Adversarial attack on deep learning-based dermatoscopic image recognition systems

Abstract

Deep learning algorithms have shown excellent performances in the field of medical image recognition, and practical applications have been made in several medical domains. Little is known about the feasibility and impact of an undetectable adversarial attacks, which can disrupt an algorithm by modifying a single pixel of the image to be interpreted. The aim of the study was to test the feasibility and impact of an adversarial attack on the accuracy of a deep learning-based dermatoscopic image recognition system. First, the pre-trained convolutional neural network DenseNet-201 was trained to classify images from the training set into 7 categories. Second, an adversarial neural network was trained to generate undetectable perturbations on images from the test set, to classifying all perturbed images as melanocytic nevi. The perturbed images were classified using the model generated in the first step. This study used the HAM-10000 dataset, an open source image database containing 10,015 dermatoscopic images, which was split into a training set and a test set. The accuracy of the generated classification model was evaluated using images from the test set. The accuracy of the model with and without perturbed images was compared. The ability of 2 observers to detect image perturbations was evaluated, and the inter observer agreement was calculated. The overall accuracy of the classification model dropped from 84% (confidence interval (CI) 95%: 82–86) for unperturbed images to 67% (CI 95%: 65–69) for perturbed images (Mc Nemar test, P < .0001). The fooling ratio reached 100% for all categories of skin lesions. Sensitivity and specificity of the combined observers calculated on a random sample of 50 images were 58.3% (CI 95%: 45.9–70.8) and 42.5% (CI 95%: 27.2–57.8), respectively. The kappa agreement coefficient between the 2 observers was negative at -0.22 (CI 95%: −0.49–−0.04). Adversarial attacks on medical image databases can distort interpretation by image recognition algorithms, are easy to make and undetectable by humans. It seems essential to improve our understanding of deep learning-based image recognition systems and to upgrade their security before putting them to practical and daily use.

Development and Validation of a Deep Learning Model to Reduce the Interference of Rectal Artifacts in MRI-based Prostate Cancer Diagnosis

“…Although previous research has highlighted the efficacy of adversarial training in bolstering deep neural networks against adversarial noises for tasks like natural image segmentation ( 22 ) or detection ( 23 ), adversarial noise for medical images (eg, MRI data) has not received sufficient attention because of the methods of producing medical images and the substantial differences between medical image noise and natural noise ( 24 , 25 ). A previous tentative study indicated that adversarial training could enhance the robustness and generalizability of models for csPCa, leading to improved diagnostic accuracy across varied testing datasets ( 26 ).…”

RDMAA: Robust Defense Model against Adversarial Attacks in Deep Learning for Cancer Diagnosis

“…Lastly, they demonstrated that the success rate of the attacks isn't influenced by the size of the training set. Allyn et al [27] performed adversarial attacks on dermoscopic imaging. They tested the test set of data set HAM10000 with DenseNet201 after perturbing it.…”

Security and Privacy in Machine Learning for Health Systems: Strategies and Challenges

“…Such papers [38,46,48] investigated attacks to fool the segmentation task using UNet 3 to generate perturbed masks. In the classification task, papers [35] and [41][42][43][44] employed the FGSM attack, [35,41,44] the PGD attack, [39,40] the UAP attack, [37] the One Pixel attack, and [46,48,60] GANs-based attack. As far as DeepFake attacks are concerned, which generate fake data, e.g., inserting a malign tumor into a medical image that is supposed to be benign.…”