Medical Multimodal Model Stealing Attacks via Adversarial Domain Alignment
This addresses a security vulnerability for healthcare systems using medical MLLMs, representing an incremental advance by extending model stealing to multimodal models in the medical domain.
The paper tackles the problem of model stealing attacks against medical multimodal large language models (MLLMs) by introducing Adversarial Domain Alignment (ADA-STEAL), which uses natural images and adversarial noise to replicate the models without access to medical data, achieving successful theft on IU X-RAY and MIMIC-CXR datasets.
Medical multimodal large language models (MLLMs) are becoming an instrumental part of healthcare systems, assisting medical personnel with decision making and results analysis. Models for radiology report generation are able to interpret medical imagery, thus reducing the workload of radiologists. As medical data is scarce and protected by privacy regulations, medical MLLMs represent valuable intellectual property. However, these assets are potentially vulnerable to model stealing, where attackers aim to replicate their functionality via black-box access. So far, model stealing for the medical domain has focused on classification; however, existing attacks are not effective against MLLMs. In this paper, we introduce Adversarial Domain Alignment (ADA-STEAL), the first stealing attack against medical MLLMs. ADA-STEAL relies on natural images, which are public and widely available, as opposed to their medical counterparts. We show that data augmentation with adversarial noise is sufficient to overcome the data distribution gap between natural images and the domain-specific distribution of the victim MLLM. Experiments on the IU X-RAY and MIMIC-CXR radiology datasets demonstrate that Adversarial Domain Alignment enables attackers to steal the medical MLLM without any access to medical data.