💻 computer science

When Background Matters: Breaking Medical Vision Language Models by Transferable Attack

This paper introduces MedFocusLeak, a highly transferable black-box attack that compromises medical vision-language models by injecting imperceptible perturbations into background regions to distract attention from pathology and induce plausible yet incorrect diagnoses.

Original authors: Akash Ghosh, Subhadip Baidya, Sriparna Saha, Xiuying Chen

Published 2026-04-21

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Akash Ghosh, Subhadip Baidya, Sriparna Saha, Xiuying Chen

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a super-smart medical AI doctor. It can look at an X-ray, MRI, or CT scan and write a detailed report about what's wrong with a patient. This AI is like a brilliant intern who has read every medical textbook in the world.

But, as this paper reveals, this brilliant intern has a very strange blind spot: it gets easily distracted by the background.

Here is the story of MedFocusLeak, the "magic trick" that tricks this AI into making dangerous mistakes without anyone noticing.

The Problem: The AI is Too Distractible

Currently, if you want to trick a computer into seeing something that isn't there, you usually have to put a weird, colorful sticker on the image. A human doctor would look at that sticker and say, "Hey, this picture is fake!"

But the researchers in this paper found a smarter way. They realized that medical AI models are obsessed with the center of the image (the heart, the brain, the tumor) but they also pay attention to the edges (the background, the table, the shadows).

The Solution: The "Invisible Decoy"

The researchers created a new attack called MedFocusLeak. Think of it like a magician's sleight of hand.

The Clean Image: Imagine an MRI scan of a brain with a small tumor. The AI correctly says, "There is a tumor here."
The Invisible Noise: The researchers take the image and add tiny, invisible changes to the background (the empty space around the brain). To a human eye, the image looks exactly the same. It's like whispering a secret to the AI that only the AI can hear.
The Distraction: These tiny changes act like a giant neon sign in the background. They don't change the brain; they just make the AI's "attention" shift away from the brain and toward the empty space.
The Text Trick: At the same time, the researchers slightly tweak the text prompt (the question asked to the AI) to match the distraction.

The Result: A Confident but Wrong Diagnosis

Because the AI is now looking at the "neon sign" in the background instead of the brain, it gets confused. It confidently writes a report saying, "This brain is perfectly healthy," or "This is a different disease entirely," even though the tumor is still right there in the picture.

The scary part?

To a human: The image looks normal. The report looks like it was written by a doctor.
To the AI: It's convinced it's looking at something completely different.

Why This Matters (The "Why Should I Care?")

The paper tested this on six different types of medical scans (X-rays, MRIs, ultrasounds, etc.) and against many different AI models, including the most advanced ones like GPT-5 and Gemini.

It works everywhere: Just like a pickpocket who can steal from anyone, this attack worked on almost every AI they tried.
It's invisible: The changes are so small that even expert doctors couldn't tell the image had been tampered with.
It's dangerous: In one example, the AI changed a report about a "possible tumor" to "completely normal." In another, it changed a mild skin issue to a "deadly cancer."

The Big Takeaway

This isn't just about breaking computers; it's about safety.

The researchers are saying: "We built these medical AIs to help us, but they have a flaw. They can be tricked by invisible background noise, leading them to make life-or-death mistakes."

They aren't trying to sell this trick to bad guys. Instead, they are shouting, "Look at this hole in the armor!" so that developers can build stronger, safer medical AIs that won't get distracted by the background and will always focus on the patient.

In short: They found a way to whisper a secret to a medical AI that makes it ignore the patient and look at the wall, causing it to give a wrong diagnosis that looks perfectly normal to everyone else.

1. Problem Statement

Vision-Language Models (VLMs) are increasingly deployed in clinical diagnostics to interpret medical scans and generate reports. However, their robustness against adversarial attacks remains largely unexplored, posing significant safety risks.

Limitations of Existing Attacks: Current medical attacks focus on secondary objectives like model stealing or prompt injection. Existing transferable attacks (which work across different models without white-box access) are ineffective in the medical domain because they introduce visible distortions (e.g., noise or artifacts) that are easily detectable by clinicians, especially on grayscale or narrow-palette medical images.
The Gap: There is a critical need for stealthy, transferable, black-box attacks that can induce incorrect but clinically plausible diagnoses without altering the primary medical modality or introducing perceptible image degradation.

2. Methodology: MedFocusLeak

The authors propose MedFocusLeak, a novel multimodal black-box attack framework designed to hijack the diagnostic reasoning of medical VLMs. The core insight is that the model's visual attention mechanism is a shared vulnerability across architectures. The attack does not alter the pathological regions; instead, it manipulates the non-diagnostic background to distract the model.

The framework operates through four key technical principles:

A. Background-Constrained Perturbation

Segmentation: The method uses MedSAM to segment and mask the primary clinical region (foreground).
Constraint: Adversarial perturbations are strictly confined to the non-diagnostic background (the top- $k$ largest square patches in the background). This ensures the core medical content remains untouched and the image remains visually imperceptible to human experts.

B. Multimodal Adversarial Representation

Joint Optimization: Unlike unimodal attacks, MedFocusLeak optimizes both image perturbations and text edits simultaneously.
Process:
1. Adversarial Text Generation: A surrogate model generates a targeted, plausible but incorrect diagnosis ( $x_{adv}$ ).
2. Iterative Search: The framework alternates between updating the image perturbation (using Projected Gradient Descent) and updating the text (using greedy token substitution).
3. Goal: To create a coordinated signal where the perturbed background and the adversarial text reinforce each other to disrupt cross-modal fusion representations.

C. Attention-Shift Mechanism (The Core Innovation)

Distraction Loss: The attack introduces a specific loss function ( $L_{attn}$ ) that explicitly redirects the model's visual attention.
Mechanism: It calculates the attention weights between visual tokens and textual tokens. The loss minimizes attention on the diagnostic foreground while maximizing attention on the perturbed background.
Effect: The VLM is forced to rely on the adversarial cues in the background rather than the actual pathological evidence, leading to confident but incorrect diagnoses.

D. Unified Evaluation Framework

The paper introduces new metrics to evaluate these attacks:

MTR (Medical Text Adversarial Score): Measures the semantic divergence of the diagnosis (how misleading the text is) while penalizing changes to the medical modality.
AvgSim: Measures image similarity (imperceptibility) using Med-CLIP.
MAS (Medical Attack Score): A unified metric combining MTR and AvgSim to reward attacks that are both effective and stealthy.

3. Key Contributions

First Systematic Study: The first work to systematically investigate transferable adversarial attacks in the medical VLM setting under realistic black-box assumptions.
MedFocusLeak Framework: A novel attack that achieves stealth by confining perturbations to the background and transferability by exploiting shared attention mechanisms across diverse models (open-source, medical-specialized, and closed-source).
Unified Metrics: Introduction of the MAS metric and a unified evaluation framework that jointly captures attack success and image fidelity.
Comprehensive Evaluation: Extensive testing across six medical imaging modalities (X-ray, CT, MRI, Dermoscopy, Mammography, Ultrasound) and six VLMs (including GPT-5, Gemini 2.5 Pro, MedVLM-R1, InternVL, etc.).

4. Experimental Results

The authors evaluated MedFocusLeak against state-of-the-art baselines (AttackVLM, AnyAttack, M-Attack, FOA-Attack).

Superior Performance: MedFocusLeak consistently outperformed all baselines across all metrics.
- MAS Scores: On GPT-5, MedFocusLeak achieved a MAS of 0.408, nearly double the strongest baseline (0.225). On InternVL, it reached 0.672, far exceeding the next best (0.523).
- Transferability: The attack successfully transferred to closed-source models (Gemini, GPT-5) and specialized medical models (MedVLM-R1) without access to their parameters.
Imperceptibility: The method maintained high image similarity (AvgSim > 0.85), confirming that perturbations were visually undetectable even to experts.
Human Evaluation: In a study with medical interns, MedFocusLeak scored highest on Adversarial Text Impact (3.94/5) and Image Quality Preservation (3.5/5), significantly outperforming baselines.
Case Studies: The paper demonstrates dangerous scenarios, such as a brain MRI report being altered from "potential tumor" to "completely normal," or a skin lesion diagnosis escalating from benign to "malignant melanoma," solely through background manipulation.

5. Significance and Implications

Critical Vulnerability Revealed: The study exposes a fundamental weakness in modern clinical VLMs: their reliance on visual attention mechanisms that can be easily hijacked by non-diagnostic background noise.
Safety Risks: The ability to generate "clinically plausible" but incorrect diagnoses poses a severe threat to patient safety, potentially leading to misdiagnosis, delayed treatment, or unnecessary procedures.
Call for Defense: The results underscore the urgent need for robust defenses in medical AI, specifically mechanisms that can verify attention alignment with diagnostic regions and resist background-based distractions.
Ethical Stance: The authors emphasize the dual-use nature of the research, releasing the code and findings to catalyze the development of more secure and trustworthy medical AI systems before these vulnerabilities can be maliciously exploited.

In conclusion, MedFocusLeak demonstrates that the "background" of a medical image is not just noise but a critical attack surface. By shifting the model's focus away from the pathology, attackers can bypass current safety measures and deceive even state-of-the-art medical AI systems.