mlsanityData to 7 Oct 2026

Medical Multimodal Model Stealing Attacks via Adversarial Domain Alignment

arXiv 2502.02438 ↗First posted 4 Feb 2025cs.CR cs.AIcited by 5

Not on the map. Why?

Abstract (arXiv)

Medical multimodal large language models (MLLMs) are becoming an instrumental part of healthcare systems, assisting medical personnel with decision making and results analysis. Models for radiology report generation are able to interpret medical imagery, thus reducing the workload of radiologists. As medical data is scarce and protected by privacy regulations, medical MLLMs represent valuable intellectual property. However, these assets are potentially vulnerable to model stealing, where attackers aim to replicate their functionality via black-box access. So far, model stealing for the medical domain has focused on classification; however, existing attacks are not effective against MLLMs. In this paper, we introduce Adversarial Domain Alignment (ADA-STEAL), the first stealing attack against medical MLLMs. ADA-STEAL relies on natural images, which are public and widely available, as opposed to their medical counterparts. We show that data augmentation with adversarial noise is sufficient to overcome the data distribution gap between natural images and the domain-specific distribution of the victim MLLM. Experiments on the IU X-RAY and MIMIC-CXR radiology datasets demonstrate that Adversarial Domain Alignment enables attackers to steal the medical MLLM without any access to medical data.

Key facts. Cited by 5 papers in the map (data through 7 Oct 2026). Builds on 22 of its 36 references that are in the map. First posted on arXiv 4 Feb 2025.

Builds on

22 of 36 references.

References · 22

  1. 2015Distilling the Knowledge in a Neural Networkcited by 10,076
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2019BERTScore: Evaluating Text Generation with BERTcited by 5,462
  4. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  5. 2023Zephyr: Direct Distillation of LM Alignmentcited by 498
  6. 2023Med-Flamingo: a Multimodal Medical Few-shot Learnercited by 387
  7. 2020Generating Radiology Reports via Memory-driven Transformercited by 363
  8. 2021RadGraph: Extracting Clinical Entities and Relations from Radiology Reportscited by 310
  9. 2022Cross-modal Memory Networks for Radiology Report Generationcited by 183
  10. 2023On the Adversarial Robustness of Multi-Modal Foundation Modelscited by 142
  11. 2019Thieves on Sesame Street! Model Extraction of BERT-based APIscited by 136
  12. 2019Zero-shot Knowledge Transfer via Adversarial Belief Matchingcited by 129
10 more
  1. 2020Data-Free Model Extractioncited by 121
  2. 2018Stealing Hyperparameters in Machine Learningcited by 115
  3. 2019Data-Free Adversarial Distillationcited by 90
  4. 2020Data-Free Network Quantization With Adversarial Knowledge Distillationcited by 79
  5. 2024Safety of Multimodal Large Language Models on Images and Textscited by 70
  6. 2022Surgical-VQA: Visual Question Answering in Surgical Scenes using Transformercited by 58
  7. 2019Defending Against Model Stealing Attacks with Adaptive Misinformationcited by 55
  8. 2023Advancing Surgical VQA with Scene Graph Knowledgecited by 41
  9. 2022How to Steer Your Adversary: Targeted and Efficient Model Stealing Defenses with Gradient Redirectioncited by 21
  10. 2024Stealthy Imitation: Reward-guided Environment-free Policy Stealingcited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 3; 2026: 2.

5 papers.

  1. 2025From Essence to Defense: Adaptive Semantic-aware Watermarking for Embedding-as-a-Service Copyright Protectioncited by 2
  2. 2025Can DeepSeek Reason Like a Surgeon? An Empirical Evaluation for Vision-Language Understanding in Robotic-Assisted Surgerycited by 0
  3. 2025Stealix: Model Stealing via Prompt Evolutioncited by 0
  4. 2026CoDA: Exploring Chain-of-Distribution Attacks and Post-Hoc Token-Space Repair for Medical Vision-Language Modelscited by 0
  5. 2026Geometry-Aware Localized Watermarking for Copyright Protection in Embedding-as-a-Servicecited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Demonstration of an Adversarial Attack Against a Multimodal Vision Language Model for Pathology Imaging
  2. 2025VSF-Med:A Vulnerability Scoring Framework for Medical Vision-Language Models
  3. 2025How to make Medical AI Systems safer? Simulating Vulnerabilities, and Threats in Multimodal Medical RAG System
  4. 2026When Background Matters: Breaking Medical Vision Language Models by Transferable Attack
  5. 2024Medical MLLM is Vulnerable: Cross-Modality Jailbreak and Mismatched Attacks on Medical Multimodal Large Language Models
  6. 2025Medusa: Cross-Modal Transferable Adversarial Attacks on Multimodal Medical Retrieval-Augmented Generation
  7. 2025Enhancing the Safety of Medical Vision-Language Models by Synthetic Demonstrations
  8. 2026When Minor Edits Matter: LLM-Driven Prompt Attack for Medical VLM Robustness in Ultrasound