Robust Detection of Directional Adversarial Attacks in Deep Neural Networks for Radiological Imaging

AI summary

Overview

• Research area: Adversarial machine learning security for medical imaging (computer vision); detection of targeted ("directional") adversarial attacks on deep neural network diagnostic classifiers.
• Technical level: Intermediate. The core idea is conceptually simple, but the paper assumes familiarity with adversarial attacks (FGSM, BIM, PGD, DeepFool), white-box threat models, sigmoid outputs, and detection metrics such as true/false positive rates.
• Scope: The paper proposes and evaluates a training-free, test-time detection framework that adds low-intensity Gaussian noise to an input image and measures how much the model's prediction changes, in order to flag directionally attacked radiological images across chest X-ray, retinal fundus, and brain MRI datasets.

What This Paper Is About

Deep neural networks used to read X-rays, MRIs, and retinal photographs can be fooled by tiny, human-invisible perturbations, and directional attacks are the most dangerous kind because they push a prediction toward a specific wrong class (for example, turning a malignant scan into a "benign" one). The authors ask whether such an image can be reliably detected at test time without retraining the model. Their answer is to "counter-attack" the image with a few percent of random Gaussian noise and compare the model's prediction before and after: clean images barely move, while attacked images snap back toward their true class.

Key Contributions

1. A systematic analysis of directional adversarial attack strategies (FGSM, BIM, PGD, DeepFool) against medical imaging classifiers, including how they affect prediction confidence and model interpretability (heatmaps).
2. A detection framework built on prediction differences across four conditions: clean images, clean images plus random noise, attacked images, and attacked images re-perturbed with random noise.
3. A simple statistical threshold rule, θ = 2·std(t), where t is the distribution of prediction differences between clean and noisy clean images, plus guidance on selecting the noise strength (epsilon) per model and per problem.
4. An evaluation on three public medical datasets (chest X-ray, brain MRI, retinal fundus) with three backbone architectures, comparing the method against a Mahalanobis-distance baseline, and reporting quantitative evidence of attack impact on accuracy and saliency-based interpretation.

Main Findings

• Detection performance: Under the standard threshold θ = 2·std(t), the framework reached an average true positive rate of 94.8% with an average false positive rate of 3.0% across all models, datasets, and attacks (Table 2). The best cell reported was 99.8% true positive with 1.1% false positive (DeepFool, ResNet50V2, Brain MRI), matching the abstract's claim of "up to 99.8%".
• Per-model means (TPR | FPR): ResNet50V2 averaged 99.1 | 2.5 on Chest X-Ray, 97.9 | 2.2 on Brain MRI, and 93.0 | 4.3 on Fundus. InceptionV3 averaged 96.3 | 3.7, 98.1 | 1.8, and 93.7 | 4.4. ViT-B16 averaged 92.2 | 4.0, 94.1 | 2.2, and 89.0 | 2.3.
• Attack strength matters: The detection gap between clean and attacked samples held across attack types, with mean TPR of 93.1% for FGSM, 95.1% for BIM, 95.6% for PGD, and 95.4% for DeepFool at their respective mean false positive rates of 3.5%, 3.1%, 3.1%, and 2.5%.
• Attacks are devastating without detection: PGD and BIM changed the predicted class of 93–100% of images, FGSM flipped 71%, and DeepFool achieved 99% on ResNet50V2- and ViT-B16-based models but only 62.6% on InceptionV3-based models.
• Noise strength depends on the attack: The best universal noise power was 0.03, but the optimum epsilon varied by model and dataset — for example 0.05 for Chest X-Ray across all three backbones, and 0.02–0.03 for the retinal fundus models. DeepFool consistently required a smaller epsilon (0.01) because it seeks the smallest possible perturbation.
• Noise barely hurts clean images but strongly disrupts perturbations: Applying 0.03 Gaussian noise to a clean image gave MSE 0.001, SSIM 0.837, PSNR 30.47 dB; applying the same noise to a 0.01 FGSM perturbation gave MSE 0.225, SSIM 0.137, PSNR 6.47 dB.
• Filtering by confidence improves detection: On the ResNet-based chest X-ray model with a manually chosen threshold, restricting to images where the model's original prediction differed from the correct class by less than 0.2 yielded 98.0% detection of attacked images with 1.8% false positives on clean images; relaxing the criterion to 1.0 gave 86.1% detection with 3.0% false positives (Table 4). The authors state that combining manual thresholding with discarding low-confidence images can detect "as much as 100%" of attacked images.
• Beat the Mahalanobis baseline: The Mahalanobis-distance detector was less accurate for every tested model and produced more false positives.
• Attacks also distort interpretability: Saliency heatmaps shifted focus after an adversarial attack (Fig. 7), and adding noise before the attack still left the model's attention significantly disrupted (Fig. 8).
• Stated limitation: The method is not expected to resist attacks that add entire patches to images, since small noise will not meaningfully alter a patch — though such patches are described as easily visible to humans in radiological images.

Methodology in Plain English

The framework works in four steps.

First, pretrained ResNet50V2, InceptionV3, and ViT-B16 backbones (originally trained on ImageNet) had their classification heads replaced with a sigmoid layer for binary classification; most layers were frozen, then a few final layers were unfrozen for fine-tuning. Reported clean-data performance was strong: accuracy/recall ranged from 0.89 to 0.99 across datasets, with ROC-AUC from 0.95 to 1.00.

Second, only correctly classified test images were kept, and each was attacked (FGSM, BIM, PGD with iteration step 0.001 to 0.01, or DeepFool with up to 50 iterations and 0.02 overshoot), stopping once the predicted class flipped. Images whose prediction did not actually change were discarded.

Third, Gaussian noise (equation 1: η ~ N(0, ε²)) was added at powers swept from 0.01 to 0.05 in steps of 0.01; each noise addition was repeated eight times and the median was taken to avoid outliers that happen to align with a class gradient. The authors tested four image variants — clean, noisy clean, attacked, and noisy attacked — and compared the resulting sigmoid outputs.

Fourth, a threshold on the prediction difference separates attacked from clean images. Two options are offered: a manual, problem-specific threshold, and an automatic statistical one, θ = 2·std(t), motivated by the roughly 95% of normally distributed values falling within two standard deviations. Increasing noise strength and raising the threshold simultaneously increases both detected attacks and false positives, so the authors frame the choice as a trade-off between sensitivity and false alarms.

Why This Matters

Adversarial attacks on medical AI are not hypothetical: the paper cites attack success rates above 90% on medical scans, a brain tumor model whose accuracy dropped from 87% to below 12%, and attacks that can drive accuracy to 0. It also cites nearly 50 million patient records exposed in US healthcare breaches in 2022 and notes that over 90% of healthcare institutions use PACS that often lack modern security features. A missed cancer caused by a manipulated scan is a direct patient-safety failure, so detection is as important as raw accuracy.

Real-world applications:

• A post-hoc verification step in clinical AI pipelines, checking an image and its prediction before a diagnosis reaches a radiologist.
• Independent audit or quality-assurance tooling for hospitals deploying third-party imaging AI, since the method requires no retraining or access to the vendor's training pipeline.
• Security monitoring for PACS/image-transfer infrastructure, where images can be tampered with in transit.
• Cross-modality screening programs — chest X-ray pneumonia, retinal disease screening, and brain tumor triage — where the same noise-and-compare rule applies without modality-specific retraining.

Industry relevance: The approach is training-free and cheap at inference (only noise addition plus two forward passes), which fits the regulatory and operational constraints of medical AI vendors and hospital IT teams better than adversarial training, which is computationally expensive and can degrade clean-data performance. The authors argue the method is hard to circumvent with an adaptive attack because crafting an attack that survives added noise is difficult.

Future Directions

• Harder attack families: The authors acknowledge the method will likely fail against patch-based or localized attacks, and future work would need to address spatially structured manipulations.
• Multi-class problems: The framework is demonstrated on binary tasks; the authors note that on multi-class datasets, adding noise must reliably return the prediction to the original class, which remains to be validated.
• Broader data and tasks: Extending to larger datasets, additional imaging modalities, other task types such as segmentation, and other data types such as audio to establish it as a general-purpose defense.
• Interpretability and clinical validation: Improving explanation techniques so that AI-assisted diagnoses remain trustworthy, and confirming real-world deployment behavior — for example, calibrating epsilon and threshold per model and per clinical priority (low false positives versus high attack recall).

Target Audience

Researchers and practitioners in medical image analysis and trustworthy ML who need a lightweight, deployable defense against white-box adversarial attacks; hospital IT and clinical-informatics teams evaluating the security of imaging AI; and graduate students studying adversarial detection, who will find the prediction-difference formulation, the threshold rule, and the side-by-side Mahalanobis comparison a useful template. Readers seeking a theoretically grounded or provably robust defense, or results on multi-class and patch-based attacks, will find those questions left open.

Authors’ abstract

Deep learning is now central to radiology, helping detect changes on X-rays, CTs, and MRIs. However, these systems are highly vulnerable to adversarial attacks - small, crafted perturbations that mislead models while appearing unchanged to humans. Such errors risk missed cancers or false positives. Studies show over 90% attack success on medical scans. Almost 30% of US hospitals use AI in imaging in 2023. Thus, an effective method of detecting such attacks and their directionality is crucial to ensure the credibility and reliability of medical systems based on DNNs. We propose a novel detection framework that leverages subsequent attacks using random noise to identify adversarial perturbations. Our approach uses the analysis of variations in the Sigmoid function to distinguish genuine medical images from adversarially manipulated ones. Specifically, we compare prediction differences between clean and attacked images, as well as between different adversarially altered versions, to improve detection accuracy. We evaluated our method on three popular medical datasets including 'Chest X-Ray Images for Classification', 'Retinal Fundus Multi-disease Image Dataset' and 'Brain Tumor Dataset' under various attack scenarios, including random noise. Our framework achieved up to 99.8% ACC in identifying adversarial directional attacks, significantly outperforming existing defense mechanisms. It consistently identified adversarial samples across varying attack strengths while keeping false positives low, showing strong reliability and potential for clinical use. Furthermore, our proposal highlights its potential for real-world deployment.