Adversarial robustness of deep learning-based thyroid nodule segmentation in ultrasound

Summary

Researchers evaluated two black-box adversarial attacks against a U-Net model that segments thyroid nodules in B-mode ultrasound images, trained on cine-clips from 192 nodules. The spatial-domain attack SSAA reduced mean DSC from 0.76 to 0.47 while keeping SSIM at 0.94, and the frequency-domain attack FDUA reduced it to 0.65 (SSIM 0.82). Three inference-time defenses significantly recovered DSC against SSAA, with deterministic denoising giving the largest gain (+0.10), but none significantly improved results against FDUA.

Mitigation

The three inference-time mitigations evaluated were randomized preprocessing with test-time augmentation, deterministic input denoising, and stochastic ensemble inference with consistency-aware aggregation. They partially mitigated spatial-domain perturbations, but statistically significant DSC recovery was not demonstrated against frequency-domain perturbations.

Topics

• Adversarial machine learning

Related items

• InfoEvaluating Parameter-Efficient Fine-Tuning Attacks Against Non-Transferable Learning DefensesSimilar attack · Elsevier Security Journals
• InfoAnchored Rank-Adversarial Fine-Tuning Pretrained Visual Place Recognition ModelsSimilar attack · Arxiv (cs.RO + cs.CV security)
• InfoSay the Same, Act Differently: Diagnosing and Steering Text-Action Divergence in Reasoning VLAsSimilar attack · Arxiv (cs.RO + cs.CV security)
• InfoDetect, Repair and Audit: A Hierarchical Multi-Agent Defense Against Adversarial Attacks in Energy ForecastingSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoSANAI: Secure ECC Distributed Keyed Parity Embedded in Weights for Protecting Neural Networks against Bit-Flip AttacksSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)