# Adversarial Attacks on Medical Segmentation Model via Transformation of Feature Statistics
## 2 Proposed Methods
### Generation of Adversarial Sample Using Dynamic Adaptive Instance Normalization  
AdaIN has been proposed to align the mean and standard deviations of the feature statistics from the source and target images, respectively [22]. AdaIN can be formulated as follows. \[\text{AdaIN}(f_{t},f_{s})=\sigma(f_{t})\left(\frac{f_{s}-\mu(f_{s})}{\sigma(f _{s})}\right)+\mu(f_{t}) \tag{1}\]  
where \(f_{t}\) and \(f_{s}\) represent the feature statistics of the target and source samples, respectively, while \(\mu\) and \(\sigma\) denote the mean and standard deviation (SD), respectively. The formula indicates that the source features undergo standard normalization using its own mean \(\mu(f_{s})\) and standard deviation \(\sigma(f_{s})\), and subsequently become unnormalized using \(\mu(f_{t})\) and \(\sigma(f_{t})\) derived from the target input features. As such, AdaIN does not require learning any parameters during model training. Rather, its computation occurs solely during inference, thereby enabling rapid style transfer without the need for predefined styles [21; 22]. For these reasons, AdaIN is widely employed in various style transfer models [21; 23; 24; 25]. Given the challenge of predicting the feature statistics of an adversarial sample before its creation, we propose a method influenced by AdaIN for the targeted adjustment of input feature statistics. We designate this method as dAdaIN (Dynamic Adaptive Instance Normalization), which facilitates the manual selection of suitable transformation factors. These factors are chosen based on human judgment to balance the adversarial impact with the authenticity of the generated samples. It is important to note that while an intruder can assess the extent to which the adversarial sample deceives the model and evaluate its visual realism, expertise in CT imaging is not a prerequisite. The transformation of feature statistics in this study is defined as follows:  
\[\text{d}\text{AdaIN}(f_{x},f_{x_{adv}})=\alpha_{\sigma}\cdot\sigma(f_{x})\left( \frac{f_{x_{adv}}-\mu(f_{x_{adv}})}{\sigma(f_{x_{adv}})}\right)+\alpha_{\mu} \cdot\mu(f_{x}) \tag{2}\]  
where \(f_{x}\) and \(f_{x_{adv}}\) represent the features of the target image and the adversarial sample, respectively. The parameters \(\alpha_{\mu}\) and \(\alpha_{\sigma}\) are transformation factors for the mean and standard deviation (SD), respectively, with \(\alpha_{\mu}=1\) and \(\alpha_{\sigma}=1\) preserving the original statistics. It is worth noting that since the features of the adversarial sample cannot be predetermined, \(f_{x}=f_{x_{adv}}\). However, as these identical features are fed into different branches of the encoder structure, as detailed in the remainder of this subsection, we differentiate the terms as described. For example, we demonstrate the transformation of the target feature's statistics in the yellow box shown in Figure 2. Between the encoder and decoder, the statistics of features denoted \(f_{x}\) and \(f_{x_{adv}}\) undergo transformation using Equation (2) as illustrated in the figure's lower diagram. In the diagram, the brown and orange bars represent the mean values and standard deviation (SD) values for each feature channel, respectively. Although AdaIN accomplishes high performance for style transfer, plugging it in any encoder-decoder structure does not guarantee it will generate realistic adversarial images to fool a segmentation model as well as physicians. Therefore, we consider the state-of-the-art style transfer model which is the texture reformer [21]. The texture reformer is a patch-based style transfer model which receives two pairs of the image and associated segment to be the source and the target. Since our main goal is not the style transfer but the transforming statistics of features, our modified texture reformer accepts only a pair of original CT images and associated seg  
Figure 2: This figure depicts an example of the transformation process of the feature statistics from the source image.