Universal and transferable attacks on pathology foundation models using microscopic perturbations

Yuntian Wang; Xilin Yang; Che-Yung Shen; Shuhang Dong; Nir Pillar; Aydogan Ozcan

doi:10.1038/s41377-026-02347-w

Your Location：

Home >

Browse articles >

Universal and transferable attacks on pathology foundation models using microscopic perturbations

Original Articles

- Universal and transferable attacks on pathology foundation models using microscopic perturbations
- Light: Science & Applications Vol. 15, Issue 8, Pages: 2833-2857(2026)
- Affiliations：
  
  1.Electrical and Computer Engineering Department, University of California, Los Angeles, CA, USA
  2.Bioengineering Department, University of California, Los Angeles, CA, USA
  3.California NanoSystems Institute (CNSI), University of California, Los Angeles, CA, USA
  4.Department of Mathematics, University of California, Los Angeles, CA, USA
  5.Department of Pathology, Hadassah Hebrew University Medical Center, Jerusalem, Israel
  6.Department of Surgery, University of California, Los Angeles, CA, USA
- Author bio：
  
  Aydogan Ozcan (ozcan@ucla.edu)
- Funds：
- DOI：10.1038/s41377-026-02347-w
  CLC：
- Received：20 November 2025，
  
  Revised：2026-05-10，
  
  Accepted：14 May 2026，
  
  Online First：01 June 2026，
  
  Published：31 August 2026
- Accepted：
Scan QR Code
Wang, Y. T. et al. Universal and transferable attacks on pathology foundation models using microscopic perturbations. Light: Science & Applications, 15, 2833-2857 (2026).
DOI：

Wang, Y. T. et al. Universal and transferable attacks on pathology foundation models using microscopic perturbations. Light: Science & Applications, 15, 2833-2857 (2026). DOI： 10.1038/s41377-026-02347-w.

摘要

Abstract

The advent

of foundation models initiated a paradigm shift in pathology and optical microscopy. However

these powerful systems also introduce vulnerabilities

making them susceptible to adversarial attacks. To shed light on these potential threats

here we introduce Universal and Transferable Adversarial Perturbations (UTAP) for pathology foundation models that reveal critical vulnerabilities. Optimized using deep learning

UTAP comprises a fixed and weak microscopic noise pattern that

when added to a pathology image

systematically disrupts the feature representation capabilities of foundation models. Therefore

UTAP induces performance drops in downstream tasks that utilize foundation models

including misclassification across a wide range of unseen data distributions. We demonstrate two key features of UTAP: (1)

universality

: its microscopic perturbation can be applied across diverse field-of-views independent of the dataset that UTAP was developed on

and (2)

transferability:

its perturbation can successfully degrade the performance of various external

black-box pathology foundation models—never seen before. These indicate that UTAP is not a dedicated attack associated with a specific foundation model or microscopy image dataset

but rather constitutes a broad threat to pathology foundation models and their applications. We evaluated UTAP across various state-of-the-art pathology foundation models on multiple datasets

causing significant drops in their performance with visually imperceptible microscopic modifications to the input images using a fixed noise pattern. The development of these potent attacks establishes a benchmark for model robustness evaluation

highlighting a need for advancing defense mechanisms to ensure the safe/reliable deployment of AI in pathology and optical microscopy.

关键词

Keywords

references

Abels, E. et al. Computational pathology definitions, best practices, and recommendations for regulatory guidance: a white paper from the Digital Pathology Association. J. Pathol. 249 , 286–294 (2019)..

Lu, M. Y. et al. AI-based pathology predicts origins for cancers of unknown primary. Nature 594 , 106–110 (2021)..

Bulten, W. et al. Artificial intelligence for diagnosis and Gleason grading of prostate cancer: the PANDA challenge. Nat. Med. 28 , 154–163 (2022)..

Xiong, C. H. et al. TAKT: target-aware knowledge transfer for whole slide image classification. Proceedings of the 27th International Conference on Medical Image Computing and Computer Assisted Intervention. 503-513 (Springer, 2024)

Huang, L. Z. et al. A robust and scalable framework for hallucination detection in virtual tissue staining and digital pathology. Nat. Biomed. Eng. 9 , 2196–2214, https://doi.org/10.1038/s41551-025-01421-9 (2025)..

Lu, M. Y. et al. A multimodal generative AI copilot for human pathology. Nature 634 , 466–473 (2024)..

Oquab, M. et al. DINOv2: learning robust visual features without supervision. Print at https://doi.org/10.48550/arXiv.2304.07193 https://doi.org/10.48550/arXiv.2304.07193 (2024).

Siméoni, O. et al. DINOv3. Print at https://doi.org/10.48550/arXiv.2508.10104 https://doi.org/10.48550/arXiv.2508.10104 (2025).

Caron, M. et al. Emerging properties in self-supervised vision transformers. 2021 IEEE/CVF International Conference on Computer Vision (ICCV). 9630-9640 (IEEE, 2021)

Zhou, J. H. et al. iBOT: Image BERT pre-training with online tokenizer. Print at https://arxiv.org/abs/2111.07832 https://arxiv.org/abs/2111.07832 (2022).

Krishnan, R., Rajpurkar, P. & Topol, E. J. Self-supervised learning in medicine and healthcare. Nat. Biomed. Eng. 6 , 1346–1352 (2022)..

Dosovitskiy, A. et al. An image is worth 16x16 words: transformers for image recognition at scale. International Conference on Learning Representations. (OpenReview.net, 2021).

Sun, Y. et al. A foundation model for enhancing magnetic resonance images and downstream segmentation, registration and diagnostic tasks. Nat. Biomed. Eng. 9 , 521–538 (2025)..

Noh, S. & Lee, B. D. A narrative review of foundation models for medical image segmentation: zero-shot performance evaluation on diverse modalities. Quant. Imaging Med. Surg. 15 , 5825–5858 (2025)..

Lee, H. H. et a l. Foundation models for biomedical image segmentation: a survey. Print at https://doi.org/10.48550/arXiv.2401.07654 https://doi.org/10.48550/arXiv.2401.07654 (2024).

Gu, H. X. et al. How to build the best medical image segmentation algorithm using foundation models: a comprehensive empirical study with Segment Anything Model. Mach. Learn. Biomed. Imaging 3 , 88–120 (2025)..

Neidlinger, P. et al. Benchmarking foundation models as feature extractors for weakly supervised computational pathology. Nat. Biomed. Eng . https://doi.org/10.1038/s41551-025-01516-3 (2025).

Ghaffari Laleh, N. et al. Adversarial attacks and adversarial robustness in computational pathology. Nat. Commun. 13 , 5711 (2022)..

Inkawhich, N., McDonald, G. & Luley, R. Adversarial attacks on foundational vision models. Print at https://doi.org/10.48550/arXiv.2308.14597 https://doi.org/10.48550/arXiv.2308.14597 (2023).

Thota, P. et al. Demonstration of an adversarial attack against a multimodal vision language model for pathology imaging. 2024 IEEE International Symposium on Biomedical Imaging (ISBI). 1-5 (IEEE, 2024)

Bortsova, G. et al. Adversarial attack vulnerability of medical image analysis systems: unexplored factors. Med. Image Anal. 73 , 102141 (2021)..

Li, Y. & Liu, S. Y. Adversarial attack and defense in breast cancer deep learning systems. Bioengineering 10 , 973 (2023)..

Fu, Y. G. et al. Patch-fool: are vision transformers always robust against adversarial perturbations. Print at https://arxiv.org/abs/2203.08392 https://arxiv.org/abs/2203.08392 (2025)

Gu, J. D., Tresp, V. & Qin, Y. Are vision transformers robust to patch perturbations? 17th European Conference on Computer Vision. 404-421, https://doi.org/10.1007/978-3-031-19775-8_24 https://doi.org/10.1007/978-3-031-19775-8_24 . (Springer, 2022).

Lovisotto, G. et al. Give me your attention: dot-product attention considered harmful for adversarial patch robustness. 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). 15213-15222. (IEEE, 2022)

Bruna, J. et al. Intriguing properties of neural networks. International Conference on Learning Representations. (OpenReview.net, 2014).

Carlini, N.&Wagner, D. Towards evaluating the robustness of neural networks. 2017 IEEE Symposium on Security and Privacy (SP). 39-57. (IEEE, 2017)

Madry, A. et al. Towards deep learning models resistant to adversarial attacks. 6th International Conference on Learning Representations. (OpenReview.net, 2019).

Chen, R. J. et al. Towards a general-purpose foundation model for computational pathology. Nat. Med. 30 , 850–862 (2024)..

Xu, H. W. et al. A whole-slide foundation model for digital pathology from real-world data. Nature 630 , 181–188 (2024)..

Vorontsov, E. et al. A foundation model for clinical-grade computational pathology and rare cancers detection. Nat. Med. 30 , 2924–2935 (2024)..

Zimmermann, E. et al. Virchow2: scaling self-supervised mixed magnification models in pathology. Print at https://doi.org/10.48550/arXiv.2408.00738 https://doi.org/10.48550/arXiv.2408.00738 (2024).

Saillard, C. et al. H-optimus-0. (2024).

Filiot, A. et al. Distilling foundation models for robust and efficient models in digital pathology. 28th International Conference on Medical Image Computing and Computer Assisted Intervention. 162-172. (Springer, 2025).

Bioptimus. H-optimus-1. (2025).

Kather, J. N., Halama, N. & Marx, A. 100, 000 histological images of human colorectal cancer and healthy tissue. at https://zenodo.org/records/1214456 https://zenodo.org/records/1214456 URL. (2018)

Wei, Z. P. et al. Towards transferable adversarial attacks on vision transformers. Print at https://arxiv.org/abs/2109.04176 https://arxiv.org/abs/2109.04176 (2022).

McInnes, L., Healy, J. & Melville, J. UMAP: uniform manifold approximation and projection for dimension reduction. Print at https://doi.org/10.48550/arXiv.1802.03426 https://doi.org/10.48550/arXiv.1802.03426 (2020).

Goodfellow, I. J., Shlens, J.&Szegedy, C. Explaining and harnessing adversarial examples. 3rd International Conference on Learning Representations. (OpenReview.net, 2015).

Komura, D. & Ishikawa, S. Histology images from uniform tumor regions in TCGA Whole Slide Images. at https://zenodo.org/records/3373439 https://zenodo.org/records/3373439 URL. (2020)

Polónia, A., Eloy, C. & Aguiar, P. BACH Dataset: grand challenge on breast cancer histology images. at https://zenodo.org/records/3632035 https://zenodo.org/records/3632035 URL. (2019)

Spanhol, F. A. et al. A dataset for breast cancer histopathological image classification. IEEE Trans. Biomed. Eng. 63 , 1455–1462 (2016)..

Lou, S. H. et al. A large histological images dataset of gastric cancer with tumour microenvironment annotation for AI. Sci. Data 12 , 138 (2025)..

Borkowski, A. A. et al. Lung and colon cancer histopathological image dataset (LC25000). Print at https://doi.org/10.48550/arXiv.1912.12142 https://doi.org/10.48550/arXiv.1912.12142 (2019).

Riasatian, A. et al. Fine-Tuning and training of Densenet for histopathology image representation using TCGA diagnostic slides. Med. Image Anal. 70 , 102032 (2021)..

Wang, L. et al. Artificial intelligence in clinical decision support systems for oncology. Int. J. Med. Sci. 20 , 79–86 (2023)..

Wang, Z. B. et al. Feature importance-aware transferable adversarial attacks. 2021 IEEE/CVF International Conference on Computer Vision (ICCV). 7619-7628. (IEEE, 2021)

Lu, M. Y. et al. A visual-language foundation model for computational pathology. Nat. Med. 30 , 863–874 (2024)..

Chen, Y. et al. SlideChat: a large vision-language assistant for whole-slide pathology image understanding. 2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). 5134-5143. (IEEE, 2025)

Tizhoosh, H. R. Beyond the failures: rethinking foundation models in pathology. Print at https://doi.org/10.48550/arXiv.2510.23807 https://doi.org/10.48550/arXiv.2510.23807 (2025).

Chen, Z. X. et al. Segment anything in pathology images with natural language. Print at https://doi.org/10.48550/arXiv.2506.20988 https://doi.org/10.48550/arXiv.2506.20988 (2025).

Chen, R. J. et al. Scaling vision transformers to gigapixel images via hierarchical self-supervised learning. 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). 16123-16134. (IEEE, 2022)

Ding, J. Y. et al. LongNet: scaling transformers to 1, 000, 000, 000 tokens. Print at https://doi.org/10.48550/arXiv.2307.02486 https://doi.org/10.48550/arXiv.2307.02486 (2023).

Tao, S. C. et al. Adversarial immunization for certifiable robustness on graphs. Proceedings of the 14th ACM International Conference on Web Search and Data Mining. 698-706, https://doi.org/10.1145/3437963.3441782 https://doi.org/10.1145/3437963.3441782 . (ACM, 2021)

Zhao, M. N. et al. Adversarial training: a survey. Print at https://doi.org/10.48550/arXiv.2410.15042 https://doi.org/10.48550/arXiv.2410.15042 (2024).

Pulfer, B., Belousov, Y. & Voloshynovskiy, S. Robustness tokens: towards adversarial robustness of transformers. 18th European Conference on Computer Vision. 110-127. https://doi.org/10.1007/978-3-031-73202-7_7 https://doi.org/10.1007/978-3-031-73202-7_7 . (Springer, 2024)

Macenko, M. et al. A method for normalizing histologyslides for quantitative analysis. 2009 IEEE International Symposium on Biomedical Imaging: From Nano to Macro. 1107-1110. https://doi.org/10.1109/ISBI.2009.5193250 https://doi.org/10.1109/ISBI.2009.5193250 . (IEEE, 2009)

Devlin, J. et al. BERT: pre-training of deep bidirectional transformers for language understanding. Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies. Minneapolis, Minnesota: Association for Computational Linguistics, 4171-4186. (2019)

Vaswani, A. et al. Attention is all you need. Proceedings of the 31st International Conference on Neural Information Processing Systems. 6000-6010. (Curran Associates Inc., 2017)

Radford, A. et al. Learning transferable visual models from natural language supervision. Proceedings of the 38th International Conference on Machine Learning. 8748-8763. (PMLR, 2021)

Liu, D. C. & Nocedal, J. On the limited memory BFGS method for large scale optimization. Math. Program. 45 , 503–528 (1989)..

Lucambio Pérez, L. R. & Prudente, L. F. A Wolfe line search algorithm for vector optimization. ACM Trans. Math. Softw. 45 , 37 (2019)..

Views

Downloads

CSCD

Alert me when the article has been cited

Submit

Tools

Publicity Resources

High-efficiency and stable deep-blue iridium phosphorescent OLEDs with enhanced charge transfer dynamics

Ultraviolet-C to mid-infrared supercontinuum generation in periodically poled lithium tantalate waveguides

Spectral level repulsion and Lifshitz-like states in hyperuniform disordered photonic networks

Skyrmions based on optical anisotropy for topological encoding

High-efficiency multi-scale holographic volumetric 3D printing with a phase light modulator

Related Author

No data

Related Institution

No data

⁰