Abstract
Administrative artificial-intelligence (AI) pipelines in primary care are vulnerable to cascade amplification when feedback loops are present. Whether the six adversarial attack classes catalogued in our earlier threat taxonomy can be deliberately triggered through realistic perturbations, and whether a distributional monitoring pattern can distinguish adversarial perturbation from accidental drift, has not been tested in silico. We extend our previously published five-node Synthea-based simulation of administrative AI in primary care (1,000 synthetic patients; 100 Monte Carlo iterations per scenario) with eight adversarial scenarios spanning single-node, coordinated multi-node, stealth-ramp, and supply-chain compromise patterns, plus a novel data-poisoning attack using the publicly available Medical-Triage-500 dataset (HuggingFace) validated against 41,470 patient encounters from the MedDialog/HealthCareMagic-100k corpus.
Results: the stealth-ramp scenario (1 per cent perturbation magnitude over 100 feedback cycles) is the only configuration crossing the previously reported clinical-relevance threshold for cascade amplification (Cascade Amplification Factor > 1.2), with total error 2.94 versus baseline accidental-drift 0.31. Single-shot adversarial injection at 10 per cent magnitude without feedback reaches total error 0.39, only 23 per cent above baseline, operationally indistinguishable from noise. Coordinated attacks at the Documentation and Coding nodes produce 1.55 times the error of single-node attacks under identical magnitude and feedback. The data-poisoning attack produces an 11.7 per cent undertriage rate at population scale.
We argue that adversarial-robustness assessment for clinical AI pipelines must address persistent low-magnitude perturbation through feedback loops, not only high-magnitude single-shot scenarios. An Ontological Intrusion-Detection Architecture as constructive response is developed in a companion paper.



![Author ORCID: We display the ORCID iD icon alongside authors names on our website to acknowledge that the ORCiD has been authenticated when entered by the user. To view the users ORCiD record click the icon. [opens in a new tab]](https://www.cambridge.org/engage/assets/public/coe/logo/orcid.png)