Skip to main content
medRxiv
  • Home
  • About
  • Submit
  • ALERTS / RSS
Advanced Search

Adversarial Attack Vulnerability of Deep Learning Models for Oncologic Images

View ORCID ProfileMarina Z. Joel, Sachin Umrao, Enoch Chang, Rachel Choi, Daniel Yang, James Duncan, Antonio Omuro, Roy Herbst, View ORCID ProfileHarlan Krumholz, Sanjay Aneja
doi: https://doi.org/10.1101/2021.01.17.21249704
Marina Z. Joel
1Department of Therapeutic Radiology, Yale School of Medicine, New Haven, CT
  • Find this author on Google Scholar
  • Find this author on PubMed
  • Search for this author on this site
  • ORCID record for Marina Z. Joel
Sachin Umrao
1Department of Therapeutic Radiology, Yale School of Medicine, New Haven, CT
  • Find this author on Google Scholar
  • Find this author on PubMed
  • Search for this author on this site
Enoch Chang
2Yale School of Medicine, New Haven, CT
  • Find this author on Google Scholar
  • Find this author on PubMed
  • Search for this author on this site
Rachel Choi
2Yale School of Medicine, New Haven, CT
  • Find this author on Google Scholar
  • Find this author on PubMed
  • Search for this author on this site
Daniel Yang
1Department of Therapeutic Radiology, Yale School of Medicine, New Haven, CT
  • Find this author on Google Scholar
  • Find this author on PubMed
  • Search for this author on this site
James Duncan
3Department of Biomedical Engineering, Yale University, New Haven, CT
  • Find this author on Google Scholar
  • Find this author on PubMed
  • Search for this author on this site
Antonio Omuro
4Yale Brain Tumor Program, New Haven, CT
  • Find this author on Google Scholar
  • Find this author on PubMed
  • Search for this author on this site
Roy Herbst
5Department of Internal Medicine, Yale School of Medicine, New Haven, CT
  • Find this author on Google Scholar
  • Find this author on PubMed
  • Search for this author on this site
Harlan Krumholz
5Department of Internal Medicine, Yale School of Medicine, New Haven, CT
6Center for Outcomes Research and Evaluation, Yale School of Medicine, New Haven, CT
  • Find this author on Google Scholar
  • Find this author on PubMed
  • Search for this author on this site
  • ORCID record for Harlan Krumholz
Sanjay Aneja
1Department of Therapeutic Radiology, Yale School of Medicine, New Haven, CT
6Center for Outcomes Research and Evaluation, Yale School of Medicine, New Haven, CT
  • Find this author on Google Scholar
  • Find this author on PubMed
  • Search for this author on this site
  • For correspondence: sanjay.aneja@yale.edu
  • Abstract
  • Full Text
  • Info/History
  • Metrics
  • Data/Code
  • Preview PDF
Loading

Abstract

Background Deep learning (DL) models have shown promise to automate the classification of medical images used for cancer detection. Unfortunately, recent studies have found that DL models are vulnerable to adversarial attacks, which manipulate images with small pixel-level perturbations designed to cause models to misclassify images. There is a need for better understanding of how adversarial attacks impact the predictive ability of DL models in the medical image domain.

Methods We examined adversarial attacks on DL classification models separately trained on three medical imaging modalities commonly used in oncology: computed tomography (CT), mammography, and magnetic resonance imaging (MRI). We investigated how iterative adversarial training could be employed to increase model robustness against three first-order attack methods.

Results On unmodified images, we achieved classification accuracies of 75.4% for CT, 76.4% accuracy for mammogram, and 93.6% for MRI. Under adversarial attack, model accuracy showed a maximum absolute decrease of 49.8% for CT, 52.9% for mammogram, 87.3% for MRI. Adversarial training caused model accuracy on adversarial images to increase by up to 42.9% for CT, 35.7% for mammogram, and 73.2% for MRI.

Conclusion Our results indicated that DL models for oncologic images are highly sensitive to adversarial attacks, as visually imperceptible degrees of perturbation are sufficient to deceive the model the majority of the time. Adversarial training mitigated the effect of adversarial attacks on model performance but was less successful against stronger attacks. Our findings provide a useful basis for designing more robust and accurate medical DL models as well as techniques to defend models from adversarial attack.

Competing Interest Statement

The authors have declared no competing interest.

Funding Statement

This work was funded in part by a Career Enhancement Program Grant (PI: Aneja) from the Yale SPORE in Lung Cancer (1P50CA196530) and by a Conquer Cancer Career Development Award (PI: Aneja), supported by Hayden Family Foundation. Any opinions, findings, and conclusions expressed in this material are those of the author(s) and do not necessarily reflect those of the American Society of Clinical Oncology or Conquer Cancer, or Hayden Family Foundation.

Author Declarations

I confirm all relevant ethical guidelines have been followed, and any necessary IRB and/or ethics committee approvals have been obtained.

Yes

The details of the IRB/oversight body that provided approval or exemption for the research described are given below:

Research was conducted in accordance with the Declaration of Helsinki guidelines and approved by the Yale University Institutional Review Board (Protocol ID: HIC#2000027592). Informed consent was obtained from all participants in this study.

All necessary patient/participant consent has been obtained and the appropriate institutional forms have been archived.

Yes

I understand that all clinical trials and any other prospective interventional studies must be registered with an ICMJE-approved registry, such as ClinicalTrials.gov. I confirm that any such study reported in the manuscript has been registered and the trial registration ID is provided (note: if posting a prospective study registered retrospectively, please provide a statement in the trial ID field explaining why the study was not registered in advance).

Yes

I have followed all appropriate research reporting guidelines and uploaded the relevant EQUATOR Network research reporting checklist(s) and other pertinent material as supplementary files, if applicable.

Yes

Data Availability

All data is available from the authors upon reasonable request.

Copyright 
The copyright holder for this preprint is the author/funder, who has granted medRxiv a license to display the preprint in perpetuity. It is made available under a CC-BY 4.0 International license.
Back to top
PreviousNext
Posted February 13, 2021.
Download PDF
Data/Code
Email

Thank you for your interest in spreading the word about medRxiv.

NOTE: Your email address is requested solely to identify you as the sender of this article.

Enter multiple addresses on separate lines or separate them with commas.
Adversarial Attack Vulnerability of Deep Learning Models for Oncologic Images
(Your Name) has forwarded a page to you from medRxiv
(Your Name) thought you would like to see this page from the medRxiv website.
CAPTCHA
This question is for testing whether or not you are a human visitor and to prevent automated spam submissions.
Share
Adversarial Attack Vulnerability of Deep Learning Models for Oncologic Images
Marina Z. Joel, Sachin Umrao, Enoch Chang, Rachel Choi, Daniel Yang, James Duncan, Antonio Omuro, Roy Herbst, Harlan Krumholz, Sanjay Aneja
medRxiv 2021.01.17.21249704; doi: https://doi.org/10.1101/2021.01.17.21249704
Digg logo Reddit logo Twitter logo CiteULike logo Facebook logo Google logo Mendeley logo
Citation Tools
Adversarial Attack Vulnerability of Deep Learning Models for Oncologic Images
Marina Z. Joel, Sachin Umrao, Enoch Chang, Rachel Choi, Daniel Yang, James Duncan, Antonio Omuro, Roy Herbst, Harlan Krumholz, Sanjay Aneja
medRxiv 2021.01.17.21249704; doi: https://doi.org/10.1101/2021.01.17.21249704

Citation Manager Formats

  • BibTeX
  • Bookends
  • EasyBib
  • EndNote (tagged)
  • EndNote 8 (xml)
  • Medlars
  • Mendeley
  • Papers
  • RefWorks Tagged
  • Ref Manager
  • RIS
  • Zotero
  • Tweet Widget
  • Facebook Like
  • Google Plus One

Subject Area

  • Radiology and Imaging
Subject Areas
All Articles
  • Addiction Medicine (70)
  • Allergy and Immunology (168)
  • Anesthesia (49)
  • Cardiovascular Medicine (448)
  • Dentistry and Oral Medicine (80)
  • Dermatology (55)
  • Emergency Medicine (157)
  • Endocrinology (including Diabetes Mellitus and Metabolic Disease) (190)
  • Epidemiology (5216)
  • Forensic Medicine (3)
  • Gastroenterology (194)
  • Genetic and Genomic Medicine (750)
  • Geriatric Medicine (77)
  • Health Economics (212)
  • Health Informatics (694)
  • Health Policy (352)
  • Health Systems and Quality Improvement (223)
  • Hematology (98)
  • HIV/AIDS (162)
  • Infectious Diseases (except HIV/AIDS) (5816)
  • Intensive Care and Critical Care Medicine (356)
  • Medical Education (102)
  • Medical Ethics (25)
  • Nephrology (80)
  • Neurology (758)
  • Nursing (43)
  • Nutrition (129)
  • Obstetrics and Gynecology (141)
  • Occupational and Environmental Health (231)
  • Oncology (475)
  • Ophthalmology (149)
  • Orthopedics (38)
  • Otolaryngology (93)
  • Pain Medicine (39)
  • Palliative Medicine (19)
  • Pathology (139)
  • Pediatrics (223)
  • Pharmacology and Therapeutics (136)
  • Primary Care Research (96)
  • Psychiatry and Clinical Psychology (854)
  • Public and Global Health (1993)
  • Radiology and Imaging (344)
  • Rehabilitation Medicine and Physical Therapy (157)
  • Respiratory Medicine (283)
  • Rheumatology (93)
  • Sexual and Reproductive Health (72)
  • Sports Medicine (75)
  • Surgery (108)
  • Toxicology (25)
  • Transplantation (29)
  • Urology (39)