From Pixels to Prompts: A Structured Narrative Review of Security, Privacy, and Adversarial Robustness in Healthcare AI

Artificial intelligence (AI) is increasingly used in healthcare, where evaluations usually ask whether a system is accurate on ordinary clinical data. This review asks instead what can happen when someone deliberately changes the data, instructions, or training to make a system fail, behave in hidden ways, or reveal confidential information, a field known as adversarial machine learning. We reviewed 113 publications (2018–2026) and grouped the reported threats into six categories: altering an input after training; corrupting the training examples; teaching a hidden rule triggered later; using the model to learn private information; placing malicious instructions in language or image-and-language models; and attacking models trained jointly across hospitals or devices. Laboratory studies showed that small deliberate changes to medical images could alter a diagnosis or a model's outline, corrupted training data could change what a model learned, and malicious prompts could produce unsafe medical responses. Effect sizes varied greatly across models, datasets, attacks, and test conditions. Several defenses helped in individual experiments, but no single defense was shown to work across all threats and settings; in one imaging study, attacks tailored to the tested defenses bypassed all five. The studies do not show how often these attacks occur in practice or harm patients; their value is to demonstrate possible failure modes under controlled conditions. Medical AI should therefore be evaluated both on ordinary clinical data and in clearly described, clinically plausible attack scenarios.