Adversarial Robustness of Medical Imaging Classifiers: A Frequency-Consistency Defence with Spectral Abstention
DOI:
https://doi.org/10.29284/pway4b33Keywords:
Adversarial robustness, medical image analysis, adversarial examples, adversarial training, wavelet transform, frequency analysis, selective classification, chest radiography, dermoscopy, computational pathology, trustworthy artificial intelligence.Abstract
Deep classifiers now approach specialist-level accuracy on chest radiography, dermoscopy and digital pathology, and the first such systems have entered routine clinical workflows. Their decision boundaries, however, lie close enough to the data that a perturbation smaller than the quantisation step of the stored DICOM pixel array can invert a diagnosis while leaving the image radiologically unchanged. Medical imaging is unusually exposed to this failure, because studies traverse a long acquisition, compression and transport pipeline whose output label carries direct reimbursement and triage consequences. This paper presents MedFAR, a frequency-aware framework for hardening medical image classifiers and deploying them safely. We first calibrate the threat model to the clinical pipeline, expressing perturbation budgets relative to the bit depth of the stored study rather than to a constant borrowed from natural-image benchmarks. A wavelet decomposition then shows that 75.5 % of the energy of a successful attack concentrates in the two highest-frequency subbands, where diagnostic signal is sparse. MedFAR exploits this asymmetry through a band-ablation consistency loss requiring the classifier to agree with itself when high-frequency content is removed, combined with a TRADES-style robust objective; a spectral-discrepancy score then allows the deployed model to abstain and route a study to a human reader rather than emit a confident wrong label. Across ChestX-ray14, ISIC 2019 and PatchCamelyon and three backbones, MedFAR raises AutoAttack AUROC on chest radiography from 0.061 to 0.641 while surrendering 1.8 points of clean AUROC, exceeding TRADES by 4.3 robust points at a lower clean cost. At 80 % coverage the abstention head reduces adversarial balanced error from 0.318 to 0.161. All results are retrospective and obtained on public datasets.
References
[1] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” in Proc. Int. Conf. Learning Representations (ICLR), Apr. 2014.
[2] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in Proc. Int. Conf. Learning Representations (ICLR), May 2015.
[3] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in Proc. Int. Conf. Learning Representations (ICLR), Apr. 2018.
[4] N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in Proc. IEEE Symp. Security and Privacy (S&P), May 2017, pp. 39–57.
[5] F. Croce and M. Hein, “Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,” in Proc. 37th Int. Conf. Machine Learning (ICML), Jul. 2020, pp. 2206–2216.
[6] H. Zhang, Y. Yu, J. Jiao, E. P. Xing, L. El Ghaoui, and M. I. Jordan, “Theoretically principled trade-off between robustness and accuracy,” in Proc. 36th Int. Conf. Machine Learning (ICML), Jun. 2019, pp. 7472–7482.
[7] S. G. Finlayson, J. D. Bowers, J. Ito, J. L. Zittrain, A. L. Beam, and I. S. Kohane, “Adversarial attacks on medical machine learning,” Science, vol. 363, no. 6433, pp. 1287–1289, Mar. 2019.
[8] X. Ma, Y. Niu, L. Gu, Y. Wang, Y. Zhao, J. Bailey, and F. Lu, “Understanding adversarial attacks on deep learning based medical image analysis systems,” Pattern Recognition, vol. 110, art. 107332, Feb. 2021.
[9] G. Bortsova, C. González-Gonzalo, S. C. Wetstein, F. Dubost, I. Katramados, et al., “Adversarial attack vulnerability of medical image analysis systems: Unexplored factors,” Medical Image Analysis, vol. 73, art. 102141, Oct. 2021.
[10] P. Rajpurkar, J. Irvin, K. Zhu, B. Yang, H. Mehta, et al., “CheXNet: Radiologist-level pneumonia detection on chest X-rays with deep learning,” arXiv:1711.05225, Nov. 2017.
[11] X. Wang, Y. Peng, L. Lu, Z. Lu, M. Bagheri, and R. M. Summers, “ChestX-ray8: Hospital-scale chest X-ray database and benchmarks on weakly-supervised classification and localization of common thorax diseases,” in Proc. IEEE Conf. Computer Vision and Pattern Recognition (CVPR), Jul. 2017, pp. 2097–2106.
[12] J. Irvin, P. Rajpurkar, M. Ko, Y. Yu, S. Ciurea-Ilcus, et al., “CheXpert: A large chest radiograph dataset with uncertainty labels and expert comparison,” in Proc. AAAI Conf. Artificial Intelligence, Jan. 2019, pp. 590–597.
[13] A. Esteva, B. Kuprel, R. A. Novoa, J. Ko, S. M. Swetter, H. M. Blau, and S. Thrun, “Dermatologist-level classification of skin cancer with deep neural networks,” Nature, vol. 542, no. 7639, pp. 115–118, Feb. 2017.
[14] N. C. F. Codella, V. Rotemberg, P. Tschandl, M. E. Celebi, S. Dusza, et al., “Skin lesion analysis toward melanoma detection 2018: A challenge hosted by the International Skin Imaging Collaboration (ISIC),” arXiv:1902.03368, Mar. 2019.
[15] B. S. Veeling, J. Linmans, J. Winkens, T. Cohen, and M. Welling, “Rotation equivariant CNNs for digital pathology,” in Proc. Int. Conf. Medical Image Computing and Computer-Assisted Intervention (MICCAI), Sep. 2018, pp. 210–218.
[16] J. M. Cohen, E. Rosenfeld, and J. Z. Kolter, “Certified adversarial robustness via randomized smoothing,” in Proc. 36th Int. Conf. Machine Learning (ICML), Jun. 2019, pp. 1310–1320.
[17] D. Hendrycks and T. Dietterich, “Benchmarking neural network robustness to common corruptions and perturbations,” in Proc. Int. Conf. Learning Representations (ICLR), May 2019.
[18] H. Wang, X. Wu, Z. Huang, and E. P. Xing, “High-frequency component helps explain the generalization of convolutional neural networks,” in Proc. IEEE/CVF Conf. Computer Vision and Pattern Recognition (CVPR), Jun. 2020, pp. 8684–8694.
[19] D. Yin, R. Gontijo Lopes, J. Shlens, E. D. Cubuk, and J. Gilmer, “A Fourier perspective on model robustness in computer vision,” in Advances in Neural Information Processing Systems 32, Dec. 2019, pp. 13276–13286.
[20] C. Xie, Y. Wu, L. van der Maaten, A. L. Yuille, and K. He, “Feature denoising for improving adversarial robustness,” in Proc. IEEE/CVF Conf. Computer Vision and Pattern Recognition (CVPR), Jun. 2019, pp. 501–509.
[21] L. Rice, E. Wong, and J. Z. Kolter, “Overfitting in adversarially robust deep learning,” in Proc. 37th Int. Conf. Machine Learning (ICML), Jul. 2020, pp. 8093–8104.
[22] G. Huang, Z. Liu, L. van der Maaten, and K. Q. Weinberger, “Densely connected convolutional networks,” in Proc. IEEE Conf. Computer Vision and Pattern Recognition (CVPR), Jul. 2017, pp. 4700–4708.
[23] A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, et al., “An image is worth 16×16 words: Transformers for image recognition at scale,” in Proc. Int. Conf. Learning Representations (ICLR), May 2021.
[24] Y. Geifman and R. El-Yaniv, “Selective classification for deep neural networks,” in Advances in Neural Information Processing Systems 30, Dec. 2017, pp. 4878–4887.
[25] C. Guo, G. Pleiss, Y. Sun, and K. Q. Weinberger, “On calibration of modern neural networks,” in Proc. 34th Int. Conf. Machine Learning (ICML), Aug. 2017, pp. 1321–1330.
[26] A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, et al., “PyTorch: An imperative style, high-performance deep learning library,” in Advances in Neural Information Processing Systems 32, Dec. 2019, pp. 8024–8035.
[27] K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proc. IEEE Conf. Computer Vision and Pattern Recognition (CVPR), Jun. 2016, pp. 770–778.
[28] S. G. Mallat, “A theory for multiresolution signal decomposition: The wavelet representation,” IEEE Trans. Pattern Analysis and Machine Intelligence, vol. 11, no. 7, pp. 674–693, Jul. 1989.
[29] A. Athalye, N. Carlini, and D. Wagner, “Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,” in Proc. 35th Int. Conf. Machine Learning (ICML), Jul. 2018, pp. 274–283.
[30] T. B. Brown, D. Mané, A. Roy, M. Abadi, and J. Gilmer, “Adversarial patch,” arXiv:1712.09665, Dec. 2017.
[31] N. Carlini, A. Athalye, N. Papernot, W. Brendel, J. Rauber, et al., “On evaluating adversarial robustness,” arXiv:1902.06705, Feb. 2019.
Downloads
Published
Issue
Section
License
This work is licensed under a Creative Commons Attribution 4.0 International License.
This work is licensed under a Creative Commons Attribution 4.0 International License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.
