错过要点：多地标检测的目标对抗攻击
Miss the Point: Targeted Adversarial Attack on Multiple Landmark Detection
摘要：
基于深度卷积神经网络（CNN）的多标志点检测中的最新方法达到了高准确性并改进了传统的临床工作流程。然而，CNN对敌对示例攻击的脆弱性很容易被利用来破坏分类和分割任务。本文首次研究了基于CNN的多地标检测模型对对抗性扰动的脆弱性。具体来说，我们提出了一种新的自适应目标迭代FGSM（ATI-FGSM）攻击对国家的最先进的模型在多个地标检测。攻击者可以使用ATI-FGSM精确控制任意选择的地标的模型预测，同时通过向原始图像添加不可感知的扰动来保持其他静止地标静止。对一个用于头影测量标志检测的公共数据集的综合评估表明，与原始的迭代FGSM攻击相比，ATI-FGSM生成的对抗性示例更有效地破坏了基于CNN的网络。我们的工作揭示了对患者健康的严重威胁。此外，我们讨论了我们的方法的局限性，并提供潜在的防御方向，通过调查附近地标的耦合效应，即，我们实验中分歧的主要来源。我们的源代码可以在https://github.com/qsyao/attack_landmark_detection上找到。
英文摘要：
Recent methods in multiple landmark detection based on deep convolutional neural networks (CNNs) reach high accuracy and improve traditional clinical workflow. However, the vulnerability of CNNs to adversarial-example attacks can be easily exploited to break classification and segmentation tasks. This paper is the first to study how fragile a CNN-based model on multiple landmark detection to adversarial perturbations. Specifically, we propose a novel Adaptive Targeted Iterative FGSM (ATI-FGSM) attack against the state-of-the-art models in multiple landmark detection. The attacker can use ATI-FGSM to precisely control the model predictions of arbitrarily selected landmarks, while keeping other stationary landmarks still, by adding imperceptible perturbations to the original image. A comprehensive evaluation on a public dataset for cephalometric landmark detection demonstrates that the adversarial examples generated by ATI-FGSM break the CNN-based network more effectively and efficiently, compared with the original Iterative FGSM attack. Our work reveals serious threats to patients' health. Furthermore, we discuss the limitations of our method and provide potential defense directions, by investigating the coupling effect of nearby landmarks, i.e., a major source of divergence in our experiments. Our source code is available at https://github.com/qsyao/attack_landmark_detection.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
