Adversarial Robustness

The process of mathematically proving a model's prediction remains constant within a defined epsilon neighborhood around an input. Unlike empirical testing, certification provides a guaranteed lower bound on robustness.

• Randomized Smoothing: A technique that constructs a certifiably robust classifier from any base model by adding Gaussian noise and predicting the most likely class under that noise distribution.
• Verification Bounds: Methods like CROWN and IBP propagate interval bounds through the network to formally verify that no adversarial example exists within a given Lp-norm ball.
• In medical imaging, certification around a lesion ensures no imperceptible pixel change can flip a malignant classification to benign.

The capability to identify and flag inputs that have been adversarially manipulated before they reach the classification stage. Detection acts as a pre-screening firewall for the diagnostic pipeline.

• Feature Squeezing: Compares model predictions on original and squeezed inputs (e.g., reduced color depth, spatial smoothing). Large discrepancies indicate adversarial tampering.
• MagNet: A framework using autoencoders to measure the reconstruction error of inputs. High reconstruction error signals an out-of-distribution adversarial sample.
• Local Intrinsic Dimensionality (LID): Characterizes the dimensional properties of adversarial subspaces; adversarial examples exhibit higher LID scores than clean data, enabling statistical detection.

A robust model must not rely on gradient obfuscation as its primary defense. Gradient masking occurs when a model's loss surface is artificially flattened or randomized, giving a false sense of security against white-box attacks.

• Obfuscated Gradients: A phenomenon identified by Athalye et al. where defenses appear robust but fail against attacks that circumvent non-differentiable layers, stochastic transformations, or vanishing gradients.
• Backward Pass Differentiable Approximation (BPDA): An attack methodology that substitutes a differentiable approximation for non-differentiable defense components during the backward pass to compute usable gradients.
• True robustness requires the model to be adversarially trained, not just shielded by non-differentiable preprocessing steps that attackers can bypass.

The property of maintaining robustness when adversarial examples generated against one diagnostic model or imaging modality are transferred to attack another. Transferability is the primary vector for black-box attacks in clinical settings.

• Ensemble Adversarial Training: Augmenting training data with adversarial examples generated from multiple surrogate models to harden the target model against transferred attacks.
• Input Diversity: Applying random resizing and padding during inference to disrupt the precise adversarial patterns that rely on fixed input dimensions.
• In a PACS environment, an adversarial perturbation crafted on a chest X-ray model from Vendor A must not transfer to Vendor B's model, ensuring diagnostic consistency across the radiology workflow.

The model's ability to remain invariant to semantically meaningful but diagnostically irrelevant changes while remaining sensitive to clinically significant features. This distinguishes robustness from simple noise tolerance.

• Spatial Robustness: Invariance to small rotations, translations, and elastic deformations that simulate natural anatomical variation without altering the diagnostic content.
• Contrast and Brightness Stability: Consistent predictions across the natural variation in scan acquisition parameters (e.g., kVp, mAs in CT) that affect pixel intensities but not pathology.
• A robust model correctly classifies a tumor regardless of patient positioning or scanner calibration, while still detecting the subtle textural changes that indicate malignancy.

The explicit engineering of the balance between standard accuracy on clean data and adversarial accuracy on perturbed data. Tsipras et al. demonstrated that these objectives can be fundamentally at odds.

• TRADES (TRadeoff-inspired Adversarial DEfense via Surrogate-loss): A loss function that explicitly balances the natural classification error and the boundary error, controlled by a regularization parameter λ.
• Robust Self-Training: Leveraging unlabeled data with pseudo-labels generated by a robust teacher model to improve the accuracy-robustness Pareto frontier.
• In medical imaging, this trade-off is critical: a model that is overly robust to perturbations may lose sensitivity to subtle, early-stage pathological features that are themselves near the decision boundary.

A carefully crafted, often imperceptible modification to an input image designed to cause a model to misclassify it with high confidence. In medical imaging, a perturbation could be a subtle noise pattern added to a retinal scan that causes a diabetic retinopathy detector to miss the disease entirely. These perturbations are typically generated using the gradient of the model's loss function with respect to the input. Key properties:

• Magnitude: Constrained by an L-p norm (e.g., L∞ ≤ 8/255 pixel intensity)
• Transferability: Perturbations crafted for one model often fool others
• Physical realizability: Attacks can be printed and re-photographed

A powerful iterative extension of FGSM that applies multiple small gradient steps, each followed by a projection back onto the allowed perturbation budget. PGD is widely considered the strongest first-order adversary and is the standard benchmark for empirical robustness evaluation. The attack iterates: x_{t+1} = Π_{x+S}(x_t + α · sign(∇_x J(θ, x_t, y))). For medical imaging models, PGD-based robustness certification is increasingly expected in FDA submission packages for SaMD.

A defensive technique where a model is trained on a mixture of clean and adversarially perturbed examples, generated on-the-fly during each training iteration. This forces the model to learn decision boundaries that are smooth and robust to small input variations. Min-max formulation: min_θ E_{(x,y)} [max_{δ∈S} L(f_θ(x+δ), y)]. Adversarial training is currently the most empirically effective defense, though it incurs a computational cost 3-10x higher than standard training and may reduce clean accuracy by 1-3%.

Diagnostic imaging models face unique adversarial threats beyond pixel-space perturbations. Key attack vectors:

• Scanner-specific noise: Exploiting reconstruction artifacts from CT or MRI acquisition
• Patch attacks: Physically realizable adversarial stickers placed on skin before imaging
• DICOM metadata poisoning: Manipulating header fields to alter preprocessing pipelines
• Cross-modality transfer: Attacks crafted on one imaging modality transferring to another
• Temporal perturbation: Subtle frame manipulation in ultrasound or fluoroscopy video sequences