S TABILIZED M EDICAL I MAGE A TTACKS
Anonymous authors
Paper under double-blind review
A BSTRACT
Convolutional Neural Networks (CNNs) have advanced existing medical systems for automatic disease diagnosis.
However, a threat to these systems arises that adversarial attacks make CNNs vulnerable.
Inaccurate diagnosis results make a negative inﬂuence on human healthcare.
There is a need to investigate potential adversarial attacks to robustify deep medical diagnosis systems.
On the other side, there are several modalities of medical images (e.g., CT, fundus, and endoscopic image) of which each type is signiﬁcantly different from others.
It is more challenging to generate adversarial perturbations for different types of medical images.
In this paper, we propose an image-based medical adversarial attack method to consistently produce adversarial perturbations on medical images.
The objective function of our method consists of a loss deviation term and a loss stabilization term.
The loss deviation term increases the divergence between the
CNN prediction of an adversarial example and its ground truth label.
Meanwhile, the loss stabilization term ensures similar CNN predictions of this example and its smoothed input.
From the perspective of the whole iterations for perturbation generation, the proposed loss stabilization term exhaustively searches the perturbation space to smooth the single spot for local optimal escape.
We further analyze the
KL-divergence of the proposed loss function and ﬁnd that the loss stabilization term makes the perturbations updated towards a ﬁxed objective spot while deviating from the ground truth.
This stabilization ensures the proposed medical attack effective for different types of medical images while producing perturbations in small variance.
Experiments on several medical image analysis benchmarks including the recent COVID-19 dataset show the stability of the proposed method.
I NTRODUCTION
Computer Aided Diagnosis (CADx) has been widely applied in the medical screening process.
The automatic diagnosis beneﬁts doctors to efﬁciently obtain health status to avoid disease exacerbation.
Recently, Convolutional Neural Networks (CNNs) have been utilized in CADx to improve the diagnosis accuracy.
The discriminative representations improve the performance of medical images analysis including lesion localization, segmentation and disease classiﬁcation.
However, recent advances in adversarial examples have revealed that the deployed CADx systems are usually fragile to adversarial attacks Finlayson et al.
(2019), e.g., small perturbations applied to the input images can deceive CNNs to have opposite conclusions.
As mentioned in Ma et al.
(2020), the vast amount of money in the healthcare economy may attract attackers to commit insurance fraud or false claims of medical reimbursement by manipulating medical reports.
Moreover, image noise is a common issue during the data collection process and sometimes these noise perturbations could implicitly form adversarial attacks.
For example, particle contamination of optical lens in dermoscopy and endoscopy and metal/respiratory artifacts of CT scans frequently deteriorate the quality of collected images.
Therefore, there is a growing interest to investigate how medical diagnosis systems respond to adversarial attacks and what we can do to improve the robustness of the deployed systems.
While recent studies of adversarial attacks mainly focus on natural images, the research of adversarial attacks in the medical image domain is desired as there are signiﬁcant differences between two domains.
Beyond regular RGB cameras, there are various types of medical imaging equipments (e.g., Computed Tomography (CT) scanner, ultrasound transducer and fundus camera) to generate dramatically different images.
Fig.
1 shows three examples where the image captured from fundus camera in (a), the image captured from the CT scanner in (b) and the endoscopic video frame in (c).
[Figure]
These three images are different from each other.
The huge data variance across different modalities of medical images brings more challenges to develop a technology that works for all the modalities.
In addition, existing investigations on medical adversarial attacks are limited.
In Finlayson et al.
(2019), adversarial examples are shown to deteriorate the diagnosis accuracy of deep learning based medical systems.
These medical attack methods are mainly based on those from natural images (e.g., Fast Gradient Sign Method (FGSM) Goodfellow et al.
and Project Gradient Descent (PGD)
Madry et al.
(2017)), which are insufﬁciently developed for different types of medical data.
As shown in Figure 1, the adversarial examples generated by FGSM and PGD do not consistently decrease the network’s performance in (b), (c), (f), (g), (j) and (k).
The data variance shown in (a) and (e) leads to the inconsistent attack results by existing methods.
In this paper, we propose a medical image attack method to consistently produce adversarial perturbations that can fool deep medical diagnosis systems working with different medical data modalities.
The perturbations are iteratively generated via taking partial derivatives of a well-deﬁned objective function that is composed of a deviation loss term and a stabilized loss term with respect to the input.
By maximizing the deviation loss term, the adversarial attack system enlarges the divergence between CNN predictions and the ground truth to have effective attack samples.
To handle the aforementioned ubiquitous data noise issue in medical images, we propose a novel stabilization loss term as an extra regularization, which ensures a consistent deviation trajectory for the crafted attack samples.
Meanwhile, the stabilization term avoids the local optima in the optimization process caused by the image noise.
The proposed stabilization loss term is designed to measure the difference between two CNN predictions, where the ﬁrst prediction is from the crafted adversarial sample and the second one is from the same sample processed with a Gaussian smoothing.
Given an adversarial example A and its Gaussian smoothed result (cid:101)
A , the loss stabilization term constrains the corresponding CNN predictions (i.e., f ( A ) and f ( (cid:101) A ) ) to be similar via a minimization process.
The intuition from the scale space optimization Lindeberg (1992) indicates that the minimization of f ( A ) and f ( (cid:101) A ) will exhaustively search the perturbation space to smooth the single spot for local optimal escape.
We further analyze this stabilized loss term via KL-divergence and ﬁnd that the CNN predictions are made towards a ﬁxed objective spot during iterations.
This stabilization improves the attack effectiveness on different types of medical data including CT image, fundus image, and endoscopic image.
We evaluate the proposed stablized medical image attack (SMIA) on several medical datasets APT (2019); EAD (2019); Kag (2015) including the recent COVID-19 COV (2019) lung CT.
Thorough evaluations demonstrate that the proposed method is effective to produce perturbations that decrease the prediction accuracy of different medical diagnosis systems.
Our investigation provides a guidance for strengthening the robustness of these medical systems towards adversarial attacks.
R ELATED W ORK
In this section, we literately review existing adversarial attack methods on both natural and medical images.
Meanwhile, we survey relevant medical image analysis tasks where SMIA is deployed.
2. A DVERSARIAL A TTACK
There are extensive investigations on adversarial attacks for natural image classiﬁcations.
In Goodfellow et al.
(2014), FGSM was proposed to generate adversarial examples based on the CNN gradients.
A DeepFool method was proposed in Moosavi-Dezfooli et al.
(2016) to compute minimal perturbations based on classiﬁer’s linearization.
In Moosavi-Dezfooli et al.
(2017), an iterative algorithm was proposed to generate perturbations and showed the existence of a universal (imageagnostic) adversarial perturbations.
In Baluja & Fischer (2017), a Transformation Network (ATN) was trained to generate adversarial examples without gradient involvement.
The adversarial training and provable defense were proposed in Balunovic & Vechev (2020) to achieve both attack robustness and high accuracies.
The capsule based reconstructive attack was proposed in Qin et al.
(2020) to cause both misclassiﬁcations and reconstructive errors.
Besides image classiﬁcation, several attack methods were proposed for semantic segmentation and object detection.
In Fischer et al.
Dong et al.
(2019), the classiﬁcation based attacks were shown transferrable to attack deep image segmentation results.
The universal perturbations were demonstrated existed in Moosavi-Dezfooli et al.
Moreover, a Dense Adversary Generation (DAG) method was proposed Xie et al.
(2017) for both semantic segmentation and object detection attacks.
The general idea of natural image attacks was to iteratively generate perturbations based on the CNN gradients to maximize the network predictions of adversarial examples and the ground truth labels.
This idea was also reﬂected in Finlayson et al.
(2019) to show the medical attacks.
Different from existing attack methods, we propose a stabilized regularization term to ensure the consistent generation of adversarial perturbations and show its effectiveness on different types of medical image datasets.
2. D EEP M EDICAL I MAGE A NALYSIS
The deep convolutional neural networks (CNNs) have been shown effective to automatically analyze medical images Litjens et al.
; Razzak et al.
The common CADx applications include classifying the stage of disease, the detection and segmentation of organs and lesions.
Disease classiﬁcation.
Most medical systems formulate disease diagnosis as an image classiﬁcation task.
The types of diseases are predeﬁned and each type corresponds to one category.
During the classiﬁcation process, there are single or multiple images as input for disease diagnosis.
In Shen et al.
(2015), a multi-scale CNN was proposed to capture the feature representation of lung nodule patches for accurate classiﬁcation.
A multi-instance layer and a multi-scale layer were proposed in Li et al.
(2019) to diagnose diabetic macular edema and myopic macular degeneration.
Besides diagnosing the types of disease, existing medical systems were also able to predict the disease status Gulshan et al.
(2016) by empirical status categorization.
Organ and lesion detection.
The detection of organ and lesion is inspired from the object detection framework for natural images (i.e., Faster-RCNN Ren et al.
, FPN Lin et al.
(2017), and
Yolo Redmon et al.
Besides, 3D spatial information of the medical data is explored in the 3D detection framework.
In Ding et al.
(2017), a 3D-CNN classiﬁcation approach was proposed to classify lung nodule candidates that were previously detected by the Faster-RCNN detector.
The
RPN Ren et al. (2015) was extended in Liao et al.
(2019) to become 3D-RPN for 3D proposal generation to detect lung nodules.
Different from the 3D detection framework, a multi-scale booster was proposed in Shao et al.
(2019) with channel and spatial attentions that were integrated into FPN for suspicious lesion detection in 2D CT slices.
The detection methods based on 2D image input reduced heavy computational cost brought in the 3D inputs for 3D detection methods.
Organ and lesion segmentation.
The medical segmentation was signiﬁcantly advanced via deep encoder-decoder structures (i.e., U-Net Ronneberger et al.
This architecture contained a contracting path (i.e., encoder) to capture global context and a symmetric expanding path (i.e., decoder) to obtain precise localization.
There were several works built upon U-Net.
In Brosch et al.
(2016), skip connections were utilized in the ﬁrst and last convolutional layers to segment lesions in brain.
A V-Net was proposed in Milletari et al.
(2016) to segment brain’s anatomical structures.
It followed 3D U-Net structure consisting of 3D convolutional layers.
A dual pathway and multi-scale 3D-CNN architecture was proposed in Kamnitsas et al.
(2017) to generate both global and local lesion representations in the CNN for brain lesion segmentation.
Existing medical methods mainly utilized deep encoder-decoder architectures for end-to-end segmentation of organs and lesions.
As illustrated above, deep medical diagnosis systems differ much from the CNN architectures that are developed for natural images.
Moreover, the variance of different modalities of medical images is signiﬁcantly larger than that of natural images.
Therefore, the adversarial attacks designed for natural images are not often effective in the medical domain.
Nevertheless, the limitations that are brought by huge network and data variance are effectively solved via our stabilized medical attack.
P ROPOSED M ETHOD
In this section, we illustrate the details of medical image attacks.
We ﬁrst show the objective function of SMIA that consists of a loss deviation term and a loss stabilization term.
The loss deviation term produces the perturbation to decrease the image analysis performance, while the loss stabilization term is consistently updated during iterations and constrains these perturbations in low variance.
Then, we analyze how SMIA affects the generated perturbations during iterative optimization from the perspective of KL-divergence.
The analysis is followed by a visualization showing the variance and cosine distance of perturbations by utilizing the loss stabilization term.
3. O BJECTIVE F UNCTION
As aforementioned, there are a loss deviation term (DEV) and a loss stabilization term (STA) in the objective function.
The loss deviation term follows Goodfellow et al.
(2014) to enlarge the difference between CNN predictions and the ground truth label.
We denote the input image as x , model parameters as θ , and the ground truth label of x as Y .
In the ﬁrst iteration, the objective function of SMIA denoted as L SMIA can be written as:
[Equation]
where f ( θ, x ) is the CNN predicted result of x and L ( · ) is the loss function.
The perturbation r can be computed by taking the partial derivatives of the objective function with respect to the input.
It can be written as:
[Equation]
The perturbation is further reﬁned to η = (cid:15) · sign( r ) where (cid:15) is a constant controlling the inﬂuence of r .
We add η to the input image x as an adversarial example.
The perturbation η is iteratively learned to enlarge the difference between f ( θ, x ) and Y .
However, we observe that the objective function with the loss deviation term alone has a major unstable issue, especially for the medical images with large variances.
To tackle the instability problem, we introduce the loss stabilization term together with the loss deviation to form the new objective function, starting from the second iteration of the training process.
We compute η in the ﬁrst iteration using Eq. 2.
The loss stabilization term can be written as:
[Equation]
where W is a Gaussian kernel and convolves with the current perturbation η .
This term enforces the CNN predictions of x + η and x + W ∗ η similar under the current loss function.
The objective function L SMIA we use during the following iterations can be written as:
[Equation]
where α is the scalar balancing the inﬂuences of L DEV and L STA , ˜ x
= x + η is the adversarial example sent to the CNN in the current iteration, and η (cid:48)
=
W ∗ η − η .
3. SMIA I NTERPRETATION VIA KL-D IVERGENCE
The iterative generation of adversarial perturbation via SMIA is the process of maximizing the objective function shown in Eq.
In the following, we show how stabilization gradually arises and makes CNN prediction update to a constant value from the perspective of KL-divergence Zhao et al.
; Shen et al.
We elucidate our interpretation of SMIA via the image classiﬁcation task where the loss function L is the cross entropy loss.
The KL-divergence is utilized to measure the distribution difference between f ( θ, ˜ x ) and f ( θ, ˜ x + η (cid:48) ) , which are from the loss stabilization term as shown in Eq.
We denote the input image as x and there are K categories in total.
The ground truth label of x is denoted as Y =
[ y 1 , y 2 , ..., y K ] T that is a one-hot label.
The output of CNN f ( θ, x ) is a K dimensional vector where each element represents the probability of x belonging to the corresponding category.
We denote the probability of x belonging to j -th category ( j = 1 , 2 , ..., K ) as p ( y j | x ) =
p j ( x ) .
The
KL-divergence D KL measures the difference between f ( θ, ˜ x ) and f ( θ, ˜ x + η (cid:48) ) and can be expanded via the second-order Taylor expansion Shen et al.
(2019) as follows:
[Equation]
where y is the random variable ranging from y 1 to y K under the distribution f (˜ x ) , and G ˜ x
= E y
[( ∇ ˜ x log p ( y | ˜ x ))
( ∇ ˜ x log p ( y | ˜ x ))
T ] is the Fisher Information Matrix of ˜ x .
This matrix is designed to measure the variance of a distribution model.
During the perturbation generation process, SMIA iteratively minimizes the KL-divergence between f ( θ, ˜ x ) and f ( θ, ˜ x + η (cid:48) ) .
As shown in Eq.
5, the minimization decreases the variances of η (cid:48) as well as seeking the smallest eigenvalue of G ˜ x .
The variance of η (cid:48) is proportional to that of η , which indicates that the learned perturbations via SMIA are constrained to maintain low variance.
On the other hand, the eigenvalue computation of G ˜ x is computationally intensive because the dimension of G ˜ x is equal to the image size.
We follow Zhao et al.
to formulate G ˜ x
as a new matrix G f through G ˜ x
= J T G f J .
The term G f is the Fisher Information Matrix of f (˜ x ) and the term J is the Jacobian matrix which can be computed as J = ∂f∂ ˜ x .
As a result, the term G f is a
K × K positive deﬁnite matrix and formulated as:
[Equation]
Therefore, the problem of minimizing eigenvalues of G ˜ x is converted to the problem of minimizing the eigenvalues of G f .
As the trace of metric equals the summation of all eigenvalues which are all
[Figure]
positive, minimizing eigenvalues is equivalent to ﬁnding the smallest trace.
The trace of G f can be computed as:
[Equation]
Therefore, the objective function shown in Eq.
4 can be formulated as follows:
[Equation]
When we iteratively add ∂ L SMIA ∂
˜ x to the last adversarial example ˜ x , we are maximizing the values of L SMIA .
Speciﬁcally, we maximize the ﬁrst term while minimizing the second term in Eq. 8.
The maximization of the ﬁrst term resembles existing adversarial attack methods (i.e., FGSM and
PGD).
However, the minimization of the second term consists of minimizing both η (cid:48) and (cid:80) Ki =1 1 p i .
When we minimize η (cid:48) , we reduce the variance of the generated perturbation η .
On the other hand, the optimal solution to min (cid:80) Ki =1 1 p i , s .
t .
(cid:80)
Ki =
1 p i = 1 is p 1 = p
= ...
=
p K = 1 K .
This indicates that the stabilization loss term enforces the CNN prediction to update towards a constant vector [ 1 K , 1 K , ..., 1 K ] .
To this end, the perturbations are learned to move consistently towards a ﬁxed objective spot during different iterations in the CNN attack space.
As this spot is not related to network structure nor data type, our loss stabilization term improves perturbation robustness that overcomes huge variations brought by different networks and different types of input data.
3. V ISUALIZATIONS
The analysis on L STA from KL-divergence indicates that the iteratively generated perturbations are in small variance and updated in a more consistent direction.
We visualize the perturbations in different iterations in Fig.
2 to see how perturbations vary in practice.
We send an input fundus image to the ResNet-50 He et al.
(2016) integrated with a graph convolutional network Kipf &
Welling (2016) framework for image classiﬁcation.
The perturbations are generated via Eq. 1 and
Eq.
4 independently.
[Table]
Fig.
2 shows the visual comparison of perturbations generated on the ﬁrst, fourth, and ninth iterations.
We denote the perturbations generated via L DEV (i.e., Eq. 1) as P DEV and that generated via L DEV + L STA (i.e., Eq. 4) as P DEV+STA .
The visualization indicates that at the same iteration, the variance of P DEV is larger than that of P DEV+STA .
Meanwhile, during different iterations, there are severe variance oscillations in P DEV while P DEV+STA are consistently decreased.
On the other side, we calculate the cosine distance between P DEV and P DEV+STA separately.
The cosine distance indicates that P DEV is updated in diverse directions while P DEV+STA are more consistent.
The visualization corresponds to the KL-divergence analysis that the proposed loss stabilization term decreases the perturbation variance and constrain a stable update direction towards a ﬁxed objective spot in the CNN feature space.
E XPERIMENTS
We evaluate the proposed method on three medical image analysis tasks including diabetic retinopathy grading, artefact detection, and lung segmentation.
The diabetic retinopathy grading is to classify fundus images into predeﬁned categories for diabetes status estimation.
The artefact detection is to detect speciﬁc artefacts like pixel saturations, motion blur, and specular reﬂections in the endoscopic images.
Lung segmentation is to segment lung region from the whole CT slice.
The medical data in one task is signiﬁcantly different from that in others.
We use two datasets for diabetic retinopathy grading.
One is the APTOS-2019 APT (2019) dataset with 3,662 fundus images.
The other is a large-scale Kaggle-DR Kag (2015) dataset where we randomly select 11,000 fundus images from its original training set.
Both APTOS-2019 and KaggleDR contains 5 deﬁned categories.
For artefact detection we use EAD-2019 EAD (2019) dataset with 2,500 images collected from endoscopic video frames and annotated artefact regions withdeﬁned categories.
These detection images focus on multiple image modalities (i.e., gastroscopy, cystoscopy, gastro-oesophageal, colonoscopy), and are captured in multi-resolution with multimodal (i.e., white light, ﬂuorescence, and narrow band imaging).
For lung segmentation, we use the COVID-19 dataset COV (2019) where there are 20 CT scans for lungs infected by COVID-19.
In practice, we use ResNet-50 He et al.
(2016) integrated with graph convolutional network Kipf &
Welling (2016) to classify fundus images, the multi-scale booster framework Shao et al.
(2019) to detect artefact, and U-Net Ronneberger et al.
(2015) to segment infected lung regions.
The proposed method is compared to other adversarial attack methods including FGSM Goodfellow et al.
PGD Madry et al.
DeepFool Moosavi-Dezfooli et al.
(2016), and DAG Xie et al.
The comparisons are made by adding these generated perturbations on the input images for decreased performance observation.
For evaluation metrics, we use mean accuracy for medical image classiﬁcation, IoU and mean Average Precision (mAP) for detection, and mean accuracy and Jaccard index for segmentation.
During perturbation generation, we set (cid:15) as 0.01 and stop at the 10-th iteration for all the attack methods.
The α in Eq.
4 are set as 1.
We provide more results including using different
Gaussian kernels W and show the pseudo code in the supplementary ﬁles.
Our implementation will be made available to the public.
4. A BLATION S TUDY
The proposed SMIA introduces a stabilization loss term to contribute to the consistent perturbation generation process across medical image modalities and tasks.
We evaluate how this stabilization term improves the attack performance of the deviation loss.
Besides using the aforementioned metrics on three datasets, we measure the cosine distance between two consecutive perturbations to calculate the similarity of their directions in the CNN attack space.
We compute the cosine distance
[Table] [Table]
between two perturbations generated via consecutive iterations.
The percentage of the amount of perturbations is collected whose cosine distance values exceed 0.
The positive values indicate the directions of perturbation update are consistent during the iterative generation process.
After evaluating the STA term on three datasets, we analyze the inﬂuence of hyper-parameters to the attack performance on EAD-2019 dataset across multiple attack methods
[Table] [Table]
[Table] [Table]
Table 1 shows the ablation study results on three datasets.
We denote “Clean” as the results generated by medical diagnosis systems without adding perturbations.
These results indicate the upper limit of these systems.
In general, the perturbations generated via deviation loss term (DEV) decrease the recognition performance (i.e., segmentation, detection, and classiﬁcation results in COVID-19,
EAD-2019, and ATPOS-2019, respectively).
By integrating loss stabilization term (STA), we are able to generate perturbations that decrease the recognition performance even further.
On the other hand, the percentage of positive cosine distance values of DEV+STA is higher than DEV, which indicates the perturbations generated via DEV+STA are more consistent with each other during their iterative generation process.
The results shown in this table indicate that STA improves the adversarial attack with DEV alone on both performance deterioration and perturbation consistency on three medical analysis scenarios.
Next, we analyze how the hyper-parameters of existing attack methods affect the attack performance on EAD-2019 dataset.
Table 2-4 show the analysis results.
We evaluate attack performance by using different iteration numbers in Table 2, by using different values of (cid:15) in Table 3, and by using different values of α in Table 4, respectively.
The iteration number indicates that existing attack methods decrease the artefact detection performance by increasing the iteration numbers.
SMIA signiﬁcantly decreases the performance by using a limited amount of iterations.
The analysis on (cid:15) shows that
SMIA performs favorably against existing methods when it is set as 0.01.
Besides, SMIA decreases most when α = 1 .
The hyper-parameter analysis shows our optimal parameter selections.
4. C OMPARISONS WITH S TATE - OF - THE - ART
We compare the proposed SMIA method to existing adversarial attack methods in the same medical analysis scenarios.
Besides the prevalent FGSM and PGD methods, we involve DAG which is
[Table]
proposed for detection and segmentation of natural images, and Deepfool that is for disease image classiﬁcation.
All these methods are deployed on the medical diagnosis systems to show the recognition performance decrease.
Meanwhile, we compute the variance of all the generated perturbations, which is shown as “Var” in the results.
Table 6 shows the evaluation performance.
Under lung segmentation (i.e., COVID-19) and diabetic retinopathy grading (i.e., APTOS-2019 and Kaggle-DR) scenarios, our SMIA consistently decreases the recognition performance of medical systems.
The accuracy and jaccard drops brought by our method are more than those from existing methods.
Speciﬁcally, the accuracy drop on the COVID19 dataset brought by our method is around 9% more than the second best method (i.e., DAG).
Moreover, the accuracy drop by using our method on the APTOS-19 dataset is around 10% more than the second best method (i.e., PGD).
The false positive rate of our method is higher than other methods in Kaggle-DR.
These performance drops indicate the effectiveness of our method to handle medical image data.
Under the artefact detection scenario in EAD-2019, we observe that the decrease of mAP from DAG is more than ours.
This is because DAG synthesizes pseudo labels for each proposal from the detection network to speciﬁcally attack the classiﬁer of the detector.
Nevertheless, its performance decrease is not as signiﬁcant as ours (i.e., 7.62% v.s. 4.8%) under the IoU metric that measures the bounding box overlap ratios.
On the other hand, the perturbation variance (i.e., “Var”) of our method is lower than other attack methods on all the evaluation datasets.
The decreased performance and smaller perturbations indicate the effectiveness of our SMIA method for attacking medical diagnosis systems.
Besides medical image datasets, we evaluate SMIA on a hand-written image dataset MNIST Deng (2012) with existing methods.
Table 5 shows the results.
Our SMIA method achieves consistent performance to decrease recognition more than that of FGSM and PGD.
This indicates that SMIA is effective to attack not only medical images, but also images from other ﬁeld.
C ONCLUSION
We propose a medical image adversarial attack method to diagnose current medical systems.
The proposed method iteratively generates adversarial perturbations by maximizing the deviation loss term and minimizing the loss stabilization term.
For an adversarial example at the current iteration, the difference between its CNN prediction and the corresponding ground truth label is enlarged, while the CNN predictions of its smoothed input and itself are similar.
The similar predictions constrain the perturbations to be generated in a relatively ﬂag region in the CNN feature space.
During consecutive iterations, the perturbations are updated from one ﬂag region to another.
Thus the proposed method can search the perturbation space to smooth the single spot for local optimal escape.
Compared to the perturbation movement among single spots that are brought by only using loss deviation term, the loss stabilization term improves the attack performance by regularizing the perturbation movement to be stable.
The KL-divergence further analyze that the minimization of loss stabilization term is to regularize the perturbations to move towards a ﬁxed objective spot while their variances are reduced.
Both the visualization and experimental results have shown the effectiveness of our attack method to ﬁgure out the limitation of medical diagnosis systems for further improvement.