Identify Susceptible Locations in Medical Records via Adversarial Attacks on Deep Predictive Models

Abstract

The surging availability of electronic medical records (EHR) leads to increased research interests in medical predictive modeling. Recently many deep learning based predicted models are also developed for EHR data and demonstrated impressive performance. However, a series of recent studies showed that these deep models are not safe: they suffer from certain vulnerabilities. In short, a well-trained deep network can be extremely sensitive to inputs with negligible changes. These inputs are referred to as adversarial examples. In the context of medical informatics, such attacks could alter the result of a high performance deep predictive model by slightly perturbing a patient's medical records. Such instability not only reflects the weakness of deep architectures, more importantly, it offers guide on detecting susceptible parts on the inputs. In this paper, we propose an efficient and effective framework that learns a time-preferential minimum attack targeting the LSTM model with EHR inputs, and we leverage this attack strategy to screen medical records of patients and identify susceptible events and measurements. The efficient screening procedure can assist decision makers to pay extra attentions to the locations that can cause severe consequence if not measured correctly. We conduct extensive empirical studies on a real-world urgent care cohort and demonstrate the effectiveness of the proposed screening approach.

References in corpus (14)

• Learning Phrase Representations using RNN Encoder-Decoder for Statistical Machine Translation
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Deep EHR: A Survey of Recent Advances in Deep Learning Techniques for Electronic Health Record (EHR) Analysis
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Learning to Diagnose with LSTM Recurrent Neural Networks
• Understanding Neural Networks through Representation Erasure
• Generating Natural Adversarial Examples
• Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN
• Adversarial Examples for Evaluating Reading Comprehension Systems
• Provably Minimally-Distorted Adversarial Examples
• Universal adversarial perturbations
• DeepCare: A Deep Dynamic Memory Model for Predictive Medicine
• Adversarial Manipulation of Deep Representations
• DeepDGA: Adversarially-Tuned Domain Generation and Detection

Cited by in corpus (4)

• Defend Deep Neural Networks Against Adversarial Examples via Fixed and Dynamic Quantized Activation Functions
• Universal Adversarial Perturbation for Text Classification
• Query-Efficient Black-Box Attack by Active Learning
• Machine Learning with Electronic Health Records is vulnerable to Backdoor Trigger Attacks