Pith. sign in

REVIEW 4 major objections 6 minor 135 references

Systems-Theoretic and Data-Driven Security Analysis in ML-enabled Medical Devices

T0 review · 4 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that a suite of NLP- and LLM-assisted tools can convert public recall, adverse-event, and vulnerability data into comprehensive premarket cybersecurity risk assessments for ML-enabled medical devices.

desk verdict Useful new FDA-data snapshot of ML medical device security, but the central practical-attack-path claim is an unvalidated LLM-generated scenario. read the letter →

arxiv 2506.15028 v1 pith:RMOWLRAT submitted 2025-06-18 cs.CR cs.ETcs.LG

Gargi Mitra , Mohammadreza Hallajiyan , Inji Kim , Athish Pranav Dharmalingam , Mohammed Elnawawy , Shahrear Iqbal , Karthik Pattabiraman , Homa Alemzadeh This is my paper · ORCID
classification cs.CRcs.ETcs.LG
keywords ML-enabledmedicaldevicespremarketsecurityriskassessmentfalsedatainjectionattackssystems-theoreticanalysisprocessforlargelanguagemodelsdevicerecallsadverseevent
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to make premarket cybersecurity review of ML-enabled medical devices possible from public data. It argues that regulatory summaries of approved devices rarely record whether manufacturers assessed security at all, and that existing assessment methods focus on component flaws rather than end-to-end attack paths through interconnected third-party devices. To close that gap, the authors build a pipeline of natural-language and LLM-assisted tools that reconstruct a device's control structure, identify the ML technique and known model attacks, scan vulnerability databases for flaws in compatible peripherals, and mine recall and adverse-event reports for patient-safety impacts. The central demonstration is a nine-step attack scenario in which an adversary exploits an unpatched home Wi-Fi router to inject false glucose readings into a diabetes-management app and cause an overdose-level insulin recommendation.

What carries the argument

The load-bearing mechanism is SAM, a tool that runs an LLM-aided systems-theoretic security analysis through a prompt template. The template takes a system description, data flow, an ML attack, a targeted peripheral component, its technology, and a known vulnerability, and returns a list of attack steps. Earlier pipeline stages supply these inputs: a control-structure builder models interconnections, a technology identifier catalogs peripheral and model technologies, a search tool retrieves relevant ML attacks, and database scans find known vulnerabilities and past safety incidents.

What would settle it

Run the nine-step d-Nav attack scenario in a laboratory with the specified router firmware; if the manipulated glucose readings do not drive the ML engine to recommend an excessive insulin dose, the demonstrated path breaks. Separately, audit manufacturers whose public summaries omit security information; if their internal development files show thorough assessments, the paper's documentation-gap claim weakens.

Watch

Extended reading notes

Core claim

The central claim is that comprehensive premarket risk assessment for an ML-enabled medical device can be assembled from public sources by coupling a systems-theoretic control-structure model with data about known vulnerabilities, recalls, and adverse events. The paper's specific contribution is identifying attack vectors that require first exploiting a vulnerability in a third-party connected component before executing a known attack against the ML model, and anticipating the patient-safety impact of such attacks by mining past incidents on similar devices. In the worked example, this produces a nine-step path from an unpatched router to a manipulated glucose reading and an overdose-level insulin recommendation.

Load-bearing premise

The load-bearing premise is that public regulatory summaries reflect what manufacturers actually did about security, and that manually validated LLM-generated attack steps are a faithful stand-in for real, executed attacks.

Editorial extensions

If this is right

  • Premarket reviewers could enumerate attack paths that start in third-party components without requiring the ML device itself to be compromised.
  • The nine-step scenario demonstrates that a common home-router vulnerability can be chained into an ML misprediction with potentially fatal consequences, giving manufacturers a concrete template for similar devices.
  • If the paper's documentation-gap finding reflects practice, regulators gain a way to spot submissions lacking security evidence, and manufacturers gain a method for filling that gap from public data.
  • Safety-impact estimates become data-driven: instead of guessing severity, analysts can point to recalls and adverse events on functionally similar devices.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The biggest unstated risk is that public regulatory summaries are documentation artifacts; auditing manufacturers' internal design files would be needed to know whether the reported gap reflects practice or just paperwork.
  • The same pipeline could be ported to other safety-critical ML domains, such as autonomous vehicles or industrial control, because the underlying move from a component vulnerability to an ML misprediction is not specific to medicine.
  • A natural test of the method's assurance value would be a laboratory red-team exercise that actually executes the nine-step scenario rather than relying on manually validated LLM-generated steps.
  • The approach could become a continuous post-market monitor if it were re-run automatically whenever new vulnerability records are published; the paper leaves that implementation as future work.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. This paper analyzes publicly available FDA databases (510(k) summaries, recalls, MAUDE adverse events) and vulnerability databases (CVE, ICS-CERT) to characterize the security and safety landscape of ML-enabled medical devices, and it presents a suite of NLP- and LLM-aided tools (SAM, MedAIScout, MedSafe) intended to assist security analysts in premarket security risk assessment. The authors report that over 65% of FDA premarket summaries for ML-enabled devices either omit security risk assessment information or describe what the authors consider inadequate assessment methods. The paper's stated novelties are (i) identifying attack vectors that exploit vulnerabilities in third-party connected components to practically execute known attacks on ML models, and (ii) anticipating the safety impacts of such attacks by analyzing past incidents on similar devices. The central demonstration is a nine-step STPA-Sec attack path for the d-Nav BGMS, in which an adversary exploits an unpatched Wi-Fi router vulnerability to inject false glucose readings and cause insulin misadministration.

Significance. If the claims were fully supported, the framework would be a useful addition to premarket security assessment for ML-enabled medical devices, with practical relevance to manufacturers and regulators. The paper draws on public data, grounds its analysis in the STAMP/STPA-Sec tradition, and is transparent about several limitations, including the 'best-guessed' ML techniques in Table 1 and the challenge of automating information retrieval. However, the central validation is an unexecuted, LLM-generated attack scenario, and the headline empirical claim equates missing documentation in FDA summaries with inadequate assessment practice. As it stands, the evidence does not support the 'comprehensive premarket risk assessment' and 'practically execute known attacks' claims, though the underlying direction is promising and the issues appear addressable with revised claims and additional validation.

major comments (4)
  1. [Section 3.3, Table 6] The only demonstration of the claimed central novelty is the d-Nav nine-step attack path, but this is an LLM-generated scenario that has not been executed end-to-end; steps 5 through 9 are labeled 'Expected reaction' or 'Expected end result' rather than observed outcomes. The path assumes an unpatched Wi-Fi router with CVE-2023-35836 without establishing a specific router model, firmware version, or network configuration, and it relies on d-Nav's ML technique being reinforcement learning, which Table 1 itself marks as 'best-guessed.' To support the claim that the approach identifies attacks that can 'practically execute known attacks on the ML models,' the authors should either validate the path in a representative testbed with the identified router and device, or explicitly reframe the contribution as generating plausible, analyst-reviewed hypotheses whose feasibility remains to be demonstrated. The current wording in the Abstract and Section 4 overstates what is shown.
  2. [Section 1, Figure 1, Section 3.2] The claim that 'for over 65% of these devices, the manufacturers either do not provide any information about the assessment method in their documentation, or employ inadequate assessment methods' is based on the absence or brevity of security-risk-assessment information in FDA premarket summaries. FDA 510(k) summaries are not full records of manufacturers' internal security assessment processes, so the analysis conflates documentation with practice. The paper should either restrict the claim to 'summaries do not report security assessment information' or provide independent corroborating evidence that the absence reflects actual inadequacy, such as postmarket incident data or manufacturer disclosures.
  3. [Table 1, Section 3.2, Section 3.3] The ML technique for d-Nav and several other devices in Table 1 is 'best-guessed' from the literature rather than confirmed by the manufacturer. The proposed attack path depends on d-Nav using reinforcement learning; if the actual technique is different, the model inversion premise and the subsequent misprediction step in Table 6 are unsupported. The case study should be explicitly conditioned on this assumption, and the authors should either obtain confirmation of the ML technique or analyze how the attack path would change for other plausible techniques.
  4. [Section 3.2, Section 3.3] The claimed effectiveness of the tools is not quantitatively evaluated or reproducible from the text. MedAIScout is reported to have 'successfully uncovered relevant vulnerabilities in four devices' with no precision, recall, or ground-truth comparison; the SAM attack-step generation is shown only through the single d-Nav example; and the FDA statistics (e.g., the 65% figure and the adverse-event counts) are presented without error bars or a detailed description of the query, inclusion/exclusion, and classification procedures. The authors should provide an evaluation protocol, release the data and prompts (or a detailed appendix), and state the LLM versions and parameters used, so that the central claims can be checked.
minor comments (6)
  1. [Reference [30]] Reference [30] is internally inconsistent: the title reads 'CVE-2023-3583' while the URL and the text use 'CVE-2023-35836'; please verify the correct identifier and URL.
  2. [Section 3, first paragraph] The sentence listing the tools contains a stray comma: 'information extraction, , and systems-theoretic accident causality analysis' should be corrected.
  3. [Abstract, Section 4] The phrase 'anticipate for the potential safety impacts' should be changed to 'anticipate the potential safety impacts.'
  4. [Table 1] The column heading 'Known ML attacks' lists known vulnerabilities in peripheral components (e.g., Android vulnerabilities, PACS server, Bluetooth) rather than ML-specific attacks; consider renaming the column to 'Known vulnerabilities in connected components' to avoid confusion.
  5. [Section 3.3] The text states that LLM outputs can 'be later manually validated by security analysts,' but it does not report whether the nine steps in Table 6 were actually validated by a human analyst; please state explicitly whether validation was performed, and if so, by whom and with what criteria.
  6. [Figure 5] The figure and its caption would benefit from reporting the total number of adverse events and the exact time period analyzed, since the text mentions 'over 1,460 adverse events' but the figure does not show denominators.

Circularity Check

2 steps flagged · score 4.0 of 10

d-Nav attack path is an LLM restatement of assumed inputs, with the model-inversion premise resting on a self-cited best guess; overall findings only partially circular.

  1. self definitional [Section 3.3, SAM attack-step generation prompt (page 21-22); d-Nav case study and Table 6.]
    "You are given a system description, an ML attack, a targeted input peripheral component, and a known vulnerability in the input component. Give a list of steps to show how an adversary can exploit the vulnerability to mislead the ML-enabled component and how that affects the action of the output device on the patient."

    The paper's stated novelty (Section 4) is 'identifying attack vectors that require exploiting vulnerabilities in third-party connected components to practically execute known attacks on the ML models.' The only demonstration is the d-Nav nine-step path, but SAM's prompt already provides the known vulnerability, the targeted peripheral, and the ML attack, and asks the LLM to 'show how an adversary can exploit the vulnerability.' The generated Table 6 steps (router exploitation, data tampering, model inversion, insulin misadministration) are thus an elaboration of the input assumptions, not an observed or experimentally validated attack.

  2. self citation load bearing [Section 3.2, ML Technology and Vulnerability Identification; Table 1 footnote; Section 3.3 d-Nav scenario.]
    "In our latest work [32], we proposed MedAIScout, a semi-automated NLP- and LLM-aided tool designed to retrieve information on known ML vulnerabilities relevant to ML-enabled medical devices. MedAIScout can analyze available information and infer the most likely ML technique by referencing similar devices documented in existing literature."

    The d-Nav attack premise is that the device uses reinforcement learning and is vulnerable to model inversion. Table 1 marks the algorithm with '∗: Best-guessed ML algorithm,' and Section 3.3 says the model inversion attack was 'identified by MedAIScout [32] in a previous step described in §3.2.' MedAIScout is the authors' own tool, and its inference substitutes for manufacturer disclosure. If the best guess is wrong, the chosen ML attack and the misprediction/misadministration steps lose their basis. This is load-bearing self-citation: the support for the central case study is an unverified guess from the authors' previous work, with no external confirmation of the actual d-Nav ML technique.

full rationale

The paper is not a derivation in the equation sense, and its large-scale empirical claims (recall, adverse-event, and vulnerability statistics) rest on public FDA, CVE, and ICS-CERT data, so there is no fitted-parameter circularity. What raises the score is the single demonstration of the central novelty: the d-Nav attack path is an LLM-generated restatement of the prompt's assumptions (known router CVE, best-guessed RL model, assumed model-inversion attack), with no executed attack or analyst validation. The RL/model-inversion premise is further anchored in a self-cited tool (MedAIScout) that is explicitly 'best-guessed.' That is partial circularity in the paper's key example, though the surrounding data pipeline retains independent content. Score 4 reflects one load-bearing self-citation and one by-construction scenario, not a fully circular derivation.

Assumptions & free parameters 0 free parameters · 6 assumptions · 0 invented entities

No fitted numerical parameters appear; the quantitative claims are counts and proportions from public FDA databases, and the demonstration scenario is a hypothetical attack path. The paper introduces software tools (SAM, MedAIScout, MedSafe) rather than postulated scientific entities; no new physical or conceptual entity requires independent evidence.

assumptions (6)
  • domain assumption FDA databases (510(k) summaries, recalls, MAUDE) are representative of real-world safety and security issues in ML-enabled medical devices.
    The paper's headline statistics (65% lacking assessment info, 1,460 adverse events, 92% malfunctions) are computed from these databases; Section 2.5 admits the AI/ML device list is not comprehensive and MAUDE is voluntary.
  • domain assumption Published ML attacks such as model inversion and false data injection transfer to the specific FDA-approved devices analyzed here.
    The d-Nav case study combines an inference-time model inversion attack with a router CVE to produce an insulin-dose misprediction, but no end-to-end attack is executed.
  • domain assumption CVE and ICS-CERT registries cover the relevant vulnerabilities in peripheral devices and communication technologies.
    Attack-surface analysis in Section 3.2 queries only these public registries, so unknown or undisclosed vulnerabilities are outside the analysis.
  • ad hoc to paper LLM-generated STPA-Sec attack steps are relevant and sufficiently complete when manually validated by an analyst.
    Section 3.3 provides only a prompt template; the paper reports no quantitative evaluation of the accuracy or coverage of the LLM outputs.
  • domain assumption STAMP/STPA-Sec control structures adequately capture the hierarchy and data flows of ML-enabled medical systems.
    The framework models the d-Nav system as a control structure with the ML engine as controller; modeling errors would propagate into the generated attack steps.
  • ad hoc to paper Absence of security risk assessment information in FDA approval summaries indicates absence or inadequacy of assessment.
    The 65% claim counts devices whose summaries omit or briefly mention assessment methods; the paper equates missing documentation with inadequate practice.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Systems-Theoretic and Data-Driven Security Analysis in ML-enabled Medical Devices." pith.science (2026). https://pith.science/paper/RMOWLRAT

@misc{pith2026250615028,
  author       = {Pith},
  title        = {Pith review of: Systems-Theoretic and Data-Driven Security Analysis in ML-enabled Medical Devices},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RMOWLRAT}},
  note         = {Machine review of arXiv:2506.15028}
}
read the original abstract

The integration of AI/ML into medical devices is rapidly transforming healthcare by enhancing diagnostic and treatment facilities. However, this advancement also introduces serious cybersecurity risks due to the use of complex and often opaque models, extensive interconnectivity, interoperability with third-party peripheral devices, Internet connectivity, and vulnerabilities in the underlying technologies. These factors contribute to a broad attack surface and make threat prevention, detection, and mitigation challenging. Given the highly safety-critical nature of these devices, a cyberattack on these devices can cause the ML models to mispredict, thereby posing significant safety risks to patients. Therefore, ensuring the security of these devices from the time of design is essential. This paper underscores the urgency of addressing the cybersecurity challenges in ML-enabled medical devices at the pre-market phase. We begin by analyzing publicly available data on device recalls and adverse events, and known vulnerabilities, to understand the threat landscape of AI/ML-enabled medical devices and their repercussions on patient safety. Building on this analysis, we introduce a suite of tools and techniques designed by us to assist security analysts in conducting comprehensive premarket risk assessments. Our work aims to empower manufacturers to embed cybersecurity as a core design principle in AI/ML-enabled medical devices, thereby making them safe for patients.

Figures

Figures reproduced from arXiv: 2506.15028 by the authors.

Figure 1
Figure 1. Growing number of AI/ML-enabled medical devices and the rise of [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Left: Typical System Control Structure of Interconnected ML-enabled [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Overall Approach for Systems-Theoretic and Data-Driven Analysis of [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Control Structure of the d-Nav System. Note that, while setting up the [PITH_FULL_IMAGE:figures/full_fig_p013_4.png]
Figure 5
Figure 5. Figure 5: Left: Adverse Events by Device Category (FDA Approval Panel), [PITH_FULL_IMAGE:figures/full_fig_p019_5.png]
Figure 6
Figure 6. Figure 6: Example Accident Causality Analysis using STAMP for an [PITH_FULL_IMAGE:figures/full_fig_p020_6.png]

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

135 extracted references · 74 canonical work pages

  1. [30]

    CVE: CVE-2023-3583 (2024), URL: https://cve.mitre.org/cgi-bin/cvename.cgi? name=CVE-2023-35836, Last accessed: Apr 18, 2025

    2024

  2. [1]

    https://info.finitestate.io/ 2023-state-of-cybersecurity-for-medical-devices-and-healthcare-systems

    2023 State of Cybersecurity for Medical Devices and Healthcare Sys- tems. Tech. rep., Health-ISAC (August 2023), "https://info.finitestate.io/ 2023-state-of-cybersecurity-for-medical-devices-and-healthcare-systems"

    2023

  3. [2]

    Universitätsbibliothek der Universität Stuttgart (2014)

    Abdulkhaleq, A., Wagner, S.: Open tool support for system-theoretic process analysis. Universitätsbibliothek der Universität Stuttgart (2014)

    2014

  4. [3]

    Abdulkhaleq, A., Wagner, S.: XSTAMPP: an eXtensible STAMP platform as tool support for safety engineering (2015)

    2015

  5. [4]

    Applied Sciences13(11), 6807 (2023)

    Albattah, A., Rassam, M.A.: Detection of Adversarial Attacks against the Hybrid Convolutional Long Short-Term Memory Deep Learning Technique for Healthcare Monitoring Applications. Applied Sciences13(11), 6807 (2023)

    2023

  6. [5]

    Alemzadeh, H.: Data-driven resiliency assessment of medical cyber-physical sys- tems. Ph.D. thesis, University of Illinois at Urbana-Champaign (2016)

    2016

  7. [6]

    In: Koornneef, F., van Gulijk, C

    Alemzadeh, H., Chen, D., Lewis, A., Kalbarczyk, Z., Raman, J., Leveson, N., Iyer, R.: Systems-theoretic safety assessment of robotic telesurgical systems. In: Koornneef, F., van Gulijk, C. (eds.) Computer Safety, Reliability, and Security. pp. 213–227. Springer International Publishing, Cham (2015)

    2015

  8. [7]

    In: IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)

    Alemzadeh, H., Chen, D., Li, X., Kesavadas, T., Kalbarczyk, Z.T., Iyer, R.K.: Targeted attacks on teleoperated surgical robots: Dynamic model-based detection and mitigation. In: IEEE/IFIP International Conference on Dependable Systems and Networks (DSN). pp. 395–406. IEEE (2016) Analysis of Security in ML-enabled Medical Devices 25

    2016

Show all 135 references
  1. [8]

    In: IEEE International Symposium on Computer-Based Medical Systems

    Alemzadeh, H., Hoagland, R., Kalbarczyk, Z., Iyer, R.K.: Automated classifi- cation of computer-based medical device recalls: An application of natural lan- guage processing and statistical learning. In: IEEE International Symposium on Computer-Based Medical Systems. pp. 553–5...

    2014

  2. [9]

    IEEE Security & Privacy11(4), 14–26 (2013)

    Alemzadeh, H., Iyer, R.K., Kalbarczyk, Z., Raman, J.: Analysis of safety-critical computer failures in medical devices. IEEE Security & Privacy11(4), 14–26 (2013). https://doi.org/10.1109/MSP.2013.49

    2013 doi

  3. [10]

    Coordinated Science Laboratory Report no

    Alemzadeh, H., Raman, J., Leveson, N., Iyer, R.K.: Safety implications of robotic surgery: A study of 13 years of FDA data on da Vinci surgical systems. Coordinated Science Laboratory Report no. UILU-ENG-13-2208 (2013)

    2013

  4. [11]

    PloS one11(4), e0151470 (2016)

    Alemzadeh, H., Raman, J., Leveson, N., Kalbarczyk, Z., Iyer, R.K.: Adverse events in robotic surgery: a retrospective study of 14 years of FDA data. PloS one11(4), e0151470 (2016)

    2016

  5. [12]

    Alemzadeh, Homa: MedSafe MAUDE, URL: https://github.com/homa-alem/ MedSafe_MAUDE, Last accessed: Apr 18, 2025

    2025

  6. [13]

    Alemzadeh, Homa: MedSafe Recalls, URL: https://github.com/homa-alem/ MedSafe_Backend/, Last accessed: Apr 18, 2025

    2025

  7. [14]

    In: IEEE/ACM International Conference on Connected Health: Applications, Systems and Engineering Technologies (CHASE)

    Almohri,H.,Cheng,L.,Yao,D.,Alemzadeh,H.:Onthreatmodelingandmitigation of medical cyber-physical systems. In: IEEE/ACM International Conference on Connected Health: Applications, Systems and Engineering Technologies (CHASE). pp. 114–119. IEEE (2017)

    2017

  8. [15]

    In: Proceedings of Security and Privacy in Communication Networks: EAI International Conference, Part I 17

    Amich, A., Eshete, B.: Explanation-guided diagnosis of machine learning evasion attacks. In: Proceedings of Security and Privacy in Communication Networks: EAI International Conference, Part I 17. pp. 207–228. Springer (2021)

    2021

  9. [16]

    In: Proceedings of the 1st ACM/IEEE International Conference on Cyber-Physical Systems

    Arney, D., Pajic, M., Goldman, J.M., Lee, I., Mangharam, R., Sokolsky, O.: Toward patient safety in closed-loop medical device systems. In: Proceedings of the 1st ACM/IEEE International Conference on Cyber-Physical Systems. pp. 139–148 (2010)

    2010

  10. [17]

    Balgos, V.H.: A systems theoretic application to design for the safety of medical diagnostic devices. Ph.D. thesis, Massachusetts Institute of Technology (2012)

    2012

  11. [18]

    Becker, C., Van Eikema Hommes, Q.: Transportation systems safety hazard analysis tool (SafetyHAT) user guide (version 1.0). Tech. rep. (2014)

    2014

  12. [19]

    In: Proceedings of the ACM/IEEE International Conference on Cyber-physical Systems

    Bonaci, T., Yan, J., Herron, J., Kohno, T., Chizeck, H.J.: Experimental analysis of denial-of-service attacks on teleoperated robotic systems. In: Proceedings of the ACM/IEEE International Conference on Cyber-physical Systems. pp. 11–20 (2015)

    2015

  13. [20]

    Medical Image Analysis 73, 102141 (2021)

    Bortsova, G., González-Gonzalo, C., Wetstein, S.C., Dubost, F., Katramados, I., Hogeweg, L., Liefers, B., van Ginneken, B., Pluim, J.P., Veta, M., et al.: Adversarial attack vulnerability of medical image analysis systems: Unexplored factors. Medical Image Analysis 73, 102141 (2021)

    2021

  14. [21]

    Canham, A.: Examining the application of STAMP in the analysis of patient safety incidents. Ph.D. thesis, Loughborough University (2018)

    2018

  15. [22]

    In: AAAI Conference on Artificial Intelligence

    Chen, H., Huang, C., Huang, Q., Zhang, Q., Wang, W.: Ecgadv: Generating adversarial electrocardiogram to misguide arrhythmia classification system. In: AAAI Conference on Artificial Intelligence. vol. 34, pp. 3446–3453 (2020)

    2020

  16. [23]

    Journal of Neural Engineering21(5), 056043 (2024)

    Chen, X., Meng, L., Xu, Y., Wu, D.: Adversarial artifact detection in EEG-based brain–computer interfaces. Journal of Neural Engineering21(5), 056043 (2024)

    2024

  17. [24]

    IEEE Transactions on Neural Networks and Learning Systems (2022) 26 G

    Chen, Y., Yan, J., Jiang, M., Zhang, T., Zhao, Z., Zhao, W., Zheng, J., Yao, D., Zhang, R., Kendrick, K.M., et al.: Adversarial learning based node-edge graph attention networks for autism spectrum disorder identification. IEEE Transactions on Neural Networks and Learning Syst...

    2022

  18. [25]

    In: Proceedings of the AAAI Conference on Artificial Intelligence

    Chhabra, A., Roy, A., Mohapatra, P.: Suspicion-free adversarial attacks on cluster- ing algorithms. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 34, pp. 3625–3632 (2020)

    2020

  19. [26]

    CVE: CVE-2017-14008 (2017), URL: https://www.cve.org/CVERecord?id= CVE-2017-14008, Last accessed: Apr 18, 2025

    2017

  20. [27]

    CVE: CVE-2019-10964 (2019), URL: https://www.cve.org/CVERecord?id= CVE-2019-10964, Last accessed: Apr 18, 2025

    2019

  21. [28]

    CVE: CVE-2020-26145 (2020), URL: https://cve.mitre.org/cgi-bin/cvekey.cgi? keyword=CVE-2020-26145, Last accessed: Apr 18, 2025

    2020

  22. [29]

    CVE: CVE-2020-8933 (2020), URL: https://www.cve.org/CVERecord?id= CVE-2020-8933, Last accessed: Apr 18, 2025

    2020

  23. [31]

    CVE: CVE-2024-43093 (2024), URL: https://www.cve.org/CVERecord?id= CVE-2024-43093, Last accessed: Apr 18, 2025

    2024

  24. [32]

    In: Red Teaming GenAI: What Can We Learn from Adversaries? (2024)

    Dharmalingam, A.P., Mitra, G.: MedAIScout: Automated Retrieval of Known Machine Learning Vulnerabilities in Medical Applications. In: Red Teaming GenAI: What Can We Learn from Adversaries? (2024)

    2024

  25. [33]

    In: IEEE/ACM Conference on Connected Health: Applications, Systems and Engineering Technologies (CHASE)

    Elnawawy, M., Hallajiyan, M., Mitra, G., Iqbal, S., Pattabiraman, K.: Sys- tematically Assessing the Security Risks of AI/ML-enabled Connected Health- care Systems. In: IEEE/ACM Conference on Connected Health: Applications, Systems and Engineering Technologies (CHASE). pp. 97–...

    2024

  26. [34]

    Applied Sciences (2076-3417) 14(23) (2024)

    Elshazly, A.A., Elgarhy, I., Eltoukhy, A.T., Mahmoud, M., Eberle, W., Alsabaan, M., Alshawi, T.: False data injection attacks on reinforcement learning-based charging coordination in smart grids and a countermeasure. Applied Sciences (2076-3417) 14(23) (2024)

    2024

  27. [35]

    cfm?id=714, Last accessed: Apr 18, 2025

    FDA: Product Classification: Interoperable Automated Glycemic Controller, URL: https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfpcd/classification. cfm?id=714, Last accessed: Apr 18, 2025

    2025

  28. [36]

    FDA: Class 2 Device Recall BioPlex 2200 ANA Screen on the BioPlex 2200 MultiAnalyte Detection System (2008), URL: https://www.accessdata.fda.gov/ scripts/cdrh/cfdocs/cfRES/res.cfm?id=66385, Last accessed: Apr 18, 2025

    2008

  29. [37]

    FDA: Class 2 Device Recall UniCel DxH 600/800 Coulter Cellular Analysis System (2017), URL: https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfRES/res.cfm? id=155030, Last accessed: Apr 18, 2025

    2017

  30. [38]

    FFRCT) (2018), URL: https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfMAUDE/detail.cfm? mdrfoi__id=8269286, Last accessed: Apr 18, 2025

    FDA: MAUDE Adverse Event Report: HEARTFLOW, INC. FFRCT) (2018), URL: https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfMAUDE/detail.cfm? mdrfoi__id=8269286, Last accessed: Apr 18, 2025

    2018

  31. [39]

    gov/scripts/cdrh/cfdocs/cfres/res.cfm?id=170857, Last accessed: Apr 18, 2025

    FDA: Class 1 Device Recall MMT500 (2019), URL: https://www.accessdata.fda. gov/scripts/cdrh/cfdocs/cfres/res.cfm?id=170857, Last accessed: Apr 18, 2025

    2019

  32. [40]

    FDA: Class 2 Device Recall Dario Blood Glucose Monitoring System (2019), URL: https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfRES/res.cfm?id= 176305, Last accessed: Apr 18, 2025

    2019

  33. [41]

    FDA: MAUDE Adverse Event Report: IRHYTHM TECHNOLOGIES, INC ZIO AT SYSTEM (2019), URL: https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/ cfMAUDE/detail.cfm?mdrfoi__id=8356453, Last accessed: Apr 18, 2025

    2019

  34. [42]

    FDA: Class 2 Device Recall BodyGuardian Heart Remote Monitoring Kit (2020), URL: https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfres/res.cfm? id=180336, Last accessed: Apr 18, 2025 Analysis of Security in ML-enabled Medical Devices 27

    2020

  35. [43]

    accessdata.fda.gov/scripts/cdrh/cfdocs/cfRES/res.cfm?id=175194, Last accessed: Apr 18, 2025

    FDA: Class 2 Device Recall MiniMed Insulin Pump (2020), URL: https://www. accessdata.fda.gov/scripts/cdrh/cfdocs/cfRES/res.cfm?id=175194, Last accessed: Apr 18, 2025

    2020

  36. [44]

    FDA: MAUDE Adverse Event Report: LABSTYLE INNOVATIONS LTD. DARIO BLOOD GLUCOSE MONITORING SYSTEM; GLUCOMETER) (2022), URL: https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfMAUDE/detail.cfm? mdrfoi__id=18904273, Last accessed: Apr 18, 2025

    2022

  37. [45]

    gov/scripts/cdrh/cfdocs/cfRES/res.cfm?id=204881, Last accessed: Apr 18, 2025

    FDA: Class 2 Device Recall Incisive CT (2024), URL: https://www.accessdata.fda. gov/scripts/cdrh/cfdocs/cfRES/res.cfm?id=204881, Last accessed: Apr 18, 2025

    2024

  38. [46]

    gov/scripts/cdrh/cfdocs/cfRES/res.cfm?id=207976, Last accessed: Apr 18, 2025

    FDA: Class 2 Device Recall Sight OLO (2024), URL: https://www.accessdata.fda. gov/scripts/cdrh/cfdocs/cfRES/res.cfm?id=207976, Last accessed: Apr 18, 2025

    2024

  39. [47]

    FDA: MAUDE Adverse Event Report: CLARIUS MOBILE HEALTH CORP. CLARIUS ULTRASOUND SCANNER; DIAGNOSTIC ULTRASOUND SYSTEM AND ACCESSORIES (2024), URL: https://www.accessdata.fda.gov/scripts/cdrh/ cfdocs/cfMAUDE/detail.cfm?mdrfoi__id=20471171, Last accessed: Apr 18, 2025

    2024

  40. [48]

    FDA: MAUDE Adverse Event Report: MEDTRONIC, INC. ACCURHYTHM ZA410 (AF); RECORDER, EVENT, IMPLANTABLE CARDIAC, (WITH ARRHYTHMIA DETECTION) (2024), URL: https://www.accessdata.fda.gov/ scripts/cdrh/cfdocs/cfMAUDE/detail.cfm?mdrfoi__id=20916084, Last accessed: Apr 18, 2025

    2024

  41. [49]

    Science363(6433), 1287–1289 (2019)

    Finlayson, S.G., Bowers, J.D., Ito, J., Zittrain, J.L., Beam, A.L., Kohane, I.S.: Adversarial attacks on medical machine learning. Science363(6433), 1287–1289 (2019)

    2019

  42. [50]

    arXiv preprint arXiv:1804.05296 (2018)

    Finlayson, S.G., Chung, H.W., Kohane, I.S., Beam, A.L.: Adversarial attacks against medical deep learning systems. arXiv preprint arXiv:1804.05296 (2018)

    2018 arXiv

  43. [51]

    In: USENIX Annual Technical Conference (USENIX ATC)

    Garbelini, M.E., Wang, C., Chattopadhyay, S., Sumei, S., Kurniawan, E.: {SweynTooth}: Unleashing mayhem over bluetooth low energy. In: USENIX Annual Technical Conference (USENIX ATC). pp. 911–925 (2020)

    2020

  44. [52]

    arXiv preprint arXiv:2310.07059 (2023)

    Ge, X., Williams, R.D., Stankovic, J.A., Alemzadeh, H.: DKEC: Domain Knowl- edge Enhanced Multi-Label Classification for Diagnosis Prediction. arXiv preprint arXiv:2310.07059 (2023)

    2023 arXiv

  45. [53]

    Nature communications13(1), 5711 (2022)

    Ghaffari Laleh, N., Truhn, D., Veldhuizen, G.P., Han, T., van Treeck, M., Buelow, R.D., Langer, R., Dislich, B., Boor, P., Schulz, V., et al.: Adversarial attacks and adversarial robustness in computational pathology. Nature communications13(1), 5711 (2022)

    2022

  46. [54]

    In: Workshop on Cybersecurity in HealthCare (HealthSec)

    Hallajiyan, M., Dharmalingam, A.P., Mitra, G., Alemzadeh, H., Iqbal, S., Pat- tabiraman, K.: SAM: Foreseeing Inference-Time False Data Injection Attacks on ML-enabled Medical Devices. In: Workshop on Cybersecurity in HealthCare (HealthSec). pp. 77–84 (August 2024), co-held wit...

    2024

  47. [55]

    Hallajiyan, M., Dharmalingam, A.P., Mitra, G., Alemzadeh, H., Iqbal, S., Pat- tabiraman, K.: Sam questionnaires for collecting information on peripheral device technologies (2024)

    2024

  48. [56]

    In: 2008 IEEE Symposium on Security and Privacy (sp 2008)

    Halperin, D., Heydt-Benjamin, T.S., Ransford, B., Clark, S.S., Defend, B., Morgan, W., Fu, K., Kohno, T., Maisel, W.H.: Pacemakers and implantable cardiac defibril- lators: Software radio attacks and zero-power defenses. In: 2008 IEEE Symposium on Security and Privacy (sp 2008...

    2008

  49. [57]

    Nature medicine 26(3), 360–363 (2020)

    Han, X., Hu, Y., Foschini, L., Chinitz, L., Jankelson, L., Ranganath, R.: Deep learning models for electrocardiograms are susceptible to adversarial attack. Nature medicine 26(3), 360–363 (2020)

    2020

  50. [58]

    BMC medical imaging21, 1–13 (2021) 28 G

    Hirano, H., Minagi, A., Takemoto, K.: Universal adversarial attacks on deep neural networks for medical image classification. BMC medical imaging21, 1–13 (2021) 28 G. Mitra et al

    2021

  51. [59]

    Quantitative Imaging in Medicine and Surgery12(6), 3276 (2022)

    Hu, L., Zhou, D.W., Guo, X.Y., Xu, W.H., Wei, L.M., Zhao, J.G.: Adversar- ial training for prostate cancer classification using magnetic resonance imaging. Quantitative Imaging in Medicine and Surgery12(6), 3276 (2022)

    2022

  52. [60]

    Insulet: Omnipod-5 (2025), URL: https://www.omnipod.com/what-is-omnipod/ omnipod-5, Last accessed: Apr 18, 2025

    2025

  53. [61]

    In: International Symposium On Leveraging Applications of Formal Methods, Verification and Validation

    Jee, E., Lee, I., Sokolsky, O.: Assurance cases in model-driven development of the pacemaker software. In: International Symposium On Leveraging Applications of Formal Methods, Verification and Validation. pp. 343–356. Springer (2010)

    2010

  54. [62]

    Computer 39(4), 61–67 (2006)

    Jetley, R., Iyer, S.P., Jones, P.: A formal methods approach to medical device review. Computer 39(4), 61–67 (2006)

    2006

  55. [63]

    In: 2010 22nd Euromicro Conference on Real-Time Systems

    Jiang, Z., Pajic, M., Connolly, A., Dixit, S., Mangharam, R.: Real-time heart model for implantable cardiac device validation and verification. In: 2010 22nd Euromicro Conference on Real-Time Systems. pp. 239–248 (2010). https://doi. org/10.1109/ECRTS.2010.36

    2010 doi

  56. [64]

    MedRxiv1, 2021 (2021)

    Joel, M.Z., Umrao, S., Chang, E., Choi, R., Yang, D., Duncan, J., Omuro, A., Herbst, R., Krumholz, H.M., Aneja, S., et al.: Adversarial attack vulnerability of deep learning models for oncologic images. MedRxiv1, 2021 (2021)

    2021

  57. [65]

    IEEe Access8, 52018–52027 (2020)

    Khan, M.A., Quasim, M.T., Alghamdi, N.S., Khan, M.Y.: A secure framework for authentication and encryption using improved ECC for IoT-based medical sensor data. IEEe Access8, 52018–52027 (2020)

    2020

  58. [66]

    Journal of Dia- betes Science and Technology (2024)

    Klonoff, D.C., Ho, C.N., Ayers, A., Abdel-Malek, A.: FDA Interoperability Designation—Creating Options for People With Diabetes and Pump Compa- nies: Regulatory, Technological, and Commercial Perspectives. Journal of Dia- betes Science and Technology (2024). https://doi.org/10...

    2024 doi

  59. [67]

    PloS one7(7), e40200 (2012)

    Kramer, D.B., Baker, M., Ransford, B., Molina-Markham, A., Stewart, Q., Fu, K., Reynolds, M.R.: Security and privacy qualities of medical devices: An analysis of FDA postmarket surveillance. PloS one7(7), e40200 (2012)

    2012

  60. [68]

    Sensors 21(11), 3922 (2021)

    Lal, S., Rehman, S.U., Shah, J.H., Meraj, T., Rauf, H.T., Damaševičius, R., Mohammed, M.A., Abdulkareem, K.H.: Adversarial attack and defence through adversarial training and feature fusion for diabetic retinopathy recognition. Sensors 21(11), 3922 (2021)

    2021

  61. [69]

    MIT press (2011)

    Leveson, N.: Engineering a safer world: Systems thinking applied to safety. MIT press (2011)

    2011

  62. [70]

    Journal of Patient Safety 16(2), 162–167 (2020)

    Leveson, N., Samost, A., Dekker, S., Finkelstein, S., Raman, J.: A systems approach to analyzing and preventing hospital adverse events. Journal of Patient Safety 16(2), 162–167 (2020)

    2020

  63. [71]

    Journal of Biomedical Informatics132, 104129 (2022)

    Levy-Loboda, T., Sheetrit, E., Liberty, I.F., Haim, A., Nissim, N.: Personalized insulin dose manipulation attack and its detection using interval-based temporal patterns and machine learning algorithms. Journal of Biomedical Informatics132, 104129 (2022)

    2022

  64. [72]

    In: IEEE International Conference on e-Health Networking, Applications and Services

    Li, C., Raghunathan, A., Jha, N.K.: Hijacking an insulin pump: Security attacks and defenses for a diabetes therapy system. In: IEEE International Conference on e-Health Networking, Applications and Services. pp. 150–156 (2011)

    2011

  65. [73]

    In: Advances in Neural Information Processing Systems

    Li, G., Hammoud, H., Itani, H., Khizbullin, D., Ghanem, B.: CAMEL: Commu- nicative Agents for "Mind" Exploration of Large Language Model Society. In: Advances in Neural Information Processing Systems. vol. 36, pp. 51991–52008. Curran Associates, Inc. (2023)

    2023

  66. [74]

    Bioengineering 10(8), 973 (2023) Analysis of Security in ML-enabled Medical Devices 29

    Li, Y., Liu, S.: Adversarial attack and defense in breast cancer deep learning systems. Bioengineering 10(8), 973 (2023) Analysis of Security in ML-enabled Medical Devices 29

    2023

  67. [75]

    In: Proceedings of the International Joint Conference on Artificial Intelligence

    Lin, Y.C., Hong, Z.W., Liao, Y.H., Shih, M.L., Liu, M.Y., Sun, M.: Tactics of adversarial attack on deep reinforcement learning agents. In: Proceedings of the International Joint Conference on Artificial Intelligence. pp. 3756–3762. International Joint Conferences on Artificia...

    2017

  68. [76]

    Journal of the American Medical Informatics Association30(7), 1227–1236 (2023)

    Lyell, D., Wang, Y., Coiera, E., Magrabi, F.: More than algorithms: an analysis of safety events involving ML-enabled medical devices reported to the FDA. Journal of the American Medical Informatics Association30(7), 1227–1236 (2023)

    2023

  69. [77]

    Pattern Recognition 110, 107332 (2021)

    Ma, X., Niu, Y., Gu, L., Wang, Y., Zhao, Y., Bailey, J., Lu, F.: Understanding adversarial attacks on deep learning based medical image analysis systems. Pattern Recognition 110, 107332 (2021)

    2021

  70. [78]

    In: IEEE EuroS&P

    Mangaokar, N., Pu, J., Bhattacharya, P., Reddy, C.K., Viswanath, B.: Jekyll: Attacking medical image diagnostics using deep generative models. In: IEEE EuroS&P. pp. 139–157 (2020)

    2020

  71. [79]

    In: 2017 IEEE International Conference on Healthcare Informatics (ICHI)

    Mason-Blakley, F., Habibi, R., Weber, J., Price, M.: Assessing stamp EMR with electronic medical record related incident reports: case study: manufacturer and user facility device experience database. In: 2017 IEEE International Conference on Healthcare Informatics (ICHI). pp....

    2017

  72. [80]

    In: IEEE BIBM

    Meiseles, A., Rosenberg, I., Motro, Y., Rokach, L., Moran-Gilad, J.: Adversarial Vulnerability of Deep Learning Models in Analyzing Next Generation Sequencing Data. In: IEEE BIBM. pp. 464–468 (2020). https://doi.org/10.1109/BIBM49941. 2020.9313421

    2020

  73. [81]

    In: ICCSA

    Menon, K., Bohra, V.K., Murugan, L., Jaganathan, K., Arumugam, C.: COVID-19 Diagnosis from Chest X-Ray Images Using Convolutional Neural Networks and Effects of Data Poisoning. In: ICCSA. pp. 508–521 (2021)

    2021

  74. [82]

    Mitre: Conexus Telemetry Protocol vulnerability, URL: https://cve.mitre.org/ cgi-bin/cvename.cgi?name=CVE-2019-6538, Last accessed: Apr 18, 2025

    2019

  75. [83]

    org/cgi-bin/cvename.cgi?name=CVE-2021-26262, Last accessed: Apr 18, 2025

    Mitre: Philips MRI 1.5T and MRI 3T vulnerability (1), URL: https://cve.mitre. org/cgi-bin/cvename.cgi?name=CVE-2021-26262, Last accessed: Apr 18, 2025

    2021

  76. [84]

    Mitre: Shekar Endoscope vulnerability (1), URL: https://cve.mitre.org/cgi-bin/ cvename.cgi?name=CVE-2017-10722, Last accessed: Apr 18, 2025

    2017

  77. [85]

    org/cgi-bin/cvename.cgi?name=CVE-2018-3938, Last accessed: Apr 18, 2025

    Mitre: Sony IPELA E Series Camera vulnerability (1), URL: https://cve.mitre. org/cgi-bin/cvename.cgi?name=CVE-2018-3938, Last accessed: Apr 18, 2025

    2018

  78. [86]

    cgi?name=CVE-2019-5921, Last accessed: Apr 18, 2025

    Mitre: Windows 7 vulnerability (2), URL: https://cve.mitre.org/cgi-bin/cvename. cgi?name=CVE-2019-5921, Last accessed: Apr 18, 2025

    2019

  79. [87]

    Mitre: Common Vulnerabilities and Exposures (CVE) Database (2024), URL: https://cve.mitre.org/, Last accessed: Apr 18, 2025

    2024

  80. [88]

    IEEE journal of biomedical and health informatics19(6), 1893–1905 (2014)

    Mozaffari-Kermani, M., Sur-Kolay, S., Raghunathan, A., Jha, N.K.: Systematic poisoning attacks on and defenses for machine learning in healthcare. IEEE journal of biomedical and health informatics19(6), 1893–1905 (2014)

    2014

  81. [89]

    In: International Workshop on Ophthalmic Medical Image Analysis

    Nielsen, C., Tuladhar, A., Forkert, N.D.: Investigating the Vulnerability of Fed- erated Learning-Based Diabetic Retinopathy Grade Classification to Gradient Inversion Attacks. In: International Workshop on Ophthalmic Medical Image Analysis. pp. 183–192 (2022)

    2022

  82. [90]

    arXiv preprint arXiv:2403.16289 (2024)

    Nouri, A., Cabrero-Daniel, B., Törner, F., Sivencrona, H., Berger, C.: Engineering Safety Requirements for Autonomous Driving with Large Language Models. arXiv preprint arXiv:2403.16289 (2024)

    2024 arXiv

  83. [91]

    In: Proceedings of the IEEE/ACM CAIN ’24

    Nouri, A., Cabrero-Daniel, B., Torner, F., Sivencrona, H., Berger, C.: Welcome Your New AI Teammate: On Safety Analysis by Leashing Large Language Models. In: Proceedings of the IEEE/ACM CAIN ’24. p. 172–177 (2024) 30 G. Mitra et al

    2024

  84. [92]

    https://www.gao. gov/assets/d24106683.pdf

    Office, U.G.A.: Medical Device Cybersecurity: Agencies Need to Update Agreement to Ensure Effective Coordination. Tech. Rep. GAO-24-106683, United States Government Accountability Office (GAO) (December 2023), "https://www.gao. gov/assets/d24106683.pdf"

    2023

  85. [93]

    O’Neil, M.M.M.: Application of CAST to hospital adverse events. Ph.D. thesis, Massachusetts Institute of Technology (2014)

    2014

  86. [94]

    OpenAPS: URL: https://openaps.org, Last accessed: Apr 18, 2025

    2025

  87. [95]

    IEEE Transactions on Industrial Informatics 10(1), 3–16 (2012)

    Pajic, M., Mangharam, R., Sokolsky, O., Arney, D., Goldman, J., Lee, I.: Model- driven safety analysis of closed-loop medical systems. IEEE Transactions on Industrial Informatics 10(1), 3–16 (2012)

    2012

  88. [96]

    Palo Alto Networks: 6 New Vulnerabilities Found on D-Link Home Routers (2020), URL: https://unit42.paloaltonetworks.com/ 6-new-d-link-vulnerabilities-found-on-home-routers, Last accessed: Apr 18, 2025

    2020

  89. [97]

    Diabetes Spectrum35(4), 398–404 (2022)

    Pattison, J., Dungan, K.M., Faulds, E.R.: Supporting the use of a person’s own diabetes technology in the inpatient setting. Diabetes Spectrum35(4), 398–404 (2022)

    2022

  90. [98]

    Journal of Information Security and Applications 47, 302–319 (2019)

    Pereira, D.P., Hirata, C., Nadjm-Tehrani, S.: A STAMP-based ontology approach to support safety and security analyses. Journal of Information Security and Applications 47, 302–319 (2019)

    2019

  91. [99]

    In: Proceedings of IEEE ITSC ’23

    Qi, Y., Dong, Y., Khastgir, S., Jennings, P., Zhao, X., Huang, X.: STPA for Learning-Enabled Systems: A Survey and A New Practice. In: Proceedings of IEEE ITSC ’23. pp. 1381–1388 (2023)

    2023

  92. [100]

    arXiv preprint arXiv:2304.01246 (2023)

    Qi, Y., Zhao, X., Khastgir, S., Huang, X.: Safety Analysis in the Era of Large Language Models: A Case Study of STPA Using ChatGPT. arXiv preprint arXiv:2304.01246 (2023)

    2023 arXiv

  93. [101]

    arXiv preprint arXiv:2305.11430 (2023)

    Santu, S.K.K., Feng, D.: Teler: A general taxonomy of LLM prompts for bench- marking complex tasks. arXiv preprint arXiv:2305.11430 (2023)

    2023 arXiv

  94. [102]

    Nature 623(7987), 493–498 (2023)

    Shanahan, M., McDonell, K., Reynolds, L.: Role play with large language models. Nature 623(7987), 493–498 (2023)

    2023

  95. [103]

    In: MATEC Web of Conferences

    Souza, F.G., Pereira, D.P., Pagliares, R.M., Nadjm-Tehrani, S., Hirata, C.M.: WebSTAMP: A web application for STPA & STPA-Sec. In: MATEC Web of Conferences. vol. 273, p. 02010. EDP Sciences (2019)

    2019

  96. [104]

    In: Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining

    Sun, M., Tang, F., Yi, J., Wang, F., Zhou, J.: Identify susceptible locations in medical records via adversarial attacks on deep predictive models. In: Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining. pp. 793–801 (2018)

    2018

  97. [105]

    In: Proc

    Thomas, J., Leveson, N.G.: Performing hazard analysis on complex, software-and human-intensive systems. In: Proc. of the 29th ISSC Conference about System Safety (2011)

    2011

  98. [106]

    Tidepool: Supported Devices, URL: https://www.tidepool.org/devices, Last ac- cessed: Apr 18, 2025

    2025

  99. [107]

    In: American Control Conference (ACC)

    Tosun, F.E., Teixeira, A., Ahlén, A., Dey, S.: Detection of bias injection attacks on the glucose sensor in the artificial pancreas under meal disturbance. In: American Control Conference (ACC). pp. 1398–1405. IEEE (2022)

    2022

  100. [108]

    US-CERT: Industrial Control Systems Cyber Emergency Response Team (ICS- CERT) Alerts, URL: https://ics-cert.us-cert.gov/alerts, Last accessed: Apr 18, 2025

    2025

  101. [109]

    U.S. FDA: ABMD Software, URL: https://www.accessdata.fda.gov/scripts/cdrh/ cfdocs/cfpmn/pmn.cfm?ID=K213760, Last accessed: Apr 18, 2025 Analysis of Security in ML-enabled Medical Devices 31

    2025

  102. [110]

    U.S. FDA: Artificial Intelligence and Machine Learn- ing (AI/ML)-Enabled Medical Devices, URL: https:// www.fda.gov/medical-devices/software-medical-device-samd/ artificial-intelligence-and-machine-learning-aiml-enabled-medical-devices, Last accessed: Apr 18, 2025

    2025

  103. [111]

    FDA: Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations, URL: https://www

    U.S. FDA: Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations, URL: https://www. fda.gov/media/184856/download, Last accessed: Apr 18, 2025

    2025

  104. [112]

    FDA: d-Nav System, URL: https://www.accessdata.fda.gov/scripts/cdrh/ cfdocs/cfpmn/pmn.cfm?ID=K181916, Last accessed: Apr 18, 2025

    U.S. FDA: d-Nav System, URL: https://www.accessdata.fda.gov/scripts/cdrh/ cfdocs/cfpmn/pmn.cfm?ID=K181916, Last accessed: Apr 18, 2025

    2025

  105. [113]

    FDA: Dario Blood Glucose Monitoring System, URL: https://www.accessdata

    U.S. FDA: Dario Blood Glucose Monitoring System, URL: https://www.accessdata. fda.gov/cdrh_docs/pdf15/K150817.pdf, Last accessed: Apr 18, 2025

    2025

  106. [114]

    FDA: DreaMed Advisor Pro, URL: https://www.accessdata.fda.gov/cdrh_ docs/pdf19/K191370.pdf, Last accessed: Apr 18, 2025

    U.S. FDA: DreaMed Advisor Pro, URL: https://www.accessdata.fda.gov/cdrh_ docs/pdf19/K191370.pdf, Last accessed: Apr 18, 2025

    2025

  107. [115]

    FDA: GI Genius, URL: https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/ cfpmn/denovo.cfm?id=DEN200055, Last accessed: Apr 18, 2025

    U.S. FDA: GI Genius, URL: https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/ cfpmn/denovo.cfm?id=DEN200055, Last accessed: Apr 18, 2025

    2025

  108. [116]

    FDA: One Drop Blood Glucose Monitoring System, URL: https://www

    U.S. FDA: One Drop Blood Glucose Monitoring System, URL: https://www. accessdata.fda.gov/scripts/cdrh/cfdocs/cfpmn/pmn.cfm?ID=K161834, Last ac- cessed: Apr 18, 2025

    2025

  109. [117]

    FDA: Welldoc Bluestar System, URL: https://www.accessdata.fda.gov/cdrh_ docs/pdf19/K190013.pdf, Last accessed: Apr 18, 2025

    U.S. FDA: Welldoc Bluestar System, URL: https://www.accessdata.fda.gov/cdrh_ docs/pdf19/K190013.pdf, Last accessed: Apr 18, 2025

    2025

  110. [118]

    Food and Drug Administration: 510(k) Premarket Notification, https://www

    U.S. Food and Drug Administration: 510(k) Premarket Notification, https://www. accessdata.fda.gov/scripts/cdrh/cfdocs/cfPMN/pmn.cfm

  111. [119]

    U.S. Food and Drug Administration: MAUDE - Manufacturer and User Facility Device Experience, URL: https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/ cfMAUDE/search.cfm, Last accessed: Apr 18, 2025

    2025

  112. [120]

    U.S. Food and Drug Administration: MAUDE Adverse Event Report: IRHYTHM TECHNOLOGIES, INC ZEUS SYSTEM; COMPUTER, DIAGNOS- TIC, PROGRAMMABLE, URL: https://www.accessdata.fda.gov/scripts/cdrh/ cfdocs/cfMAUDE/detail.cfm?mdrfoi__id=19427744, Last accessed: Apr 18, 2025

    2025

  113. [121]

    U.S. Food and Drug Administration: Product Code Classification Database, URL: https://www.fda.gov/medical-devices/classify-your-medical-device/ product-code-classification-database, Last accessed: Apr 18, 2025

    2025

  114. [122]

    U.S. Food and Drug Administration: Recalls, Corrections and Removals (Devices), URL: https://www.fda.gov/medical-devices/postmarket-requirements-devices/ recalls-corrections-and-removals-devices, Last accessed: Apr 18, 2025

    2025

  115. [123]

    Food and Drug Administration: Zeus system, URL: https://www.accessdata

    U.S. Food and Drug Administration: Zeus system, URL: https://www.accessdata. fda.gov/cdrh_docs/pdf22/K222389.pdf, Last accessed: Apr 18, 2025

    2025

  116. [124]

    In: CEUR Workshop Proceedings

    Vargas, D.V., Su, J.: Understanding the one-pixel attack: Propagation maps and locality analysis. In: CEUR Workshop Proceedings. vol. 2640 (2020)

    2020

  117. [125]

    In: ACM SIGSAC CCS

    Wang, W., Yao, Y., Liu, X., Li, X., Hao, P., Zhu, T.: I can see the light: Attacks on autonomous vehicles using invisible lights. In: ACM SIGSAC CCS. pp. 1930–1944 (2021)

    2021

  118. [126]

    ACM Computing Surveys 55(7), 1–36 (2022)

    Wang, Z., Ma, J., Wang, X., Hu, J., Qin, Z., Ren, K.: Threats to training: A survey of poisoning attacks and defenses on machine learning systems. ACM Computing Surveys 55(7), 1–36 (2022)

    2022

  119. [127]

    Advances in neural information processing systems35, 24824–24837 (2022) 32 G

    Wei, J., Wang, X., Schuurmans, D., Bosma, M., Xia, F., Chi, E., Le, Q.V., Zhou, D.: Chain-of-thought prompting elicits reasoning in large language models. Advances in neural information processing systems35, 24824–24837 (2022) 32 G. Mitra et al

    2022

  120. [128]

    Xu,Y.,Tran,D.,Tian,Y.,Alemzadeh,H.:Analysisofcyber-securityvulnerabilities ofinterconnectedmedicaldevices.In:2019IEEE/ACMInternationalConferenceon Connected Health: Applications, Systems and Engineering Technologies (CHASE) (2019)

    2019

  121. [129]

    IEEE Communications Surveys & Tutorials21(4), 3723–3768 (2019)

    Yaqoob, T., Abbas, H., Atiquzzaman, M.: Security Vulnerabilities, Attacks, Coun- termeasures, and Regulations of Networked Medical Devices—A Review. IEEE Communications Surveys & Tutorials21(4), 3723–3768 (2019)

    2019

  122. [130]

    JAMA ophthalmology138(11), 1213–1215 (2020)

    Yoo, T.K., Choi, J.Y.: Outcomes of adversarial attacks on deep learning models for ophthalmology imaging domains. JAMA ophthalmology138(11), 1213–1215 (2020)

    2020

  123. [131]

    In: Proceedings of ACM ACSAC ’13

    Young, W., Leveson, N.: Systems thinking for safety and security. In: Proceedings of ACM ACSAC ’13. p. 1–8. Association for Computing Machinery (2013)

    2013

  124. [132]

    In: STAMP Conference

    Young, W., Porada, R.: System-theoretic process analysis for security (STPA-SEC): Cyber security and STPA. In: STAMP Conference. pp. 27–30. MIT Press (2017)

    2017

  125. [133]

    BMC Medical Informatics and Decision Making23(1), 115 (2023)

    Yu, J., Qiu, K., Wang, P., Su, C., Fan, Y., Cao, Y.: Perturbing BEAMs: EEG adversarial attack to deep learning models for epilepsy diagnosing. BMC Medical Informatics and Decision Making23(1), 115 (2023)

    2023

  126. [134]

    IEEE Transactions on Dependable and Secure Computing (2023)

    Zhou, X., Ahmed, B., Aylor, J.H., Asare, P., Alemzadeh, H.: Hybrid knowledge and data driven synthesis of runtime monitors for cyber-physical systems. IEEE Transactions on Dependable and Secure Computing (2023)

    2023

  127. [135]

    In: 2022 IEEE/ACM Conference on Connected Health: Applications, Systems and Engineering Tech- nologies (CHASE)

    Zhou, X., Kouzel, M., Ren, H., Alemzadeh, H.: Design and validation of an open- source closed-loop testbed for artificial pancreas systems. In: 2022 IEEE/ACM Conference on Connected Health: Applications, Systems and Engineering Tech- nologies (CHASE). pp. 1–12. IEEE (2022)

    2022

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.