Chen Fang, Wang Jian, Liu Han, Kong Wentao, Zhao Zhe, Ma Longfei, Liao Hongen, Zhang Daoqiang
Key Laboratory of Brain-Machine Intelligence Technology, Ministry of Education, Nanjing University of Aeronautics and Astronautics, Nanjing China; College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing China.
Key Laboratory of Brain-Machine Intelligence Technology, Ministry of Education, Nanjing University of Aeronautics and Astronautics, Nanjing China; College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing China.
Comput Biol Med. 2023 Sep;164:107248. doi: 10.1016/j.compbiomed.2023.107248. Epub 2023 Jul 25.
The security of AI systems has gained significant attention in recent years, particularly in the medical diagnosis field. To develop a secure medical image classification system based on deep neural networks, it is crucial to design effective adversarial attacks that can embed hidden, malicious behaviors into the system. However, designing a unified attack method that can generate imperceptible attack samples with high content similarity and be applied to diverse medical image classification systems is challenging due to the diversity of medical imaging modalities and dimensionalities. Most existing attack methods are designed to attack natural image classification models, which inevitably corrupt the semantics of pixels by applying spatial perturbations. To address this issue, we propose a novel frequency constraint-based adversarial attack method capable of delivering attacks in various medical image classification tasks. Specially, our method introduces a frequency constraint to inject perturbation into high-frequency information while preserving low-frequency information to ensure content similarity. Our experiments include four public medical image datasets, including a 3D CT dataset, a 2D chest X-Ray image dataset, a 2D breast ultrasound dataset, and a 2D thyroid ultrasound dataset, which contain different imaging modalities and dimensionalities. The results demonstrate the superior performance of our model over other state-of-the-art adversarial attack methods for attacking medical image classification tasks on different imaging modalities and dimensionalities.
近年来，人工智能系统的安全性受到了广泛关注，尤其是在医学诊断领域。要基于深度神经网络开发一个安全的医学图像分类系统，设计有效的对抗攻击至关重要，这种攻击能够将隐藏的恶意行为嵌入到系统中。然而，由于医学成像模态和维度的多样性，设计一种统一的攻击方法，使其能够生成具有高内容相似度且不可察觉的攻击样本，并应用于各种医学图像分类系统，具有很大的挑战性。大多数现有的攻击方法旨在攻击自然图像分类模型，通过应用空间扰动不可避免地破坏了像素的语义。为了解决这个问题，我们提出了一种基于频率约束的新型对抗攻击方法，该方法能够在各种医学图像分类任务中进行攻击。具体来说，我们的方法引入了频率约束，在保留低频信息以确保内容相似度的同时，将扰动注入高频信息。我们的实验包括四个公共医学图像数据集，一个3D CT数据集、一个2D胸部X光图像数据集、一个2D乳腺超声数据集和一个2D甲状腺超声数据集，这些数据集包含不同的成像模态和维度。结果表明，在针对不同成像模态和维度的医学图像分类任务进行攻击时，我们的模型比其他现有先进对抗攻击方法具有更优越的性能。
