REVIEW 3 major objections 5 minor 26 references
Robustifying deep networks for image segmentation
T0 review · 3 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash
Pith's one-line read Visually subtle, gradient-based perturbations reduce brain-tumor segmentation Dice coefficients by up to 65%, and defensive distillation restores some robustness, though never to clean-image performance.
desk verdict Useful empirical baseline for adversarial attacks on 3D medical segmentation, but the abstract overclaims the distillation-vs-adversarial-training comparison. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing object is the gradient of a Dice-based loss through the 3D U-Net: the attack takes one or several steps along $\operatorname{sign}(\nabla_x \mathrm{DiceLoss})$, bounded by $\varepsilon$ per pixel, and thereby turns an imperceptible input change into a large mis-segmentation. Iterative versions repeat small steps ($\alpha=0.005$, ten iterations), and the targeted version steers all output labels toward a chosen incorrect label map. On the defense side, the carrier is temperature-scaled softmax in distillation, where a student network is trained on soft label volumes produced by a teacher at temperature $T$, smoothing the input–output map; adversarial training instead minimizes a loss that mixes clean and FGSM-perturbed examples. Robustness is quantified by the Dice overlap coefficient and tested with Wilcoxon signed-rank tests.
What would settle it
Evaluate the same undefended and defended 3D U-Nets under an attack family not used in training—for example, projected gradient descent with random restarts or black-box perturbations transferred from an independently trained model at the same $\varepsilon$ budget—and compare Dice coefficients. If the attack no longer produces Dice reductions in the reported 26–65% range, or if adversarial training matches or beats distillation under that attack, the paper's vulnerability estimates and defense ranking would not generalise beyond FGSM-family attacks.
Extended reading notes
Core claim
The central discovery is that the Fast Gradient Sign Method and its iterative variants can be ported from classification to voxel-wise segmentation by replacing the usual cross-entropy objective with a Dice-coefficient-based loss, and in that form they reliably degrade a 3D U-Net's tumor segmentations. The paper reports Dice reductions of 30.5%, 58.3%, and 43.8% for tumor core; 44.6%, 65.6%, and 45.4% for enhancing tumor; and 26.7%, 47.5%, and 35.0% for whole tumor under FGSM, i-FGSM, and ti-FGSM, respectively, with all differences statistically significant after multiple-comparison correction despite nearly unchanged image appearance. For defenses, distillation with temperature $T=5000$ gives the best robustness, improving Dice by 0.14–0.22 over the undefended model at the strongest attack, and it outperforms both FGSM-based adversarial training and uniform-noise data augmentation. The authors also find that none of the defenses restores performance to the unperturbed level.
Load-bearing premise
The load-bearing premise is that robustness measured against the same kind of gradient-based attacks used to train the adversarial models is a fair stand-in for robustness against adversarial perturbations in general; if a different attack family or transferred perturbations were used, the defense ranking could change.
Editorial extensions
If this is right
- A segmentation model can be made to label normal tissue as tumor, or to miss tumor regions, by input changes that a radiologist would not notice, so deployment of such models should include adversarial stress testing.
- High-temperature defensive distillation is a practical partial defense: it requires no attack generation during training, only retraining on soft labels, and its robustness increases with $T$ until saturation.
- Adversarial training improves robustness for FGSM-style perturbations, but its behavior depends heavily on the chosen perturbation radius, and a radius that is too large can make training diverge.
- Random-noise data augmentation protects least among the tested defenses, indicating that generic augmentation is not a substitute for attack-aware training.
- Even the best defense leaves a substantial gap to clean-image accuracy, so 'robust' here means less degraded, not undegraded.
Reading between the lines
- Because the adversarial models were trained and evaluated on the same FGSM family, the reported superiority of distillation may be specific to that threat model; testing against transferred black-box perturbations or multiple random restarts of an iterative attack would be a fairer head-to-head.
- The temperature-smoothing mechanism suggests a measurable proxy for robustness: networks with smaller local Lipschitz constants near medical images should be harder to fool, and computing those constants on this dataset would give a direct, attack-independent check.
- The same machinery could be pointed at targeted erasure, for example driving all tumor labels to background rather than to the paper's target label; if that succeeds, it would demonstrate an even more dangerous clinical failure mode.
- If the vulnerability is as broad as reported, the natural standard for clinical imaging tools is not just average Dice on clean data but worst-case Dice over a perturbation ball; the paper's numbers provide a benchmark for that worst-case evaluation.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. This paper reports an empirical study of adversarial robustness for a 3D U-Net applied to BraTS 2017 brain tumor segmentation. The authors implement first-order attacks based on FGSM, iterative FGSM (i-FGSM), and targeted iterative FGSM (ti-FGSM), using a Dice-based loss, and evaluate defensive distillation and adversarial training as countermeasures. They report that FGSM-family attacks significantly reduce Dice coefficients by up to about 65%, that distillation outperforms adversarial training, and that all defended models remain worse on attacked inputs than on unperturbed inputs. Robustness is quantified with Dice coefficient, PSNR, SSIM, and RMSE, with Wilcoxon signed-rank tests and Bonferroni correction.
Significance. The attack-vulnerability results, if they hold, are potentially significant for the medical-imaging community, since they demonstrate that a standard segmentation network can be degraded by small L-infinity perturbations. The paper is also useful as an empirical benchmark on a public dataset. However, the paper's second headline claim, that distillation performs significantly better than adversarial training, is not backed by any direct statistical test, and the 'visually subtle' characterization is in tension with SSIM values as low as 0.47. The defense evaluation is also confined to the FGSM attack family used to train the adversarial networks. These issues reduce the defensibility of the conclusions but are addressable with additional analysis and revised claims.
major comments (3)
- [Abstract; Results, 'Distillation vs. adversarial training'] The abstract's sentence 'For attack defenses, distillation performed significantly better than adversarial training approaches' is not supported by the reported statistics. In Table 2, every p-value in the 'Dice Coefficient Difference' columns tests a defense against the no-defense row within the same epsilon; there is no paired Wilcoxon test comparing distillation with adversarial training. At epsilon=0.1, Whole Tumor Dice is 0.758±0.182 for Distillation T=5000 versus 0.765±0.143 for Adversarial Training-0.1, so the numerical order is not even uniform, and for Tumor Core the gap (0.640±0.247 vs 0.588±0.241) is within one standard deviation. The paper cannot claim statistical significance for the superiority of distillation on the evidence presented. The authors should either add direct pairwise significance tests across defenses, with appropriate multiple-comparison correction, or revise the abstract and Results to describe the observed ordering qualitatively.
- [Table 1; Results, 'Adversarial attacks'] The characterization of the perturbations as 'visually subtle' or 'visually minor' conflicts with the image-quality metrics in Table 1. The SSIM of i-FGSM is 0.470, FGSM SSIM is 0.646, and RMSE values are 0.040–0.041; for a normalized image, an SSIM below 0.5 indicates a substantial structural change, not a subtle one. Since the paper includes no human-perception experiment, 'visually subtle' should be replaced with a quantitative description of the perturbation, such as the L-infinity bound epsilon, and the discrepancy between the PSNR/SSIM values and perceptual subtlety should be explicitly discussed.
- [Discussion; Supplemental Materials, 'Details for Adversarial Training'] The defense comparison is a white-box evaluation within the FGSM family, and the adversarially trained models are explicitly trained on FGSM-generated adversarial examples. Table 2's ranking of defenses may therefore reflect, in part, the models' exposure to the exact attack distribution used at test time, rather than a general robustifying effect. The authors acknowledge in the Discussion that they plan to evaluate black-box and transferred attacks, but the title and abstract present the defense conclusions without this qualification. The Conclusions should restrict the claims to one-step FGSM-style white-box attacks, or the authors should add at least one out-of-family attack (e.g., DeepFool or C&W) to support a broader robustness claim.
minor comments (5)
- [Table 2 caption] The caption says the table lists 'the Dice coefficient of label 4 (Enhancing Tumor),' but the table reports Whole Tumor and Tumor Core as well as Enhancing Tumor. Please update the caption to match the table contents.
- [Materials and Methods] Several mathematical variables are missing from the rendered text, for example 'For , we chose 5%' and 'such that 5% of the maximum pixel magnitude' in the attack section, and 'we used fixed values of .' in Measuring Robustness. Please ensure the compiled PDF displays epsilon and alpha definitions in all equations.
- [Figures 3-5] The figures label the attack magnitude as 'e' instead of the epsilon symbol used in the text. Please use consistent notation across text and figures.
- [References] Reference [14] (Carlini and Wagner) appears in the reference list but is never cited in the body of the manuscript. Either cite it in the Discussion of other attack methods or remove it.
- [Table 2] In the epsilon=0 columns, p-values are reported for each defense but the No Defense row has dashes for all comparison columns. It is unclear what null hypothesis these p-values test; the table caption should state explicitly that these are comparisons against the No Defense condition at the same epsilon.
Circularity Check
No circularity: the paper is an empirical benchmark using standard attacks and defenses, with no fitted parameter renamed as a prediction and no load-bearing self-citation.
full rationale
This manuscript does not contain a derivation chain in which an output is equivalent to an input by construction. The attacks are standard FGSM, i-FGSM, and ti-FGSM adapted to segmentation by replacing cross-entropy with the Dice loss, and the defenses are standard adversarial training and defensive distillation. The reported outcomes are measured Dice coefficients on held-out test images after applying perturbations; they are empirical results, not quantities forced by the definitions. No parameter is fitted to a subset of the data and then relabeled as a prediction: adversarial training is trained on FGSM-based examples and evaluated on FGSM-family attacks, but the measured robustness values are not mathematically guaranteed by the training objective and could have differed, so this is a methodological limitation about attack generalization rather than circularity. The paper does not rely on a self-citation chain or a uniqueness theorem from the authors' own prior work; the cited literature on FGSM and distillation is external and not used to forbid alternative interpretations. The skeptical concern that the abstract's 'distillation performed significantly better than adversarial training' is not supported by direct pairwise statistics in Table 2 is a statistical-evidence and correctness issue, not a circularity issue, because the conclusion does not reduce to its inputs by construction. No circular step can be quoted and exhibited, so the circularity score is 0.
Assumptions & free parameters
free parameters (4)
- attack epsilon =
0.05 for FGSM; 0.005 with 10 steps for i-FGSM; 0.001 increments from 0 to 0.01 for defense evaluation
- distillation temperature T =
20, 100, 500, 5000
- adversarial training epsilon =
0.01, 0.05, 0.1
- adversarial training mix weight alpha =
0.5
assumptions (4)
- domain assumption Gradient-based FGSM perturbations with L-infinity bound approximate worst-case adversarial perturbations in a locally linear region.
- domain assumption BraTS expert manual segmentations are ground truth for Dice evaluation.
- domain assumption The Wilcoxon signed-rank test is valid for paired Dice scores across subjects.
- domain assumption Perturbations with epsilon up to 5% of maximum pixel intensity are visually subtle.
Cite this review
Pith. "Pith review of Robustifying deep networks for image segmentation." pith.science (2026). https://pith.science/paper/OEDEAH3I
@misc{pith2026190800656,
author = {Pith},
title = {Pith review of: Robustifying deep networks for image segmentation},
year = {2026},
howpublished = {\url{https://pith.science/paper/OEDEAH3I}},
note = {Machine review of arXiv:1908.00656}
}
read the original abstract
Purpose: The purpose of this study is to investigate the robustness of a commonly-used convolutional neural network for image segmentation with respect to visually-subtle adversarial perturbations, and suggest new methods to make these networks more robust to such perturbations. Materials and Methods: In this retrospective study, the accuracy of brain tumor segmentation was studied in subjects with low- and high-grade gliomas. A three-dimensional UNet model was implemented to segment four different MR series (T1-weighted, post-contrast T1-weighted, T2- weighted, and T2-weighted FLAIR) into four pixelwise labels (Gd-enhancing tumor, peritumoral edema, necrotic and non-enhancing tumor, and background). We developed attack strategies based on the Fast Gradient Sign Method (FGSM), iterative FGSM (i-FGSM), and targeted iterative FGSM (ti-FGSM) to produce effective attacks. Additionally, we explored the effectiveness of distillation and adversarial training via data augmentation to counteract adversarial attacks. Robustness was measured by comparing the Dice coefficient for each attack method using Wilcoxon signed-rank tests. Results: Attacks based on FGSM, i-FGSM, and ti-FGSM were effective in significantly reducing the quality of image segmentation with reductions in Dice coefficient by up to 65%. For attack defenses, distillation performed significantly better than adversarial training approaches. However, all defense approaches performed worse compared to unperturbed test images. Conclusion: Segmentation networks can be adversely affected by targeted attacks that introduce visually minor (and potentially undetectable) modifications to existing images. With an increasing interest in applying deep learning techniques to medical imaging data, it is important to quantify the ramifications of adversarial inputs (either intentional or unintentional).
Figures
Reference graph
Works this paper leans on
-
[1]
Machine Learning in Medical Imaging
Wernick MN, Yang Y, Brankov JG, Yourganov G, Strother SC. Machine Learning in Medical Imaging. IEEE Signal Process Mag. 2010;27(4):25–38
work page 2010
-
[2]
Machine Learning and Radiology
Wang S, Summers RM. Machine Learning and Radiology. Med Image Anal. 2012;16(5):933–51
work page 2012
-
[3]
Machine learning approaches in medical image analysis: From detection to diagnosis
de Bruijne M. Machine learning approaches in medical image analysis: From detection to diagnosis. Medical Image Analysis [Internet]. 2016;33:94–7. Available from: http://dx.doi.org/10.1016/j.media.2016.06.032
-
[5]
The Mythos of Model Interpretability
Lipton ZC. The Mythos of Model Interpretability. 2016;(Whi). Available from: http://arxiv.org/abs/1606.03490
arXiv 2016
-
[6]
Methods for interpreting and understanding deep neural networks
Montavon G, Samek W, Müller KR. Methods for interpreting and understanding deep neural networks. Digit Signal Process A Rev J [Internet]. 2018;73:1–15. Available from: https://doi.org/10.1016/j.dsp.2017.10.011
-
[7]
Goodfellow, I. J.; Shlens, J. & Szegedy, C. (2014), 'Explaining and Harnessing Adversarial Ex-amples.', CoRR abs/1412.6572
arXiv 2014
-
[8]
Kurakin, A.; Goodfellow, I. J. & Bengio, S. (2017), Adversarial machine learning at scale. In ICLR, 2017b
work page 2017
-
[9]
can increase the robustness of neural networks when applied to classification tasks for standard computer vision datasets such as MNIST and ImageNet [16]. In this paper, we will show that these methods are also effective for medical imaging segmentation. Both of our defense strategies, based on adversarial training and defensive distillation, show signifi...
work page 2017
Show all 26 references
-
[10]
Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks,
N. Papernot, P. McDaniel, X. Wu, S. Jha and A. Swami, "Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks," 2016 IEEE Symposium on Security and Privacy (SP), San Jose, CA, 2016, pp. 582-597
2016
-
[11]
3D U-Net: learning dense volumetric segmentation from sparse annotation,
Cicek, A. Abdulkadir, S. Lienkamp, T. Brox, and O. Ronneberger, “3D U-Net: learning dense volumetric segmentation from sparse annotation,” 2016 Medical Image Computing and Computer-Assisted Intervention (MICCAI), Springer, LNCS, Vol.9901, 424--432, Oct
2016
-
[12]
Multimodal Brain Tumor Segmentation Challenge 2017: https://www.med.upenn.edu/sbia/brats2017/data.html
2017
-
[13]
Moosavi-Dezfooli, S., Fawzi, A., & Frossard, P. (2016). DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks. 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2574-2582
2016
-
[14]
Papernot, N., McDaniel, P.D., Jha, S., Fredrikson, M., Celik, Z.B., & Swami, A. (2016). The Limitations of Deep Learning in Adversarial Settings. 2016 IEEE European Symposium on Security and Privacy (EuroS&P), 372-387
2016
-
[15]
Carlini, N., & Wagner, D.A. (2017). Towards Evaluating the Robustness of Neural Networks. 2017 IEEE Symposium on Security and Privacy (SP), 39-57
2017
-
[16]
Xie, C., Wang, J., Zhang, Z., Zhou, Y., Xie, L., & Yuille, A. (2017). Adversarial Examples for Semantic Segmentation and Object Detection. 2017 IEEE International Conference on Computer Vision (ICCV)
2017
-
[17]
The Multimodal Brain Tumor Image Segmentation Benchmark (BRATS)
Menze BH, Jakab A, Bauer S, Kalpathy-Cramer J, Farahani K, Kirby J, Burren Y, Porz N, Slotboom J, Wiest R, Lanczi L, Gerstner E, Weber MA, Arbel T, Avants BB, Ayache N, Buendia P, Collins DL, Cordier N, Corso JJ, Criminisi A, Das T, Delingette H, Demiralp Γ, Durst CR, Dojat M,...
2015
-
[18]
Advancing The Cancer Genome Atlas glioma MRI collections with expert segmentation labels and radiomic features
Bakas S, Akbari H, Sotiras A, Bilello M, Rozycki M, Kirby JS, Freymann JB, Farahani K, Davatzikos C. "Advancing The Cancer Genome Atlas glioma MRI collections with expert segmentation labels and radiomic features", Nature Scientific Data, 4:170117 (2017) DOI: 10.1038/sdata.2017.117
2017 doi
-
[20]
DOI: 10.7937/K9/TCIA.2017.GJQ7R0EF
2017 doi
-
[22]
(2017), ‘Towards Deep Learning Models Resistant to Adversarial Attacks’
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A. (2017), ‘Towards Deep Learning Models Resistant to Adversarial Attacks’. arXiv preprint arXiv:1706.06083,
2017 arXiv
-
[23]
arXiv preprint arXiv:1707.06728
Efficient Defenses Against Adversarial Attacks. arXiv preprint arXiv:1707.06728
-
[26]
efficient defenses against adversarial attacks
Carlini, N. and Wagner, D. Magnet and “efficient defenses against adversarial attacks” are not robust to adversarial examples. arXiv preprint arXiv:1711.08478, 2017b
-
[27]
Logan, T
E. Logan, T. Brandon, T. Dimitris, S. Ludwig, M. Aleksander. A Rotation and a Translation Suffice: Fooling CNNs with Simple Transformations. arXiv preprint arXiv:1712.02779,
-
[29]
Tustison, B.B
N.J. Tustison, B.B. Avants, P.A. Cook, Y. Zheng, A. Egan, P.A. Yushkevich, et al. N4ITK: improved N3 bias correction IEEE Trans Med Imaging, 29 (6) (2010), pp. 1310-1320 Attack Type Dice Coef -tumor core Dice Coef -enhancing tumor Dice Coef - whole tumor Input PSNR Input SSIM ...
2010
-
[2016]
arxiv.org/abs/1512.03385
-
[2017]
DOI: 10.7937/K9/TCIA.2017.KLXWJJ1Q
2017 doi
-
[2018]
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey.arXiv preprint arXiv:1801.00553 (2018)
2018 arXiv
Reviewed August 14, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.