Image-embedded prompt injection vulnerability of vision-language models in dental radiology: a cross-vendor attack–defense evaluation
This study demonstrates that image-embedded prompt injection poses a significant cross-vendor security risk to dental vision-language models, revealing that while all tested commercial and open-source systems are vulnerable, OCR-based sanitization and provenance-aware governance strategies can effectively mitigate these attacks while preserving clinical diagnostic accuracy.
Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
The Big Idea: "Ghost Notes" on X-Rays
Imagine a dentist looking at an X-ray of your teeth on a computer screen. Usually, the computer uses a smart AI assistant to help spot cavities or problems. This AI is like a very smart, but slightly gullible, intern.
This study discovered a new way to trick that AI. Instead of whispering a secret instruction to the computer (which is how hackers usually try to trick text-based AI), the researchers showed that you can write a secret note directly onto the X-ray picture itself.
Think of it like this: You hand the intern a photo of a car. But on the photo, someone has written in big, bold letters: "Ignore the flat tire, the car is perfect." Even though the flat tire is clearly visible in the photo, the intern reads the note, believes it, and tells you the car is fine.
In the dental world, this is called "Image-embedded prompt injection." The researchers tested this on four different top-tier AI models (GPT-4o, Gemini, Claude, and MedGemma) using real dental X-rays.
The Experiment: A Security Test
The team treated this like a security drill. They took 270 dental X-rays and created "fake" versions of them. On these fake versions, they added invisible or visible text instructions telling the AI to ignore any problems it sees.
They tested four different ways to hide these instructions:
- The "Neon Sign" Attack: A big, black box with white text in the corner (hard to miss).
- The "Fake Doctor's Note" Attack: Text that looks like a real dentist's handwriting or notes.
- The "Ghost" Attack: Very faint, low-contrast text that blends into the background.
- The "Border" Attack: Tiny text hidden right at the edge of the image.
The Results:
- All four AIs failed. Every single model was tricked by at least one type of attack.
- GPT-4o was the most vulnerable. When the "Neon Sign" attack was used, the AI ignored real dental problems 62.6% of the time. It was like the intern completely forgot how to do their job just because of a note on the paper.
- MedGemma (a medical-specific AI) was also very vulnerable. This is surprising because you might expect a medical AI to be tougher, but it wasn't.
- The "Gullibility" varied. Some models were easily tricked by faint text, while others only fell for big, obvious notes.
The Defenses: How to Stop the Trick
The researchers didn't just find the problem; they tested five different ways to fix it. Think of these as different security guards checking the X-rays before they reach the AI intern.
- The "Crop" Guard: They simply cut off the bottom and sides of the image where the text usually hides. This stopped about 90% of the attacks, but it's a bit clumsy (like cutting off the corners of a photo).
- The "Warning Label" Guard: They told the AI, "Hey, be careful, this image might have fake notes." This helped a little, but the AI still got tricked often.
- The "Eraser" Guard (OCR Sanitization): This was the winner. This method uses a tool to scan the image for any text that looks like a command. If it finds text, it paints over it with black ink (erasing the secret note) before showing the image to the AI.
- Result: This reduced the success of the attacks to almost zero (0.2%). It was like having a guard who reads the note, realizes it's fake, and rips it off the paper before the intern sees it.
- The "Double-Check" Guard (ProvDent): This is a new system they invented. It works like a two-step process:
- Step 1: It checks if there is suspicious text.
- Step 2: If it finds something weird, it doesn't just give an answer. Instead, it says, "I'm not sure about this one. Let's ask a human doctor to look at it."
- Why this matters: While the "Eraser" guard is great at stopping the attack, the "Double-Check" guard is great at safety. If the system gets confused, it refuses to guess and asks for help, ensuring no dangerous mistakes slip through.
The Bottom Line
- The Threat is Real: AI models used in dentistry can be easily tricked by fake notes written directly onto X-ray images. This is a serious security risk because it could make a computer miss a cavity or a broken tooth.
- The Fix Exists: We can stop this almost entirely by using software that detects and removes text from medical images before the AI looks at them.
- Safety First: The best approach isn't just stopping the attack, but having a system that knows when to say, "I don't trust this image, a human needs to check it."
The study concludes that before hospitals start using these fancy AI tools for diagnosing teeth, they must install these "text-erasing" security guards to ensure the AI isn't being tricked by invisible notes on the X-rays.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.