Robustness Of Deep Learning Models Research Articles

Robustness in deep learning models for medical diagnostics: security and adversarial challenges towards robust AI applications

The current study investigates the robustness of deep learning models for accurate medical diagnosis systems with a specific focus on their ability to maintain performance in the presence of adversarial or noisy inputs. We examine factors that may influence model reliability, including model complexity, training data quality, and hyperparameters; we also examine security concerns related to adversarial attacks that aim to deceive models along with privacy attacks that seek to extract sensitive information. Researchers have discussed various defenses to these attacks to enhance model robustness, such as adversarial training and input preprocessing, along with mechanisms like data augmentation and uncertainty estimation. Tools and packages that extend the reliability features of deep learning frameworks such as TensorFlow and PyTorch are also being explored and evaluated. Existing evaluation metrics for robustness are additionally being discussed and evaluated. This paper concludes by discussing limitations in the existing literature and possible future research directions to continue enhancing the status of this research topic, particularly in the medical domain, with the aim of ensuring that AI systems are trustworthy, reliable, and stable.

Robust-EQA: Robust Learning for Embodied Question Answering With Noisy Labels.

Embodied question answering (EQA) is a recently emerged research field in which an agent is asked to answer the user's questions by exploring the environment and collecting visual information. Plenty of researchers turn their attention to the EQA field due to its broad potential application areas, such as in-home robots, self-driven mobile, and personal assistants. High-level visual tasks, such as EQA, are susceptible to noisy inputs, because they have complex reasoning processes. Before the profits of the EQA field can be applied to practical applications, good robustness against label noise needs to be equipped. To tackle this problem, we propose a novel label noise-robust learning algorithm for the EQA task. First, a joint training co-regularization noise-robust learning method is proposed for noisy filtering of the visual question answering (VQA) module, which trains two parallel network branches by one loss function. Then, a two-stage hierarchical robust learning algorithm is proposed to filter out noisy navigation labels in both trajectory level and action level. Finally, by taking purified labels as inputs, a joint robust learning mechanism is given to coordinate the work of the whole EQA system. Empirical results demonstrate that, under extremely noisy environments (45% of noisy labels) and low-level noisy environments (20% of noisy labels), the robustness of deep learning models trained by our algorithm is superior to the existing EQA models in noisy environments.

Advances in Deep Learning Methods for Prostate Segmentation and Volume Estimation in Ultrasound Imaging

Accurate prostate volume estimation is crucial for effective prostate disease management. Ultrasound (US) imaging, particularly transrectal ultrasound, offers a cost-effective and rapid assessment. However, US images often suffer from artifacts and poor contrast, making prostate volume estimation challenging. This review explores recent advancements in deep learning (DL) techniques for automatic prostate segmentation in US images as a primary step toward prostate volume estimation. We examine various DL architectures, including traditional U-Net modifications and innovative designs incorporating residual connections, multi-directional image data, and attention mechanisms. Additionally, we discuss pre-processing methods to enhance image quality, the integration of shape information, and strategies to improve the consistency and robustness of DL models. The effectiveness of these techniques is evaluated through metrics such as the Dice Similarity Coefficient, Jaccard Index, and Hausdorff Distance. The review highlights the potential of DL in improving prostate volume estimation accuracy and reducing clinical workload while also identifying areas for future research to enhance model performance and generalizability.

Improvement of the robustness of deep learning models against adversarial attacks

Artificial intelligence has had significant and widespread advancements globally in recent years, primarily due to the exceptional progress of deep learning, a subset of machine learning. Currently, there is a rapid and significant rise in the adoption of deep learning as a research tool across several scientific disciplines worldwide. It has emerged as an integrative and versatile method for conducting general scientific research. Nevertheless, the extensive prevalence and ongoing refinement of adversarial assaults have become an intrinsic drawback of deep learning models, compromising the model's stability. Hence, enhancing the resilience of deep learning models against adversarial attacks has emerged as a highly focused area of research. This study employs the research method of literature analysis and literature review to examine the resilience and vulnerability of deep learning. It explores several approaches to enhance the robustness of deep learning models and provides a comprehensive summary and insights into improving these models.

Dose robustness of deep learning models for anatomic segmentation of computed tomography images.

The trend towards lower radiation doses and advances in computed tomography (CT) reconstruction may impair the operation of pretrained segmentation models, giving rise to the problem of estimating the dose robustness of existing segmentation models. Previous studies addressing the issue suffer either from a lack of registered low- and full-dose CT images or from simplified simulations. We employed raw data from full-dose acquisitions to simulate low-dose CT scans, avoiding the need to rescan a patient. The accuracy of the simulation is validated using a real CT scan of a phantom. We consider down to 20% reduction of radiation dose, for which we measure deviations of several pretrained segmentation models from the full-dose prediction. In addition, compatibility with existing denoising methods is considered. The results reveal the surprising robustness of the TotalSegmentator approach, showing minimal differences at the pixel level even without denoising. Less robust models show good compatibility with the denoising methods, which help to improve robustness in almost all cases. With denoising based on a convolutional neural network (CNN), the median Dice between low- and full-dose data does not fall below 0.9 (12 for the Hausdorff distance) for all but one model. We observe volatile results for labels with effective radii less than 19mm and improved results for contrasted CT acquisitions. The proposed approach facilitates clinically relevant analysis of dose robustness for human organ segmentation models. The results outline the robustness properties of a diverse set of models. Further studies are needed to identify the robustness of approaches for lesion segmentation and to rank the factors contributing to dose robustness.

Exploring the potential of pretrained CNNs and time-frequency methods for accurate epileptic EEG classification: a comparative study

Prompt diagnosis of epilepsy relies on accurate classification of automated electroencephalogram (EEG) signals. Several approaches have been developed to characterize epileptic EEG data; however, none of them have exploited time-frequency data to evaluate the effect of tweaking parameters in pretrained frameworks for EEG data classification. This study compares the performance of several pretrained convolutional neural networks (CNNs) namely, AlexNet, GoogLeNet, MobileNetV2, ResNet-18 and SqueezeNet for the localization of epilepsy EEG data using various time-frequency data representation algorithms. Continuous wavelet transform (CWT), empirical Fourier decomposition (EFD), empirical mode decomposition (EMD), empirical wavelet transform (EWT), and variational mode decomposition (VMD) were exploited for the acquisition of 2D scalograms from 1D data. The research evaluates the effect of multiple factors, including noisy versus denoised scalograms, different optimizers, learning rates, single versus dual channels, model size, and computational time consumption. The benchmark Bern-Barcelona EEG dataset is used for testing purpose. Results obtained show that the combination of MobileNetV2, Continuous Wavelet Transform (CWT) and Adam optimizer at a learning rate of 10−4, coupled with dual-data channels, provides the best performance metrics. Specifically, these parameters result in optimal sensitivity, specificity, f1-score, and classification accuracy, with respective values of 96.06%, 96.15%, 96.08%, and 96.10%. To further corroborate the efficacy of opted pretrained models on exploited Signal Decomposition (SD) algorithms, the classifiers are also being simulated on Temple University database at pinnacle modeling composition. A similar pattern in the outcome readily validate the findings of our study and robustness of deep learning models on epilepsy EEG scalograms.The conclusions drawn emphasize the potential of pretrained CNN-based models to create a robust, automated system for diagnosing epileptiform. Furthermore, the study offers insights into the effectiveness of varying time-frequency techniques and classifier parameters for classifying epileptic EEG data.

Robustness of Deep Learning models in electrocardiogram noise detection and classification

Background and Objective: Automatic electrocardiogram (ECG) signal analysis for heart disease detection has gained significant attention due to busy lifestyles. However, ECG signals are susceptible to noise, which adversely affects the performance of ECG signal analysers. Traditional blind filtering methods use predefined noise frequency and filter order, but they alter ECG biomarkers. Several Deep Learning-based ECG noise detection and classification methods exist, but no study compares recurrent neural network (RNN) and convolutional neural network (CNN) architectures and their complexity. Methods:This paper introduces a knowledge-based ECG filtering system using Deep Learning to classify ECG noise types and compare popular computer vision model architectures in a practical Internet of Medical Things (IoMT) framework. Experimental results demonstrate that the CNN-based ECG noise classifier outperforms the RNN-based model in terms of performance and training time. Results:The study shows that AlexNet, visual geometry group (VGG), and residual network (ResNet) achieved over 70% accuracy, specificity, sensitivity, and F1 score across six datasets. VGG and ResNet performances were comparable, but VGG was more complex than ResNet, with only a 4.57% less F1 score. Conclusions:This paper introduces a Deep Learning (DL) based ECG noise classifier for a knowledge-driven ECG filtering system, offering selective filtering to reduce signal distortion. Evaluation of various CNN and RNN-based models reveals VGG and Resnet outperform. Further, the VGG model is superior in terms of performance. But Resnet performs comparably to VGG with less model complexity.

Status of the Deep Learning-Based Shattered Pellet Injection Shard Tracking at ASDEX Upgrade

Plasma disruptions pose an intolerable risk to large tokamaks, such as ITER. If a disruption can no longer be avoided, ITER’s last line of defense will be the Shattered Pellet Injection. An experimental test bench was created at ASDEX Upgrade to inform the design decisions for controlling the shattering of the pellets and develop the techniques for the generation of the fragment distributions necessary for optimal disruption mitigation. In an effort to analyze the videos resulting from the more than 1000 tests and determine the impact of different settings on the resulting shard cloud, an analysis pipeline, based on traditional computer vision (CV), was created. This pipeline enabled the analysis of 173 of the videos, but at the same time showed the limits of traditional CV when applied in applications with a highly heterogeneous dataset such as this. We created a machine learning-based (ML) alternative as a drop-in replacement to the original image processing code using a semantic segmentation model to exploit the innate adaptability and robustness of deep learning models. This model is capable of labeling the entire dataset quickly, accurately and reliably. This contribution details the implementation of the ML model and the current state and future plans of the project.

Robustness and Security in Deep Learning: Adversarial Attacks and Countermeasures

Deep learning models have demonstrated remarkable performance across various domains, yet their susceptibility to adversarial attacks remains a significant concern. In this study, we investigate the effectiveness of three defense mechanisms—Baseline (No Defense), Adversarial Training, and Input Preprocessing—in enhancing the robustness of deep learning models against adversarial attacks. The baseline model serves as a reference point, highlighting the vulnerability of deep learning systems to adversarial perturbations. Adversarial Training, involving the augmentation of training data with adversarial examples, significantly improves model resilience, demonstrating higher accuracy under both Fast Gradient Sign Method (FGSM) and Iterative Gradient Sign Method (IGSM) attacks. Similarly, Input Preprocessing techniques mitigate the impact of adversarial perturbations on model predictions by modifying input data before inference. However, each defense mechanism presents trade-offs in terms of computational complexity and performance. Adversarial Training requires additional computational resources and longer training times, while Input Preprocessing techniques may introduce distortions affecting model generalization. Future research directions may focus on developing more sophisticated defense mechanisms, including ensemble methods, gradient masking, and certified defense strategies, to provide robust and reliable deep learning systems in real-world scenarios. This study contributes to a deeper understanding of defense mechanisms against adversarial attacks in deep learning, highlighting the importance of implementing robust strategies to enhance model resilience.

Brain-inspired semantic data augmentation for multi-style images.

Data augmentation is an effective technique for automatically expanding training data in deep learning. Brain-inspired methods are approaches that draw inspiration from the functionality and structure of the human brain and apply these mechanisms and principles to artificial intelligence and computer science. When there is a large style difference between training data and testing data, common data augmentation methods cannot effectively enhance the generalization performance of the deep model. To solve this problem, we improve modeling Domain Shifts with Uncertainty (DSU) and propose a new brain-inspired computer vision image data augmentation method which consists of two key components, namely, using Robust statistics and controlling the Coefficient of variance for DSU (RCDSU) and Feature Data Augmentation (FeatureDA). RCDSU calculates feature statistics (mean and standard deviation) with robust statistics to weaken the influence of outliers, making the statistics close to the real values and improving the robustness of deep learning models. By controlling the coefficient of variance, RCDSU makes the feature statistics shift with semantic preservation and increases shift range. FeatureDA controls the coefficient of variance similarly to generate the augmented features with semantics unchanged and increase the coverage of augmented features. RCDSU and FeatureDA are proposed to perform style transfer and content transfer in the feature space, and improve the generalization ability of the model at the style and content level respectively. On Photo, Art Painting, Cartoon, and Sketch (PACS) multi-style classification task, RCDSU plus FeatureDA achieves competitive accuracy. After adding Gaussian noise to PACS dataset, RCDSU plus FeatureDA shows strong robustness against outliers. FeatureDA achieves excellent results on CIFAR-100 image classification task. RCDSU plus FeatureDA can be applied as a novel brain-inspired semantic data augmentation method with implicit robot automation which is suitable for datasets with large style differences between training and testing data.

Bibimbap : Pre-trained models ensemble for Domain Generalization

This paper addresses a machine learning problem often challenged by differences in the distributions of training and real-world data. We propose a framework that addresses the problem of underfitting in the ensembling method using pre-trained models and improves the performance and robustness of deep learning models through ensemble diversity. For the naive weight ensembling framework, we discovered that the ensembled models could not lie in the same loss basin under extreme domain shift conditions, suggesting that a loss barrier may exist. We used a fine-tuning step after the weighted ensemble to address the underfitting problem caused by the loss barrier and stabilize the batch normalization running parameters. We also inferred through qualitative analysis that the diversity of ensemble models affects domain generalization. We validate our method on a large-scale image dataset (ImageNet-1K) and chemical molecule data, which is suitable for testing with domain shift problems due to its data-splitting method.

Deforestation detection using deep learning-based semantic segmentation techniques: a systematic review

Deforestation poses a critical global threat to Earth’s ecosystem and biodiversity, necessitating effective monitoring and mitigation strategies. The integration of deep learning with remote sensing offers a promising solution for precise deforestation segmentation and detection. This paper provides a comprehensive review of deep learning methodologies applied to deforestation analysis through satellite imagery. In the face of deforestation’s ecological repercussions, the need for advanced monitoring and surveillance tools becomes evident. Remote sensing, with its capacity to capture extensive spatial data, combined with deep learning’s prowess in recognizing complex patterns to enable precise deforestation assessment. Integration of these technologies through state-of-the-art models, including U-Net, DeepLab V3, ResNet, SegNet, and FCN, has enhanced the accuracy and efficiency in detecting deforestation patterns. The review underscores the pivotal role of satellite imagery in capturing spatial information and highlights the strengths of various deep learning architectures in deforestation analysis. Multiscale feature learning and fusion emerge as critical strategies enabling deep networks to comprehend contextual nuances across various scales. Additionally, attention mechanisms combat overfitting, while group and shuffle convolutions further enhance accuracy by reducing dominant filters’ contribution. These strategies collectively fortify the robustness of deep learning models in deforestation analysis. The integration of deep learning techniques into remote sensing applications serves as an excellent tool for deforestation identification and monitoring. The synergy between these fields, exemplified by the reviewed models, presents hope for preserving invaluable forests. As technology advances, insights from this review will drive the development of more accurate, efficient, and accessible deforestation detection methods, contributing to the sustainable management of the planet’s vital resources.

Evaluating the Robustness of Deep Learning Models against Adversarial Attacks: An Analysis with FGSM, PGD and CW

This study evaluated the generation of adversarial examples and the subsequent robustness of an image classification model. The attacks were performed using the Fast Gradient Sign method, the Projected Gradient Descent method, and the Carlini and Wagner attack to perturb the original images and analyze their impact on the model’s classification accuracy. Additionally, image manipulation techniques were investigated as defensive measures against adversarial attacks. The results highlighted the model’s vulnerability to conflicting examples: the Fast Gradient Signed Method effectively altered the original classifications, while the Carlini and Wagner method proved less effective. Promising approaches such as noise reduction, image compression, and Gaussian blurring were presented as effective countermeasures. These findings underscore the importance of addressing the vulnerability of machine learning models and the need to develop robust defenses against adversarial examples. This article emphasizes the urgency of addressing the threat posed by harmful standards in machine learning models, highlighting the relevance of implementing effective countermeasures and image manipulation techniques to mitigate the effects of adversarial attacks. These efforts are crucial to safeguarding model integrity and trust in an environment marked by constantly evolving hostile threats. An average 25% decrease in accuracy was observed for the VGG16 model when exposed to the Fast Gradient Signed Method and Projected Gradient Descent attacks, and an even more significant 35% decrease with the Carlini and Wagner method.

Increasing the Robustness of Deep Learning Models for Object Segmentation: A Framework for Blending Automatically Annotated Real and Synthetic Data.

Recent problems in robotics can sometimes only be tackled using machine learning technologies, particularly those that utilize deep learning (DL) with transfer learning. Transfer learning takes advantage of pretrained models, which are later fine-tuned using smaller task-specific datasets. The fine-tuned models must be robust against changes in environmental factors such as illumination since, often, there is no guarantee for them to be constant. Although synthetic data for pretraining has been shown to enhance DL model generalization, there is limited research on its application for fine-tuning. One limiting factor is that the generation and annotation of synthetic datasets can be cumbersome and impractical for the purpose of fine-tuning. To address this issue, we propose two methods for automatically generating annotated image datasets for object segmentation, one for real-world and another for synthetic images. We also introduce a novel domain adaptation approach called filling the reality gap (FTRG), which can blend elements from real-world and synthetic scenes in a single image to achieve domain adaptation. We demonstrate through experimentation on a representative robot application that FTRG outperforms other domain adaptation techniques, such as domain randomization or photorealistic synthetic images, in creating robust models. Furthermore, we evaluate the benefits of using synthetic data for fine-tuning in transfer learning and continual learning with experience replay using our proposed methods and FTRG. Our findings indicate that fine-tuning with synthetic data can produce superior results compared to solely using real-world data.

Are transformer-based models more robust than CNN-based models?

As the deployment of artificial intelligence (AI) models in real-world settings grows, their open-environment robustness becomes increasingly critical. This study aims to dissect the robustness of deep learning models, particularly comparing transformer-based models against CNN-based models. We focus on unraveling the sources of robustness from two key perspectives: structural and process robustness. Our findings suggest that transformer-based models generally outperform convolution-based models in robustness across multiple metrics. However, we contend that these metrics may not wholly represent true model robustness, such as the mean of corruption error. To better understand the underpinnings of this robustness advantage, we analyze models through the lens of Fourier transform and game interaction. From our insights, we propose a calibrated evaluation metric for robustness against real-world data, and a blur-based method to enhance robustness performance. Our approach achieves state-of-the-art results, with mCE scores of 2.1% on CIFAR-10-C, 12.4% on CIFAR-100-C, and 24.9% on TinyImageNet-C.

Frequency-based methods for improving the imperceptibility and transferability of adversarial examples

The adversarial attack is a popular technology to evaluate the robustness of deep learning models. However, adversarial examples crafted by current methods often have poor imperceptibility and low transferability, hindering the utility of attacks in practice. In this paper, we creatively leverage the frequency information to promote the imperceptibility and adversarial transferability in the white-box scenario and black-box scenario, respectively. Specifically, in the white-box scenario, we adopt the low-frequency constraint and normal projection to improve the imperceptibility of the adversarial example without reducing the attack performance. In the black-box scenario, we propose an effective Frequency Spectrum Diversity Transformation (FSDT) to address the issue of overfitting to the substitute model. FSDT enriches the input with a diverse set of unfamiliar information, significantly improving the transferability of adversarial attacks. Towards those defended target models in the black-box scenario, we also design a gradient refinement technology named Frequency Dropout (FD) to discard some useless components of gradients in the frequency domain, which can further mitigate the protective effect of defense mechanisms. Plentiful experiments forcefully validate the superiority of our proposed methods. Furthermore, we apply the proposed method to evaluate the robustness of real-world online models and discover their vulnerability. Finally, we analyze why imperceptibility and adversarial transferability are hard to improve concurrently from the view of frequency. Our codes are available at https://github.com/RYC-98/FSD-MIM-and-NPGA.

End-to-end deep learning pipeline for on-board extraterrestrial rock segmentation

Bringing autonomy on board edge devices is inevitable to accelerate the process of space exploration. Although there are various tasks that can be executed autonomously by such vehicles, detecting and segmenting rocks in on-board images of extraterrestrial landscapes is a critical step in the processing chain, as it can allow to navigate safely while avoiding collisions. We tackle this issue and introduce an end-to-end pipeline for building and validating resource-frugal machine learning techniques for this task, offering a high level of flexibility. Deploying such models on board edge devices poses numerous practical challenges, spanning across ensuring their memory and computational efficiency, and understanding their robustness against varying quality of acquired images. These aspects are often overlooked while building deep learning-powered on-board systems—we show that they can (and ultimately should) be a part of the deployment chain. Our extensive experimental study performed over several benchmark data sets shed more light on functional and non-functional capabilities of the investigated models, both in full-precision and compressed by quantisation, the latter delivering statistically same segmentation accuracy while being approximately 11× smaller. Additionally, we show that synthesised images can be utilised to quantify the robustness of deep learning models against on-board acquisition conditions which directly affect the quality of captured images—such simulations mimicking real-world acquisition settings could have a negative impact on the capabilities of the models trained over clean and high-quality image data. To ensure full reproducibility of this study, we made our implementation publicly available at https://github.com/danielmarek22/onboard-rock-segmentation.

COVID-19 CHEST CT IMAGE SEGMENTATION NETWORK BY MULTI SCALE FUSION AND ENHANCEMENT OPERATIONS

ABSTRACT-A deep learning research is the availability of training data sets. With a limited number of publicly available COVID-19 chest X-ray images, the generalization and robustness of deep learning models to detect COVID-19 cases developed based on these images are questionable. Segmentation of pneumonia lesions from Lung CT images has become vital for diagnosing the disease and evaluating the severity of the patients during the COVID-19 pandemic. Several Deep Learning based systems have been proposed for this task. However, some low-contrast abnormal zones in CT images make the task challenging. which will be used as the testing data set. We used a deep learning model based on the convolutional neural network architecture, which was pre trained to recognize objects from a million of images and then retrained to detect abnormality in chest X-ray images. Keywords—Deep Learning, COVID-19, pneumonia prediction, Evolution, Intelligent System.

Adversarial Robustness in Graph-Based Neural Architecture Search for Edge AI Transportation Systems

Edge AI technologies have been used for many Intelligent Transportation Systems, such as road traffic monitor systems. Neural Architecture Search (NAS) is a typcial way to search high-performance models for edge devices with limited computing resources. However, NAS is also vulnerable to adversarial attacks. In this paper, A One-Shot NAS is employed to realize derivative models with different scales. In order to study the relation between adversarial robustness and model scales, a graph-based method is designed to select best sub models generated from One-Shot NAS. Besides, an evaluation method is proposed to assess robustness of deep learning models under various scales of models. Experimental results shows an interesting phenomenon about the correlations between network sizes and model robustness, reducing model parameters will increase model robustness under maximum adversarial attacks, while, increasing model paremters will increase model robustness under minimum adversarial attacks. The phenomenon is analyzed, that is able to help understand the adversarial robustness of models with different scales for edge AI transportation systems.

Holistic Adversarial Robustness of Deep Learning Models

Adversarial robustness studies the worst-case performance of a machine learning model to ensure safety and reliability. With the proliferation of deep-learning-based technology, the potential risks associated with model development and deployment can be amplified and become dreadful vulnerabilities. This paper provides a comprehensive overview of research topics and foundational principles of research methods for adversarial robustness of deep learning models, including attacks, defenses, verification, and novel applications.