One-Pixel Attack Deceives Computer-Assisted Diagnosis of Cancer

Abstract

In this article we demonstrate that a state-of-the-art machine learning model predicting whether a whole slide image contains mitosis can be fooled by changing just a single pixel in the input image. Computer vision and machine learning can be used to automate various tasks in cancer diagnostic and detection. If an attacker can manipulate the automated processing, the results can be devastating and in the worst case lead to wrong diagnostic and treatments. In this research one-pixel attack is demonstrated in a real-life scenario with a real tumor dataset. The results indicate that a minor one-pixel modification of a whole slide image under analysis can affect the diagnosis. The attack poses a threat from the cyber security perspective: the one-pixel method can be used as an attack vector by a motivated attacker.

A Review of Generative Adversarial Networks in Cancer Imaging: New Applications, New Solutions

“…A general problem facing the adoption of deep learning methods in clinical tasks is their inherent unreliability ex-emplified by high prediction variation caused by minimal input variation (e.g., one pixel attack [156]). This is further exacerbated by the nontransparent decision making process inside deep neural networks thus often described as 'black box models' [24]; Also, the performance of deep learning methods in out-of-domain datasets has been assessed as unreliable [157].…”

“…The susceptibility of medical imaging deep learn-ing systems to white box and black box adversarial attacks is reviewed [245,243] and investigated [246,228,247] in recent studies. Cancer imaging models show a high level of susceptibility [248,156,249]. Besides imaging data, image quantification features such as radiomics features [250] are also commonly used in cancer imaging as input into CADe and CADx systems.…”

Chromatic and spatial analysis of one-pixel attacks against an image classifier

“…In our previous publications we introduced how an artificial neural network image classifier model could be fooled by changing only one pixel in the input image [16,17]. Those studies targeted IBM CODAIT MAX breast cancer detector model [18].…”

“…The dataset used in this study contains the one-pixel attack results from the previous study [16], and information of the attacked image, such as the attack pixel's location in the image and the nearby neighboring pixels' color values of the attacked pixel. Attacks that were considered successful were selected from the dataset, mitosis-to-normal attacks, where the confidence score of the neural network was decreased to less than 0.9, was included.…”

“…One-pixel attack appeared to be a comprehensive and realistic attack vector, so we decided to further investigate it as a conceptual framework in the medical imaging domain [15]. When the concept and usability of the attack were understood, we succeeded to implement the technical one-pixel attack against real neural network models used in medical imaging [16]. That first technical attack was a success, but the pixel changes in the images were quite easily observable by a human.…”