Towards Evaluating the Robustness of Deep Diagnostic Models by Adversarial Attack

Abstract

Deep learning models (with neural networks) have been widely used in challenging tasks such as computer-aided disease diagnosis based on medical images. Recent studies have shown deep diagnostic models may not be robust in the inference process and may pose severe security concerns in clinical practice. Among all the factors that make the model not robust, the most serious one is adversarial examples. The so-called "adversarial example" is a well-designed perturbation that is not easily perceived by humans but results in a false output of deep diagnostic models with high confidence. In this paper, we evaluate the robustness of deep diagnostic models by adversarial attack. Specifically, we have performed two types of adversarial attacks to three deep diagnostic models in both single-label and multi-label classification tasks, and found that these models are not reliable when attacked by adversarial example. We have further explored how adversarial examples attack the models, by analyzing their quantitative classification results, intermediate features, discriminability of features and correlation of estimated labels for both original/clean images and those adversarial ones. We have also designed two new defense methods to handle adversarial examples in deep diagnostic models, i.e., Multi-Perturbations Adversarial Training (MPAdvT) and Misclassification-Aware Adversarial Training (MAAdvT). The experimental results have shown that the use of defense methods can significantly improve the robustness of deep diagnostic models against adversarial attacks.

arXiv commentThis version was accepted in the journal Medical Image Analysis (MedIA)

References in corpus (27)

• Adam: A Method for Stochastic Optimization
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• CheXNet: Radiologist-Level Pneumonia Detection on Chest X-Rays with Deep Learning
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Theoretically Principled Trade-off between Robustness and Accuracy
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• On Evaluating Adversarial Robustness
• Understanding Adversarial Attacks on Deep Learning Based Medical Image Analysis Systems
• Countering Adversarial Images using Input Transformations
• Using Pre-Training Can Improve Model Robustness and Uncertainty
• Skin Lesion Analysis toward Melanoma Detection: A Challenge at the International Symposium on Biomedical Imaging (ISBI) 2016, hosted by the International Skin Imaging Collaboration (ISIC)
• Detecting Adversarial Samples from Artifacts
• Robustness May Be at Odds with Accuracy
• Deep Variational Information Bottleneck
• Benchmarking Neural Network Robustness to Common Corruptions and Perturbations
• Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradients
• Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
• Learning to diagnose from scratch by exploiting dependencies among labels
• Are Labels Required for Improving Adversarial Robustness?
• Adversarial vulnerability for any classifier
• Adversarial Attacks Against Medical Deep Learning Systems
• Training for Faster Adversarial Robustness Verification via Inducing ReLU Stability
• Automatic brain tumor grading from MRI data using convolutional neural networks and quality assessment
• Detecting hip fractures with radiologist-level performance using deep neural networks
• Security Analysis and Enhancement of Model Compressed Deep Learning Systems under Adversarial Attacks
• Vulnerability Analysis of Chest X-Ray Image Classification Against Adversarial Attacks

Cited by in corpus (4)

• MedViT: A Robust Vision Transformer for Generalized Medical Image Classification
• Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challenges
• InfoAT: Improving Adversarial Training Using the Information Bottleneck Principle
• Accurate Explanation Model for Image Classifiers using Class Association Embedding