Microscopic noise can fool multiple cancer pathology models, exposing a major clinical safety gap

by UCLA Engineering Institute for Technology Advancement

edited by Sadie Harley, reviewed by Robert Egan

Sadie Harley

Scientific Editor

Meet our editorial team
Behind our editorial process

Robert Egan

Associate Editor

Meet our editorial team
Behind our editorial process Editors' notes

This article has been reviewed according to Science X's editorial process and policies. Editors have highlighted the following attributes while ensuring the content's credibility:

fact-checked

peer-reviewed publication

trusted source

proofread

The GIST Add as preferred source

The integration of AI into digital pathology through general-purpose foundation models promises to significantly enhance various tasks, such as cancer detection and subtyping. However, these powerful AI systems also introduce severe vulnerabilities, rendering them susceptible to adversarial attacks.

Researchers at the University of California, Los Angeles (UCLA) have introduced universal and transferable adversarial perturbations (UTAP) to investigate these potential threats and shed light on defense mechanisms against such adversarial attacks.

UTAP uses an adaptive optimization process to iteratively craft a subtle microscopic noise pattern. When this fixed noise pattern is added to a pathology image, for example, corresponding to a microscopic image of a biopsied tissue section, it systematically disrupts the feature representation capabilities of pathology foundation models by minimizing the similarity between the feature representations of the original and perturbed images. This adversarial methodology fundamentally hampers the representational power of AI models.

UCLA research demonstrated two key capabilities of UTAP: universality and transferability. The optimized microscopic perturbation of the attack can be applied across diverse sets of tissue images, independent of the training dataset, confirming its universality. The work is published in the journal Light: Science & Applications.

Furthermore, the perturbation degrades the performance of various external pathology foundation models without prior exposure, demonstrating extensive transferability to new AI models never seen before.

Quantitative evaluations revealed that applying the UTAP microscopic perturbation to various tissue images resulted in significant reductions in accuracy across seven state-of-the-art pathology foundation models.

"Framed as 'ethical hacking,' our work develops and benchmarks advanced attacks to raise awareness," stated Prof. Aydogan Ozcan. "Our goal is to enable the powerful tools needed to build, assess, and improve the next generation of resilient, secure computational pathology and optical microscopy models."

Standard defense mechanisms, such as the application of spatial low-pass filters to neutralize high-frequency adversarial noise, were proven insufficient. UCLA researchers demonstrated that an adaptive adversary could systematically bypass these filtering defenses by incorporating similar filters into the forward pass during perturbation training.

To secure the clinical utility of pathology foundation models against these sophisticated threats, the research team proposes a closed-loop methodology comprising detection, source identification, and reconfirmation.

This framework utilizes a dedicated attack-detection network as a first line of defense, followed by protocolized rescanning of physical tissue slides to identify/isolate the source of the attack. Ultimately, the framework relies on a human expert in the loop to assess the morphological data and reject hallucinated diagnostic outputs, ensuring patient safety.

The rapid creation of a universal and transferable perturbation pattern, in less than 15 minutes of training time, carries significant implications for the clinical deployment and safety of AI in digital pathology and optical microscopy systems. Consequently, to support the safer development and deployment of pathology foundation models, it is essential to comprehensively study these threats and develop robust defenses.

The study was supervised by Prof. Aydogan Ozcan of UCLA. The other authors of this work include Yuntian Wang, Xilin Yang, Che-Yung Shen, Shuhang Dong, and Nir Pillar.

Publication details

Yuntian Wang et al, Universal and transferable attacks on pathology foundation models using microscopic perturbations, Light: Science & Applications (2026). DOI: 10.1038/s41377-026-02347-w

Journal information: Light: Science & Applications

Key medical concepts

Diagnostic ErrorsHand Held Microscopy

Clinical categories

Laboratory medicineOncology Provided by UCLA Engineering Institute for Technology Advancement Who's behind this story?

Sadie Harley

BSc Life Sciences & Ecology. Microbiology lab background with pharmaceutical news experience in oil, gas, and renewable industries. Full profile →

Robert Egan

Bachelor's in mathematical biology, Master's in creative writing. Well-traveled with unique perspectives on science and language. Full profile →

Citation: Microscopic noise can fool multiple cancer pathology models, exposing a major clinical safety gap (2026, June 1) retrieved 1 June 2026 from https://medicalxpress.com/news/2026-06-microscopic-noise-multiple-cancer-pathology.html This document is subject to copyright. Apart from any fair dealing for the purpose of private study or research, no part may be reproduced without the written permission. The content is provided for information purposes only.