Abstract:Adversarial attacks are considered a potentially serious security threat for machine learning systems. Medical image analysis (MedIA) systems have recently been argued to be vulnerable to adversarial attacks due to strong financial incentives and the associated technological infrastructure.In this paper, we study previously unexplored factors affecting adversarial attack vulnerability of deep learning MedIA systems in three medical domains: ophthalmology, radiology, and pathology. We focus on adversarial black-box settings, in which the attacker does not have full access to the target model and usually uses another model, commonly referred to as surrogate model, to craft adversarial examples that are then transferred to the target model. We consider this to be the most realistic scenario for MedIA systems. Firstly, we study the effect of weight initialization (pre-training on ImageNet or random initialization) on the transferability of adversarial attacks from the surrogate model to the target model, i.e., how effective attacks crafted using the surrogate model are on the target model. Secondly, we study the influence of differences in development (training and validation) data between target and surrogate models. We further study the interaction of weight initialization and data differences with differences in model architecture. All experiments were done with a perturbation degree tuned to ensure maximal transferability at minimal visual perceptibility of the attacks.Our experiments show that pre-training may dramatically increase the transferability of adversarial examples, even when the target and surrogate's architectures are different: the larger the performance gain using pre-training, the larger the transferability. Differences in the development data between target and surrogate models considerably decrease the performance of the attack; this decrease is further amplified by difference in the model architecture. We believe these factors should be considered when developing security-critical MedIA systems planned to be deployed in clinical practice. We recommend avoiding using only standard components, such as pre-trained architectures and publicly available datasets, as well as disclosure of design specifications, in addition to using adversarial defense methods. When evaluating the vulnerability of MedIA systems to adversarial attacks, various attack scenarios and target-surrogate differences should be simulated to achieve realistic robustness estimates. The code3 and all trained models4 used in our experiments are publicly available.

Adversarial attacks on deep learning models for fatty liver disease classification by modification of ultrasound image reconstruction method

Unsupervised Domain Adaptation with Adversarial Learning for Liver Tumors Detection in Multi-phase CT Images

Robustly Optimized Deep Feature Decoupling Network for Fatty Liver Diseases Detection

Frequency Constraint-Based Adversarial Attack on Deep Neural Networks for Medical Image Classification.

Stabilized Medical Image Attacks

Adversarial Detection and Defense for Medical Ultrasound Images: from a Frequency Perspective

Deep Learning With Ultrasound Images Enhance the Diagnosis of Nonalcoholic Fatty Liver

Deep Learning for Accurate Diagnosis of Liver Tumor Based on Magnetic Resonance Imaging and Clinical Data

Unsupervised Domain Adaptation Using Adversarial Learning and Maximum Square Loss for Liver Tumors Detection in Multi-phase CT Images.

Adversarial attack on deep learning-based dermatoscopic image recognition systems: Risk of misdiagnosis due to undetectable image perturbations

Adversarial Attack and Defense in Breast Cancer Deep Learning Systems

Using Adversarial Images to Assess the Robustness of Deep Learning Models Trained on Diagnostic Images in Oncology

Robust Medical Diagnosis: A Novel Two-Phase Deep Learning Framework for Adversarial Proof Disease Detection in Radiology Images

Realistic Ultrasound Image Synthesis for Improved Classification of Liver Disease

Understanding adversarial attacks on deep learning based medical image analysis systems

Impact of ultrasound image reconstruction method on breast lesion classification with neural transfer learning

DFT-Based Adversarial Attack Detection in MRI Brain Imaging: Enhancing Diagnostic Accuracy in Alzheimer's Case Studies

Adversarial attack vulnerability of medical image analysis systems: Unexplored factors

A Hierarchical Feature Constraint to Camouflage Medical Adversarial Attacks

Exploring adversarial attacks in federated learning for medical imaging

Comparing Detection Schemes for Adversarial Images against Deep Learning Models for Cancer Imaging