## 1 Introduction  
Robustness describes a model's ability to maintain safe operation when its inputs, parameters, and conditions change slightly. At present, deep learning algorithms are widely used in the aided diagnosis of diseases, and we must address the robustness of disease-aided diagnosis models based on deep learning. However, two kinds of errors, namely, misdiagnosis and missed diagnosis, inevitably occur in disease-aided diagnosis models. Misdiagnosis and missed diagnosis are critical factors affecting the security of an aided-diagnosis model [1]. Clinical diagnostic data do not have an even distribution of positive and negative samples. This means that the corresponding model applied will learn biased prior information, which will weaken the model [2]. It is challenging to obtain electronic medical records, and it is even more difficult to obtain misdiagnosed medical records in clinical practice. If it only takes other common diseases as negative samples and ignores medical record information on misdiagnosis, a model cannot thoroughly learn the characteristics of misdiagnosis, and the results it yields will not conform to the actual clinical situation. From a model security perspective, it is very harmful to the results when a large portion of the training samples only consists of simple negative samples. Although it is simple to train a model on negative samples, it will only receive a limited amount of gradient information. Finally, it is not easy to distinguish between hard-negative samples and positive samples [3]. Clinical misdiagnosis medical records are similar to positive sample medical records. Compared with other common medical records used as negative samples, misdiagnosed medical records are more consistent with the definition of hard negatives. Therefore, whether to address the need to enhance the security of a model or the practical difficulties faced by the clinic, models must be trained to recognize high-quality misdiagnosis medical records as negative samples. In addition, applying machine learning techniques to extensively distributed data may lead to disclosing sensitive information about the data's subjects [4]. Data often contain sensitive identifiable information, and even if this information is protected, over-processing techniques employed in machine learning can be used to identify individuals, thus raising privacy concerns. Data collection performed when machine learning techniques are applied to medically assisted diagnoses can similarly involve patient-related privacy issues, especially concerning the collection of negative samples such as misdiagnosed medical records, which involve more significant ethical challenges [5]. Many organizations must ensure that the personal data they collect for data analytics are sufficiently anonymous to reduce the associated compliance burden [6]. However, this will inevitably lead to insufficient sample sizes and increased data collection costs. Determining how to achieve data augmentation without sacrificing user privacy and choosing how to maximize the usability of published data is the ultimate goal of privacy-preserving data publishing [7]. Therefore, from the perspective of model training and data privacy protection, suitable data augmentation methods are needed, as they can improve the robustness of medical models and reduce the data collection cost. Data augmentation aims at generating additional synthetic training data in data-deficient scenarios. Data augmentation methods include rule-based methods, learnable generation-based methods, etc., ensuring the augmented data's validity. Thus, data augmentation methods must ensure that the augmented data are valid for a given task, i.e., that they are regarded as part of the same distribution as the original data ([PERSON] et al., 2020) [8]. For example, the semantic similarity in machine translation and labels in text categorization are the same as those about the original data.