DarkSyringe - Automated poisoning of Clinical AI Assistants Through PDFs a physician's POV

The speaker, a hand surgeon, starts from the pressure on clinicians: long hours, paperwork, and growing patient workloads push doctors toward AI tools that summarize notes and answer clinical questions from uploaded documents. Their argument is that a PDF is an unvalidated input, and that classic prompt injection fails here because blunt commands conflict with the document and get flagged. The alternative they describe, divergent prompt injection, is a false but clinically plausible sentence, such as a wrong drug or an invented contraindication, that fits the surrounding text.

The talk presents DarkSyringe, an open-source pipeline that finds text-based PDFs, removes personal identifiers, asks a local model to write a harmful but believable payload, hides it in the document body with transparent text, and uses a second model to check whether the resulting summary differs in a dangerous way. In a live demo on a boxer's fracture letter, a commercial model summarized the poisoned file and recommended an unindicated antibiotic at a toxic dose, plus an invented cardiac contraindication. Tests between August and December 2025 found several frontier models vulnerable, while later detectors caught some variants and not others.

The speaker closes with defenses that help but do not solve the problem: scanning for hidden content, or rendering pages to images and running OCR. The main takeaways are that clinicians need to read sources skeptically, and that anyone building clinical tools should treat every ingested document as untrusted input.