Is Mamba Reliable for Medical Imaging?

Banafsheh Saber Latibari; Najmeh Nazari; Daniel Brignac; Hossein Sayadi; Houman Homayoun; Abhijit Mahalanobis

cs.CRFeb 16, 2026

Is Mamba Reliable for Medical Imaging?

Authors: Banafsheh Saber Latibari, Najmeh Nazari, Daniel Brignac, Hossein Sayadi, Houman Homayoun, Abhijit Mahalanobis

Organizations: Department of Electrical and Computer Engineering, University of Arizona, Tucson, AZ, USA · Department of Electrical and Computer Engineering, University of California, Davis, CA, USA · Department of Computer Engineering and Computer Science, California State University, Long Beach, Long Beach, CA, USA

Abstract

State-space models like Mamba offer linear-time sequence processing and low memory, making them attractive for medical imaging. However, their robustness under realistic software and hardware threat models remains underexplored. This paper evaluates Mamba on multiple MedM-NIST classification benchmarks under input-level attacks, including white-box adversarial perturbations (FGSM/PGD), occlusion-based PatchDrop, and common acquisition corruptions (Gaussian noise and defocus blur) as well as hardware-inspired fault attacks emulated in software via targeted and random bit-flip injections into weights and activations. We profile vulnerabilities and quantify impacts on accuracy indicating that defenses are needed for deployment.

Figures & tables

Fig. 2: Overview of the threat model and evaluation pipeline for medical image classification. We consider input-level attacks including information corruption, information drop, and white-box adversarial perturbations, as well as hardware-level fault attacks such as random and layer-wise bit flips (e.g., Rowhammer-induced DRAM faults). The diagram highlights how these disturbances can propagate through the model and potentially lead to incorrect clinical predictions (misdiagnosis).

Dataset	Clean Acc	FGSM Acc	PGD Acc
PathMNIST	89.73	26.31	10.56
DermaMNIST	79.35	20.35	3.89
OCTMNIST	91.8	41.2	20.6
PneumoniaMNIST	93.27	13.46	0
RetinaMNIST	51.0	22.5	4.25
BreastMNIST	88.46	20.51	8.33

TABLE I: Model accuracy (%) on MedMNIST datasets under clean, FGSM, and PGD (

\epsilon=1/255,20

steps).

Dataset	0%	6.25%	18.75%	25%	37.5%	50%	56.25%
PathMNIST	89.72	91.8	80.86	72.81	56.73	45.64	38.95
DermaMNIST	79.35	72.77	55.81	39.75	20.70	17.85	17.75
OCTMNIST	91.8	85.1	71.1	67.9	61.2	47.1	42.4
PneumoniaMNIST	93.27	91.03	85.26	78.53	62.82	56.73	43.11
RetinaMNIST	51.0	51.5	51.75	51.5	50.5	45.75	44.75
BreastMNIST	88.46	86.54	81.41	78.85	76.28	69.87	73.07

TABLE II: Robustness evaluation using PatchDrop showing classification accuracy (%) across MedMNIST datasets under increasing patch removal ratios.

		Intensity 1		Intensity 2		Intensity 3		Intensity 4		Intensity 5
Dataset	Clean Acc	N	B	N	B	N	B	N	B	N	B
PathMNIST	89.72	61.99	81.89	33.20	72.94	23.22	57.73	9.04	45.89	6.13	40.89
DermaMNIST	79.35	70.47	78.80	66.73	78.06	66.93	76.51	66.88	75.86	66.88	74.96
OCTMNIST	91.80	84.40	83.90	71.10	71.50	54.70	57.00	26.90	48.70	25.00	42.60
PneumoniaMNIST	93.27	62.98	61.54	37.50	58.65	37.50	63.30	37.50	73.40	37.50	82.37
RetinaMNIST	51.00	45.75	50.75	44.50	51.50	43.50	51.00	43.50	50.75	43.50	51.00

TABLE III: Accuracy (%) under Gaussian noise and defocus blur at different intensity levels.

Dataset	Clean Acc	k=1	k=2	k=4	k=8	k=16
PathMNIST	89.72	81.73	76.19	72.25	52.04	32.32
DermaMNIST	79.35	78.64	75.15	77.96	48.10	34.42
OCTMNIST	91.80	85.08	79.63	76.04	45.22	43.33
PneumoniaMNIST	93.27	90.11	87.04	87.07	66.80	59.94
RetinaMNIST	51.00	49.00	50.70	49.80	41.03	42.21
BreastMNIST	88.46	87.08	85.55	85.54	56.19	54.52

TABLE IV: Model accuracy (%) under Random Bit Flip faults across MedMNIST datasets, where k denotes the number of random bit flips applied.

		Patch_embed					stage0_layers.0					stage1_layers.1					stage2_layers.2					stage3_layers.3					classifier_head					ssm_related
Dataset	Clean Acc	1	2	4	8	16	1	2	4	8	16	1	2	4	8	16	1	2	4	8	16	1	2	4	8	16	1	2	4	8	16	1	2	4	8	16
PathMNIST	89.72	80.23	67.44	52.19	22.02	27.48	82.58	68.30	64.82	32.81	22.19	82.60	68.39	64.80	43.13	25.41	82.62	68.40	64.86	21.33	25.75	86.18	77.53	69.89	44.27	24.12	86.26	75.23	70.13	45.18	36.74	81.76	66.34	56.22	28.06	19.57
DermaMNIST	79.35	71.40	56.01	44.62	7.10	13.52	71.73	56.50	52.70	18.51	7.07	71.76	56.33	52.55	26.13	7.52	71.79	56.55	52.75	7.27	10.91	72.51	68.31	59.59	32.64	21.92	73.37	67.33	64.74	43.27	42.76	72.37	56.97	46.12	24.11	8.13
OCTMNIST	91.80	83.05	71.18	58.46	28.37	35.05	85.19	71.79	68.40	38.36	28.34	85.12	71.79	68.46	45.03	31.68	85.13	71.77	68.44	28.67	31.68	91.81	81.79	65.41	49.58	30.58	89.36	78.07	70.04	55.03	47.24	85.77	73.66	61.60	40.17	27.58
PneumoniaMNIST	93.27	87.44	72.60	68.45	40.32	45.68	87.72	76.52	73.75	48.61	40.29	87.80	76.59	73.79	54.24	40.30	87.70	76.54	73.74	40.72	43.10	88.94	88.94	78.74	67.09	48.32	89.61	85.55	76.39	52.13	62.85	89.65	76.77	75.99	54.78	44.06
RetinaMNIST	51.00	49.85	48.13	47.00	43.80	44.44	50.25	48.74	48.39	45.03	43.90	50.25	48.75	46.36	45.75	44.28	50.25	48.75	48.38	43.88	44.26	51.00	46.36	45.05	38.51	37.61	50.66	50.33	44.80	31.45	27.05	47.15	40.99	43.03	28.29	36.81

TABLE V: Accuracy (%) under layer-wise bit-flip faults for different values of k.

Explore similar work

Patch-MoE Mamba: A Patch-Ordered Mixture-of-Experts State Space Architecture for Medical Image Segmentation
May 18, 2026Diego Adame, Fabian Vazquez, Jose A. Nunez +7Mamba Image Segmentation
University of Texas Rio Grande Valley, Edinburg, TX 78539, USA
Probing Length Generalization in Mamba via Image Reconstruction
Mar 12, 2026Jan Rathjens, Robin Schiewer, Laurenz Wiskott +1Mamba Length Generalization
Institute for Neural Computation, Faculty of Computer Science, Ruhr University Bochum, Bochum, Germany · CITEC, Bielefeld University, Bielefeld, Germany · Department of Computer Science, Royal Holloway, University of London, Egham, UK
Hidden State Poisoning Attacks against Mamba-based Language Models
Jan 5, 2026Alexandre Le Mercier, Chris Develder, Thomas DemeesterAdversarial Attacks on LLMs Language Modeling
IDLab–T2K, Ghent University–imec

May 18, 2026J/K move · Enter open · S save

Patch-MoE Mamba: A Patch-Ordered Mixture-of-Experts State Space Architecture for Medical Image Segmentation

Diego Adame, Fabian Vazquez, Jose A. Nunez, Huimin Li+6

University of Texas Rio Grande Valley, Edinburg, TX 78539, USA

Mamba Image Segmentation Polyp Segmentation Medical Image Segmentation Skin Lesion Segmentation Mixture-of-Experts Models

Open paper AskPDF arXiv

CNN- and Transformer-based architectures have achieved strong performance in medical image segmentation, but CNNs are limited in modeling long-range dependencies, while Transformers often suffer from quadratic computational and memory complexity. State space models, especially Mamba-based networks, offer an efficient alternative with linear sequence complexity. However, existing Mamba segmentation models still face two limitations: pixel-wise directional scanning can disrupt local 2D spatial structure, and simple summation-based fusion of scan directions cannot adapt well to diverse object sizes, shapes, and boundaries. To address these issues, we propose Patch-MoE Mamba, a patch-ordered mixture-of-experts state space architecture for medical image segmentation. It introduces a hierarchical patch-ordered scanning mechanism that preserves local spatial neighborhoods while capturing multi-scale context, and an MoE-based directional fusion module that adaptively combines multiple Mamba scanner outputs using four directional experts, a learnable concatenation expert, and residual directional aggregation. Experiments on five public polyp segmentation benchmarks and the ISIC 2017/2018 skin lesion segmentation datasets demonstrate the effectiveness and generality of Patch-MoE Mamba.

Abstract

Explore similar work

Patch-MoE Mamba: A Patch-Ordered Mixture-of-Experts State Space Architecture for Medical Image Segmentation

Probing Length Generalization in Mamba via Image Reconstruction

Hidden State Poisoning Attacks against Mamba-based Language Models