{"id":"https://openalex.org/W4409366643","doi":"https://doi.org/10.1609/aaai.v39i7.32734","title":"Medical Multimodal Model Stealing Attacks via Adversarial Domain Alignment","display_name":"Medical Multimodal Model Stealing Attacks via Adversarial Domain Alignment","publication_year":2025,"publication_date":"2025-04-11","ids":{"openalex":"https://openalex.org/W4409366643","doi":"https://doi.org/10.1609/aaai.v39i7.32734"},"language":"en","primary_location":{"id":"doi:10.1609/aaai.v39i7.32734","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v39i7.32734","pdf_url":"https://ojs.aaai.org/index.php/AAAI/article/download/32734/34889","source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://ojs.aaai.org/index.php/AAAI/article/download/32734/34889","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5055262831","display_name":"Yaling Shen","orcid":"https://orcid.org/0000-0002-1548-3506"},"institutions":[{"id":"https://openalex.org/I62916508","display_name":"Technical University of Munich","ror":"https://ror.org/02kkvpp62","country_code":"DE","type":"education","lineage":["https://openalex.org/I62916508"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Yaling Shen","raw_affiliation_strings":["Bosch Center for Artificial Intelligence, Germany\nTechnical University of Munich, Germany\nMunich Center for Machine Learning, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Bosch Center for Artificial Intelligence, Germany\nTechnical University of Munich, Germany\nMunich Center for Machine Learning, Germany","institution_ids":["https://openalex.org/I62916508"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100532948","display_name":"Zhixiong Zhuang","orcid":null},"institutions":[{"id":"https://openalex.org/I33256026","display_name":"German Research Centre for Artificial Intelligence","ror":"https://ror.org/01ayc5b57","country_code":"DE","type":"funder","lineage":["https://openalex.org/I33256026"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Zhixiong Zhuang","raw_affiliation_strings":["Bosch Center for Artificial Intelligence, Germany\nSaarland University, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Bosch Center for Artificial Intelligence, Germany\nSaarland University, Germany","institution_ids":["https://openalex.org/I33256026"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100614598","display_name":"Kun Yuan","orcid":"https://orcid.org/0000-0001-8394-8187"},"institutions":[{"id":"https://openalex.org/I62916508","display_name":"Technical University of Munich","ror":"https://ror.org/02kkvpp62","country_code":"DE","type":"education","lineage":["https://openalex.org/I62916508"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Kun Yuan","raw_affiliation_strings":["Technical University of Munich, Germany\nMunich Center for Machine Learning, Germany\nUniversity of Strasbourg, France"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Technical University of Munich, Germany\nMunich Center for Machine Learning, Germany\nUniversity of Strasbourg, France","institution_ids":["https://openalex.org/I62916508"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5062708957","display_name":"Maria-Irina Nicolae","orcid":"https://orcid.org/0009-0002-2758-7481"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Maria-Irina Nicolae","raw_affiliation_strings":["Bosch Center for Artificial Intelligence, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Bosch Center for Artificial Intelligence, Germany","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5046896448","display_name":"Nassir Navab","orcid":"https://orcid.org/0000-0002-6032-5611"},"institutions":[{"id":"https://openalex.org/I62916508","display_name":"Technical University of Munich","ror":"https://ror.org/02kkvpp62","country_code":"DE","type":"education","lineage":["https://openalex.org/I62916508"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Nassir Navab","raw_affiliation_strings":["Technical University of Munich, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Technical University of Munich, Germany","institution_ids":["https://openalex.org/I62916508"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5071976104","display_name":"Nicolas Padoy","orcid":"https://orcid.org/0000-0002-5010-4137"},"institutions":[{"id":"https://openalex.org/I4210160625","display_name":"Institut de Chirurgie Guid\u00e9e par l'Image","ror":"https://ror.org/053694011","country_code":"FR","type":"facility","lineage":["https://openalex.org/I4210160625"]},{"id":"https://openalex.org/I68947357","display_name":"Universit\u00e9 de Strasbourg","ror":"https://ror.org/00pg6eq24","country_code":"FR","type":"education","lineage":["https://openalex.org/I68947357"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Nicolas Padoy","raw_affiliation_strings":["University of Strasbourg, France\nIHU Strasbourg, France"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Strasbourg, France\nIHU Strasbourg, France","institution_ids":["https://openalex.org/I4210160625","https://openalex.org/I68947357"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5003887059","display_name":"Mario Fritz","orcid":"https://orcid.org/0000-0001-8949-9896"},"institutions":[{"id":"https://openalex.org/I4210128801","display_name":"Helmholtz Center for Information Security","ror":"https://ror.org/02njgxr09","country_code":"DE","type":"facility","lineage":["https://openalex.org/I1305996414","https://openalex.org/I4210128801"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Mario Fritz","raw_affiliation_strings":["CISPA Helmholtz Center for Information Security, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"CISPA Helmholtz Center for Information Security, Germany","institution_ids":["https://openalex.org/I4210128801"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":9.9002,"has_fulltext":true,"cited_by_count":7,"citation_normalized_percentile":{"value":0.98192955,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":97,"max":98},"biblio":{"volume":"39","issue":"7","first_page":"6842","last_page":"6850"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9886999726295471,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9886999726295471,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.7602460384368896},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6495074033737183},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.6018751263618469},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4605841040611267},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3472636342048645},{"id":"https://openalex.org/keywords/mathematics","display_name":"Mathematics","score":0.10592612624168396}],"concepts":[{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.7602460384368896},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6495074033737183},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.6018751263618469},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4605841040611267},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3472636342048645},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.10592612624168396},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1609/aaai.v39i7.32734","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v39i7.32734","pdf_url":"https://ojs.aaai.org/index.php/AAAI/article/download/32734/34889","source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1609/aaai.v39i7.32734","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v39i7.32734","pdf_url":"https://ojs.aaai.org/index.php/AAAI/article/download/32734/34889","source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G3562914802","display_name":"European Lighthouse on Secure and Safe AI","funder_award_id":"101070617","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"}],"funders":[{"id":"https://openalex.org/F4320320300","display_name":"European Commission","ror":"https://ror.org/00k4n6c32"},{"id":"https://openalex.org/F4320326256","display_name":"Grand \u00c9quipement National De Calcul Intensif","ror":"https://ror.org/0010d1q40"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4409366643.pdf","grobid_xml":"https://content.openalex.org/works/W4409366643.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2502115930","https://openalex.org/W2482350142","https://openalex.org/W4246396837","https://openalex.org/W3126451824","https://openalex.org/W1561927205","https://openalex.org/W3191453585","https://openalex.org/W4297672492"],"abstract_inverted_index":{"Medical":[0],"multimodal":[1],"large":[2],"language":[3],"models":[4],"(MLLMs)":[5],"are":[6,28,59,91,118],"becoming":[7],"an":[8],"instrumental":[9],"part":[10],"of":[11,38,152],"healthcare":[12],"systems,":[13],"assisting":[14],"medical":[15,32,41,50,81,110,127,175,181],"personnel":[16],"with":[17,134],"decision":[18],"making":[19],"and":[20,45,120,148,161],"results":[21],"analysis.":[22],"Models":[23],"for":[24,79],"radiology":[25,163],"report":[26],"generation":[27],"able":[29],"to":[30,62,68,125,139,172,180],"interpret":[31],"imagery,":[33],"thus":[34],"reducing":[35],"the":[36,80,105,141,149,153,158,174],"workload":[37],"radiologists.":[39],"As":[40],"data":[42,132,142],"is":[43,137],"scarce":[44],"protected":[46],"by":[47],"privacy":[48],"regulations,":[49],"MLLMs":[51],"represent":[52],"valuable":[53],"intellectual":[54],"property.":[55],"However,":[56],"these":[57],"assets":[58],"potentially":[60],"vulnerable":[61],"model":[63,77],"stealing,":[64],"where":[65],"attackers":[66,171],"aim":[67],"replicate":[69],"their":[70,126],"functionality":[71],"via":[72],"black-box":[73],"access.":[74],"So":[75],"far,":[76],"stealing":[78,107],"domain":[82],"has":[83],"focused":[84],"on":[85,114,157],"image":[86],"classification;":[87],"however,":[88],"existing":[89],"attacks":[90],"not":[92],"effective":[93],"against":[94,109],"MLLMs.":[95,111],"In":[96],"this":[97],"paper,":[98],"we":[99],"introduce":[100],"Adversarial":[101,167],"Domain":[102,168],"Alignment":[103,169],"(ADA-Steal),":[104],"first":[106],"attack":[108],"ADA-Steal":[112],"relies":[113],"natural":[115,146],"images,":[116],"which":[117],"public":[119],"widely":[121],"available,":[122],"as":[123],"opposed":[124],"counterparts.":[128],"We":[129],"show":[130],"that":[131,166],"augmentation":[133],"adversarial":[135],"noise":[136],"sufficient":[138],"overcome":[140],"distribution":[143,151],"gap":[144],"between":[145],"images":[147],"domain-specific":[150],"victim":[154],"MLLM.":[155],"Experiments":[156],"IU":[159],"X-RAY":[160],"MIMIC-CXR":[162],"datasets":[164],"demonstrate":[165],"enables":[170],"steal":[173],"MLLM":[176],"without":[177],"any":[178],"access":[179],"data.":[182]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":5}],"updated_date":"2026-08-25T07:29:55.448023","created_date":"2025-10-10T00:00:00"}