Using Adversarial Images to Assess the Stability of Deep Learning Models Trained on Diagnostic Images in Oncology

Abstract

BackgroundDeep learning (DL) models have shown the ability to automate the classification of medical images used for cancer detection. Unfortunately, recent studies have found that DL models are vulnerable to adversarial attacks which manipulate models into making incorrect predictions with high confidence. There is a need for better understanding of how adversarial attacks impact the predictive ability of DL models in the medical image domain.MethodsWe studied the adversarial attack susceptibility of DL models for three common imaging tasks within oncology. We investigated how PGD adversarial training could be employed to increase model robustness against FGSM, PGD, and BIM attacks. Finally, we studied the utility of adversarial sensitivity as a metric to improve model performance.ResultsOur experiments showed that medical DL models were highly sensitive to adversarial attacks, as visually imperceptible degrees of perturbation (<0.004) were sufficient to deceive the model the majority of the time. DL models for medical images were more vulnerable to adversarial attacks compared to DL models for non-medical images. Adversarial training increased model performance on adversarial samples for all classification tasks. We were able to increase model accuracy on clean images for all datasets by excluding images most vulnerable to adversarial perturbation.ConclusionOur results indicated that while medical DL systems are extremely susceptible to adversarial attacks, adversarial training show promise as an effective defense against attacks. Adversarial susceptibility of individual images can be used to increase model performance by identifying images most at-risk for misclassification. Our findings provide a useful basis for designing more robust and accurate medical DL models as well as techniques to defend models from adversarial attack.

Novel technical and privacy-preserving technology for artificial intelligence in ophthalmology

“…These attacks are specifically designed to exploit the local instability of AI models -from logistic regression to deep neural networks to NLP [116]. A prime target is image-based analyses, where input data can be manipulated with small variations, creating adversarial images that result in a significant decrease in accuracy and performance of DL models, despite having imperceptible differences from the original images to the human eye [117][118][119]. Adversarial techniques can also manipulate medical data for financial incentives such as exploiting medical billing and reimbursement systems, or to bias clinical trial outcomes [120].…”

A Review of Generative Adversarial Networks in Cancer Imaging: New Applications, New Solutions

“…The susceptibility of medical imaging deep learn-ing systems to white box and black box adversarial attacks is reviewed [245,243] and investigated [246,228,247] in recent studies. Cancer imaging models show a high level of susceptibility [248,156,249]. Besides imaging data, image quantification features such as radiomics features [250] are also commonly used in cancer imaging as input into CADe and CADx systems.…”

Towards Robust General Medical Image Segmentation

“…This behaviour has been studied for various tasks, such as classification [29,19], object detection [34] and semantic segmentation [32,2,7], highlighting the importance of reliably assessing robustness. To improve this dimension, adversarial robustness has been studied both from the side of the attacks [22,3,9,24,14] and the defenses [35,27,23,17], obtaining sizable progress towards DNN models resistant to adversarial perturbations; however, still much is left to advance. In particular, recognition tasks in medical domains are of utmost importance for robustness, as these tasks aim at safety-critical applications in which brittleness could have dramatic consequences.…”