cs.CVMar 22, 2026

When Minor Edits Matter: LLM-Driven Prompt Attack for Medical VLM Robustness in Ultrasound

Authors: Yasamin Medghalchi, Milad Yazdani, Amirhossein Dabiriaghdam, Moein Heidari, Mojan Izadkhah, Zahra Kavian, Giuseppe Carenini, Lele Wang, 

Organizations: University of British Columbia, Vancouver, Canada

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Ultrasound is widely used in clinical practice due to its portability, cost-effectiveness, safety, and real-time imaging capabilities. However, image acquisition and interpretation remain highly operator dependent, motivating the development of robust AI-assisted analysis methods. Vision-language models (VLMs) have recently demonstrated strong multimodal reasoning capabilities and competitive performance in medical image analysis, including ultrasound. However, emerging evidence highlights significant concerns about their trustworthiness. In particular, adversarial robustness is critical because Med-VLMs operate via natural-language instructions, rendering prompt formulation a realistic and practically exploitable point of vulnerability. Small variations (typos, shorthand, underspecified requests, or ambiguous wording) can meaningfully shift model outputs. We propose a scalable adversarial evaluation framework that leverages a large language model (LLM) to generate clinically plausible adversarial prompt variants via "humanized" rewrites and minimal edits that mimic routine clinical communication. Using ultrasound multiple-choice question answering benchmarks, we systematically assess the vulnerability of SOTA Med-VLMs to these attacks, examine how attacker LLM capacity influences attack success, analyze the relationship between attack success and model confidence, and identify consistent failure patterns across models. Our results highlight realistic robustness gaps that must be addressed for safe clinical translation. Code will be released publicly following the review process.

Figures & tables

Figure 1: Overview of our LLM-based prompt-edit attack with MCTS and an ultrasound QA example showing a prediction flip after attack.
 Attacker LLMTarget Med-VLMAvg.
 MedGemmaLLaVA-MedQoQ-Med 
Pre-attack–42.2234.7941.4639.49
Post-attackQwen-7B13.72 /23.8311.57 /18.5414.94 /24.9013.41 /22.42
Qwen-30B20.08/ 21.6917.47/ 17.9323.83/ 24.6020.46/ 21.41
GPT-4.1 mini25.82/29.9620.69/23.7527.82/30.8824.60/28.20
Table 1: Accuracy (%) before and after LLM-driven prompt editing attacks. The first row reports pre-attack accuracy. Post-attack cells are a/ba/b , where aa is accuracy on all attacked outputs and bb is accuracy after restricting to samples with PPL<15\mathrm{PPL}<15 .
Figure 2: MCTS Depth distribution of successful attacks from Qwen-7B over targeted Med-VLMs before PPL filtering.
Med-VLMQwen-7BQwen-30BGPT-4.1 mini
PPL ↓\downarrowSim. ↑\uparrowPPL ↓\downarrowSim. ↑\uparrowPPL ↓\downarrowSim. ↑\uparrow
MedGemma10.970.97410.980.9969.180.988
LLava-Med11.420.97410.720.99310.480.983
QoQ-Med11.160.97711.220.9969.240.988
Table 2: Perplexity (PPL; lower is better) and Semantic Similarity Score (Sim.; higher is better) of the generated prompt edits for each target Med-VLM across three attacker LLMs. Metrics are computed on the final accepted edits after PPL-based filtering. Bold denotes the best attacker result for each target model.
Figure 3: Distributions of Med-VLM logit margin for successful attacks ( green ) and failed attacks ( red ) across target Med-VLMs (cols) and attacker LLMs (rows).
Figure 4: Examples of LLM-generated suggestions
More in this topic

VLM Robustness

Vision-language model robustness studies whether models remain reliable under visual, textual, and distribution shifts, adversarial inputs, and safety challenges.

See all 454 papers

Explore similar work

CardsList
Jul 2, 2026

Towards Real-World Ultrasound Understanding: Large Vision-Language Models from Multi-Image Examinations with Long-Form Reports

Large vision-language models (LVLMs) have achieved strong performance across many medical imaging tasks, yet their application to ultrasound remains limited due to its inherent complexity and variability. In this work, we revisit what is truly needed to enable real-world ultrasound understanding. Instead of introducing complex architectures or elaborate training strategies, we show that data scale and clinically faithful data alignment are the key factors. We construct a large-scale dataset of 1.5M real-world ultrasound examinations, containing 17.7M images, multi-organ coverage, and paired uncurated clinical reports. Crucially, we organize the data at the examination level, aligning multiple images with their corresponding reports to reflect real clinical workflows. We then fine-tune a standard LVLM using low-rank adaptation (LoRA) on this dataset without task-specific modifications. Surprisingly, this simple recipe already leads to strong performance across diverse ultrasound understanding tasks, outperforming prior methods designed with more complex pipelines. Beyond these results, we present model and data scaling analyses that provide insights into the role of scale in ultrasound LVLMs.

Bingcong Yan, Chunlei Li, Jingliang Hu +3

1MedAI Technology (Wuxi) Co. Ltd. · 2Technical University of Munich

VLM AdaptationUltrasound ImagingMedical VLMs
AskPDF
May 20, 2026

Look-Closer-Then-Diagnose: Confidence-Aware Ultrasound VQA via Active Zooming

Vision-Language Models (VLMs) have significantly advanced medical visual question answering, yet their performance in ultrasound remains suboptimal. In clinical practice, sonographers explicitly focus on lesion regions to formulate reports, though diagnostic interpretations sometimes vary due to inherent subjectivity. However, existing VLMs are not explicitly structured to interactively zoom into lesions prior to diagnosis; moreover, they typically treat annotations as unbiased ground truths, failing to account for their inherent subjectivity and ambiguity. In this paper, we propose a framework specifically designed to consider the sonographer's cognitive workflow. We first introduce a structured Zoom-then-Diagnose paradigm, which replicates the interactive search process to enable lesion-focused reasoning. Furthermore, within the Group Relative Policy Optimization (GRPO) framework, we introduce an uncertainty-aware reward derived from stochastic group-wise rollouts to estimate prediction consistency as a proxy for model confidence. Together, these two components encourage the model to reinforce accurate predictions on clear cases while remaining cautious under ambiguity. Experiments across liver, breast, and thyroid datasets show that our framework improves lesion localization by 39.3%, demonstrating that our model has learned the ability to actively look closer and diagnose.

Yue Zhou, Erxuan Wu, Yikang Sun +5

Computer Aided Medical Procedures (CAMP), TU Munich, Germany · Munich Center for Machine Learning (MCML), Munich, Germany · Zhongshan Hospital, Fudan University, China +1

Visual Question AnsweringUncertainty Estimation for VLA ModelsMedical VQAUltrasound ImagingMedical Image LocalizationRL for VLMs
AskPDF
Apr 19, 2026

When Background Matters: Breaking Medical Vision Language Models by Transferable Attack

Vision-Language Models (VLMs) are increasingly used in clinical diagnostics, yet their robustness to adversarial attacks remains largely unexplored, posing serious risks. Existing medical attacks focus on secondary objectives such as model stealing or adversarial fine-tuning, while transferable attacks from natural images introduce visible distortions that clinicians can easily detect. To address this, we propose MedFocusLeak, a highly transferable black-box multimodal attack that induces incorrect yet clinically plausible diagnoses while keeping perturbations imperceptible. The method injects coordinated perturbations into non-diagnostic background regions and employs an attention distraction mechanism to shift the model's focus away from pathological areas. Extensive evaluations across six medical imaging modalities show that MedFocusLeak achieves state-of-the-art performance, generating misleading yet realistic diagnostic outputs across diverse VLMs. We further introduce a unified evaluation framework with novel metrics that jointly capture attack success and image fidelity, revealing a critical weakness in the reasoning capabilities of modern clinical VLMs.

Akash Ghosh, Subhadip Baidya, Sriparna Saha +1

Indian Institute of Technology Patna1 · Work done as Visiting Researcher at MBZUAI · MBZUAI3 +1

VLM RobustnessAdversarial Attacks on VLMsMedical VLMsTransfer-Based Adversarial AttacksBlack-Box Adversarial Attacks
AskPDF