Pith. sign in

REVIEW 3 major objections 5 minor 41 references

The Butterfly Effect in Pathology: Exploring Security in Pathology Foundation Models

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A label-free attack that perturbs a single patch can substantially degrade downstream accuracy across whole-slide pathology foundation models.

desk verdict Useful first benchmark on WSI-FM adversarial security, but the abstract understates the measured drops and an unablated 7,000-patch cap may inflate the single-patch effect. read the letter →

arxiv 2505.24141 v1 pith:MSQGMAOM submitted 2025-05-30 cs.CV cs.AI

Jiashuai Liu , Yingjia Shang , Yingkang Zhan , Di Zhang , Yi Niu , Dong Wei , Xian Wu , Zeyu Gao
show 2 more authors
Chen Li Yefeng Zheng
This is my paper
classification cs.CVcs.AI
keywords pathologyfoundationmodelswholeslideimagesadversarialattacklabel-freerobustnessmedicalimagesecuritytumordetectionfeature-space
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to establish that whole-slide pathology foundation models—systems that compress a gigapixel tissue scan into one feature vector reused by many diagnostic classifiers—are vulnerable to a new, label-free kind of adversarial attack. The attack requires only access to the pretrained foundation model's feature extractor and aggregation module; it does not need labels or access to the downstream task head. By perturbing as few as one patch (about 0.1% of patches in a slide) with noise at intensity $4/255$, the attack pushes the slide-level representation away from its original location, and the paper's tables report downstream accuracy drops as large as 61.65 percentage points. If this is right, it matters because the same representation is reused across multiple clinical tasks, so one cheap manipulation could degrade tumor detection, subtyping, and mutation prediction simultaneously. The paper also reports that the number of attacked patches matters more than perturbation magnitude, that robustness differs across models, and that a small dose of uniform noise largely undoes the attack.

What carries the argument

The object that carries the argument is the two-stage WSI foundation model, written as a patch-level feature extractor $\phi$ followed by a feature aggregator $A$; the slide-level representation is $z = A(\{f_1,\dots,f_N\})$ where $f_i=\phi(x_i)$. The attack mechanism is local perturbation with global impact: choose a small set $I$ of $K$ patches, add an $\epsilon$-bounded perturbation $\delta_i$ only to those patches, and maximize $\mathrm{MSE}(A(\{\phi(\tilde{x}_i)\}), z)$ via gradient-based updates. This objective makes the attack label-free because it only measures how far the whole-slide representation moves, not which class it moves toward. The redefined perturbation budget separates scope ($K$ patches) from magnitude ($\epsilon$), and the parallel versus sequential attack strategies model different computational constraints while sharing the same objective.

What would settle it

Run the same single-patch attack on uncapped whole-slide images, or on randomly sampled 7,000-patch subsets instead of a contiguous prefix, and compare the accuracy drop. If the large drops vanish on full slides or depend on which patch block is chosen, the reported single-patch global impact is an artifact of the truncation window; if the drops persist, the butterfly-effect claim holds.

Watch

Extended reading notes

Core claim

The central claim, stated on the paper's own terms, is that WSI-level pathology foundation models exhibit a butterfly effect: a tiny local perturbation in pixel space gets amplified through patch-feature extraction and feature aggregation into a large shift of the slide-level representation, and that shift degrades every downstream task that consumes the representation. The authors formalize the attack as maximizing the mean squared error between the original slide representation $z$ and the perturbed representation $\hat{z}$, subject to two budgets: the perturbation scope $K$ (the number of patches changed) and the per-pixel magnitude $\epsilon$. They adapt FGSM, BIM, MIM, and C&W to this label-free objective and evaluate them on CHIEF, PRISM, and TITAN across six tasks. Their most striking single-patch results ($K=1$, $\epsilon=4/255$) include CHIEF falling from 84.31% to 51.34% on Camelyon16 tumor detection, TITAN from 98.32% to 41.78%, and PRISM from 89.90% to 28.25% on EBRAINS subtyping. They also report a robustness ordering CHIEF > TITAN > PRISM that is inversely related to parameter count, and show that adding uniform noise of $\pm 1/255$ to all input patches restores most of the lost accuracy.

Load-bearing premise

The evaluation caps every slide at a contiguous block of 7,000 patches and asserts without a control experiment that this truncation does not compromise downstream task performance.

Editorial extensions

If this is right

  • A white-box adversary who obtains the pretrained foundation model weights can degrade many unseen downstream tasks at once, because the attack targets the shared slide-level representation rather than any specific label.
  • Deploying WSI-FMs in clinical decision support requires treating the feature extractor and aggregator as a security boundary, not just the final classifier.
  • Expanding the number of attacked patches from one to eight degrades accuracy further and more reliably than increasing per-pixel noise, so defenders should focus on patch-count thresholds.
  • The lightweight uniform-noise defence restores most of the lost accuracy on the tested tasks, making randomized pre-processing a plausible first-line mitigation.
  • Larger slide-level foundation models appear more fragile under this attack, so model scaling in pathology should be accompanied by explicit robustness evaluation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A direct extension not run in the paper: because the attack is label-free and representation-level, the same perturbed slide should also degrade tasks the paper did not measure, such as survival prediction or molecular biomarker prediction, whenever those tasks read from the same $z$; testing this would be a cheap falsification of the global-impact claim.
  • The patch-semantics analysis implies that random patch selection underestimates the attack: choosing patches that are normal on normal slides, or patches far from tumor regions, should raise attack success rates; this follows from the paper's Figure 4 but is not claimed by the authors.
  • The contiguous 7,000-patch cap means the reported global impact could depend on which part of the slide the window covers; sampling 7,000 patches uniformly at random instead would show whether the effect is a property of aggregation or of the chosen prefix.
  • The uniform-noise defence is demonstrated against the paper's attacks at small $K$ and $\epsilon$; pushing it against iterative attacks with $K=8$ or larger budgets would tell whether it is a true hardening step or a narrow countermeasure.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This manuscript proposes a label-free adversarial attack framework for WSI-level pathology foundation models, introducing a 'local perturbation with global impact' principle that perturbs a small subset of patches under white-box access to the backbone while keeping the downstream task model black-box. The authors adapt FGSM, BIM, MIM, and C&W attacks to maximize the MSE between original and perturbed slide-level representations, and evaluate them on CHIEF, PRISM, and TITAN across six downstream tasks on five datasets. They report substantial accuracy drops (e.g., up to 61.65% on PRISM for EBRAINS subtype under FGSM), analyze patch-level vulnerability on Camelyon16, and propose a random-noise defence. Code is released.

Significance. If the reported vulnerability transfers to full WSIs, this is an important and timely contribution: it is the first systematic security benchmark for WSI-FMs, it uses a practically motivated threat model (white-box backbone, black-box downstream), and the public code release supports reproducibility. The paper also contains useful observations on patch semantics and a lightweight defence. However, the central claim is currently supported only on truncated slides, and the robustness ranking in Section 6.1 is contradicted by the paper's own Camelyon16 results, so the significance is contingent on additional validation.

major comments (3)
  1. [Appendix C; Section 5.2] All experiments cap each WSI at a contiguous 7,000-patch subset and the paper asserts without supporting ablation that this 'does not compromise downstream task performance.' Because Eq. (2) and the central 'local perturbation with global impact' claim are about full gigapixel WSIs, the reported single-patch attack effects may depend on the truncation: a 7,000-patch contiguous block may not represent the whole slide, and the aggregation module's sensitivity to a single patch can differ with slide length. Please add full-slide baselines, or at least random-subset ablations, to show that the no-attack accuracy and the attack-drop magnitudes are not artifacts of the truncation.
  2. [Section 6.1; Table 2; Table 1 (Camelyon16)] The claimed robustness order CHIEF > TITAN > PRISM is not supported by the Camelyon16 results. In Table 1, TITAN has the largest accuracy drop under every attack (e.g., FGSM accuracy drop: CHIEF 32.97%, PRISM 49.91%, TITAN 56.54%; MIM accuracy drop: CHIEF 23.99%, PRISM 35.99%, TITAN 56.04%), while PRISM is more robust than TITAN. Table 2's robustness ranks should therefore be revised, and Section 6.1's model-size hypothesis needs a quantitative correlation analysis rather than a claim.
  3. [Abstract; Section 5.2] The abstract states that attacks lead to 'up to 20%' accuracy degradation, but Table 1 reports maximum accuracy drops of 61.65% (PRISM, EBRAINS subtype, FGSM) and multiple drops above 50%. Please correct the headline number or qualify it; as written the abstract substantially understates the paper's own results.
minor comments (5)
  1. [Appendix D, Table 3] Table 3 labels the fourth attack row as 'PGD', but Section 5.2 and Table 1 consistently refer to BIM; please make the naming consistent.
  2. [Section 4.3] The heading 'Perbution budget' appears to be a typo for 'Perturbation budget'.
  3. [Table 1] Several entries contain duplicated arrow symbols (e.g., '↓6.10↓6.10↓6.10' and '↓32.97↓32.97↓32.97'); these should be cleaned for readability.
  4. [Appendix C] Please explain why a contiguous 7,000-patch subset rather than a random subset was chosen, and report the distribution of slide sizes to clarify how often the cap actually binds.
  5. [Section 6.1] The claimed 'positive correlation between attack success rate and model size' is not quantitatively demonstrated; Table 2 only lists parameter counts. Add a correlation analysis or explicitly frame this as a hypothesis.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the reported attack effectiveness is measured empirically on held-out downstream classifiers, and the label-free MSE objective does not by construction force the observed accuracy drops.

full rationale

The paper's derivation chain is empirical rather than self-referential. The attack objective (Eq. 2) maximizes the MSE between the clean and perturbed slide-level representations; this optimization does not use downstream labels, and the downstream classifiers are trained and evaluated under five-fold cross-validation with the attacked WSI excluded from the training fold. Consequently, downstream accuracy drop is an externally measured consequence, not an artifact of a fitted parameter renamed as a prediction. The four adapted attacks (FGSM, BIM, MIM, C&W) are standard white-box methods, and their hyperparameters (epsilon, iterations, step size) are fixed before evaluation; no parameter is tuned to the reported accuracy drops. The benchmark is self-contained against external WSI-FMs (CHIEF, PRISM, TITAN) with published pretrained weights and standard public datasets. The authors' self-citations, e.g., [8] and [16] in the patch-vulnerability discussion, are related-work or methodological references and are not load-bearing for the central claim. Appendix C caps each WSI at a contiguous 7,000-patch subset and asserts that 'this restriction does not compromise downstream task performance' without an ablation; this is a potential threat to external validity and may affect whether the results transfer to full gigapixel slides, but it is not circularity because the no-attack baseline and all attack conditions use the same truncation, and the paper does not define the attack's success in terms of the truncation. No equation is equivalent to its own input, no prior uniqueness theorem is imported from the authors to forbid alternatives, and no known result is merely renamed. The 'up to 20%' wording in the abstract understates the larger drops in Table 1, but that inconsistency concerns reporting accuracy, not circular reasoning.

Assumptions & free parameters 5 free parameters · 3 assumptions · 0 invented entities

The central claim rests on several assumptions: that a contiguous 7,000-patch subset represents the full WSI, that MLP classifiers capture downstream-task behavior, and that gradient-aligned noise on one patch is the cause of accuracy drops rather than any perturbation. The no-attack baseline and repeated runs support the measurement, but the missing random-perturbation baseline prevents causal attribution to the adversarial direction. No new entities or fitted parameters are introduced; the attack hyperparameters are standard choices.

free parameters (5)
  • epsilon (perturbation magnitude budget) = 4/255 in main results; 4/255 to 64/255 in magnitude analysis
    Chosen as a small, 'imperceptible' per-pixel bound; not fitted to outcomes, but the attack's severity scales with it.
  • K (number of attacked patches) = 1 in main results ('0.1%'); 1,2,4,8 in scope analysis
    The paper's headline result uses K=1; the paper shows attack effectiveness increases with K.
  • patch cap per WSI = 7,000 contiguous patches
    Chosen for computational feasibility; central to all evaluations and not ablated.
  • C&W balance coefficient c = 1
    Weights perturbation size vs feature discrepancy; standard default, not fitted.
  • MIM momentum coefficient mu = not reported in main text or appendix
    The update rule in Eq. 5 uses mu, but no value is given, leaving a reproducibility gap.
assumptions (3)
  • domain assumption The downstream task can be adequately modeled by an MLP classifier trained on the frozen aggregated representation.
    All six downstream tasks are evaluated with MLPs only; the threat model claims impact on 'all downstream tasks' but transferability to other architectures is not tested.
  • domain assumption A contiguous 7,000-patch window is a faithful proxy for a full WSI.
    Appendix C states the cap 'does not compromise downstream task performance' without an ablation study.
  • domain assumption The white-box gradient of the representation-MSE loss is a reliable steering signal for unseen classifiers.
    Eq. 2 maximizes representation shift, but the paper never shows that the shift direction is aligned with the decision boundaries of the downstream MLPs; the connection is empirical only.

how reviews work

0 comments
Cite this review

Pith. "Pith review of The Butterfly Effect in Pathology: Exploring Security in Pathology Foundation Models." pith.science (2026). https://pith.science/paper/MSQGMAOM

@misc{pith2026250524141,
  author       = {Pith},
  title        = {Pith review of: The Butterfly Effect in Pathology: Exploring Security in Pathology Foundation Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MSQGMAOM}},
  note         = {Machine review of arXiv:2505.24141}
}
read the original abstract

With the widespread adoption of pathology foundation models in both research and clinical decision support systems, exploring their security has become a critical concern. However, despite their growing impact, the vulnerability of these models to adversarial attacks remains largely unexplored. In this work, we present the first systematic investigation into the security of pathology foundation models for whole slide image~(WSI) analysis against adversarial attacks. Specifically, we introduce the principle of \textit{local perturbation with global impact} and propose a label-free attack framework that operates without requiring access to downstream task labels. Under this attack framework, we revise four classical white-box attack methods and redefine the perturbation budget based on the characteristics of WSI. We conduct comprehensive experiments on three representative pathology foundation models across five datasets and six downstream tasks. Despite modifying only 0.1\% of patches per slide with imperceptible noise, our attack leads to downstream accuracy degradation that can reach up to 20\% in the worst cases. Furthermore, we analyze key factors that influence attack success, explore the relationship between patch-level vulnerability and semantic content, and conduct a preliminary investigation into potential defence strategies. These findings lay the groundwork for future research on the adversarial robustness and reliable deployment of pathology foundation models. Our code is publicly available at: https://github.com/Jiashuai-Liu-hmos/Attack-WSI-pathology-foundation-models.

Figures

Figures reproduced from arXiv: 2505.24141 by the authors.

Figure 1
Figure 1. Example of prediction shift under adversarial attack. While the original model predicts [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Overview of the proposed adversarial attack framework and its clinical attack scenario. (a) [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Evaluation of attack performance under varying perturbation budgets on two downstream [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Distribution of attack outcomes across different patch types. TPTW: tumor patch from [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Defence performance on two downstream tasks, reporting the prediction accuracy of each [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

41 extracted references · 26 canonical work pages

  1. [1]

    Ebrains live papers-interactive resource sheets for computational studies in neuroscience

    Shailesh Appukuttan, Luca L Bologna, Felix Schürmann, Michele Migliore, and Andrew P Davi- son. Ebrains live papers-interactive resource sheets for computational studies in neuroscience. Neuroinformatics, 21(1):101–113, 2023

    work page 2023

  2. [2]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy, pages 39–57. IEEE, 2017

    work page 2017

  3. [3]

    Towards a general-purpose foundation model for computational pathology.Nature Medicine, 30(3):850–862, 2024

    Richard J Chen, Tong Ding, Ming Y Lu, et al. Towards a general-purpose foundation model for computational pathology.Nature Medicine, 30(3):850–862, 2024

    work page 2024

  4. [4]

    The somatic genomic landscape of chromophobe renal cell carcinoma.Cancer Cell, 26(3):319–330, 2014

    Caleb F Davis, Christopher J Ricketts, Min Wang, et al. The somatic genomic landscape of chromophobe renal cell carcinoma.Cancer Cell, 26(3):319–330, 2014

    work page 2014

  5. [5]

    Multimodal whole slide foundation model for pathology.arXiv preprint arXiv:2411.19666, 2024

    Tong Ding, Sophia J Wagner, Andrew H Song, et al. Multimodal whole slide foundation model for pathology.arXiv preprint arXiv:2411.19666, 2024

    arXiv 2024

  6. [6]

    Benchmarking adversarial robustness on image classification

    Yinpeng Dong, Qi-An Fu, Xiao Yang, Tianyu Pang, Hang Su, Zihao Xiao, and Jun Zhu. Benchmarking adversarial robustness on image classification. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 321–331, 2020

    work page 2020

  7. [7]

    Boosting adversarial attacks with momentum

    Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 9185–9193, 2018

    2018

  8. [8]

    Accurate spatial quantification in computational pathology with multiple instance learning.MedRxiv, 2024

    Zeyu Gao, Anyu Mao, Yuxing Dong, Jialun Wu, Jiashuai Liu, Chunbao Wang, Kai He, Tieliang Gong, Chen Li, and Mireia Crispin-Ortuzar. Accurate spatial quantification in computational pathology with multiple instance learning.MedRxiv, 2024. medRxiv: 2024.04.25.24306364

    work page 2024

Show all 41 references
  1. [9]

    Adversarial attacks and adversarial robustness in computational pathology.Nature Communications, 13(1):5711, 2022

    Narmin Ghaffari Laleh, Daniel Truhn, Gregory Patrick Veldhuizen, et al. Adversarial attacks and adversarial robustness in computational pathology.Nature Communications, 13(1):5711, 2022

    2022

  2. [10]

    Explaining and harnessing adversar- ial examples.arXiv preprint arXiv:1412.6572, 2014

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- ial examples.arXiv preprint arXiv:1412.6572, 2014

    2014 arXiv

  3. [11]

    Attention-based deep multiple instance learning

    Maximilian Ilse, Jakub Tomczak, and Max Welling. Attention-based deep multiple instance learning. InInternational Conference on Machine Learning, pages 2127–2136. PMLR, 2018

    2018

  4. [12]

    Tissue contamination challenges the credibility of machine learning models in real world digital pathology.Modern Pathology, 37(3):100422, 2024

    Ismail Irmakci, Ramin Nateghi, Rujoi Zhou, Mariavittoria Vescovo, Madeline Saft, Ashley E Ross, Ximing J Yang, Lee AD Cooper, and Jeffery A Goldstein. Tissue contamination challenges the credibility of machine learning models in real world digital pathology.Modern Pathology, 3...

    2024

  5. [13]

    Adversarial machine learning at scale

    Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. arXiv preprint arXiv:1611.01236, 2016. 10

    2016 arXiv

  6. [14]

    WSI-LLaV A: A multimodal large language model for whole slide image.arXiv preprint arXiv:2412.02141, 2024

    Yuci Liang, Xinheng Lyu, Meidan Ding, et al. WSI-LLaV A: A multimodal large language model for whole slide image.arXiv preprint arXiv:2412.02141, 2024

    2024 arXiv

  7. [15]

    1399 H&E-stained sentinel lymph node sections of breast cancer patients: the CAMELYON dataset.GigaScience, 7(6):giy065, 2018

    Geert Litjens, Peter Bandi, Babak Ehteshami Bejnordi, et al. 1399 H&E-stained sentinel lymph node sections of breast cancer patients: the CAMELYON dataset.GigaScience, 7(6):giy065, 2018

    2018

  8. [16]

    Pamil: Prototype attention-based multiple instance learning for whole slide image classification

    Jiashuai Liu, Anyu Mao, Yi Niu, Xianli Zhang, Tieliang Gong, Chen Li, and Zeyu Gao. Pamil: Prototype attention-based multiple instance learning for whole slide image classification. In International Conference on Medical Image Computing and Computer Assisted Intervention, page...

    2024

  9. [17]

    A foundational multimodal vision language AI assistant for human pathology.arXiv preprint arXiv:2312.07814, 2023

    Ming Y Lu, Bowen Chen, Drew FK Williamson, et al. A foundational multimodal vision language AI assistant for human pathology.arXiv preprint arXiv:2312.07814, 2023

    2023 arXiv

  10. [18]

    A visual-language foundation model for computational pathology.Nature Medicine, 30(3):863–874, 2024

    Ming Y Lu, Bowen Chen, Drew FK Williamson, et al. A visual-language foundation model for computational pathology.Nature Medicine, 30(3):863–874, 2024

    2024

  11. [19]

    Data-efficient and weakly supervised computational pathology on whole-slide images.Nature Biomedical Engineering, 5(6):555–570, 2021

    Ming Y Lu, Drew FK Williamson, Tiffany Y Chen, Richard J Chen, Matteo Barbieri, and Faisal Mahmood. Data-efficient and weakly supervised computational pathology on whole-slide images.Nature Biomedical Engineering, 5(6):555–570, 2021

    2021

  12. [20]

    Towards deep learning models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083, 2017

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  13. [21]

    Comprehensive molecular characterization of papil- lary renal-cell carcinoma.New England Journal of Medicine, 374(2):135–145, 2016

    Cancer Genome Atlas Research Network. Comprehensive molecular characterization of papil- lary renal-cell carcinoma.New England Journal of Medicine, 374(2):135–145, 2016

    2016

  14. [22]

    Comprehensive genomic characterization of squamous cell lung cancers.Nature, 489(7417):519, 2012

    Cancer Genome Atlas Research Network et al. Comprehensive genomic characterization of squamous cell lung cancers.Nature, 489(7417):519, 2012

    2012

  15. [23]

    Comprehensive molecular portraits of human breast tumours.Nature, 490(7418):61–70, 2012

    Cancer Genome Atlas Research Network et al. Comprehensive molecular portraits of human breast tumours.Nature, 490(7418):61–70, 2012

    2012

  16. [24]

    Comprehensive molecular characterization of clear cell renal cell carcinoma.Nature, 499(7456):43–49, 2013

    Cancer Genome Atlas Research Network et al. Comprehensive molecular characterization of clear cell renal cell carcinoma.Nature, 499(7456):43–49, 2013

    2013

  17. [25]

    Comprehensive molecular profiling of lung adenocarcinoma.Nature, 511(7511):543, 2014

    Cancer Genome Atlas Research Network et al. Comprehensive molecular profiling of lung adenocarcinoma.Nature, 511(7511):543, 2014

    2014

  18. [26]

    Review of artificial intelligence adversar- ial attack and defense technologies.Applied Sciences, 9(5):909, 2019

    Shilin Qiu, Qihe Liu, Shijie Zhou, and Chunjiang Wu. Review of artificial intelligence adversar- ial attack and defense technologies.Applied Sciences, 9(5):909, 2019

    2019

  19. [27]

    Adversarial training for free!Advances in Neural Information Processing Systems, 32, 2019

    Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free!Advances in Neural Information Processing Systems, 32, 2019

    2019

  20. [28]

    Prism: A multi-modal generative foundation model for slide-level histopathology.arXiv preprint arXiv:2405.10254, 2024

    George Shaikovski, Adam Casson, Kristen Severson, et al. Prism: A multi-modal generative foundation model for slide-level histopathology.arXiv preprint arXiv:2405.10254, 2024

    2024 arXiv

  21. [29]

    Transmil: Transformer based correlated multi- ple instance learning for whole slide image classification.Advances in Neural Information Processing Systems, 34:2136–2147, 2021

    Zhuchen Shao, Hao Bian, Yang Chen, et al. Transmil: Transformer based correlated multi- ple instance learning for whole slide image classification.Advances in Neural Information Processing Systems, 34:2136–2147, 2021

    2021

  22. [30]

    Guided adversarial attack for evaluating and enhancing adversarial defenses.Advances in Neural Information Processing Systems, 33:20297–20308, 2020

    Gaurang Sriramanan, Sravanti Addepalli, Arya Baburaj, et al. Guided adversarial attack for evaluating and enhancing adversarial defenses.Advances in Neural Information Processing Systems, 33:20297–20308, 2020

    2020

  23. [31]

    Intriguing properties of neural networks.arXiv preprint arXiv:1312.6199, 2013

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfel- low, and Rob Fergus. Intriguing properties of neural networks.arXiv preprint arXiv:1312.6199, 2013. 11

    2013 arXiv

  24. [32]

    Demonstration of an adversarial attack against a multimodal vision language model for pathology imaging

    Poojitha Thota, Jai Prakash Veerla, Partha Sai Guttikonda, Mohammad S Nasr, Shirin Nilizadeh, and Jacob M Luber. Demonstration of an adversarial attack against a multimodal vision language model for pathology imaging. InIEEE International Symposium on Biomedical Imaging, pages...

    2024

  25. [33]

    Molecular-driven foundation model for oncologic pathology.arXiv preprint arXiv:2501.16652, 2025

    Anurag Vaidya, Andrew Zhang, Guillaume Jaume, et al. Molecular-driven foundation model for oncologic pathology.arXiv preprint arXiv:2501.16652, 2025

    2025 arXiv

  26. [34]

    A foundation model for clinical-grade computational pathology and rare cancers detection.Nature Medicine, 30(10):2924–2935, 2024

    Eugene V orontsov, Alican Bozkurt, Adam Casson, et al. A foundation model for clinical-grade computational pathology and rare cancers detection.Nature Medicine, 30(10):2924–2935, 2024

    2024

  27. [35]

    A pathology foundation model for cancer diagnosis and prognosis prediction.Nature, 634(8035):970–978, 2024

    Xiyue Wang, Junhan Zhao, Eliana Marostica, et al. A pathology foundation model for cancer diagnosis and prognosis prediction.Nature, 634(8035):970–978, 2024

    2024

  28. [36]

    Performance evaluation of adversarial attacks: Discrepancies and solutions.arXiv preprint arXiv:2104.11103, 2021

    Jing Wu, Mingyi Zhou, Ce Zhu, Yipeng Liu, Mehrtash Harandi, and Li Li. Performance evaluation of adversarial attacks: Discrepancies and solutions.arXiv preprint arXiv:2104.11103, 2021

    2021 arXiv

  29. [37]

    A vision–language foundation model for precision oncology.Nature, pages 1–10, 2025

    Jinxi Xiang, Xiyue Wang, Xiaoming Zhang, et al. A vision–language foundation model for precision oncology.Nature, pages 1–10, 2025

    2025

  30. [38]

    A whole-slide foundation model for digital pathology from real-world data.Nature, 630(8015):181–188, 2024

    Hanwen Xu, Naoto Usuyama, Jaspreet Bagga, et al. A whole-slide foundation model for digital pathology from real-world data.Nature, 630(8015):181–188, 2024

    2024

  31. [39]

    A multimodal knowledge-enhanced whole-slide pathology foundation model.arXiv preprint arXiv:2407.15362, 2024

    Yingxue Xu, Yihui Wang, Fengtao Zhou, et al. A multimodal knowledge-enhanced whole-slide pathology foundation model.arXiv preprint arXiv:2407.15362, 2024

    2024 arXiv

  32. [40]

    Ac- celerating data processing and benchmarking of AI models for pathology.arXiv preprint arXiv:2502.06750, 2025

    Andrew Zhang, Guillaume Jaume, Anurag Vaidya, Tong Ding, and Faisal Mahmood. Ac- celerating data processing and benchmarking of AI models for pathology.arXiv preprint arXiv:2502.06750, 2025

    2025 arXiv

  33. [41]

    butterfly effect

    Eric Zimmermann, Eugene V orontsov, Julian Viret, Adam Casson, Michal Zelechowski, George Shaikovski, Neil Tenenholtz, James Hall, Thomas Fuchs, Nicolo Fusi, Siqi Liu, and Kristen Severson. Virchow2: Scaling self-supervised mixed magnification models in pathology.arXiv preprin...

    2024 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.