Attacking medical images with minimal noise: exploiting vulnerabilities in medical deep-learning systems

A change in the output of deep neural networks (DNNs) via the perturbation of a few pixels of an image is referred to as an adversarial attack, and these perturbed images are known as adversarial samples. This study examined strategies for compromising the integrity of DNNs under stringent conditions, specifically by inducing the misclassification of medical images of disease with minimal pixel modifications.

This study used the following three publicly available datasets: the chest radiograph of emphysema (cxr) dataset, the melanocytic lesion (derm) dataset, and the Kaggle diabetic retinopathy (dr) dataset. To attack the medical images, we proposed a method termed decrease group differential evolution (DGDE) for generating adversarial images. Under this method, a noise matrix of the same size as the input image is first used to attack the image sample several times until the initial adversarial perturbation s0 is obtained. Next, a subset s1 is randomly picked from the initial adversarial perturbation s0 that is still able to cause the samples to be misclassified by the classifier. A new subset s2 is subsequently randomly selected from the adversarial perturbation subset s1, which can still cause the adversarial samples to be misclassified by the classifier. Finally, the adversarial perturbation subset sn with the minimum number of elements is obtained by continuous reduction of the number of perturbed pixels.

In this study, the DGDE method was used to attack the images of the cxr dataset, the derm dataset, and the dr dataset; and the minimum number of pixels required to be considered a successful attack was 11, 7, and 7, respectively, while the maximum number of pixel changes was 55, 35, and 21, respectively. The average number of pixel changes was 30, 18, and 11, respectively, in the cxr dataset, the derm dataset, and the dr dataset, respectively, while the percentages of the average number of pixel changes among the total number of pixels of the image were 0.0598%, 0.0359%, and 0.0219, respectively.

Unlike the traditional differential evolution (DE) method, the proposed DGDE method modifies fewer pixels to generate adversarial samples by introducing a variable population number and a novel crossover and selection strategy. However, the success rate of the initial attack on different image datasets varied greatly. In future studies, we intend to identify the reasons for this phenomenon and improve the success rate of the initial attack.