[论文解读] Fuzzy Unique Image Transformation: Defense Against Adversarial Attacks On Deep COVID-19 Models

Achyut Mani Tripathi, Ashish Mishra|arXiv (Cornell University)|Sep 8, 2020

COVID-19 diagnosis using AI参考文献 50被引用 9

一句话总结

本文提出模糊唯一图像变换（Fuzzy Unique Image Transformation, FUIT），一种预处理技术，通过将图像像素映射到模糊区间以减少唯一像素值的方差，从而增强对对抗性攻击的鲁棒性。在对COVID-19胸部X光片和CT扫描图像进行训练前应用FUIT，模型在对抗PGD和BIM等六种攻击时仍能保持高达88.31%的诊断准确率，且在强攻击下准确率超过85%。

ABSTRACT

Early identification of COVID-19 using a deep model trained on Chest X-Ray and CT images has gained considerable attention from researchers to speed up the process of identification of active COVID-19 cases. These deep models act as an aid to hospitals that suffer from the unavailability of specialists or radiologists, specifically in remote areas. Various deep models have been proposed to detect the COVID-19 cases, but few works have been performed to prevent the deep models against adversarial attacks capable of fooling the deep model by using a small perturbation in image pixels. This paper presents an evaluation of the performance of deep COVID-19 models against adversarial attacks. Also, it proposes an efficient yet effective Fuzzy Unique Image Transformation (FUIT) technique that downsamples the image pixels into an interval. The images obtained after the FUIT transformation are further utilized for training the secure deep model that preserves high accuracy of the diagnosis of COVID-19 cases and provides reliable defense against the adversarial attacks. The experiments and results show the proposed model prevents the deep model against the six adversarial attacks and maintains high accuracy to classify the COVID-19 cases from the Chest X-Ray image and CT image Datasets. The results also recommend that a careful inspection is required before practically applying the deep models to diagnose the COVID-19 cases.

研究动机与目标

• 解决深度学习模型在基于医学图像诊断COVID-19时对利用微小像素扰动的对抗性攻击的脆弱性。
• 开发一种预处理技术，以增强模型鲁棒性而不损害诊断准确率。
• 评估所提方法在真实世界COVID-19图像数据集上对多种白盒对抗性攻击的有效性。
• 证明FUIT可减少干净图像与对抗性图像之间唯一像素值的方差，从而降低模型对扰动的敏感性。

提出的方法

• FUIT使用预定义的模糊集将每个像素值映射到模糊区间，将图像转换为像素值多样性降低的表示形式。
• 该变换确保干净图像与对抗性图像具有相同数量的唯一像素值，从而最小化攻击者可检测到的统计差异。
• 模糊集被构建为将像素强度范围划分为若干区间，以实现在图像间的一致下采样。
• FUIT变换后的图像用于微调深度学习模型，随后评估其在六种对抗性攻击类型下的鲁棒性。
• 该方法在两个数据集上进行评估：使用X光片和CT扫描图像，通过训练有无FUIT的模型进行对比。
• 鲁棒性通过在各种对抗性攻击（包括PGD、BIM、FGSM、CW、DeepFool和PGD-r）下的分类准确率来衡量。

实验结果

研究问题

• RQ1 像FUIT这样的预处理技术能否有效防御医学图像分类中深度学习模型的对抗性攻击？
• RQ2 当应用于COVID-19 X光片和CT扫描图像时，FUIT对深度模型诊断准确率有何影响？
• RQ3 FUIT在多大程度上减少了干净图像与对抗性图像之间唯一像素值的方差？
• RQ4 与基线模型相比，基于FUIT的模型在多种对抗性攻击类型下的鲁棒性如何？

主要发现

• 经过FUIT变换的模型（M13–M18）在最激进的BIM攻击下仍保持超过85%的分类准确率，其中M13达到85.21%的准确率。
• 相比之下，基线模型（M10–M12）在BIM攻击下准确率最低降至8.12%，表明其高度脆弱。
• 在PGD攻击下，FUIT模型达到86.12%的准确率（M13），而非FUIT模型则下降至48.19%（M10）。
• FUIT技术在干净CT图像上保持了高达88.31%的诊断准确率，与最先进模型相当。
• FUIT方法有效均衡了干净图像与对抗性图像之间的唯一像素值数量，减少了攻击者可利用的统计差异。
• 视觉检查确认，对抗性图像对人类而言与干净图像无法区分，但无FUIT的模型仍被误导，凸显了防御机制的必要性。