Adversarial examples: attacks and defences on medical deep learning systems

Puttagunta, Murali Krishna; Subban, Ravi; Babu, C. Nelson Kennedy

doi:10.1007/s11042-023-14702-9

Cited by 17 publications

(6 citation statements)

References 100 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We can see that the highest F1 score, which is 51.6%, was achieved while detecting the Gaussian-noise-based adversarial attacks. To attack the vision-based ADSs at runtime with different intensities, we adjust the noise term σ and the attack intensity ε in (10). We set five levels of attack intensities to perturb the images in either a multiplicative way or an additive way.…”

Section: Discussionmentioning

confidence: 99%

“…The primary objective of the adversarial attacks is to take into account the model's vulnerabilities and craft adversarial input to fool the DNN model into producing incorrect results [5][6][7][8]. Various adversarial attack strategies have recently been proposed to fool the DNN model into producing incorrect results in different application domains [9][10][11][12][13][14]. Among these attack strategies, DeepSearch [15], DeepFool [16], projected gradient descent (PGD) [17], and the fast gradient sign method (FGSM) [2] are commonly adopted methods for adversarial attacks.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Reconstruction-Based Adversarial Attack Detection in Vision-Based Autonomous Driving Systems

Hussain,

Hong

2023

MAKE

View full text Add to dashboard Cite

The perception system is a safety-critical component that directly impacts the overall safety of autonomous driving systems (ADSs). It is imperative to ensure the robustness of the deep-learning model used in the perception system. However, studies have shown that these models are highly vulnerable to the adversarial perturbation of input data. The existing works mainly focused on studying the impact of these adversarial attacks on classification rather than regression models. Therefore, this paper first introduces two generalized methods for perturbation-based attacks: (1) We used naturally occurring noises to create perturbations in the input data. (2) We introduce a modified square, HopSkipJump, and decision-based/boundary attack to attack the regression models used in ADSs. Then, we propose a deep-autoencoder-based adversarial attack detector. In addition to offline evaluation metrics (e.g., F1 score and precision, etc.), we introduce an online evaluation framework to evaluate the robustness of the model under attack. The framework considers the reconstruction loss of the deep autoencoder that validates the robustness of the models under attack in an end-to-end fashion at runtime. Our experimental results showed that the proposed adversarial attack detector could detect square, HopSkipJump, and decision-based/boundary attacks with a true positive rate (TPR) of 93%.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Reconstruction-Based Adversarial Attack Detection in Vision-Based Autonomous Driving Systems

Hussain,

Hong

2023

MAKE

View full text Add to dashboard Cite

show abstract

“…Several attacks have been introduced by previous research works, such as the Fast Sign Gradient Method [7], DeepFool [8], Carlini and Wagner attack [9], JSMA [10], One Pixel Attack [6]. Several surveys related to adversarial machine learning attacks including [11]- [13] have been published. The surveys focused on various aspects such as attack type [11], adversarial attacks in realworld scenarios [11], adversarial examples [12] and adversarial robustness from the interpretability perspective and attacks in specific domains (i.e., medical domain) [13].…”

Section: Related Workmentioning

confidence: 99%

“…Several surveys related to adversarial machine learning attacks including [11]- [13] have been published. The surveys focused on various aspects such as attack type [11], adversarial attacks in realworld scenarios [11], adversarial examples [12] and adversarial robustness from the interpretability perspective and attacks in specific domains (i.e., medical domain) [13].…”

Section: Related Workmentioning

confidence: 99%

Defense Method against Adversarial Attacks Using JPEG Compression and One-Pixel Attack for Improved Dataset Security

Cucu,

Valenzise,

Stănescu

et al. 2023

2023 27th International Conference on System Theory, Control and Computing (ICSTCC)

View full text Add to dashboard Cite

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers. L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

show abstract

“…However, the performance of CNNs is highly influenced by the image quality, object visibility, and other conditions during training [1]. For instance, in a medical application, such as recognizing the surgical tools in laparoscopic surgery video streams, some visual challenges highly influence the CNNs' performance for object classification [1,2]. These visual challenges are quite common in real medical applications, i.e., the surgical tools may be occluded by tissue or smoke may be generated during surgery, lenses are stained by blood, and motion blur is caused by movement or unstable camera position [1].…”

Section: Introductionmentioning

confidence: 99%

Minimally Distorted Adversarial Images with a Step-Adaptive Iterative Fast Gradient Sign Method

Ding,

Möller

2024

View full text Add to dashboard Cite

The safety and robustness of convolutional neural networks (CNNs) have raised increasing concerns, especially in safety-critical areas, such as medical applications. Although CNNs are efficient in image classification, their predictions are often sensitive to minor, for human observers, invisible modifications of the image. Thus, a modified, corrupted image can be visually equal to the legitimate image for humans but fool the CNN and make a wrong prediction. Such modified images are called adversarial images throughout this paper. A popular method to generate adversarial images is backpropagating the loss gradient to modify the input image. Usually, only the direction of the gradient and a given step size were used to determine the perturbations (FGSM, fast gradient sign method), or the FGSM is applied multiple times to craft stronger perturbations that change the model classification (i-FGSM). On the contrary, if the step size is too large, the minimum perturbation of the image may be missed during the gradient search. To seek exact and minimal input images for a classification change, in this paper, we suggest starting the FGSM with a small step size and adapting the step size with iterations. A few decay algorithms were taken from the literature for comparison with a novel approach based on an index tracking the loss status. In total, three tracking functions were applied for comparison. The experiments show our loss adaptive decay algorithms could find adversaries with more than a 90% success rate while generating fewer perturbations to fool the CNNs.

show abstract

Adversarial examples: attacks and defences on medical deep learning systems

Cited by 17 publications

References 100 publications

Reconstruction-Based Adversarial Attack Detection in Vision-Based Autonomous Driving Systems

Reconstruction-Based Adversarial Attack Detection in Vision-Based Autonomous Driving Systems

Defense Method against Adversarial Attacks Using JPEG Compression and One-Pixel Attack for Improved Dataset Security

Minimally Distorted Adversarial Images with a Step-Adaptive Iterative Fast Gradient Sign Method

Contact Info

Product

Resources

About