CoChat
Sign Up
Cited by 51Adversarial Robustness in Machine LearningDigital Media Forensic DetectionAI in cancer detection

Using Adversarial Images to Assess the Robustness of Deep Learning Models Trained on Diagnostic Images in Oncology

Open access
Joel, Marina Z., Umrao, Sachin, Chang, Enoch, Choi, Rachel, Yang, Daniel X., Duncan, James S., Omuro, Antonio, Herbst, Roy +2 more·2022·JCO Clinical Cancer Informatics
DOI 10.1200/cci.21.00170PMC PMC8932490

Published version of a preprint

Open this paper in CoChat — free account

Abstract

PURPOSE Deep learning (DL) models have rapidly become a popular and cost-effective tool for image classification within oncology. A major limitation of DL models is their vulnerability to adversarial images, manipulated input images designed to cause misclassifications by DL models. The purpose of the study is to investigate the robustness of DL models trained on diagnostic images using adversarial images and explore the utility of an iterative adversarial training approach to improve the robustness of DL models against adversarial images. METHODS We examined the impact of adversarial images on the classification accuracies of DL models trained to classify cancerous lesions across three common oncologic imaging modalities. The computed tomography (CT) model was trained to classify malignant lung nodules. The mammogram model was trained to classify malignant breast lesions. The magnetic resonance imaging (MRI) model was trained to classify brain metastases. RESULTS Oncologic images showed instability to small pixel-level changes. A pixel-level perturbation of 0.004 (for pixels normalized to the range between 0 and 1) resulted in most oncologic images to be misclassified (CT 25.6%, mammogram 23.9%, and MRI 6.4% accuracy). Adversarial training improved the stability and robustness of DL models trained on oncologic images compared with naive models ([CT 67.7% v 26.9%], mammogram [63.4% vs 27.7%], and MRI [87.2% vs 24.3%]). CONCLUSION DL models naively trained on oncologic images exhibited dramatic instability to small pixel-level changes resulting in substantial decreases in accuracy. Adversarial training techniques improved the stability and robustness of DL models to such pixel-level changes. Before clinical implementation, adversarial training should be considered to proposed DL models to improve overall performance and safety.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1200/cci.21.00170

Cites

21 of 21 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Adversarial attacks are perturbations that maintain the visual structure of the data as close as possible to the original data, which is more suited for image and ECG than for tabular data.

    “adversarial attacks being perturbations that maintain the “visual” structure (from a human perspective) of the data as close as possible to the original data, which is more suited for image and ECG than for tabular data, for instance28,29.”

    From A scoping review of robustness concepts for machine learning in healthcare (2025) · cites this paper as [28]

    The Introduction (page unavailable) says adversarial images have small pixel-level changes that are often imperceptible to humans, and Methods says the attacks minimize the difference from the original image. The paper does not address ECG or tabular data, so it does not support the claimed comparison of their suitability. (LLM, conf=0.88)

    Experimental — accuracy not yet measured

  • Even the most accurate AI model will fail if oncologists cannot use it effectively.

    “Even the most accurate AI model will fail if oncologists cannot use it effectively [139,140,141].”

    From Artificial Intelligence in Clinical Oncology: From Productivity Enhancement to Creative Discovery (2025) · cites this paper as [141]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 23

  1. [11]Szegedy C Zaremba W Sutskever I et al Intriguing properties of neural networks arXiv 2013 arXiv preprint 1312.6199 · arXiv
  2. [12]Kurakin A Goodfellow I Bengio S Adversarial examples in the physical world arXiv 2013 arXiv:1607.02533 · arXiv
  3. [13]Yuan X He P Zhu Q et al Adversarial examples: Attacks and defenses for deep learning arXiv 2017 arXiv:1712.07107 30640631 · arXiv
  4. [15]Goodfellow IJ Shlens J Szegedy C Explaining and harnessing adversarial examples arXiv 2014 arXiv:1412.6572 · arXiv
  5. [16]Shu H Shi R Zhu H et al Adversarial image generation and training for deep neural networks arXiv 2020 arXiv:2006.03243 · arXiv
  6. [17]Tabacof P Valle E Exploring the space of adversarial images arXiv 2015 arXiv:1510.05328 · arXiv
  7. [18]Madry A Makelov A Schmidt L et al Towards deep learning models resistant to adversarial attacks arXiv arXiv:1706.06083 · arXiv
  8. [19]Finlayson SG Chung HW Kohane IS et al Adversarial attacks against medical deep learning systems arXiv 2018 arXiv:1804.05296 · arXiv
  9. [23]Chang E Joel M Chang HY et al Comparison of radiomic feature aggregation methods for patients with multiple tumors medRxiv 2020 2020.11.04.20226159 PMC8105371 33963236
  10. [27]Simonyan K Zisserman A Very deep convolutional networks for large-scale image recognition arXiv 2014 arXiv:1409.1556, 2014 · arXiv
  11. [28]Abadi M Agarwal A Barham P et al Tensorflow: Large-scale machine learning on heterogeneous distributed systems arXiv 2016 arXiv:1603.04467 · arXiv
  12. [29]Nicolae M-I Sinn M Tran MN et al Adversarial robustness Toolbox v1.0.0 arXiv 2018 arXiv:1807.01069 · arXiv
  13. [31]Kyono T Gilbert FJ van der Schaar M MAMMO: A deep learning solution for facilitating radiologist-machine collaboration in breast cancer diagnosis arXiv 2018 arXiv:1811.02661 · arXiv
  14. [36]Wetstein SC González-Gonzalo C Bortsova G et al Adversarial attack vulnerability of medical image analysis systems: Unexplored factors arXiv 2020 arXiv:2006.06356 34246850 · arXiv
  15. [37]Asgari Taghanaki S Das A Hamarneh G Vulnerability analysis of chest X-ray image classification against adversarial attacks arXiv 2018 arXiv:1807.02905 · arXiv
  16. [39]Shafahi A Najibi M Ghiasi A et al Adversarial training for free! arXiv 2019 arXiv:1904.12843 · arXiv
  17. [40]Li X Pan D Zhu D Defending against adversarial attacks on medical imaging AI system, classification or detection? arXiv 2020 arXiv:2006.13555 · arXiv
  18. [41]Li X Zhu D Robust detection of adversarial attacks on medical images 2020 IEEE 17th International Symposium on Biomedical Imaging (ISBI), 2020, pp 1154-1158
  19. [42]Paul R Schabath M Gillies R et al Mitigating adversarial attacks on medical image understanding systems 2020 IEEE 17th International Symposium on Biomedical Imaging (ISBI), 2020, pp 1517-1521
  20. [43]Vatian A Gusarova N Dobrenko N et al Impact of adversarial examples on the efficiency of interpretation and use of information from high-tech medical images 2019 24th Conference of Open Innovations Association (FRUCT), 2019, pp 472-478
  21. [46]Li B Chen C Wang W et al Certified adversarial robustness with additive noise arXiv 2018 arXiv:1809.03113 · arXiv
  22. [47]Chen C Yuan W Lu X et al Spoof face detection via semi-supervised adversarial training arXiv 2020 arXiv:2005.10999 · arXiv
  23. [48]Uesato J Alayrac J-B Huang P-S et al Are labels required for improving adversarial robustness? arXiv 2019 arXiv:1905.13725 · arXiv

Cited by

Sorted by citations

Authors
Joel, M. Z., Umrao, S., Chang, E., Choi, R., Yang, D. X., Duncan, J. S., Omuro, A., Herbst, R., Krumholz, H. M., & Aneja, S.
Affiliations
  • Yale University (US)
  • Department of Therapeutic Radiology, Yale School of Medicine, New Haven, CT
ORCID
Venue
JCO Clinical Cancer Informatics
Publisher
American Society of Clinical Oncology (ASCO)
Published
2022-05
Volume
6
Issue
6
Pages
e2100170-e2100170
ISSN
2473-4276 (ISSN-L)
DOI
10.1200/cci.21.00170
PMC
PMC8932490
OpenAlex
W4220851686
Cited by
51
References
21
Citations by year
2026: 6 · 2025: 15 · 2024: 11 · 2023: 13 · 2022: 4 · 2021: 2
FWCI
3.52
Type
journal article
Language
en
Open access
Licence
cc-by-nc-nd
Locations
  • JCO Clinical Cancer Informatics (publishedVersion, cc-by-nc-nd)
  • medRxiv (acceptedVersion, cc-by)
  • PubMed Central (publishedVersion, cc-by-nc-nd)
  • PubMed (publishedVersion)
Funders
  • Conquer Cancer Foundation
  • Yale University
  • National Institutes of Health (UL1TR001863)
  • Yale SPORE in Lung Cancer
  • National Heart, Lung, and Blood Institute (T35HL007649)
  • National Cancer Institute (P50CA196530)
  • National Center for Advancing Translational Sciences
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
  • Physical Sciences › Computer Science › Artificial Intelligence › AI in cancer detection
Keywords
adversarial images, adversarial training, deep neural network robustness, lung nodule classification, breast lesion classification, computed tomography, mammography, magnetic resonance imaging
MeSH terms
Deep Learning, Breast, Humans, Magnetic Resonance Imaging, Mammography, Tomography, X-Ray Computed

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review