# MedicalGuard: U-Net Model Robust against Adversarially Perturbed Images

Authors: Hyun Kwon
Journal: Security and Communication Networks
 (2021)

---

## Abstract

Deep neural networks perform well for image recognition, speech recognition, and pattern analysis. This type of neural network has also been used in the medical field, where it has displayed good performance in predicting or classifying patient diagnoses. An example is the U-Net model, which has demonstrated good performance in data segmentation, an important technology in the field of medical imaging. However, deep neural networks are vulnerable to adversarial examples. Adversarial examples are samples created by adding a small amount of noise to an original data sample in such a way that to human perception they appear to be normal data but they will be incorrectly classified by the classification model. Adversarial examples pose a significant threat in the medical field, as they can cause models to misidentify or misclassify patient diagnoses. In this paper, I propose an advanced adversarial training method to defend against such adversarial examples. An advantage of the proposed method is that it creates a wide variety of adversarial examples for use in training, which are generated by the fast gradient sign method (FGSM) for a range of epsilon values. A U-Net model trained on these diverse adversarial examples will be more robust to unknown adversarial examples. Experiments were conducted using the ISBI 2012 dataset, with TensorFlow as the machine learning library. According to the experimental results, the proposed method builds a model that demonstrates segmentation robustness against adversarial examples by reducing the pixel error between the original labels and the adversarial examples to an average of 1.45.


---

## Body

## 1. Introduction

Deep learning technology has enabled innovations in the field of computer image recognition. The deep neural network [1], which is a neural network with a multilayer structure, has displayed better performance than previous machine learning models on tasks in the field of image object classification. This technology has attracted particular attention in the field of medical imaging [2]. For example, Google’s machine learning technology for diabetic retinopathy diagnosis [3] using fundus images has demonstrated the capability of performing medical diagnoses at a level comparable to that of physicians. Studies using deep learning technology are also being conducted in the fields of radiology, pathology, and ophthalmology.However, deep neural networks are vulnerable to adversarial examples [4, 5]. An adversarial example is a sample created by adding a small amount of noise to an original data sample in such a way that it does not appear abnormal to humans but will be incorrectly classified by the model. If adversarial examples are included in medical image data, patient image data may be incorrectly classified by the deep learning model, resulting in incorrect diagnoses.In this paper, I propose a method of constructing a model that is robust against adversarial examples in medical images. The proposed method accomplishes this by generating adversarial examples for a range of epsilon values and then training the model using the fast gradient sign method (FGSM) [6]. The contributions of this paper are as follows: first, I propose a system of gradual adversarial training to build a model that is robust to adversarial examples, targeting the U-Net model, which segments data. Second, I analyze the proposed method using the pixel error of the adversarial examples and original samples as a metric. Third, I report the results of image analyses of adversarial examples and performance analyses of the adversarial examples and the proposed method according to the value of epsilon.The remainder of this paper is organized as follows: Section2 introduces related research, and Section 3 explains the proposed scheme. Section 4 presents the experiments and evaluations, and Section 5 discusses the proposed method further. Finally, the paper concludes with Section 6.


## 2. Related Work

This section describes the U-Net model and provides a brief introduction to adversarial examples.


### 2.1. U-Net Model

The U-Net model [7] is a model that performs well for segmenting a specific area of an image. Shown in Figure 1, the U-Net model has two advantages over previous models. First, it is fast because instead of using a sliding window to subdivide an image and scan the pieces one by one, it uses a patch method, cutting the entire image into a grid and classifying it all at once. Second, it does not face a trade-off between recognition rate and patch size. With the conventional method, the recognition rate for the overall data improves when a large area is examined at once, but this comes at the expense of localization. With U-Net, however, a high recognition rate is maintained both locally and for the entire dataset.Figure 1
U-Net model.The left half of the U-Net model’s structure, called a contracting path, consists of a part that decreases in size, and the right half, called an expansive path, increases in size. A feature of the structure is that the result value of each layer in the contracting path is concatenated with the output filter of the same-sized layer on the right before each max pooling operation is performed. In the concatenation operation, when the left image size is greater than that on the right, the model crops and resizes the image so that the left and right images mirror each other. In addition, it uses a trick to increase the recognition rate: it attaches the rest when cutting in the patch units called overlap tiles. Another advantage is its fast forwarding speed due to the lack of a fully connected layer.


### 2.2. Adversarial Examples

Adversarial examples are samples created by adding a small amount of noise to an original data sample such that the noise will be difficult for humans to discern but will cause misclassification by the model. The study of adversarial examples was introduced by Szegedy et al. [4] in 2014, and various types of attack and methods of defense have been investigated. Attacks by adversarial example can be classified in four ways: by the amount of information available on the target model, by the specificity of the desired misclassification, by method of distortion, and by the method used to generate the adversarial examples. First, adversarial examples can be divided according to the amount of information available on the target model into white box attacks and black box attacks [8]. A white box attack is one occurring in a scenario in which the attacker has all of the information about the target model: its structure, its parameters, and the output probability values for a given input. A black box attack is one occurring in a scenario in which the attacker does not have information about the target model; that is, only the model’s result for a given input can be known. It is more difficult for an attacker to generate adversarial examples for a black box attack than for a white box attack.Second, adversarial examples can be classified according to the specificity of the desired misclassification as targeted attacks [9, 10] or untargeted attacks [11]. In a targeted attack, the intent is that the adversarial example will be misclassified by the model as a specific target class determined by the attacker. In an untargeted attack, the intent is that the adversarial example will be misclassified by the model as any class other than the original class. Targeted attacks have the advantage of enabling more sophisticated attacks than untargeted attacks. On the other hand, untargeted attacks have the advantage of being able to generate adversarial examples in less time and with less distortion than targeted attacks require.Third, adversarial examples can be classified according to the metric of distortion [12] into L1, L2, and L∞ as follows:(1)Lp=∑i=1nx−x∗p1/p.In all three method of distortion, the smaller the result, the more similar the adversarial examplex∗ is to the original sample x.Fourth, adversarial examples can be classified according to the method used for generating them. These include FGSM [6], iterative FGSM (I-FGSM) [13], the DeepFool method [14], the Jacobian-based saliency map attack (JSMA) [15], and the Carlini and Wagner attack [5]. These methods generate adversarial examples using the output fed back by the target model on values given to it as input. A transformer adds a small amount of noise to the original data sample, generates a transformed data sample, and passes it to the target model, which delivers a corresponding probability value to the transformer as feedback. The transformer creates adversarial examples by iteratively adding a small amount of noise to the transformed data such that the probability value corresponding to the target class (or to a random class other than the original class) is increased.Methods of defense against adversarial examples involve manipulating the input data [16, 17] or making the classifier more robust [4, 6]. The first approach, manipulation of input data, defends against adversarial examples by reducing the effect of the adversarial noise on the input, such as by filtering or feature squeezing. The second approach, making the classifier more robust, reduces the effectiveness of adversarial example attacks by training the classifier on adversarial examples. The adversarial training method [6], for example, defends against unknown adversarial examples by training the target model on local adversarial examples borne by the model. This defense method is simple and effective relative to other methods. Other adversarial training methods have been investigated for images, text fields, and intrusion detection fields. Li and Qiu [18] proposed a method to enhance robustness against text adversarial examples. Text adversarial examples generated by the word-wise method are used in the training. Debicha et al. [19] proposed an intrusion detection method that increases robustness against adversarial examples. They generated adversarial examples from NSL-KDD data [20] in a local model to train the target model. The defense method proposed in this paper generates adversarial examples for a range of epsilon values using FGSM and uses these to train a U-Net model, thereby building a U-Net model that is more robust against adversarial examples.


## 2.1. U-Net Model

The U-Net model [7] is a model that performs well for segmenting a specific area of an image. Shown in Figure 1, the U-Net model has two advantages over previous models. First, it is fast because instead of using a sliding window to subdivide an image and scan the pieces one by one, it uses a patch method, cutting the entire image into a grid and classifying it all at once. Second, it does not face a trade-off between recognition rate and patch size. With the conventional method, the recognition rate for the overall data improves when a large area is examined at once, but this comes at the expense of localization. With U-Net, however, a high recognition rate is maintained both locally and for the entire dataset.Figure 1
U-Net model.The left half of the U-Net model’s structure, called a contracting path, consists of a part that decreases in size, and the right half, called an expansive path, increases in size. A feature of the structure is that the result value of each layer in the contracting path is concatenated with the output filter of the same-sized layer on the right before each max pooling operation is performed. In the concatenation operation, when the left image size is greater than that on the right, the model crops and resizes the image so that the left and right images mirror each other. In addition, it uses a trick to increase the recognition rate: it attaches the rest when cutting in the patch units called overlap tiles. Another advantage is its fast forwarding speed due to the lack of a fully connected layer.


## 2.2. Adversarial Examples

Adversarial examples are samples created by adding a small amount of noise to an original data sample such that the noise will be difficult for humans to discern but will cause misclassification by the model. The study of adversarial examples was introduced by Szegedy et al. [4] in 2014, and various types of attack and methods of defense have been investigated. Attacks by adversarial example can be classified in four ways: by the amount of information available on the target model, by the specificity of the desired misclassification, by method of distortion, and by the method used to generate the adversarial examples. First, adversarial examples can be divided according to the amount of information available on the target model into white box attacks and black box attacks [8]. A white box attack is one occurring in a scenario in which the attacker has all of the information about the target model: its structure, its parameters, and the output probability values for a given input. A black box attack is one occurring in a scenario in which the attacker does not have information about the target model; that is, only the model’s result for a given input can be known. It is more difficult for an attacker to generate adversarial examples for a black box attack than for a white box attack.Second, adversarial examples can be classified according to the specificity of the desired misclassification as targeted attacks [9, 10] or untargeted attacks [11]. In a targeted attack, the intent is that the adversarial example will be misclassified by the model as a specific target class determined by the attacker. In an untargeted attack, the intent is that the adversarial example will be misclassified by the model as any class other than the original class. Targeted attacks have the advantage of enabling more sophisticated attacks than untargeted attacks. On the other hand, untargeted attacks have the advantage of being able to generate adversarial examples in less time and with less distortion than targeted attacks require.Third, adversarial examples can be classified according to the metric of distortion [12] into L1, L2, and L∞ as follows:(1)Lp=∑i=1nx−x∗p1/p.In all three method of distortion, the smaller the result, the more similar the adversarial examplex∗ is to the original sample x.Fourth, adversarial examples can be classified according to the method used for generating them. These include FGSM [6], iterative FGSM (I-FGSM) [13], the DeepFool method [14], the Jacobian-based saliency map attack (JSMA) [15], and the Carlini and Wagner attack [5]. These methods generate adversarial examples using the output fed back by the target model on values given to it as input. A transformer adds a small amount of noise to the original data sample, generates a transformed data sample, and passes it to the target model, which delivers a corresponding probability value to the transformer as feedback. The transformer creates adversarial examples by iteratively adding a small amount of noise to the transformed data such that the probability value corresponding to the target class (or to a random class other than the original class) is increased.Methods of defense against adversarial examples involve manipulating the input data [16, 17] or making the classifier more robust [4, 6]. The first approach, manipulation of input data, defends against adversarial examples by reducing the effect of the adversarial noise on the input, such as by filtering or feature squeezing. The second approach, making the classifier more robust, reduces the effectiveness of adversarial example attacks by training the classifier on adversarial examples. The adversarial training method [6], for example, defends against unknown adversarial examples by training the target model on local adversarial examples borne by the model. This defense method is simple and effective relative to other methods. Other adversarial training methods have been investigated for images, text fields, and intrusion detection fields. Li and Qiu [18] proposed a method to enhance robustness against text adversarial examples. Text adversarial examples generated by the word-wise method are used in the training. Debicha et al. [19] proposed an intrusion detection method that increases robustness against adversarial examples. They generated adversarial examples from NSL-KDD data [20] in a local model to train the target model. The defense method proposed in this paper generates adversarial examples for a range of epsilon values using FGSM and uses these to train a U-Net model, thereby building a U-Net model that is more robust against adversarial examples.


## 3. Proposed Scheme

Figure2 shows an overview of the proposed method. The proposed method is divided into three steps: generation of adversarial examples, training of the U-Net model, and inference. First, in the adversarial example generation step, a variety of adversarial examples are generated using FGSM for several values of epsilon and targeting a local model known to the defender. In the second step, the method provides additional training to the U-Net model, using the diverse array of adversarial examples generated in the first step. The proposed method trains the U-Net model on the adversarial examples generated using a range of epsilon values within which the segmentation performance of the U-Net model is not degraded. Third, the trained U-Net model is tested for its segmentation performance on unknown adversarial examples. Through this procedure, the proposed method provides greater robustness than the existing adversarial training method, as the U-Net model trains on various adversarial examples created with multiple epsilon values, thereby becoming more robust against unknown adversarial examples.Figure 2
Overview of the proposed method. (a) Generating adversarial example. (b) Training processing. (c) Inference.The mathematical expression of the proposed method is as follows: first, to generate local adversarial examples for each of several values of epsilon, the fast gradient sign method (FGSM) [6] finds an adversarial example xl∗ through L∞:(2)xl∗=x+ϵ⋅sign▽lossF,tx,where F is an objective function of the local model and t is the target class. In FGSM, the local adversarial example is generated according to the value of ϵ from the input image x through the gradient ascent method, which is simple but has excellent performance. Local adversarial examples are generated for epsilon values ranging from 0.1 to 0.4.Second, the proposed method performs additional training of the U-Net model using a dataset that matches the original label with various adversarial examples. Given original samplex, various adversarial examples xl∗, and original label y, the operation function f of the U-Net model learns to associate fx and fxl∗ with original label y:(3)fx=y∈Yandfxl∗=y∈Y.Third, to confirm the robustness of the trained U-Net model against unknown adversarial examples, the U-Net model segments the unknown adversarial examplexu∗ generated from a holdout model with the original label:(4)fxu∗=y∈Y.


## 4. Experimental Setup and Evaluation

This section describes the experimental environment and reports the results for the proposed method. The experiments were performed using the TensorFlow [21] machine learning library and a Xeon E5-2609 1.7 GHz server.


### 4.1. Dataset

The ISBI 2012 dataset [22] was used for the experiments. This is a serial section transmission electron microscopy (ssTEM) dataset of the Drosophila first instar larva ventral nerve cord (VNC). It is commonly used in the segmentation of medical images. It is composed of 30 images and labels. The microcube measures approximately 2×2×1.5 microns, and the resolution is 4×4×50 nm/pixel. The label is binary and is represented by a black and white image, with segmented objects represented in white and the rest represented in black. It was tested by the k-fold cross-validation method. Although the ISBI 2012 dataset is small, the U-Net model has demonstrated very high performance on data segmentation using this dataset.


### 4.2. Model Configurations

The experiments in this study involved a U-Net model as the attack target; a local model, used for the advanced adversarial training of the U-Net model; and a holdout model, as used by attackers to perform a transfer attack. An attacker performs a transfer attack on the U-Net model as a black box attack, using an adversarial example created using the holdout model.


#### 4.2.1. U-Net Model

The target model was a U-Net model used for data segmentation. Its structure is given in Table1. The Adam algorithm [23] was used as the optimization algorithm of the U-Net model, and ReLU [24] was used as the activation function. The model’s parameter values are given in Table 2.Table 1
Architecture of the U-Net model.
LevelConv layerFilterStrideOutput sizeInput244, 244, 3Contracting pathLevel 1Conv 13, 3, 641224, 244, 64Conv 23, 3, 641224, 244, 64Level 2Conv 33, 3, 1282112, 112, 128Conv 43, 3, 1281112, 112, 128Level 3Conv 53, 3, 256256, 56, 256Conv 63, 3, 256156, 56, 256Level 4Conv 73, 3, 512228, 28, 512Conv 83, 3, 512128, 28, 512BridgeLevel 5Conv 93, 3, 1024214, 14, 1024Conv 103, 3, 1024114, 14, 1024Expansive pathLevel 6Conv 113, 3, 512128, 28, 512Conv 123, 3, 512128, 28, 512Level 7Conv 133, 3, 256156, 56, 256Conv 143, 3, 256156, 56, 256Level 8Conv 153, 3, 1281112, 112, 128Conv 163, 3, 1281112, 112, 128Level 9Conv 173, 3, 641224, 244, 64Conv 183, 3, 641224, 244, 64OutputConv 191, 11224, 244, 1Table 2
Parameters of the target model.
ParameterValueLearning rate0.001Momentum0.9Dropout0.5Batch size4Number of epochs100


#### 4.2.2. Local Model

The local model has the same structure as the U-Net model, but with different parameters: the learning rate was 0.002, and the epoch was set to 80 to create the local model.


#### 4.2.3. Holdout Model

The holdout model was configured as shown in Table3; its structure was different from that of the U-Net models. The learning rate was set to 0.002, the epoch was set to 120, and the remaining parameter values were as listed in Table 2.Table 3
Architecture of the holdout model.
LevelConv layerFilterStrideOutput sizeInput244, 244, 3Contracting pathLevel 1Conv 13, 3, 641224, 244, 64Conv 23, 3, 641224, 244, 64Level 2Conv 33, 3, 1282112, 112, 128Conv 43, 3, 1281112, 112, 128Level 3Conv 53, 3, 256256, 56, 256Conv 63, 3, 256156, 56, 256Level 4Conv 73, 3, 512228, 28, 512Conv 83, 3, 512128, 28, 512Level 5Conv 93, 3, 1024214, 14, 1024Conv 103, 3, 1024114, 14, 1024BridgeLevel 6Conv 113, 3, 202827, 7, 1024Conv 123, 3, 202817, 7, 2028Expansive pathLevel 7Conv 133, 3, 1024114, 14, 1024Conv 143, 3, 1024114, 14, 1024Level 8Conv 153, 3, 512128, 28, 512Conv 163, 3, 512128, 28, 512Level 9Conv 173, 3, 256156, 56, 256Conv 183, 3, 256156, 56, 256Level 10Conv 193, 3, 1281112, 112, 128Conv 203, 3, 1281112, 112, 128Level 11Conv 213, 3, 641224, 244, 64Conv 223, 3, 641224, 244, 64OutputConv 231, 11224, 244, 1


### 4.3. Generation of the Adversarial Examples

For the local model, FGSM was used as the adversarial example generation method. In producing the adversarial examples, the value of epsilon was varied from 0.1 to 0.4. For each value of epsilon, 30 adversarial examples were generated. The adversarial examples generated in this way from the local model were used in the additional training of the U-Net model. For the holdout model, 30 adversarial examples unknown to the U-Net model were generated for each of several values of epsilon ranging from 0.1 to 0.9, also by FGSM.


### 4.4. Experimental Results

This section shows the results of the analysis of adversarial example images generated from the holdout model, the analysis of the segmentation performance of the proposed method, and the analysis of pixel error for the proposed method.Table4 shows examples of original sample images, adversarial noise, and adversarial examples from the holdout model. To generate the adversarial noise, epsilon was set to 0.4 for each image. It can be seen in the table that in terms of human perception, there is little difference between the original sample and the adversarial example. Even so, the U-Net model’s segmentation of each sample will be incorrect if a method of defense is not used.Table 4
Examples of original sample images, adversarial noise, and adversarial examples from the holdout model.
DescriptionCase 1Case 2Case 3Original sampleAdversarial noiseAdversarial exampleTable5 shows a comparison between original labels and output results of the model with no defense, the baseline model, and the proposed model. The model with no defense is a U-Net model with no defense against adversarial examples. The baseline model is a U-Net model to which the existing adversarial training method was applied, and adversarial examples generated from the local model using an epsilon value of 0.4 were used for additional training. It can be seen in the figure that the model with no defense produced many incorrect segmentations in the adversarial examples. This is because the noise of the adversarial example affects the elements to be segmented, resulting in errors. On the other hand, the segmentations produced by the proposed model and the baseline model for the adversarial examples are similar to the original labels. Furthermore, the proposed model had better segmentation performance on a greater number of adversarial examples than the baseline model because it was trained on a variety of adversarial examples generated from a wider range of epsilon values than the baseline model.Table 5
Comparison between original label and output result of the model with no defense, the baseline model, and the proposed model. The model with no defense is a U-Net model with no defense against adversarial examples. The baseline model is a U-Net model to which the existing adversarial training method has been applied.
DescriptionCase 1Case 2Case 3Adversarial exampleOriginal labelNo defenseBaselineProposedFigure3 shows the pixel error between the original label and the adversarial example for each model. The “pixel error” is the difference between the pixels of the original label and those of the classified output, calculated according to the L2 metric. It can be seen in the figure that as epsilon increased, the pixel error of the adversarial examples likewise increased. Because the proposed model is robust to adversarial examples, the pixel error was small for unknown adversarial examples. On the other hand, the model with no defense had the largest pixel error for adversarial examples, and the baseline model, because it is not trained on the adversarial examples generated using a range of epsilon values as is the proposed model, had a pixel error higher than that of the proposed model.Figure 3
Pixel error between the original label and the adversarial example for the model with no defense, the baseline model, and the proposed model.


## 4.1. Dataset

The ISBI 2012 dataset [22] was used for the experiments. This is a serial section transmission electron microscopy (ssTEM) dataset of the Drosophila first instar larva ventral nerve cord (VNC). It is commonly used in the segmentation of medical images. It is composed of 30 images and labels. The microcube measures approximately 2×2×1.5 microns, and the resolution is 4×4×50 nm/pixel. The label is binary and is represented by a black and white image, with segmented objects represented in white and the rest represented in black. It was tested by the k-fold cross-validation method. Although the ISBI 2012 dataset is small, the U-Net model has demonstrated very high performance on data segmentation using this dataset.


## 4.2. Model Configurations

The experiments in this study involved a U-Net model as the attack target; a local model, used for the advanced adversarial training of the U-Net model; and a holdout model, as used by attackers to perform a transfer attack. An attacker performs a transfer attack on the U-Net model as a black box attack, using an adversarial example created using the holdout model.


### 4.2.1. U-Net Model

The target model was a U-Net model used for data segmentation. Its structure is given in Table1. The Adam algorithm [23] was used as the optimization algorithm of the U-Net model, and ReLU [24] was used as the activation function. The model’s parameter values are given in Table 2.Table 1
Architecture of the U-Net model.
LevelConv layerFilterStrideOutput sizeInput244, 244, 3Contracting pathLevel 1Conv 13, 3, 641224, 244, 64Conv 23, 3, 641224, 244, 64Level 2Conv 33, 3, 1282112, 112, 128Conv 43, 3, 1281112, 112, 128Level 3Conv 53, 3, 256256, 56, 256Conv 63, 3, 256156, 56, 256Level 4Conv 73, 3, 512228, 28, 512Conv 83, 3, 512128, 28, 512BridgeLevel 5Conv 93, 3, 1024214, 14, 1024Conv 103, 3, 1024114, 14, 1024Expansive pathLevel 6Conv 113, 3, 512128, 28, 512Conv 123, 3, 512128, 28, 512Level 7Conv 133, 3, 256156, 56, 256Conv 143, 3, 256156, 56, 256Level 8Conv 153, 3, 1281112, 112, 128Conv 163, 3, 1281112, 112, 128Level 9Conv 173, 3, 641224, 244, 64Conv 183, 3, 641224, 244, 64OutputConv 191, 11224, 244, 1Table 2
Parameters of the target model.
ParameterValueLearning rate0.001Momentum0.9Dropout0.5Batch size4Number of epochs100


### 4.2.2. Local Model

The local model has the same structure as the U-Net model, but with different parameters: the learning rate was 0.002, and the epoch was set to 80 to create the local model.


### 4.2.3. Holdout Model

The holdout model was configured as shown in Table3; its structure was different from that of the U-Net models. The learning rate was set to 0.002, the epoch was set to 120, and the remaining parameter values were as listed in Table 2.Table 3
Architecture of the holdout model.
LevelConv layerFilterStrideOutput sizeInput244, 244, 3Contracting pathLevel 1Conv 13, 3, 641224, 244, 64Conv 23, 3, 641224, 244, 64Level 2Conv 33, 3, 1282112, 112, 128Conv 43, 3, 1281112, 112, 128Level 3Conv 53, 3, 256256, 56, 256Conv 63, 3, 256156, 56, 256Level 4Conv 73, 3, 512228, 28, 512Conv 83, 3, 512128, 28, 512Level 5Conv 93, 3, 1024214, 14, 1024Conv 103, 3, 1024114, 14, 1024BridgeLevel 6Conv 113, 3, 202827, 7, 1024Conv 123, 3, 202817, 7, 2028Expansive pathLevel 7Conv 133, 3, 1024114, 14, 1024Conv 143, 3, 1024114, 14, 1024Level 8Conv 153, 3, 512128, 28, 512Conv 163, 3, 512128, 28, 512Level 9Conv 173, 3, 256156, 56, 256Conv 183, 3, 256156, 56, 256Level 10Conv 193, 3, 1281112, 112, 128Conv 203, 3, 1281112, 112, 128Level 11Conv 213, 3, 641224, 244, 64Conv 223, 3, 641224, 244, 64OutputConv 231, 11224, 244, 1


## 4.2.1. U-Net Model

The target model was a U-Net model used for data segmentation. Its structure is given in Table1. The Adam algorithm [23] was used as the optimization algorithm of the U-Net model, and ReLU [24] was used as the activation function. The model’s parameter values are given in Table 2.Table 1
Architecture of the U-Net model.
LevelConv layerFilterStrideOutput sizeInput244, 244, 3Contracting pathLevel 1Conv 13, 3, 641224, 244, 64Conv 23, 3, 641224, 244, 64Level 2Conv 33, 3, 1282112, 112, 128Conv 43, 3, 1281112, 112, 128Level 3Conv 53, 3, 256256, 56, 256Conv 63, 3, 256156, 56, 256Level 4Conv 73, 3, 512228, 28, 512Conv 83, 3, 512128, 28, 512BridgeLevel 5Conv 93, 3, 1024214, 14, 1024Conv 103, 3, 1024114, 14, 1024Expansive pathLevel 6Conv 113, 3, 512128, 28, 512Conv 123, 3, 512128, 28, 512Level 7Conv 133, 3, 256156, 56, 256Conv 143, 3, 256156, 56, 256Level 8Conv 153, 3, 1281112, 112, 128Conv 163, 3, 1281112, 112, 128Level 9Conv 173, 3, 641224, 244, 64Conv 183, 3, 641224, 244, 64OutputConv 191, 11224, 244, 1Table 2
Parameters of the target model.
ParameterValueLearning rate0.001Momentum0.9Dropout0.5Batch size4Number of epochs100


## 4.2.2. Local Model

The local model has the same structure as the U-Net model, but with different parameters: the learning rate was 0.002, and the epoch was set to 80 to create the local model.


## 4.2.3. Holdout Model

The holdout model was configured as shown in Table3; its structure was different from that of the U-Net models. The learning rate was set to 0.002, the epoch was set to 120, and the remaining parameter values were as listed in Table 2.Table 3
Architecture of the holdout model.
LevelConv layerFilterStrideOutput sizeInput244, 244, 3Contracting pathLevel 1Conv 13, 3, 641224, 244, 64Conv 23, 3, 641224, 244, 64Level 2Conv 33, 3, 1282112, 112, 128Conv 43, 3, 1281112, 112, 128Level 3Conv 53, 3, 256256, 56, 256Conv 63, 3, 256156, 56, 256Level 4Conv 73, 3, 512228, 28, 512Conv 83, 3, 512128, 28, 512Level 5Conv 93, 3, 1024214, 14, 1024Conv 103, 3, 1024114, 14, 1024BridgeLevel 6Conv 113, 3, 202827, 7, 1024Conv 123, 3, 202817, 7, 2028Expansive pathLevel 7Conv 133, 3, 1024114, 14, 1024Conv 143, 3, 1024114, 14, 1024Level 8Conv 153, 3, 512128, 28, 512Conv 163, 3, 512128, 28, 512Level 9Conv 173, 3, 256156, 56, 256Conv 183, 3, 256156, 56, 256Level 10Conv 193, 3, 1281112, 112, 128Conv 203, 3, 1281112, 112, 128Level 11Conv 213, 3, 641224, 244, 64Conv 223, 3, 641224, 244, 64OutputConv 231, 11224, 244, 1


## 4.3. Generation of the Adversarial Examples

For the local model, FGSM was used as the adversarial example generation method. In producing the adversarial examples, the value of epsilon was varied from 0.1 to 0.4. For each value of epsilon, 30 adversarial examples were generated. The adversarial examples generated in this way from the local model were used in the additional training of the U-Net model. For the holdout model, 30 adversarial examples unknown to the U-Net model were generated for each of several values of epsilon ranging from 0.1 to 0.9, also by FGSM.


## 4.4. Experimental Results

This section shows the results of the analysis of adversarial example images generated from the holdout model, the analysis of the segmentation performance of the proposed method, and the analysis of pixel error for the proposed method.Table4 shows examples of original sample images, adversarial noise, and adversarial examples from the holdout model. To generate the adversarial noise, epsilon was set to 0.4 for each image. It can be seen in the table that in terms of human perception, there is little difference between the original sample and the adversarial example. Even so, the U-Net model’s segmentation of each sample will be incorrect if a method of defense is not used.Table 4
Examples of original sample images, adversarial noise, and adversarial examples from the holdout model.
DescriptionCase 1Case 2Case 3Original sampleAdversarial noiseAdversarial exampleTable5 shows a comparison between original labels and output results of the model with no defense, the baseline model, and the proposed model. The model with no defense is a U-Net model with no defense against adversarial examples. The baseline model is a U-Net model to which the existing adversarial training method was applied, and adversarial examples generated from the local model using an epsilon value of 0.4 were used for additional training. It can be seen in the figure that the model with no defense produced many incorrect segmentations in the adversarial examples. This is because the noise of the adversarial example affects the elements to be segmented, resulting in errors. On the other hand, the segmentations produced by the proposed model and the baseline model for the adversarial examples are similar to the original labels. Furthermore, the proposed model had better segmentation performance on a greater number of adversarial examples than the baseline model because it was trained on a variety of adversarial examples generated from a wider range of epsilon values than the baseline model.Table 5
Comparison between original label and output result of the model with no defense, the baseline model, and the proposed model. The model with no defense is a U-Net model with no defense against adversarial examples. The baseline model is a U-Net model to which the existing adversarial training method has been applied.
DescriptionCase 1Case 2Case 3Adversarial exampleOriginal labelNo defenseBaselineProposedFigure3 shows the pixel error between the original label and the adversarial example for each model. The “pixel error” is the difference between the pixels of the original label and those of the classified output, calculated according to the L2 metric. It can be seen in the figure that as epsilon increased, the pixel error of the adversarial examples likewise increased. Because the proposed model is robust to adversarial examples, the pixel error was small for unknown adversarial examples. On the other hand, the model with no defense had the largest pixel error for adversarial examples, and the baseline model, because it is not trained on the adversarial examples generated using a range of epsilon values as is the proposed model, had a pixel error higher than that of the proposed model.Figure 3
Pixel error between the original label and the adversarial example for the model with no defense, the baseline model, and the proposed model.


## 5. Discussion

### 5.1. Assumptions

The proposed method assumes that the attacker will perform a transfer attack in the form of a black box attack, with no information on the U-Net model. In other words, it is assumed that the attacker will exploit the feature that an adversarial example generated from the holdout model (known to the attacker) can be effective as an attack against other U-Net models. In the experiment, to give the advantage to the side of the attacker, the holdout model and the U-Net model were defined to have similar structures. The proposed defense method used adversarial examples generated from the local model (similar to the U-Net model) in the additional training of the U-Net model.


### 5.2. Epsilon

In FGSM, epsilon is a parameter that controls the amount of adversarial noise. When adversarial examples are segmented, as epsilon increases, the pixel error of the segmentation increases. On the other hand, it is important to keep in mind that the amount of adversarial noise added in generating the adversarial example increases as epsilon increases. Therefore, it is desirable to select a value for epsilon such that the pixel error of the segmentation by the model will be high but the adversarial noise will not be identifiable by the human eye.The adversarial examples generated from the local model using values of epsilon ranging from 0.1 to 0.4 were used in the additional training of the U-Net model. By training adversarial examples generated using various values for epsilon, the proposed method produces a model that is more robust to unknown adversarial examples.


### 5.3. Pixel Error

The models’ performance on the original labels and the results of the model with no defense, the baseline model, and the proposed model were analyzed using pixel error. As epsilon increases, the adversarial noise of the unknown adversarial example increases, and thus, the pixel error increases. The trade-off is that with higher epsilon values, the adversarial noise becomes easier for humans to discern. The proposed model has less pixel error than the other models between the original labels and the adversarial examples. The proposed model is robust in correctly segmenting unknown adversarial examples because it has been trained on a variety of adversarial examples.


### 5.4. Applications

An adversarial training method can be used in medical applications in which there is a risk of misclassification due to adversarial examples. In the experiment, adversarial examples for a segmentation application in the medical field were analyzed. Segmentation is an important technology for MRI imaging and tumor identification in the healthcare industry. If a segmentation is incorrect because of adversarial examples in such medical projects, it can pose a serious threat to patients’ medical care. Therefore, the proposed method can be an important tool in the field of medical imaging because it creates models that are robust against adversarial examples.


### 5.5. Limitations

FGSM was chosen as a representative method from among the adversarial example generation methods for use in the proposed method. Studies on the proposed method can be expanded by using alternative adversarial example generation methods. In addition, it may be interesting to research targets of attack other than the U-Net segmentation model.


## 5.1. Assumptions

The proposed method assumes that the attacker will perform a transfer attack in the form of a black box attack, with no information on the U-Net model. In other words, it is assumed that the attacker will exploit the feature that an adversarial example generated from the holdout model (known to the attacker) can be effective as an attack against other U-Net models. In the experiment, to give the advantage to the side of the attacker, the holdout model and the U-Net model were defined to have similar structures. The proposed defense method used adversarial examples generated from the local model (similar to the U-Net model) in the additional training of the U-Net model.


## 5.2. Epsilon

In FGSM, epsilon is a parameter that controls the amount of adversarial noise. When adversarial examples are segmented, as epsilon increases, the pixel error of the segmentation increases. On the other hand, it is important to keep in mind that the amount of adversarial noise added in generating the adversarial example increases as epsilon increases. Therefore, it is desirable to select a value for epsilon such that the pixel error of the segmentation by the model will be high but the adversarial noise will not be identifiable by the human eye.The adversarial examples generated from the local model using values of epsilon ranging from 0.1 to 0.4 were used in the additional training of the U-Net model. By training adversarial examples generated using various values for epsilon, the proposed method produces a model that is more robust to unknown adversarial examples.


## 5.3. Pixel Error

The models’ performance on the original labels and the results of the model with no defense, the baseline model, and the proposed model were analyzed using pixel error. As epsilon increases, the adversarial noise of the unknown adversarial example increases, and thus, the pixel error increases. The trade-off is that with higher epsilon values, the adversarial noise becomes easier for humans to discern. The proposed model has less pixel error than the other models between the original labels and the adversarial examples. The proposed model is robust in correctly segmenting unknown adversarial examples because it has been trained on a variety of adversarial examples.


## 5.4. Applications

An adversarial training method can be used in medical applications in which there is a risk of misclassification due to adversarial examples. In the experiment, adversarial examples for a segmentation application in the medical field were analyzed. Segmentation is an important technology for MRI imaging and tumor identification in the healthcare industry. If a segmentation is incorrect because of adversarial examples in such medical projects, it can pose a serious threat to patients’ medical care. Therefore, the proposed method can be an important tool in the field of medical imaging because it creates models that are robust against adversarial examples.


## 5.5. Limitations

FGSM was chosen as a representative method from among the adversarial example generation methods for use in the proposed method. Studies on the proposed method can be expanded by using alternative adversarial example generation methods. In addition, it may be interesting to research targets of attack other than the U-Net segmentation model.


## 6. Conclusion

In this paper, I have proposed an advanced adversarial training method to defend against adversarial examples. An advantage of this method is that it trains the U-Net model using a diverse array of adversarial examples, generated using FGSM for a range of epsilon values. The proposed method provides a segmentation model with robustness against adversarial examples by reducing the pixel error between the original labels and adversarial examples to an average of 1.45.In future research, the scope can be expanded to experiments with other datasets. In addition, the proposed method can be applied to models for medical data by generating the adversarial examples using generative adversarial nets [25]. Finally, another interesting topic for research would be ensemble defense methods for use in the medical field.



---

*Source: 5595026-2021-08-10.xml*