Adversarial Machine Learning in AID Algorithms

Adversarial Machine Learning in AID Algorithms for Continuous [Glucose Monitoring](/)

Introduction

Adversarial machine learning studies how inputs can be crafted on purpose to make a machine-learning model give the wrong answer [1]. It matters for automated insulin delivery (AID) systems, which depend on a continuous glucose monitor (CGM) as their main sensing input [2]. If the glucose data is manipulated, the software that adjusts the insulin pump acts on bad information. In a laboratory test published in 2026, falsified sensor data pushed an open-source insulin controller to deliver more insulin than it did without the attack [2].

Background

Continuous glucose monitoring systems use algorithms to analyze data from glucose sensors, providing real-time insights into glucose levels and trends. The dosing software in two widely used commercial AID systems comes from control engineering rather than from a trained neural network: the MiniMed 780G uses a proportional-integral-derivative (PID) controller, and the Tandem t:slim X2 uses model predictive control (MPC) [3]. Machine learning enters the picture through research. Teams are using it to predict glucose, to detect attacks on insulin pumps, and to build "digital twin" models of people with type 1 diabetes for AI-enabled AID systems [4][5]. The distinction matters, because any controller can be misled by false glucose data, while adversarial examples in the strict sense target learned models [1].

Adversarial Machine Learning

Adversarial machine learning covers attacks that change a model's input on purpose so it makes an incorrect prediction or decision. Writing in Science in 2019, Finlayson and colleagues noted that researchers had shown adversarial examples for "essentially every type of machine-learning model ever studied." Their point was not that these models are inaccurate, but that even accurate models can be fooled by inputs built to fool them [1]. Much of the published AID work studies a related attack called false data injection, where fabricated values replace real sensor readings or pump commands. A team at Imperial College London connected real glucose sensors, laboratory fluid pumps and an open-source controller to simulated patients and found that a false-data attack on the sensor raised the insulin dose the controller delivered [2]. A Ben-Gurion University group spelled out the stakes: an insulin overdose attack can cause hypoglycemia, and an underdose attack can cause hyperglycemia [4].

Patents and Manufacturers

Several companies, including Dexcom and Medtronic, hold patents related to continuous glucose monitoring and machine learning algorithms. Medtronic's diabetes business now sells its pumps and sensors under the MiniMed name [6]. Both companies keep releasing new sensors, covered in the next section. Their comparison pages describe wear time, age indications and pump compatibility; they don't describe how the algorithms respond to manipulated inputs [6][7].

Latest Product Lines and Comparison

As of October 2026, Dexcom's current prescription CGMs are the Dexcom G7 and the Dexcom G7 15 Day [7]. The Dexcom G6 is being phased out. Dexcom says it will no longer manufacture the G6 after July 1, 2026, although pharmacies and distributors may have supplies for a while after that [8]. MiniMed's current sensors are the Simplera CGM, the Simplera Sync sensor, the Guardian 4 sensor and the Instinct sensor, which Abbott makes and which is worn for up to 15 days [6][9]. Guardian Connect, the standalone Medtronic CGM the FDA approved in 2018, has been superseded. It no longer appears on MiniMed's sensor comparison, and the FDA approved the standalone Simplera system under the same premarket approval file in July 2024 [6][10].

None of this tells us how a particular product would hold up against an adversarial attack. The test-bench study above used an open-source controller and simulated patients, not these commercial devices [2].

Pitfalls, Warnings, and Issues

The research and FDA guidance we read point to four recurring problems:

• Adversarial attacks: Deliberately altered inputs, including falsified glucose readings, can push a model or controller toward a wrong decision [1][2]. FDA's draft guidance on AI-enabled devices lists "model evasion" (inputs crafted to deceive a model) and "data poisoning" (maliciously modified data) among the threats manufacturers should plan for [11].
• Data quality: A model learns only what its data teaches it. FDA asks manufacturers to describe the data quality factors they used and to explain how their data represents the people who will use the device [11].
• Algorithmic bias: FDA describes AI bias as a tendency to produce incorrect results in a systematic, sometimes unforeseeable way, either for everyone or for a subset of the intended users [11].
• Regulatory frameworks: FDA's premarket cybersecurity guidance, updated in February 2026, tells manufacturers what security information belongs in a submission and addresses section 524B of the Federal Food, Drug, and Cosmetic Act for "cyber devices" [12]. The AI guidance was still a draft when we checked in October 2026 [11]. Past problems show why this matters. In 2019, Medtronic recalled its MiniMed 508 and Paradigm insulin pumps over a cybersecurity flaw it could not fix with a software update, the first diabetes device recall for that reason [13].

Conclusion

The evidence on attacks against AID comes from test benches, simulated patients and retrospective pump logs, not from attacks on marketed devices [2][4]. In the bench study, the authors warned that an undetected false-data attack could lead to a life-threatening condition [2]. What remains unknown is how today's commercial sensors and AID algorithms would respond to a determined attacker. If you have security questions about your own system, the manufacturer is the place to ask, and any change to how you use it is a decision for your care team.