Adversarial training and deep k-nearest neighbors improves adversarial defense of glaucoma severity detection

Glaucoma is an eye disease that can cause irreversible blindness to people if not treated properly. Although deep learning models have shown that they can provide good results in identifying diseases from medical imagery, they suffer from the vulnerability of adversarial attacks, making them perform poorly. Several techniques can be applied to improve defense against such attacks. One of which is adversarial training (AT) which trains a deep learning model using the input's gradient used to generate noises to the input image and Deep k-Nearest Neighbor (DkNN) that enforces prediction's conformity based on nearest neighbor voting on each layer's representation. This work tries to improve the defense against adversarial attacks by combining AT and DkNN. The evaluation performed on several adversarial attacks show that given an optimum k, the combination of these two methods is able to improve most models' overall classification result on the perturbed retinal fundus image.