Abstract:Diabetic Retinopathy (DR) is a leading cause of vision loss around the world. To help diagnose it, numerous cutting-edge works have built powerful deep neural networks (DNNs) to automatically grade DR via retinal fundus images (RFIs). However, RFIs are commonly affected by camera exposure issues that may lead to incorrect grades. The mis-graded results can potentially pose high risks to an aggravation of the condition. In this paper, we study this problem from the viewpoint of adversarial attacks. We identify and introduce a novel solution to an entirely new task, termed as adversarial exposure attack, which is able to produce natural exposure images and mislead the state-of-the-art DNNs. We validate our proposed method on a real-world public DR dataset with three DNNs, e.g., ResNet50, MobileNet, and EfficientNet, demonstrating that our method achieves high image quality and success rate in transferring the attacks. Our method reveals the potential threats to DNN-based automatic DR grading and would benefit the development of exposure-robust DR grading methods in the future.

What problem does this paper attempt to address?

The problem that this paper attempts to solve is the impact of camera exposure problems on deep neural networks (DNNs) in the grading of diabetic retinopathy (DR) images. Specifically, since retinal fundus images (RFIs) are often affected by camera exposure problems, this may lead to errors in the automatic grading of DR by DNNs, and may further pose a high risk to the aggravation of patients' conditions. Therefore, this paper studies this problem from the perspective of adversarial attacks and proposes a new task - adversarial exposure attack, aiming to mislead the state - of - the - art DNNs by generating natural exposure images, thereby revealing the potential threats of DNNs in dealing with exposure changes and promoting the development of future anti - exposure DR grading methods. ### Main contributions 1. **Proposed exposure attack based on multiplicative perturbation**: By adjusting image exposure to mislead pre - trained DNNs, it reveals the challenges of this new task, that is, it is difficult to generate natural adversarial exposure images with high attack transferability. 2. **Proposed Adversarial Bracketed Exposure Fusion (ABEF)**: Consider exposure attacks as an element - level exposure fusion problem in the Laplacian pyramid space to improve the image naturalness of adversarial outputs. 3. **Proposed Convolutional Bracketed Exposure Fusion (CBEF)**: Further enhance the transferability of attacks by using convolutional operations instead of multiplicative operations. 4. **Experimental verification**: Experiments were carried out on real - world public DR datasets, showing that the generated adversarial samples can achieve high - quality images and high attack transferability, which helps to enhance the robustness of DNNs to exposure changes. ### Method overview - **Adversarial Exposure Attack**: - Given a DR image \(X\), a pre - trained DNN \(\phi(\cdot)\) can classify it into a certain grade. - The goal is to generate an adversarial sample \(X_e = X\odot E\) by adjusting the exposure map \(E\) so that the DNN misclassifies it. - Optimization objective function: \[ \arg\max_{E}J(\phi(X\odot E), y),\quad\text{subject to }\|E - 1\|_p < \epsilon \] where \(J(\cdot)\) is an image classification loss function (such as cross - entropy), \(y\) is the true grade of \(X\), and \(\epsilon\) controls the perturbation degree. - **Adversarial Bracketed Exposure Fusion (ABEF)**: - Generate a sequence of images with different exposure levels \(\{X_i\}_{i = 1}^N\), where \(X_i = X\cdot2^{e_i}\), and \(e_i\) is the exposure offset value. - Decompose each exposure image using the Laplacian pyramid representation method and assign a weight map \(\{W_i^l\}\) to each image. - Fuse these images to generate the final adversarial sample: \[ \hat{X}_e^l=\sum_{i = 1}^N W_i^l\odot\hat{X}_i^l,\quad\text{subject to }\forall l,\sum_{i = 1}^N\sum_p W_i^l(p)=1 \] \[ X_e = L^{-1}(\{\hat{X}_e^l\}_{l = 1}^L) \] - **Convolutional Bracketed Exposure Fusion (CBEF)**: - Extend the element - level linear fusion to a convolutional strategy

Adversarial Exposure Attack on Diabetic Retinopathy Imagery Grading

Grading of Diabetic Retinopathy Images Based on Graph Neural Network.

IDRiD: Diabetic Retinopathy - Segmentation and Grading Challenge.

A novel approach for intelligent diagnosis and grading of diabetic retinopathy

Towards Generalizable Diabetic Retinopathy Grading in Unseen Domains

Attention-Driven Cascaded Network for Diabetic Retinopathy Grading from Fundus Images

Adversarial Attack and Defence through Adversarial Training and Feature Fusion for Diabetic Retinopathy Recognition

Universal Adversarial Framework to Improve Adversarial Robustness for Diabetic Retinopathy Detection

Improving Lesion Segmentation for Diabetic Retinopathy using Adversarial Learning

Robust Collaborative Learning of Patch-Level and Image-Level Annotations for Diabetic Retinopathy Grading From Fundus Image

Grouping and Decoupling Mechanism for Diabetic Retinopathy Image Grading.

Divergent Domains, Convergent Grading: Enhancing Generalization in Diabetic Retinopathy Grading

Deep attentive convolutional neural network for automatic grading of imbalanced diabetic retinopathy in retinal fundus images

Attention-based Deep Learning Framework for Automatic Fundus Image Processing to Aid in Diabetic Retinopathy Grading

End-to-end diabetic retinopathy grading based on fundus fluorescein angiography images using deep learning

Recognition of Diabetic Retinopathy Grades Based on Data Augmentation and Attention Mechanisms

Using Deep Learning Architectures for Detection and Classification of Diabetic Retinopathy

Learning Discriminative Representations for Fine-Grained Diabetic Retinopathy Grading

Explainable Diabetic Retinopathy Detection and Retinal Image Generation

DRStageNet: Deep Learning for Diabetic Retinopathy Staging from Fundus Images

DRG-Net: Interactive Joint Learning of Multi-lesion Segmentation and Classification for Diabetic Retinopathy Grading