       "title": "The future landscape of large language models in medicine",
       "authors": ["J. Clusmann"],
       "year": 2023,
       "relevance": "Overview of LLM applications in medicine, providing context for why securing medical VLMs matters."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Directly relevant to healthcare organizations deploying VLMs, but provides no defensive tool — primarily an awareness paper."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "Prompt injection vulnerability is well-established; the medical domain application is novel but not contrarian."
     },
     "fear_safety": {
       "score": 3,
       "justification": "Demonstrates that VLMs can be tricked into missing cancer diagnoses — a directly life-threatening implication in clinical settings."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "Implicitly shows major commercial AI models (GPT-4o, Claude) are vulnerable in healthcare, but framing is measured and academic."
     },
     "demo_ability": {
       "score": 1,
       "justification": "Code and data are available on GitHub but it is not a pip-installable tool or interactive demo."
     },
     "brand_recognition": {
       "score": 2,
       "justification": "Tests well-known models (GPT-4o, Claude 3.5 Sonnet) and published in Nature Communications, a high-profile venue."
     }
   }
 }