Abstract:It is known that Deep Neural networks (DNNs) are vulnerable to adversarial attacks, and the adversarial robustness of DNNs could be improved by adding adversarial noises to training data (e.g., the standard adversarial training (SAT)). However, inappropriate noises added to training data may reduce a model's performance, which is termed the trade-off between accuracy and robustness. This problem has been sufficiently studied for the classification of whole images but has rarely been explored for image analysis tasks in the medical application domain, including image segmentation, landmark detection, and object detection tasks. In this study, we show that, for those medical image analysis tasks, the SAT method has a severe issue that limits its practical use: it generates a fixed and unified level of noise for all training samples for robust DNN training. A high noise level may lead to a large reduction in model performance and a low noise level may not be effective in improving robustness. To resolve this issue, we design an adaptive-margin adversarial training (AMAT) method that generates sample-wise adaptive adversarial noises for robust DNN training. In contrast to the existing, classification-oriented adversarial training methods, our AMAT method uses a loss-defined-margin strategy so that it can be applied to different tasks as long as the loss functions are well-defined. We successfully apply our AMAT method to state-of-the-art DNNs, using five publicly available datasets. The experimental results demonstrate that: (1) our AMAT method can be applied to the three seemingly different tasks in the medical image application domain; (2) AMAT outperforms the SAT method in adversarial robustness; (3) AMAT has a minimal reduction in prediction accuracy on clean data, compared with the SAT method; and (4) AMAT has almost the same training time cost as SAT.

A general approach to improve adversarial robustness of DNNs for medical image segmentation and detection

Adaptive Adversarial Training to Improve Adversarial Robustness of DNNs for Medical Image Segmentation and Detection

Robustifying Deep Networks for Medical Image Segmentation

Improving adversarial robustness of deep neural networks by using semantic information

Increasing-Margin Adversarial (IMA) Training to Improve Adversarial Robustness of Neural Networks

Enhancing Adversarial Defense for Medical Image Analysis Systems with Pruning and Attention Mechanism

Defending Against Adversarial Attacks On Medical Imaging Ai System, Classification Or Detection?

Adversarial attacks and defenses on AI in medical imaging informatics: A survey

Cross-denoising Network against Corrupted Labels in Medical Image Segmentation with Domain Shift

Dynamic Perturbation-Adaptive Adversarial Training on Medical Image Classification

Improving adversarial robustness of medical imaging systems via adding global attention noise

Robust Convolutional Neural Networks Against Adversarial Attacks on Medical Images

Adversarial examples: attacks and defences on medical deep learning systems

Adversarial Neural Networks in Medical Imaging Advancements and Challenges in Semantic Segmentation

A prior knowledge-guided distributionally robust optimization-based adversarial training strategy for medical image classification

Target Attack on Biomedical Image Segmentation Model Based on Multi-Scale Gradients.

How Resilient Are Deep Learning Models in Medical Image Analysis? The Case of the Moment-Based Adversarial Attack (Mb-AdA)

Towards Robust General Medical Image Segmentation

Neural Architecture Search for Adversarial Medical Image Segmentation.

Adversarial attacks and adversarial training for burn image segmentation based on deep learning

Adversarial robustness improvement for deep neural networks