Universal and transferable attacks on pathology foundation models using microscopic perturbations

Abstract The advent of foundation models initiated a paradigm shift in pathology and optical microscopy. However, these powerful systems also introduce vulnerabilities, making them susceptible to adversarial attacks. To shed light on these potential threats, here we introduce Universal and Transferable Adversarial Perturbations (UTAP) for pathology foundation models that reveal critical vulnerabilities. Optimized using deep learning, UTAP comprises a fixed and weak microscopic noise pattern that, when added to a pathology image, systematically disrupts the feature representation capabilities of foundation models. Therefore, UTAP induces performance drops in downstream tasks that utilize foundation models, including misclassification across a wide range of unseen data distributions. We demonstrate two key features of UTAP: (1) universality : its microscopic perturbation can be applied across diverse field-of-views independent of the dataset that UTAP was developed on, and (2) transferability: its perturbation can successfully degrade the performance of various external, black-box pathology foundation models—never seen before. These indicate that UTAP is not a dedicated attack associated with a specific foundation model or microscopy image dataset, but rather constitutes a broad threat to pathology foundation models and their applications. We evaluated UTAP across various state-of-the-art pathology foundation models on multiple datasets, causing significant drops in their performance with visually imperceptible microscopic modifications to the input images using a fixed noise pattern. The development of these potent attacks establishes a benchmark for model robustness evaluation, highlighting a need for advancing defense mechanisms to ensure the safe/reliable deployment of AI in pathology and optical microscopy.