Diffusion-Based Feature Denoising and Using NNMF for Robust Brain Tumor Classification
Authors: Hiba Adil Al-kharsan, Róbert Rajkó
Organizations: Doctoral School of Computer Science, University of Szeged, Árpád tér 2, H-6720 Szeged, Hungary · University Research and Innovation Center (EKIK), Óbuda University, Bécsi út 96/b, H-1034 Budapest, Hungary · Academic Staff, Doctoral School of Computer Science, University of Szeged, Árpád tér 2, H-6720 Szeged, Hungary
Brain tumor classification from magnetic resonance imaging, which is also known as MRI, plays a sensitive role in computer-assisted diagnosis systems. In recent years, deep learning models have achieved high classification accuracy. However, their sensitivity to adversarial perturbations has become an important reliability concern in medical applications. This study suggests a robust brain tumor classification framework that combines Non-Negative Matrix Factorization (NNMF or NMF), lightweight convolutional neural networks (CNNs), and diffusion-based feature purification. Initially, MRI images are preprocessed and converted into a non-negative data matrix, from which compact and interpretable NNMF feature representations are extracted. Statistical metrics, including AUC, Cohen's d, and p-values, are used to rank and choose the most discriminative components. Then, a lightweight CNN classifier is trained directly on the selected feature groups. To improve adversarial robustness, a diffusion-based feature-space purification module is introduced. A forward noise method followed by a learned denoiser network is used before classification. System performance is estimated using both clean accuracy and robust accuracy under powerful adversarial attacks created by AutoAttack. The experimental results show that the proposed framework achieves competitive classification performance while significantly enhancing robustness against adversarial perturbations.The findings presuppose that combining interpretable NNMF-based representations with a lightweight deep approach and diffusion-based defense technique supplies an effective and reliable solution for medical image classification under adversarial conditions.
Figures & tables
Figure 1: Stages of the proposed framework
Figure 2: NNMF Basis Components (k = 15) . This figure shows the learned NNMF basis components got from the training data. Each basis image represents a non-negative spatial pattern that contributes to rebuilding brain MRI images. The components take meaningful anatomical structures such as skull boundaries, tissue distribution, and localized density variations. The variety across components indicates that NNMF decomposes the images into multiple complementary patterns rather than a single dominant structure, providing an interpretable and compact representation suitable for later analysis.
Figure 3: Example Test Image and Its Normalized NNMF Feature Vector. This figure illustrates an example test MRI image from the normal class side, its matching normalized NNMF feature vector. The bar plot shows the activation power of each NNMF component for this image, highlighting that only a subset of components exhibits strong responses. This sparse and selective activation pattern explains that NNMF features encode discriminative structural information rather than uniformly responding to all components, which is desirable for robust classification.
Figure 4: L2 Norm of Xtest After Normalization. This figure reports the L2 norm of all normalized test feature vectors. The values are tightly focused around one, confirming the right and stability of the normalization process. Ensuring unit-norm feature vectors is critical for fair comparison between samples and for robustness evaluation, as it blocks feature magnitude variations from controlling the classifier or adversarial attack.
Figure 5: Class-wise Mean NNMF Features (Normalized, TEST). This figure shows the mean activation of each NNMF component for normal and tumor classes after feature normalization. Clearly, differences can be noticed via several components, where certain features show continuously, higher activation for tumor samples, while others are more prominent for normal samples. These class-dependent activation patterns indicate that NNMF components capture discriminative characteristics linked to pathological changes, supporting their effectiveness for classification and feature-space defense strategies.
Figure 6: Top-Activated TEST Samples per Component (Using Normalized Xtest: This figure appears to be the most strongly activated test sample for each NNMF component based on normalized feature vectors. For each component, the corresponding image and its activation value are viewed along with the class label. The results detect that some components are often activated by tumour images, while others respond more strongly to normal brain structures. This component-wise association boosts interpretability by directly linking devoid feature dimensions to concrete visual patterns in MRI images
Figure 7: Top-15 Features – AUC. This figure shows the AUC rate of the top rate of NNMF features based on the feature selection operation. Each bar corresponds to a single NNMF component and affects its individual ability to distinguish tumor samples from normal ones. Higher AUC numbers indicate the most powerful discriminative ability, while values closer to 0.5 suggest limited separability. The score proves that several NNMF components show meaningful classification potential at the feature grade.
Figure 8: Effect Size vs Significance. This figure clarifies the relation between effect size and statistical significance for NNMF features. The horizontal axis marks Cohen’s d, where positive values correspond to higher activation in tumor samples and negative values point to higher activation in normal samples. The vertical axis performs the negative logarithm of the p-value gained from Welch’s t-test. Features with large absolute effect sizes and high statistical significance are visually stressed, highlighting components that are both hardly discriminative and statistically trusted.
Figure 9: Top Feature Distributions (Normal vs Tumor) This figure displays boxplot visualizations of the maximum discriminative NNMF features, comparing their normalized distributions between normal and tumor classes. The plots detect visible differences in average and allocation spreads for selected features, providing visual confirmation of their discriminative stand. These distributions supplement the statistical metrics and explain how individual NNMF components react differently to healthy and sick brain structures.
Figure 10: Class Mean Heatmap (Top-15 Features) This figure summarizes the class-wise mean activation of the top rate NNMF features using a heatmap representation. Every column reacts to a selected NNMF component, while rows represent the normal and tumor classes. The color intensity reflects the average feature activation, enabling speedily identification of tumor-dominant and normal-dominant features. The observed style confirms that NNMF components capture class-based structural information and contribute to interpretable feature-level discrimination.
Figure 11: Training Progress – Accuracy This figure shows the evolution of classification accuracy via training. The light curve represents raw mini-boost training accuracy, while the smoothed curve highlights the total way. Validation accuracy (black markers) is measured periodically and close to the training curve, indicating stable learning and limited overfitting. Accuracy climbs sharply during the early iterations and then gradually saturates, proposing convergence of the model when trained on the selected NNMF feature space.
Figure 12: Training Progress – Loss This figure reports the training and validation loss curves over iterations. The training loss reduces steadily, while the validation loss follows a similar downward trend with a slightly higher amount, which is expected. The parallel behaviour of both curves suggests that optimization is forward normally ,and the model generalizes reasonably well. The lack shows a big difference between training and validation loss, indicating that the CNN is not severely overfitting in spite of being trained for multiple epochs.
Figure 13: VAL Confusion Matrix (Acc ≈ 0.83). This confusion matrix abstract model’s performance on the validation set. Correct predictions show on the diagonal, while off-diagonal input corresponds to m wrong classifications. The matrix points a high rate of correctly classified normal and tumor samples, with errors basis occurring when normal images are predicted as tumor and vice versa. The total validation accuracy ( 83% confirms that the selected NNMF features retain meaningful discriminative information and that the classifier is learning a separable decision limit.
Figure 14: TEST Confusion Matrix (Acc ≈ 0.851). This confusion matrix reports final performance on the unseen test set. The majority of samples lie on the diagonal, return an overall accuracy ≈ 0.851. Although this accuracy may seem lower compared to some current approaches, it is substantial to confirm that many reported results are gained under standard (non-adversarial) situation and often depend on complex deep architectures. In contrast, the suggested framework prefer robustness and interpretability in supplement to classification performance. The model run on a compact set of statistically chosen NNMF features and uses a lightweight CNN, which improves generalization and minimize overfitting. Furthermore, under robust adversarial attacks (e.g., AutoAttack), the baseline model display a big drop in performance, while the defended model preserve substantially higher robustness. This demonstrates the effectiveness of the suggested diffusion-based feature purification and highlights the importance of robustness in safety critical implementation such as medical diagnosis. The relatively low number of false positives (normal → tumor) and false negatives (tumor → normal) points to balanced performance across both classes. This result supports the effectiveness of using a compact subset of NNMF features (selected by statistical ranking) as input to a small CNN, achieving robust generalization while reducing dimensionality.
Figure 15: Clean vs diffused NNMF feature vectors at a late diffusion time step (t = 41). The figure shows the impact of forward diffusion noise on selected feature components, view how the original clean features xt,x0 are gradually corrupted to getting noisy features. trusted.
Figure 16: Impact of diffusion time on NNMF features at various timesteps (t = 1, 10, 25, and 50). As the diffusion timestep increases, the injected noise becomes more dominant, leading to higher distortion and variability in the feature representations.
Figure 17: allocation of NNMF feature values before and after diffusion. The histogram comparison highlights the increase in contrast and spread of feature values caused by the diffusion operation, indicating a deviation from the original feature multiple.
Figure 18: Noise energy as a function of diffusion timestep. The plot shows the L2 distance between clean and noisy feature vectors, xt∥2∥x0 , increasing with diffusion time, quantitative confirming the gradually damage introduced by the forward diffusion step. Although the accumulative diffusion table is not explicitly explained, its effect is inherently reflected in the progressive rise of the noise capacity, which confirms how the contribution of the original clean features gradually reduces as the diffusion timestep boosts.
Figure 19: Feature denoising example at diffusion step t=41. The clean feature vector X0, its diffused version xt, and the denoiser output x0ˆ are drawn to explain how the network suppresses diffusion noise and movement, acting closer to the clean features.
Figure 20: Denoising error is lowering relative to the noisy information. Each point contrast the noisy reconstruction error, ∥xt−x0∥2 (x-axis), versus the denoised reconstruction error, ∥x^0−x0∥2 (y-axis). Points lying below the identity streak indicate successful fault decrees after denoising, demonstrating that the denoiser effectively returns features near the original clean representation.
Figure 21: Denoiser reconstruction error versus diffusion time. The plot appears x0∥2∥x^0 as a function of timestep t , highlighting how denoising hard changes with increasing diffusion force.
Figure 22: Clean vs. diffusion-defended NNMF feature vector example on the test set, explain how the refine step alters the feature profile after forward noise and denoising at purt .
Figure 23: a) Confusion matrix on the test set using clean (non-defended) NNMF features, displays class-wise predicate outcomes for normal and tumor. b) Confusion matrix on the test set after implementation of diffusion-based feature refinement (defended features), highlighting changes in misclassification patterns compared to the clean state.
Figure 24: Test accuracy comparison between clean features and diffusion-defended (refine) features, quantifying the net effect of the defense on standard classification accuracy.
Figure 25: Clean and robust accuracy under AutoAttack ( L∞ , ϵ=0.10 ) for the clean model and the suggested diffusion-based defense. The robust accuracy corresponds to the final AutoAttack score (minimum across the evaluated attacks).
Figure 26: Robust accuracy per AutoAttack component (APGD-CE and Square) for the baseline and defended models (L ∞ , ϵ=0.10 ). The final robustness is calculated as the minimum accuracy across attacks.
Figure 27: Accuracy decline under AutoAttack for baseline versus defended models (L ∞ , ϵ =0.10). The diffusion-based defense noticeably reduces the drop from clean to robust performance.
Model
Acc
Prec
Rec
F1
MCC
BalAcc
ROC-AUC
Brier
LogLoss
Clean_Baseline
0.8605
0.8548
0.8983
0.8760
0.7178
0.8564
0.9105
0.1461
0.4751
Clean_Defended
0.8512
0.8525
0.8814
0.8667
0.6988
0.8479
0.8967
0.1555
0.4963
Robust_Baseline
0.0047
0.0000
0.0000
0.0000
-0.9906
0.0052
0.0075
0.4702
1.1629
Robust_Defended
0.5953
0.6115
0.7203
0.6615
0.1703
0.5818
0.7485
0.2150
0.6182
Table 1: Comprehensive Performance Comparison Under Clean and Adversarial Settings
Figure 28: Comparison of classification and probabilistic metrics for baseline and diffusion-based defense under clean and adversarial settings. Higher values indicate better performance except for Brier Score and Log-Loss, where lower values are preferred.
This work presents a robust multi-class classification framework for handwritten digits that combines diffusion-driven feature denoising with a hybrid feature representation. Inspired by our previous work on brain tumor classification, the proposed approach operates in a feature space to improve the robustness to noise and adversarial attacks. This manuscript is submitted as an extended abstract rather than a full-length press-ready paper. First, the input images are converted into tight, interpretable exemplification using Non-negative Matrix Factorization (NNMF). In parallel, special deep features are extracted using a computational neural network (CNN). These integral features are combined into a united hybrid representation. The main objective of this work is to extend our previously validated two-class framework to a multi-class handwritten digit classification scenario. To improve robustness, a step diffusion operation is used in the feature space by gradually adding Gaussian noise. A feature denoiser network is trained to reverse this operation and rebuild clean representations from tilted inputs. The courteous features are then applied for multi-class classification. The suggested method is evaluated in both baseline and adversarial settings using AutoAttack. The experimental outcome present that the diffusion-based hybrid model is both effective and robust, the CNN baseline models outperforming while maintain powerful classification performance. These results explain the activity of feature-level diffusion defense for reliable multi-class handwritten digit classification.
Hiba Adil Al-kharsan, Róbert Rajkó
Doctoral School of Computer Science, University of Szeged, Árpád tér 2, H-6720 Szeged, Hungary · University Research and Innovation Center (EKIK), Óbuda University, Bécsi út 96/b, H-1034 Budapest, Hungary
We study whether deep networks for medical imaging learn useful nonrobust features - predictive input patterns that are not human interpretable and highly susceptible to small adversarial perturbations - and how these features impact test performance. We show that models trained only on nonrobust features achieve well above chance accuracy across five MedMNIST classification tasks, confirming their predictive value in-distribution. Conversely, adversarially trained models that primarily rely on robust features sacrifice in-distribution accuracy but yield markedly better performance under controlled distribution shifts (MedMNIST-C). Overall, nonrobust features boost standard accuracy yet degrade out-of-distribution performance, revealing a practical robustness-accuracy trade-off in medical imaging classification tasks that should be tailored to the requirements of the deployment setting.
Coenraad Mouton, Randle Rabe, Niklas C. Koser +4
Section Biomedical Imaging, Department of Radiology and Neuroradiology, University Hospital Schleswig-Holstein, Kiel University · Faculty of Engineering, North-West University, South Africa
Improving patient outcomes depends on the prompt and accurate diagnosis of brain tumors, but manual MRI scan analysis is still time-consuming and unreliable. Although deep learning has shown promise, many of the models that are now in use are computationally intensive and have difficulty handling the intrinsic complexity and variety of different types of brain tumors. In this work, we propose a lightweight yet high-performing Convolutional Neural Network (CNN) for multi-class brain tumor classification, employing MRI images to target gliomas, meningiomas, pituitary tumors, and healthy (no tumor) instances. The model was rigorously evaluated on two publicly accessible datasets from Figshare and Kaggle. Leveraging efficient feature extraction and optimized training strategies, our CNN achieved classification accuracies of 99.03% and 99.28%, along with ROC scores of 99.88% and 99.94% on Dataset 1 and Dataset 2, respectively-all while utilizing significantly fewer parameters than popular pre-trained architectures. In contrast to cutting-edge models like DenseNet201, MobileNetV2, VGG19, Xception, InceptionV3, and ResNet50, our approach consistently demonstrated superior performance with reduced computational overhead. These findings highlight the potential of the proposed model as a practical and reliable diagnostic aid in clinical environments.
Md Fahimul Kabir Chowdhury, Jannatul Ferdous
Department of Computer Science and Engineering, University of North Texas, USA · Department of Electrical and Electronic Engineering, International Islamic University Chittagong, Bangladesh