Adversarial Fragility and Language Vulnerability in Clinical AI: A Systematic Audit of Diagnostic Collapse Under Imperceptible Perturbations and Cross-Lingual Drift in Low-Resource Healthcare Settings

Technical Summary: Adversarial Fragility and Language Vulnerability in Clinical AI

Problem Statement
Current clinical Artificial Intelligence (AI) systems are predominantly evaluated on clean, standardized, English-language datasets, creating a "fragility envelope" that fails to reflect the realities of healthcare delivery in low-resource settings, particularly in Sub-Saharan Africa. This study identifies two orthogonal safety vulnerabilities that threaten the deployment of AI in Nigerian Primary Health Centres (PHCs):

1. Adversarial Image Fragility: The susceptibility of deep learning models to imperceptible perturbations that cause diagnostic collapse.
2. Cross-Lingual Diagnostic Drift: The degradation of Large Language Model (LLM) reasoning when patients present in local dialects (Nigerian Pidgin/Naija) or Yoruba-inflected English rather than Standard American English (SAE).

Methodology
The study conducted a systematic dual audit using two distinct experimental tracks:

• Track 1: Adversarial Robustness (Image Analysis)

  • Architecture: DenseNet121 (the backbone of CheXNet), fine-tuned on the COVID-QU-Ex dataset (85,318 images).
  • Dataset: A stratified test set of 150 images (50 per class: COVID-19, Non-COVID Pneumonia, Normal).
  • Attack Vector: Fast Gradient Method (FGM) applied across 15 epsilon ($\epsilon$) levels from 0 to 0.3.
  • Mitigation Stress Test: Evaluated three defensive strategies at the critical threshold of $\epsilon=0.021$: Gaussian smoothing ($\sigma=1.0$), Ensemble Voting (via geometric augmentations), and Mini Adversarial Training.
  • Environment: Experiments run on Apple Silicon MPS acceleration; models wrapped in the Adversarial Robustness Toolbox (ART).

• Track 2: Language Fragility (LLM Analysis)

  • Models: Compared a general-purpose model (Llama3.1:8b) against an African-context model (NatLAS/N-ATLAS).
  • Dataset: 20 authored clinical vignettes covering the same three diagnostic classes, presented in three registers: Standard English, Nigerian Pidgin (Naija), and Yoruba-inflected English (60 total queries).
  • Metrics: Diagnostic accuracy and cross-lingual consistency (agreement with the Standard English prediction).
  • Inference: Local execution via Ollama API with temperature set to 0.0 for reproducibility.

Key Results

• Adversarial Collapse: The fine-tuned DenseNet121 model achieved a baseline accuracy of 89.3%. Under a minimal perturbation of $\epsilon=0.021$ (2.1% per-pixel intensity change, imperceptible to the human eye), accuracy collapsed to 62.0% (a 27.3 percentage point drop). At $\epsilon=0.300$, accuracy fell to 34.7%, indistinguishable from random chance.

  • Per-Class Impact: "Normal" patients suffered the most severe degradation, dropping from 78.0% to 42.0% accuracy, leading to a high rate of false positives (healthy patients misdiagnosed as having pneumonia).
  • Defense Failure: Standard defenses failed to restore safety. Gaussian smoothing reduced accuracy further to 34.7% (worse than the undefended baseline), while Ensemble Voting only achieved partial recovery (72.7%), remaining 16.6 points below the clean baseline.

• Language Fragility: Both models exhibited significant accuracy degradation when inputs deviated from Standard English.

  • Llama3.1:8b: Accuracy dropped from 80.0% (English) to 65.0% (Pidgin) and 60.0% (Yoruba-English). Diagnosis consistency fell to 85% for Pidgin.
  • NatLAS: Despite higher English baseline accuracy (85.0%), it exhibited a "Localisation Paradox," collapsing to 55.0% on Nigerian Pidgin (a 30-point drop). Crucially, its diagnosis consistency on Pidgin fell to 50%, meaning the model produced a different diagnosis for the same patient in half of the Pidgin cases compared to its English output.

Key Contributions

1. First Quantitative Audit: Provided the first quantitative assessment of adversarial robustness for DenseNet121 on COVID-19 chest X-rays within a Nigerian clinical context.
2. Systematic Drift Evaluation: Conducted a head-to-head evaluation of diagnostic drift across three Nigerian language registers, revealing that even models designed for African contexts (NatLAS) suffer severe fragility in community-level dialects.
3. Defense Inefficacy: Empirically demonstrated that standard defensive strategies (smoothing, ensembling) are insufficient to restore clinical safety under these specific adversarial and linguistic conditions.
4. Failure Envelope Definition: Established a quantitative "failure envelope" for clinical AI, identifying $\epsilon=0.021$ as a critical threshold where diagnostic reliability collapses.

Significance and Claims
The paper argues that current clinical AI systems may already be operating within their "adversarial danger zone" due to routine digital artifacts (compression, transmission noise) that mimic attack magnitudes. The findings highlight a critical "algorithmic inequity" where patients communicating in native dialects receive systematically different and less accurate clinical assessments.

The authors conclude that safe deployment in African PHC settings requires:

• Mandatory Auditing: The publication of "Adversarial Robustness Maps" and "Cross-Lingual Drift Profiles" before deployment.
• Architectural Hardening: A move away from standard architectures toward adversarially hardened designs.
• Linguistic Inclusion: Training on community-level Naija corpora rather than just formal written registers to address the "Localisation Paradox."

The study serves as a call for regulatory frameworks in Nigeria and Sub-Saharan Africa to mandate these specific safety evaluations, noting that current standards (like the EU AI Act) have not yet been translated into local regulatory contexts.