mlsanityData to 14 Oct 2026

Adversarial Attacks on Reinforcement Learning-based Medical Questionnaire Systems: Input-level Perturbation Strategies and Medical Constraint Validation

arXiv 2508.05677 ↗First posted 5 Aug 2025cs.CR cs.AI cs.LGcited by 0

Not on the map. Why?

Abstract (arXiv)

RL-based medical questionnaire systems have shown great potential in medical scenarios. However, their safety and robustness remain unresolved. This study performs a comprehensive evaluation on adversarial attack methods to identify and analyze their potential vulnerabilities. We formulate the diagnosis process as a Markov Decision Process (MDP), where the state is the patient responses and unasked questions, and the action is either to ask a question or to make a diagnosis. We implemented six prevailing major attack methods, including the Fast Gradient Signed Method (FGSM), Projected Gradient Descent (PGD), Carlini & Wagner Attack (C&W) attack, Basic Iterative Method (BIM), DeepFool, and AutoAttack, with seven epsilon values each. To ensure the generated adversarial examples remain clinically plausible, we developed a comprehensive medical validation framework consisting of 247 medical constraints, including physiological bounds, symptom correlations, and conditional medical constraints. We achieved a 97.6% success rate in generating clinically plausible adversarial samples. We performed our experiment on the National Health Interview Survey (NHIS) dataset (https://www.cdc.gov/nchs/nhis/), which consists of 182,630 samples, to predict the participant's 4-year mortality rate. We evaluated our attacks on the AdaptiveFS framework proposed in arXiv:2004.00994. Our results show that adversarial attacks could significantly impact the diagnostic accuracy, with attack success rates ranging from 33.08% (FGSM) to 64.70% (AutoAttack). Our work has demonstrated that even under strict medical constraints on the input, such RL-based medical questionnaire systems still show significant vulnerabilities.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 24 of its 51 references that are in the map. First posted on arXiv 5 Aug 2025.

Builds on

24 of 51 references.

References · 24

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  3. 2013Intriguing properties of neural networkscited by 5,155
  4. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  5. 2016Understanding deep learning requires rethinking generalizationcited by 1,674
  6. 2016Concrete Problems in AI Safetycited by 1,642
  7. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  8. 2017A Survey on Deep Learning in Medical Image Analysiscited by 1,186
  9. 2016Practical Black-Box Attacks against Machine Learningcited by 903
  10. 2017Evasion Attacks against Machine Learning at Test Timecited by 689
  11. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
  12. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
12 more
  1. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
  2. 2017Adversarial Attacks on Neural Network Policiescited by 320
  3. 2019Adversarial Policies: Attacking Deep Reinforcement Learningcited by 214
  4. 2018Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approachcited by 182
  5. 2017Tactics of Adversarial Attack on Deep Reinforcement Learning Agentscited by 166
  6. 2019Understanding Adversarial Attacks on Deep Learning Based Medical Image Analysis Systemscited by 153
  7. 2018AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networkscited by 137
  8. 2020Robust Reinforcement Learning via Adversarial training with Langevin Dynamicscited by 45
  9. 2019Impact of Adversarial Examples on Deep Learning Models for Biomedical Image Segmentationcited by 26
  10. 2019Blackbox Attacks on Reinforcement Learning Agents Using Approximated Temporal Informationcited by 13
  11. 2020A Hierarchical Feature Constraint to Camouflage Medical Adversarial Attackscited by 8
  12. 2020Learning to Ask Medical Questions using Reinforcement Learningcited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025CARES: Comprehensive Evaluation of Safety and Adversarial Robustness in Medical LLMs
  2. 2025SafeMed-R1: Adversarial Reinforcement Learning for Generalizable and Robust Medical Reasoning in Vision-Language Models
  3. 2021MedAttacker: Exploring Black-Box Adversarial Attacks on Risk Prediction Models in Healthcare
  4. 2024Medical MLLM is Vulnerable: Cross-Modality Jailbreak and Mismatched Attacks on Medical Multimodal Large Language Models
  5. 2026Research on Security Enhancement Methods for Adversarial Robust Large Language Model Intelligent Agents for Medical Decision-Making Tasks
  6. 2026When Large Language Models Fail in Healthcare: Evaluating Sensitivity to Prompt Variations
  7. 2026MPIB: A Benchmark for Medical Prompt Injection Attacks and Clinical Safety in LLMs
  8. 2025A Practical Framework for Evaluating Medical AI Security: Reproducible Assessment of Jailbreaking and Privacy Vulnerabilities Across Clinical Specialties