Original: On the Robustness of deep learning-based MRI Reconstruction to image transformations
Revised: On the Robustness of deep learning-based MRI Reconstruction to image transformations

Original: Anonymous Author(s)

Original: AffiliationAddress email

Original: Abstract
Revised: Abstract

Original: Although deep learning (DL) has received much attention in accelerated magneticresonance imaging (MRI), recent studies show that tiny input perturbations maylead to instabilities of DL-based MRI reconstruction models.
Revised: Although deep learning (DL) has received much attention in accelerated magnetic resonance imaging (MRI), recent studies show that tiny input perturbations may lead to instabilities of DL-based MRI reconstruction models.

Original: However, the approaches of robustifying these models are underdeveloped.
Revised: However, the approaches of robustifying these models are underdeveloped.

Original: Compared to imageclassification, it could be much more challenging to achieve a robust MRI imagereconstruction network considering its regression-based learning objective, limitedamount of training data, and lack of efficient robustness metrics.
Revised: Compared to image classification, it could be much more challenging to achieve a robust MRI image reconstruction network considering its regression-based learning objective, limited amount of training data, and lack of efficient robustness metrics.

Original: To circumvent theabove limitations, our work revisits the problem of DL-based image reconstructionthrough the lens of robust machine learning.
Revised: To circumvent the above limitations, our work revisits the problem of DL-based image reconstruction through the lens of robust machine learning.

Original: We find a new instability sourceof MRI image reconstruction, i.e. , the lack of reconstruction robustness againstspatial transformations of an input, e.g. , rotation and cutout.
Revised: We find a new instability source of MRI image reconstruction, i.e. , the lack of reconstruction robustness against spatial transformations of an input, e.g. , rotation and cutout.

Original: Inspired by this newrobustness metric, we develop a robustness-aware image reconstruction methodthat can defend against both pixel-wise adversarial perturbations as well as spatialtransformations.
Revised: Inspired by this new robustness metric, we develop a robustness-aware image reconstruction method that can defend against both pixel-wise adversarial perturbations as well as spatial transformations.

Original: Extensive experiments are also conducted to demonstrate theeffectiveness of our proposed approaches.
Revised: Extensive experiments are also conducted to demonstrate the effectiveness of our proposed approaches.

Original:  Introduction
Revised:  Introduction

Original: Medical image reconstruction is a known problem in magnetic resonance imaging (MRI).
Revised: Medical image reconstruction is a known problem in magnetic resonance imaging (MRI).

Original: The keychallenge lies in solving an inverse problem so as to enable the reconstruction of a high-qualitymedical image from sub-sampled measurements that are readily be obtained from medical devices[Lustig et al., 2008].
Revised: The key challenge lies in solving an inverse problem so as to enable the reconstruction of a high-quality medical image from sub-sampled measurements that are readily be obtained from medical devices [Lustig et al., 2008].

Original: The conventional approach for solving the MRI image reconstruction problemcommonly resorted to sparse signal processing techniques [Lustig et al., 2008, Yang et al., 2010,
Revised: The conventional approach for solving the MRI image reconstruction problem commonly resorted to sparse signal processing techniques [Lustig et al., 2008, Yang et al., 2010,

Original: Huang et al., 2011], e.g. , compressed sensing.
Revised: Huang et al., 2011], e.g. , compressed sensing.

Original: The key enabling technique is to leverage sparsityinducing optimization [Bach et al., 2011], e.g. , the least-squared problem penalized by ℓ 1 norm.
Revised: The key enabling technique is to leverage sparsityinducing optimization [Bach et al., 2011], e.g. , the least-squared problem penalized by ℓ 1 norm.

Original: Incontrast to the direct optimization-based approaches, an increasing amount of recent works proposedthe deep learning (DL)-based MRI image reconstruction methods [Zhu et al., 2018, Liang et al., 2020,
Revised: In contrast to the direct optimization-based approaches, an increasing amount of recent works proposed the deep learning (DL)-based MRI image reconstruction methods [Zhu et al., 2018, Liang et al., 2020,

Original: Sriram et al., 2020].
Revised: Sriram et al., 2020].

Original: With aid of DL models, the problem of image reconstruction is then solved assupervised learning problem in which the reconstruction error between the ‘predicted’ high-qualityimage and the train-time ‘reference’ image is minimized.
Revised: With aid of DL models, the problem of image reconstruction is then solved as supervised learning problem in which the reconstruction error between the ‘predicted’ high-quality image and the train-time ‘reference’ image is minimized.

Original: In this work, our research falls into thecategory of DL-based MRI image reconstruction.
Revised: In this work, our research falls into the category of DL-based MRI image reconstruction.

Original: The DL-based image reconstruction approaches can be roughly divided into three types.
Revised: The DL-based image reconstruction approaches can be roughly divided into three types.

Original: First, U-Net[Ronneberger et al., 2015] and its many variants [Han and Ye, 2018, Lee et al., 2018] follow the
Revised: First, U-Net [Ronneberger et al., 2015] and its many variants [Han and Ye, 2018, Lee et al., 2018] follow the

Original: Encoder-Decoder based network architecture.
Revised: Encoder-Decoder based network architecture.

Original: Second, learning-to-optimize (L2O), which leveragesa recurrent neural network (RNN) to mimic an iterative optimization algorithm in problem solving[Chen et al., 2017], was adopted to unroll the optimization flow of sparse signal recovery for imagereconstruction [Yang et al., 2016, Aggarwal et al., 2018, Hosseini et al., 2020]
Revised: Second, learning-to-optimize (L2O), which leverages a recurrent neural network (RNN) to mimic an iterative optimization algorithm in problem solving [Chen et al., 2017], was adopted to unroll the optimization flow of sparse signal recovery for image reconstruction [Yang et al., 2016, Aggarwal et al., 2018, Hosseini et al., 2020]

Original: Third, in addition to supervised learning, state-of-the-art unsupervised learning approaches were leveraged to tacklemedical image reconstruction in the scarce data regime [Hu et al., 2021, Fabian et al., 2021].
Revised: Third, in addition to supervised learning, state-of-the-art unsupervised learning approaches were leveraged to tackle medical image reconstruction in the scarce data regime [Hu et al., 2021, Fabian et al., 2021].

Original: In spite of the rapid growth in DL for medical image reconstruction, nearly all existing works focusedon tackling the problem of enhancing image reconstruction accuracy .
Revised: In spite of the rapid growth in DL for medical image reconstruction, nearly all existing works focused on tackling the problem of enhancing image reconstruction accuracy .

Original: However, a series of recentworks [Antun et al., 2020, Zhang et al., 2021] showed that the DL-based image reconstructionnetwork suffers a weakness : the lack of adversarial robustness.
Revised: However, a series of recent works [Antun et al., 2020, Zhang et al., 2021] showed that the DL-based image reconstruction network suffers a weakness : the lack of adversarial robustness.

Original: Specifically, it has been shown in
Revised: Specifically, it has been shown in

Original: Antun et al.
Revised: Antun et al.

Original: [2020] that an imagery input, at the presence of adversarial perturbations (which aredesigned via adversarial learning, known as adversarial attack generation), can significantly hamperthe image reconstruction accuracy even if these perturbations are unnoticeable to human eyes.
Revised: [2020] that an imagery input, at the presence of adversarial perturbations (which are designed via adversarial learning, known as adversarial attack generation), can significantly hamper the image reconstruction accuracy even if these perturbations are unnoticeable to human eyes.

Original: Werefer readers to Fig. 2(b) for a reconstructed image example using an DL-based approach when facingadversarial input perturbations.
Revised: We refer readers to Fig. 2(b) for a reconstructed image example using an DL-based approach when facing adversarial input perturbations.

Original: Prior to the finding of the lack of adversarial robustness in imagereconstruction , the problem of adversarial learning has been extensively studied in the domain ofimage classification [Goodfellow et al., 2014, Carlini and Wagner, 2017, Croce and Hein, 2020].
Revised: Prior to the finding of the lack of adversarial robustness in image reconstruction , the problem of adversarial learning has been extensively studied in the domain of image classification [Goodfellow et al., 2014, Carlini and Wagner, 2017, Croce and Hein, 2020].

Original: To defend such adversarial perturbations, the min-max optimization-based adversarial training (AT)[Madry et al., 2017] provides a principled defensive method to robustify image classifiers.
Revised: To defend such adversarial perturbations, the min-max optimization-based adversarial training (AT) [Madry et al., 2017] provides a principled defensive method to robustify image classifiers.

Original: By contrast,few work studied the problem of improving adversarial robustness for deep image reconstructionnetworks, except Raj et al.
Revised: By contrast, few work studied the problem of improving adversarial robustness for deep image reconstruction networks, except Raj et al.

Original: [2020], Calivá et al.
Revised: [2020], Calivá et al.

Original: [2020] which were mainly built upon AT.
Revised: [2020] which were mainly built upon AT.

Original: Differentfrom the existing work, our contributions are summarized below.
Revised: Different from the existing work, our contributions are summarized below.

Original: • We show that in addition to adversarial perturbation, deep MRI image reconstruction models are also vulnerable to tiny input spatial transformations.
Revised: • We show that in addition to adversarial perturbation, deep MRI image reconstruction models are also vulnerable to tiny input spatial transformations.

Original: • We develop a generalized adversarial training (GAT) approach that promotes robustness againstboth adversarial input perturbations and input spatial transformations.
Revised: • We develop a generalized adversarial training (GAT) approach that promotes robustness against both adversarial input perturbations and input spatial transformations.

Original: • We demonstrate the effectiveness of GAT on the MRI dataset [Aggarwal et al., 2018], showing ourimprovement over the conventional standard training and adversarial training
Revised: • We demonstrate the effectiveness of GAT on the MRI dataset [Aggarwal et al., 2018], showing our improvement over the conventional standard training and adversarial training.

Original:  Preliminaries
Revised:  Preliminaries

Original: In this section, we provide a brief background on the problem of accelerated MRI acquisition, andthe deep learning (DL) based MRI reconstruction method.
Revised: In this section, we provide a brief background on the problem of accelerated MRI acquisition, and the deep learning (DL) based MRI reconstruction method.

Original: Accelerated multi-coil MRI acquisition In MRI , measurement of a patient’s anatomy is acquiredin the Fourier-domain, also known as the k -space, through receiver coils.
Revised: Accelerated multi-coil MRI acquisition In MRI , measurement of a patient’s anatomy is acquired in the Fourier-domain, also known as the k -space, through receiver coils.

Original: In the setup of multi-coil
Revised: In the setup of multi-coil

Original: MRI acquisition, each coil will capture a different region of a targeted image, and will be assignedwith a complex-valued sensitive map, noted by S i .
Revised: MRI acquisition, each coil will capture a different region of a targeted image, and will be assigned with a complex-valued sensitive map, noted by S i .

Original: As a result, the k -space measurement y ∈ C n ofa complex-valued ground truth image x ∗ ∈ C n is given by :
Revised: As a result, the k -space measurement y ∈ C n of a complex-valued ground truth image x ∗ ∈ C n is given by :

Original: [Equation]
Revised: [Equation]

Original: where N is the number of coils, P Ω is a binary sampling mask that will be introduced later, F is thetwo-dimensional Fourier-transform, and n i ∈ C n is the additive noise arising in the measurementprocess.
Revised: where N is the number of coils, P Ω is a binary sampling mask that will be introduced later, F is the two-dimensional Fourier-transform, and n i ∈ C n is the additive noise arising in the measurement process.

Original: In (1), the use of P Ω is for the purpose of accelerating the multi-coil MRI acquisition, sinceobtaining the full-sampled measurements in the k -space is quite time-consuming.
Revised: In (1), the use of P Ω is for the purpose of accelerating the multi-coil MRI acquisition, since obtaining the full-sampled measurements in the k -space is quite time-consuming.

Original: The 0 s in P Ωrepresents the frequencies that will not be sampled.
Revised: The 0 s in P Ω represents the frequencies that will not be sampled.

Original: We refer readers to Deshmane et al.
Revised: We refer readers to Deshmane et al.

Original: [2012] formore details on multi-coil MRI acquisition.
Revised: [2012] for more details on multi-coil MRI acquisition.

Original: Eventually, the multi-coil MRI acquisition process canbe formulated as the forward mapping below [Pruessmann et al., 2001]
Revised: Eventually, the multi-coil MRI acquisition process can be formulated as the forward mapping below [Pruessmann et al., 2001]

Original: [Equation]
Revised: [Equation]

Original: where y Ω denotes the sub-sampled multi-coil k -space measurements, A Ω denotes the forwardencoding operator which concatenates P Ω F S i across all coils.
Revised: where y Ω denotes the sub-sampled multi-coil k -space measurements, A Ω denotes the forward encoding operator which concatenates P Ω F S i across all coils.

Original: MRI reconstruction problem The goal of MRI reconstruction is to estimate the original image x ∗from the k -space measurement y Ω .
Revised: MRI reconstruction problem The goal of MRI reconstruction is to estimate the original image x ∗ from the k -space measurement y Ω .

Original: The conventional solution to dealing with the MRI reconstructionproblem is to treat the problem as an inverse problem and then calls the regularized least-squaredmethod [Pruessmann et al., 2001, Sutton et al., 2003] .
Revised: The conventional solution to dealing with the MRI reconstruction problem is to treat the problem as an inverse problem and then calls the regularized least-squared method [Pruessmann et al., 2001, Sutton et al., 2003] .

Original: However, the state-of-the-art reconstructionperformance is achieved by a learning-based approach, especially for using deep models.
Revised: However, the state-of-the-art reconstruction performance is achieved by a learning-based approach, especially for using deep models.

Original: In thisparadigm, we aim to learn a reconstruction network f θ , parameterized by θ , under a training dataset D .
Revised: In this paradigm, we aim to learn a reconstruction network f θ , parameterized by θ , under a training data set D .

Original: In the training set, the data ‘feature’ is given by the sub-sampled image z acquired from thek -space measurement directly, namely, z =
Revised: In the training set, the data ‘feature’ is given by the sub-sampled image z acquired from the k -space measurement directly, namely, z =

Original: A H Ω y Ω , and the data ‘label’ is given by the original imagex ∗ .
Revised: A H Ω y Ω , and the data ‘label’ is given by the original image x ∗ .

Original: The rationale behind using z rather than y Ω is that the mapping from z and x ∗ can be readily achieved using a denoising-based neural network [Aggarwal et al., 2018] as the input resolution andthe output resolution remain the same.
Revised: The rationale behind using z rather than y Ω is that the mapping from z and x ∗ can be readily achieved using a denoising-based neural network [Aggarwal et al., 2018] as the input resolution and the output resolution remain the same.

Original: The deep learning (DL) based MRI reconstruction then seeksthe optimal network parameters θ by minimizing a certain training loss ℓ over the training dataset D :
Revised: The deep learning (DL) based MRI reconstruction then seeks the optimal network parameters θ by minimizing a certain training loss ℓ over the training dataset D :

Original: [Equation]
Revised: [Equation]

Original: where recall that f θ ( z ) and x ∗ correspond to the network output image and the reference fullysampled image, respectively.
Revised: where recall that f θ ( z ) and x ∗ correspond to the network output image and the reference fullysampled image, respectively.

Original: In practice, a normalized ℓ 1 - ℓ 2 loss [Knoll et al., 2020a] is commonlyused to specify ℓ , which is given by
Revised: In practice, a normalized ℓ 1 - ℓ 2 loss [Knoll et al., 2020a] is commonly used to specify ℓ , which is given by

Original: [Equation]
Revised: [Equation]

Original: Fig.
Revised: Fig.

Original: 1 shows the input sub-sampled image z , the reconstructed image obtained from the normallytrained model θ NT by solving problem (3), and the full-sampled reference image x ∗ .
Revised: 1 shows the input sub-sampled image z , the reconstructed image obtained from the normally trained model θ NT by solving problem (3), and the full-sampled reference image x ∗ .

Original: [Figure]
Revised: [Figure]

Original:  The Lack of Robustness for DL-Based MRI Reconstruction
Revised:  The Lack of Robustness for DL-Based MRI Reconstruction

Original: In this section, we will demonstrate two vulnerabilities of the DL-based MRI reconstruction networkto input ‘perturbations’.
Revised: In this section, we will demonstrate two vulnerabilities of the DL-based MRI reconstruction network to input ‘perturbations’.

Original: First, we echo the finding of Antun et al.
Revised: First, we echo the finding of Antun et al.

Original: [2020] that DL-based MRIreconstruction is oversensitive to adversarial input perturbations , which are unnoticeable but carefullycrafted to worsen the reconstruction accuracy.
Revised: [2020] that DL-based MRI reconstruction is oversensitive to adversarial input perturbations , which are unnoticeable but carefully crafted to worsen the reconstruction accuracy.

Original: Second, beyond Antun et al.
Revised: Second, beyond Antun et al.

Original: [2020], we find that DLbased MRI reconstruction also lacks robustness against input spatial transformations , e.g. , flipping,cutting-out, and rotation, even to a small degree.
Revised: [2020], we find that DLbased MRI reconstruction also lacks robustness against input spatial transformations , e.g. , flipping, cutting-out, and rotation, even to a small degree.

Original: To the best of our knowledge, the vulnerability of
Revised: To the best of our knowledge, the vulnerability of

Original: DL-based MRI reconstruction to spatial transformations of inputs is found for the first time.
Revised: DL-based MRI reconstruction to spatial transformations of inputs is found for the first time.

Original: Norm-constrained adversarial input perturbations Given a well-trained reconstruction networkf θ NT from (3), the norm-constrained adversarial attack was first established by Antun et al.
Revised: Norm-constrained adversarial input perturbations Given a well-trained reconstruction network f θ NT from (3), the norm-constrained adversarial attack was first established by Antun et al.

Original: [2020] inthe context of MRI image reconstruction.
Revised: [2020] in the context of MRI image reconstruction.

Original: Following the same spirit of adversarial attack in imageclassification [Goodfellow et al., 2014], the adversarially perturbed input is formulated as z + δ , whereδ denotes adversarial perturbations.
Revised: Following the same spirit of adversarial attack in image classification [Goodfellow et al., 2014], the adversarially perturbed input is formulated as z + δ , where δ denotes adversarial perturbations.

Original: The adversary then optimizes δ to degrade the reconstructionperformance.
Revised: The adversary then optimizes δ to degrade the reconstruction performance.

Original: To this end, one can solve the optimization problem [Antun et al., 2020],
Revised: To this end, one can solve the optimization problem [Antun et al., 2020],

Original: [Equation]
Revised: [Equation]

Original: where ∥ · ∥ ∞ denotes the ℓ ∞ norm, ϵ > 0 is the perturbation budget, and ℓ signifies the reconstructionloss, e.g. , given by (4).
Revised: where ∥ · ∥ ∞ denotes the ℓ ∞ norm, ϵ > 0 is the perturbation budget, and ℓ signifies the reconstruction loss, e.g. , given by (4).

Original: The rational behind (5) is to learn δ so as to enlarge the discrepancy betweenthe model outputs at the perturbed input and the original input, respectively.
Revised: The rational behind (5) is to learn δ so as to enlarge the discrepancy between the model outputs at the perturbed input and the original input, respectively.

Original: To solve the optimizationproblem (5), the standard projected gradient descent (PGD)
Revised: To solve the optimization problem (5), the standard projected gradient descent (PGD)

Original: [Madry et al., 2017] is commonly used.
Revised: [Madry et al., 2017] is commonly used.

Original: In
Revised: In

Original: Fig.
Revised: Fig.

Original: 2, we compare the image reconstruction results (when facing the benign input and the adversarialperturbed input, respectively) with the full-sampled reference image x ∗ .
Revised: 2, we compare the image reconstruction results (when facing the benign input and the adversarial perturbed input, respectively) with the full-sampled reference image x ∗ .

Original: To generate the adversarialperturbations δ , we use PGD to solve (5) with ϵ = 0 .
Revised: To generate the adversarial perturbations δ , we use PGD to solve (5) with ϵ = 0 .

Original: Spatial transformation-based input perturbations.
Revised: Spatial transformation-based input perturbations.

Original: We next introduce a non-norm-constrainedadversarial perturbations by leveraging input spatial transformations, e.g. , flipping, cutting-out, androtation.
Revised: We next introduce a non-norm-constrained adversarial perturbations by leveraging input spatial transformations, e.g. , flipping, cutting-out, and rotation.

Original: We ask: Will DL-based MRI reconstruction network be robust against heuristics-based inputtransformations?
Revised: We ask: Will DL-based MRI reconstruction network be robust against heuristics-based input

Original: Different from adversarial perturbations that are determined by solving (5), the

Original: [Figure]
Revised: [Figure]

Original:  input transformations are randomly generated.
Revised: transformations? Different from adversarial perturbations that are determined by solving (5), the input transformations are randomly generated.

Original: Let T : C n → C n denote a transformation operation,the perturbed input is then given by
Revised: Let T : C n → C n denote a transformation operation, the perturbed input is then given by

Original: [Equation]
Revised: [Equation]

Original: Associated with (6), the desired reference image will become T ( x ∗ ) .
Revised: Associated with (6), the desired reference image will become T ( x ∗ ) .

Original: Given the normally trainednetwork f θ NT , we find that there exists a large discrepancy between f θ NT ( T ( z )) and its referenceimage T ( x ∗ ) .
Revised: Given the normally trained network f θ NT , we find that there exists a large discrepancy between f θ NT ( T ( z )) and its reference image T ( x ∗ ) .

Original: An example is shown in Fig.
Revised: An example is shown in Fig.

Original: 3, where a rotation of 180 ◦ is applied to the input imagez .
Revised: 3, where a rotation of 180 ◦ is applied to the input image z .

Original: Moreover, by comparing f θ NT
Revised: Moreover, by comparing f θ NT

Original: ( T ( z )) with f θ NT ( z + δ ) in Fig. 2, we observe that DL-based MRIreconstruction lacks robustness  not only optimization-based adversarial perturbations but also heuristics-based input transformations.
Revised: ( T ( z )) with f θ NT ( z + δ ) in Fig. 2, we observe that DL-based MRI reconstruction lacks robustness against not only optimization-based adversarial perturbations but also heuristics-based input transformations.

Original: [Figure]
Revised: [Figure]

Original:  Towards Unified Robustness of MRI Reconstruction
Revised:  Towards Unified Robustness of MRI Reconstruction

Original: In this section, we will develop novel training protocols to acquire robust DL-based MRI reconstruction networks against both adversarial perturbations and input transformations.
Revised: In this section, we will develop novel training protocols to acquire robust DL-based MRI reconstruction networks against both adversarial perturbations and input transformations.

Original: To defend adversarialperturbations, the min-max optimization (MMO)-based adversarial training (AT) recipe will be usedfollowing the same spirit of robust image classification [Madry et al., 2017].
Revised: To defend adversarial perturbations, the min-max optimization (MMO)-based adversarial training (AT) recipe will be used following the same spirit of robust image classification [Madry et al., 2017].

Original: However, we will showthat AT lacks efficacy to improve robustness against input transformations.
Revised: However, we will show that AT lacks efficacy to improve robustness against input transformations.

Original: Spurred by that, we willthen propose a generalized AT approach that can incorporate data augmentations for ‘free’, namely,without needing additional data annotations.
Revised: Spurred by that, we will then propose a generalized AT approach that can incorporate data augmentations for ‘free’, namely, without needing additional data annotations.

Original: Adversarial training (AT) AT adopts MMO as the algorithmic backbone, where the worst-case(maximum) training loss is minimized by incorporating a synthesized attack during model training.
Revised: Adversarial training (AT) AT adopts MMO as the algorithmic backbone, where the worst-case (maximum) training loss is minimized by incorporating a synthesized attack during model training.

Original: For robust image classification, AT has been poised the only effective defense method [Athalye et al. ,2018] against the adversarial input perturbations.
Revised: For robust image classification, AT has been poised the only effective defense method [Athalye et al., 2018] against the adversarial input perturbations.

Original: Based on MMO, problem (3) can be modified as
Revised: Based on MMO, problem (3) can be modified as

Original: [Equation]
Revised: [Equation]

Original: where the training loss is given by (4).
Revised: where the training loss is given by (4).

Original: Compared to (3), the attack generation problem (5) is infusedinto (7) as an inner maximization problem.
Revised: Compared to (3), the attack generation problem (5) is infused into (7) as an inner maximization problem.

Original: To solve problem (7), the alternating gradient ascentdescent method [Madry et al., 2017] is commonly used.
Revised: To solve problem (7), the alternating gradient ascentdescent method [Madry et al., 2017] is commonly used.

Original: For ease of presentation, let θ AT denote themodel parameters obtained from (7).
Revised: For ease of presentation, let θ AT denote the model parameters obtained from (7).

Original: This is in contrast to θ NT obtained by the normal training over(3).
Revised: This is in contrast to θ NT obtained by the normal training over (3).

Original: In Fig.
Revised: In Fig.

Original: 4, we demonstrate an example to compare the reconstruction performance of f θ AT ( z + δ )and that of f θ NT ( z + δ ) when facing adversarial perturbations.
Revised: 4, we demonstrate an example to compare the reconstruction performance of f θ AT ( z + δ ) and that of f θ NT ( z + δ ) when facing adversarial perturbations.

Original: Meanwhile, we show the performanceof these different models against input transformations.
Revised: Meanwhile, we show the performance of these different models against input transformations.

Original: As we can see, AT largely enhances therobustness of MRI reconstruction against adversarial input perturbations.
Revised: As we can see, AT largely enhances the robustness of MRI reconstruction against adversarial input perturbations.

Original: However, it is insufficientto robustify the reconstruction network against the input transformations; see Fig. 4-(c).[Figure] [Equation] [Figure]
Revised: However, it is insufficient to robustify the reconstruction network against the input transformations; see Fig. 4-(c).

Original: [Equation]

Original: [Figure]

Original: [Equation]

Original: [Figure]
Revised: [Figure]

Original: Generalized AT (GAT) with data augmentation Spurred by the lack of robustness of AT againstinput transformations, we ask if the transformed data can be infused into the AT framework.
Revised: Generalized AT (GAT) with data augmentation Spurred by the lack of robustness of AT against input transformations, we ask if the transformed data can be infused into the AT framework.

Original: Meanwhile, such integration of AT with data augmentation is expected to be as simple as possible withoutneeding additional data annotations.
Revised: Meanwhile, such integration of AT with data augmentation is expected to be as simple as possible without needing additional data annotations.

Original: To this end, we can augment the training data set D with thenewly paired transformed data ˆ D =
Revised: To this end, we can augment the training data set D with the newly paired transformed data ˆ D =

Original: { T ( z ) , T ( x ∗ ) } ( z , x ∗ ) ∈D .
Revised: { T ( z ) , T ( x ∗ ) [Equation] z [Equation]

Revised: ∗

Revised: [Equation]

Original: In this context, we will generalize ATinto the following regularized optimization framework
Revised: In this context, we will generalize AT into the following regularized optimization framework

Original: [Equation]
Revised: [Equation]

Original: where γ > 0 is a regularization parameter to strike a balance between normal training and robusttraining.
Revised: where γ > 0 is a regularization parameter to strike a balance between normal training and robust training.

Original: Different from (7), we explicitly introduce an augmented standard training objective toimprove the reconstruction accuracy when facing input transformations, and we introduce a ‘labelfree’ robust regularization that penalizes the discrepancy between the normal reconstruction and theadversarial reconstruction.
Revised: Different from (7), we explicitly introduce an augmented standard training objective to improve the reconstruction accuracy when facing input transformations, and we introduce a ‘labelfree’ robust regularization that penalizes the discrepancy between the normal reconstruction and the adversarial reconstruction.

Original: This robustness regularization is commonly used to tradeoff the standardmodel accuracy and the model robustness [Zhang et al., 2019].
Revised: This robustness regularization is commonly used to tradeoff the standard model accuracy and the model robustness [Zhang et al., 2019].

Original: To solve (8), one major difficulty is how to select the proper data transformation operations T ( · ) toconstruct ˜ D .
Revised: To solve (8), one major difficulty is how to select the proper data transformation operations T ( · ) to construct ˜ D .

Original: Motivated by the success of data augmentation in improving distributional robustnessof image classification [Geirhos et al., 2018, Hendrycks et al., 2019], we consider the followingthree representative data transformation operations: rotation [Taylor and Nitschke, 2018], cutout[DeVries and Taylor, 2017], and cutmix [Yun et al., 2019]; see Fig.
Revised: Motivated by the success of data augmentation in improving distributional robustness of image classification [Geirhos et al., 2018, Hendrycks et al., 2019], we consider the following three representative data transformation operations: rotation [Taylor and Nitschke, 2018], cutout [DeVries and Taylor, 2017], and cutmix [Yun et al., 2019]; see Fig.

Original: A1 for an illustrative example.
Revised: A1 for an illustrative example.

Original: The rationale behind these augmentation operations is that invariant deep features used for imagereconstruction can be learned against spatial perturbations, e.g. , occlusion, translation, and rotation.
Revised: The rationale behind these augmentation operations is that invariant deep features used for image reconstruction can be learned against spatial perturbations, e.g. , occlusion, translation, and rotation.

Original: Our experiments in Sec.
Revised: Our experiments in Sec.

Original: 5 will show that the combination of these augmentation operations can leadto a superior robustness to input transformations.
Revised: 5 will show that the combination of these augmentation operations can lead to a superior robustness to input transformations.

Original: Meanwhile, the model learned from (8) (denoted byθ GAT ) also maintains robustness against adversarial input perturbations like AT (see Fig. 5).
Revised: Meanwhile, the model learned from (8) (denoted by θ GAT ) also maintains robustness against adversarial input perturbations like AT (see Fig. 5).

Original: [Figure]
Revised: [Figure]

Original:  Experiments 
Revised:  Experiments 5.1 Experiment Setup

Original: 5.1 Experiment Setup

Original: Datasets and model architecture
Revised: Datasets and model architecture

Original: In this paper, we focus on the Fully-sampled coronal protondensity knee MRI dataset with 15-channel coils, which were obtained from the fastMRI database[Knoll et al., 2020b].
Revised: In this paper, we focus on the Fully-sampled coronal proton density knee MRI dataset with 15-channel coils, which were obtained from the fastMRI database [Knoll et al., 2020b].

Original: The image size is 320 × 368 .
Revised: The image size is 320 × 368 .

Original: In our paper, we used the unrolling-based imagereconstruction model MoDL [Aggarwal et al., 2018].
Revised: In our paper, we used the unrolling-based image reconstruction model MoDL [Aggarwal et al., 2018].

Original: Training setup All of our models were trained in an end-to-end fashion using the Adam optimizerwith learning rate 1 × 10 − 4 and batch size 1 .
Revised: Training setup All of our models were trained in an end-to-end fashion using the Adam optimizer with learning rate 1 × 10 − 4 and batch size 1 .

Original: When implementing AT and GAT, we used the 10 -step
Revised: When implementing AT and GAT, we used the 10 -step

Original: PGD attack [Madry et al., 2017] with ϵ = 0 .
Revised: PGD attack [Madry et al., 2017] with ϵ = 0 .

Original: 03 / 255 for solving the inner maximization problem.
Revised: 03 / 255 for solving the inner maximization problem.

Original: When generating the transformed dataset ˜ D in GAT, we sampled one transformation operation foreach original data sample from the random cutout, random cutmix, and rotate 180 ◦ uniformly.
Revised: When generating the transformed dataset ˜ D in GAT, we sampled one transformation operation for each original data sample from the random cutout, random cutmix, and rotate 180 ◦ uniformly.

Original: Andwe choose the regularization parameter γ = 3 in the implementation of GAT (8).
Revised: And we choose the regularization parameter γ = 3 in the implementation of GAT (8).

Original: Evaluation metrics
Revised: Evaluation metrics

Original: In our paper, we used both normalized mean squared error (NMSE) andstructural similarity index measure (SSIM) to evaluate the quality of reconstructed images.
Revised: In our paper, we used both normalized mean squared error (NMSE) and structural similarity index measure (SSIM) to evaluate the quality of reconstructed images.

Original: The higher
Revised: The higher

Original: SSIM signifies higher quality reconstruction results, while the higher NMSE represents the lowerquality of image reconstruction.
Revised: SSIM signifies higher quality reconstruction results, while the higher NMSE represents the lower quality of image reconstruction.

Original: To evaluate the robustness and accuracy of a model, we evaluate itsperformance when facing three types of test-time inputs: 1) Benign test input z , which correspondsto the standard reconstruction accuracy; 2) Adversarial test input ( z + δ ), which is generatedusing the 20 -step PGD attack with ϵ = 0 .
Revised: To evaluate the robustness and accuracy of a model, we evaluate its performance when facing three types of test-time inputs: 1) Benign test input z , which corresponds to the standard reconstruction accuracy; 2) Adversarial test input ( z + δ ), which is generated using the 20 -step PGD attack with ϵ = 0 .

Original: 03 / 255 and corresponds to the adversarial robustness; 3)
Revised: 03 / 255 and corresponds to the adversarial robustness; 3)

Original: Transformed test input T ( z ) : model’s robustness against input spatial transformations.
Revised: Transformed test input T ( z ) : model’s robustness against input spatial transformations.

Original: [Figure]

Original: 5.2 Experiment results
Revised: 5.2 Experiment results

Original: [Figure]

Original: [Table]
Revised: [Table]

Original: Reconstruction accuracy and robustness
Revised: Reconstruction accuracy and robustness

Original: [Figure]

Original: We compared our proposed GAT with NTand AT.
Revised: We compared our proposed GAT with NT and AT.

Original: The overall quantitative results areshown in Tab. 1.
Revised: The overall quantitative results are shown in Tab. 1.

Original: As we can see, GATis the most robust model against spatialtransformation-based perturbations, without sacrificing much on accuracies againstadversarial test inputs and benign test inputs.
Revised: As we can see, GAT is the most robust model against spatial transformation-based perturbations, without sacrificing much on accuracies against adversarial test inputs and benign test inputs.

Original: These suggest that our proposed GATimproves robustness against adversarial perturbation and spatial transformation-based perturbation with a slight standard accuracy drop.
Revised: These suggest that our proposed GAT improves robustness against adversarial perturbation and spatial transformation-based perturbation with a slight standard accuracy drop.

Original: [Table]
Revised: [Table]

Original: Effect of data augmentations Next, we investigate how the choice of data augmentationaffects model robustness.
Revised: Effect of data augmentations Next, we investigate how the choice of data augmentation affects model robustness.

Original: Tab.
Revised: Tab.

Original: 2 shows the
Revised: 2 shows the

Original: NMSE and SSIM performance of our approach(GAT) using different data augmentation strategies: cutout-only, cutmax-only, rotation-only,and their combination.
Revised: NMSE and SSIM performance of our approach (GAT) using different data augmentation strategies: cutout-only, cutmax-only, rotation-only, and their combination.

Original: As we can see, eachtransformation operator used in GAT can improve the robustness against the spatial inputtransformations.
Revised: As we can see, each transformation operator used in GAT can improve the robustness against the spatial input transformations.

Original: However, the integration of all three transformation types into GAT achieves thebest robustness at transformed test inputs.
Revised: However, the integration of all three transformation types into GAT achieves the best robustness at transformed test inputs.

Original: Meanwhile, we find that the use of cutout-only is able toachieve a great tradeoff with the improvement in adversarial robustness.
Revised: Meanwhile, we find that the use of cutout-only is able to achieve a great tradeoff with the improvement in adversarial robustness.

Original: Visualization of reconstructed MRI images Fig.
Revised: Visualization of reconstructed MRI images Fig.

Original: A2 shows examples of reconstructed MRIimages using different approaches when facing different types of a test-time examples.
Revised: A2 shows examples of reconstructed MRI images using different approaches when facing different types of a test-time examples.

Original: For ease ofcomparison, we apply the inverse spatial transformation to the reconstruction result of a spatiallytransformed input.
Revised: For ease of comparison, we apply the inverse spatial transformation to the reconstruction result of a spatiallytransformed input.

Original: As shown in Fig.
Revised: As shown in Fig.

Original: A2-(b), (d), and (e), there exist less visible artifacts in thereconstruction results of our GAT-trained model.
Revised: A2-(b), (d), and (e), there exist less visible artifacts in the reconstruction results of our GAT-trained model.

Original: Compared to NT, both AT and GAT significantlyimproves model robustness against adversarial perturbations.
Revised: Compared to NT, both AT and GAT significantly improves model robustness against adversarial perturbations.

Original: While Fig.
Revised: While Fig.

Original: A2-(a), (d), and (g) suggestthat there might exist an accuracy-robustness tradeoff.
Revised: A2-(a), (d), and (g) suggest that there might exist an accuracy-robustness tradeoff.

Original:  Conclusion
Revised:  Conclusion

Original: In this paper, we investigate the problem of adversarial robustness of DL-based MRI image reconstruction.
Revised: In this paper, we investigate the problem of adversarial robustness of DL-based MRI image reconstruction.

Original: We show that a deep image reconstruction model is highly susceptible to not onlypixel-level adversarial perturbations but also input spatial transformations, e.g., cropping and rotation.
Revised: We show that a deep image reconstruction model is highly susceptible to not only pixel-level adversarial perturbations but also input spatial transformations, e.g., cropping and rotation.

Original: To improve the resilience of MRI image reconstruction, we propose a generalized adversarialtraining method that is built upon a new robustness regularization metric by taking into accountboth adversarial perturbations and data transformations.
Revised: To improve the resilience of MRI image reconstruction, we propose a generalized adversarial training method that is built upon a new robustness regularization metric by taking into account both adversarial perturbations and data transformations.

Original: We show that our proposal is effective in afastMRI dataset by comparing with state-of-the-art baselines under a variety of evaluation metrics.
Revised: We show that our proposal is effective in a fastMRI dataset by comparing with state-of-the-art baselines under a variety of evaluation metrics.

Original: Inthe future, we would like to generalize our approach to the self-supervised learning paradigm, andimprove its computation efficiency through more lightweight robust training protocols.
Revised: In the future, we would like to generalize our approach to the self-supervised learning paradigm, and improve its computation efficiency through more lightweight robust training protocols.

Original: A Appendix 
Revised: A Appendix A.1 Transformation operations

Original: A.1 Transformation operations

Original: In this section
Revised: In this section

Original: [Figure]
Revised: [Figure]

Original: we provide some illustrations for different data transformation operations.
Revised: we provide some illustrations for different data transformation operations.

Original: [Figure]
Revised: [Figure]

Original: A.2 Results visualization
Revised: A.2 Results visualization

Original: [Figure]
Revised: [Figure]