Pith. sign in

REVIEW 4 major objections 5 minor 66 references

Prompt2Perturb (P2P): Text-Guided Diffusion-Based Adversarial Attacks on Breast Ultrasound Images

T0 review · 4 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Text-guided diffusion fools breast ultrasound classifiers with subtle edits.

desk verdict The method is plausible and the qualitative results look good, but the headline FID/LPIPS advantage is probably a selection artifact, so the paper needs major evaluation fixes before the main claim can be trusted. read the letter →

arxiv 2412.09910 v1 pith:M2R4IMH4 submitted 2024-12-13 cs.CV

Yasamin Medghalchi , Moein Heidari , Clayton Allard , Leonid Sigal , Ilker Hacihaliloglu This is my paper · ORCID
classification cs.CV
keywords adversarialattacksbreastultrasounddiffusionmodelspromptlearningtextembeddingoptimizationmedicalimagingsecurityperceptualsimilaritytransfer
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that adversarial breast ultrasound images can be made by optimizing text embeddings inside a frozen text-to-image diffusion model, with no retraining and no need for a domain-specific diffusion model. The resulting Prompt2Perturb (P2P) attacks reportedly match the attack success rate of the diffusion-based Diff-PGD baseline while producing markedly lower LPIPS and FID scores across three breast ultrasound datasets and three classifier architectures. The authors argue that this makes P2P a practical way to stress-test medical classifiers in data-scarce settings, where training or fine-tuning a diffusion model on ultrasound images is often infeasible.

What carries the argument

The central object is a set of learnable text embeddings in the CLIP text encoder of Stable Diffusion v1.4, optimized by backpropagating a combined loss: cross-entropy against the true label to fool the classifier, plus MSE between the added noise and the predicted noise to preserve semantic content. Only the first 50 reverse-diffusion steps are optimized, based on the observation that early denoising steps shape low-frequency structure, so perturbations introduced there are hidden in realistic tissue texture. The diffusion U-Net and the autoencoder remain frozen throughout.

What would settle it

Measure the autoencoder reconstruction error on breast ultrasound images: encode each image, decode immediately, and compute LPIPS/SSIM against the original. If typical ultrasound images are reconstructed poorly, P2P's semantic-preservation claim is unsupported. A second check: replace the frozen natural-image diffusion model with one fine-tuned on ultrasound; if P2P's perceptual gains disappear, the result depends on domain mismatch rather than on the prompt-embedding mechanism.

Watch

Extended reading notes

Core claim

The central claim is that adversarial breast ultrasound images can be generated by updating only the text embeddings that condition a pretrained latent diffusion model, instead of adding pixel-level noise or retraining the generator. On the BUSI, BUS-BRA, and UDIAT datasets, P2P reports attack success rates comparable to Diff-PGD (e.g., 0.97 for ResNet34 on BUSI) while beating FGSM, PGD, and Diff-PGD on LPIPS and FID (e.g., LPIPS 0.12 and FID 43.03 for ResNet34 on BUSI). The paper further claims that optimizing only the early reverse-diffusion steps keeps attack quality while improving efficiency, and that adding an MSE noise-prediction term visibly suppresses streak artifacts and preserves tissue texture.

Load-bearing premise

The method assumes that a diffusion model trained on everyday photos can faithfully represent breast ultrasound images, so that editing its text prompts changes the image without destroying the clinical content; the paper does not directly test that reconstruction fidelity.

Editorial extensions

If this is right

  • P2P can launch an attack without a domain-specific diffusion model or a large medical training set, since only text embeddings are learned.
  • Across BUSI, BUS-BRA, and UDIAT, P2P matches Diff-PGD's success rate on DenseNet121 and ResNet34 while producing lower LPIPS and FID, meaning the attacked images should be harder to distinguish from clean ultrasound images.
  • Optimizing only the first 50 reverse-diffusion steps keeps success near the full-horizon setting while cutting generation time per image from roughly 280 to 178 seconds on the reported hardware.
  • The MSE noise-prediction term does not change headline metrics much but visibly reduces streak-like artifacts and preserves tissue homogeneity, supporting its role as a semantic-preservation regularizer.
  • The t-SNE analysis shows P2P's attacked features interleave with clean features more than FGSM, PGD, or Diff-PGD, which the paper interprets as evidence that the adversarial examples are harder to detect at the feature level.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: if P2P's perceptual gains survive a human-observer study, it would provide a stronger stress test for ultrasound computer-aided diagnosis than norm-bounded attacks, because the attacked images would lie on the manifold of plausible ultrasound textures.
  • Editorial inference: a direct comparison against a diffusion model fine-tuned on ultrasound would separate the contribution of prompt-embedding optimization from the domain gap of the frozen backbone; the paper does not run that comparison.
  • Editorial inference: because the attack manipulates text embeddings rather than pixels, the same recipe may transfer to other text-conditioned generators or other imaging modalities without retraining, though the paper does not test this.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper introduces Prompt2Perturb (P2P), a text-guided diffusion-based adversarial attack for breast ultrasound images. Instead of adding fixed-norm perturbations or fine-tuning a diffusion model, P2P optimizes text embeddings in a frozen Stable Diffusion v1.4 text encoder, using only the first 50 reverse-diffusion steps (t ≤ 50) and a loss that combines a cross-entropy term (with a -1e10 multiplier) and an MSE term on the predicted noise. Experiments compare P2P against FGSM, PGD, and Diff-PGD on three breast ultrasound datasets (BUSI, BUS-BRA, UDIAT) using ResNet34, SqueezeNet1.1, and DenseNet121, reporting success rate, LPIPS, SSIM, and FID. The abstract claims that P2P outperforms state-of-the-art attacks across all three datasets in FID and LPIPS.

Significance. If validated, the proposal is interesting because it avoids retraining a domain-specific diffusion model, which is important for data-scarce medical domains. The evaluation is externally grounded: three public datasets and three classifier architectures, with an ablation study on the loss and step-range choices. The paper also provides qualitative visualizations and t-SNE plots. However, the headline quantitative claim about FID and LPIPS superiority is currently not substantiated because the evaluation protocol appears confounded by candidate selection and by computing perceptual metrics only on the per-method subsets of successful attacks.

major comments (4)
  1. [§3.2, Algorithm 1] The final-image selection procedure is underspecified and can invalidate the comparison. The text states that "the image that shows the highest similarity to the original input is selected as the adversarial output," but Algorithm 1 returns xadv inside the iteration loop and does not state how many candidates are considered, which similarity measure is used, or how the selected image relates to the loop iterations. If any form of best-of-K selection over iterations, seeds, or checkpoints is performed, then LPIPS, SSIM, and FID comparisons in Tables 1–3 are not apples-to-apples with FGSM, PGD, and Diff-PGD, which emit a single deterministic output per input. Since the abstract's headline is precisely the FID/LPIPS improvement, this selection rule must be fully specified, and the baselines must be given the same selection allowance or P2P must be evaluated without such selection.
  2. [Tables 1–3, §4.2] All perceptual metrics are computed only on "successful attack examples," and success rates differ substantially across methods (e.g., Diff-PGD 1.0 vs P2P 0.86 for DenseNet121 on UDIAT; Diff-PGD 0.75 vs P2P 0.74 for SqueezeNet1.1 on BUS-BRA). This means each method is scored on a different subset of images, and the reported FID/LPIPS advantage may reflect selection of easier examples rather than intrinsic perceptual quality. The paper also reports no error bars or standard deviations for any table. The authors should either compute FID/LPIPS on a fixed common subset (e.g., the intersection of images successfully attacked by all methods) or report variance and per-class sample counts; otherwise the central claim of superiority is not statistically supported.
  3. [Algorithm 1, §3.2] The loss definition is problematic as written. Algorithm 1 sets Loss ← −1010 × CrossEntropyLoss(˜y, y) + mse(ϵ, ϵθ(zt, C)). The -1e10 multiplier is unexplained and appears to be a hand-tuned free parameter; no sensitivity analysis or justification is provided. Additionally, the MSE term calls ϵθ(zt, C) without the timestep argument t, which is inconsistent with the LDM objective defined in §3.2 (where the network is ϵθ(zt, t, cθ(p))). The authors should clarify the exact loss, the role of the multiplier, and why the resulting optimization does not produce numerical instability or trivial solutions.
  4. [§3.2 'Minimal reversal steps' vs Algorithm 1] There is a direct contradiction between the methodological description and the implementation regarding which diffusion timesteps are optimized. The text says "Optimizing only the early timesteps of denoising process (akin to later timesteps of diffusion process)" and justifies this by low-frequency structure, but Algorithm 1 samples t ← randint(0, 50), which are early diffusion timesteps with low noise (close to the clean image), i.e., the late stages of the reverse process. This inconsistency undermines the stated rationale for the choice t ≤ 50 and the ablation study in Table 4, which varies T=20, T=50, T=100. The authors must reconcile the text with the algorithm and clarify whether they are optimizing high-noise or low-noise steps.
minor comments (5)
  1. [§3.2] Typo: "approch" should be "approach."
  2. [References] Reference [13] contains the placeholder "Accessed: [Insert Date of Access]" and should be completed.
  3. [Algorithm 1] The indentation and control flow are ambiguous: the 'return xadv' appears inside the batch loop and inside the iteration loop, so it is unclear when the function actually terminates and how the 'highest similarity' selection is implemented.
  4. [§3.2] The factual claim that the word "benign" is not present in the Stable Diffusion text encoder vocabulary is surprising and is given without any citation or verification; please provide evidence or remove the claim.
  5. [§4.1] The hyperparameter settings for Diff-PGD are only described as "the same setting as it used for ImageNet," without specifying the number of steps, step size, or noise schedule used in this paper; this hampers reproducibility.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: P2P is evaluated against external classifiers, datasets, and baselines, and its design choices are validated by ablation.

full rationale

The derivation chain is self-contained. P2P optimizes text embeddings with a standard white-box attack objective: cross-entropy on the target classifier plus an MSE noise-prediction term, then decodes the adversarial image. Success rate, LPIPS, SSIM, and FID are measured on held-out validation images from three public datasets (BUSI, BUS-BRA, UDIAT) against three external classifiers (ResNet34, SqueezeNet, DenseNet121) and standard baselines (FGSM, PGD, Diff-PGD). No fitted constant is renamed as a prediction, and no reported metric is an input to the optimization except through the generic classifier gradient and the MSE regularizer. The early-timestep strategy is motivated by prior work [41] with an overlapping author, but the paper independently ablates T=20, T=50, and T=100 in Table 4, so the self-citation is not load-bearing. Other self-citations ([3], [31]) are contextual and do not support the central claim. The only notable evaluation concern is the unspecified 'highest similarity' candidate-selection step in Section 3.2, which could confound LPIPS/FID comparisons if it acted as best-of-K selection; however, the paper does not define that similarity metric as equivalent to the reported metrics, so this is a potential evaluation artifact rather than a demonstrated circular reduction.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The method rests on the pretrained Stable Diffusion v1.4 model and on the assumption that its latent space and text-embedding geometry can represent ultrasound images and clinically meaningful perturbations. The prompt template and its length are unspecified free parameters. No new physical or mathematical entities are introduced.

free parameters (4)
  • Initial text prompt template
    The paper never states the starting prompt or the number of optimized tokens L; the final attack depends on this choice.
  • Cross-entropy loss multiplier = -1e10
    Algorithm 1 uses -1e10 * CE + MSE; this extreme weighting makes the MSE term negligible and is chosen by hand without sensitivity analysis.
  • Reverse diffusion step cap T = 50
    Chosen from ablation experiments (T=20 lowers success, T=100 increases time); it is a fitted hyperparameter, not derived from theory.
  • Optimization iterations and learning rate = 500, 5e-4
    Standard hyperparameters reported, but no sensitivity analysis is provided.
assumptions (4)
  • domain assumption Stable Diffusion v1.4, pretrained on natural images, can encode breast ultrasound images with sufficient fidelity that optimizing its text embeddings produces clinically plausible adversarial edits.
    The entire method relies on the VAE and text encoder spanning the ultrasound domain; no reconstruction fidelity or domain-shift analysis is provided (Section 3.2).
  • domain assumption One-step denoising (the tilde-z reconstruction in Algorithm 1) approximates the full reverse process well enough to serve as the attack generator.
    Algorithm 1 reconstructs the adversarial image via a single-step DDIM-style denoise at t<=50; the paper does not validate this against multi-step sampling.
  • ad hoc to paper Optimizing only the earliest reverse steps (t<=50) captures the low-frequency structure needed for a successful semantic attack without introducing artifacts.
    The paper cites related work on prompt conditioning sensitivity but provides no formal argument; the step cap is an empirical choice made after ablation.
  • domain assumption Classifier gradients can propagate through the frozen diffusion model into text embeddings and still produce meaningful changes in the generated image.
    Backpropagation through the large frozen U-Net is assumed to yield useful gradients; no analysis of gradient quality or conditioning is given.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Prompt2Perturb (P2P): Text-Guided Diffusion-Based Adversarial Attacks on Breast Ultrasound Images." pith.science (2026). https://pith.science/paper/M2R4IMH4

@misc{pith2026241209910,
  author       = {Pith},
  title        = {Pith review of: Prompt2Perturb (P2P): Text-Guided Diffusion-Based Adversarial Attacks on Breast Ultrasound Images},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/M2R4IMH4}},
  note         = {Machine review of arXiv:2412.09910}
}
read the original abstract

Deep neural networks (DNNs) offer significant promise for improving breast cancer diagnosis in medical imaging. However, these models are highly susceptible to adversarial attacks--small, imperceptible changes that can mislead classifiers--raising critical concerns about their reliability and security. Traditional attacks rely on fixed-norm perturbations, misaligning with human perception. In contrast, diffusion-based attacks require pre-trained models, demanding substantial data when these models are unavailable, limiting practical use in data-scarce scenarios. In medical imaging, however, this is often unfeasible due to the limited availability of datasets. Building on recent advancements in learnable prompts, we propose Prompt2Perturb (P2P), a novel language-guided attack method capable of generating meaningful attack examples driven by text instructions. During the prompt learning phase, our approach leverages learnable prompts within the text encoder to create subtle, yet impactful, perturbations that remain imperceptible while guiding the model towards targeted outcomes. In contrast to current prompt learning-based approaches, our P2P stands out by directly updating text embeddings, avoiding the need for retraining diffusion models. Further, we leverage the finding that optimizing only the early reverse diffusion steps boosts efficiency while ensuring that the generated adversarial examples incorporate subtle noise, thus preserving ultrasound image quality without introducing noticeable artifacts. We show that our method outperforms state-of-the-art attack techniques across three breast ultrasound datasets in FID and LPIPS. Moreover, the generated images are both more natural in appearance and more effective compared to existing adversarial attacks. Our code will be publicly available https://github.com/yasamin-med/P2P.

Figures

Figures reproduced from arXiv: 2412.09910 by the authors.

Figure 1
Figure 1. Illustration of P2P in an adversarial attack against Diff [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Overall framework of the proposed method. Image adapted from [ [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Visual comparison of different attack methods on a benign image from the BUSI dataset, using DenseNet121 as the classifier. [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Comparison of original and P2P-attacked ultrasound images from BUS-BRA Dataset, using DenseNet121 as the classifier. The [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 7
Figure 7. Figure 7: Impact of MSE loss in the P2P framework. Image (a) [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 5
Figure 5. Figure 5: t-SNE visualization of last-layer ResNet34 features on [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Attack examples of a malignant image of Dataset BUSI [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

66 extracted references · 36 canonical work pages

  1. [1]

    A comprehensive review on breast cancer de- tection, classification and segmentation using deep learning

    Barsha Abhisheka, Saroj Kumar Biswas, and Biswajit Purkayastha. A comprehensive review on breast cancer de- tection, classification and segmentation using deep learning. Archives of Computational Methods in Engineering , 30(8): 5023–5052, 2023. 5

    work page 2023

  2. [2]

    Dataset of breast ultrasound images

    Walid Al-Dhabyani, Mohammed Gomaa, Hussien Khaled, and Aly Fahmy. Dataset of breast ultrasound images. Data in Brief, 2020. 5

    work page 2020

  3. [3]

    Vision-language synthetic data enhances echocardiography downstream tasks

    Pooria Ashrafian, Milad Yazdani, Moein Heidari, Dena Shahriari, and Ilker Hacihaliloglu. Vision-language synthetic data enhances echocardiography downstream tasks. arXiv preprint arXiv:2403.19880, 2024. 2

    arXiv 2024

  4. [4]

    Badclip: Trigger-aware prompt learning for backdoor attacks on clip

    Jiawang Bai, Kuofeng Gao, Shaobo Min, Shu-Tao Xia, Zhifeng Li, and Wei Liu. Badclip: Trigger-aware prompt learning for backdoor attacks on clip. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24239–24250, 2024. 3

    work page 2024

  5. [5]

    Recent advances in adversarial training for adversarial ro- bustness

    Tao Bai, Jinqi Luo, Jun Zhao, Bihan Wen, and Qian Wang. Recent advances in adversarial training for adversarial ro- bustness. arXiv preprint arXiv:2102.01356, 2021. 2

    arXiv 2021

  6. [6]

    In- structpix2pix: Learning to follow image editing instructions

    Tim Brooks, Aleksander Holynski, and Alexei A Efros. In- structpix2pix: Learning to follow image editing instructions. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 18392–18402, 2023. 3

    2023

  7. [7]

    Adversarial patch

    Tom B Brown, Dandelion Man ´e, Aurko Roy, Mart´ın Abadi, and Justin Gilmer. Adversarial patch. arXiv preprint arXiv:1712.09665, 2017. 6

    arXiv 2017

  8. [8]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39–57. Ieee, 2017. 2, 3

    work page 2017

Show all 66 references
  1. [9]

    Diffusion models for imperceptible and transferable adversarial attack

    Jianqi Chen, Hao Chen, Keyan Chen, Yilan Zhang, Zhengxia Zou, and Zhenwei Shi. Diffusion models for imperceptible and transferable adversarial attack. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024. 3

    2024

  2. [10]

    Adversarial-robust transfer learning for medical imaging via domain assimilation

    Xiaohui Chen and Tie Luo. Adversarial-robust transfer learning for medical imaging via domain assimilation. In Pacific-Asia Conference on Knowledge Discovery and Data Mining, pages 335–349. Springer, 2024. 2

    2024

  3. [11]

    Advdiffuser: Natural adversarial exam- ple synthesis with diffusion models

    Xinquan Chen, Xitong Gao, Juanjuan Zhao, Kejiang Ye, and Cheng-Zhong Xu. Advdiffuser: Natural adversarial exam- ple synthesis with diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 4562–4572, 2023. 2

    2023

  4. [12]

    Computer-aided diagnosis with deep learning architecture: applications to breast le- sions in us images and pulmonary nodules in ct scans

    Jie Zhi Cheng, Dong Ni, Yi Hong Chou, Jing Qin, Chui Mei Tiu, Yeun Chung Chang, Chiun Sheng Huang, Dinggang Shen, and Chung Ming Chen. Computer-aided diagnosis with deep learning architecture: applications to breast le- sions in us images and pulmonary nodules in ct scans. Sci...

    2016

  5. [13]

    Stable diffusion v1.4 - original, 2023

    CompVis. Stable diffusion v1.4 - original, 2023. Accessed: [Insert Date of Access]. 5

    2023

  6. [14]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009. 5

    2009

  7. [15]

    Adversarial attack and defense for medical im- age analysis: Methods and applications

    Junhao Dong, Junxi Chen, Xiaohua Xie, Jianhuang Lai, and Hao Chen. Adversarial attack and defense for medical im- age analysis: Methods and applications. arXiv preprint arXiv:2303.14133, 2023. 2

    2023 arXiv

  8. [16]

    Advanced breast imaging modali- ties—dbt, cem, mbi, pem, mri, ai

    Ahmed Elhatw, Hannah L Chung, Rasha M Kamal, Charles De Jesus, Shanen Jean, Varnita Vishwanath, Hanna R Fer- reira Dalla Pria, Miral M Patel, Mary S Guirguis, and Tanya W Moseley. Advanced breast imaging modali- ties—dbt, cem, mbi, pem, mri, ai. Current Breast Cancer Reports, ...

    2023

  9. [17]

    An image is worth one word: Personalizing text-to- image generation using textual inversion

    Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patash- nik, Amit H Bermano, Gal Chechik, and Daniel Cohen- Or. An image is worth one word: Personalizing text-to- image generation using textual inversion. arXiv preprint arXiv:2208.01618, 2022. 4

    2022 arXiv

  10. [18]

    Bus-bra: A breast ultrasound dataset for assessing computer-aided diagnosis systems

    Wilfrido G ´omez-Flores, Maria Julia Gregorio-Calas, and Wagner Coelho de Albuquerque Pereira. Bus-bra: A breast ultrasound dataset for assessing computer-aided diagnosis systems. Medical Physics, 51(4):3110–3123, 2024. 5, 7

    2024

  11. [19]

    Generative adversarial nets

    Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In Advances in Neural Information Processing Systems , pages 2672–2680. MIT Press, 2014. 2

    2014

  12. [20]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014. 2, 3

    2014 arXiv

  13. [21]

    Baple: Back- door attacks on medical foundational models using prompt learning

    Asif Hanif, Fahad Shamshad, Muhammad Awais, Muza- mmal Naseer, Fahad Shahbaz Khan, Karthik Nandakumar, Salman Khan, and Rao Muhammad Anwer. Baple: Back- door attacks on medical foundational models using prompt learning. In International Conference on Medical Image Computing an...

  14. [22]

    Adversarially robust feature learning for breast cancer diagnosis

    Degan Hao, Dooman Arefan, Margarita Zuley, Wendie Berg, and Shandong Wu. Adversarially robust feature learning for breast cancer diagnosis. arXiv preprint arXiv:2402.08768 ,

    arXiv

  15. [23]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceed- ings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. 5

    2016

  16. [24]

    Gans trained by a two time-scale update rule converge to a local nash equilib- rium

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilib- rium. Advances in neural information processing systems , 30, 2017. 6

    2017

  17. [25]

    Denoising dif- fusion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising dif- fusion probabilistic models. Advances in neural information processing systems, 33:6840–6851, 2020. 3

    2020

  18. [26]

    Densely connected convolutional net- works

    Gao Huang, Zhuang Liu, Laurens van der Maaten, and Kil- ian Q Weinberger. Densely connected convolutional net- works. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2017. 5

    2017

  19. [27]

    Promptsmooth: Certifying robustness of medical vision-language models via prompt learning

    Noor Hussein, Fahad Shamshad, Muzammal Naseer, and Karthik Nandakumar. Promptsmooth: Certifying robustness of medical vision-language models via prompt learning. In International Conference on Medical Image Computing and Computer-Assisted Intervention , pages 698–708. Springer,

  20. [28]

    Iandola, Song Han, Matthew W

    Forrest N. Iandola, Song Han, Matthew W. Moskewicz, Khalid Ashraf, William J. Dally, and Kurt Keutzer. Squeezenet: Alexnet-level accuracy with 50x fewer parame- ters and <0.5mb model size. arXiv:1602.07360, 2016. 5

    2016 arXiv

  21. [29]

    Diffattack: Evasion attacks against diffusion-based adversarial purification

    Mintong Kang, Dawn Song, and Bo Li. Diffattack: Evasion attacks against diffusion-based adversarial purification. Ad- vances in Neural Information Processing Systems, 36, 2024. 3

    2024

  22. [30]

    A style-based generator architecture for generative adversarial networks

    Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. In Proceedings of the IEEE/CVF conference on computer vi- sion and pattern recognition, pages 4401–4410, 2019. 2

    2019

  23. [31]

    Diffusion models in medical imaging: A comprehensive survey

    Amirhossein Kazerouni, Ehsan Khodapanah Aghdam, Moein Heidari, Reza Azad, Mohsen Fayyaz, Ilker Haci- haliloglu, and Dorit Merhof. Diffusion models in medical imaging: A comprehensive survey. Medical Image Analysis, 88:102846, 2023. 1

    2023

  24. [32]

    Deep fea- ture extraction and classification of breast ultrasound im- ages

    Kriti, Jitendra Virmani, and Ravinder Agarwal. Deep fea- ture extraction and classification of breast ultrasound im- ages. Multimedia Tools and Applications , 79(37):27257– 27292, 2020. 5

    2020

  25. [33]

    Digital breast to- mosynthesis and the challenges of implementing an emerg- ing breast cancer screening technology into clinical practice

    Christoph I Lee and Constance D Lehman. Digital breast to- mosynthesis and the challenges of implementing an emerg- ing breast cancer screening technology into clinical practice. Journal of the American College of Radiology, 13(11):R61– R66, 2016. 1

    2016

  26. [34]

    The power of scale for parameter-efficient prompt tuning.arXiv preprint arXiv:2104.08691, 2021

    Brian Lester, Rami Al-Rfou, and Noah Constant. The power of scale for parameter-efficient prompt tuning.arXiv preprint arXiv:2104.08691, 2021. 3

    2021 arXiv

  27. [35]

    Ultrasound physics and instrumentation for pathologists

    David Lieu. Ultrasound physics and instrumentation for pathologists. Archives of pathology & laboratory medicine, 134(10):1541–1556, 2010. 4

    2010

  28. [36]

    Sd- nae: Generating natural adversarial examples with stable dif- fusion

    Yueqian Lin, Jingyang Zhang, Yiran Chen, and Hai Li. Sd- nae: Generating natural adversarial examples with stable dif- fusion. arXiv preprint arXiv:2311.12981, 2023. 2, 3

    2023 arXiv

  29. [37]

    In- struct2attack: Language-guided semantic adversarial at- tacks

    Jiang Liu, Chen Wei, Yuxiang Guo, Heng Yu, Alan Yuille, Soheil Feizi, Chun Pong Lau, and Rama Chellappa. In- struct2attack: Language-guided semantic adversarial at- tacks. arXiv preprint arXiv:2311.15551, 2023. 2

    2023 arXiv

  30. [38]

    Decoupled weight decay regularization

    I Loshchilov. Decoupled weight decay regularization. arXiv preprint arXiv:1711.05101, 2017. 5

    2017 arXiv

  31. [39]

    Understanding adversarial at- tacks on deep learning based medical image analysis sys- tems

    Xingjun Ma, Yuhao Niu, Lin Gu, Yisen Wang, Yitian Zhao, James Bailey, and Feng Lu. Understanding adversarial at- tacks on deep learning based medical image analysis sys- tems. Pattern Recognition, 110:107332, 2021. 2

    2021

  32. [40]

    Towards deep learning models resis- tant to adversarial attacks

    Aleksander Madry. Towards deep learning models resis- tant to adversarial attacks. arXiv preprint arXiv:1706.06083,

    arXiv

  33. [41]

    Prompting hard or hardly prompting: Prompt inversion for text-to-image diffusion models

    Shweta Mahajan, Tanzila Rahman, Kwang Moo Yi, and Leonid Sigal. Prompting hard or hardly prompting: Prompt inversion for text-to-image diffusion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pat- tern Recognition, pages 6808–6817, 2024. 4

    2024

  34. [42]

    Deepfool: a simple and accurate method to fool deep neural networks

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE con- ference on computer vision and pattern recognition , pages 2574–2582, 2016. 2

    2016

  35. [43]

    Boosting diffusion models with moving average sampling in frequency domain

    Yurui Qian, Qi Cai, Yingwei Pan, Yehao Li, Ting Yao, Qibin Sun, and Tao Mei. Boosting diffusion models with moving average sampling in frequency domain. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8911–8920, 2024. 4

    2024

  36. [44]

    Learning transferable visual models from natural language supervi- sion

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervi- sion. In International conference on machine learning, ...

    2021

  37. [45]

    Adver- sarial attacks and defenses in deep learning

    Kui Ren, Tianhang Zheng, Zhan Qin, and Xue Liu. Adver- sarial attacks and defenses in deep learning. Engineering, 6 (3):346–360, 2020. 2

    2020

  38. [46]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022. 2, 3

    2022

  39. [47]

    U- net: Convolutional networks for biomedical image segmen- tation

    Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U- net: Convolutional networks for biomedical image segmen- tation. In Medical image computing and computer-assisted intervention–MICCAI 2015: 18th international conference, Munich, Germany, October 5-9, 2015, proceedings, pa...

    2015

  40. [48]

    Deep unsupervised learning using nonequilibrium thermodynamics

    Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. In International confer- ence on machine learning, pages 2256–2265. PMLR, 2015. 3

    2015

  41. [49]

    Constructing unrestricted adversarial examples with genera- tive models

    Yang Song, Rui Shu, Nate Kushman, and Stefano Ermon. Constructing unrestricted adversarial examples with genera- tive models. Advances in neural information processing sys- tems, 31, 2018. 2

    2018

  42. [50]

    Mirst-dm: Multi-instance rst with drop-max layer for robust classification of breast cancer

    Shoukun Sun, Min Xian, Aleksandar Vakanski, and Hossny Ghanem. Mirst-dm: Multi-instance rst with drop-max layer for robust classification of breast cancer. In International Conference on Medical Image Computing and Computer- Assisted Intervention, pages 401–410. Springer, 2022. 2

  43. [51]

    Advanced ap- plications of breast ultrasound

    William E Svensson and Victoria R Stewart. Advanced ap- plications of breast ultrasound. Breast Cancer, pages 70–98,

  44. [52]

    Intriguing properties of neural networks

    C Szegedy. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013. 2

    2013 arXiv

  45. [53]

    Neural discrete representation learning

    Aaron Van Den Oord, Oriol Vinyals, et al. Neural discrete representation learning. Advances in neural information pro- cessing systems, 30, 2017. 3

    2017

  46. [54]

    Visualizing data using t-sne

    Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research , 9 (11), 2008. 7

    2008

  47. [55]

    p+: Extended textual conditioning in text-to- image generation

    Andrey V oynov, Qinghao Chu, Daniel Cohen-Or, and Kfir Aberman. p+: Extended textual conditioning in text-to- image generation. arXiv preprint arXiv:2303.09522, 2023. 4

    2023 arXiv

  48. [56]

    Advst: Generat- ing unrestricted adversarial images via style transfer

    Xiaomeng Wang, Honglong Chen, Peng Sun, Junjian Li, An- qing Zhang, Weifeng Liu, and Nan Jiang. Advst: Generat- ing unrestricted adversarial images via style transfer. IEEE Transactions on Multimedia, 2023. 3

    2023

  49. [57]

    Medclip: Contrastive learning from unpaired medical images and text

    Zifeng Wang, Zhenbang Wu, Dinesh Agarwal, and Jimeng Sun. Medclip: Contrastive learning from unpaired medical images and text. arXiv preprint arXiv:2210.10163, 2022. 2

    2022 arXiv

  50. [58]

    Better diffusion models further improve adversarial training

    Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan. Better diffusion models further improve adversarial training. InInternational Conference on Machine Learning, pages 36246–36263. PMLR, 2023. 3

    2023

  51. [59]

    Defending against adversarial audio via dif- fusion model

    Shutong Wu, Jiongxiao Wang, Wei Ping, Weili Nie, and Chaowei Xiao. Defending against adversarial audio via dif- fusion model. arXiv preprint arXiv:2303.01507, 2023. 3

    2023 arXiv

  52. [60]

    Diffusion-based adversarial sample generation for improved stealthiness and controllability.Advances in Neural Informa- tion Processing Systems, 36:2894–2921, 2023

    Haotian Xue, Alexandre Araujo, Bin Hu, and Yongxin Chen. Diffusion-based adversarial sample generation for improved stealthiness and controllability.Advances in Neural Informa- tion Processing Systems, 36:2894–2921, 2023. 3

    2023

  53. [61]

    Diffusion-based adversarial sample generation for improved stealthiness and controllability.Advances in Neural Informa- tion Processing Systems, 36, 2024

    Haotian Xue, Alexandre Araujo, Bin Hu, and Yongxin Chen. Diffusion-based adversarial sample generation for improved stealthiness and controllability.Advances in Neural Informa- tion Processing Systems, 36, 2024. 2

    2024

  54. [62]

    Automated breast ultrasound lesions detec- tion using convolutional neural networks

    Moi Hoon Yap, Gerard Pons, Joan Marti, Sergi Ganau, Melcior Sentis, Reyer Zwiggelaar, Adrian K Davison, and Robert Marti. Automated breast ultrasound lesions detec- tion using convolutional neural networks. IEEE journal of biomedical and health informatics, 22(4):1218–1226, 2017. 5, 7

    2017

  55. [63]

    The unreasonable effectiveness of deep features as a perceptual metric

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shecht- man, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recogni- tion, pages 586–595, 2018. 6

    2018

  56. [64]

    Gen- erating natural adversarial examples

    Zhengli Zhao, Dheeru Dua, and Sameer Singh. Gen- erating natural adversarial examples. arXiv preprint arXiv:1710.11342, 2017. 2

    2017 arXiv

  57. [65]

    A machine and human reader study on ai diagnosis model safety under attacks of adversar- ial images

    Qianwei Zhou, Margarita Zuley, Yuan Guo, Lu Yang, Bron- wyn Nair, Adrienne Vargo, Suzanne Ghannam, Dooman Arefan, and Shandong Wu. A machine and human reader study on ai diagnosis model safety under attacks of adversar- ial images. Nature communications, 12(1):7281, 2021. 2

    2021

  58. [66]

    A pilot study of query-free adversarial attack against stable diffusion

    Haomin Zhuang, Yihua Zhang, and Sijia Liu. A pilot study of query-free adversarial attack against stable diffusion. In Proceedings of the IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition, pages 2385–2392, 2023. 3

    2023

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.