# Adversarial Attacks on Medical Segmentation Model via Transformation of Feature Statistics
## 3 Experiments
### Implemented Models
#### 3.2.2 Implemented Attack Methods  
We compare our method with existing adversarial attack methods that are most commonly used in automated medical image diagnosis [30]: the fast gradient sign method (FGSM) [17], basic iterative method (BIM) [18] and stabilized medical image attacks (SMIA) [19]. We have implemented these adversarial methods for the comparison. The concepts for the models are outlined as follows:  
* **Our attack method:** We adopt the structure of the texture reformer [21] as depicted in Figure 3 and we reimplement the final three levels to transform the statistics as described in Equation (2). The model is based on stacked autoencoders. It contains the five separate encoder-decoder components. Encoder layers consist of convolutional layers similarly VGG19 [31] to extract features from the source image. Decoder layers are structured as flipped encoders using the nearest neighbor interpolation to generate the target image. We exploit open source and pre-trained weights provided by the official implementation ([[https://github.com/EndyWon/Texture-Reformer](https://github.com/EndyWon/Texture-Reformer)]([https://github.com/EndyWon/Texture-Reformer](https://github.com/EndyWon/Texture-Reformer)), accessed on 25 July 2022). The source code for our framework is available at [[https://github.com/hyercia-bdml/adversarial-attack-transformation-statistics](https://github.com/hyercia-bdml/adversarial-attack-transformation-statistics)]([https://github.com/hyercia-bdml/adversarial-attack-transformation-statistics](https://github.com/hyercia-bdml/adversarial-attack-transformation-statistics)) (accessed on 17 March 2024).
* **FGSM:** It calculates gradients given input image \(x\) and corresponding class \(y\). The gradients act as a direction for maximizing the loss function \(J\) of the target model. The direction is added into original image \(x\) to generate the adversarial sample \(x_{adv}\). We formulate the attack as below: \[x_{adv}=x+\epsilon\cdot\text{sign}\big{(}\
abla_{x}J\big{(}x,y\big{)}\big{)}\] where \(\epsilon\) is the step size.
* **BIM:** It is an iterative method while FGSM is a one-step method. The difference is that BIM maximizes the loss repetitively (for instance, \(K\) times) and adds stacks of the gradients \(x^{i}_{adv}\) to the original image. BIM is defined as the following equation for our problem: \[x^{i+1}_{adv}=\pi\Big{(}x^{i}_{adv}+\frac{1}{K}\big{(}\
abla_{x}J\big{(}x^{i} _{adv},y\big{)}\big{)}\Big{)}\] where initial \(x^{0}_{adv}\) is the input image \(x\) and \(\pi\) is the clipping function to avoid exceeding pixel values in the range from \(x-\epsilon\) to \(x+\epsilon\).
* **SMIA:** It is specialized to fool models in only the medical domain whereas FGSM and BIM are for general purposes. Unlike how those models produce noisy results, SMIA reduces noise. The key idea is that while adversarial samples tend to be noisy,  
Figure 6: The number of images corresponding to each organ.  
SMIA adds a stabilization function into the loss function to force the noisy sample close to the blurred sample obtained by a Gaussian kernel. The stabilization loss for maximization is formulated for our problem as follows:  
\[\mathcal{L}=\mathcal{L}\big{(}M(x_{adv}),y\big{)}-\alpha\cdot\mathcal{L}\big{(}M (x_{adv}),M(x+W*\eta)\big{)}\]  
where \(W\) is the Gaussian kernel to convolutional operation with the perturbation noise \(\eta\) (\(=x_{adv}-x\)) and \(\alpha\) is the scalar balancing factor for the loss terms.