Abstract:Deep learning algorithms have shown excellent performances in the field of medical image recognition, and practical applications have been made in several medical domains. Little is known about the feasibility and impact of an undetectable adversarial attacks, which can disrupt an algorithm by modifying a single pixel of the image to be interpreted. The aim of the study was to test the feasibility and impact of an adversarial attack on the accuracy of a deep learning-based dermatoscopic image recognition system.First, the pre-trained convolutional neural network DenseNet-201 was trained to classify images from the training set into 7 categories. Second, an adversarial neural network was trained to generate undetectable perturbations on images from the test set, to classifying all perturbed images as melanocytic nevi. The perturbed images were classified using the model generated in the first step. This study used the HAM-10000 dataset, an open source image database containing 10,015 dermatoscopic images, which was split into a training set and a test set. The accuracy of the generated classification model was evaluated using images from the test set. The accuracy of the model with and without perturbed images was compared. The ability of 2 observers to detect image perturbations was evaluated, and the inter observer agreement was calculated.The overall accuracy of the classification model dropped from 84% (confidence interval (CI) 95%: 82-86) for unperturbed images to 67% (CI 95%: 65-69) for perturbed images (Mc Nemar test, P < .0001). The fooling ratio reached 100% for all categories of skin lesions. Sensitivity and specificity of the combined observers calculated on a random sample of 50 images were 58.3% (CI 95%: 45.9-70.8) and 42.5% (CI 95%: 27.2-57.8), respectively. The kappa agreement coefficient between the 2 observers was negative at -0.22 (CI 95%: -0.49--0.04).Adversarial attacks on medical image databases can distort interpretation by image recognition algorithms, are easy to make and undetectable by humans. It seems essential to improve our understanding of deep learning-based image recognition systems and to upgrade their security before putting them to practical and daily use.

Adversarial examples: attacks and defences on medical deep learning systems

Adversarial Attacks Against Medical Deep Learning Systems

Adversarial attacks and defenses on AI in medical imaging informatics: A survey

Adversarial Examples: Attacks and Defenses for Deep Learning

Securing the Diagnosis of Medical Imaging: An In-depth Analysis of AI-Resistant Attacks

How Resilient Are Deep Learning Models in Medical Image Analysis? The Case of the Moment-Based Adversarial Attack (Mb-AdA)

Understanding adversarial attacks on deep learning based medical image analysis systems

Adversarial Attacks and Defences for Skin Cancer Classification

Adversarial Deep Learning: A Survey on Adversarial Attacks and Defense Mechanisms on Image Classification

Enhancing Adversarial Defense for Medical Image Analysis Systems with Pruning and Attention Mechanism

Adversarial Attacks and Defenses in Images, Graphs and Text: A Review

Defending against adversarial attacks on Covid-19 classifier: A denoiser-based approach

Adversarial attack on deep learning-based dermatoscopic image recognition systems: Risk of misdiagnosis due to undetectable image perturbations

Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challenges

Impact of Adversarial Examples on Deep Learning Models for Biomedical Image Segmentation

Adversarial Attacks and Defenses Against Deep Neural Networks: A Survey

Adversarial example detection for DNN models: a review and experimental comparison

Practical Black-Box Attacks against Deep Learning Systems using Adversarial Examples

Towards evaluating the robustness of deep diagnostic models by adversarial attack

Adversarial examples: attacks and defenses in the physical world