[论文解读] Now You See It, Now You Dont: Adversarial Vulnerabilities in Computational Pathology

Alex Foote, Amina Asif+4 more|arXiv (Cornell University)|Jun 14, 2021

Adversarial Robustness in Machine Learning参考文献 35被引用 8

一句话总结

本文表明，计算病理学中的深度学习模型极易受到对抗性攻击的影响，其中难以察觉的扰动可可靠地将肿瘤分类预测结果完全颠倒，且置信度极高。尽管模型AUC > 0.95，但其仍易受实例特定及通用对抗性扰动的影响，且能量极低，凸显了在临床部署中存在严重安全风险。

ABSTRACT

Deep learning models are routinely employed in computational pathology (CPath) for solving problems of diagnostic and prognostic significance. Typically, the generalization performance of CPath models is analyzed using evaluation protocols such as cross-validation and testing on multi-centric cohorts. However, to ensure that such CPath solutions are robust and safe for use in a clinical setting, a critical analysis of their predictive performance and vulnerability to adversarial attacks is required, which is the focus of this paper. Specifically, we show that a highly accurate model for classification of tumour patches in pathology images (AUC > 0.95) can easily be attacked with minimal perturbations which are imperceptible to lay humans and trained pathologists alike. Our analytical results show that it is possible to generate single-instance white-box attacks on specific input images with high success rate and low perturbation energy. Furthermore, we have also generated a single universal perturbation matrix using the training dataset only which, when added to unseen test images, results in forcing the trained neural network to flip its prediction labels with high confidence at a success rate of > 84%. We systematically analyze the relationship between perturbation energy of an adversarial attack, its impact on morphological constructs of clinical significance, their perceptibility by a trained pathologist and saliency maps obtained using deep learning models. Based on our analysis, we strongly recommend that computational pathology models be critically analyzed using the proposed adversarial validation strategy prior to clinical adoption.

研究动机与目标

• 调查最先进的计算病理学模型尽管诊断准确率高，但仍对对抗性攻击高度敏感。
• 评估对抗性扰动对普通人群及训练病理学家的可察觉程度。
• 分析扰动能量、形态学变化与显著性图改变之间的关系。
• 开发并验证一种面向临床人工智能模型的对抗鲁棒性评估策略。
• 倡导将对抗性验证作为临床采用CPath系统前的先决条件。

提出的方法

• 采用基于梯度的优化方法，在肿瘤切片分类模型上实施白盒对抗性攻击，以生成最小扰动。
• 在训练数据集上训练单一通用扰动矩阵，可应用于未见的测试图像。
• 通过训练病理学家进行感知评估，以判断对抗性样本的视觉可检测性。
• 利用临床相关性度量分析扰动引起的组织结构形态变化。
• 生成并对比原始输入与对抗性输入的显著性图，研究模型注意力的转移。
• 在多个测试图像上评估攻击成功率及扰动能量（L2范数）。

实验结果

研究问题

• RQ1 高度准确的计算病理学模型是否可被难以察觉的对抗性扰动可靠地欺骗？
• RQ2 训练病理学家在多大程度上能察觉对抗性扰动？
• RQ3 对抗性扰动的能量与组织结构形态变化之间是否存在相关性？
• RQ4 单一通用扰动在多样化测试图像上翻转模型预测的成功率如何？
• RQ5 原始输入与对抗性输入的显著性图有何差异，反映出模型注意力的何种转移？

主要发现

• AUC > 0.95的高精度模型在低能量下，通过单实例白盒扰动即可实现高成功率攻击。
• 通用扰动矩阵在未见测试图像上实现了超过84%的预测翻转成功率，同时保持不可察觉性。
• 对抗性扰动对普通人群及训练病理学家均不可察觉，表明其视觉可检测性极低。
• 低能量扰动在组织结构中引发了显著的形态学变化，引发临床安全担忧。
• 显著性图显示原始输入与对抗性输入之间注意力发生显著转移，表明模型推理不可靠。
• 本研究表明，标准评估协议（如交叉验证）不足以确保模型对对抗性攻击的鲁棒性。