Image-embedded prompt injection vulnerability of vision-language models in dental radiology: a cross-vendor attack–defense evaluation

Abstract Image-embedded prompt injection—adversarial text rendered into the pixel data of a medical image—is an emerging security threat to vision-language models (VLMs) explored for clinical decision support. In an adversarial stress test using a permissive elicitation prompt, we assessed four production-tier VLMs (GPT-4o, Gemini 2.5 Flash, Claude Sonnet 4.5, MedGemma 4B) on 270 DenTeX dental panoramic radiographs under four attack classes, across 58,320 logged inference calls. All four models were vulnerable, with paired attack success rates (ASR) up to 62.6% (95% CI 58.5–66.7%, GPT-4o) and model-specific profiles. We benchmarked four defenses—ROI cropping, spotlighting, OCR-based text sanitization, and ProvDent, a provenance-aware defense with bounded clinical abstention—against a re-executed undefended control. OCR-based sanitization reduced pooled ASR from 15.6% to 0.2%; ProvDent reached 7.5% when every abstention is scored as an attack success, or 1.1% on the 93.5% of cases it answered, escalating the remainder for human review. On this high-prevalence benchmark (245/270 abnormal), defenses left clean-image sensitivity essentially unchanged (99.4–99.9% vs. 99.7%); the scarcity of normal images precluded assessment of specificity. These findings establish image-embedded prompt injection as a reproducible cross-vendor weakness under stress-test conditions, informing pre-deployment security evaluation rather than deployed-system risk.