RECORD
The Security of Deep Learning Defences for Medical Imaging
Cryptography and Security · Submitted 21 Jan 2022
abstract compiled · 2026-09-23 · no language-model review
The authors' main claim We show that an informed attacker can evade five of the current state of the art defences while successfully fooling the victim's deep learning model, rendering these defences useless.
The compiled record
The paper's own sentences, arranged. Each label is drawn from a closed vocabulary; the number beside it is the probability the classifier gave that label. Numbers in the tables are the authors', checked by code. No sentence in this record was written by a model.
Open the compiled record
The abstract, sentence by sentence
Deep learning has shown great promise in the domain of medical image analysis. Medical professionals and healthcare providers have been adopting the technology to speed up and enhance their work. These systems use deep neural networks (DNN) which are vulnerable to adversarial samples; images with imperceivable changes that can alter the model's prediction. Researchers have proposed defences which either make a DNN more robust or detect the adversarial samples before they do harm. However, none of these works consider an informed attacker which can adapt to the defence mechanism. We show that an informed attacker can evade five of the current state of the art defences while successfully fooling the victim's deep learning model, rendering these defences useless. We then suggest better alternatives for securing healthcare DNNs from such attacks: (1) harden the system's security and (2) use digital signatures.
background contribution method result interpretation main claim
| # | sentence | role | the authors' own work | states the main conclusion | strength |
|---|---|---|---|---|---|
| s0 | Deep learning has shown great promise in the domain of medical image analysis. | background 1.00 | 0.05 | 0.01 | asserted 0.96 |
| s1 | Medical professionals and healthcare providers have been adopting the technology to speed up and enhance their work. | background 1.00 | 0.03 | 0.01 | asserted 1.00 |
| s2 | These systems use deep neural networks (DNN) which are vulnerable to adversarial samples; images with imperceivable changes that can alter the model's prediction. | background 1.00 | 0.05 | 0.02 | asserted 1.00 |
| s3 | Researchers have proposed defences which either make a DNN more robust or detect the adversarial samples before they do harm. | background 1.00 | 0.04 | 0.02 | asserted 1.00 |
| s4 | However, none of these works consider an informed attacker which can adapt to the defence mechanism. | gap 1.00 | 0.07 | 0.07 | asserted 1.00 |
| s5 | We show that an informed attacker can evade five of the current state of the art defences while successfully fooling the victim's deep learning model, rendering these defences useless. | result 0.97 | 0.95 | 0.88 | asserted 1.00 |
| s6 | We then suggest better alternatives for securing healthcare DNNs from such attacks: (1) harden the system's security and (2) use digital signatures. | future work 0.68 | 0.54 | 0.22 | hedged possibility 0.81 |
What was examined, and what was not
- arXiv listing abstract v1
- full text
- figures and tables
- references and citing sentences
- relations to other papers
- P abstract
- S sections
- T body sentences
- C citations
- R cross-paper relations
The paper
Original abstract
Deep learning has shown great promise in the domain of medical image analysis. Medical professionals and healthcare providers have been adopting the technology to speed up and enhance their work. These systems use deep neural networks (DNN) which are vulnerable to adversarial samples; images with imperceivable changes that can alter the model's prediction. Researchers have proposed defences which either make a DNN more robust or detect the adversarial samples before they do harm. However, none of these works consider an informed attacker which can adapt to the defence mechanism. We show that an informed attacker can evade five of the current state of the art defences while successfully fooling the victim's deep learning model, rendering these defences useless. We then suggest better alternatives for securing healthcare DNNs from such attacks: (1) harden the system's security and (2) use digital signatures.
Human review
How the literature uses it
3 arXiv papers cite this in 3 sentences
Papers citing it · 2 sentences without a confident label
Cites it as support 1 paper
-
According to several studies on the motivations for conducting medical adversarial attacks [ref] , we consider the financial gain can be the biggest incentive to attack healthcare systems, as health insurance frauds have grown on a large scale over the years [ref] .
Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challenges · Taxonomy of Adversarial Attacks · 0.98
What it cites · 6 sentences without a confident label
Uses the method or tool of 1 paper
-
We used a one step attack (FGSM [ref] ) since it was able to fool the entire ensemble while being the simplest.
Explaining and Harnessing Adversarial Examples · Ensemble Method · 1.00
Cites as background 2 papers
-
The attacker who crafts $x'$ can perform a targeted attack (choose which label or mask should be predicted) [ref] or an untargeted attack (cause a general misclassification) [ref] .
Explaining and Harnessing Adversarial Examples · Adversarial Samples · 0.97
-
The attacker who crafts $x'$ can perform a targeted attack (choose which label or mask should be predicted) [ref] or an untargeted attack (cause a general misclassification) [ref] .
Adversarial Machine Learning at Scale · Adversarial Samples · 0.97
Discussion
Know something about this paper? Leave a comment, or highlight any passage above to comment on it.