Stabilized Medical Image Attacks
Authors: Gege Qi
Lijun GONG
Yibing Song
Kai Ma
Yefeng Zheng
Venue: ICLR 2021 Spotlight (2021)
Keywords: Healthcare
Biometrics

Abstract: Convolutional Neural Networks (CNNs) have advanced existing medical systems for automatic disease diagnosis. However, a threat to these systems arises that adversarial attacks make CNNs vulnerable. Inaccurate diagnosis results make a negative influence on human healthcare. There is a need to investigate potential adversarial attacks to robustify deep medical diagnosis systems. On the other side, there are several modalities of medical images (e.g., CT, fundus, and endoscopic image) of which each type is significantly different from others. It is more challenging to generate adversarial perturbations for different types of medical images. In this paper, we propose an image-based medical adversarial attack method to consistently produce adversarial perturbations on medical images. The objective function of our method consists of a loss deviation term and a loss stabilization term. The loss deviation term increases the divergence between the CNN prediction of an adversarial example and its ground truth label. Meanwhile, the loss stabilization term ensures similar CNN predictions of this example and its smoothed input. From the perspective of the whole iterations for perturbation generation, the proposed loss stabilization term exhaustively searches the perturbation space to smooth the single spot for local optimum escape. We further analyze the KL-divergence of the proposed loss function and find that the loss stabilization term makes the perturbations updated towards a fixed objective spot while deviating from the ground truth. This stabilization ensures the proposed medical attack effective for different types of medical images while producing perturbations in small variance. Experiments on several medical image analysis benchmarks including the recent COVID-19 dataset show the stability of the proposed method.

Published as a conference paper at ICLR 2021
STABILIZED MEDICAL IMAGE ATTACKS
Gege Qi', Lijun Gong"" Vibing Song"*, Kai Ma', Yefeng Zheng' Tencent Jarvis Lab, Shenzhen, China
2 Tencent AI Lab, Shenzhen, China
1 jungengetencent.ccmmm com yibingsong.cvvee www.mnig....mmmmm...m com yefengzhenggtennent.ccom
ABSTRACT
Convolutional Neural Networks (CNNs) have advanced existing medical systems for automatic disease diagnosis. However, threat to these systems arises that adversarial attacks make CNNs vulnerable. Inaccurate diagnosis results make a negative influence human healthcare. There is need to investigate poten- tial adversarial attacks to robustify deep medical diagnosis systems. On the other side, there are several modalities of medical images (e.g.. CT, fundus, and en- doscopic image) of which each type is significantly different from others. It is more challenging to generate adversarial perturbattions for different types of med- ical images. In this paper, we propose an image- based medical adversarial attack method to consistently produce adversarial perturbations on medical images. The objective function of our method consists of a loss deviation term and loss sta- bilization term. The loss deviation term increases the divergence between the CNN prediction of adversarial example and its ground truth label. Meanwhile, the loss stabilization term ensures similar CNN predictions this example and its smoothed input. From the perspective of the whole iterations for perturbation gen- eration, the proposed loss stabilization term exhaustively searches the perturbation space smooth the single spot for local optimum escape. We further analyze the KI--divergence of the proposed loss function and find that the loss stabilization term makes the perturbations updated towards fixed objective spot while deviat- ing from the ground truth. This stabilization ensures the proposed medical attack effective for different types of medical images while producing perturbations small variance. Experiments on several medical image analysis benchmarks in- cluding the recent COVID-19 dataset show the stability of the proposed method.
INTRODUCTION
Computer Aided Diagnosis (CADx) has been widely applied in the medical screening process. The automatic diagnosis benefits doctors to efficiently obtain health status avoid disease exacerbation. Recently, Convolutional Neural Networks (CNNs) have been utilized in CADx to improve the di- agnosis accuracy. The discriminative representations improve the performance of medical image analysis including lesion localization, segmentation and disease classification. However, recent ad- vances in adversarial examples have revealed that the deployed CADx systems are usually fragile to adversarial attacks (Finlayson et al., 2019), e.g., small perturbations applied to the input images can deceive CNNs to have opposite conclusions. As mentioned in Ma et al. (2020), the vast amount of money in the healthcare economy may attract attackers to commit insurance fraud false claims of medical reimbursement by manipulating medical reports. Moreover, image noise a common issue during the data collection process and sometimes these noise perturbations could implicitly form adversarial attacks. For example, particle contamination of optical lens dermoscopy and endoscopy and metal/respiratory artifacts of CT scans frequently deteriorate the quality of collected images. Therefore, there is growing interest to investigate how medical diagnosis systems respond adversarial attacks and what we can do to improve the robustness of the deployed systems.
While recent studies of adversarial attacks mainly focus on natural images, the research of adver- sarial attacks in the medical image domain is desired as there are significant differences between
"L.g and Y. Song are corresponding authors. The code is available at https:/ ptttaa//ghh / thub. mogengi /SMA

---

Published as a conference paper at ICLR 2021
Clasification
(APT, 2019)
Grade D: None
Grade 1: Mild
Grade 2: Moderate
Grade 3: Severe
Grade 4: Proliferative
(a) Fundux image Grade
(c)
(d) Ours Grade
Grade
Grade 0
Lung Segmentation (COV, 2019) Left lung (Cyan) Right lung (Yellow)
(e) Clicee
(1 FGSM
(g) PGD
(h) Ours
Artefact Detection
(EAD, 2019)
Astefect (Green)
(Orange)
Contrast (Bluc)
Saturation (Cyan)
(i) Endoseopic image
FGSM
(k) PGD
Ours
Figure 1: Adversarial attacks on medical images. A clean fundus image shown (a) and correctly classified as "None" during diabetic retinopathy grading. The perturbations from FGSM (Goodfel- low et al., 2014) attack successfully (i.e., grading as "Mild") in (b) while PGD (Madry et al., 2017) fails (i.e.. grading still as "None"). A clean CT slice is shown in (c) where the lung is correctly seg- mented. The perturbations from FGSM do not attack completely (i.e., cyan mask is still accurate) in (f) while PGD works in (g). A clean endoscopic image detection result shown in (i). FGSM and PGD are not effective to fail the detector completely. The perturbations produced by SMIA decrease the analysis performance across different medical image datasets as shown (d), (h) and (I).
two domains. Beyond regular RGB cameras, there are various types of medical imaging equipments (e.g., Computed Tomography (CT) scanners, ultrasound transducers and fundus cameras) to gen- erate dramatically different images. Fig. 1 shows three examples where an image captured from fundus camera in (a), an image captured from the CT scanner is (e) and an endoscopic video frame is in (i). As can be seen in the figure that these three images have little in common. The huge data variance across different modalities medical images brings more challenges to develop medical adver-
technology that works for all the modalities. In addition, existing investigations sarial attacks are limited. In Finlayson et al. (2019), adversarial examples are shown to deteriorate the diagnosis accuracy of deep learning based medical systems. These medical attack methods mainly based on those from natural images (e.g.. Fast Gradient Sign Method (FGSM) (Goodfellow al., 2014) and Project Gradient Descent (PGD) (Madry et al., 2017), which are insufficiently de- veloped for different types of medical data. As shown in Fig. 1, the adversarial examples generated by FGSM and PGD do consistently decrease the network's performance in (b), (c), (f. (g), (j) and (k). The data variance in (a) and (e) leads to the inconsistent attack results by existing methods.
In this paper, we propose medical image attack method consistently produce adversarial pertur- bations that can fool deep medical diagnosis systems working with different medical data modalities. The perturbations are iteratively generated via taking partial derivatives of well-defined objective function that is composed of deviation loss term and a stabilized loss term with respect to the input. By maximizing the deviation loss term, the adversarial attack system enlarges the divergence between CNN predictions and the ground truth to have effective attack samples. To handle the afore- mentioned ubiquitous data noise issue in medical images, we propose a novel stabilization loss term extra regularization, which ensures consistent deviation trajectory for the crafted attack sam- plcs. Meanwhile, the stabilization term avoids the local optima in the optimization process caused by the image noise.
2

---

Published as a conference paper at ICLR 2021
The proposed stabilization loss term is designed to measure the difference between two CNN predic- tions, where the first prediction is from the crafted adversarial sample and the second one is from the same sample processed with Gaussian smoothing. Given an adversarial example A and its Gaus- sian smoothed result A, the loss stabilization term constrains the corresponding CNN predictions (i.e., [(A) and ((A) to be similar via a minimization process. The intuition from the scale space optimization (Lindeberg, 1992) indicates that the minimization of f(A) and f(A) will exhaustively search the perturbation space smooth the single spot for local optimum escape. We further analyze this stabilized loss term via KL-divergence and find that the CNN predictions are steered towards a fixed objective spot during iterations. This stabilization improves the attack effectiveness on differ- ent types of medical data including CT, fundus, and endoscopic images. We evaluate the proposed Stablized Medical Image Attack (SMIA) on several medical datasets (APT, 2019; EAD, 2019; Kag, 2015), including the recent COVID-19 (COV, 2019) lung CT. Thorough evaluations demonstrate that the proposed method is effective to produce perturbations that decrease the prediction accuracy of different medical diagnosis systems. Our investigation provides guidance for strengthening the robustness of these medical systems towards adversarial attacks.
RELATED WORK
In this section, we literately review existing adversarial attack methods on both natural and medical images. Meanwhile, we survey relevant medical image analysis tasks where SMIA is deployed.
2.1 ADVERSARIAL ATTACK
There are extensive investigations adversarial attacks for natural image classifications. In Good- fellow et al. (2014), FGSM was proposed to generate adversarial examples based on the CNN gra- dients. A DeepFool method was proposed in Moosavi-Dezfool. et al. (2016) compute minimal perturbations based on classifier's linearization. In Moosavi-Dezfooli et al. (2017), an iterative algorithm was proposed to generate perturbations and showed the existence of a universal (image- agnostic) adversarial perturbations. In Baluja & Fischer (2017), (),, Transformation Network (ATN) was trained to generate adversarial examples without gradient involvement. The adversarial training and provable defense were proposed in Balunovic & Vechev (2020) to achieve both attack robust- ness and high accuracy. The capsule based reconstructive attack was proposed in Qin et al. (2020) to cause both misclassifications and reconstructive errors. Besides image classification, several attack methods were proposed for semantic segmentation, object detection and object tracking Jia et al. (2020). In Fischer et al. (2017); Dong et al. (2019), the classification based attacks were shown transferable to attack deep image segmentation results. The universal perturbations were demon- strated existing in Moosavi-Dezfool et al. (2017). Moreover, Dense Adversary Generation (DAG) method was proposed Xie et al. (2017) for both semantic segmentation and object detection attacks. The general idea of natural image attacks was iteratively generate perturbations based on the CNN gradients to maximize the network predictions of adversarial examples and the ground truth labels. This idea was also reflected in Finlayson al. (2019) show the medical attacks. Different from existing methods, we propose a stabilized regularization term to ensure the consistent generation of adversarial perturbations, which are effective for different types of medical image datasets.
2.2
DEEP MEDICAL IMAGE ANALYSIS
The deep Convolutional Neural Networks (CNNs) have been shown effective to automatically an- alyze medical images (Litjens et al., 2017; Razzak al., 2018). The common CADx applications include classifying the stage of disease, the detection and segmentation of organs and lesions.
Disease classification. Most medical systems formulate disease diagnosis as an image classification task. The types of diseases are predefined and each type corresponds to one category. During the classification process, there are single or multiple images as input for disease diagnosis. In Shen et al. (2015), multi-scale CNN was proposed to capture the feature representation of lung nodule patches for accurate classification. A multi-instance layer and a multi-scal layer were proposed in Li et al. (2019) to diagnose diabetic macular edema and myopic macular degeneration. Besides diagnosing the types of disease, existing medical systems were also able to predict the disease status (Gulshan et al., 2016) by empirical status categorization.
3

---

Published as a conference paper at ICLR 2021
Organ and lesion detection. The detection of organ and lesion is inspired by the object detection framework for natural images (e.g., Becter-RNNN (Ren et al., 2015), FPN (Lin et al., 2017), and Yolo (Redmon et al., 2016)). Besides, 3D spatial information of the medical data is explored in the 3D) detection framework. In Ding et al. (2017), a 3D-CNN classification approach was proposed to classify lung nodule candidates that were previously detected by the Paster-RCNr detector. The RPN (Ren et al., 2015) was extended in Liao et al. (2019) to become 3D-RPN for 3D proposal generation to detect lung nodules. Different from the 3D detection framework, multi-scale booster was proposed in Shao et al. (2019) with channel and spatial attentions that were integrated into FPN for suspicious lesion detection 2D CT slices. The detection methods based on 2D image input reduced heavy computational cost brought in the 3D inputs for 3D detection methods.
Organ and lesion segmentation. The medical segmentation was significantly advanced via deep encoder-decoder structures (e.g., U-Net (Ronneberger al., 2015)). This architecture contains contracting path (i.e., encoder) to capture global context and symmetric expanding path (i.e., de- coder) to obtain precise localization. There were several works built upon U-Net. In Brosch et al. (2016), skip connections were utilized in the first and last convolutional layers to segment lesions in brain. V-Net was proposed in Milletari al. (2016) to segment brain's 's anatomical structures. followed 3D U-Net structure consisting of 3D convolutional layers. A dual pathway and multi-scale 3D-CNN architecture was proposed in Kamnitsas et al. (2017) to generate both global and local lesion representations in the CNN for brain lesion segmentation. Existing medical methods mainly utilized deep encoder-decoder architectures for end- and segmentation of organs and lesions.
As illustrated above, deep medical diagnosis systems differ much from the CNN architectures that are developed for natural images. Moreover, the variance different modalities of medical images is significantly larger than that of natural images. Therefore, the adversarial attacks designed for natural images are not often effective in the medical domain. Nevertheless, the limitations that are brought by huge network and data variance are effectively solved via our stabilized medical attack.
PROPOSED METHOD
In this section, we illustrate the details of medical image attacks. We first show the objective function of SMIA that consists of a loss deviation term and a loss stabilization term. The loss deviation term produces the perturbation to decrease the image analysis performance, while the loss stabilization term is consistently updated during iterations and constrains these perturbations to low variance. Then, analyze how SMIA affects the generated perturbations during iterative optimization from the perspective of KL-divergence. The analysis is followed by a visualization showing the variance and cosine distance of perturbations by utilizing the loss stabilization term.
3.1 OBJECTIVE FUNCTION
As aforementioned, there are loss deviation term (DEV) and a loss stabilization term (STA) in the objective function. The loss deviation term follows Goodfellow al. (2014) to enlarge the difference between CNN predictions and the ground truth label. We denote the input image as x, model parameters as 0, and the ground truth label of x as Y. In the first iteration, the objective function of SMIA denoted as LSMIA can be written as:
LSMIA LDEV C(f(O, x).).
where f0, æ) is the CNN predicted result of x and C(-) is the loss function. The perturbation r can be computed by taking the partial derivatives of the objective function with respect to the input. It can be written as:
0LSMIA dr (C Or v.
The perturbation is further refined to = siggn(()) where e a constant controlling the influence of We add 7 to the input image an adversarial example. The perturbation 1) iteratively learned
4

---

Published as a conference paper at ICLR 2021
to enlarge the difference between ((),z) and Y. However, observe that the objective function with the loss deviation term alone has a major unstable issue, especially for the medical images with large variances.
To tackle the instability problem, we introduce the loss stabilization term together with the loss de- viation form the new objective function, starting from the second iteration of the training process. We compute 1y in the first iteration using Eq. 2. The loss stabilization term can be written as:
CSTA (f + n), f(0, W * n)),
(3)
where W is a Gaussian kernel and convolves with the current perturbation 7/. This term enforces the CNN predictions of + 7) and x + W +) similar under the current loss function. The objective function LSMIA we use during the following iterations can be written as:
LSMIA = LDEV + a LSTA
=[f(0, x + v) - a. (.0(0 1(0, W * *)))
(4)
=(f((0, ().0 100-aa--i10 ())( f(0,a)+))))
where is the scalar balancing the influences of LDEV and LSTA, I = x + 17 is the adversarial example sent the CNN in the current iteration, and n/ W * - 17.
3.2 SMIA INTERPRETATION VIA KL- EL-DIVERGENCE
The iterative generation of adversarial perturbation via SMIA is the process of maximizing the objective function shown in Eq. 4. the following, we show how stabilization gradually arises and makes CNN prediction update to constant value from the perspective of KL-divergence (Zhao et al., 2019; Shen et al., 2019). We elucidate our interpretation of SMIA via the image classification task where the loss function L is the cross entropy loss. The KL-divergence is utilized measure the distribution difference between [(0, 3) and f((0, I + v/). which are from the loss stabilization term shown in Eq. 3.
We denote the input image as x and there are K categories in total. The ground truth label of x is de- noted Y [y1 1/2.-- -... yKl² that is one-hot label. The output of CNN f(0, 2:) is K dimensional vector where each element represents the probability of x belonging to the corresponding category. We denote the probability of belonging to j-th category (j 1,2, K) as p(y,) (z) = (x)). The
Ki-divergence DKL measures the difference between f(0, 2) and f(0, & + ry') and can be expanded via the second-orde Taylor expansion (Shen et al., 2019) as follows:
DKI (0, +n))) = (log p(yl
p(ul j + m/))
(5)
(n)) (n/)
where is the random variable ranging from V1 to yK under the distribution f(ī), and G [V,(VV log p(ylā)) log p(y])))² is the Fisher Information Matrix of T. This matrix is designed to measure the variance of a distribution model.
During the perturbation generation process, SMIA iteratively minimizes the KL-divergence between f(,, and f(0, - + r/). As shown in Eq. 5, the minimization decreases the variances of ry' as well as seeking the smallest eigenvalue of G The variance of 7y' is proportional to that of 17. which indicates that the learned perturbations via SMIA are constrained maintain low variance.
On the other hand, the eigenvalue computation of G is computationally intensive because the dimension of G is equal to the image size. We follow Zhao al. (2019) to formulate G3 as new matrix Gy through G = J" G. The term Gy is the Fisher Information Matrix of f(ī) and the term J is the Jacobian matrix which can be computed as J = Øf As result, the term G is K K positive definite matrix and formulated as:
Gj (V (V logr(ul/))*).
Therefore, the problem of minimizing eigenvalues of G is converted to the problem minimizing the eigenvalues of Gy. As the trace of matrix equals the summation of its eigenvalues which
5

---

Published as a conference paper at ICLR 2021
Cosine distance:
Cosine distancer -0.37
DEV
4-th iteration
9-th Reeation variance: 0.054
variance: 0.002
Cosine
Cosine distance:
Fundus Image
DEV-STA
1-st
iteration
9-th iteration
variance:
Figure 2: Visualizations of adversarial perturbations. We show how perturbation varies the first, fourth, and ninth iterations, which generated via LDVV and LDVV + LSTA on an input fundus image. The perturbations produced via CDEV LSTA have low variance and consistent cosine distance values, which accords with the analysis of the loss stabilization term via KL-divergence.
all positive, minimizing eigenvalues is equivalent to finding the smallest trace. The trace of Gy can be computed as:
= [|
plyl log logr(ul/)) logrol
K
P3
1=1
j=1
pi
Therefore, the objective function shown in Eq. 4 can be formulated as follows:
LSMIA x C(S(0,))
(1/)²
When we iteratively add @CaMIA to the last adversarial example ž, we are maximizing the values of LSMIA. Specifically, we maximize the first term while minimizing the second in Eq. 8. The maximization of the first term resembles existing adversarial attack methods (e.g., FGSM and PGD). However, the minimization of the second term consists of minimizing both n/' and Σ 1 When we minimize v/', we reduce the variance of the generated perturbation 1). On the other hand, the optimal solution to min ΣK 1 t. Σ p; = 1 is P1 P2 indicates that the stabilization loss term enforces the CNN prediction to update towards a constant vector 1
p;
Pк K This
p;
}. To this end, the perturbations are learned to move consistently towards fixed objective spot during different iterations in the CNN attack space. As this spot is not related to
network structure nor data type, our loss stabilization term improves perturbation robustness that overcomes huge variations brought by different networks and different types of input data.
3.3 VISUALIZATIONS
The analysis on LSTA from KL-divergence indicates that the iteratively generated perturbations are in small variance and updated in a more consistent direction. We visualize the perturbations in different iterations in Fig. to see how perturbations vary in practice. We send an input fundus image to the ResNet-50 (He et al., 2016) integrated with graph convolutional network (Kipf & Welling, 2016) framework for image classification. The perturbations are generated via Eq. and Eq. 4 independently.

---

Published as a conference paper at ICLR 2021
Table I: Ablation study lung segmentation, artefact detection, and diabetic retinopathy grading. STA improves the attack performance while updating perturbations coherently.
COVID-19
FAD-22019
APTOS-2019
Methods
Acc(%)]
Jaccard( (%)) Cos($6)
[0U(%)
mAP (%)]
Cos($))
Acc(SO) Cos($))
Clean 87.82
93,57
22.86
43,36
81.82
DEV
69.16
83.66
60.00
6.82
17.28
64.98
69.35
90.34
DEV + STA
60.82
79.18
63.21
4.8
3.47
68.54
57.37
95.46
Fig. shows the visual comparison of perturbations generated on the first, fourth, and ninth iter- ations. We denote the perturbations generated via LDVV (i.e., Eq. 1) as PDEV and that generated via LDVV + LSTA (i.c., Eq. 4) as +TEV+STA- The visualization indicates that at the same itera- tion, the variance of PDEV larger than that of PDEV+STA. Meanwhile, during different iterations, there are severe variance oscillations in PDEV while PDEV+STA is consistently decreased. On the other side, we calculate the cosine distance between PDE and PDEV+STA separately. The cosine distance indicates that PDEV is updated in diverse directions while + is more consistent. The visualization accords with the KI--divergence analysis that the proposed loss stabilization term decreases the perturbation variance and constrain a stable update direction towards a fixed objective spot in the CNN feature space.
EXPERIMENTS
We evaluate the proposed method on three medical image analysis tasks including diabetic retinopa- thy grading, artefact detection, and lung segmentation. The diabetic retinopathy grading is to classify fundus images into predefined categories for diabetes status estimation. The artefact detection is to detect specific artefacts like pixel saturations, motion blur, and specular reflections in the endoscopic images. Lung segmentation is to segment lung region from the whole CT slice. The medical data in one task is significantly different from that in others.
We use two datasets for diabetic retinopathy grading. One is the APTOS-200 20190-20999-0 (APT, 2019) dataset with 3,662 fundus images. The other is large-scale Kaggle-DR (Kag, 2015) dataset where randomly select 11,000 fundus images from its original training set. Both APTOS-200 and Kaggle- DR contains five defined categories. For artefact detection we use EAD-2019 (EAD, 2019) dataset with 2,500 images collected from endoscopic video frames and annotated artefact regions with seven defined categories. These detection images focus on multiple image modalities (i.e., gastroscopy, cystoscopy, oesoohagall and colonoscopy), and are captured in multi-resolutiin with multi- modal (i.e., white light, fluorescence, and narrow band imaging). For lung segmentation, we use the COVID-19 dataset (COV, 2019) where there are 20 CT scans for lungs infected by COVID-19.
In practice we use ResNet-50 (He al., 2016) integrated with graph convolutional network (Kipf & Welling, 2016) to classify fundus images, the multi-scale booster framework (Shao et al., 2019) to detect artefact, and U-Net (Ronneberger et al., 2015) to segment infected lung regions. The proposed method is compared to other adversarial attack methods including FGSM (Goodfellow et al., 2014), PGD (Madry et al., 2017), DeepFool (Moosavi-Dezfoolii et al., 2016), and DAG (Xie et 2017). The comparisons are made by adding these generated perturbations on the input images for decreased performance observation. For evaluation metrics, we use mean accuracy for medical image classification, IoU and mean Average Precision (mAP) for detection, and mean accuracy and Jaccard index for segmentation. During perturbation generation, we set as 0.05, 0.01, 5 x 10-5 for lung segmentation, artefact detection and diabetic retinopathy grading respectively. We stop at the 10-th iteration for all the attack methods. The in Eq. 4 is set as 1, We provide more results including using different Gaussian kernels W and show the pseudo code in the supplementary files. Our implementation will be made available to the public.
4.1 ABLATION STUDY
The proposed SMIA introduces a stabilization loss term to contribute to the consistent perturbation generation process across medical image modalities and tasks. We evaluate how this stabilization term improves the attack performance of the deviation loss. Besides using the aforementioned met- rics on three datasets, measure the cosine distance between two consecutive perturbations to
7

---

Published as a conference paper at ICLR 2021
Table 2: Attack performance the EAD-2019 dataset with different iteration numbers.
15
20
25
Iterationt
IOU(%)
mAP(%)
10U(%)
mAP(%)
IOU(%)
mAP(%)
Clean
22.86
43.36
22.86
43.36
22.86
43.36
FGSM
14.64
5.19
13,94
4.97
13.03
PGD
4.79
13.40
4.11
11.90
3.94
10.42
DAG
3.51
1.02
2.28
0.03
1.45
0.01
SMIA
1.02
0.24
0.50
0.02
0.11
0.01
Table 3: Attack performance on the EAD-2019 dataset with different
0.005
0.01
0.015
10U(%)
mAP(%)
IOU(%)
mAP(%)
(0U(%)
mAP(%))
Clean
22.86
43.36
22.86
43.36
22.86
43.36
FGSM
12.03
26.65
6.82
17.28
5.27
13.52
PGD
11.49
22.89
6.48
16.36
3.49
10.73
DAG
11.28
14.94
7.62
2.71
2.86
1.44
SMIA
11.34
15.92
4.8
3.47
1.18
3.25
calculate the similarity of their directions in the CNN attack space. We also calculate the percentage of perturbations with a positive cosine distance since a positive value indicates that directions of perturbation update consistent during the iterative generation process. After evaluating the STA term on three datasets, we analyze the influence of hyper--araman parameters to the attack performance on the EAD-2019 dataset across multiple attack methods.
Table 4: Attack performance on the EAD- 2019 dataset with different a in Eq. 4.
Table 5: Numerical evaluations on the
MNIST dataset.
a
I0U(%)
mAP(%%
Methods Accuracy(%5) Decrease(%)
Clean
22.86
43.36
Clean
99.39
0 6,82
17.28
FGSM
75.90
23.63
0.75
5.94
12.18
PGD
74.88
24.66
1 4.80
3.47
SMIA
73.72
25.83
1.25
4.93
4.05
Table shows the ablation study results on three datasets. We denote "Clean" as the results generated by medical diagnosis systems without adding perturbations. These results indicate the upper limit of these systems. In general, the perturbations generated via deviation loss term (DEV) decrease the recognition performance (i.e., segmentation, detection, and classification results in COVID-19, EAD-2019, and ATPOS-2019 respectively). By integrating loss stabilization term (STA), we are able to generate perturbations that decrease the recognition performance hand, the percentage of positive cosine distance values of DEV+STA is higher than DEV, which indicates the perturbations generated via DEV+STA are more consistent with each other during their iterative generation process. The results shown in this table indicate that STA improves the adversarial attack with DEV alone on both performance deterioration and perturbation consistency on three medical analysis scenarios.
further. On the other
Next, we analyze how the hyper-parannterr existing attack methods affect the attack performance on the EAD-2019 dataset. Tables 2-4 show the analysis results. We evaluate attack performance by using different iteration numbers in Table 2, different values of in Table 3, and different values of in Table 4, respectively. The analysis iteration numbers indicates that existing attack methods decrease the artefact detection performance by increasing the iteration numbers. SMIA significantly decreases the performance by using limited number of iterations. The analysis SMIA performs favorably against existing methods when it set as 0.01. Besides, SMIA decreases when 1. The hyper-parameter analysis shows our optimal parameter selections.
shows that
4.2 COMPARISONS WITH TTATE-OF-THE-AAE
We compare the proposed SMIA method with existing adversarial attack methods in the same med- ical analysis scenarios. Besides the prevalent FGSM and PGD methods, involve DAG which is
8

---

Published as a conference paper at ICLR 2021
Table 6: Comparison with state-of-the-art on lung segmentation, artefact detection, and diabetic retinopathy grading. The proposed SMIA method decreases recognition accuracies while producing perturbations with low variance.
COVID-19
EAD-2019
APTOS 2019
Kaggle- DR
Ac)(%)
Jac(S)
Var
(0)
mAP(%)
Var
Acc(%)
Var
Acc(S))
Var
FPR(%)
Clean
87.82
93.57
22.86
43.36
81.28
75.64
18.18
FGSM
69.16
83.66
0.087
6.82
17.28
0.062
69.35
0.052
58.91
0.064
25.56
PGD
69.40
83.69
0.081
6,48
16,36
0.086
67,46
0.126
56.89
0.085
26.09
DeepFool
68.23
0.073
56.57
0.069
27.01
DAG
68.96
90.87
0.054
7.62
2,71
0.059
SMIA
60.82
79.18
0.001
4.8
3.47
0.019
57.37
0.023
51.26
0.041
27.80
proposed for detection and segmentation of natural images, and DeepFool that is for disease image classification. All these methods are deployed on the medical diagnosis systems to show the recogni- tion performance decrease. Meanwhile, we compute the variance of all the generated perturbations, which is shown as "Var" in the results.
Table 6 shows the evaluation performance. Under lung segmentation (i.e., COVID-19) and diabetic retinopathy grading (i.e., APTOS APTOS-2019 and Kaggle-DR) scenarios, our SMIA consistently decreases the recognition performance of medical systems. The drops in accuracy and Jaccard index brought by our method are more than those from existing methods. Specifically, the accuracy drop on the COVID-19 dataset brought by our method around 9% more than the second best method (i.e., DAG). Moreover, the accuracy drop by using our method on the APTOS-19 dataset is around 10% more than the second best method (i.e., PGD). The false positive rate brought by our method is higher than other methods in Kaggle-DR. These performance drops indicate the effectiveness of our method to handle medical image data. Under the artefact detection scenario in EAD-2019, we observe that the decrease of mAP from DAG is more than ours. This is because DAG synthesizes pseudo labels for each proposal from the detection network to specifically attack the classifier of the detector. Nevertheless, its performance decrease is not significant 4.8%) under the loU metric that measures the bounding box overlap ratios. On the other hand, the perturbation variance (i.e., "Var") of our method is lower than other attack methods on all the evaluation datasets. The decreased performance and smaller perturbations indicate the effectiveness of our SMIA method for attacking medical diagnosis systems.
ours (i.e., 7.62% v.s.
Besides medical image datasets, we evaluate SMIA on a wund-written image dataset MNIST (Deng, 2012) with existing methods. Table 5 shows the results. Our SMIA method decreases the recognition accuracy more than that of FGSM and PGD. This indicates that SMIA is effective to attack not only medical images, but also images from other fields.
CONCLUSION
We proposed a medical image adversarial attack method to diagnose current medical systems. The proposed method iteratively generates adversarial perturbations by maximizing the deviation loss term and minimizing the loss stabilization term. For an adversarial example at the current iteration, the difference between its CNN prediction and the corresponding ground truth label is enlarged, while the CNN predictions of its smoothed input and itself are similar. The similar predictions constrain the perturbations to be generated in relatively flat region in the CNN feature space. During consecutive iterations, the perturbations are updated from one flat region to another. Thus the proposed method can search the perturbation space to smooth the single spot for local optimum escape. Compared to the perturbation movement among single spots that are brought by only using loss deviation term, the loss stabilization term improves the attack performance by regularizing the perturbation movement to be stable. Further analysis with the KL-divergence shows that the minimization of loss stabilization term is to regularize the perturbations to move towards a fixed objective spot while their variances are reduced. Both the visualization and experimental results have shown the effectiveness of our attack method to figure out the limitations of medical diagnosis systems for further improvement.

---

Published as a conference paper at ICLR 2021
REFERENCES
Diabetic Retinopathy Detection, 2015. detection/overview.
https:/www....agggecooocddddddet
APTOS 2019 Blindness Detection, 2019.
http:///ww..k.ggecccc///////ppps
detection/data.
COVID-19 CT scans, 2019. http://www...aggcccommamttmnwwes
Endoscopic Artefact Detection Challenge, 2019. https///ea220113ggrrddcaaalllee
Shumeet Baluja and lan Fischer. Adversarial transformation networks: Learning generate adver- sarial examples. arXiv preprint arXiv:1703, 2017.
Mislav Balunovic and Martin Vechev. Adversarial training and provable defenses: Bridging the gap. In International Conference on Learning Representations, 2020.
Tom Brosch, Lisa Y. W. Tang, Youngjin Yoo, David K. B. Li, Anthony Traboulsee, and Roger Tam. Deep 3D convolutional encoder networks with shortcuts for multiscale feature integration applied to multiple sclerosis lesion segmentation. IEEE Transactions on Medical Imaging, 35(5): 1229 1239, 2016.
Li Deng. The mnist database of handwritten digit images for machine learning research. 1EEE Signal Processing Magazine, 2012.
Jia Ding, Aoxue Li, Zhiqiang Hu, and Liwei Wang. Accurate pulmonary nodule detection in com- puted tomography images using deep convolutional neural networks. In International Conference on Medical Image Computing and Computer-assister Intervention, pp. 559-567. Springer, 2017.
Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by translation-invaiian invariant attacks. In IEEE Conference on Computer Vision and Pattern Recognition, 2019.
Samuel G Finlayson, John D Bowers, Joichi Ito, Jonathan I. Zittrain, Andrew I. Beam, and Isaac Kohane. Adversarial attacks on medical machine learning. Science, 36336433))1 2019.
Volker Fischer, Mummadi Chaithanya Kumar, Jan Hendrik Metzen, and Thomas Brox. Adversarial examples for semantic image segmentation. arXiv preprint 1703011003.0100,,222
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint 14 2014.
Varun Gulshan, Lily Peng. Mare Coram, Martin C Stumpe, Derek Wu, Arunachalam Narayanaswamy, Subhashini Venugopalan, Kasumi Widner, Tom Madams, Jorge Cuadros, et al. Development and validation of a deep learning algorithm for detection of diabetic retinopathy in retinal fundus photographs. JAMA, 316(22):2402 2410, 2016.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 770-778, 2016.
Shuai Jia, Chao Ma, Yibing Song, and Xiaokang Yang. Robust tracking against adversarial attacks. In European Conference on Computer Vision, pp. 69-84, 84. Springer, 2020.
Konstantinos Kamnitsas, Christian Ledig, Virginia Newcombe, Joanna Simpson, Andrew D Kane, David K Menon, Daniel Rueckert, and Ben Glocker. Efficient multi-scale 3D CNN with fully connected CRF for accurate brain lesion segmentation. Medical Image Analysis, 36:61-78, 2017.
Thomas Kipf and Max Welling. Semi-supervised classification with graph convolutional network-
arXiv preprint arXiv:1609.0000 1609.0290000 2016.
10

---

Published as a conference paper at ICLR 2021
Shaohua Li, Yong Liu, Xiuchao Sui, Cheng Chen, Gabriel Tjio, Daniel Shu Wei Ting, and Rick Siow Mong Goh. Multi-instance multi-scale CNN for medical image classification. In Interna- tional Conference Medical Image Computing and Cossitee-assisted Intervention, pp. 531- 539. Springer, 2019.
Fangzhou Liao, Ming Liang. Zhe Li, Xiaolin Hu, and Sen Song. Evaluate the malignancy of pul- monary nodules using the 3D deep leaky noisy-or network. IEEE Transactions on Neural Net- works and Learning Systems, (:311))3484-3444 2019.
Tsung- Yi Lin, Piotr Dollár, Ross Girshick, Kaiming He, Bharath Hariharan, and Serge Belongie. Feature pyramid networks for object detection. In Proceedings of the IEEE Conference on Com- puler Vision and Patlern Recognition, pp. 21 2117-2125, 2017.
Tony Lindeberg. Scale-space behaviour of local extrema and blobs. Journal of Mathematical Imag- ing and Vision 1(1):65-99, 1992.
Geert Litjens, Thijs Kooi, Babak Ehteshami Bejnordi, Arnaud Arindra Adiyoso Setio, Francesco Ciompi, Mohsen Ghafoorian, Jeroen Awm Van Der Laak, Bram Van Ginneken, and Clara I Sánchez. survey on deep learning in medical image analysis. Medical Image Analysis, 42: 60-88, 2017.
Xingjun Ma, Yuhao Niu, Lin Gu, Yisen Wang. Yitian Zhao, James Bailey, and Lu Feng. Under- standing adversarial attacks on deep learning based medical image analysis systems. Pattern Recognition, 2020.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint: 1700.00006.3 2017.
Fausto Milletari, Nassir Navab, and Seyed-Ahmad Ahmadi. V-Net: Fully convolutional neural networks for volumetric medical image segmentation. In Fourth International Conference on 3D Vision, pp. 565-571. IEEE, 2016.
Seyed-Mohsen Noosavi-Dezfooli: Alhussein Fawzi, and Pascal Frossard. Deepfool: simple and accurate method to fool deep neural networks. In Proceedings of the IEEE Conference on Com- puter Vision and Pattern Recognition, pp. 2574-2582, 2016.
Seyed-Mohsen -ezsovi- Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 1765-1773, 2017.
Yao Qin, Nicholas Frosst, Sara Sabour, Colin Raffel, Garrison Cottrell, and Geoffrey Hinton. De- tecting and diagnosing adversarial images with class-conditional capsule reconstructions. In In- ternational Conference on Learning Representations, 2020.
Muhammad Imran Razzak, Saceda Naz, and Ahmad Zaib. Deep learning for medical image process- ing: Overview, challenges and the future. In Classification BioApps, pp. 323-350. Springer, 2018.
Joseph Redmon, Santosh Divvala, Ross Girshick, and Ali Farhadi. You only look once: Unified, real-time object detection. In Proceedings of the IEEE Conference on Computer Vision and Pat- tern Recognition, pp. 779-788, 2016
Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. Faster R-CNN: Towards real-time object detection with region proposal networks. In Advances in Neural Information Processing Systems, pp. 91-9999999999 2015.
Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-Net: Convolutional networks for biomed- ical image segmentation. In International Conference on Medical Image Computing and Computer-assisted Intervention, pp. 234-241 Springer, 2015.
Qingbin Shao, Lijun Gong, Kai Ma, Hualuo Liu, and Yefeng Zheng. Attentive CT lesion detection using deep pyramid inference with scali booster. In International Conference on Medical Image Computing and Cosputer-assisted Intervention, pp. 301-309. Springer, 2019.

---

Published as a conference paper at ICLR 2021
Chaomin Shen, Yaxin Peng, Guixu Zhang, and Jinsong Fan. Defending against adversarial at- tacks by suppressing the largest eigenvalue of Fisher information matrix. arXiv preprint arX- 1v:1909.06137,200 2019.
Wei Shen, Mu Zhou, Feng Yang, Caiyun Yang, and Jie Tian. Multi-scale convolutional neural networks for lung nodule classification. In International Conference on Information Processing Springer, 2015.
in Medical Imaging. pp.
Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille. Adversarial examples for semantic segmentation and object detection. In Proceedings of the IEEE Interna- tional Conference on Computer Vision, pp. 1369-1378, 2017.
Chenxiao Zhao, P Thomas Fletcher, Mixue Yu, Yaxin Peng, Guixu Zhang, and Chaomin Shen. The adversarial attack and detection under the Fisher information metric. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 33, pp. 5869-5876, 2019.
12


Reviews:
[{"review_id": "du1EufUuAIp", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The authors present a universal medical attack method that can consistently produce adversarial examples across several medical imaging domains. The authors achieve this by developing a novel objective function that includes two terms, which they refer to as stabilized medical attack (SMA). The first term is the loss deviation term, inspired by the conventional fast gradient sign method, which enlarges the difference between CNN predictions and ground truth labels. The second term, a regularizer, is the loss stabilization term that enforces consistent predictions between the adversarial image and the Gaussian smoothed version of the adversarial image. The authors then provide an insightful interpretation of their SMA loss via KL divergence. The derivation demonstrates that perturbations consistently move towards a fixed location in the SAM objective landscape during successive iterations of gradient ascent. This method increases perturbation robustness by overcoming huge variations that result from different types of medical imaging data. The authors provide an illustrative figure (Fig.2) to demonstrate that both the variance and direction of the adversarial perturbation remain stable and consistent across multiple iterations, compared to using the deviation loss alone. The authors then perform an ablation study to demonstrate the DEV + STA loss results in a significantly greater reduction in model performance across medical imaging datasets compared to DEV loss alone. Finally, compared to the state-of-the-art adversarial methods, SMA results in the greatest reduction in performance for all datasets.\n\nPros:\nThis is an excellent paper. Succinct and clear, addressing a known problem with any CAD system. They provide good justification of the technique. They provide sufficient mathematical detail to follow the KL divergence derivation. Both empirical studies are sound and demonstrate the expected results. Additional examples are provided in the supplementary materials. The methods are correct. The empirical methodology is correct. The paper is generally clear.\n\nCons:\nIt would be helpful for the reader/audience to have an associated figure that graphically demonstrated the point made in 3.2. There is a compelling geometric intuition behind the idea expressed in the text above Sec 3.3 that would help present the contribution of adding the STA term.", "extra_scores": {}, "extra_text": {}}, {"review_id": "ZCZ3TQekh3y", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 7, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper proposes to use a regularization term for stabilizing the perturbation trajectories in generating adversarial examples for medical image tasks. More specifically, they introduce a loss stabilization term which forces perturbed inputs to be close to smoothed perturbed inputs in the CNN output space. The authors give a shallow analysis which demonstrates that this regularizer forces convergence of softmax output to a uniform distribution (i.e. the maximum entropy distribution). In addition, their theoretical analysis yields a practical implementation for their loss term. The authors provide one visualization to demonstrate the differences in variance of the perturbation and variance in the directions of perturbation. Finally, they demonstrate the effectiveness of their method on three medical image datasets for separate computer vision tasks by comparing with the state of the art methods for adversarial attacks. I like the idea of using regularization in the generation of adversarial examples. In particular, the theoretical motivation to control the perturbation variance and output distribution is thought provoking. I believe more generalization and deeper analysis would be beneficial to future deep learning research, and for this primary reason do I vote to accept. My primary concern for the paper is the clarity of the presentation, which I explain in the cons section.\nPros: \n\n1. The paper presents a theoretically founded, and (somewhat) experimentally validated application of regularization for generating adversarial examples for multi-modal tasks and data for medical images.\n \n2. The proposed method is simple and elegant. It is theoretically well-founded and easily implemented. \n \n3. The paper provides good initial results, showing that to some degree their method is generalizable. The ablation study provides a good basis for demonstrating the effectiveness of the proposed regularization. \nCons: \n \n1. The datasets used are rather small and not well known within medical imaging community. I suggest expanding this study to include larger datasets (10,000+ images) and include other well-founded datasets for medical tasks (see literature cited by the paper). This would demonstrate greater generalization of the proposed method, especially in the case that this method generalizes to large, varied datasets.\n \n2. Because the real danger of adversarial attacks in medical images concerns false positives, the generation of adversarial examples that yield false positives would be helpful. Experiments regarding this would be even better.\n \n3. Could include visuals for multiple datasets and multiple tasks. \n\n4. Should include information on how the hyper-parameters were determined and the results of such validation. Particularly, epsilon, alpha, and stopping iteration. In addition, why was the second iteration chosen to introduce the regularization? \n\n5. On page 4, the authors claim “the limitations that are brought by huge network and data variance are effectively solved via our stabilized medical attack”. Why is this the case? While the method does reduce the variance in the perturbation and the direction of the perturbations, can you explain in the paper why this is inherent to deep networks and a variety of data modalities? The introduction could also touch on previous work demonstrating the difficulties adversarial examples have for differing data modalities (i.e. why, as is claimed, do previous methods not generalize away from natural images?)\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "38PL-rUgfC2", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 7, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The authors proposed to introduce a combination of a loss deviation term and a loss stabilization term to generate more consistent adversarial perturbations on medical images. The loss deviation term increases the divergence between the CNN prediction of an adversarial example and its ground truth label. At the same time, the loss stabilization term ensures similar CNN predictions of this example and its smoothed input. The authors tested against 3 different medical image datasets obtained by different modalities. The proposed strategy seems straightforward and the benefits are clearly demonstrated with these three datasets.\n\nOverall, I vote for good paper, accept, after minor revise. The proposed strategy seems straightforward and the benefits are clearly demonstrated with these three datasets. This approach may contribute to further improve CNN-based medical image diagnosis systems.\n\nMinor points:\n\nSince the authors demonstrated only with medical image dataset, the title Stabilized “Medical Attacks” seems misleading and inaccurate. There are many other data types in medical field such as text, wave form, numerical values, etc, thus the title should be more specific, at least “Medical Image Attacks”. Also the term “universal” is used several times in the main text, and it has the same issue since the authors tested only three medical image datasets while there are many more different modalities exist in the real medical field even if limit the data type to an image.\nConversely, the strategy, introducing a stabilization loss, seems not quite specific to the characteristics of medical image, rather potentially more general. Thus it is quite curious to see how this strategy can be generalized toward image datasets in other fields.\n", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review:  The paper proposes to use a regularization term for stabilizing the perturbation trajectories in generating adversarial examples for medical image tasks. The authors tested the effectiveness of their proposal on different medical image datasets obtained by different modalities, and the experimental results are generally encouraging.
All the reviewers see the value of the paper and give positive comments. At the same time, they also point out some aspects for further improvement, including
1)	The datasets used are relatively small
2)	The title is a little misleading since the paper only tackles the image attacks (but the title is stabilized medical attacks).
3)	Case studies and visualization are needed to help people better understand the paper

The authors have done a good job in their rebuttal and paper revision, by adding experiments on larger datasets, changing the title to “stabilized medical image attacks”, and adding some geometric figures for better illustration. These have largely addressed the concerns of the reviewers, and we see no problem with accepting the paper.

Decision: Accept (Spotlight)