论文标题
自适应对抗训练以改善DNN的对抗性鲁棒性，以进行医学图像分割和检测
Adaptive Adversarial Training to Improve Adversarial Robustness of DNNs for Medical Image Segmentation and Detection
论文作者
论文摘要
众所周知，深层神经网络（DNN）容易受到对抗性攻击的影响，并且可以通过在训练数据中添加对抗性噪声来改善DNN的对抗性鲁棒性（例如，标准的对抗性训练（SAT））。但是，添加到训练数据中的不适当噪声可能会降低模型的性能，这被称为准确性和鲁棒性之间的权衡。对整个图像的分类进行了充分研究，但很少探索用于医疗应用程序域中的图像分析任务，包括图像分割，地标检测和对象检测任务。在这项研究中，我们表明，对于那些医学图像分析任务，SAT方法具有严重的问题，限制了其实际用途：它为所有训练样本生成了固定和统一的噪声，用于强大的DNN培训。高噪声水平可能会导致模型性能大大降低，低噪声水平可能无法有效提高鲁棒性。为了解决这个问题，我们设计了一种自适应 - 利润对抗训练（AMAT）方法，该方法生成了样本适应性的对抗性噪声，以进行强大的DNN培训。与现有的面向分类的对抗训练方法相反，我们的AMAT方法使用损失定义的划分策略，以便只要损失功能明确定义，就可以将其应用于不同的任务。我们使用五个公开可用的数据集将我们的AMAT方法成功地应用于最先进的DNN。实验结果表明：（1）我们的AMAT方法可以应用于医疗图像应用程序域中的三个看似不同的任务； （2）AMAT在对抗性鲁棒性方面优于SAT方法； （3）与SAT方法相比，AMAT的预测准确性最少降低； （4）AMAT的培训时间几乎与SAT相同。
It is known that Deep Neural networks (DNNs) are vulnerable to adversarial attacks, and the adversarial robustness of DNNs could be improved by adding adversarial noises to training data (e.g., the standard adversarial training (SAT)). However, inappropriate noises added to training data may reduce a model's performance, which is termed the trade-off between accuracy and robustness. This problem has been sufficiently studied for the classification of whole images but has rarely been explored for image analysis tasks in the medical application domain, including image segmentation, landmark detection, and object detection tasks. In this study, we show that, for those medical image analysis tasks, the SAT method has a severe issue that limits its practical use: it generates a fixed and unified level of noise for all training samples for robust DNN training. A high noise level may lead to a large reduction in model performance and a low noise level may not be effective in improving robustness. To resolve this issue, we design an adaptive-margin adversarial training (AMAT) method that generates sample-wise adaptive adversarial noises for robust DNN training. In contrast to the existing, classification-oriented adversarial training methods, our AMAT method uses a loss-defined-margin strategy so that it can be applied to different tasks as long as the loss functions are well-defined. We successfully apply our AMAT method to state-of-the-art DNNs, using five publicly available datasets. The experimental results demonstrate that: (1) our AMAT method can be applied to the three seemingly different tasks in the medical image application domain; (2) AMAT outperforms the SAT method in adversarial robustness; (3) AMAT has a minimal reduction in prediction accuracy on clean data, compared with the SAT method; and (4) AMAT has almost the same training time cost as SAT.
