Abstract PO-078: Exploring adversarial image attacks on deep learning models in oncology

Abstract

Abstract Purpose: Deep learning (DL) models have shown the ability to automate the classification of diagnostic images used for cancer detection. Unfortunately, recent evidence has suggested DL models are also vulnerable to adversarial image attacks by manipulating image pixels to force models to make incorrect predictions with high confidence. The existence of adversarial images, which are imperceptible from unmodified images to the human eye, poses a roadblock to the safe implementation of DL models in clinical settings. The extent to which diagnostic imaging is vulnerable to adversarial image attacks remains underexplored. We investigated the effectiveness of adversarial imaging attacks on DL models for three common imaging tasks within oncology. Additionally, we explored whether adversarial image attack vulnerability could be used as a metric to improve deep learning model performance. Methods: We employed adversarial imaging attacks on DL models for three common imaging tasks within oncology: 1) Classifying malignant lung nodules on CT imaging, 2) Classifying brain metastases on MRI imaging, 3) Classifying malignant breast lesions on mammograms. To assess relative vulnerability to adversarial image attacks, we also employed two DL models on non-medical images: 1) CIFAR10, 2) MNIST. We considered three first-order adversarial attacks: Fast Gradient Sign Method, Projected Gradient Descent, and Basic Iterative Method. Vulnerability to adversarial image attacks was assessed by comparing model accuracy at fixed levels of image perturbations. Model performance was also measured after removing images which were most susceptible to adversarial imaging attacks. Results: We observed that all three diagnostic imaging types were susceptible to adversarial imaging attacks. Overall diagnostic images were more vulnerable to adversarial attacks compared to non-medical images. Mammograms [29.6% accuracy] appeared to be the most vulnerable to adversarial imaging attacks followed by lung CTs [30.6% accuracy] and brain MRIs [30.8% accuracy]. Finally, we determined that removing images most vulnerable to adversarial manipulation leads to improved deep learning model performance [Mammogram: 73.6 % accuracy, CT: 83.0% accuracy, MRI 84.2% accuracy]. Conclusion: Our study demonstrates that diagnostic imaging modalities in cancer are likely more vulnerable to adversarial attacks than non-medical images. Susceptibility to adversarial imaging attacks varies across different diagnostic imaging modalities. Adversarial susceptibility for an individual image can be used as a valuable metric to improve DL model performance on diagnostic images. Citation Format: Marina Joel, Sachin Umrao, Enoch Chang, Rachel Choi, Daniel Yang, Aidan Gilson, Roy Herbst, Harlan Krumholz, Sanjay Aneja. Exploring adversarial image attacks on deep learning models in oncology [abstract]. In: Proceedings of the AACR Virtual Special Conference on Artificial Intelligence, Diagnosis, and Imaging; 2021 Jan 13-14. Philadelphia (PA): AACR; Clin Cancer Res 2021;27(5_Suppl):Abstract nr PO-078.