{"id":"de58699b-af35-4363-83d0-e22869ef6489","arxiv_id":"2412.18706","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"SurvAttack uses ontology-guided additions, removals, and replacements of medical codes to flip the survival-time rankings predicted by black-box survival models.","lead":"SurvAttack is a new attack method that subtly changes medical codes in electronic health records to fool survival models into misranking which patients need urgent care. It could be used to stress-test hospital AI before deployment, or to find which parts of a patient history most influence a survival prediction.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"SurvAttack's 'clinically compatible' claim rests on an unvalidated, survival-pretrained SSF cosine-similarity threshold; if SSF is permissive, perturbations are not clinically subtle even though the reported c-index drops may hold.","rationale":"The reader's weakest_assumption correctly identifies the unvalidated SSF as the load-bearing premise for the paper's central 'clinically compatible' claim. If SSF is not a faithful measure of clinical compatibility, the perturbations may be obvious to clinicians, and the attack's realism and safety motivation collapse even if the quantitative attack success (large c-index/MAE degradation) survives. This is a conceptual gap, not a mere implementation detail, because SSF is embedded in both the scoring function (Eq. 10) and the final acceptance check (Algorithm 2). The paper gives no external evidence for SSF's validity; it is a self-referential, survival-pretrained encoder. I therefore agree with the reader's verdict of CONDITIONAL: the empirical attack results are plausible but the stealthiness guarantee is unsupported. I also noticed a secondary issue in the DSA description (Algorithm 3 sorts ascending by true survival time while seeking to invert observed-observed rankings), which could affect reproducibility, but I do not elevate it above the SSF concern because it may be a simple textual typo and does not undermine the core contribution as fundamentally. The proposed clinician-judgment test would directly settle whether the SSF threshold meaningfully enforces clinical compatibility.","tokens_in":18260,"tokens_out":9379,"duration_ms":84256,"concrete_test":"Take a random sample of 100 successfully attacked patient pairs (V, V*) generated by SurvAttack with SSF >= 0.90 across the four victim models, and have two or more clinicians with AKI domain expertise independently judge whether each perturbed record is clinically plausible (e.g., 'Would this altered medication/diagnosis history be realistic for a patient with this profile?') on a Likert scale. Compute the fraction of high-SSF perturbations that clinicians deem implausible and report inter-rater agreement. If a substantial fraction (e.g., >20%) of SSF-compliant perturbations are judged clinically implausible, the SSF proxy fails as a stealthiness constraint.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that SurvAttack produces 'subtle, clinically compatible, and semantically consistent' perturbations depends entirely on the Semantic Similarity Function (SSF) introduced in Section 3.4 (Eq. 5) and enforced as the final stealthiness check in Algorithm 2. SSF is the cosine similarity between embeddings of the original and perturbed EHRs, produced by an ontology-aware encoder pre-trained on the survival task in the authors' prior work (ref [32]). This is not a validated proxy for clinical compatibility: it measures proximity in a survival-predictive latent space, not medical plausibility. Two codes that lead to similar survival predictions could be clinically very different (e.g., adding 'acute myocardial infarction' vs. adding a nonspecific symptom code), and the threshold theta=0.90 is chosen without calibration. Because SSF is used both in the composite scoring (Section 3.5, Eq. 10) and as the attack's final gate, a permissive SSF would let the attack make clinically obvious changes while still being labeled 'compatible,' collapsing the paper's safety and realism argument even if the Table 1 c-index and MAE numbers are accurate. The paper provides no clinician validation, no external semantic benchmark, and no comparison against ontology-based distances. A secondary reproducibility concern compounds this: DSA (Section 3.7, Algorithm 3) says it sorts observed patients ascending by true survival time while aiming to make observed-observed pairs discordant; with the described 'above t_min' target, ascending order would preserve concordance rather than invert it, suggesting a typo or an undocumented mechanism that could affect reported results.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes SurvAttack, a black-box adversarial attack framework for survival models on longitudinal electronic health records (EHRs). The method combines ontology-informed synonym code selection (SCS), a composite code scoring (CCS) strategy that balances a saliency index with a deep semantic similarity function (SSF), and a dynamic survival-specific attack strategy (DSA) that perturbs censored and observed patients to degrade the c-index and MAE of four survival models (CoxCC, DeepSurv, N-MTLR, DeepHit). Experiments on a private AKI EHR dataset with roughly 77k patients show large drops in c-index and increases in MAE under SurvAttack compared with several adapted text-attack baselines, and the paper includes attack-pattern analyses and a case study. The authors claim the perturbations are subtle, clinically compatible, and semantically consistent.","tokens_in":18550,"tokens_out":8121,"duration_ms":75160,"significance":"If the empirical claims hold, the paper makes a useful contribution: it is one of the first query-only black-box attack frameworks targeted at survival ranking rather than at classification or regression, with potential value for pre-deployment robustness testing and counterfactual interpretation. The paper's strengths include its black-box threat model, the use of ontology and co-occurrence information to narrow candidate code edits, a released anonymous implementation, and consistently large reported degradations (e.g., DeepSurv c-index from 0.6934 to 0.0569 and MAE from 2.01 to 4.48). However, the central 'clinically compatible and semantically consistent' claim rests on an unvalidated deep-embedding similarity function, and the quantitative results lack statistical uncertainty quantification. The significance is therefore conditional on addressing the validation and correctness concerns below.","major_comments":[{"comment":"The claim that SurvAttack produces 'subtle, clinically compatible, and semantically consistent' perturbations is not established. Section 3.4 defines SSF as cosine similarity in the latent space of an encoder pre-trained on the survival task in prior work [32], but the paper provides no validation against clinicians, no external semantic benchmark, and no comparison with ontology-based or co-occurrence-based similarity measures. Because the same SSF is used as the final stealthiness gate in Algorithm 2 (the SSF checks after adding, removing, and replacing) and also enters the composite score in Eq. (10), a permissive SSF could allow clinically obvious edits to pass as compatible even while the reported c-index degradation holds. The threshold θ=0.90 is stated in Section 4.2 without calibration or sensitivity analysis. The c-index degradation itself is not circular because it is measured against separately trained victim models, but the clinical-compatibility conclusion is circular relative to SSF unless SSF is independently validated. I recommend either external validation of SSF (e.g., clinician-rated pairs or agreement with established medical text similarity metrics) and a sensitivity analysis over θ, or a clear narrowing of the claim to semantic consistency in the SSF latent space.","section":"3.4, Eq. (5); 3.6, Algorithm 2; 4.2"},{"comment":"The DSA strategy as written does not implement the stated target-time logic. Section 3.7 says that if an observed patient's predicted time is above t_min, the algorithm perturbs the record until the predicted time becomes 'closest to t_min but above it'; however, Algorithm 3 simply calls Algorithm 2 with target time t=t_min, and Algorithm 2 only checks whether each action moves F(V*) in the requested direction relative to the current prediction (the checks such as 'ΔF = F(V*) − T_cur towards direction'). For direction 'decrease', any decrease is accepted, so the predicted time can cross below t_min without triggering any stop, and the invariant that all observed patients remain above the censored patients is not enforced. This can leave observed–observed and observed–censored pairs concordant despite the attack, undermining the claimed c_t and c_ob results. Algorithm 2 should include an explicit crossing check that stops at the target, or Algorithm 3 should verify the target condition after each call.","section":"3.7, Algorithm 3; Algorithm 2"},{"comment":"The quantitative comparison lacks any measure of variability. Table 1 reports single point estimates without error bars, confidence intervals, or significance tests, and no information is given about the number of runs or random seeds. This is consequential because the Random baseline sometimes improves the c-index over No Attack (CoxCC c1: 0.742 vs 0.7107; DeepSurv c1: 0.7814 vs 0.6934), yet Section 4.3 states without qualification that 'Random demonstrates the worst results.' The paper should report bootstrap confidence intervals or multiple-run results with paired tests, at least for the comparison between SurvAttack and the strongest baseline, and should explicitly discuss the cases where Random improves ranking.","section":"Table 1; Section 4.3"},{"comment":"The free parameters of the method are fixed without justification or sensitivity analysis: the co-occurrence threshold p=0.75, the SSF similarity threshold θ=0.90, and λ in the exponential weighting of Eq. (10). Since Eq. (10) and the SSF threshold directly control both attack success and the claimed stealthiness, it is unclear whether the Table 1 results are robust to these choices or selected to favor the method. An ablation or sensitivity study over p, θ, and λ is needed to support the general claim of effectiveness.","section":"4.2, Eq. (10)"}],"minor_comments":[{"comment":"Section 1 contains a duplicated sentence: 'Mining health records uncovers valuable patterns and insights to enhance healthcare decision-making' appears twice in consecutive sentences; one copy should be removed.","section":"1"},{"comment":"The similarity threshold is denoted ε in Section 4.2 but θ in Section 3.1 and Algorithm 2; please unify the notation.","section":"4.2"},{"comment":"In the case study, the text states that drug code N05CA was replaced with N05CD, but the reported co-occurrence is written as P(C09DA|C09DX) >= 0.75; these code identifiers are inconsistent and should be corrected.","section":"4.3.2"},{"comment":"The Table 4 caption reports 'SI = 0.96%' for the case study, while Eq. (5) defines SSF as a cosine similarity in [0,1]; please clarify whether the intended value is 0.96 or 96% and align the units.","section":"Table 4"},{"comment":"The column labels c1, c2, c_t, and c_ob are described only in the prose of Section 4.3; define them explicitly in the table caption or immediately before the table for readability.","section":"Table 1"},{"comment":"The dataset is private and described only as coming from an anonymous university medical center; the anonymous code release is helpful, but a detailed data schema, code mappings, and model training hyperparameters would materially improve reproducibility.","section":"4.1"},{"comment":"The claim of being the first black-box attack on survival models should be softened to 'to the best of our knowledge' or accompanied by a more thorough search of prior survival-model attack literature.","section":"5"}],"recommendation":"major_revision","confidential_remarks":"This is a potentially valuable applied ML contribution, but the 'clinically compatible' claim currently outruns the evidence, and the DSA algorithm has a correctness gap relative to its stated invariant. The scope fits an applied data-mining or biomedical informatics venue. I would be willing to see a major revision that adds SSF validation, fixes or clarifies the target-time logic in DSA, and adds uncertainty quantification to the main table."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Read SurvAttack. It's the first black-box attack framework for survival models on longitudinal EHRs, and the core result is a large c-index drop: from 0.6934 to 0.0569 for DeepSurv under the full attack, with MAE up from 2.01 to 4.48. The framework is coherent – greedy scoring of remove/add/replace actions, ontology-informed synonym selection via co-occurrence, and a survival-specific DSA strategy. The ablation (SurvAttack vs SurvAttack-NoSym) shows that including the semantic similarity term in scoring helps, not just as a downstream filter. That's a real contribution.\n\nThe main ranking-degradation result is not circular: c-index is measured against separately trained victim models, so the numbers stand on their own. I also value the baseline adaptations (Surv-TextBugger, Surv-PWWS, Surv-WS) and the attempt at interpretability through visit and code frequency analysis.\n\nNow the soft spots, in order of seriousness. First, the 'clinically compatible' claim rests entirely on SSF, a cosine similarity in an embedding space from the authors' own prior survival model (ref [32]). That is a proxy for medical plausibility, not a validated one. The threshold θ=0.90 is arbitrary, there is no clinician validation and no external semantic benchmark. If SSF is permissive, the perturbations could be obvious in practice while still passing the check. Second, no error bars or significance tests anywhere. One oddity: for CoxCC, Random attack improves c1 from 0.7107 to 0.742, and that is not discussed. Third, hyperparameters λ, p, and θ are reported once and never swept. Fourth, the DSA description (Section 3.7, Algorithm 3) looks internally inconsistent. Patients are sorted ascending by true survival time, and each is attacked to land just above a running t_min, which is then updated to that new prediction. As written, that would preserve concordance among observed-observed pairs, not destroy it. The reported c2 drops imply the implementation must do something different – maybe descending order, or 'below t_min' instead of 'above.' As it stands, a reader trying to reproduce DSA from the text would be stuck. This needs a corrected algorithm or a clear explanation.\n\nOverall, the paper deserves a serious referee. The core idea is new, and the quantitative story is strong enough to warrant revision rather than desk reject. I would bring it to a reading group on adversarial learning in health, and I would cite it as the first black-box attack on survival models, but I would want the DSA issue and the SSF validation settled before trusting its details.","headline":"First black-box attack on survival models, with a big c-index drop; the big caveats are an unvalidated SSF and a DSA description that seems to contradict itself.","tokens_in":19125,"tokens_out":4909,"would_cite":true,"duration_ms":38756,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A query-only attacker can collapse survival-ranking quality by editing EHR codes through ontology-informed substitutions, dropping DeepSurv's c-index from 0.6934 to 0.0569.","keywords":["adversarial attack","survival analysis","electronic health records","black-box attack","ontology-informed perturbation","semantic similarity","acute kidney injury","concordance index"],"falsifier":"A concrete falsifying observation would be a clinician-labeling study: take SurvAttack's attacked and intact records that both pass the 0.90 semantic-similarity threshold, and if clinicians can reliably tell which are attacked at above-chance accuracy, the stealthiness guarantee is refuted.","tokens_in":18067,"feed_emoji":"🏥","tokens_out":8532,"duration_ms":74639,"temperature":0.7,"pith_summary":"SurvAttack claims that a black-box adversary who can only query a survival model can seriously degrade its predictive performance on longitudinal electronic health records (EHRs) by making small, ontology-guided edits to the medical codes in a patient's history. The paper develops a greedy algorithm that scores three actions — removing a code, adding a synonymous code, and replacing a code — by combining the model-output change with a deep semantic-similarity score, then uses a dynamic cohort-level strategy to flip the survival-urgency ranking across patients. On an acute kidney injury EHR cohort of 77,809 patients, the full attack drives DeepSurv's c-index from 0.6934 to 0.0569 and its mean absolute error from 2.01 to 4.48, while keeping perturbed records above the semantic-similarity threshold. If this claim holds, the framework provides both a pre-deployment robustness test for survival models and a source of counterfactual insight into which codes and visits control survival predictions.","feed_headline":"Query-only EHR edits collapse survival-model rankings","feed_subtitle":"A greedy ontology-aware attack flips patient urgency rankings; DeepSurv's c-index falls from 0.69 to 0.06.","key_machinery":"The central object is the composite code scoring (CCS) function \\(h = \\$\\Delta$ F \\cdot $e^{{\\lambda SI}}$\\) that ranks candidate perturbations, where \\(\\$\\Delta$ F\\) is the saliency (output change of the victim survival model) and \\(SI\\) is the semantic similarity index. The Semantic Similarity Function (SSF) backing \\(SI\\) is a transformer-based, ontology-aware encoder — GRAM, attention pooling, and transformer — pretrained on a survival objective and used both to score candidates and as the final stealthiness check (threshold 0.90). Candidate codes are generated by the ontology-informed Synonym Code Selection (SCS) strategy: ontology siblings of a target code are kept only if the conditional co-occurrence probability \\(P(s_{ij}|c_i)>0.75\\). The Dynamic SA-specific (DSA) attack organizes the per-patient greedy search into a cohort-level ranking flip by first pushing censored patients' predicted survival times to 0 and then attacking observed patients around a running minimum target.","core_discovery":"On the paper's own terms, the central discovery is that discrete EHR perturbations can be chosen in a black-box setting so that a survival model's temporal ranking of patient urgency is inverted while the edited record remains semantically close to the original in the embedding space of an ontology-aware encoder. The mechanism is a composite score \\(h = \\$\\Delta$ F \\cdot \\varphi(SI)\\) with \\(\\varphi(z)=$e^{{\\lambda z}}$\\), where \\(\\$\\Delta$ F\\) is the change in predicted survival time and \\(SI\\) is the cosine similarity from the Semantic Similarity Function (SSF); candidates are executed greedily in score order, and the Dynamic SA-specific (DSA) strategy attacks each censored patient once and then each observed patient once to make concordant pairs discordant. Experimentally, the full attack lowers c-index and raises MAE on all four victim models, with DeepSurv showing the largest drop in concordance from 0.6934 to 0.0569 and MAE rising from 2.01 to 4.48. The authors interpret the attack-pattern statistics as evidence that the method also contributes model interpretability, since the most-targeted visits and codes align with known clinical risk factors for AKI.","pith_inferences":["The paper leaves untested whether the 0.90 cosine-similarity threshold matches clinical perception; a clinician study that asks physicians to distinguish attacked from intact records would test whether the attack's stealthiness claim holds outside the embedding space.","Because the SSF encoder comes from the same research line as the attack itself, the notion of similarity may be tailored to that encoder's blind spots; replacing SSF with an independently trained clinical encoder would test whether the finding generalizes.","The paper does not study transferability across victim models, but since the attack acts through shared ontology structure and code co-occurrence statistics, perturbations found against one survival model may also degrade another, which would broaden the threat model."],"forward_implications":["A hospital deploying an EHR survival model for triage must treat the input record as a manipulated surface: a query-only adversary can reverse urgency rankings without dropping below the model's own semantic-similarity threshold.","The attack can serve as a pre-deployment robustness test, and the size of the c-index drop under SurvAttack differentiates which survival models are safer to trust for patient prioritization.","The perturbation patterns provide counterfactual explanations: the last visit and drug codes carry most decision weight, and codes like acute myocardial infarction (ICD-9 410) are among the most effective additions, consistent with known AKI risk factors.","Because DSA needs only one attack per patient, cohort-wide ranking disruption is computationally feasible, so robustness testing can be run at scale over the full patient population."],"supporting_citations":[{"why":"Supplies the pretrained survival-aware encoder whose embeddings define the SSF similarity check.","marker":"[32]"},{"why":"Provides the ontology-aware GRAM attention component inside the SSF encoder.","marker":"[5]"},{"why":"Provides the real-world AKI EHR dataset on which all attacks and victim models are evaluated.","marker":"[28]"},{"why":"Defines the concordance index, the primary ranking metric the attack aims to degrade.","marker":"[19]"},{"why":"DeepSurv is one of the four victim survival models attacked.","marker":"[21]"},{"why":"CoxCC is one of the four victim survival models attacked.","marker":"[24]"},{"why":"N-MTLR is one of the four victim survival models attacked.","marker":"[13]"},{"why":"DeepHit is one of the four victim survival models attacked.","marker":"[25]"},{"why":"Serves as the PWWS baseline adapted to survival models for comparison.","marker":"[37]"},{"why":"Serves as the TextBugger baseline adapted to survival models for comparison.","marker":"[26]"}],"fun_headline_variants":["SurvAttack: stealthy EHR edits flip survival rankings","Black-box ontology attack inverts patient urgency order","Greedy EHR perturbations crush survival model accuracy","Semantic-compatible tweaks collapse survival rankings"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the cosine similarity computed by the paper's own EHR encoder is a valid measure of clinical compatibility, so records kept above the 0.90 threshold are genuinely subtle and clinically plausible.","fun_headline_variants_meta":{"raw":{"variants":["SurvAttack: stealthy EHR edits flip survival rankings","Black-box ontology attack inverts patient urgency order","Greedy EHR perturbations crush survival model accuracy","Semantic-compatible tweaks collapse survival rankings"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00024,"raw_usage":{"total_tokens":1575,"prompt_tokens":1058,"completion_tokens":517,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":674,"completion_tokens_details":{"reasoning_tokens":456}},"tokens_in":674,"tokens_out":517,"duration_ms":5348,"temperature":1.0,"reasoning_tokens":456,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T04:33:10.524409+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A concrete falsifying observation would be a clinician-labeling study: take SurvAttack's attacked and intact records that both pass the 0.90 semantic-similarity threshold, and if clinicians can reliably tell which are attacked at above-chance accuracy, the stealthiness guarantee is refuted.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the pretrained survival-aware encoder whose embeddings define the SSF similarity check."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the real-world AKI EHR dataset on which all attacks and victim models are evaluated."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"DeepSurv is one of the four victim survival models attacked."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Serves as the PWWS baseline adapted to survival models for comparison."}],"review_version":1}