Query-Agnostic Poisoning of Medical Multimodal RAG

Description

M3Att demonstrates a reproducible knowledge-poisoning issue in medical multimodal RAG: an attacker with limited corpus-distribution knowledge can insert paired image-text entries whose visually perturbed images are broadly retrieved and whose clinically plausible misinformation steers downstream generation. The paper evaluates both white-box and black-box retrieval optimization and reports degraded diagnostic and report-generation utility across multiple datasets, retrievers, and LVLMs. These are paper-reported results, not independently verified facts.

Examples

Safe defensive reproduction: use only synthetic or de-identified benchmark data in an isolated test corpus; compare clean-RAG and poisoned-corpus retrieval hit rates and downstream utility without deploying medical misinformation. The authors provide an implementation and sample evaluation datasets at https://github.com/ypr17/M3Att (opens in a new tab), but this analysis did not execute or independently validate it.

Impact

Successful poisoning can cause medical multimodal RAG systems to retrieve covertly corrupted evidence and produce plausible but incorrect diagnoses, severity assessments, reports, or recommendations, degrading integrity and reliability and potentially creating unsafe clinical decision support outputs.

Affected Systems

• Medical multimodal RAG pipelines that retrieve paired medical images and text from writable or weakly governed knowledge bases
• Vision-language retrieval pipelines using CLIP, BGE-VL, or SigLIP-style embedding retrievers
• Medical VQA, radiology report generation, and histopathology image-classification systems augmented with external retrieval

Mitigation Steps

• Enforce strict provenance, authorization, review, and immutable audit trails for every image-text pair admitted to a medical RAG knowledge base.
• Require clinician or trusted-source validation of retrieved evidence before it can influence high-impact diagnoses or recommendations.
• Continuously test retrieval and downstream utility against isolated, synthetic poisoning canaries, including query-agnostic and cross-retriever scenarios.
• Use defense-in-depth: image/text anomaly checks, cross-modal consistency checks, perplexity filtering, score pruning, deduplication, and retrieval monitoring; do not rely on any single filter because the paper reports that simple filters remained bypassable.
• Cross-check retrieved evidence against independent trusted sources and model priors, surface uncertainty and citations, and require human review for consequential clinical outputs.
• Monitor unusual retrieval concentration, newly ingested items appearing across unrelated queries, and sudden shifts in diagnostic/report-generation metrics.

Evidence

• Primary source abstract and Introduction: https://arxiv.org/html/2605.10253#S1 (opens in a new tab) — the paper states that M3Att combines covert textual misinformation with paired visual data as a query-agnostic retrieval trigger and evaluates five LVLMs and five datasets.
• Primary source §3.1 Threat Model: https://arxiv.org/html/2605.10253#S3.SS1 (opens in a new tab) — the attacker injects a limited number of poisoned entries without access to model parameters, user queries, or retrieved contexts, aiming to increase poisoned retrieval and mislead the LVLM.
• Primary source §3.3 Distribution-Guided Retrieval Hijacking: https://arxiv.org/html/2605.10253#S3.SS3 (opens in a new tab) — the paper describes cluster-proxy targeting and bounded visual perturbations, with both white-box gradients and black-box zeroth-order gradient estimation.
• Primary source §3.4 Clinical Ambiguity-Guided Poisoning: https://arxiv.org/html/2605.10253#S3.SS4 (opens in a new tab) — the paper describes clinically plausible text corruption targeting severity, diagnosis, and risk-association cues.
• Primary source §4.1–§4.2: https://arxiv.org/html/2605.10253#S4.SS1 (opens in a new tab) and https://arxiv.org/html/2605.10253#S4.SS2 (opens in a new tab) — the evaluation uses IU-XRay, MIMIC-CXR, CRC100k, MHIST, and PCam; GPT-4o, GPT-5, Gemini-2.5, Claude-4.5, and LLaVA-Med; and CLIP, BGE-VL, and SigLIP retrievers.
• Primary source Table 1 / §4.3: https://arxiv.org/html/2605.10253#S4.SS3 (opens in a new tab) — paper-reported measurements show M3Att reducing task utility relative to clean RAG across evaluated model/retriever/task combinations; these measurements were not independently reproduced here.
• Primary source §4.7: https://arxiv.org/html/2605.10253#S4.SS7 (opens in a new tab) — the paper reports a case-study Top-5 poisoned-sample hit-rate increase from 0.01% to 5%; this is a paper-reported measurement, not an independently verified fact.
• Primary source Appendix B: https://arxiv.org/html/2605.10253#A1.SS2 (opens in a new tab) — the paper reports retrieval ASR@5 of 75.87% without defense and 57.89%–75.87% under evaluated filtering defenses on IU-XRay with CLIP; these are paper-reported results.
• Directly linked artifact: https://github.com/ypr17/M3Att (opens in a new tab) — the repository README identifies retrieval-hijacking, misinformation-poisoning, generation, and evaluation code plus sample datasets, supporting reproducibility; it was inspected as untrusted documentation and not executed.