How Robust is Your Automatic Diagnosis Model Automatic diagnosis based on clinical notes has become a popular research field recently, and many proposed deep learning models have achieved competitive performance in diseases inference. However, previous research reveals that deep learning models are susceptible to negligibly perturbed inputs named adversarial examples, which contradicts with the safety and reliability requirements of the medical domain. To analyze the vulnerability and robustness of current automatic diagnosis models, we investigate in the generation of adversarial text examples. The main challenges for generating adversarial text examples are divided into three parts. First, the word embedding space is discrete, which makes it hard to perturb as small as adversarial image examples generation. Second, previous adversarial example generation methods focus mainly on multiclass classification models, while automatic diagnosis is a multilabel classification task. Third, the semantic and medical meaning of clinical notes are vital in disease inference, and even small perturbations can change them to a large extent. In this paper, we address the three main challenges and propose ClinicalAttacker, a general framework for both whitebox and blackbox adversarial text examples generation against automatic diagnosis models. Experimental results on MIMICIII dataset demonstrate that our framework can easily alter the predictions of automatic diagnosis models with the semantic and medical meaning preserved.

A LabelBased Approach for Automatic Identifying Adversarial Examples with Image Transformation Besides extraordinary results that deep neural networks are widely deployed in many fields such as computer vision, speech recognition, and natural language processing, in recent years deep neural networks have been recognized vulnerable to intentional modification of legitimate inputs called adversarial examples. These patterns are almost indistinguishable from AI models and human perception. Adversarial examplesu0027 concern is rising dramatically and is attracted by many researchu0027s apprehensiveness because of its tremendous impact. Unfortunately, until now there is none of the defenses has been shown to be very effective. In this paper, we introduce a new defense strategy against adversarial examples by using a labelbased endtoend system. Our proposed defense system can mostly distinguish adversarial samples and benign images without human intervention. We exploit the important role of spatial domain in adversarial attacks and proposing a stateoftheart method for detecting adversarial examples based on our observation. We evaluate our systemu0027s performance on a variety of standard benchmark datasets including MNIST and ImageNet. Our proposed method reached out detection rates in a range from 94.6% to 99.2% in many settings.