Medical Aegis: Robust adversarial protectors for medical images
arXiv:2111.10969
Abstract
Deep neural network based medical image systems are vulnerable to adversarial examples. Many defense mechanisms have been proposed in the literature, however, the existing defenses assume a passive attacker who knows little about the defense system and does not change the attack strategy according to the defense. Recent works have shown that a strong adaptive attack, where an attacker is assumed to have full knowledge about the defense system, can easily bypass the existing defenses. In this paper, we propose a novel adversarial example defense system called Medical Aegis. To the best of our knowledge, Medical Aegis is the first defense in the literature that successfully addresses the strong adaptive adversarial example attacks to medical images. Medical Aegis boasts two-tier protectors: The first tier of Cushion weakens the adversarial manipulation capability of an attack by removing its high-frequency components, yet posing a minimal effect on classification performance of the original image; the second tier of Shield learns a set of per-class DNN models to predict the logits of the protected model. Deviation from the Shield's prediction indicates adversarial examples. Shield is inspired by the observations in our stress tests that there exist robust trails in the shallow layers of a DNN model, which the adaptive attacks can hardly destruct. Experimental results show that the proposed defense accurately detects adaptive attacks, with negligible overhead for model inference.
References in corpus (16)
- Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
- Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
- A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks
- Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks
- Understanding Adversarial Attacks on Deep Learning Based Medical Image Analysis Systems
- Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
- Countering Adversarial Images using Input Transformations
- Detecting Adversarial Samples from Artifacts
- Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning
- Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradients
- A study of the effect of JPG compression on adversarial images
- On Detecting Adversarial Perturbations
- Adversarial Attacks Against Medical Deep Learning Systems
- Adversarial Manipulation of Deep Representations
- Benchmarking Adversarial Robustness
- GAT: Generative Adversarial Training for Adversarial Example Detection and Robust Classification