An AI system that reads radiographs also needs rules for the text it finds inside them. Words rendered into an image's pixels can be interpreted as instructions by a vision-language model. That makes input handling part of the evaluation, alongside the system's ability to interpret the clinical content.
A 2026 study in Scientific Reports tested image-embedded instructions in 270 de-identified panoramic radiographs. Across 58,320 inference calls, all four tested models were vulnerable under the researchers' permissive stress-test prompt. Results varied by model and attack type.
In the defense comparison, text sanitization using optical character recognition (OCR) reduced pooled attack success from 15.6 percent to 0.2 percent. A separate provenance-aware defense could abstain and escalate cases for human review.
Those numbers describe an adversarial experiment, not attacks measured in deployed dental systems. The sample contained 245 abnormal images and only 25 normal images, which prevented a meaningful assessment of specificity. The results support further security testing; they do not establish diagnostic accuracy or clinical readiness.
For a team evaluating a multimodal imaging system, I would carry that finding into six practical checks.
First, preserve provenance. The system should know where an image came from, what software touched it, and whether it was exported, compressed, annotated, or re-saved before analysis.
Second, separate observations from instructions. Text found inside an image may be a marker, an annotation, a patient identifier, or an attack. The model should not gain new permissions because pixels told it to ignore its rules or take an action.
Third, include adversarial examples in a controlled evaluation using authorized, de-identified test copies. Preserve the original clinical images. Test visible and subtle text in the pixels, including instructions that conflict with the system prompt. Evaluate modified metadata, unexpected file formats, duplicate studies, and missing identifiers as separate input-handling cases. Record what the model follows, ignores, or escalates.
Fourth, constrain downstream actions. A system that can summarize an image has a different risk profile from one that can write into a chart, create an order, contact a patient, or change a case. The image should never expand the set of actions the system is allowed to take.
Fifth, design abstention as part of the product. Human review is useful only when the reviewer can see why the case stopped, what the model observed, and what evidence needs to be checked. An unexplained refusal simply moves uncertainty to the next person.
Sixth, keep the test reproducible. Record the model version, prompt, image handling, defense settings, and expected result. Re-run representative cases when any of those change. A security control that worked on one version should not become a permanent assumption.
The study's sanitization result should not become an instruction to alter a practice's radiographs. Any proposed preprocessing needs validation for legitimate markers and clinically relevant annotations, with the original preserved. Provenance, permissions, escalation, and monitoring still need their own checks.
Ask the vendor to show how its system handles an image that tries to redirect the model, and where the resulting test is recorded. The demonstration should include the output, any action the system attempted, and the evidence a reviewer receives when it stops.