To standardize interactions between LLM-based agents and their environments, the Model Context Protocol (MCP) was proposed and has since been widely adopted. However, integrating external tools expands the attack surface, exposing agents to tool poisoning attacks. In such attacks, malicious instructions embedded in tool metadata are injected into the agent context during MCP registration phase, thereby manipulating agent behavior. Prior work primarily focuses on explicit tool poisoning or relied on manually crafted poisoned tools. In contrast, we focus on a particularly stealthy variant: implicit tool poisoning, where the poisoned tool itself remains uninvoked. Instead, the instructions embedded in the tool metadata induce the agent to invoke a legitimate but high-privilege tool to perform malicious operations. We propose MCP-ITP, the first automated and adaptive framework for implicit tool poisoning within the MCP ecosystem. MCP-ITP formulates poisoned tool generation as a black-box optimization problem and employs an iterative optimization strategy that leverages feedback from both an evaluation LLM and a detection LLM to maximize Attack Success Rate (ASR) while evading current detection mechanisms. Experimental results on the MCPTox dataset across 12 LLM agents demonstrate that MCP-ITP consistently outperforms the manually crafted baseline, achieving up to 84.2% ASR while suppressing the Malicious Tool Detection Rate (MDR) to as low as 0.3%.
Aim: This study aimed to determine the extent to which non-physician healthcare personnel recognize life-threatening rhythms in Electrocardiography (ECG), and to identify the importance of professional experience or in-service training in recognizing life-threatening rhythms. Material and Methods: This descriptive study was designed to measure the ECG knowledge levels of healthcare personnel. It was completed with a total of 532 non-physician healthcare personnel including Paramedics, Emergency Medical Technicians (EMTs), nurses working in intensive care units, and inpatient clinics in Hatay province, Turkey. An 18-question survey form was used as the data collection tool in the research. Seven of the questions were related to participants' age, workplace, duration of employment, in-service training, etc., while eleven were related to ECG rhythms. Results: A total of 532 healthcare workers participated in the study, with the majority falling in the age range of 20-25 years (41.9%).Nurses comprised the largest group among the participants (37.4%). The majority of participants (75%) had been employed for 8 years or more, yet 66.9% had not attended any ECG courses during their employment, and 34% had received formal ECG training as part of their undergraduate or in-service education for five years or more. Among the units where participants worked, it was observed that 49.9% of the respondents were emergency department workers, where ECG applications were very frequent. Conclusion: According to the findings of the study, nurses were the group that answered the most questions, and the most frequently answered question incorrectly was about AF and ANT MI. It is suggested that ECG courses be added as compulsory subjects to the nursing and paramedic-EMT training curriculum, accompanied by laboratory and simulation practices.
Elizabeth H. Pittman, Sumeja Aljic, Earl G. Ford
et al.
Abstract Mercury (Hg) is a unique heavy metal toxicant found in numerous environmental and occupational settings. A major source of environmental Hg is artisanal and small-scale gold mining, whereby metallic mercury (Hg0) is used to concentrate gold from mined ore. If the Hg0-contaminated tailings are then subjected to cyanidation to extract any remaining gold, toxic mercuric cyanide complexes form that contaminate terrestrial and aquatic environments around mining sites. The purpose of the current study was to determine how mercuric cyanide complexes affect the health of aquatic organisms in contaminated environments. Zebrafish (Danio rerio) embryos and larvae were exposed to different concentrations (0, 0.05, 0.1, 0.15, 0.2, 0.25, 0.3 mg/L) of mercuric cyanide. This exposure did not alter germ ring formation, tail segmentation, or heartbeat initiation, but did affect hatching and survival rates. Furthermore, the number of embryos exhibiting tail twitching activity decreased by approximately 25% when exposed to 0.15 mg/L mercuric cyanide and 75% following exposure to 0.3 mg/L mercuric cyanide. In addition, 50% of embryos exposed to 0.05 mg/L mercuric cyanide experienced delays in hatching compared with controls. Overall survival was also affected with only 75% of embryos surviving exposure to 0.05 mg/L mercuric cyanide. None of the embryos exposed to higher concentrations of mercuric cyanide hatched. The current study suggests that the reproduction and survival of aquatic organisms may be affected significantly by mercury cyanide contamination of aquatic environments.
BackgroundLong-term cadmium exposure is a risk factor for nephrolithiasis; however, the mechanisms underlying cadmium-mediated nephrolithiasis remain unclear.ObjectiveTo investigate the potential metabolic pathways involved in nephrolithiasis induced by occupational cadmium exposure.MethodsFrom January to December 2021, workers from a metal smelting plant in Guangdong Province were selected as study subjects. Demographic characteristics, medical history, and lifestyle information were collected through questionnaires. Midstream morning urine and blood samples were collected. Nearest neighbor matching was used to select paired samples. Untargeted metabolomics technology was employed to detect serum metabolite (lipids, amino acids, nucleotides, etc.) levels, while inductively coupled plasma mass spectrometry was used to determine urinary cadmium levels. History of nephrolithiasis was obtained through questionnaire survey, and logistic regression models were constructed to explore factors associated with nephrolithiasis. Core metabolites were identified using volcano plots and elastic net regression analysis. A metabolite-gene regulatory network was constructed using Cytoscape to identify nephrolithiasis-related genes, and Kyoto Encyclopedia of Genes and Genomes (KEGG) pathway enrichment analysis was conducted to elucidate nephrolithiasis-associated metabolic pathways.ResultsA total of 764 workers met predetermined inclusion and exclusion criteria. Among them, 318 workers were in the nephrolithiasis group (41.62%) and 446 in the control group (58.38%). A representative subset of 70 workers was used for the serum metabolomics analysis, comprising 25 workers in the nephrolithiasis group (35.71%) and 45 in the control group (64.29%). The logistic regression analysis revealed that urinary cadmium was a risk factor for nephrolithiasis in both the total population and the metabolomics subset, showing a positive association with nephrolithiasis occurrence [total population: OR(95%CI)=1.22(1.07, 1.38), P=0.01; metabolomics subset: OR(95%CI)=2.38(1.21, 4.70), P=0.01]. The volcano plot analysis identified 113 differential metabolites, including 39 significantly upregulated and 74 significantly downregulated metabolites. The elastic net regression analysis of these differential metabolites identified 13 related metabolites at λ=0.0274, where the model achieved optimal performance. These metabolites included acylcarnitine, N-acetylornithine, and spermine. The metabolite-gene regulatory network analysis identified 80 genes regulating the key metabolites. The KEGG pathway enrichment analysis of these genes revealed that lipid and amino acid metabolic pathways may be involved in the cadmium exposure-mediated kidney stone formation process. These pathways included sphingolipid metabolism, glycerate metabolism, arginine biosynthesis, and arginine and proline metabolism, among others.ConclusionOccupational cadmium exposure is positively associated with nephrolithiasis, and lipid and amino acid metabolic pathways may be involved in the cadmium-mediated process of kidney stone formation.
Retrieval-Augmented Generation (RAG) has proven effective in mitigating hallucinations in large language models by incorporating external knowledge during inference. However, this integration introduces new security vulnerabilities, particularly to poisoning attacks. Although prior work has explored various poisoning strategies, a thorough assessment of their practical threat to RAG systems remains missing. To address this gap, we propose the first comprehensive benchmark framework for evaluating poisoning attacks on RAG. Our benchmark covers 5 standard question answering (QA) datasets and 10 expanded variants, along with 13 poisoning attack methods and 7 defense mechanisms, representing a broad spectrum of existing techniques. Using this benchmark, we conduct a comprehensive evaluation of all included attacks and defenses across the full dataset spectrum. Our findings show that while existing attacks perform well on standard QA datasets, their effectiveness drops significantly on the expanded versions. Moreover, our results demonstrate that various advanced RAG architectures, such as sequential, branching, conditional, and loop RAG, as well as multi-turn conversational RAG, multimodal RAG systems, and RAG-based LLM agent systems, remain susceptible to poisoning attacks. Notably, current defense techniques fail to provide robust protection, underscoring the pressing need for more resilient and generalizable defense strategies.
The lifecycle of large language models (LLMs) is far more complex than that of traditional machine learning models, involving multiple training stages, diverse data sources, and varied inference methods. While prior research on data poisoning attacks has primarily focused on the safety vulnerabilities of LLMs, these attacks face significant challenges in practice. Secure data collection, rigorous data cleaning, and the multistage nature of LLM training make it difficult to inject poisoned data or reliably influence LLM behavior as intended. Given these challenges, this position paper proposes rethinking the role of data poisoning and argue that multi-faceted studies on data poisoning can advance LLM development. From a threat perspective, practical strategies for data poisoning attacks can help evaluate and address real safety risks to LLMs. From a trustworthiness perspective, data poisoning can be leveraged to build more robust LLMs by uncovering and mitigating hidden biases, harmful outputs, and hallucinations. Moreover, from a mechanism perspective, data poisoning can provide valuable insights into LLMs, particularly the interplay between data and model behavior, driving a deeper understanding of their underlying mechanisms.
Behavior Cloning (BC) is a popular framework for training sequential decision policies from expert demonstrations via supervised learning. As these policies are increasingly being deployed in the real world, their robustness and potential vulnerabilities are an important concern. In this work, we perform the first analysis of the efficacy of clean-label backdoor attacks on BC policies. Our backdoor attacks poison a dataset of demonstrations by injecting a visual trigger to create a spurious correlation that can be exploited at test time. We evaluate how policy vulnerability scales with the fraction of poisoned data, the strength of the trigger, and the trigger type. We also introduce a novel entropy-based test-time trigger attack that substantially degrades policy performance by identifying critical states where test-time triggering of the backdoor is expected to be most effective at degrading performance. We empirically demonstrate that BC policies trained on even minimally poisoned datasets exhibit deceptively high, near-baseline task performance despite being highly vulnerable to backdoor trigger attacks during deployment. Our results underscore the urgent need for more research into the robustness of BC policies, particularly as large-scale datasets are increasingly used to train policies for real-world cyber-physical systems. Videos and code are available at https://sites.google.com/view/dataset-poisoning-in-bc.
Local Differential Privacy (LDP) is a widely adopted privacy-protection model in the Internet of Things (IoT) due to its lightweight, decentralized, and scalable nature. However, it is vulnerable to poisoning attacks, and existing defenses either incur prohibitive resource overheads or rely on domain-specific prior knowledge, limiting their practical deployment. To address these limitations, we propose PEEL, a Poisoning-Exposing Encoding theoretical framework for LDP, which departs from resource- or prior-dependent countermeasures and instead leverages the inherent structural consistency of LDP-perturbed data. As a non-intrusive post-processing module, PEEL amplifies stealthy poisoning effects by re-encoding LDP-perturbed data via sparsification, normalization, and low-rank projection, thereby revealing both output and rule poisoning attacks through structural inconsistencies in the reconstructed space. Theoretical analysis proves that PEEL, integrated with LDP, retains unbiasedness and statistical accuracy, while being robust to expose both output and rule poisoning attacks. Moreover, evaluation results show that LDP-integrated PEEL not only outperforms four state-of-the-art defenses in terms of poisoning exposure accuracy but also significantly reduces client-side computational costs, making it highly suitable for large-scale IoT deployments.
Importance The US and Canada currently have no formal published nationwide guidelines for specialists in poison information or emergency departments for the management of acetaminophen poisoning, resulting in significant variability in management. Objective To develop consensus guidelines for the management of acetaminophen poisoning in the US and Canada. Evidence Review Four clinical toxicology societies (America's Poison Centers, American Academy of Clinical Toxicology, American College of Medical Toxicology, and Canadian Association of Poison Control Centers) selected participants (n = 21). Led by a nonvoting chairperson using a modified Delphi method, the panel created a decision framework and determined the appropriate clinical management of a patient with acetaminophen poisoning. Unique to this effort was the collection of guidelines from most poison centers in addition to systematic collection and review of the medical literature. Comments from review by external organizations were incorporated before the guideline was finalized. The project began in March 2021 and ended in March 2023. Findings The search retrieved 84 guidelines and 278 publications. The panel developed guidelines for emergency department management of single or repeated ingestion of acetaminophen. In addition, the panel addressed extended-release formulation, high-risk ingestion, coingestion of anticholinergics or opioids, age younger than 6 years, pregnancy, weight greater than 100 kg, and intravenous acetaminophen use. Differences from current US practice include defining acute ingestion as an ingestion presentation from 4 to 24 hours after overdose was initiated. A revised form of the Rumack-Matthew nomogram was developed. The term massive ingestion was replaced with the term high-risk ingestion and denoted by a specific nomogram line. Other recommendations include specific criteria for emergency department triage, laboratory evaluation and monitoring parameters, defining the role of gastrointestinal decontamination, detailed management of acetylcysteine treatment, associated adverse effects, and stopping criteria for acetylcysteine treatment, as well as criteria for consultation with a clinical toxicologist. Finally, specific treatment considerations, including acetylcysteine dosing, fomepizole administration, and considerations for extracorporeal elimination and transplant evaluation, were addressed. Conclusions and Relevance This qualitative study provides a consensus statement on consistent evidence-based recommendations for medical, pharmacy, and nursing education and practice to optimize care of patients with acetaminophen poisoning.
Background: Studies suggest that medicinal plant extracts can help reduce the neuron degeneration associated with diabetes. In this study, the neuroprotective effect of the alkaloid-rich extract from the leaves of Lannea egregia was assessed in rats with diabetes induced by streptozotocin (STZ). Methods: Lannea egregia alkaloid-rich analysis was carried out via a known procedure. The rats were randomly assigned into five treatment groups (n = 8): normal control, diabetic-induced rats (45 mg/kg STZ), and diabetic rats treated with low doses of Lannea egregia leaf alkaloid-rich extract (50 mg/kg b.w, LEL) and high (100 mg/kg b.w, LEH) (300 mg/kg and 150 mg/kg), and metformin (200 mg/kg). On 22nd day of the experiment, animals were sacrificed, and their blood and brains were collected for neuro-biomarker analysis. Results: Diabetic-induced rats that received metformin, LEL and LEH exhibited considerably reduced levels of dopamine, serotonin, norepinephrine, NO, MDA, and AChE, BChE activities when compared to untreated diabetic animals. Additionally, rats with diabetes that received treatment with metformin, LEL and LEH displayed a noticeable increase in ENTPDase, Na/K ATPase, GST, CAT, GPx, and SOD activities when compared to the untreated diabetic rats. Histological examination revealed improved brain architecture in the treated groups in contrast to those in diabetic-induced rats. Conclusion: The alkaloid-rich extracts of Lannea egregia might be effective in normalizing brain damage caused by complications of diabetes mellitus.
Vision-Language Models (VLMs) excel in generating textual responses from visual inputs, but their versatility raises security concerns. This study takes the first step in exposing VLMs' susceptibility to data poisoning attacks that can manipulate responses to innocuous, everyday prompts. We introduce Shadowcast, a stealthy data poisoning attack where poison samples are visually indistinguishable from benign images with matching texts. Shadowcast demonstrates effectiveness in two attack types. The first is a traditional Label Attack, tricking VLMs into misidentifying class labels, such as confusing Donald Trump for Joe Biden. The second is a novel Persuasion Attack, leveraging VLMs' text generation capabilities to craft persuasive and seemingly rational narratives for misinformation, such as portraying junk food as healthy. We show that Shadowcast effectively achieves the attacker's intentions using as few as 50 poison samples. Crucially, the poisoned samples demonstrate transferability across different VLM architectures, posing a significant concern in black-box settings. Moreover, Shadowcast remains potent under realistic conditions involving various text prompts, training data augmentation, and image compression techniques. This work reveals how poisoned VLMs can disseminate convincing yet deceptive misinformation to everyday, benign users, emphasizing the importance of data integrity for responsible VLM deployments. Our code is available at: https://github.com/umd-huang-lab/VLM-Poisoning.
Ethnopharmacological relevance: Fimbristylis miliacea (L.) Vahl (Cyperaceae) is a grass like herb habitually breeds as weed in paddy fields and mostly disseminated in tropical or sub-tropical countries of south and south-east Asia, northern Australia, and west Africa. The plant has been traditionally used to treat fever as a form of poultice. However, no scientific study regarding its toxicity profile has been testified. Aim of the study: The study has been carried out to determine the potential toxicity of the methanol extract from leaves of the Fimbristylis miliacea, employing the technique of acute and subchronic oral administration in mice. Materials and methods: In the acute toxicity study according to OECD guideline 425, oral administration of FM methanol extract at single doses of 2000 and 5000 mg/kg in both sexes of Swiss albino mice was performed. Toxic symptoms, abnormal behavior, changes in body weight, and mortality were observed for 14 consecutive days. In subchronic toxicity study according to OECD guideline 407, plant extract was administered orally at doses of 100, 500, 1000, and 2000 mg/kg daily for 28 days. The general toxic symptoms, abnormal behavior, changes in body weight were observed daily. Biochemical analysis of serum, and histopathological examination of liver were performed at the end of the study. Results: No mortality, abnormal behavior and urination, changes in sleep, food intake, adverse effect, and non-linearity in body weight have been recorded during acute toxicity study at the doses of 2000 and 5000 mg/kg. Also, in subchronic toxicity study, FM extract produced no mortality or any kind of adverse effects in regards of general behavior, body weight, urination, sleeping routine, and food intake. In case of analysis of thirteen different biochemical parameters, concentrations of aspartate transaminase (AST) and glucose were altered significantly in male and female mice in both acute and subchronic study. Total cholesterol and triglycerides at 5000 mg/kg.bw were changed in male mice in acute toxicity study. On the other hand, female mice had altered triglycerides in subchronic test. All other critical parameters were found unaffected. In subchronic test, histopathological examination of liver demonstrated cellular necrosis at 2000 mg/kg.bw in both male and female mice while minor necrosis was observed at 1000 mg/kg.bw. Thus, the no observed adverse effect level (NOAEL) can be assumed around 1000 mg/kg.bw. Conclusion: The present study suggests that treatment with FM extract does not reveal significant toxicity.
Abstract Papaya is a luscious tropical fruit loaded with vitamins and phytochemicals. The climacteric nature of fruit exposes it to numerous postharvest pathogens. Postharvest physical treatments are safer and greener approaches to mitigate the losses and bridge the gap between demand and supply of fruit. These treatments preserve the fruit quality during extended periods of cold storage and maintain shelf life. Nonetheless, prestorage physical treatments can positively impact the postharvest food value of fresh papaya fruits. This review summarizes the major advances in the field of postharvest physical treatments on papaya postharvest quality. Physical treatments include ozonation, irradiation, thermal and low‐temperature treatment, and synergistic effect among different physical treatments and also the synergetic effect of physical treatments with chemicals, essential oils, and coating materials on quality retention and disease management. The potential physiological, biochemical, microbiological, enzymatic, and biotechnological mechanisms of different physical treatments are reviewed. The review primarily highlights the changes induced due to physical treatment on genetic, biochemical, and physicochemical properties of papaya fruit. Most treatments positively impact the esthetic and nutritional value of fruit by reducing disease severity, physiological loss in weight, preserving physicochemical attributes, and retaining natural gloss and color. Use of physical interventions in papaya vouch for a safer, sustainable, and premium quality produce in the global market.
Food processing and manufacture, Toxicology. Poisons