In this article we demonstrate that a state-of-the-art machine learning model predicting whether a whole slide image contains mitosis can be fooled by changing just a single pixel in the input image. Computer vision and machine learning can be used to automate various tasks in cancer diagnostic and detection. If an attacker can manipulate the automated processing, the results can be devastating and in the worst case lead to wrong diagnostic and treatments. In this research one-pixel attack is demonstrated in a real-life scenario with a real tumor dataset. The results indicate that a minor one-pixel modification of a whole slide image under analysis can affect the diagnosis. The attack poses a threat from the cyber security perspective: the one-pixel method can be used as an attack vector by a motivated attacker.

Modern artificial intelligence based medical imaging tools are vulnerable to model fooling attacks. Automated medical imaging methods are used for supporting the decision making by classifying samples as regular or as having characters of abnormality. One use of such technology is the analysis of whole-slide image tissue samples. Consequently, attacks against artificial intelligence based medical imaging methods may diminish the credibility of modern diagnosis methods and, at worst, may lead to misdiagnosis with improper treatment. This study demonstrates an advanced color-optimized one-pixel attack against medical imaging. A state-of-the-art one-pixel modification is constructed with minimal effect on the pixel's color value. This multi-objective approach mitigates the unnatural coloring of raw none-pixel attacks. Accordingly, it is infeasible or at least cumbersome for a human to see the modification in the image under analysis. This color-optimized one-pixel attack poses an advanced cyber threat against modern medical imaging and shows the importance of data integrity with image analysis.

No abstract

This version of the contribution has been accepted for publication, after peer review (when applicable) but is not the Version of Record and does not reflect post-acceptance improvements, or any corrections.