Radiology under siege? Adversarial attacks against deep learning algorithms

In the rapidly evolving landscape of deep learning (DL) models within healthcare, particularly in the field of radiology, as they become increasingly integrated into clinical practice, a growing concern emerges – heightened vulnerability to cyberattacks [1Cheng P.M. Montagnon E. Yamashita R. Pan I. Cadrin-Chênevert A. Perdigón Romero F. Chartrand G. Kadoury S. Tang A. Deep Learning: An Update for Radiologists.Radiographics. 2021; 41: 1427-1445https://doi.org/10.1148/rg.2021200210Crossref PubMed Scopus (55) Google Scholar, 2Ma X. Niu Y. Gu L. Wang Y. Zhao Y. Bailey J. Lu F. Understanding adversarial attacks on deep learning based medical image analysis systems.Pattern Recogn. 2021; 110107332https://doi.org/10.1016/j.patcog.2020.107332Crossref PubMed Scopus (210) Google Scholar, 3Sorin V. Barash Y. Konen E. Klang E. Deep Learning for Natural Language Processing in Radiology—Fundamentals and a Systematic Review.J. Am. Coll. Radiol. 2020; 17: 639-648https://doi.org/10.1016/j.jacr.2019.12.026Abstract Full Text Full Text PDF PubMed Scopus (90) Google Scholar]. Among these threats, adversarial attacks stand out as a collection of techniques whereby attackers deliberately manipulate input data to deceive neural network models into making erroneous predictions or classifications [[2]Ma X. Niu Y. Gu L. Wang Y. Zhao Y. Bailey J. Lu F. Understanding adversarial attacks on deep learning based medical image analysis systems.Pattern Recogn. 2021; 110107332https://doi.org/10.1016/j.patcog.2020.107332Crossref PubMed Scopus (210) Google Scholar]. These manipulations are typically imperceptible to human observers, yet their repercussions on model performance can be profound. Two primary types of adversarial attacks exist: white-box and black-box approaches [[4]Hirano H. Minagi A. Takemoto K. Universal adversarial attacks on deep neural networks for medical image classification.BMC Med. Imaging. 2021; 21: 9https://doi.org/10.1186/s12880-020-00530-yCrossref PubMed Scopus (68) Google Scholar]. In white-box attacks, the attacker possesses complete knowledge of the target model, including its architecture, parameters, and relative weights. In contrast, black-box attacks occur when the attacker has limited or no information about the target model’s inner workings, compelling them to resort to trial-and-error or leveraging transferability from other models to craft adversarial data inputs. The very presence of these adversarial examples also raises critical questions about the generalization capabilities of DL networks, diminishes model interpretability, and imposes constraints on the application of DL in safety- and security-critical environments [[5]Ren K. Zheng T. Qin Z. Liu X. Adversarial Attacks and Defenses in Deep Learning.Engineering. 2020; 6: 346-360https://doi.org/10.1016/j.eng.2019.12.012Crossref Scopus (313) Google Scholar]. In the systematic review conducted by Sorin et al, utilizing the MEDLINE and Google Scholar databases, the Authors comprehensively analyzed investigations published within the last five years regarding adversarial attacks in radiology [[6]Sorin V. Soffer S. Glicksberg B.S. Barash Y. Konen E. Klang E. Adversarial attacks in radiology – A systematic review.Eur. J. Radiol. 2023; 167111085https://doi.org/10.1016/j.ejrad.2023.111085Abstract Full Text Full Text PDF PubMed Scopus (1) Google Scholar]. Among the twenty-two studies examined, half focused on assessing adversarial attacks on DL models designed for chest X-ray classification. Remarkably, these attacks resulted in misclassifications across various radiological conditions, including pneumothorax, mass/nodule, and pneumonia, accompanied by a significant deterioration in model performance, even leading to an accuracy of zero, particularly in the case of white-box attacks. Additionally, other targeted algorithms encompassed chest CT, brain MRI, mammography, abdominal CT, as well as liver and thyroid ultrasound imaging. In addition to the inherent risks of misclassification and misdiagnosis, adversarial attacks can have far-reaching consequences within the realm of healthcare [[5]Ren K. Zheng T. Qin Z. Liu X. Adversarial Attacks and Defenses in Deep Learning.Engineering. 2020; 6: 346-360https://doi.org/10.1016/j.eng.2019.12.012Crossref Scopus (313) Google Scholar]. They may steer patients toward incorrect treatment regimens, possibly resulting in unwarranted surgical procedures, medications, or therapies, as well as unwelcome delays in addressing genuine medical conditions. This not only burdens individuals with potentially unnecessary medical interventions but also places healthcare providers and institutions in a precarious position. Indeed, these attacks can expose healthcare practitioners and institutions to a slew of adverse outcomes, including liability issues, malpractice claims and frauds. The consequences extend beyond immediate medical costs, encompassing the broader spectrum of trust and integrity in the healthcare ecosystem [[2]Ma X. Niu Y. Gu L. Wang Y. Zhao Y. Bailey J. Lu F. Understanding adversarial attacks on deep learning based medical image analysis systems.Pattern Recogn. 2021; 110107332https://doi.org/10.1016/j.patcog.2020.107332Crossref PubMed Scopus (210) Google Scholar]. To defend against adversarial attacks, various mitigation and detection techniques have been proposed [[7]Aneja S. Aneja N. Abas P.E. Naim A.G. Defense against adversarial attacks on deep convolutional neural networks through nonlocal denoising.IAES Int. J. Artif. Intell. (IJ-AI). 2022; 11: 961https://doi.org/10.11591/ijai.v11.i3.pp961-968Crossref Scopus (3) Google Scholar]. Among the most effective methods is adversarial training, which involves augmenting the training dataset with adversarial samples to enhance the neural network's resistance to adversarial manipulations [[5]Ren K. Zheng T. Qin Z. Liu X. Adversarial Attacks and Defenses in Deep Learning.Engineering. 2020; 6: 346-360https://doi.org/10.1016/j.eng.2019.12.012Crossref Scopus (313) Google Scholar]. Besides robust security measures, adherence to data privacy regulations, rigorous quality control in image acquisition and annotation, and ongoing education and training for healthcare professionals are mandatory [7Aneja S. Aneja N. Abas P.E. Naim A.G. Defense against adversarial attacks on deep convolutional neural networks through nonlocal denoising.IAES Int. J. Artif. Intell. (IJ-AI). 2022; 11: 961https://doi.org/10.11591/ijai.v11.i3.pp961-968Crossref Scopus (3) Google Scholar, 8Shi X. Peng Y. Chen Q. Keenan T. Thavikulwat A.T. Lee S. Tang Y. Chew E.Y. Summers R.M. Lu Z. Robust convolutional neural networks against adversarial attacks on medical images.Pattern Recogn. 2022; 132108923https://doi.org/10.1016/j.patcog.2022.108923Crossref Scopus (9) Google Scholar]. The Defense Advanced Research Project Agency (DARPA), recognizing the dangers of adversarial attacks, has launched the Media Forensics (MediFor) program to counter data manipulations [[9]https://www.darpa.mil/program/media-forensics.Google Scholar]. While regulatory frameworks for AI medical devices exist, there is a crucial need for these measures to prioritize data security more prominently. The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.