MedThreatRAG: Multimodal Poisoning in Medical RAG

Updated 9 July 2026

MedThreatRAG is a multimodal poisoning framework for medical retrieval-augmented generation systems that employs Cross-Modal Conflict Injection (CMCI) to introduce semantically contradictory image-text pairs.
It simulates a semi-open attack environment, demonstrating up to a 27.66% reduction in answer F1 scores on tasks like IU-Xray and MIMIC-CXR, which highlights critical vulnerabilities in external evidence bases.
The framework compares multiple poisoning strategies and provides safety guidelines, emphasizing semantic consistency checks and runtime monitoring to safeguard clinical RAG pipelines.

Searching arXiv for the named system and closely related medical RAG security work. MedThreatRAG most directly denotes a multimodal poisoning framework for medical retrieval-augmented generation (RAG) systems that use medical vision-LLMs and external image-text knowledge bases. It was introduced to simulate how an attacker could poison a clinical multimodal knowledge base by injecting adversarial image-text pairs that remain plausible enough to pass basic filtering while misleading retrieval, reranking, and answer generation. The framework is centered on a simulated semi-open attack environment and on Cross-Modal Conflict Injection (CMCI), a poisoning strategy that embeds subtle semantic contradictions between medical images and paired reports. On IU-Xray and MIMIC-CXR QA tasks, the reported effect is a reduction in answer F1 scores by up to 27.66%, with LLaVA-Med-1.5 F1 falling to as low as 51.36% under the strongest setting (Zuo et al., 24 Aug 2025).

1. Conceptual scope and position in the literature

In the literature represented here, MedThreatRAG is primarily a security-oriented framework rather than a clinical reasoning framework. Its purpose is not to improve diagnostic reasoning directly, but to probe vulnerabilities created when multimodal medical RAG systems depend on externally maintained image-text corpora. The central premise is that RAG reduces hallucinations by grounding outputs in retrieved evidence, yet this same external knowledge base becomes a major attack surface when it is periodically updated (Zuo et al., 24 Aug 2025).

This positioning distinguishes MedThreatRAG from systems whose main objective is medically grounded reasoning. MedCoT-RAG, for example, combines causal-aware document retrieval with a structured four-stage clinical chain-of-thought scaffold for open-domain medical question answering, emphasizing diagnostic logic rather than adversarial threat simulation (Wang et al., 20 Aug 2025). MedRAG is presented as a smart multimodal healthcare copilot with voice, text, and EHR inputs, together with knowledge-graph-elicited reasoning to reduce misdiagnosis risk, but it does not describe explicit adversarial threat detection or cybersecurity defenses (Zhao et al., 3 Jun 2025). DoctorRAG likewise focuses on fusing explicit medical knowledge with analogous patient cases and refining outputs through Med-TextGrad, rather than modeling poisoning of the retrieval substrate (Lu et al., 26 May 2025).

A second, broader use of the name appears in a separate security context: a multi-agent, retrieval-augmented framework for threat assessment across the machine-learning lifecycle, built around an ontology-driven heterogeneous threat graph and repository mining. That usage is conceptually adjacent, but it is not the same framework as the multimodal poisoning method defined for medical RAG (Foundjem et al., 29 Dec 2025). This suggests that the term “MedThreatRAG” currently names a family of threat-oriented RAG analyses more than a single standardized architecture.

2. Threat model and simulated semi-open environment

The MedThreatRAG threat model is defined over a triplet $(I, Q, A)$ , where $I$ is a medical image, $Q$ is a clinical question, and $A$ is the correct answer. Under attack, the corrupted output is written as

$\hat{A} = \mathcal{G}(I, Q; \tilde{\mathcal{C}})$

where $\mathcal{G}$ is the generator and $\tilde{\mathcal{C}}$ is the adversarial context retrieved from the threatened knowledge base (Zuo et al., 24 Aug 2025).

A key assumption is the “simulated semi-open attack environment.” This environment is intended to mimic real medical RAG systems with an external multimodal knowledge base, periodic knowledge base updates, some degree of user or pipeline contribution, and no direct attacker access to model internals. The attacker therefore does not need access to model weights, prompts, or internal parameters; the capability required is the ability to inject malicious multimodal content into the retrievable corpus through the same channels used for legitimate updates (Zuo et al., 24 Aug 2025).

The framework also imposes a stealthiness constraint:

$\text{Stealthiness: } D_{\text{sem}}((I, T), (I^*, T^*)) \leq \epsilon$

where $D_{\text{sem}}$ is a semantic similarity metric such as cosine similarity in CLIP space, $(I, T)$ is a benign image-text pair, $I$ 0 its adversarial version, and $I$ 1 is a small threshold ensuring plausibility. The attack objective is therefore dual: degrade retrieval quality and degrade generation accuracy while keeping poisoned samples sufficiently realistic to evade detection (Zuo et al., 24 Aug 2025).

The targeted multimodal RAG pipeline has three stages. A CLIP-based or OpenCLIP-based retriever encodes queries and candidate image-text pairs into a joint embedding space and retrieves top candidates by cosine similarity. A Med-LVLM reranker then scores retrieved candidates for relevance. Finally, a Med-LVLM generator produces the answer from the query, image, and retrieved context. The architecture matters because poisoning at any one of these stages can propagate downstream and corrupt the final response (Zuo et al., 24 Aug 2025).

MedThreatRAG includes three complementary poisoning strategies: Textual Attack (TA), Visual Attack (VA), and Cross-Modal Conflict Injection (CMCI). The paper treats TA and VA as included “for completeness,” but emphasizes CMCI as the main innovation and the most severe attack (Zuo et al., 24 Aug 2025).

Strategy	Target	Characterization
TA	Text modality	Plausible but incorrect caption or report
VA	Image modality	Realistic synthetic or adversarial image
CMCI	Joint image-text pair	Individually plausible but semantically contradictory pair

TA poisons the text modality by crafting an adversarial caption $I$ 2 for an image $I$ 3. In the white-box setting, its objective is

$I$ 4

with iterative update

$I$ 5

The attack injects false textual evidence directly into the knowledge base, but remains a single-modality attack (Zuo et al., 24 Aug 2025).

VA poisons the image modality. The implementation uses Stable Diffusion v1-4, fine-tuned on the MIMIC dataset, to generate realistic synthetic chest X-rays from medical text prompts. The paper defines a global adversarial image objective,

$I$ 6

with update

$I$ 7

Its aim is to maximize similarity between one adversarial image and many queries so that the same malicious image is broadly retrievable (Zuo et al., 24 Aug 2025).

CMCI attacks both modalities jointly. Its adversarial pairs $I$ 8 are constructed so that the image and text are individually plausible, yet together encode a semantic conflict. The objective is

$I$ 9

Here $Q$ 0 preserves image-text semantic alignment in the embedding space so that the pair appears normal to retrieval, while $Q$ 1 encourages deceptive generation. The paper characterizes this as more effective than TA or VA because it attacks the cross-modal interface rather than one modality alone (Zuo et al., 24 Aug 2025).

The retrieval stage is formalized as

$Q$ 2

with entries above threshold $Q$ 3 selected,

$Q$ 4

followed by reranking,

$Q$ 5

and final context selection,

$Q$ 6

The attack succeeds when poisoned examples score highly in both the retriever and reranker while remaining semantically plausible enough to evade conventional filtering (Zuo et al., 24 Aug 2025).

The observed failure modes are correspondingly staged. Retrieval failures occur when poisoned image-text pairs are retrieved instead of legitimate ones. Reranking failures occur when subtle contradictions remain in the top results despite a relevance filter. Generation failures occur when corrupted retrieved context induces wrong diagnoses or answers. The paper’s case studies include a pneumonia example where “consolidation in the right lower lobe” becomes “the lungs appear clear,” and a brain tumor example where glioblastoma becomes meningioma (Zuo et al., 24 Aug 2025).

4. Experimental configuration and empirical results

The evaluation uses IU-Xray and MIMIC-CXR, both in medical VQA or answer-generation settings over retrieved multimodal evidence. The reported backbone models are LLaVA-Med-1.5 7B and Qwen-VL; retriever, reranker, and generator components include CLIP, OpenCLIP, Qwen-VL Chat, and LLaVA. Poisoning settings are textpo (15%), imapo (15%), mixed (15%), textpo++ (35%), imapo++ (35%), and mixed++ (35%). The metrics are Accuracy, Precision, Recall, and F1 (Zuo et al., 24 Aug 2025).

For the visual attack pipeline, Stable Diffusion v1-4 is fine-tuned on MIMIC with full fine-tuning on four NVIDIA A100 GPUs using AdamW, learning rate $Q$ 7, batch size 16, 10 epochs, and mixed precision. This detail is operationally relevant because the attack is not framed as a purely theoretical perturbation; it is instantiated through a realistic generative image workflow (Zuo et al., 24 Aug 2025).

The primary quantitative result is that MedThreatRAG reduces answer F1 scores by up to 27.66%. On IU-Xray with LLaVA-Med-1.5, clean performance is F1 = 58.00, RAG raises this to 79.02, and the mixed++ condition lowers it to 51.36. On MIMIC-CXR with the same model, clean performance is 88.37, RAG raises it to 91.45, and mixed++ lowers it to 74.93. Qwen-VL shows the same degradation pattern: on IU-Xray, clean F1 is 53.63, RAG is 72.46, and mixed++ is 57.35; on MIMIC-CXR, clean F1 is 75.54, RAG is 85.98, and mixed++ is 68.19 (Zuo et al., 24 Aug 2025).

Across both models and both datasets, mixed++ is the worst-performing condition. The paper interprets this as evidence that coordinated multimodal poisoning is the most damaging setting, consistent with the emphasis on CMCI. The same section also notes that Qwen-VL often underperforms LLaVA-Med-1.5, likely because it is less medical-domain-specialized. That last point is presented as an interpretation in the source rather than as a separate controlled causal result (Zuo et al., 24 Aug 2025).

Ablation isolates poisoning of the retrieval, reranker, and generator components. On IU-Xray, the reported F1 scores are 56.61 for retrieval poisoning, 57.37 for reranker poisoning, and 55.15 for generator poisoning. On MIMIC-CXR, the corresponding values are 86.42, 86.26, and 85.18. Generator poisoning is therefore the most harmful overall in the reported ablation, although reranking is described as especially influential on IU-Xray (Zuo et al., 24 Aug 2025).

5. Relations to adjacent attack, audit, and defense frameworks

MedThreatRAG belongs to a broader line of work arguing that medical RAG security cannot be reduced to hallucination mitigation. A closely related multimodal attack paper, M $Q$ 8Att, studies knowledge poisoning in medical multimodal RAG under a query-agnostic threat model, using paired visual data as a trigger for retrieval hijacking and “clinical ambiguity-guided poisoning” for the text component. Its experiments on five LLMs and datasets report that the attack reduces overall downstream utility by 8.78% relative to clean RAG and produces generations that remain clinically plausible but incorrect (Yang et al., 11 May 2026). Relative to that framework, MedThreatRAG is distinguished by its simulated semi-open update environment and by CMCI’s explicit emphasis on semantic contradiction between image and report (Zuo et al., 24 Aug 2025).

Security risk also appears outside the poisoning setting. An anonymized case study of a patient-facing medical RAG chatbot shows that ordinary browser inspection exposed the system prompt, model and embedding configuration, retrieval parameters, backend endpoints, document and chunk metadata, knowledge-base content, and the 1,000 most recent patient-chatbot conversations, including questions, responses, timestamps, and free-text keyword tags (Madrid-García et al., 1 May 2026). This broadens the MedThreatRAG problem frame: the threat surface includes not only poisoned evidence, but also configuration leakage, metadata exposure, and unauthenticated access to stored patient interactions.

On the defensive side, stateful and post-hoc verification layers have been proposed for related risk classes. MMA-RAG $Q$ 9 models multimodal agentic RAG defense as a POMDP with adversarial intent as a latent variable and reports a 6.50 $A$ 0 average reduction factor in Attack Success Rate across 43,774 adversarial instances, with negligible utility cost (Singh et al., 24 Feb 2026). MedRAGChecker introduces claim-level verification for biomedical RAG by decomposing answers into atomic claims and combining evidence-grounded NLI with biomedical KG consistency signals, yielding answer-level diagnostics such as faithfulness, contradiction, under-evidence, and safety-critical error rates (Ji et al., 10 Jan 2026). Together, these works indicate that threat-aware medical RAG research now spans corpus poisoning, system-governance auditing, stateful runtime control, and claim-level verification.

6. Safety guidance, limitations, and broader significance

The practical recommendations associated with MedThreatRAG are grouped by attack surface. For textual attacks, the paper recommends fact-checking new text against trusted medical ontologies, performing negation detection, using language-model consistency scoring, and routing low-confidence items to experts. For visual attacks, it recommends perceptual hashing, diffusion-artifact detection, out-of-distribution filtering, and manual review or down-ranking of suspicious images. For CMCI specifically, it recommends computing image-text entailment or contradiction scores and dropping pairs with high contradiction (Zuo et al., 24 Aug 2025).

The operational safeguards are equally explicit: maintain signed provenance logs, support instant rollback of suspicious knowledge-base snapshots, stream real-time telemetry with alert thresholds tied to clinical risk, and allow clinicians to veto retrievals influencing patient care. At the process level, the recommendations include regular red-team drills, HIPAA/GDPR compliance, safety hooks at well-defined API boundaries, and a modular retrieval layer so that defenses can be hot-swapped, including GraphRAG-style alternatives (Zuo et al., 24 Aug 2025).

MedThreatRAG’s broader significance lies in the shift it enforces in how medical RAG is evaluated. In standard clinical RAG papers, the main concerns are hallucination, reasoning depth, or diagnostic specificity. MedCoT-RAG, for instance, argues that causal-aware retrieval and a four-stage reasoning scaffold improve accuracy, interpretability, and consistency in medical QA, outperforming vanilla RAG by up to 10.3% and advanced domain-adapted methods by 6.4% (Wang et al., 20 Aug 2025). MedRAG emphasizes misdiagnosis reduction through multimodal input handling, EHR retrieval, and knowledge-graph-elicited reasoning (Zhao et al., 3 Jun 2025). DoctorRAG emphasizes retrieval precision through concept tagging and dual retrieval from knowledge and patient cases, together with iterative textual-gradient refinement (Lu et al., 26 May 2025). MedThreatRAG does not invalidate those goals; rather, it shows that their benefits depend on the integrity of the external evidence substrate.

A plausible implication is that “threat-aware medical RAG” is emerging as a composite discipline rather than a single method family. One branch studies how poisoned multimodal evidence can enter and distort clinical RAG pipelines (Zuo et al., 24 Aug 2025, Yang et al., 11 May 2026). Another studies how backend exposure and weak governance can leak prompts, corpora, and patient conversations (Madrid-García et al., 1 May 2026). A third studies runtime trust inference and claim-level verification as postures for resilient deployment (Singh et al., 24 Feb 2026, Ji et al., 10 Jan 2026). Under that synthesis, MedThreatRAG is both a named framework and a representative problem formulation: medical RAG systems must be evaluated not only for retrieval quality and reasoning fidelity, but also for corpus integrity, cross-modal consistency, privacy boundaries, and operational security.