<figure><img src="image_1.png" /></figure>

HAL
open science

# Robust Neural Architecture Search Using Differential Evolution for Medical Images

Muhammad Junaid Ali, Laurent Moalic, Mokhtar Essaid, Lhassane Idoumghar

► To cite this version:

Muhammad Junaid Ali, Laurent Moalic, Mokhtar Essaid, Lhassane Idoumghar. Robust Neural Architecture Search Using Differential Evolution for Medical Images. International Conference on the Applications of Evolutionary Computation (Part of EvoStar), Apr 2024, Aberystwyth, United Kingdom. pp.163-179, 10.1007/978-3-031-56855-8_10. hal-04985553

HAL Id: hal-04985553

https://hal.science/hal-04985553v1

Submitted on 11 Mar 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Robust Neural Architecture Search using
Differential Evolution for Medical Images

Muhammad Junaid Ali¹ * †, Laurent Moalic² †, Mokhtar Essaid³ †, and Lhassane Idoumghar⁴ †

¹muhammad-junaid.ali@uha.fr ²laurent.moalic@uha.fr ³mokhtar.essaid@uha.fr

⁴lhassane.idoumghar@uha.fr

† Université de Haute-Alsace, IRIMAS UR 7499, F-68093 Mulhouse, France

**Abstract.** Recent studies have demonstrated that Convolutional Neural Network (CNN) architectures are sensitive to adversarial attacks with imperceptible permutations. Adversarial attacks on medical images may cause manipulated decisions and decrease the performance of the diagnosis system. The robustness of medical systems is crucial, as it assures an improved healthcare system and assists medical professionals in making decisions. Various studies have been proposed to secure medical systems against adversarial attacks, but they have used handcrafted architectures. This study proposes an evolutionary Neural Architecture Search (NAS) approach for searching robust architectures for medical image classification. The Differential Evolution (DE) algorithm is used as a search algorithm. Furthermore, we utilize an attention-based search space consisting of five different attention layers and sixteen convolution and pooling operations. Experiments on multiple MedMNIST datasets show that the proposed approach has achieved better results than deep learning architectures and a robust NAS approach.

**Keywords:** Differential Evolution · Evolutionary AutoML · evolutionary NAS · Neural Architecture Search

# 1 Introduction

Deep Neural Networks (DNNs) have been widely used to solve medical imaging tasks, such as classification, localization, registration, and segmentation [4] [26]. The robustness of these systems is crucial to secure them from vulnerability issues [2]. The latter can be caused by adversarial attacks, which are deliberate attempts to deceive or manipulate a machine-learning model by adding perturbations to the input data [9]. The real-life threats of these attacks are considered essential; for instance, in medical systems, they can exhibit misleading diagnostic outcomes.

Different types of adversarial attacks include black-box, white-box, and targeted attacks. In a black-box attack, the attacker cannot access the model parameters as it generates adversarial images without knowledge of the model.

<footnote>* Corresponding author</footnote>
However, in white-box attacks, the attacker can access the model parameters. Furthermore, targeted attacks aim to cause the model to predict incorrect class labels [5]. Some of the famous adversarial attack techniques are the Fast Gradient Sign Method (FGSM) [6], Projected Gradient Descent (PGD) [7] and their different variants. PGD is a powerful adversarial attack that uses randomized initialization and multi-step attacks to perturb input data iteratively along the gradient's direction, aiming to find effective adversarial examples. Following the same context, FGSM is a one-step adversarial attack that perturbs the input data by adding little noise in the direction.

For effective defense mechanisms against adversarial attacks, numerous approaches have been proposed in the literature, such as adversarial training [11] [13], Denoising Convolutional Neural Networks (DCNN)'s [12], model ensemble techniques [10]. These approaches aim to enhance the robustness of deep learning models against adversarial perturbations. While adversarial robustness methods enhance a model's robustness against adversarial attacks, they may reduce performance on clean(original and unaltered) data samples due to overfitting towards adversarial examples.

Moreover, these techniques use hand-crafted architectures. Recent studies have shown that the choice of deep learning architecture directly impacts the performance of adversarial training [15]. Manual designing of deep learning architectures is a complex and time-consuming task. Neural Architecture Search (NAS) overcomes this problem by automatically searching for an efficient architecture for a specific task. Evolutionary NAS approaches are effective in the automated search of robust architectures for image classification [3]. These approaches efficiently search for robust and lightweight architectures. In these studies, each sampled architecture is trained with adversarial training and evaluated on accuracy scores obtained after applying different adversarial attacks on the validation set [3][20] [24] [25].

Studies have shown that DNNs trained on medical images can be more vulnerable to adversarial attacks than natural images. One of the main reasons is due to the complex biological textures in medical images, which may lead to more vulnerable regions, and deep neural networks designed for large-scale natural images can be overparametrized for medical image tasks, which leads to high vulnerability to adversarial attacks [19] [1]. Therefore, there is a need for a separate adversarial NAS approach for medical images that focus only on medical images. A specific DNN learned on medical image data may be more robust against perturbations than existing deep learning architectures.

Motivated by the above studies, we have proposed an evolutionary approach for searching robust architectures against adversarial attacks on medical images. This study is about the architectural perspective of adversarial robustness for medical images. Besides, it shows how evolutionary approaches can be helpful to search for an architectural topology that is both lightweight and robust against adversarial attacks. We used Differential Evolution (DE) as a search algorithm for our proposed approach. The motivation behind adopting DE as a search algorithm is its simplicity and effectiveness in population explorations. It has been
widely adopted by different studies and achieved state-of-the-art performance on various tasks [36] [35] [34][33] [32]. In summary, the main contributions of this paper are as follows:

- We have proposed an approach for automatically searching robust architectures against adversarial attacks for medical images using an evolutionary algorithm.

- A fitness function is designed to aggregate the accuracy scores from multiple adversarial attacks.

- We designed an attention-based search space consisting of multiple convolution and pooling layers and different attention layers.

The rest of the article is structured as follows. Section 2 discusses the related work. We present the proposed methodology in section 3. Section 4 discusses the results and experimental settings. Finally, we conclude this study in section 5.

## 2 Related Work

Numerous studies have been proposed to defend deep learning models against adversarial attacks on medical images, specifically for medical image classification tasks [37] [38] [39] [40] [41]. These studies have compared the performance of different Convolutional Neural Network (CNN) architectures under adversarial attacks. A study by Hirano et al. proposed to evaluate the vulnerability of seven CNN models on medical image classification task. They have performed experiments on three medical image datasets (skin cancer, pneumonia classification, and diabetic retinopathy) against Universal Adversarial Attack (UAP) [40].

Moreover, Ma et al. compared the responses of natural and medical images on adversarial perturbations, finding that medical images are more vulnerable due to their complex biological structures and unique properties [19]. Similarly, Xu et al. conducted experiments on three models in multi-label, multi-class, and binary classification tasks, finding that models are unreliable when subjected to adversarial examples [41]. They also developed two types of defense techniques for dealing with adversarial instances. Denoising operations are also found to be quite effective against adversarial attacks. Xue et al. proposed enhancing the denoising ability of CNN classifiers for medical image classification using an auto-encoder to make the model robust against adversarial attacks [12].

Furthermore, various countermeasures have also been proposed to enhance the resilience of deep learning architectures against adversarial attacks. The most effective and popular defense technique is adversarial training. It improves the model's robustness by adding adversarial examples during the training [6] [7]. In adversarial training, adversarial examples are fed to the network during training to increase its robustness against these attacks. Multiple studies have been proposed to improve the adversarial training process for increasing the robustness accuracy [16] [17][18]. Adaptive adversarial training is also proposed, which uses a loss-defined margin to overcome performance degradation caused by high noise levels [11]. During adversarial training, the most widely used method
is to replace the input data or combine it with adversarial examples generated by PGD to make the architecture more resilient to other attacks [7]. It was noticed that Defensive distillation is only effective when dealing with some gradient-based attack methods such as FGSM and PGD [31].

Similarly, obfuscated gradient only resists specific gradient-based attacks, as it does not enhance the robustness of architecture [28]. Adversarial training is the most effective approach for defense against adversarial attacks [42]. However, the performance of adversarial training is also dependent on the network architecture [27]. As manually designing a neural network architecture is difficult, NAS overcomes the issue by automatically searching an architecture topology. Therefore, adopting NAS for building robust architectures would be helpful. Accordingly, a variety of robust NAS approaches have been proposed to automatically search for adversarial robust architectures for image classification [14] [24] [25]. These approaches achieve robustness from an architectural design perspective.

Studies have shown that medical images exhibit certain characteristics different from natural images and are more sensitive against adversarial attacks [8]; therefore, there is a need for an adversarial NAS approach specifically designed for medical images. To the best of our knowledge, there are no previous studies for searching robust architectures against adversarial attacks in medical images. This study aims to automatically search for a robust, resilient architecture against multiple adversarial attacks by leveraging an evolutionary search approach and adversarial training.

# 3 Proposed Methodology

This section presents the overall methodology of the proposed approach to search for robust architectures against adversarial attacks on medical images. The overview of the proposed framework is shown in Figure 1. The proposed NAS-based framework consists of three main steps: (i) population initialization, (ii) crossover and mutation operations, and (iii) fitness evaluation.

The individual network is represented using a vector consisting of continuous and discrete values of fixed length as a genotype. The proposed approach directly applies the reproduction operators on the genotype while decoding the genotype only for evaluation purposes. The cost of each architecture is computed using the proposed fitness function, and the search algorithm maximizes the fitness to search for new architecture with better robustness. Instead of simple training, the individual neural networks are trained with adversarial training.

## 3.1 Search Space Design

In this study, we have used cell-based search space for our NAS approach, in which the neural network architecture is constructed using a set of repeating modules or “cells” [23] [21]. Each cell consists of several layers and their connections. This search space is frequently adopted by different studies thanks to its simplicity and flexible nature, which makes it easy to modify. This search space
<figure><img src="image_3.png" /><figcaption>Fig. 1: System diagram of the proposed methodology</figcaption></figure>

is frequently adopted by different studies thanks to its simplicity and flexibility, making it easy to modify. This search space categorizes the cells into two different types: normal and reduction cells. The normal cells process the input and keep the same resolution of the feature map. In contrast, the reduction cell

<figure><img src="image_4.png" /><figcaption>Fig. 2: Operations and attention layers used in the search space to design CNN architectures</figcaption></figure>

reduces the feature map's resolution using down-sampling operations such as pooling and stride-2 convolution. The network is formed by stacking these cells one after another. Each cell consists of several predefined operations. Figure 3 shows a visual example of cell-based search space. This study uses 16 different operations and 5 different attention layers, as shown in Figure 2. We have used these attention layers from the Attention-DARTS [29] study. This latter proposed to search attention layers along convolution and pooling operations. The objective is to use each attention layer after the candidate operation to focus
more on salient regions. Various efficient and lightweight CNN components from

<figure><img src="image_5.png" /><figcaption>Fig. 3: An example of proposed search space utilized in this approach. Left: The full structure of the architecture consists of normal and reduction cells. Right: Example of cell build using proposed encoding scheme</figcaption></figure>

different architectures, such as MobileNet, OctoveNet, and InceptionNets, are selected in our search space. These operations consist of dilated convolution, mobile convolution block, octave convolutions, separable convolutions, and inverted residual blocks with different kernel sizes. Moreover, five different kinds of attention layers were used. They are applied after each operation. Studies have shown that attention-based models are more robust against adversarial attacks [30]. These layers include Squeeze and Excitation (SE), Gather-Excite (GE) Attention, Bottleneck Attention Module (BAM), Convolution Bottleneck Attention Module (CBAM), and Double Attention (DA) blocks.

## 3.2 Encoding Scheme

In the search space, each candidate operation is represented by a real value between 0 and 1, while a value between 1 and 5 represents the associated attention layer, mapping to different attention types. Figure 4 shows an encoding scheme's visual representation. Each value of the encoding vector corresponds to a tuple consisting of a real value representing some network operation and an attention layer represented by an integer value. Similarly, each value of the decoding vector represents a tuple consisting of an operation and an attention layer defined in the search space (convolution or pooling layers), as illustrated above.

The mapping of an encoding vector $\bar{E}$ to a decoding vector $\bar{D}$ in this approach is given as:

$$ \bar{E} = [(e_1, a_1), (e_2, a_2), (e_3, a_3), (e_4, a_4), \dots, (e_n, a_n)] \qquad (1) $$
<table><caption>(a) Genotype Representation</caption><tr><td>0.15394,3</td><td>0.73577,3</td><td>0.01724,1</td><td>0.07689,5</td><td>0.89058,0</td><td>0.37734,2</td><td>0.00395,3</td><td>0.70345,4</td></tr><tr><td>0.69953,4</td><td>0.13817,0</td><td>0.56487,4</td><td>0.98290,3</td><td>0.59894,4</td><td>0.80453,1</td><td>0.39271,2</td><td>0.09398,2</td></tr></table>

<table><caption>(b) Phenotype Representation</caption><thead><tr><th>Skip Connection,CBAM</th><th>Octave Conv 5x5,CBAM</th><th>MaxPool 3x3,5E</th><th>AvgPool 3x3,Double Attention</th><th>MBConv 5x5 1E, Identity</th><th>DICConv5x5,BAM</th><th>MaxPool3x3,CBAM</th><th>Octave Conv 5x5,GE_ theta plus</th></tr></thead><tbody><tr><td>Octave Conv 5x5,GE_ theta plus</td><td>Skip Connection,Identity</td><td>Inverted Residual 5x5, GE_ theta plus</td><td>MBConv 3x3 1E,CBAM</td><td>Inverted Residual 5x5,GE_ theta plus</td><td>Octave Conv 3x3,5E</td><td>DilatedConv 5x5, BAM</td><td>Avg Pool 3x3, BAM</td></tr></tbody></table>

<caption>Fig. 4: Genotype and phenotype representation of individuals consisting of 8 genes</caption>

Where the operation gene $e_i$ and attention gene $a_i$ are defined as:

$$e_i = P_{ri} \qquad \text{where } 0 \le P_{ri} \le 1 \quad (2)$$

$$a_i = R_{ri} \qquad \text{where } 1 \le R_{ri} \le 5 \quad (3)$$

$P_r$: Random probability value for each candidate convolution or pooling operation

$R_r$: Random value for each attention operation

$A_r$: Total number of available attention operations

$O_N$: Total number of available convolution or pooling operations

The decoding vector is given as:

$$\bar{D} = [d_1, d_2, d_3, d_4, \dots, d_n] \qquad (4)$$

Each gene of a decoded individual represents:

$$d_i = (\text{Operations}[[O_N \times e_i]]], \text{Attentions}[a_i])$$

## 3.3 Fitness Function

This study proposes a fitness function to evaluate an individual's robustness against multiple adversarial attacks. The fitness function consists of the harmonic mean of the accuracy scores of three different adversarial attacks (FGSM, Basic Iterative Method (BIM), and PGD) as a measure to evaluate the performance of an individual. The model's predictions are computed using perturbed validation data to compute these accuracy scores. The intuition behind using harmonic mean is to keep the fitness function having non-zero values. The fitness function is given as:

$$FitnessFunction = \frac{3}{\frac{1}{A_{FGSM}} + \frac{1}{A_{PGD}} + \frac{1}{A_{BIM}}} \qquad (5)$$

Where $A_{FGSM}$, $A_{PGD}$, and $A_{BIM}$ are the accuracy scores on the searched model after applying FGSM, PGD, and BIM attacks on the validation set. The pseudo-code of performance evaluation of an individual neural network is given in Algorithm 1
## 3.4 Adversarial Training

Adversarial training feeds adversarial samples during training to increase the model's robustness against perturbations. In this study, PGD-based adversarial training is used. In the case of multi-class classification, a multi-class input X and output Y are considered. The output Y is one-hot encoded, representing a corresponding label for each class in X. The goal is to train a classifier $f_\theta$ with some parameters $\theta$ that accurately predicts the class label from unseen data. For adversarial training in the case of multi-class, the adversarial perturbations are applied to each class separately. The original classification loss is given by:

$$ \mathcal{L}(\theta) = \frac{1}{S} \sum_{i=1}^{S} \text{loss}(f_{\theta}(X_i), Y_i) \qquad (6) $$

Where S represents the number of samples in the dataset, $X_i$ indicates the i-th input with $Y_i$ as the corresponding label with loss as the multi-class classification loss function. The adversarial perturbations generated using the PGD for each class c are achieved by the given function:

$$ \delta_c = \text{PGD}(f_\theta, X_i, Y_i, \epsilon, \alpha, J) \qquad (7) $$

where $X_i$ is the input with $Y_i$ as the label, $\epsilon$ is the size of perturbation, $\alpha$ the step size and $J$ as the number of iterations. The adversarial training loss for each class c is given by:

$$ \mathcal{L}_{adv}^{c}(\theta) = \frac{1}{S_c} \sum_{i=1}^{S_c} \text{loss}(f_{\theta}(X_i + \delta_c), Y_i) \qquad (8) $$

where $S_c$ is the number of samples in class c. The overall adversarial training objective is given as follows:

$$ \min_{\theta} \left( \mathcal{L}(\theta) + \lambda \sum_{c=1}^{C} \mathcal{L}_{adv}^{c}(\theta) \right) \qquad (9) $$

Where C is the total number of classes, and $\lambda$ is a hyper-parameter that balances the importance of the original loss and the adversarial training loss for each class.

## 3.5 Differential Evolution

This study uses DE as a search strategy in the proposed NAS approach. It finds optimal solutions by iteratively mutating and combining candidate solutions, evaluating their fitness, and replacing less fit solutions. Compared with traditional evolutionary algorithms, DE uses the scaled difference of vectors to produce new candidate solutions in the population [43]. Moreover, DE comprises few parameters and is easy to implement. DE consists of four main stages: initialization, mutation, crossover, and selection. At first, individuals are randomly
generated to create the initial population. Then, a mutation operation is performed to generate donor vectors. Most commonly, the DE/best/1 mutation scheme is used.

$$ \vec{V}_i^g = \vec{X}_g^{best} + Fx(\vec{X}_{r1}^g - \vec{X}_{r2}^g) \quad (10) $$

In this equation, $\vec{V}_i^g$ denotes the i-th vector from generation g. $\vec{X}_g^{best}$ is the best vector from generation g, and $\vec{X}_{r1}^g$ and $\vec{X}_{r2}^g$ represent two random vectors from the population g such that $\vec{X}_{r1}^g \neq \vec{X}_{r2}^g$. F is a scaling factor, $F \in (0, 1)$. After the mutation, the crossover operator is performed as follows:

$$ \vec{U}_{ij}^g = \begin{cases} \vec{V}_{ij}^g & \text{if } rand_i \le CR \text{ or } j = j, \\ \vec{x}_{ij}^g & \text{otherwise.} \end{cases} \quad (11) $$

Where $X_{ij}^{(t)}$ defines the j-th dimension of the i-th individual in the g-th generation. In the binomial crossover, a random number $rand_i$ is generated for each individual dimension and compared with the crossover rate $CR$ and $j$ according to the equation to decide whether the crossover operation will occur or not.

Finally, the generated vector $\vec{U}_{ij}^g$ is compared with the trial vector $\vec{U}_{ij}^g$ and the best one is selected for the next generation according to the fitness values. This process is repeated until the stopping criteria or the maximum number of generations is reached.

**Algorithm 1: Performance Evaluation**

**Input:** An individual I, Training epochs E, Dataset$_{train}$, Dataset$_{valid}$

**Output:** Fitness value $f_i$ of an Individual I

(1) Decode the individual with the decoding strategy to obtain the model M;

(2) for $i = 1$ to E do

(3) Train model M on Dataset$_{train}$ using adversarial training; // ;

(4) $f_i \leftarrow$ Test model M on Dataset$_{valid}$ after adversarial attacks (FGSM, PGD, BIM);

(5) Return fitness value $f_i$;

# 4 Experimental Settings and Results

We have performed comprehensive experiments to evaluate the performance of the proposed approach. This section briefly describes the experimental settings used to perform different experiments and the experimental results.

## 4.1 Datasets used for experimentation

The study utilized MedMNIST benchmark datasets, consisting of 2D and 3D images of various organs and modalities [22]. Two datasets, OrganCMNIST
and PathMNIST, were used for experiments. The PathMNIST dataset consists of nine different classes containing colorectal cancer histology slides. The OrganCMNIST dataset consists of eleven different classes of abdominal Computed Tomography (CT) scans in the coronal axes. These datasets are described in the Table 1.

<table><caption>Table 1: Datasets description</caption><thead><tr><th>Dataset Name</th><th>Task(Classs)</th><th>Data Modality</th><th># Samples</th><th># Training</th><th>/ Validation</th><th>/ Test</th></tr></thead><tbody><tr><td>PathMNIST</td><td>Multi-Class (9)</td><td>Colon Pathology</td><td>107,180</td><td>89,996</td><td>/ 10,004</td><td>/ 7,180</td></tr><tr><td>OrganCMNIST</td><td>Multi-Class (11)</td><td>Abdominal CT</td><td>23,660</td><td>13,000</td><td>/ 2,392</td><td>/ 8,268</td></tr></tbody></table>

## 4.2 Experimental Settings

The architecture search was conducted on a small network of 8 cells, divided into train, validation, and test sets. The individual was trained on the training set, evaluated on the validation set, and the final architecture was evaluated on the test set. As the parameters of DE play an important role in the quality of the searched solution, we have performed experiments with different CR and F rates, population sizes, and mutation strategies. The best-reported parameters of DE are given in Table 3. Moreover, the best-performing parameter settings of deep learning algorithms and adversarial attack settings are also given in Table 2. For a fair comparison, all the hyperparameters are kept the same. We performed adversarial training using 7-step PGD with a step size of 0.01 and $\epsilon$ as 8/255 for 50 epochs.

For training, we used the Stochastic Gradient Descent (SGD) optimizer with a MultiStepLR scheduler and a learning rate of 0.1, a momentum rate of 0.9, and a weight decay of 0.0002. Similarly, the number of epochs for the proposed approach and AdvRush is set to 50 for the final searched architecture. During the search phase of the proposed approach, the number of epochs is 10 to estimate the performance of an individual. The PyTorch library is used for implementing deep learning architectures, and TorchAttacks is used to implement adversarial attacks. All the experiments are performed on NVIDIA A100 Graphical Processing Unit (GPU) on a GPU cluster.

## 4.3 Experimental Results and Discussion

Medical images exhibit diverse representations and certain textures and can be easily attacked by adversarial perturbations. Studies have shown that hand-crafted architectures are more robust towards adversarial attacks than existing architectures. We have compared our proposed approach with deep learning architectures (VGG16, ResNet-18, ResNet-50) and adversarial NAS approaches for a baseline comparison given in Table 4. In our study, the architecture searched by the NAS is more robust towards multiple attacks due to the search space consisting of multiple attention blocks with different convolution layers and skip connections.
<table><caption>Table 2: Parameters settings of different adversarial attacks</caption><thead><tr><th>Attacks</th><th>ε</th><th>α</th><th>Iteration</th></tr></thead><tbody><tr><td>FGSM</td><td>8/255</td><td>10/255</td><td>-</td></tr><tr><td>PGD</td><td>8/255</td><td>2/255</td><td>7</td></tr><tr><td>BIM</td><td>8/255</td><td>2/255</td><td>10</td></tr><tr><td>FFGSM</td><td>8/255</td><td>2/255</td><td>-</td></tr><tr><td>One Attack</td><td>-</td><td>-</td><td>-</td></tr><tr><td>EOTPGD</td><td>8/255</td><td>2/255</td><td>-</td></tr><tr><td>PGDRS</td><td>8/255</td><td>2/255</td><td>10</td></tr></tbody></table>

<table><caption>Table 3: Parameter settings of differential evolution algorithm</caption><thead><tr><th>Parameters</th><th>Value</th></tr></thead><tbody><tr><td>Number of Iterations</td><td>20</td></tr><tr><td>Population Size</td><td>15</td></tr><tr><td>Crossover Probability (CR)</td><td>0.7 (PathMNIST) 0.5 (OrganCMNIST)</td></tr><tr><td>Differential Rate (F)</td><td>0.5 (PathMNIST) 0.6 (OrganCMNIST)</td></tr><tr><td>Chromosome Length</td><td>48</td></tr><tr><td>Crossover Operator</td><td>Simple Crossover</td></tr><tr><td>Mutation Operator</td><td>DE/rand/2/bin (PathMNIST)<br>DE/best/1/bin (OrganCMNIST)</td></tr></tbody></table>

Recent studies have shown that attention layers and skip connections improve the performance and robustness of natural images for classification tasks [45] [30]. These architectures are robust against adversarial attacks and lightweight as we have predefined the number of layers; the NAS algorithm is restricted to searching for robust architecture by trying combinations within the limit. This shows that the learning algorithm and the choice of operations play an essential role in performance enhancement against adversarial attacks. Multiple adversarial NAS

<table><caption>Table 4: Performance comparison of obtained accuracy scores against different adversarial attacks of the proposed approach with deep learning architectures. These architectures are adversarially trained on the PGD perturbed examples.</caption><thead><tr><th rowspan="3">Results</th><th colspan="5">PathMNIST</th><th colspan="5">OrganCMNIST</th></tr><tr><th colspan="3">Hand Crafted</th><th rowspan="2">Robust NAS</th><th rowspan="2">Proposed (Best Score)</th><th colspan="3">Hand Crafted</th><th rowspan="2">Robust NAS</th><th rowspan="2">Proposed (Best Score)</th></tr><tr><th>ResNet18</th><th>ResNet50</th><th>VGG16</th><th>ResNet18</th><th>ResNet50</th><th>VGG16</th><th>AdvRush [15]</th><th>Proposed (Mean)</th></tr></thead><tbody><tr><td>Clean Accuracy</td><td>27.14</td><td>28.6</td><td>29.72</td><td>28.76</td><td><strong>35.4</strong></td><td>30.21</td><td>11.67</td><td>15.29</td><td>22.00</td><td>28.74</td><td><strong>37.34</strong></td><td>28.33</td></tr><tr><td>PGD</td><td>15.73</td><td>14.13</td><td>16.14</td><td>26.88</td><td><strong>28.34</strong></td><td>22.81</td><td>13.23</td><td>19.16</td><td>6.80</td><td>26.56</td><td><strong>34.05</strong></td><td>25.36</td></tr><tr><td>FGSM</td><td>14.03</td><td>13.58</td><td>15.97</td><td>28.4</td><td><strong>30.39</strong></td><td>22.39</td><td>14.78</td><td>19.197</td><td>6.19</td><td>28.11</td><td><strong>36.31</strong></td><td>22.98</td></tr><tr><td>BIM</td><td>4.92</td><td>7.14</td><td>15.6</td><td>26.74</td><td><strong>28.18</strong></td><td>21.04</td><td>13.22</td><td>19.27</td><td>6.79</td><td>26.67</td><td><strong>34.02</strong></td><td>24.65</td></tr><tr><td>One Pixel</td><td>13.87</td><td>13.19</td><td>13.48</td><td>11.49</td><td><strong>14.07</strong></td><td>15.43</td><td>0.34</td><td>1.20</td><td>1.81</td><td>1.71</td><td><strong>2.58</strong></td><td>3.26</td></tr><tr><td>EOTPGD</td><td>15.95</td><td>21.936</td><td>15.77</td><td>26.7</td><td><strong>28.04</strong></td><td>17.82</td><td>13.22</td><td>18.71</td><td>6.18</td><td>26.64</td><td><strong>34.13</strong></td><td>21.60</td></tr><tr><td>PGDRS</td><td>5.19</td><td>7.35</td><td>19.3</td><td>28.82</td><td><strong>30.85</strong></td><td>22.07</td><td>13.19</td><td>18.87</td><td>6.78</td><td>26.56</td><td><strong>34.21</strong></td><td>23.04</td></tr><tr><td>PGD-10</td><td>15.7</td><td>14.17</td><td>16.2</td><td>28.37</td><td><strong>28.885</strong></td><td>28.34</td><td>13.18</td><td>19.85</td><td>6.79</td><td>26.51</td><td><strong>34.05</strong></td><td>25.25</td></tr><tr><td>PGD-20</td><td>15.68</td><td>14.56</td><td>16.17</td><td>28.49</td><td><strong>28.59</strong></td><td>22.17</td><td>13.14</td><td>19.76</td><td>6.56</td><td>26.64</td><td><strong>33.96</strong></td><td>22.84</td></tr><tr><td>PGD-50</td><td>15.71</td><td>14.25</td><td>16.15</td><td>28.35</td><td><strong>28.46</strong></td><td>22.03</td><td>13.12</td><td>19.47</td><td>6.43</td><td>26.68</td><td><strong>34.12</strong></td><td>22.86</td></tr><tr><td>PGD-100</td><td>15.41</td><td>14.24</td><td>16.11</td><td>28.33</td><td><strong>28.39</strong></td><td>21.10</td><td>13.05</td><td>19.21</td><td>6.17</td><td>26.56</td><td><strong>34.31</strong></td><td>22.88</td></tr></tbody></table>
approaches exist, but they have not provided their implementation. AdvRush is a famous gradient-based NAS approach that has achieved state-of-the-art results in improving the performance and robustness of the image classification task. Their proposed approach consists of a SuperNet-based NAS approach with a regularization technique that favors a candidate architecture with a smooth loss landscape [15]. Results have shown that AdvRush, a differentiable NAS approach proposed to discover adversarial robust architectures for image classification, has performed better than deep learning architectures. However, the proposed NAS approach has better performance than AdvRush. One potential reason is the search space used; secondly, each architecture is evaluated instead of the weight-sharing approach used by AdvRush.

The limitation of weight-sharing NAS approaches is that they fail to explore diverse architectural components due to constraints on shared weights across diverse architectural components. Therefore, the proposed approach allows greater architectural diversity, allowing exploration of a wide range of model configurations. In the case of standard image classification problems, simple architecture components are weight-sharing based adversarial NAS approach works quite well but perform poorly in case of medical image classification. Medical images exhibit different characteristics apart from standard images.

<table><caption>Table 5: Results comparison of clean accuracy and accuracy after different attacks with and without attention layers in the search space of proposed NAS approach</caption><thead><tr><th rowspan="2"></th><th colspan="2">OrganCMNIST</th><th colspan="2">PathMNIST</th></tr><tr><th>Without Attention Layers</th><th>With Attention Layers</th><th>Without Attention Layers</th><th>With Attention Layers</th></tr></thead><tbody><tr><td>Clean Accuracy</td><td>22.19</td><td><strong>37.34</strong></td><td>19.83</td><td><strong>35.4</strong></td></tr><tr><td>PGD</td><td>22.51</td><td><strong>34.05</strong></td><td>20.04</td><td><strong>28.34</strong></td></tr><tr><td>FGSM</td><td>25.64</td><td><strong>36.31</strong></td><td>19.81</td><td><strong>30.39</strong></td></tr><tr><td>BIM</td><td>22.47</td><td><strong>34.02</strong></td><td>17.35</td><td><strong>28.18</strong></td></tr><tr><td>One Pixel</td><td>2.3</td><td><strong>3.26</strong></td><td>13.10</td><td><strong>14.7</strong></td></tr><tr><td>EOTPGD</td><td>22.52</td><td><strong>34.13</strong></td><td>19.72</td><td><strong>28.04</strong></td></tr><tr><td>PGDRS</td><td>26.73</td><td><strong>37.53</strong></td><td>19.94</td><td><strong>30.85</strong></td></tr></tbody></table>

For performance comparison, the accuracy scores after different adversarial attacks (PGD, FGSM, BIM, FFGSM, PGDRS, EOTPGD, and OnePixel attacks) are computed on the test set. Moreover, to examine if increasing the number of iterations has an impact on the adversarial accuracy, the architectures are evaluated under PGD attack with different numbers of iterations: PGD¹⁰, PGD²⁰, PGD⁵⁰, and PGD¹⁰⁰. BIM and FFGSM are extensions of FGSM attacks, in which BIM performs attacks on multiple iterations. FFGSM extends FGSM by applying the gradient sign method on low-dimensional feature representation. PGDRS and EOTPGD represent other extensions of PGD: PGDRS starts with random initial perturbations to avoid getting stuck at the local minimum; EOTPGD considers the performance of attacks when various transformations are applied to the input.
Moreover, One-pixel attack is also considered, which focuses on changing the values of one or a few pixels to induce misclassification. The motivation behind using multiple attacks is to evaluate the effectiveness and robustness of the proposed method against multiple attacks. We reported the best and average results of five runs obtained by our method and compared them with hand-crafted architectures. Similarly, the deep learning architectures are also adversarially trained and evaluated under these attacks.

Furthermore, we have also performed ablation studies to investigate the performance impact of different components (search space). Table 5 describes the results when using attention layers alongside convolution and pooling operations and without attention layers. It is observed that the attention layers exhibit better robustness against different adversarial attacks and better accuracy on clean examples. As attention layers capture relationships between image regions and focus more on salient regions, it also helps to make models robust against adversarial perturbations.

<figure><img src="image_6.png" /><figcaption>Fig. 5: The visualization of Normal cell (a) and reduction cell (b) found by the proposed approach for OrganCMNIST dataset</figcaption></figure>

Table 6 demonstrates the number of parameters and model size of the best-performing architecture and the searching time of the proposed NAS approach on PathMNIST and OrganCMNIST. The significant search time is due to adversarial training, in which the model is trained on clean and adversarially perturbed samples. Secondly, the model is tested on perturbed samples with three different types of attacks for fitness evaluation. Compared with deep learning architectures (ResNet, VGG16), the number of parameters and size in MegaBytes (MB) of best-performing architectures are relatively less in numbers. Furthermore, the normal and reduction cells of the best-found architecture on the OrganCMNIST dataset are shown in Figures 5a and 5b, respectively. Both cells contain a variety of different operations, pooling layers, and different kinds of attention layers.

To compare multiple classifiers and NAS approaches over two MedMNIST datasets, we used the Friedman test to first reject the null hypothesis as given in [44]. Then, a post-hoc analysis using the Wilcoxon signed-rank test is performed with Holm's alpha correction with $\alpha = 0.05$ as the initial value. Then, the average ranks of the classifiers are visualized with a Critical Difference (CD) diagram [44] as shown in Figure 6. Figure 6 shows the average rank comparison of the proposed approach with deep learning architectures and NAS approaches.
<figure><img src="image_7.png" /><figcaption>Fig. 6: Critical difference diagram showing the pairwise statistical comparison of deep learning approaches and AdvRush approach with proposed approach on accuracy after different adversarial attacks.</figcaption></figure>

<table><caption>Table 6: Searching cost (in hours) of the proposed approach on different datasets with model size in MBs and the number of parameters of best-searched architecture</caption><thead><tr><td>Dataset</td><td>Searching Cost</td><td>Model Size in MBs</td><td>#Parameters</td></tr></thead><tbody><tr><td>PathMNIST</td><td>41 Hours</td><td>2.28</td><td>597652</td></tr><tr><td>OrganCMNIST</td><td>33 Hours</td><td>2.6</td><td>703365</td></tr></tbody></table>

The proposed approach has the highest performance over the two datasets from the MedMNIST benchmark. The thick line between the average ranks of deep learning architectures indicates no significant difference among these approaches as these architectures share the same architectural components. However, there is no statistical significance between AdvRush and the proposed approach, and AdvRush ranked second.

# 5 Conclusion

This study proposes an evolutionary NAS approach to search robust architectures for medical image classification. A search space is designed consisting of multiple attention layers and a variety of convolution and pooling operations. Experimental results show that the proposed approach has achieved better results than deep learning architectures and existing NAS approaches. This shows that techniques proposed for image classification would not work in the case of medical images, and a separate approach is very helpful in this case. In the near future, we aim to enhance the proposed approach by incorporating performance estimation strategies, such as surrogate models, to reduce search time.

# Acknowledgment

This work was funded by ArtIC project "Artificial Intelligence for Care" (grant ANR-20-THIA-0006-01) and co-funded by IRIMAS Institute / Université de Haute Alsace. The authors would like to thank the Mesocentre of Strasbourg for providing access to the GPU cluster and the providers of all datasets used in this paper.
References

1. Maliamanis, Theodore V., and George A. Papakostas. "Machine learning vulnerability in medical imaging." Machine Learning, Big Data, and IoT for Medical Informatics. Academic Press, 2021. 53-70.

2. Apostolidis, Kyriakos D., and George A. Papakostas. "A survey on adversarial deep learning robustness in medical image analysis." Electronics 10.17 (2021): 2132.

3. Liu, Jia, and Yaochu Jin. "Multi-objective search of robust neural architectures against multiple types of adversarial attacks." Neurocomputing 453 (2021): 73-84.

4. Shen, D., Wu, G., and Suk, H. I. (2017). Deep learning in medical image analysis. Annual review of biomedical engineering, 19, 221-248.

5. Xu, Han, et al. "Adversarial attacks and defenses in images, graphs and text: A review." International Journal of Automation and Computing 17 (2020): 151-178.

6. Goodfellow, Ian J., Jonathon Shlens, and Christian Szegedy. "Explaining and harnessing adversarial examples." arXiv preprint arXiv:1412.6572 (2014).

7. Madry, Aleksander, et al. "Towards deep learning models resistant to adversarial attacks." arXiv preprint arXiv:1706.06083 (2017).

8. Dong, Junhao, et al. "Adversarial Attack and Defense for Medical Image Analysis: Methods and Applications." arXiv preprint arXiv:2303.14133 (2023).

9. Akhtar, Naveed, and Ajmal Mian. "Threat of adversarial attacks on deep learning in computer vision: A survey." Ieee Access 6 (2018): 14410-14430.

10. Qiu, Shilin, et al. "Review of artificial intelligence adversarial attack and defense technologies." Applied Sciences 9.5 (2019): 909.

11. Ma, Linhai, and Liang Liang. "Adaptive Adversarial Training to Improve Adversarial Robustness of DNNs for Medical Image Segmentation and Detection." arXiv preprint arXiv:2206.01736 (2022).

12. Xue, Fei-Fei, et al. "Improving robustness of medical image diagnosis with denoising convolutional neural networks." Medical Image Computing and Computer Assisted Intervention-MICCAI 2019: 22nd International Conference, Shenzhen, China, October 13-17, 2019, Proceedings, Part VI 22. Springer International Publishing, 2019.

13. Lal, Sheeba, et al. "Adversarial attack and defence through adversarial training and feature fusion for diabetic retinopathy recognition." Sensors 21.11 (2021): 3922.

14. Yue, Zhixiong, et al. "Effective, efficient and robust neural architecture search." 2022 International Joint Conference on Neural Networks (IJCNN). IEEE, 2022.

15. Mok, Jisoo, et al. "AdvRush: Searching for adversarially robust neural architectures." Proceedings of the IEEE/CVF International Conference on Computer Vision. 2021.

16. Joel, Marina Z., et al. "Using adversarial images to assess the robustness of deep learning models trained on diagnostic images in oncology." JCO Clinical Cancer Informatics 6 (2022): e2100170.

17. Rao, Chendi, et al. "A thorough comparison study on adversarial attacks and defenses for common thorax disease classification in chest X-rays." arXiv preprint arXiv:2003.13969 (2020).

18. Li, Xin, Deng Pan, and Dongxiao Zhu. "Defending against adversarial attacks on medical imaging AI system, classification or detection?." 2021 IEEE 18th International Symposium on Biomedical Imaging (ISBI). IEEE, 2021.

19. Ma, Xingjun, et al. "Understanding adversarial attacks on deep learning based medical image analysis systems." Pattern Recognition 110 (2021): 107332.
20. Kotyan, Shashank, and Danilo Vasconcellos Vargas. "Towards evolving robust neural architectures to defend from adversarial attacks." Proceedings of the 2020 Genetic and Evolutionary Computation Conference Companion. 2020.

21. Liu, Hanxiao, Karen Simonyan, and Yiming Yang. "Darts: Differentiable architecture search." arXiv preprint arXiv:1806.09055 (2018).

22. Yang, Jiancheng, Rui Shi, and Bingbing Ni. "Medmnist classification decathlon: A lightweight automl benchmark for medical image analysis." 2021 IEEE 18th International Symposium on Biomedical Imaging (ISBI). IEEE, 2021.

23. Zoph, Barret, et al. "Learning transferable architectures for scalable image recognition." Proceedings of the IEEE conference on computer vision and pattern recognition. 2018.

24. Guo, Minghao, et al. "When nas meets robustness: In search of robust architectures against adversarial attacks." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2020.

25. Hosseini, Ramtin, Xingyi Yang, and Pengtao Xie. "Dsrna: Differentiable search of robust neural architectures." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2021.

26. Ali, Muhammad Junaid, et al. "Glioma segmentation using ensemble of 2D/3D U-Nets and survival prediction using multiple features fusion." Brainlesion: Glioma, Multiple Sclerosis, Stroke and Traumatic Brain Injuries: 6th International Workshop, BrainLes 2020, Held in Conjunction with MICCAI 2020, Lima, Peru, October 4, 2020, Revised Selected Papers, Part II 6. Springer International Publishing, 2021.

27. Singh, Naman D., Francesco Croce, and Matthias Hein. "Revisiting Adversarial Training for ImageNet: Architectures, Training and Generalization across Threat Models." arXiv preprint arXiv:2303.01870 (2023).

28. Athalye, Anish, Nicholas Carlini, and David Wagner. "Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples." International conference on machine learning. PMLR, 2018.

29. Nakai, Kohei, Takashi Matsubara, and Kuniaki Uehara. "Att-darts: Differentiable neural architecture search for attention." 2020 International Joint Conference on Neural Networks (IJCNN). IEEE, 2020.

30. Agrawal, Prachi, et al. "Impact of attention on adversarial robustness of image classification models." 2021 IEEE International Conference on Big Data (Big Data). IEEE, 2021.

31. Papernot, Nicolas, et al. "Distillation as a defense to adversarial perturbations against deep neural networks." 2016 IEEE symposium on security and privacy (SP). IEEE, 2016.

32. Awad, Noor, Neeratyoy Mallik, and Frank Hutter. "Differential evolution for neural architecture search." arXiv preprint arXiv:2012.06400 (2020).

33. Kuş, Zeki, et al. "Differential evolution-based neural architecture search for brain vessel segmentation." Engineering Science and Technology, an International Journal 46 (2023): 101502.

34. Rampavan, Medipelly, and Earnest Paul Ijjina. "Brake light detection of vehicles using differential evolution based neural architecture search." Applied Soft Computing 147 (2023): 110839.

35. Gülcü, Ayla, and Zeki Kuş. "Neural Architecture Search Using Differential Evolution in MAML Framework for Few-Shot Classification Problems." Metaheuristics International Conference. Cham: Springer International Publishing, 2022.

36. Yu, Caiyang, et al. "EU-Net: Automatic U-Net neural architecture search with differential evolutionary algorithm for medical image segmentation." Computers in Biology and Medicine (2023): 107579.
37. Shi, Xiaoshuang, et al. "Robust convolutional neural networks against adversarial attacks on medical images." Pattern Recognition 132 (2022): 108923.

38. Xu, Mengting, Tao Zhang, and Daoqiang Zhang. "Medrdf: A robust and retrain-
less diagnostic framework for medical pretrained models against adversarial attack."
IEEE Transactions on Medical Imaging 41.8 (2022): 2130-2143.

39. Rodriguez, David, et al. "On the role of deep learning model complexity in adversarial robustness for medical images." BMC Medical Informatics and Decision Making 22.2 (2022): 1-15.

40. Hirano, Hokuto, Akinori Minagi, and Kazuhiro Takemoto. "Universal adversarial attacks on deep neural networks for medical image classification." BMC medical imaging 21 (2021): 1-13.

41. Xu, Mengting, et al. "Towards evaluating the robustness of deep diagnostic models by adversarial attack." Medical Image Analysis 69 (2021): 101977.

42. Bai, T., Luo, J., Zhao, J., Wen, B., & Wang, Q. (2021). Recent advances in adversarial training for adversarial robustness. *arXiv preprint arXiv:2102.01356*.

43. Storn, Rainer, and Kenneth Price. "Differential evolution–a simple and efficient heuristic for global optimization over continuous spaces." Journal of global optimization 11 (1997): 341-359.

44. Demšar, Janez. "Statistical comparisons of classifiers over multiple data sets." The Journal of Machine learning research 7 (2006): 1-30.

45. Huang, Shihua, et al. "Revisiting Residual Networks for Adversarial Robustness." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2023.