Adversarial Robustness of Medical Image Classifiers via Denoised Smoothing
摘要
Deep neural networks (DNNs) have been shown to be highly susceptible to small changes in input data, making them vulnerable to adversarial attacks. These sensitivities in artificial intelligence (AI) systems can be easily exploited, posing substantial risks to the reliability and safety of DNNs, especially in critical applications like medical imaging. Enhancing adversarial robustness is essential to the secure deployment of DNNs in these sensitive domains. Traditional defense methods often require full access to the target model or re-training with adversarial augmentation data. Yet, medical models are trained on sensitive or domain-specific data, and typically undergo rigorous validation. Modifications to the parameters or architecture could inadvertently disrupt the model’s performance. Recently, Denoised Smoothing (DS) offers a promising defense mechanism by prepending a denoiser neural network to a pre-trained image classifier. The denoiser is trained to remove Gaussian noises from the input data, potentially mitigating adversarial perturbations. The DS-based defense is particularly suitable for medical imaging systems since no alteration to the original classifier is required. In this paper, we experiment with different denoiser training objectives to properly adopt the DS technique for defending brain tumor and cervical cancer classification models. We then evaluate the performance of the models under three widely-used attack methods: Fast Gradient Sign Method (FGSM), Projected Gradient Descent (PGD), and Decoupled Direction and Norm (DDN). Source code is available at: https://github.com/ELO-Lab/AR-MIC-DS .