Shanghai Institute for Advanced Study, Zhejiang University, Shanghai 201203, China; Joint NTU-UBC Research Centre Of Excellence In Active Living For The Elderly, NTU, 50 Nanyang Avenue, 639798, Singapore.
Department of Critical Care Medicine, Qilu Hospital of Shandong University, Jinan, Shandong 250012, China.
Comput Biol Med. 2023 Sep;164:107310. doi: 10.1016/j.compbiomed.2023.107310. Epub 2023 Jul 31.
Reliable skin cancer diagnosis models play an essential role in early screening and medical intervention. Prevailing computer-aided skin cancer classification systems employ deep learning approaches. However, recent studies reveal their extreme vulnerability to adversarial attacks - often imperceptible perturbations to significantly reduce the performances of skin cancer diagnosis models. To mitigate these threats, this work presents a simple, effective, and resource-efficient defense framework by reverse engineering adversarial perturbations in skin cancer images. Specifically, a multiscale image pyramid is first established to better preserve discriminative structures in the medical imaging domain. To neutralize adversarial effects, skin images at different scales are then progressively diffused by injecting isotropic Gaussian noises to move the adversarial examples to the clean image manifold. Crucially, to further reverse adversarial noises and suppress redundant injected noises, a novel multiscale denoising mechanism is carefully designed that aggregates image information from neighboring scales. We evaluated the defensive effectiveness of our method on ISIC 2019, a largest skin cancer multiclass classification dataset. Experimental results demonstrate that the proposed method can successfully reverse adversarial perturbations from different attacks and significantly outperform some state-of-the-art methods in defending skin cancer diagnosis models.
可靠的皮肤癌诊断模型在早期筛查和医学干预中起着至关重要的作用。现有的计算机辅助皮肤癌分类系统采用深度学习方法。然而，最近的研究表明，它们极易受到对抗攻击的影响——这些攻击通常是对皮肤癌诊断模型性能产生显著影响的难以察觉的干扰。为了减轻这些威胁，这项工作通过对皮肤癌图像中的对抗性扰动进行反向工程，提出了一种简单、有效且资源高效的防御框架。具体来说，首先建立一个多尺度图像金字塔，以更好地保留医学成像领域的有区分性结构。为了中和对抗性效应，然后在不同的尺度上逐步扩散皮肤图像，通过注入各向同性的高斯噪声来将对抗性示例移动到干净的图像流形上。至关重要的是，为了进一步反转对抗性噪声并抑制冗余注入的噪声，我们精心设计了一种新颖的多尺度去噪机制，该机制从相邻尺度聚合图像信息。我们在 ISIC 2019 上评估了我们方法的防御效果，这是一个最大的皮肤癌多分类数据集。实验结果表明，所提出的方法可以成功地从不同的攻击中反转对抗性扰动，并在防御皮肤癌诊断模型方面明显优于一些最先进的方法。
