## 4 Discussion  
The COVID-19 pandemic is a danger to global health and requires the development of models to identify infected people and isolate them. To automate the diagnosis process from chest radiology images, deep learning-based artificial intelligence techniques provide a promising method to address the problem and can be quickly and inexpensively used in a pandemic situation. However, the most promising deep learning-based approaches require vulnerability analysis to adversarial attacks such as FGSM attack before deployment. Most frequently used pre-trained models to develop radiology image-based COVID-19 diagnosis techniques are publicly available with all relevant parameters. Moreover, these images are captured in a well-defined standard environment for which attack generation is also easier. Sharing of the images to build big data environment for rare disease such as COVID-19, the sharing of reusable pre-trained deep learning model parameters and access of the intruders to computerized and network-based diagnosis systems play a vital role to make the system vulnerable to adversarial attack. Therefore, there are widespread relevant research opportunities. We developed transfer learning-based deep learning methods from popular pre-trained models VGG16 and Inception-v3. For both X-ray and CT images, these models  
Figure 13: Sample drop of class probability score for successfully classified adversarial chest CT images. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline  & \multicolumn{3}{c}{**VGG16**} & \multicolumn{3}{c}{**Inception-v3**} \\ \cline{2-7} \(\epsilon\) & **Average Original** & **Average Adversarial** & **Average Probability** & **Average Original** & **Average Adversarial** & **Average Probability** \\  & **Probability** & **Probability** & **Decease** & **Probability** & **Probability** & **Decease** \\ \hline
0.0001 & 0.970143 & 0.95651 & 0.013633 & 1 & 0.999243 & 0.000757 \\
0.0003 & 0.979453 & 0.943228 & 0.036225 & 0.9998 & 0.9965 & 0.0033 \\
0.0005 & 0.984652 & 0.935994 & 0.048657 & 1 & 0.994946 & 0.005054 \\
0.0007 & 0.990419 & 0.930707 & 0.059711 & 1 & 0.994075 & 0.005925 \\
0.0009 & 0.995197 & 0.938476 & 0.056721 & 0.997934 & 0.986894 & 0.01104 \\
0.002 & 0.997335 & 0.903967 & 0.093368 & 1 & 0.981473 & 0.018527 \\
0.004 & 0.999686 & 0.864664 & 0.135021 & 0.99249 & 0.973294 & 0.019196 \\
0.006 & 1 & 0.836082 & 0.163918 & 1 & 0.972294 & 0.027706 \\
0.008 & 1 & 0.826898 & 0.173102 & 1 & 0.971526 & 0.028474 \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Average drop of predicted correct class probability for adversarial chest CT images. showed trustworthy performance in terms of various metrics such as accuracy, precision, recall, F1 score, and AUC. Apart from that, this research investigated the vulnerability of the developed deep learning models which are representative of transfer learning-based models for COVID-19 detection from radiology images. For X-ray images, the VGG16 model accuracy dropped significantly by more than 90%, and for the Inception-v3 network, it dropped by 30% if the perturbation increased from 0.0001 to 0.09. Similarly, for CT images, the FGSM attack also revealed potential risks such as misclassification. Moreover, our study shows that the degree of perturbation considerably affects human perceptibility of attacks. This study depicted that for small perturbations, although no noise can be visible in the adversarial images, misclassification as well as class probability reduction can happen for these images. Rich textures in COVID-19 X-ray images often cause the deep learning models to focus on unimportant regions of the features. Therefore, the adversarial attack needs to be considered for these image-based COVID-19 diagnosis techniques before they are practically deployed. The FGSM attack can be crafted from open-source resources; therefore, this research utilized open-source pre-trained models, parameters, and datasets for COVID-19 detection.