AIPA: An Adversarial Imperceptible Patch Attack on Medical Datasets and its Interpretability

Abstract

Deep learning is one of the most prominent computational techniques used for automated disease detection in the medical domain. In the field of deep learning, the performance and reliability of deep learning models have been compromised due to adversarial attacks. In this work, a novel Adversarial Imperceptible Patch Attack (AIPA) is proposed. Adversarial noise, which is created as a small rectangular patch of noise, is added to an original image to synthesise the adversarial image. The Diabetic Retinopathy 2015 Data Colored Resized dataset and the SARS-COV-2 CT-Scan dataset have been used in this experimentation. It is found that for both the datasets, the adversarial image synthesised by the proposed technique is capable of misleading a customised VGG16 in terms of its classification. Interpretability plots generated using the Gradient Shap, Integrated Gradients, Occlusion and Saliency techniques are also studied. The proposed adversarial attack has influenced the interpretability plots, irrespective of whether the adversarial attack is successful in misclassification or not. When the attack is successful with respect to classification, the interpretability plots seem to favour misprediction. In addition, when the attack is unsuccessful, interpretability plots are inconsistent. The susceptibility of the deep learning models revealed by this work would be beneficial for the research community to devise better defence mechanisms and interpretability methods.