VOLT: VOlumetric Low-frequency Trigger backdoors on 3D medical foundation models via prompt learning

The growing adoption of 3D medical foundation models raises critical security concerns, particularly when such models are adapted to downstream clinical tasks through parameter efficient prompt learning. We introduce \textbf{VOLT} (\textbf{\underline{VO}}lumetric \textbf{\underline{L}}ow frequency \textbf{\underline{T}}rigger), a backdoor attack framework for 3D medical vision language foundation models that jointly learns a low distortion volumetric spectral trigger and a small set of continuous prompt tokens while keeping the pretrained image and text encoders frozen. Unlike conventional voxel space perturbations, VOLT parameterizes the trigger in a compact low frequency region of the 3D frequency domain, producing smooth global perturbations that are difficult to perceive and remain effective under common medical image preprocessing operations. The learned prompt simultaneously steers the image text representation toward an attacker specified target class, enabling the backdoor to be implanted with only a small number of trainable parameters and few shot samples. We evaluate VOLT on multiple 3D medical imaging benchmarks, including MedMNIST3D, MosMedData, LUNA16, and CC-CCII, across three medical foundation models: M3D-CLIP, CT-CLIP, and MERLIN. VOLT achieves high attack success, reaching $100\%$ backdoor accuracy in several model dataset combinations while generally maintaining useful clean task performance. Further analyses demonstrate the parameter efficiency and imperceptibility of the spectral trigger, its robustness to preprocessing, transferability across foundation model backbones, and sensitivity to prompt learning and trigger design choices. These results expose a previously underexplored attack surface in prompt adapted 3D medical foundation models and highlight the need for backdoor aware evaluation and safeguards before their deployment in safety critical healthcare settings.