Deep Learning based Adversarial Disturbances in Fundus Image Analysis

Abstract

Purpose : Deep Learning (DL) has shown promising results in medical image analysis. Patient measurements are increasingly performed remotely and then transferred to automated diagnostic procedures, such as clinical decision support systems, telemedicine, and E-health. This process is vulnerable to intentional attacks to undermine the diagnostic processor, which becomes a particular problem if data manipulations are invisible to human observers. Here, we investigate this risk in fundus image analysis with added invisible perturbations.

Methods : We consider three adversarial techniques called FGSM, SMIA, and ASMA to perturb the fundus images. In this study, without loss of generality, we select optic disc segmentation as the application of DL models which is beneficial for disc detection and Glaucoma diagnosis. In this regard, we train four different state-of-the-art segmentation models, one general method (DeepLabV3+), and three frequently used in fundus analysis (UNet, AttNet, CeNet). The segmentation models are trained using 3710 fundus images and evaluated with 1282 test images (without subject overlap). The images of the test set are additionally perturbed with three severity levels for adversaries that make 11538 perturbed images such that the perturbation artifact is not visible. The performance of the segmentation models is assessed with IoU and FNR metrics.

Results : Fig. 1 shows the results quantitively; the CeNet and DeepLabv3+ are slightly better than other segmentation models for the not-perturbed test set. The comparison between Fig. 1A/1C and figures 1B/1D shows that the performance of the segmentation models is reduced in the presence of adversarial disturbances (IoU %95 CI: 0.90 - 0.91 vs. 0.83 - 0.84, p<0.05), and the ratio of outliers is significantly larger (IoU < 0.5: 0.007 vs. 0.04). Fig. 2 shows some random examples and illustrates that for some perturbed images, the segmentation model completely failed to segment the disc.

Conclusions : Our evaluations express that the invisible adversarial disturbances lessen the performance of the DL models significantly, while humans would still perform equally well. We show that even in black-box scenarios when the deployed model is not available to the malicious actor, the model may completely fail to accomplish its task. Also, we show that the models’ vulnerability is different, so we suggest taking this aspect into account in future model evaluations.

This abstract was presented at the 2023 ARVO Imaging in the Eye Conference, held in New Orleans, LA, April 21-22, 2023.