[论文解读] Adaptive Adversarial Training to Improve Adversarial Robustness of DNNs for Medical Image Segmentation and Detection

Linhai Ma, Liang Liang|arXiv (Cornell University)|Jun 2, 2022

Adversarial Robustness in Machine Learning被引用 4

一句话总结

该论文提出了一种新型方法——自适应边界对抗训练（AMAT），在训练过程中为每个样本生成特定的对抗性噪声，以提升医学图像分割、关键点检测和目标检测任务的鲁棒性，同时不损失干净数据的准确率。AMAT在鲁棒性和干净数据准确率方面均优于标准对抗训练（SAT），且训练效率相近。

ABSTRACT

It is known that Deep Neural networks (DNNs) are vulnerable to adversarial attacks, and the adversarial robustness of DNNs could be improved by adding adversarial noises to training data (e.g., the standard adversarial training (SAT)). However, inappropriate noises added to training data may reduce a model's performance, which is termed the trade-off between accuracy and robustness. This problem has been sufficiently studied for the classification of whole images but has rarely been explored for image analysis tasks in the medical application domain, including image segmentation, landmark detection, and object detection tasks. In this study, we show that, for those medical image analysis tasks, the SAT method has a severe issue that limits its practical use: it generates a fixed and unified level of noise for all training samples for robust DNN training. A high noise level may lead to a large reduction in model performance and a low noise level may not be effective in improving robustness. To resolve this issue, we design an adaptive-margin adversarial training (AMAT) method that generates sample-wise adaptive adversarial noises for robust DNN training. In contrast to the existing, classification-oriented adversarial training methods, our AMAT method uses a loss-defined-margin strategy so that it can be applied to different tasks as long as the loss functions are well-defined. We successfully apply our AMAT method to state-of-the-art DNNs, using five publicly available datasets. The experimental results demonstrate that: (1) our AMAT method can be applied to the three seemingly different tasks in the medical image application domain; (2) AMAT outperforms the SAT method in adversarial robustness; (3) AMAT has a minimal reduction in prediction accuracy on clean data, compared with the SAT method; and (4) AMAT has almost the same training time cost as SAT.

研究动机与目标

• 解决医学图像分析任务（如分割、关键点检测和目标检测）中对抗鲁棒性与干净数据准确率之间的权衡问题。
• 克服标准对抗训练（SAT）的局限性，即对所有训练样本使用固定的噪声水平ε，导致在干净或低噪声数据上性能下降。
• 开发一种与任务无关、由损失定义边界的策略，根据模型不确定性与损失动态自适应地生成每一样本的噪声。
• 通过五个公开数据集，在多种医学影像任务中验证AMAT的有效性。
• 在不增加训练时间的前提下实现鲁棒性提升，与SAT相比保持相同训练效率。

提出的方法

• AMAT采用基于损失的边界策略，在反向传播过程中根据模型的损失值动态计算每个训练样本的扰动幅度。
• 与SAT不同，后者对所有样本应用固定的ε，AMAT生成基于样本的噪声水平，使其适应每个样本的难度，确保对困难样本施加更强的扰动，对简单样本施加更弱的扰动。
• 该方法将对抗训练与随损失梯度调整的边界相结合，使模型能够在不因高噪声样本而过拟合的情况下学习到鲁棒特征。
• AMAT兼容任何具有可微且明确定义损失函数的深度学习模型，适用于分割、检测和关键点定位等任务。
• 训练目标结合了标准损失与对抗损失，对抗噪声通过PGD攻击生成，其样本特定的ε由损失值计算得出。
• 自适应边界源自损失幅度，确保损失值较高（即更困难样本）的样本获得更大的扰动，从而提升泛化能力与鲁棒性。

实验结果

研究问题

• RQ1 自适应对抗训练是否能在不降低干净数据性能的前提下提升医学图像分割的鲁棒性？
• RQ2 在医学图像分析任务中，基于样本的自适应噪声水平是否优于对抗训练中固定的噪声水平？
• RQ3 所提出的AMAT方法是否能在提升鲁棒性与干净数据准确率的同时保持训练效率？
• RQ4 在多种医学影像任务中，AMAT与标准对抗训练（SAT）及标准模型（STD）相比，在不同对抗攻击（如PGD、IFGSM）下的表现如何？
• RQ5 AMAT框架是否具有跨不同医学图像分析任务（包括分割、关键点检测和目标检测）的通用性？

主要发现

• 在所有测试任务中，AMAT在干净数据和噪声数据上的平均相对误差（MRE）均最低，优于SAT和STD模型。
• 在BCCD数据集上，AMAT在干净数据上的mAP0.5:0.95为0.5989，在平均噪声数据上为0.2262，优于SAT1（0.5810和0.1709）和SAT15（0.2565和0.1320）。
• AMAT在干净数据上保持了接近STD的性能（如mAP为0.5989，而STD为0.5993），同时在鲁棒性方面显著优于SAT模型。
• STD模型在极低噪声水平下（如IF.5时mAP为0.0005）降至接近零，表明其对细微对抗扰动极度脆弱。
• 与SAT相比，AMAT的训练时间开销极小，所有实验中训练成本几乎相同。
• 在分割任务（Heart、Hippocampus、Prostate）中，AMAT甚至在干净数据Dice分数上超过了标准模型（STD），表明鲁棒性可实现而无需牺牲准确率。