The chest X-ray plays a key role in screening and diagnosis of many lung diseases including the COVID-19. More recently, many works construct deep neural networks (DNNs) for chest X-ray images to realize automated and efficient diagnosis of lung diseases. However, bias field caused by the improper medical image acquisition process widely exists in the chest X-ray images while the robustness of DNNs to the bias field is rarely explored, which definitely poses a threat to the X-ray-based automated diagnosis system. In this paper, we study this problem based on the recent adversarial attack and propose a brand new attack, i.e., the adversarial bias field attack where the bias field instead of the additive noise works as the adversarial perturbations for fooling the DNNs. This novel attack posts a key problem: how to locally tune the bias field to realize high attack success rate while maintaining its spatial smoothness to guarantee high realisticity. These two goals contradict each other and thus has made the attack significantly challenging. To overcome this challenge, we propose the adversarial-smooth bias field attack that can locally tune the bias field with joint smooth & adversarial constraints. As a result, the adversarial X-ray images can not only fool the DNNs effectively but also retain very high level of realisticity. We validate our method on real chest X-ray datasets with powerful DNNs, e.g., ResNet50, DenseNet121, and MobileNet, and show different properties to the state-of-the-art attacks in both image realisticity and attack transferability. Our method reveals the potential threat to the DNN-based X-ray automated diagnosis and can definitely benefit the development of bias-field-robust automated diagnosis system.
Improving the Robustness of Quantized Deep Neural Networks to White-Box Attacks using Stochastic Quantization and Information-Theoretic Ensemble Training
Center for Vision Technologies（视觉技术中心）；SRI International（SRI国际）
Towards a Robust Deep Neural Network in Texts: A Survey
Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education（空天信息安全与可信计算教育部重点实验室）；School of Cyber Science and Engineering, Wuhan University（武汉大学网络空间安全学院）
Exploring the Effect of DNN Depth on Adversarial Attacks in Network Intrusion Detection Systems
Computer Engineering Carleton University Ottawa, Canada（计算机工程 卡尔顿大学渥太华加拿大）；School of Information Technology Carleton University Ottawa, Canada（信息科技学院 卡尔顿大学渥太华加拿大）
Learning from Attacks: Attacking Variational Autoencoder for Improving Image Classification
fortiss（弗劳恩霍夫软件系统技术研究所）
对抗攻击通常被认为是对深度神经网络（DNN）鲁棒性的威胁。已经开发了各种防御技术来减轻对抗攻击对任务预测的潜在负面影响。本文从不同的角度分析了对抗攻击。也就是说，对抗性示例包含对预测有用的隐式信息，即，图像分类，并将针对DNN的对抗攻击视为能够促进特定学习任务的提取的抽象表示。我们提出了一个算法框架，利用DNN的数据自我表达和特定任务的预测的优势，以提高图像分类。该框架联合学习一个用于攻击变分自编码器（VAE）网络的DNN和一个用于分类的DNN，称为Attacking VAE for Improve Classification（AVIC）。实验结果表明，AVIC在标准数据集上的准确率高于干净样本训练和传统的对抗训练。
