## 5 AI Regulations, Verification, and Ethical Problems
### Verification of the Model
#### 5.2.1 Adversarial Attacks  
Adversarial attacks on AI models in dermatology involve deliberately manipulating skin images (e.g., photos of moles or cancerous lesions) in a way that changes their classification by the AI model while remaining almost imperceptible to the human eye. Adversarial attacks involve adding slight, deliberate noise to the input image. This noise is chosen to affect the AI model's prediction but not to change the human perception of the image.  
The most popular adversarial attack methods include the fast gradient sign method (FGSM) [132], which adds a small perturbation in the gradient direction, maximising the model error; projected gradient descent (PGD) [132], which is an improved version of the FGSM with the iterative addition of perturbations; and the Carlini and Wagner attack (CW) [133], which generates minimal perturbations that effectively change the model's classification. These attacks are most easily found in programming libraries such as CleverHans [134], the Adversarial Robustness Toolbox [135], Foolbox [136], or AdvBox [137], making it easier for modellers to prepare attacks to train their models further using adversarial training [138; 139; 140; 141; 142]. However, there is a great need for new adversarial attack generation algorithms that are specialised for dermatological images [143].  
Figure 8: The left subfigure simulates a skin image with a dark birthmark (mole) in the centre. The middle subfigure shows the noise added to the left one. The right subfigure illustrates an adversarial attack: the same image with added slight noise, which is imperceptible but can affect classification by machine learning models.  
Suppose that an AI model classifies images of moles as benign or malignant (melanoma) (Figure 8). An adversarial attack can modify the image so that a malignant mole is classified as benign (false negative diagnosis) or a benign mole is classified as malignant (false positive diagnosis).  
As a consequence, this can lead to incorrect medical decisions, such as delays in skin cancer diagnosis or unnecessary biopsies and treatments.  
These attacks can be used for both malicious and testing purposes. Unique attack generation can be used to test the robustness of the model, increasing its security against other attacks. It is intended to counter cyberattacks, which can be used to sabotage AI models used in hospitals or telemedicine [144].  
Fortunately, we can defend against attacks using adversarial training defence, where the model is trained on data containing examples of attacks. This involves detecting anomalies, i.e., unnatural perturbations in images, and utilising image processing filters to remove interference invisible to the eye.  
Adversarial attacks pose a significant threat to AI systems in dermatology, as they can lead to incorrect diagnoses and potentially detrimental outcomes. Studying and counteracting them is crucial for patient safety and the effectiveness of artificial intelligence in medicine, following the standard verification of model quality using the measures presented in Section 3.5.