SurvAttack: Black-Box Attack On Survival Models through Ontology-Informed EHR Perturbation

Arya Hadizadeh Moghaddam; Bin Liu; Mei Liu; Mohsen Nayebi Kerdabadi; Zijun Yao

REVIEW 4 major objections 7 minor 52 references

SurvAttack: Black-Box Attack On Survival Models through Ontology-Informed EHR Perturbation

T0 review · 4 major / 7 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A query-only attacker can collapse survival-ranking quality by editing EHR codes through ontology-informed substitutions, dropping DeepSurv's c-index from 0.6934 to 0.0569.

desk verdict First black-box attack on survival models, with a big c-index drop; the big caveats are an unvalidated SSF and a DSA description that seems to contradict itself. read the letter →

arxiv 2412.18706 v1 pith:RHLZEVFA submitted 2024-12-24 cs.LG cs.AIcs.CR

Mohsen Nayebi Kerdabadi , Arya Hadizadeh Moghaddam , Bin Liu , Mei Liu , Zijun Yao This is my paper · ORCID

classification cs.LGcs.AIcs.CR

keywords adversarialattacksurvivalanalysiselectronichealthrecordsblack-boxontology-informedperturbationsemanticsimilarityacutekidneyinjuryconcordanceindex

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

SurvAttack claims that a black-box adversary who can only query a survival model can seriously degrade its predictive performance on longitudinal electronic health records (EHRs) by making small, ontology-guided edits to the medical codes in a patient's history. The paper develops a greedy algorithm that scores three actions — removing a code, adding a synonymous code, and replacing a code — by combining the model-output change with a deep semantic-similarity score, then uses a dynamic cohort-level strategy to flip the survival-urgency ranking across patients. On an acute kidney injury EHR cohort of 77,809 patients, the full attack drives DeepSurv's c-index from 0.6934 to 0.0569 and its mean absolute error from 2.01 to 4.48, while keeping perturbed records above the semantic-similarity threshold. If this claim holds, the framework provides both a pre-deployment robustness test for survival models and a source of counterfactual insight into which codes and visits control survival predictions.

What carries the argument

The central object is the composite code scoring (CCS) function $h = \$\Delta$ F \cdot $e^{{\lambda SI}}$$ that ranks candidate perturbations, where $\$\Delta$ F$ is the saliency (output change of the victim survival model) and $SI$ is the semantic similarity index. The Semantic Similarity Function (SSF) backing $SI$ is a transformer-based, ontology-aware encoder — GRAM, attention pooling, and transformer — pretrained on a survival objective and used both to score candidates and as the final stealthiness check (threshold 0.90). Candidate codes are generated by the ontology-informed Synonym Code Selection (SCS) strategy: ontology siblings of a target code are kept only if the conditional co-occurrence probability $P(s_{ij}|c_i)>0.75$. The Dynamic SA-specific (DSA) attack organizes the per-patient greedy search into a cohort-level ranking flip by first pushing censored patients' predicted survival times to 0 and then attacking observed patients around a running minimum target.

What would settle it

A concrete falsifying observation would be a clinician-labeling study: take SurvAttack's attacked and intact records that both pass the 0.90 semantic-similarity threshold, and if clinicians can reliably tell which are attacked at above-chance accuracy, the stealthiness guarantee is refuted.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that discrete EHR perturbations can be chosen in a black-box setting so that a survival model's temporal ranking of patient urgency is inverted while the edited record remains semantically close to the original in the embedding space of an ontology-aware encoder. The mechanism is a composite score $h = \$\Delta$ F \cdot \varphi(SI)$ with $\varphi(z)=$e^{{\lambda z}}$$, where $\$\Delta$ F$ is the change in predicted survival time and $SI$ is the cosine similarity from the Semantic Similarity Function (SSF); candidates are executed greedily in score order, and the Dynamic SA-specific (DSA) strategy attacks each censored patient once and then each observed patient once to make concordant pairs discordant. Experimentally, the full attack lowers c-index and raises MAE on all four victim models, with DeepSurv showing the largest drop in concordance from 0.6934 to 0.0569 and MAE rising from 2.01 to 4.48. The authors interpret the attack-pattern statistics as evidence that the method also contributes model interpretability, since the most-targeted visits and codes align with known clinical risk factors for AKI.

Load-bearing premise

The load-bearing premise is that the cosine similarity computed by the paper's own EHR encoder is a valid measure of clinical compatibility, so records kept above the 0.90 threshold are genuinely subtle and clinically plausible.

Editorial extensions

If this is right

A hospital deploying an EHR survival model for triage must treat the input record as a manipulated surface: a query-only adversary can reverse urgency rankings without dropping below the model's own semantic-similarity threshold.
The attack can serve as a pre-deployment robustness test, and the size of the c-index drop under SurvAttack differentiates which survival models are safer to trust for patient prioritization.
The perturbation patterns provide counterfactual explanations: the last visit and drug codes carry most decision weight, and codes like acute myocardial infarction (ICD-9 410) are among the most effective additions, consistent with known AKI risk factors.
Because DSA needs only one attack per patient, cohort-wide ranking disruption is computationally feasible, so robustness testing can be run at scale over the full patient population.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper leaves untested whether the 0.90 cosine-similarity threshold matches clinical perception; a clinician study that asks physicians to distinguish attacked from intact records would test whether the attack's stealthiness claim holds outside the embedding space.
Because the SSF encoder comes from the same research line as the attack itself, the notion of similarity may be tailored to that encoder's blind spots; replacing SSF with an independently trained clinical encoder would test whether the finding generalizes.
The paper does not study transferability across victim models, but since the attack acts through shared ontology structure and code co-occurrence statistics, perturbations found against one survival model may also degrade another, which would broaden the threat model.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Read SurvAttack. It's the first black-box attack framework for survival models on longitudinal EHRs, and the core result is a large c-index drop: from 0.6934 to 0.0569 for DeepSurv under the full attack, with MAE up from 2.01 to 4.48. The framework is coherent – greedy scoring of remove/add/replace actions, ontology-informed synonym selection via co-occurrence, and a survival-specific DSA strategy. The ablation (SurvAttack vs SurvAttack-NoSym) shows that including the semantic similarity term in scoring helps, not just as a downstream filter. That's a real contribution.

The main ranking-degradation result is not circular: c-index is measured against separately trained victim models, so the numbers stand on their own. I also value the baseline adaptations (Surv-TextBugger, Surv-PWWS, Surv-WS) and the attempt at interpretability through visit and code frequency analysis.

Now the soft spots, in order of seriousness. First, the 'clinically compatible' claim rests entirely on SSF, a cosine similarity in an embedding space from the authors' own prior survival model (ref [32]). That is a proxy for medical plausibility, not a validated one. The threshold θ=0.90 is arbitrary, there is no clinician validation and no external semantic benchmark. If SSF is permissive, the perturbations could be obvious in practice while still passing the check. Second, no error bars or significance tests anywhere. One oddity: for CoxCC, Random attack improves c1 from 0.7107 to 0.742, and that is not discussed. Third, hyperparameters λ, p, and θ are reported once and never swept. Fourth, the DSA description (Section 3.7, Algorithm 3) looks internally inconsistent. Patients are sorted ascending by true survival time, and each is attacked to land just above a running t_min, which is then updated to that new prediction. As written, that would preserve concordance among observed-observed pairs, not destroy it. The reported c2 drops imply the implementation must do something different – maybe descending order, or 'below t_min' instead of 'above.' As it stands, a reader trying to reproduce DSA from the text would be stuck. This needs a corrected algorithm or a clear explanation.

Overall, the paper deserves a serious referee. The core idea is new, and the quantitative story is strong enough to warrant revision rather than desk reject. I would bring it to a reading group on adversarial learning in health, and I would cite it as the first black-box attack on survival models, but I would want the DSA issue and the SSF validation settled before trusting its details.

Referee Report

4 major / 7 minor

Summary. The paper proposes SurvAttack, a black-box adversarial attack framework for survival models on longitudinal electronic health records (EHRs). The method combines ontology-informed synonym code selection (SCS), a composite code scoring (CCS) strategy that balances a saliency index with a deep semantic similarity function (SSF), and a dynamic survival-specific attack strategy (DSA) that perturbs censored and observed patients to degrade the c-index and MAE of four survival models (CoxCC, DeepSurv, N-MTLR, DeepHit). Experiments on a private AKI EHR dataset with roughly 77k patients show large drops in c-index and increases in MAE under SurvAttack compared with several adapted text-attack baselines, and the paper includes attack-pattern analyses and a case study. The authors claim the perturbations are subtle, clinically compatible, and semantically consistent.

Significance. If the empirical claims hold, the paper makes a useful contribution: it is one of the first query-only black-box attack frameworks targeted at survival ranking rather than at classification or regression, with potential value for pre-deployment robustness testing and counterfactual interpretation. The paper's strengths include its black-box threat model, the use of ontology and co-occurrence information to narrow candidate code edits, a released anonymous implementation, and consistently large reported degradations (e.g., DeepSurv c-index from 0.6934 to 0.0569 and MAE from 2.01 to 4.48). However, the central 'clinically compatible and semantically consistent' claim rests on an unvalidated deep-embedding similarity function, and the quantitative results lack statistical uncertainty quantification. The significance is therefore conditional on addressing the validation and correctness concerns below.

major comments (4)

[3.4, Eq. (5); 3.6, Algorithm 2; 4.2] The claim that SurvAttack produces 'subtle, clinically compatible, and semantically consistent' perturbations is not established. Section 3.4 defines SSF as cosine similarity in the latent space of an encoder pre-trained on the survival task in prior work [32], but the paper provides no validation against clinicians, no external semantic benchmark, and no comparison with ontology-based or co-occurrence-based similarity measures. Because the same SSF is used as the final stealthiness gate in Algorithm 2 (the SSF checks after adding, removing, and replacing) and also enters the composite score in Eq. (10), a permissive SSF could allow clinically obvious edits to pass as compatible even while the reported c-index degradation holds. The threshold θ=0.90 is stated in Section 4.2 without calibration or sensitivity analysis. The c-index degradation itself is not circular because it is measured against separately trained victim models, but the clinical-compatibility conclusion is circular relative to SSF unless SSF is independently validated. I recommend either external validation of SSF (e.g., clinician-rated pairs or agreement with established medical text similarity metrics) and a sensitivity analysis over θ, or a clear narrowing of the claim to semantic consistency in the SSF latent space.
[3.7, Algorithm 3; Algorithm 2] The DSA strategy as written does not implement the stated target-time logic. Section 3.7 says that if an observed patient's predicted time is above t_min, the algorithm perturbs the record until the predicted time becomes 'closest to t_min but above it'; however, Algorithm 3 simply calls Algorithm 2 with target time t=t_min, and Algorithm 2 only checks whether each action moves F(V*) in the requested direction relative to the current prediction (the checks such as 'ΔF = F(V*) − T_cur towards direction'). For direction 'decrease', any decrease is accepted, so the predicted time can cross below t_min without triggering any stop, and the invariant that all observed patients remain above the censored patients is not enforced. This can leave observed–observed and observed–censored pairs concordant despite the attack, undermining the claimed c_t and c_ob results. Algorithm 2 should include an explicit crossing check that stops at the target, or Algorithm 3 should verify the target condition after each call.
[Table 1; Section 4.3] The quantitative comparison lacks any measure of variability. Table 1 reports single point estimates without error bars, confidence intervals, or significance tests, and no information is given about the number of runs or random seeds. This is consequential because the Random baseline sometimes improves the c-index over No Attack (CoxCC c1: 0.742 vs 0.7107; DeepSurv c1: 0.7814 vs 0.6934), yet Section 4.3 states without qualification that 'Random demonstrates the worst results.' The paper should report bootstrap confidence intervals or multiple-run results with paired tests, at least for the comparison between SurvAttack and the strongest baseline, and should explicitly discuss the cases where Random improves ranking.
[4.2, Eq. (10)] The free parameters of the method are fixed without justification or sensitivity analysis: the co-occurrence threshold p=0.75, the SSF similarity threshold θ=0.90, and λ in the exponential weighting of Eq. (10). Since Eq. (10) and the SSF threshold directly control both attack success and the claimed stealthiness, it is unclear whether the Table 1 results are robust to these choices or selected to favor the method. An ablation or sensitivity study over p, θ, and λ is needed to support the general claim of effectiveness.

minor comments (7)

[1] Section 1 contains a duplicated sentence: 'Mining health records uncovers valuable patterns and insights to enhance healthcare decision-making' appears twice in consecutive sentences; one copy should be removed.
[4.2] The similarity threshold is denoted ε in Section 4.2 but θ in Section 3.1 and Algorithm 2; please unify the notation.
[4.3.2] In the case study, the text states that drug code N05CA was replaced with N05CD, but the reported co-occurrence is written as P(C09DA|C09DX) >= 0.75; these code identifiers are inconsistent and should be corrected.
[Table 4] The Table 4 caption reports 'SI = 0.96%' for the case study, while Eq. (5) defines SSF as a cosine similarity in [0,1]; please clarify whether the intended value is 0.96 or 96% and align the units.
[Table 1] The column labels c1, c2, c_t, and c_ob are described only in the prose of Section 4.3; define them explicitly in the table caption or immediately before the table for readability.
[4.1] The dataset is private and described only as coming from an anonymous university medical center; the anonymous code release is helpful, but a detailed data schema, code mappings, and model training hyperparameters would materially improve reproducibility.
[5] The claim of being the first black-box attack on survival models should be softened to 'to the best of our knowledge' or accompanied by a more thorough search of prior survival-model attack literature.

Circularity Check

2 steps flagged · score 4.0 of 10

SurvAttack's ranking-degradation results are independent and non-circular, but its clinical-compatibility claim is circular: the SSF used to enforce stealthiness is also offered as evidence, and the encoder comes from the authors' own prior work.

self definitional [Section 3.6 (Algorithm 2), Section 3.1, and Section 4.3.2 Case Study]
"Performing SurvAttack, the predicted survival time reduced to T* = 4.318 (faking the patient as more urgent compared to other critical patients), while still maintaining a 0.96% medical semantic similarity with the original intact subject."

The 'medical semantic similarity' reported in the case study is exactly SSF from Eq. (5). Algorithm 2 rejects every perturbation with SSF(V,V*) < theta before accepting it, so any reported similarity above theta is guaranteed by the attack's own stopping rule. Presenting that value as evidence of clinical compatibility is therefore circular: the property is enforced by the same metric that is offered as confirmation, and the metric itself is never validated against clinicians or an external semantic benchmark.
self citation load bearing [Section 3.4, Eq. (5)]
"This encoder was firstly pre-trained through a survival analysis target in work [32]. The survival predictor layer was then discarded after training."

The encoder whose cosine similarity defines SSF is taken from the authors' own prior work [32], and the paper provides no external validation that this survival-pretrained latent space measures clinical compatibility. Since SSF is used both to score candidate perturbations in CCS and as the final stealthiness gate in Algorithm 2, the central assertion that the perturbations are 'clinically compatible, and semantically consistent' rests on a self-cited model rather than an independent criterion. This self-citation is load-bearing because without SSF the paper has no quantitative support for the subtlety claim.

full rationale

The central attack-effectiveness results in Table 1 are not circular: c-index and MAE are measured on a held-out target set against four victim survival models trained separately from SurvAttack, and the metrics are computed from true survival times and the victim models' predictions. The circularity is confined to the stealthiness and clinical-compatibility claim. The attack's acceptance criterion is SSF(V,V*) >= theta, and the paper then presents the SSF value in the case study as evidence of 'medical semantic similarity'; this is a property enforced by construction, not an independent finding. Additionally, SSF is instantiated via an encoder from the authors' own prior work [32], with no external clinical or semantic validation, so the conclusion that perturbations are clinically compatible rests on a self-citation chain. Because the ranking-degradation numbers remain externally grounded, the overall circularity score is 4 rather than higher.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The attack's core quantitative claim (c-index and MAE degradation) is measured independently of the method's own components, so the central result has grounding. However, the 'clinically compatible' and 'stealthy' claims rest on the authors' own ontology and embedding assumptions, which are not validated against external clinical benchmarks.

free parameters (3)

co-occurrence threshold p = 0.75
Used in SCS (Section 3.3) to retain synonym codes with P[s|c] > p; set without sensitivity analysis in Section 4.2.
similarity threshold theta/epsilon = 0.90
SSF threshold in Algorithm 2 and Section 4.2; chosen by hand, no sensitivity analysis.
lambda in composite score = not reported
Exponent weight lambda in phi(z)=e^{lambda z} (Section 3.5) is a free hyperparameter; its value is never given or swept.

assumptions (5)

domain assumption Medical ontology hierarchy (ICD-9 and ATC) captures clinically meaningful code similarity
SCS (Section 3.3) treats sibling codes under the same parent as exchangeable; ontological nearness is assumed to imply clinical interchangeability.
domain assumption High conditional co-occurrence P[s|c] implies clinically safe substitution
Section 3.3 uses P[s|c] > p to filter synonym codes; statistical co-occurrence is assumed to imply clinical compatibility.
domain assumption Cosine similarity in the pretrained embedding space measures semantic preservation of EHR
SSF (Section 3.4, Eq. 5) uses the authors' own encoder from ref [32] to quantify stealthiness; no external clinical validation is provided.
domain assumption Victim survival models can be queried as black boxes and return a scalar predicted survival time
The attack needs F(V) differences (Eqs. 6-8) and a point estimate for survival time; the paper does not state how DeepHit's distribution is reduced to a scalar.
domain assumption The pretrained SSF encoder is applicable to the AKI cohort and remains fixed during attack
Section 3.4 uses encoder from ref [32], trained possibly on a different split or task; no finetuning or validation is reported.

how reviews work

0 comments

Cite this review

Pith. "Pith review of SurvAttack: Black-Box Attack On Survival Models through Ontology-Informed EHR Perturbation." pith.science (2026). https://pith.science/paper/RHLZEVFA

@misc{pith2026241218706,
  author       = {Pith},
  title        = {Pith review of: SurvAttack: Black-Box Attack On Survival Models through Ontology-Informed EHR Perturbation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RHLZEVFA}},
  note         = {Machine review of arXiv:2412.18706}
}

read the original abstract

Survival analysis (SA) models have been widely studied in mining electronic health records (EHRs), particularly in forecasting the risk of critical conditions for prioritizing high-risk patients. However, their vulnerability to adversarial attacks is much less explored in the literature. Developing black-box perturbation algorithms and evaluating their impact on state-of-the-art survival models brings two benefits to medical applications. First, it can effectively evaluate the robustness of models in pre-deployment testing. Also, exploring how subtle perturbations would result in significantly different outcomes can provide counterfactual insights into the clinical interpretation of model prediction. In this work, we introduce SurvAttack, a novel black-box adversarial attack framework leveraging subtle clinically compatible, and semantically consistent perturbations on longitudinal EHRs to degrade survival models' predictive performance. We specifically develop a greedy algorithm to manipulate medical codes with various adversarial actions throughout a patient's medical history. Then, these adversarial actions are prioritized using a composite scoring strategy based on multi-aspect perturbation quality, including saliency, perturbation stealthiness, and clinical meaningfulness. The proposed adversarial EHR perturbation algorithm is then used in an efficient SA-specific strategy to attack a survival model when estimating the temporal ranking of survival urgency for patients. To demonstrate the significance of our work, we conduct extensive experiments, including baseline comparisons, explainability analysis, and case studies. The experimental results affirm our research's effectiveness in illustrating the vulnerabilities of patient survival models, model interpretation, and ultimately contributing to healthcare quality.

Figures

Figures reproduced from arXiv: 2412.18706 by the authors.

**Figure 3.** Semantic Similarity Function (SSF). SSF employs an [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

**Figure 4.** Frequency of adversarial attacks on Diagnosis Codes (left) and drug codes (right) executed by SurvAttack. Codes [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗

Figures from the paper (2 more)

**Figure 5.** Figure 5: SurvAttack’s perturbation patterns for diagnosis codes (left) and drug codes (right). These heatmaps illustrate the [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]

**Figure 6.** Figure 6: Dynamic SA-specific Attack (DSA) Strategy. Step 1: [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

52 extracted references · 38 canonical work pages

[32]

Mohsen Nayebi Kerdabadi, Arya Hadizadeh Moghaddam, Bin Liu, Mei Liu, and Zijun Yao. 2023. Contrastive learning of temporal distinctiveness for survival SurvAttack: Black-Box Attack On Survival Models through Ontology-Informed EHR Perturbation analysis in electronic health records. InProceedings of the 32nd ACM International Conference on Information and K...

work page 2023
[1]

Joseph Alge, Kristin Dolan, Joseph Angelo, Sameer Thadani, Manpreet Virk, and Ayse Akcan Arikan. 2021. Two to tango: kidney-lung interaction in acute kidney injury and acute respiratory distress syndrome. Frontiers in Pediatrics (2021), 1046

work page 2021
[2]

Sungtae An, Cao Xiao, Walter F Stewart, and Jimeng Sun. 2019. Longitudinal adversarial attack on electronic health records data. In The world wide web conference. 2558–2564

work page 2019
[3]

Nicholas Carlini and David Wagner. 2017. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp) . Ieee, 39–57

2017
[4]

Jinyin Chen, Mengmeng Su, Shijing Shen, Hui Xiong, and Haibin Zheng. 2019. POBA-GA: Perturbation optimized black-box adversarial attacks via genetic algorithm. Computers & Security 85 (2019), 89–106

work page 2019
[5]

Edward Choi, Mohammad Taha Bahadori, Le Song, Walter F Stewart, and Jimeng Sun. 2017. GRAM: graph-based attention model for healthcare representation learning. In Proceedings of the 23rd ACM SIGKDD international conference on knowledge discovery and data mining . 787–795

2017
[6]

Edward Choi, Mohammad Taha Bahadori, Jimeng Sun, Joshua Kulas, Andy Schuetz, and Walter Stewart. 2016. Retain: An interpretable predictive model for healthcare using reverse time attention mechanism. Advances in neural information processing systems 29 (2016)

2016
[7]

David R Cox. 1972. Regression models and life-tables. Journal of the Royal Statistical Society: Series B (Methodological) 34, 2 (1972), 187–202

work page 1972

Show all 52 references

[8]

Yinpeng Dong, Shuyu Cheng, Tianyu Pang, Hang Su, and Jun Zhu. 2021. Query- efficient black-box adversarial attacks guided by a transfer-based prior. IEEE Transactions on Pattern Analysis and Machine Intelligence 44, 12 (2021), 9536– 9548

2021
[9]

Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. 2019. Evading defenses to transferable adversarial examples by translation-invariant attacks. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 4312–4321

2019
[10]

Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2017. Hotflip: White- box adversarial examples for text classification. arXiv preprint arXiv:1712.06751 (2017)

2017 arXiv
[11]

Shuman Fang, Jie Li, Xianming Lin, and Rongrong Ji. 2022. Learning to learn transferable attack. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 36. 571–579

2022
[12]

Sarah Faubel and Charles L Edelstein. 2016. Mechanisms and mediators of lung injury after acute kidney injury. Nature Reviews Nephrology 12, 1 (2016), 48–60

2016
[13]

Stephane Fotso. 2018. Deep neural networks for survival analysis based on a multi-task framework. arXiv preprint arXiv:1801.05512 (2018)

2018 arXiv
[14]

Ji Gao, Jack Lanchantin, Mary Lou Soffa, and Yanjun Qi. 2018. Black-box genera- tion of adversarial text sequences to evade deep learning classifiers. In 2018 IEEE Security and Privacy Workshops (SPW) . IEEE, 50–56

2018
[15]

Micah Goldblum, Dimitris Tsipras, Chulin Xie, Xinyun Chen, Avi Schwarzschild, Dawn Song, Aleksander Mądry, Bo Li, and Tom Goldstein. 2022. Dataset security for machine learning: Data poisoning, backdoor attacks, and defenses. IEEE Transactions on Pattern Analysis and Machine I...

2022
[16]

Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)

2014 arXiv
[17]

Arya Hadizadeh Moghaddam, Mohsen Nayebi Kerdabadi, Bin Liu, Mei Liu, and Zijun Yao. 2024. Discovering Time-Aware Hidden Dependencies with Personal- ized Graphical Structure in Electronic Health Records.ACM Trans. Knowl. Discov. Data (Dec. 2024). https://doi.org/10.1145/3709143...

2024 doi
[18]

Arya Hadizadeh Moghaddam, Mohsen Nayebi Kerdabadi, Mei Liu, and Zijun Yao. 2024. Contrastive learning on medical intents for sequential prescription recommendation. In Proceedings of the 33rd ACM International Conference on Information and Knowledge Management . 748–757

2024
[19]

Frank E Harrell, Robert M Califf, David B Pryor, Kerry L Lee, and Robert A Rosati
[20]

Vojko Kanic, Gregor Kompara, David Šuran, Alojz Tapajner, Franjo Husam Naji, and Andreja Sinkovic. 2019. Acute kidney injury in patients with myocardial infarction undergoing percutaneous coronary intervention using radial versus femoral access. BMC nephrology 20 (2019), 1–7

2019
[21]

Jared L Katzman, Uri Shaham, Alexander Cloninger, Jonathan Bates, Tingting Jiang, and Yuval Kluger. 2018. DeepSurv: personalized treatment recommender system using a Cox proportional hazards deep neural network. BMC medical research methodology 18, 1 (2018), 1–12

2018
[22]

Alexey Kurakin, Ian Goodfellow, and Samy Bengio. 2016. Adversarial machine learning at scale. arXiv preprint arXiv:1611.01236 (2016)

2016 arXiv
[23]

Alexey Kurakin, Ian Goodfellow, Samy Bengio, et al. 2016. Adversarial examples in the physical world

2016
[24]

Håvard Kvamme, Ørnulf Borgan, and Ida Scheel. 2019. Time-to-Event Prediction with Neural Networks and Cox Regression.Journal of Machine Learning Research 20, 129 (2019), 1–30. http://jmlr.org/papers/v20/18-424.html

2019
[25]

Changhee Lee, William Zame, Jinsung Yoon, and Mihaela Van Der Schaar. 2018. Deephit: A deep learning approach to survival analysis with competing risks. In Proceedings of the AAAI conference on artificial intelligence , Vol. 32

2018
[26]

Jinfeng Li, Shouling Ji, Tianyu Du, Bo Li, and Ting Wang. 2018. Textbugger: Generating adversarial text against real-world applications. arXiv preprint arXiv:1812.05271 (2018)

2018 arXiv
[27]

Bin Liu, Ying Li, Zhaonan Sun, Soumya Ghosh, and Kenney Ng. 2018. Early prediction of diabetes complications from electronic health records: A multi-task survival analysis approach. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 32

2018
[28]

Kang Liu, Xiangzhou Zhang, Weiqi Chen, SL Alan, John A Kellum, Michael E Matheny, Steven Q Simpson, Yong Hu, and Mei Liu. 2022. Development and validation of a personalized model with transfer learning for acute kidney injury risk estimation using electronic health records. JA...

2022
[29]

Rishabh Maheshwary, Saket Maheshwary, and Vikram Pudi. 2021. Generating natural language attacks in a hard label black box setting. In Proceedings of the AAAI Conference on Artificial Intelligence , Vol. 35. 13525–13533

2021
[30]

Arya Hadizadeh Moghaddam, Mohsen Nayebi Kerdabadi, Cuncong Zhong, and Zijun Yao. 2024. Meta-Learning on Augmented Gene Expression Profiles for Enhanced Lung Cancer Detection. arXiv preprint arXiv:2408.09635 (2024)

2024 arXiv
[31]

Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. 2016. Deepfool: a simple and accurate method to fool deep neural networks. InProceed- ings of the IEEE conference on computer vision and pattern recognition . 2574–2582

2016
[33]

Lucila Ohno-Machado. 2001. Modeling medical prognosis: survival analysis techniques. Journal of biomedical informatics 34, 6 (2001), 428–439

2001
[34]

Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami. 2016. The limitations of deep learning in adversarial settings. In 2016 IEEE European symposium on security and privacy (EuroS&P) . IEEE, 372–387

2016
[35]

Nicolas Papernot, Patrick McDaniel, Ananthram Swami, and Richard Harang
[36]

Bryan D Park and Sarah Faubel. 2021. Acute kidney injury and acute respiratory distress syndrome. Critical Care Clinics 37, 4 (2021), 835–849

2021
[37]

Shuhuai Ren, Yihe Deng, Kun He, and Wanxiang Che. 2019. Generating natural language adversarial examples through probability weighted word saliency. In Proceedings of the 57th annual meeting of the association for computational linguistics. 1085–1097

2019
[38]

Suranjana Samanta and Sameep Mehta. 2017. Towards crafting text adversarial samples. arXiv preprint arXiv:1707.02812 (2017)

2017 arXiv
[39]

Yacov Shacham, Arie Steinvil, and Yaron Arbel. 2016. Acute kidney injury among ST elevation myocardial infarction patients treated by primary percutaneous coronary intervention: a multifactorial entity. Journal of nephrology 29 (2016), 169–174

2016
[40]

Mengying Sun, Fengyi Tang, Jinfeng Yi, Fei Wang, and Jiayu Zhou. 2018. Identify susceptible locations in medical records via adversarial attacks on deep predictive models. In Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining . 793–801

2018
[41]

Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. Advances in neural information processing systems 30 (2017)

2017
[42]

Ping Wang, Yan Li, and Chandan K Reddy. 2019. Machine learning for survival analysis: A survey. ACM Computing Surveys (CSUR) 51, 6 (2019), 1–36

2019
[43]

Xingxing Wei, Ying Guo, Jie Yu, and Bo Zhang. 2022. Simultaneously optimiz- ing perturbations and positions for black-box adversarial patch attacks. IEEE transactions on pattern analysis and machine intelligence (2022)

2022
[44]

Zhipeng Wei, Jingjing Chen, Micah Goldblum, Zuxuan Wu, Tom Goldstein, and Yu-Gang Jiang. 2022. Towards transferable adversarial attacks on vision transformers. In Proceedings of the AAAI Conference on Artificial Intelligence , Vol. 36. 2668–2676

2022
[45]

Muchao Ye, Jinghui Chen, Chenglin Miao, Ting Wang, and Fenglong Ma. 2022. Leapattack: Hard-label adversarial attack on text via gradient-based optimization. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. 2307–2315

2022
[46]

Muchao Ye, Junyu Luo, Guanjie Zheng, Cao Xiao, Houping Xiao, Ting Wang, and Fenglong Ma. 2022. MedAttacker: Exploring black-box adversarial attacks on risk prediction models in healthcare. In 2022 IEEE International Conference on Bioinformatics and Biomedicine (BIBM) . IEEE, 1777–1780

2022
[47]

Ziyi Yin, Muchao Ye, Tianrong Zhang, Jiaqi Wang, Han Liu, Jinghui Chen, Ting Wang, and Fenglong Ma. 2024. VQAttack: Transferable Adversarial Attacks on Vi- sual Question Answering via Pre-trained Models. arXiv preprint arXiv:2402.11083 (2024)

2024 arXiv
[48]

Chun-Nam Yu, Russell Greiner, Hsiu-Chin Lin, and Vickie Baracos. 2011. Learn- ing patient-specific cancer survival distributions as a sequence of dependent regressors. Advances in neural information processing systems 24 (2011)

2011
[49]

Lifan Yuan, Yichi Zhang, Yangyi Chen, and Wei Wei. 2021. Bridge the gap between cv and nlp! a gradient-based textual adversarial attack framework. arXiv preprint arXiv:2110.15317 (2021)

2021 arXiv
[50]

Yuan Zang, Fanchao Qi, Chenghao Yang, Zhiyuan Liu, Meng Zhang, Qun Liu, and Maosong Sun. 2019. Word-level textual adversarial attacking as combinatorial optimization. arXiv preprint arXiv:1910.12196 (2019)

2019 arXiv
[1982]

Jama 247, 18 (1982), 2543–2546

Evaluating the yield of medical tests. Jama 247, 18 (1982), 2543–2546

1982
[2016]

In MILCOM 2016-2016 IEEE Military Communications Conference

Crafting adversarial input sequences for recurrent neural networks. In MILCOM 2016-2016 IEEE Military Communications Conference . IEEE, 49–54

2016

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [32]

Mohsen Nayebi Kerdabadi, Arya Hadizadeh Moghaddam, Bin Liu, Mei Liu, and Zijun Yao. 2023. Contrastive learning of temporal distinctiveness for survival SurvAttack: Black-Box Attack On Survival Models through Ontology-Informed EHR Perturbation analysis in electronic health records. InProceedings of the 32nd ACM International Conference on Information and K...

work page 2023

[2] [1]

Joseph Alge, Kristin Dolan, Joseph Angelo, Sameer Thadani, Manpreet Virk, and Ayse Akcan Arikan. 2021. Two to tango: kidney-lung interaction in acute kidney injury and acute respiratory distress syndrome. Frontiers in Pediatrics (2021), 1046

work page 2021

[3] [2]

Sungtae An, Cao Xiao, Walter F Stewart, and Jimeng Sun. 2019. Longitudinal adversarial attack on electronic health records data. In The world wide web conference. 2558–2564

work page 2019

[4] [3]

Nicholas Carlini and David Wagner. 2017. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp) . Ieee, 39–57

2017

[5] [4]

Jinyin Chen, Mengmeng Su, Shijing Shen, Hui Xiong, and Haibin Zheng. 2019. POBA-GA: Perturbation optimized black-box adversarial attacks via genetic algorithm. Computers & Security 85 (2019), 89–106

work page 2019

[6] [5]

Edward Choi, Mohammad Taha Bahadori, Le Song, Walter F Stewart, and Jimeng Sun. 2017. GRAM: graph-based attention model for healthcare representation learning. In Proceedings of the 23rd ACM SIGKDD international conference on knowledge discovery and data mining . 787–795

2017

[7] [6]

Edward Choi, Mohammad Taha Bahadori, Jimeng Sun, Joshua Kulas, Andy Schuetz, and Walter Stewart. 2016. Retain: An interpretable predictive model for healthcare using reverse time attention mechanism. Advances in neural information processing systems 29 (2016)

2016

[8] [7]

David R Cox. 1972. Regression models and life-tables. Journal of the Royal Statistical Society: Series B (Methodological) 34, 2 (1972), 187–202

work page 1972