<figure><img src="image_1.png" /></figure>

HAL
open science

# Pre-trained Model Robustness Against GAN-Based Poisoning Attack in Medical Imaging Analysis

Pakpoom Singkorapoom, Suronapee Phoomvuthisarn

► To cite this version:

Pakpoom Singkorapoom, Suronapee Phoomvuthisarn. Pre-trained Model Robustness Against GAN-Based Poisoning Attack in Medical Imaging Analysis. 19th IFIP International Conference on Artificial Intelligence Applications and Innovations (AIAI), Jun 2023, León, Spain. pp.302-313, 10.1007/978-3-031-34111-3_26. hal-05449813

HAL Id: hal-05449813

https://inria.hal.science/hal-05449813v1

Submitted on 9 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_3.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Pre-trained Model Robustness Against GAN-Based Poisoning Attack in Medical Imaging Analysis

Pakpoom Singkorapoom and Suronapee Phoomvuthisarn(✉)

Department of Statistics, Chulalongkorn University, Bangkok, Thailand
pakpoom.singkora@gmail.com, suronapee@cbs.chula.ac.th

**Abstract.** Deep learning revolutionizes healthcare, particularly in medical image classification, with its analysis performance aided by public architectures and transfer learning for pre-trained models. However, these models are vulnerable to adversarial attacks as they rely on learned parameters, and their unexplainable nature can make it challenging to identify and fix the root cause of the model after an attack. Given the increasing use of pre-trained models in life-critical domains like healthcare, testing their robustness against attacks is essential. Evasion and poisoning attacks are two primary attack types, with poisoning attacks having a broader range of poison sample-generating methods, making testing model robustness under them more critical than under evasion attacks. Poisoning attacks do not require an attacker to have a complete understanding to corrupt the model, making them more likely to occur in the real world. This paper evaluates the robustness of the famous pre-trained models trained as binary classifiers under poisonous label attack. The attacks use GANs to generate mislabeled fake images and feed poison samples to the model in a black box manner. The amount of performance degradation using classification metrics evaluates the model's robustness. We found that ConvNeXt architecture is the most robust against this type of attack, suggesting that transformer architecture can be used to build a more robust deep-learning model.

**Keywords:** adversarial machine learning · poisoning attack · medical image classification · generative adversarial networks (GANs)

## 1 Introduction

We have seen tremendous development in deep learning-powered applications in almost every field of business in the past few years. Healthcare and the medical field have also benefitted from this rise for some time. Nevertheless, a thorough analysis of the model's robustness and security must be considered for life-critical applications. The topic of adversarial attacks in deep learning has been a concern in the research field since the discovery of [1]. “Adversarial examples,” tiny input modifications imperceptible to humans, can cause neural networks to make prediction errors, posing security risks for machine
learning due to the unpredictable behavior they cause. In healthcare, medical images acquired from different modalities, such as X-ray radiography, computed tomography (CT), and magnetic resonance imaging (MRI), are crucial in healthcare data analysis as they serve as the essential source of data, accounting for 90% [2] and provide important anatomical information used in the detection/localization and diagnosis of abnormalities [3]. However, recent research has revealed that medical images can be susceptible to modification and utilized in adversarial attacks, which raises significant concerns regarding the use of such technology in applications that impact human lives [4].

An adversarial attack against the model's security aspect can be divided into two types of attacks, evasion attack, and poisoning attack [5–8]. The evasion attack occurs during the inference phase of the model life cycle, where we want to use the model to predict unseen samples, whereas poisoning attack occurs in the training phase. While an evasion attack solely affects prediction results, a poisoning attack can potentially modify the learning process and produce a suboptimal classifier due to the insertion of contaminated samples. The attacker may use different methods to generate poisoned samples, including advanced deep learning technologies such as generative adversarial networks or GANs [9–12] frequently employed in medical data augmentation [13–16]. This type of attack can be executed with limited knowledge about the target model. Furthermore, the attacker may take advantage of the necessity to update or retrain an existing model by surreptitiously introducing poison samples into the system [3, 7] without the requirement to directly manipulate the samples, as is the case with evasion attacks. In light of these factors, poisoning attacks pose a more significant threat to healthcare than evasion attacks.

In this paper, we conduct an experiment to study the robustness of various deep learning pre-train models in medical image classification against a poisoning attack. First, we consider the poisonous label attack scheme proposed by [17], a black box attack that uses GANs to generate fake images and mislabel them from the true class label. The black-box attack is more realistic than the white-box attack, requiring only limited knowledge about the dataset. Next, we simulate the attack on five different binary classifiers and find that the ConvNeXt architecture is the most robust, while VGG16 is the weakest. This paper's contribution is the demonstration that advanced pre-trained deep learning models can be vulnerable to attacks, especially in healthcare. This highlights the need for robust and secure medical image classifiers that can resist such attacks. The suggested models in this study serve as a starting point for developing more reliable and secure classifiers, ultimately enhancing patient care and safety.

## 2 Related Work

Existing research has identified two types of adversarial attacks depending on the timing of the attack: evasion and poisoning attacks. In evasion attacks, the attacker manipulates the input to the model during inference time by adding a carefully crafted perturbation, leading to incorrect predictions. For instance, in [18], the author demonstrates that GoogLeNet misclassifies a perturbed panda image as a gibbon with high confidence. On the other hand, a poisoning attack occurs during the training or update phase, whereby the attacker creates poison samples that look realistic but typically with inconsistent
labels, leading to changes in decision boundaries [5, 7]. These attacks can be further categorized into white-box and black-box attacks. In white-box attacks, the attacker is assumed to understand the target model, which is unrealistic, but developers can use this setting to test the worst-case performance of the target model. Whereas a black-box attack does not require an attacker to have complete information about the system, only the input and output formats of the target system are sufficient [5]. In healthcare, poisoning attacks are more relevant than evasion attacks because poisoning attacks only need an attacker to stealthily add poison samples to the dataset compared to direct manipulation of unseen samples at the inference time of evasion attacks which could require more skill and effort of an attacker [3]. Additionally, an attacker can launch poisoning attacks using various methods of poison sample generation, which can increase the chance of the attack's success and affect the entire learning process, resulting in a poor classifier. In contrast, evasion attacks rely on adding perturbations to inference samples and only affect the prediction result.

There have been many studies on poisoning attacks in deep neural networks. In one study [19], the authors investigated poisoning attacks in three tasks: sample and malware detection and hand digit recognition. They proposed a back gradient optimization algorithm that can trace the gradient computation process and solve the bi-level optimization problem to obtain poison samples that can degrade the performance of the target model. In spam and malware detection, they showed that the test set error rate of one-layer neural networks with ten neurons could be increased up to 25% in a white-box attack setting. However, the method slightly increased classification errors in handwritten digit recognition using CNN as the target model. The authors in [9] proposed a solution to the computational intensity issue of [19] by utilizing generative adversarial networks with an autoencoder as the generator and the target model serving as the discriminator. They experimented with MNIST and CIFAR-10 datasets, using a two-layer feed-forward neural network and the LeNet model as the target models. They achieved at least a 16.59% decrease in accuracy for the two-layer feed-forward neural network on MNIST and a 20.74% decrease in accuracy for the LeNet model on CIFAR-10, with a 200-fold improvement in poison generation time. Although these methods are effective, their white-box nature is also a drawback. In contrast, the authors in [17] proposed a poisonous label attack method that uses DCGAN with reconstruction loss to generate poison samples that look realistic and are mislabeled with a probability transition vector. This method was tested on the MNIST dataset with a LeNet model, resulting in a 65.4% decrease in accuracy after injecting 900 poison samples. Although this result is slightly worse than the previous two studies, the poisonous label attack is a black-box attack, making it more realistic and easier to deploy in real-world applications.

Although the experiments discussed used deep neural networks, the methods described so far report their results with standard datasets, e.g., MNIST, and CIFAR-10, which are not representative of real-world or healthcare-domain datasets. Also, the target model architecture used in these experiments is relatively simple and not state-of-the-art. The study [20] conducted an algorithm-independent poisoning attack on five healthcare tabular datasets and six machine learning algorithms, including multilayer perceptrons (MLPs). By adjusting the degree of performance degradation, poison samples were added to the dataset and were shown to compromise the performance of the models. The
study found that adding 30% poison samples to the training data led to a 20% and 26% decrease in accuracy for the thyroid disease and breast cancer datasets when used to train MLPs, respectively. Other studies [4, 21] demonstrated the susceptibility of deep learning pre-trained models in healthcare and medical images. [4] explained that pre-trained models in this domain are uniquely susceptible to these attacks due to monetary incentives and technical vulnerability. They stated that the ground truth in this domain is often ambiguous and that without the eyes of the expert, it is almost impossible to diagnose data correctly, and if a malicious attacker perturbs data even the expert may have a tough time. Moreover, medical images are highly standardized compared to raw images because these images are captured by pre-defined and well-established positioning and exposure. This high-standard property is the potential to be attacked because the dynamic nature of natural images can mitigate the effects of the attack. They also demonstrated the attack across three datasets, i.e., diabetic retinopathy, pneumothorax chest x-ray, and dermoscopic melanoma photographs, against ResNet50 architecture and reported that the attacks could completely fool the model. Under three white and black box attack types, [21] analyzed two CNN models trained on the chest x-ray dataset against Inception-ResNet-V2 and Nasnet-Large. The result is not entirely different from previous works. Although [4, 21] have shown that deep learning pre-trained models used in medical image classification can be compromised, they only studied evasion attacks, which we believe will have less impact than poisoning attacks in the healthcare domain, as we stated before. This paper explores the impact of error-generic performance degradation caused by a black box poisoning attack, specifically a poisonous label attack. We conduct experiments using five binary deep learning classifiers trained on a chest x-ray images dataset and investigate how each model's performance changes due to poison samples injected during update time.

# 3 Methods

## 3.1 Overview

<figure><img src="image_4.png" /><figcaption>Fig. 1. Overview of the experiment</figcaption></figure>

The experimental framework is illustrated in Fig. 1. Initially, a dataset is collected, and a training set is used to train five binary classifiers. Next, GANs are also trained using the training set. Then, the generator component of GANs is extracted to generate fake images with mislabeled attributes. Poison samples are then applied to update the trained classifiers. Afterward, performance degradation data is gathered and plotted to visualize the results.
## 3.2 Dataset

We use the chest x-ray dataset from [22], which contains chest x-ray images of three classes, including covid-19, pneumonia, and normal lung. Since we focused on binary classifiers, we used only pneumonia and normal images. The dataset consists of 14,507 images for training, with 6,849 images depicting normal lungs and 7,208 images depicting pneumonia. The dataset also contained 3,514 validation images, including 1,712 normal lung images and 1,802 pneumonia images, and 4,393 test images, comprising 2,140 normal lung images and 2,253 pneumonia images. All images were preprocessed and scaled to 128 x 128 pixels, and the dataset did not exhibit any signs of class imbalance.

## 3.3 Models

To evaluate the robustness of models, we trained five deep learning pre-trained models as binary classifiers: VGG16, ResNet50V2, MobileNetV2, InceptionV3, and ConvNetX-Tiny. These models differ in various aspects, such as architecture, number of layers, number of learned parameters, technique employed, and hyperparameters, and should behave differently under attack. We hypothesize that VGG16 may suffer the most because of its simple architecture of stacking convolution layers. Next, each model was trained consistently using transfer learning. We used parameters learned from the ImageNet dataset and replaced the old classifier portion with our new classifier. We used Adam optimizer with a learning rate of 0.0001 and batch size of 64, and an early stopping strategy to halt training before overfitting. Once all models were trained, we fine-tuned the weight of each network by unfreezing all weights and trained each network for another 16 epochs using a small learning rate of 0.00001 [23]. In these 16 epochs, we only saved the model that achieved the best validation metric for each architecture.

## 3.4 Attack Method

In this study, we use a poisonous label attack purposed by [17] as an attack method. The poisonous label attack is a black box, meaning the attacker does not need complete information about the attacked or victim model. It is also a performance degradation type that aims to cause classification errors. Initially, this attack is targeted, which means it aims to cause misclassification on a specific set of samples but can be adjusted to attack indiscriminately. It is also error-generic that will have samples misclassified as any other class except the actual class. This attack is feasible because conditional GANs [24] generate fake images for each class and a probability transition vector to mislabel those images from the true class. We also use the FID score [25] to evaluate the quality of generated images.

First, we build a conditional DCGAN [26] to generate fake images of normal and pneumonia lungs. In this process, we build the conditional DCGAN using only training data to prevent GANs from learning information about the image in the validation set and test set. We use the architecture of the generator and discriminator proposed in [15] as our initial idea and make modifications. As reported in [17, 27], adding reconstruction loss to the GANs' primary objective function can improve the quality of the generated image, so we mount L1 reconstruction loss to it. We also employ a two-time scale update
rule [25], which uses different learning rates in the generator and discriminator and can stabilize the training process. For the generator, we use a learning rate of 0.0001, and for the discriminator, we use a learning rate of 0.0003. In the generator, instead of using a convolutional transpose layer as in [26], we use a convolutional layer along with the nearest neighbor upsampling method, which can reduce the checkerboard artifact in generated images [28]. To make DCGAN conditional as described in [24], we use an embedding layer to transform the integer representing the label to a matrix and pass this matrix along with the corresponding image. In training time, we train our networks for 200 epochs and use a batch size of 16. For every five epochs, we compute the FID score, a metric measuring distance between data distribution and generated distribution. The FID score is the most popular metric for evaluating the quality of generated images; the lower the score the better the quality. In our work, we use the FID implementation of [29] which takes into account the effect of resizing images before feeding them to InceptionV3 network. For each FID computation, we compute three values of FID due to the random property of input to the generator using an equal number of images between images in the training data of two classes and generated data and take the average of three values. Figure 2 shows the average FID score for every five epochs.

<figure><img src="image_5.png" /><figcaption>Fig. 2. The average FID score for every five epochs in training.</figcaption></figure>

Once the training is finished, we investigate the epoch with the lowest average FID score and find that at the end of epoch 165th, the average FID score is 33.58. Therefore, we save the generator at this epoch and use it in the attacking experiment. Figure 3 shows examples of generated images of normal and pneumonia lungs from our 165th epoch generator.

After we have obtained the generator, another part of the poisonous label attack is mislabeling these generated samples. In [17], the authors use the probability transition vector or poisoning vector called by the authors. The poisoning vector has two versions: the symmetric and asymmetric poisoning vectors. The probability of the symmetric poisoning vector is a uniform distribution that changes the label of generated samples to other labels randomly and uniformly. In contrast, the probability distribution of the asymmetric poisoning vector is a two-point distribution that alters the label of generated
<figure><img src="image_6.png" /><figcaption>Fig. 3. Example of images generated by conditional DCGAN.</figcaption></figure>

samples to a single label different from the ground truth label. In this case, we only consider the asymmetric poisoning vector reported by the authors to be more aggressive than the symmetric poisoning vector. As our five victim models mentioned in Sect. 3.2 are binary classifiers, we only swap the label of these two classes so that after we create fake typical lung images with 0 as the ground truth label, we will change it to 1 and vice versa for fake pneumonia images.

# 4 Result

## 4.1 Performance Evaluation

Before we perform the attack experiment, we evaluate the test set performances of our models using the following classification metrics: accuracy, sensitivity, and specificity. The result is shown in Table 1.

For the attack experiment, we updated our models with poison samples generated by conditional DCGAN. We first generated 32 images of normal and pneumonia lungs, 64 images in total which equate to our train batch size, and mislabeled them as described in Sect. 3.3. We then fed these poison samples to our models using the same learning as a training phase. We only update our models with less than 14,000 poison samples as 14,000 is roughly our training data size, and for each model, we repeated the update
<table><caption>**Table 1.** Test set performances for three classification metrics of models</caption><thead><tr><td>Model</td><td>Accuracy</td><td>Sensitivity</td><td>Specificity</td></tr></thead><tbody><tr><td>VGG16</td><td>0.9463</td><td>0.9387</td><td>0.9542</td></tr><tr><td>ResNet50v2</td><td>0.9313</td><td>0.9387</td><td>0.9234</td></tr><tr><td>MobileNetv2</td><td>0.9360</td><td>0.9316</td><td>0.9406</td></tr><tr><td>InceptionV3</td><td>0.9367</td><td>0.9348</td><td>0.9388</td></tr><tr><td>ConvNext-Tiny</td><td>0.9369</td><td>0.9243</td><td>0.9489</td></tr></tbody></table>

three times to get the average value of performance drop. Figures 4, 5 and 6 show the performance drop trends for each model's classification metric.

<figure><img src="image_7.png" /><figcaption>**Fig. 4.** Average accuracy drops for each model</figcaption></figure>

<figure><img src="image_8.png" /><figcaption>**Fig. 5.** Average sensitivity drops for each model</figcaption></figure>
<figure><img src="image_9.png" /><figcaption>**Fig. 6.** Average specificity drops for each model</figcaption></figure>

From Fig. 4, 5, 6, we can see that in terms of accuracy and sensitivity, ConvNeXt-Tiny is the most robust model against the poisonous label attack, followed by the ResNet50V2. As we hypothesized, the VGG16 model cannot restrain the poisonous label attack's effect. Figure 5 also shows that all models tend to suffer in predicting negative class as all lines go down rapidly when the number of poison samples is around 2,000. There is an interesting behavior in Fig. 5 where poison samples can help improve the sensitivity of models, but as the number of poison samples increases, the performance still decreases.

## 4.2 Discussion

The architecture of ConvNeXt, as described in the paper [30], closely resembles that of ResNet. However, the authors incorporate various techniques from Swin Transformer into the ResNet body, which may explain why ResNet50V2 performs as the second-best model in our experiment. As ConvNeXt employs Swin Transformer technology, we can infer that Transformer technology may help alleviate the impact of poison samples and may be more secure than the traditional convolutional neural network approach. Furthermore, both ConvNeXt and ResNet50V2 share a dominant characteristic: the residual connection that can contribute to the model's robustness. As demonstrated in Fig. 6, our experiments on a binary chest x-ray classification task show that a poisoning attack can significantly increase false positives, leading to a sudden drop in specificity scores. This result highlights the vulnerability of deep learning models to poisonous label attacks, even when using well-established architectures like ResNet50V2 and ConvNeXt. However, it is worth noting that the effect of increasing false negatives is not as pronounced, even though the attack still successfully degrades the model's sensitivity.

We have demonstrated that deep learning pre-trained models are susceptible to poisoning attacks, specifically the poisonous label attack. Our approach differs from prior works in that we have evaluated these attacks on modern and state-of-the-art model architectures using a real-world dataset from the healthcare domain. The findings of this study have significant implications for the medical community, as the results highlight the importance of developing robust medical image classifiers resistant to adversarial attacks. Furthermore, our suggested models can serve as a starting point for researchers
and practitioners to develop more secure and reliable medical image classifiers, which
can ultimately improve patient care and safety.

5 Conclusion and Future Work

In this paper, we conduct an experiment showing that the poisonous label attack can compromise various CNN models used for medical image classification tasks. We use conditional DCGAN with an average FID score of 33.58 to generate fake images of normal and pneumonia lungs. After that, we update the five-trained CNN model with generated images with the wrong label and observe the performance degradation. We found that ConvNeXt is the most robust model among five others, followed by Resnet50v2. These might suggest that the technology in the Transformer and residual connection, the main characteristic of convnext and resnet, can be adapted to create a more secure classification model in the medical images domain, and the simple architecture of stacking convolution layers model like VGG16 should be avoided.

In the future, with more time and resources, we could try experimenting with more
types of attacks, e.g., targeted poisoning attack and back door attack, and we could
use the SOTA models in the medical image domain and also general SOTA models for
example, Swin Transformer, Vision Transformer, and other attention-based models as
our victim model. Additionally, it is worthwhile to explore the model's interpretability
under attacks, such as evaluating the effect of attacks on Grad-CAM's visualization or
Transformer's attention maps.

References

1. Szegedy, C., et al.: Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 (2013)

2. Zhou, S.K., et al.: A review of deep learning in medical imaging: Imaging traits, technology trends, case studies with progress highlights, and future promises. Proc. IEEE 109(5), 820–838 (2021)

3. Qayyum, A., et al.: Secure and robust machine learning for healthcare: a survey. IEEE Rev. Biomed. Eng. 14, 156–180 (2020)

4. Finlayson, S.G., et al.: Adversarial attacks against medical deep learning systems. arXiv preprint arXiv:1804.05296 (2018)

5. Bae, H., et al.: Security and privacy issues in deep learning. arXiv preprint arXiv:1807.11655 (2018)

6. Biggio, B., Roli, F.: Wild patterns: ten years after the rise of adversarial machine learning. Pattern Recogn. 84, 317–331 (2018)

7. Liu, Q., et al.: A survey on security threats and defensive techniques of machine learning: a data driven view. IEEE access 6, 12103–12117 (2018)

8. Liu, X., et al.: Privacy and security issues in deep learning: a survey. IEEE Access 9, 4566–4593 (2020)

9. Yang, C., et al.: Generative poisoning attack method against neural networks. arXiv preprint arXiv:1703.01340 (2017)

10. Shi, Y., et al.: Generative adversarial networks for black-box API attacks with limited training data. In: 2018 IEEE International Symposium on Signal Processing and Information Technology (ISSPIT). IEEE (2018)
11. Muñoz-González, L., et al.: Poisoning attacks with generative adversarial nets. arXiv preprint arXiv:1906.07773 (2019)

12. Kasichainula, K., Mansourifar, H., Shi, W.: Poisoning attacks via generative adversarial text to image synthesis. In: 2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W). IEEE (2021)

13. Zhang, Q., et al.: Medical image synthesis with generative adversarial networks for tissue recognition. In: 2018 IEEE International Conference on Healthcare Informatics (ICHI). IEEE (2018)

14. Bhagat, V., Bhaumik, S.: Data augmentation using generative adversarial networks for pneumonia classification in chest Xrays. In: 2019 Fifth International Conference on Image Information Processing (ICIIP). IEEE (2019)

15. Kora Venu, S., Ravula, S.: Evaluation of deep convolutional generative adversarial networks for data augmentation of chest x-ray images. Future Internet 13(1), 8 (2020)

16. Kim, D., Joo, J., Kim, S.C.: Fake data generation for medical image augmentation using GANs. In: 2022 International Conference on Artificial Intelligence in Information and Communication (ICAIIC). IEEE (2022)

17. Liu, H., Li, D., Li, Y.: Poisonous label attack: black-box data poisoning attack with enhanced conditional DCGAN. Neural Process. Lett. 53(6), 4117-4142 (2021). https://doi.org/10.1007/s11063-021-10584-w

18. Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)

19. Muñoz-González, L., et al.: Towards poisoning of deep learning algorithms with back-gradient optimization. In: Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security (2017)

20. Mozaffari-Kermani, M., et al.: Systematic poisoning attacks on and defenses for machine learning in healthcare. IEEE J. Biomed. Health Inf. 19(6), 1893-1905 (2015)

21. Taghanaki, S.A., Das, A., Hamarneh, G.: Vulnerability analysis of chest X-ray image classification against adversarial attacks. In: Stoyanov, Danail, Taylor, Zeike, Kia, Seyed Mostafa, Oguz, Ipek, Reyes, Mauricio, Martel, Anne, Maier-Hein, Lena, Marquand, Andre F., Duchesnay, Edouard, Löfstedt, Tommy, Bennett Landman, M., Cardoso, Jorge, Silva, Carlos A., Pereira, Sergio, Meier, Raphael (eds.) Understanding and Interpreting Machine Learning in Medical Image Computing Applications: First International Workshops, MLCN 2018, DLF 2018, and iMIMIC 2018, Held in Conjunction with MICCAI 2018, Granada, Spain, September 16-20, 2018, Proceedings, pp. 87-94. Springer International Publishing, Cham (2018). https://doi.org/10.1007/978-3-030-02628-8_10

22. Tahir, A.M., et al.: COVID-19 infection localization and severity grading from chest X-ray images. Comput. Biol. Med. 139, 105002 (2021)

23. Aggarwal, S., et al.: Automated COVID-19 detection in chest X-ray images using fine-tuned deep learning architectures. Expert. Syst. 39(3), e12749 (2022)

24. Mirza, M., Osindero, S.: Conditional generative adversarial nets. arXiv preprint arXiv:1411.1784 (2014)

25. Heusel, M., et al.: Gans trained by a two time-scale update rule converge to a local nash equilibrium. In: Advances in Neural Information Processing Systems, vol. 30 (2017)

26. Radford, A., Metz, L., Chintala, S.: Unsupervised representation learning with deep convolutional generative adversarial networks. arXiv preprint arXiv:1511.06434 (2015)

27. Isola, P., et al.: Image-to-image translation with conditional adversarial networks. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (2017)

28. Odena, A., Dumoulin, V., Olah, C.: Deconvolution and checkerboard artifacts. Distill 1(10): e3 (2016)
29. Parmar, G., Zhang, R., Zhu, J.-Y.: On aliased resizing and surprising subtleties in gan evaluation. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (2022)

30. Liu, Z., et al.: A convnet for the 2020s. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (2022)