# Deep Learning for Medical Image Cryptography: A Comprehensive Review
## 3 Vulnerability of Deep Learning-Based Medical Image Analysis
### Adversarial Medical Image Analysis  
The objective of a medical adversarial attack is to produce adversarial cases to thwart medical diagnosis models while they are still in the inference stage. The no-box adversarial approach against systems that analyze medical images was researched by [PERSON] et al. in detail [81]. Numerous studies have shown that pre-training can significantly improve the transferability of the surrogate model to the target black-box model. Their findings indicate a relationship between the value of disruption and the effectiveness and perceptibility of the attacks. Finally, attack performance might be affected when the attacker and target have different data and models, which is improved by pre-training models, which also increases adversarial transferability. [PERSON] et al. [82] investigated how adversarial attacks affected the classification of skin lesions and brain segmentation. Inception-v3 [83], Inception-v4 [84], and MobileNet [85] models have been used for the classification task, while the segmentation work was carried out using SegNet [86], U-Net [87], and DenseNet [88]. The most effective models for classification and segmentation tasks, according to experiments, were InceptionV3 and DenseNet. The authors demonstrated that a model's robustness for classification is connected with its depth, whereas a model's efficiency for segmentation is increased by packed blocks and skip connections. The hostile samples were barely evident because the SSIM was 0.97-0.99. Fundoscopy, dermoscopy, and chest X-ray images were subjected to PGD white and black box attacks by [PERSON] et al. [89] using a pre-trained ResNet50 model [39]. In both instances, the model's accuracy was significantly reduced. In order to perform segmentation tasks, [PERSON] et al. [90] experimented with targeted PGD attack in X-rays. The model fragmented the heart symbol rather than the actual heart since they added barely discernible noise to the photographs. Additionally, they used white-box, black-box, and untargeted PGD attacks, which considerably reduced the model's average IoU. The COVID-19 classification accuracy from X-rays and CT scans was investigated by [PERSON] et al. [91]. They developed adversarial samples using the FGSM attack and evaluated them using the VGG-16 and InceptionV3 models. These models are susceptible, as evidenced by the accuracy declines of up to 90% in VGG-16 and up to 63% in InceptionV3. [PERSON] et al. [92] evaluated the vulnerability of CNN-based COVID-Net [93] model which is one of the first deep learning model to detect COVID-19 using chest X-ray (CXR) images and is an open source and also available for general public. Targeted and non-targeted, two types of attacks are explored by applying perturbation generated via the fast gradient sign method (FGSM). The COVID-Net CXR small and CXR big models have both been assessed by the authors. Their findings demonstrated that, after adding 2% universal adversarial perturbations, both models achieved success rates for non-targeted and targeted attacks of >85% and >90%, respectively. Additionally, scientists have demonstrated that these models result in normal and pneumonia test pictures as COVID-19 images with larger perturbations. Furthermore, they examined COVID-Net's susceptibility in comparison to certain other DL models including ResNet and VGG. They employed adversarial retraining as a defense strategy and used the COVIDx dataset. For the categorization of skin cancer, diabetic retinopathy, pneumonia, and other diseases, [PERSON] et al. [94] looked into universal adversarial attacks on DNNs. They tested both targeted and non-targeted attacks using a variety of models, including VGG16, VGG19, InceptionV2, DenseNet169, DenseNet121, and ResNet50. They found that, in the majority of situations, adversarial training was ineffective, particularly in attacks that were not specifically targeted. While this was happening, non-targeted attacks had a low transferability rate.