Source-linked AI summary
When Background Matters: Breaking Medical Vision Language Models by Transferable Attack
Akash Ghosh, Subhadip Baidya, Sriparna Saha, Xiuying Chen
TL;DR
Medical VLMs have underexplored robustness gaps, especially because natural-image transferable attacks are visibly distorted in clinical imagery. MedFocusLeak uses coordinated image–text perturbations in background regions plus attention distraction to induce clinically plausible wrong diagnoses, and it reports strong performance across diverse VLMs while preserving imperceptibility. The authors conclude that current medical AI systems have critical vulnerabilities requiring stronger safeguards, while noting benchmark and background-region limitations.
Problem
Transferable attacks remain underexplored for specialized medical VLMs, while natural-image attacks often create conspicuous medical-image distortions that limit practicality.
Method
MedFocusLeak jointly perturbs image and text inputs in non-diagnostic background regions and applies attention distraction to shift models away from pathological evidence.
Results
MedFocusLeak achieves state-of-the-art performance across six medical datasets and modalities, outperforming baselines while maintaining imperceptibility and transferability.
Takeaways & Limitations
The results reveal critical vulnerabilities in current medical AI systems and underscore the need for stronger safeguards for safe clinical deployment.
Takeaways & Limitations
Evaluation is primarily benchmark-driven, and effectiveness may decrease for images such as pathology slides with limited background regions.
Abstract
from arXiv · showhide
Vision-Language Models (VLMs) are increasingly used in clinical diagnostics, yet their robustness to adversarial attacks remains largely unexplored, posing serious risks. Existing medical attacks focus on secondary objectives such as model stealing or adversarial fine-tuning, while transferable attacks from natural images introduce visible distortions that clinicians can easily detect. To address this, we propose MedFocusLeak, a highly transferable black-box multimodal attack that induces incorrect yet clinically plausible diagnoses while keeping perturbations imperceptible. The method injects coordinated perturbations into non-diagnostic background regions and employs an attention distraction mechanism to shift the model's focus away from pathological areas. Extensive evaluations across six medical imaging modalities show that MedFocusLeak achieves state-of-the-art performance, generating misleading yet realistic diagnostic outputs across diverse VLMs. We further introduce a unified evaluation framework with novel metrics that jointly capture attack success and image fidelity, revealing a critical weakness in the reasoning capabilities of modern clinical VLMs.
1 Introduction
Medical VLMs remain vulnerable to transferable attacks, while existing approaches are poorly suited to realistic clinical settings. MedFocusLeak addresses this gap by redirecting model attention through stealthy, multimodal perturbations in non-diagnostic regions.
- Medical VLM safety and reliability remain critical concerns in high-stakes clinical settings.
- Existing transferable attacks often produce conspicuous distortions on grayscale or narrow-palette medical images, limiting practicality.
- MedFocusLeak targets the model’s visual attention, redirecting it toward irrelevant cues while critical pathological evidence is ignored.
- The framework masks clinical regions, coordinates image perturbations with adversarial text edits, and optimizes semantically aware background patches under black-box constraints.
- Experiments across six medical datasets and imaging modalities report state-of-the-art induction of misleading yet clinically plausible diagnoses against black-box VLMs.
2 Related Works
Prior adversarial research progressed from image-classification attacks to transferable multimodal methods, while medical multimodal systems face additional security threats. These threats include model replication, adversarial manipulation, and cross-modality exploitation.
- Classical adversarial research established deep-neural-network vulnerability through gradient-based attacks such as FGSM, PGD, and CW.
- Multimodal attacks increasingly target transferability across unseen models by exploiting weaknesses inherited from vision encoders.
- Medical multimodal systems have been attacked through model stealing using natural images, threatening model confidentiality.
- Other medical attacks exploit general adversarial weaknesses or inconsistencies between clinical and natural data to mislead multimodal reasoning.
3 Our Approach: MedFocusLeak
MedFocusLeak formulates a black-box objective for producing clinically plausible wrong diagnoses while preserving image modality and imperceptibility. It combines targeted adversarial text, joint image–text optimization, background-constrained perturbations, and attention redirection.
- 3.1 Problem Formulation: The attack seeks an adversarial image that remains imperceptible and modality-consistent while inducing a wrong yet plausible diagnostic output.
- 3.2 Adversarial Target Generation: A surrogate model first generates targeted adversarial text that preserves the image modality while altering reported clinical findings.
- 3.3 Multimodal Adversarial Representation: The multimodal seed alternates projected-gradient image updates with greedy adversarial token substitution until the perturbations converge.
- 3.4 Background Constrained Perturbation: MedSAM isolates diagnostic regions, after which dynamic programming selects the largest background patches for constrained perturbation.
- 3.4 Background Constrained Perturbation: Local alignment maximizes cosine similarity between random adversarial-image crops and a target multimodal adversarial representation under a perturbation budget.
- 3.5 Attention Shift via Background Gate: The attention-shift component extracts final-block visual–textual cross-attention and uses foreground/background mass to redirect focus toward perturbed background regions.
- 4.2 Main Results: Table 1 reports attack comparisons using MTR, AvgSim, and MAS, with blue values marking statistically significant improvement over the best baseline.
4 Experiments
Experiments evaluate MedFocusLeak across diverse medical data, model families, baselines, and metrics, showing stronger attack performance while preserving image similarity and transferability.
- Experimental setup: The evaluation uses 1,000 medical images spanning seven imaging modalities and ten anatomical body parts.
- Experimental setup: The study evaluates two open-source, two specialized medical, and two closed-source VLMs, using an ensemble of four CLIP surrogate models.
- Experimental setup: MedFocusLeak is tested against five transfer-based multimodal attack baselines, including M-Attack and FOA-Attack.
- Metrics: The framework combines MTS, AvgSim, and MAS to assess clinical attack impact, image quality, and their joint effectiveness, alongside human metrics.
- Main results: 0.408 MAS on GPT-5 nearly doubles the strongest baseline’s 0.225, while InternVL reaches 0.672 versus 0.523 for the next best score.
- Main results: MedFocusLeak improves MAS across open-weight, specialized medical, and closed-source models, while reasoning-oriented models remain comparatively more robust.
5 Analysis and Discussion
Ablations and robustness analyses show that multimodal perturbations, attention shifting, and larger optimization budgets strengthen attacks, while defenses and runtime expose important trade-offs.
- Ablation study: At k=10 patches, MAS peaks across models, whereas AvgSim decreases as more patches are added.
- Ablation study: Joint image-text perturbations raise MAS from 0.371 image-only and 0.502 text-only to 0.629 on Qwen, while maintaining high AvgSim.
- Ablation study: Attention shift increases Qwen MAS from 0.484 to 0.629 and MTR from 0.585 to 0.740, with AvgSim remaining approximately 0.85–0.88.
- Ablation study: Increasing the perturbation budget from 4 to 8 to 16 improves attack success, with MedFocusLeak gaining more steeply than M-Attack and FOA-Attack.
- Ablation study: As optimization steps increase from 100 to 300, MAS rises across models, with MedFocusLeak showing steeper growth than M-Attack.
- Classification analysis: In classification on 100 ChestX-ray images, MedFocusLeak achieves the highest ASR across models and exceeds 0.9 on BioMedLLaMA-Vision.
- Defense robustness: Under Gaussian noise and Comdefend, MedFocusLeak outperforms M-Attack, including approximately 0.51 versus 0.42 MTR on Qwen-VL.
- Human evaluation: Human evaluation gives MedFocusLeak ATI 3.94, IQP 3.5, and OHAS 3.75, with Cohen’s kappa of 0.82.
6 Conclusion
MedFocusLeak redirects medical VLM attention through subtle image-text perturbations, producing incorrect diagnoses without perceptible image degradation and outperforming strong baselines in automated and human evaluations.
- MedFocusLeak subtly perturbs image and text inputs to redirect medical VLM attention and induce incorrect diagnoses without perceptible image degradation.
- The method consistently outperforms strong baselines in automated and human evaluations, remains effective under standard defenses, and can deceive human experts.
7 Limitations
The paper’s main limitations concern computational cost, benchmark-focused validation, restricted background regions in some modalities, and limited threat-model coverage.
- Higher computational cost than baselines may restrict deployment in resource-constrained clinical environments.
- Because evaluation is primarily benchmark-driven, broader validation with more variable real-world data and clinical experts remains necessary.
- Modalities with limited non-diagnostic background, such as pathology slides, may provide less space for perturbations and reduce attack effectiveness.
- The study covers only a limited set of adversarial threat models, leaving other potential attack surfaces unexplored.
8 Use of AI Assistants
The work used AI assistants and LLMs for manuscript refinement, output evaluation, and coding support.
- LLMs supported editing and refinement of the manuscript.
- LLMs evaluated the quality of outputs generated by the attack framework.
- LLMs assisted with coding and implementation tasks.
9 Ethics Statement
The authors acknowledge the dual-use risks of MedFocusLeak and describe an ethically supervised evaluation process intended to support safer medical AI.
- MedFocusLeak could be misused to generate plausible but dangerously incorrect clinical diagnoses.
- The authors state that their primary goal is to expose vulnerabilities before malicious exploitation.
- The research used publicly available and credentialed datasets in licensed, controlled, and medically supervised evaluations.
A Appendix
The appendix supplies supplementary methodological details, evaluation protocols, additional experiments, visualizations, prompts, and qualitative analyses.
- The appendix covers background, the threat model, dataset construction, and baseline configurations.
- It documents human evaluation and automatic evaluation protocols.
- Additional results include medical-modality analyses, step-size sensitivity, and submodel variants.
- The appendix provides extended visualizations, prompts, and qualitative analyses.
A.1 Background
VLMs jointly process images and text to generate diagnostic outputs, but their shared multimodal representations create adversarial vulnerabilities. Transferable black-box attacks exploit surrogate models and shared features to affect unseen models.
- VLMs jointly model images and text for multimodal reasoning and diagnostic report generation.They autoregressively generate output tokens conditioned on the image, prompt, and prior predictions.
- Medical VLMs can process radiological scans and diagnostic prompts to produce reports or diagnostic statements.
- Shared multimodal embeddings expose VLMs to adversarial vulnerabilities in high-stakes clinical applications.
- Transferable attacks create adversarial examples on surrogate models to affect unseen black-box models.Their success relies on shared feature representations across different models.
A.2 THREAT MODEL
The threat model assumes a black-box medical VLM deployment and an attacker using transferable, clinically plausible image and prompt perturbations. Evaluations across medical modalities examine whether MedFocusLeak can induce misleading diagnoses while preserving image fidelity and exploiting attention distraction.
- Deployment assumptions: The victim VLM accepts a medical image and clinical prompt, returns textual findings, and is accessed by the attacker through an API-only black-box interface.The provider controls model parameters, data, preprocessing, inference, query limits, and auditing.
- Attacker knowledge and resources: The attacker uses surrogate models and transferability, with zero or limited queries to the black-box victim, while knowing the task interface and common preprocessing.Surrogates may include open-weight medical or general VLMs, CLIP-like encoders, and medically tuned VLMs.
- Attacker capabilities and goals: Adversarial image and prompt changes must remain imperceptible, preserve anatomical and structural detail, maintain modality and semantic consistency, and avoid white-box access.The intended output is a plausible but incorrect diagnosis produced without violating clinicians’ expectations.
- Evaluation setting: The evaluation draws from MIMIC-CXR, MedTrinity, and SkinCAP across seven medical modalities, covering report-generation and captioning tasks.The datasets include chest X-rays, fundus images, CT, MRI, demography, mammography, ultrasound, and skin imagery.
- Cross-modality results: Across XCR, dermoscopy, mammography, MRI, ultrasound, and CT, MedFocusLeak reports higher MAS than baselines while maintaining high image similarity near 0.85 where reported.Reported examples include MAS 0.738 versus 0.571 on InternVL for mammography and 0.720 versus 0.591 on MRI.
- Sensitivity and ablations: Increasing α raises attack success but lowers image similarity, with α = 1.00 reported as the optimal overall setting; removing Clip-Patch-Laison causes major performance collapse.The ablation reports MAS values of 0.180 for Gemini and 0.000 for MedVLM-R1 after removing that component.