ArticleNature communications2025
Prompt injection attacks on vision language models in oncology.
Article in Nature communications, 2025. The graph could read no effect estimate from its abstract, so it casts no vote on the map. Cited by 21 papers.
What it found
Each row is one number read from the abstract, on the scale the paper reported it, with its interval. Left of the dashed line favours the treatment, right favours the comparator. Under each row is the sentence it came from. New to these charts? A ten-minute tutorial.
The abstract states no effect estimate the extractor could read, or names no intervention and outcome on the map, so this paper lights no cell and moves no belief. It is still indexed, cited and linked below.
The trial behind it
Trials whose registry record cites this paper, or whose number appears in the abstract. A trial that started after this paper was published is citing it as background, not reporting it.
Neither the registry nor the abstract names a trial number. If this is a trial report, that itself is worth knowing.
Who cites it
21 citing papers in PubMed.
- Prompt Injection in Clinical Artificial Intelligence Systems: The Emerging Security Challenge of Large Language Models and Agentic AI.Annals of biomedical engineering · 2026Article
- Development of an Equity-Centered Sociotechnical Architecture for Generative AI Integration in Public Health Promotion: Conceptual Framework.Journal of medical Internet research · 2026Article
- For the record: a narrative review of ambient voice technology in clinical documentation for dentistry and wider healthcare.British dental journal · 2026Review
- Review
- A deep learning framework for efficient pathology image analysis.Nature communications · 2026Article
- Towards clinical-level interpretation of dental panoramic radiography using an instance-guided vision-language model.Nature biomedical engineering · 2026Article
- Susceptibility of large language models to hidden nudge injection during simulated medical peer review: a quasi-experimental study.Research integrity and peer review · 2026Article
- Article
- Clinical Plausibility in Large Language Model Robustness Testing for Medicine: A Scoping Review.Journal of medical systems · 2026Article
- Artificial intelligence agents in cancer research and oncology.Nature reviews. Cancer · 2026Review
- [Artificial intelligence in diagnostics-a pathology perspective].Pathologie (Heidelberg, Germany) · 2026Review
- Knowledgeable Language Models as Black-Box Optimizers for Personalized Medicine.... International Conference on Learning Representations · 2026Article
- Recent advances in defending the privacy attacks of large language models for healthcare applications: a concise review.Frontiers in artificial intelligence · 2026Review
- Prompt injection attacks on vision-language models for surgical decision support.npj digital surgery · 2026Article
- Performance of large language model in cross-specialty medical scenarios.Journal of translational medicine · 2025Article
- Vulnerability of Large Language Models to Prompt Injection When Providing Medical Advice.JAMA network open · 2025Article
- Large language models for clinical decision support in gastroenterology and hepatology.Nature reviews. Gastroenterology & hepatology · 2025Review
- [Applications, challenges and a trustworthy use of artificial intelligence in public health].Bundesgesundheitsblatt, Gesundheitsforschung, Gesundheitsschutz · 2025Review
- Computer-aided tumor cell fraction (TCF) estimation by medical students, residents, and pathologists improves inter-observer agreement while highlighting the risk of automation bias.Virchows Archiv : an international journal of pathology · 2025Article
- Hallmarks of artificial intelligence contributions to precision oncology.Nature cancer · 2025Review
Corrections and comments
PubMed lists nothing against this paper. Absence here is not a guarantee, only a check that was made.
Authors and funding
8 authors.
Funding
Abstract
Vision-language artificial intelligence models (VLMs) possess medical knowledge and can be employed in healthcare in numerous ways, including as image interpreters, virtual scribes, and general decision support systems. However, here, we demonstrate that current VLMs applied to medical tasks exhibit a fundamental security flaw: they can be compromised by prompt injection attacks. These can be used to output harmful information just by interacting with the VLM, without any access to its parameters. We perform a quantitative study to evaluate the vulnerabilities to these attacks in four state of the art VLMs: Claude-3 Opus, Claude-3.5 Sonnet, Reka Core, and GPT-4o. Using a set of N = 594 attacks, we show that all of these models are susceptible. Specifically, we show that embedding sub-visual prompts in manifold medical imaging data can cause the model to provide harmful output, and that these prompts are non-obvious to human observers. Thus, our study demonstrates a key vulnerability in medical VLMs which should be mitigated before widespread clinical adoption.
Indexed as
Identifiers
What OpenQuestion holds
Registered trials
Read under generation 80e0d062 · epoch 390. Bibliography from PubMed, PubMed Central and OpenAlex; grants from NIH RePORTER; trial links from ClinicalTrials.gov; estimates, votes and beliefs from the OpenQuestion graph.