Research on adversarial examples in computer visiontasks has shown that small, often imperceptible changes to an image can induce misclassification, which has security implications for a wide range of image processing systems. Considering L 2 norm distortions, the Carlini and Wagner attack is presently the most effective white-box attack in the literature. However, this method is slow since it performs a line-search for one of the optimization terms, and often requires thousands of iterations. In this paper, an efficient approach is proposed to generate gradient-based attacks that induce misclassifications with low L 2 norm, by decoupling the direction and the norm of the adversarial perturbation that is added to the image. Experiments conducted on the MNIST, CIFAR-10 and ImageNet datasets indicate that our attack achieves comparable results to the state-of-the-art (in terms of L 2 norm) with considerably fewer iterations (as few as 100 iterations), which opens the possibility of using these attacks for adversarial training. Models trained with our attack achieve state-of-the-art robustness against whitebox gradient-based L 2 attacks on the MNIST and CIFAR-10 datasets, outperforming the Madry defense when the attacks are limited to a maximum norm. * Equal contribution.1 This also affects other machine learning classifiers, but we restrict our analysis to CNNs, that are most commonly used in computer vision tasks.

Purpose Precise segmentation of bladder walls and tumor regions is an essential step toward noninvasive identification of tumor stage and grade, which is critical for treatment decision and prognosis of patients with bladder cancer (BC). However, the automatic delineation of bladder walls and tumor in magnetic resonance images (MRI) is a challenging task, due to important bladder shape variations, strong intensity inhomogeneity in urine, and very high variability across the population, particularly on tumors’ appearance. To tackle these issues, we propose to leverage the representation capacity of deep fully convolutional neural networks. Methods The proposed network includes dilated convolutions to increase the receptive field without incurring extra cost or degrading its performance. Furthermore, we introduce progressive dilations in each convolutional block, thereby enabling extensive receptive fields without the need for large dilation rates. The proposed network is evaluated on 3.0T T2‐weighted MRI scans from 60 pathologically confirmed patients with BC. Results Experiments show the proposed model to achieve a higher level of accuracy than state‐of‐the‐art methods, with a mean Dice similarity coefficient of 0.98, 0.84, and 0.69 for inner wall, outer wall, and tumor region segmentation, respectively. These results represent a strong agreement with reference contours and an increase in performance compared to existing methods. In addition, inference times are less than a second for a whole three‐dimensional (3D) volume, which is between two and three orders of magnitude faster than related state‐of‐the‐art methods for this application. Conclusion We showed that a CNN can yield precise segmentation of bladder walls and tumors in BC patients on MRI. The whole segmentation process is fully automatic and yields results similar to the reference standard, demonstrating the viability of deep learning models for the automatic multiregion segmentation of bladder cancer MRI images.

No abstract

The NIPS 2018 Adversarial Vision Challenge is a competition to facilitate measurable progress towards robust machine vision models and more generally applicable adversarial attacks. This document is an updated version of our competition proposal that was accepted in the competition track of 32nd Conference on Neural Information Processing Systems (NIPS 2018). NIPS 2017 Competition on adversarial attacks and defenses.Co-organised by Alexey Kurakin. This competition pitted models against attacks but only indirectly: attacks were unable to query the models and hence had to device generic adversarial examples that would work against as many models as possible. Devising defenses against such unspecific transferbased attacks is much simpler than becoming robust against model-specific attacks.

No abstract