cs.CVOct 11, 2026

Robust Detection of Directional Adversarial Attacks in Deep Neural Networks for Radiological Imaging

Authors: Tristan Malatyński, Joanna Jaworek-Korjakowska

Organizations: AGH University of Kraków, Poland Center of Excellence in Artificial Intelligence

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Deep learning is now central to radiology, helping detect changes on X-rays, CTs, and MRIs. However, these systems are highly vulnerable to adversarial attacks - small, crafted perturbations that mislead models while appearing unchanged to humans. Such errors risk missed cancers or false positives. Studies show over 90% attack success on medical scans. Almost 30% of US hospitals use AI in imaging in 2023. Thus, an effective method of detecting such attacks and their directionality is crucial to ensure the credibility and reliability of medical systems based on DNNs. We propose a novel detection framework that leverages subsequent attacks using random noise to identify adversarial perturbations. Our approach uses the analysis of variations in the Sigmoid function to distinguish genuine medical images from adversarially manipulated ones. Specifically, we compare prediction differences between clean and attacked images, as well as between different adversarially altered versions, to improve detection accuracy. We evaluated our method on three popular medical datasets including 'Chest X-Ray Images for Classification', 'Retinal Fundus Multi-disease Image Dataset' and 'Brain Tumor Dataset' under various attack scenarios, including random noise. Our framework achieved up to 99.8% ACC in identifying adversarial directional attacks, significantly outperforming existing defense mechanisms. It consistently identified adversarial samples across varying attack strengths while keeping false positives low, showing strong reliability and potential for clinical use. Furthermore, our proposal highlights its potential for real-world deployment.

Figures & tables

Figure 1: Visualization of the evasion adversarial attack process.
Figure 2: Visualization of image perturbations: a) original Chest X-ray image, b) adversarial noise, c) The original image combined with the perturbation, demonstrating no visible differences.
Figure 3: Overview of the adversarial detection framework. (1) Clean images are processed, and random noise is added to generate noisy images. (2) Adversarial attacks are applied to the clean data and random noise is added to generate noisy adversarial dataset. (3) A deep learning model trained and evaluated on clean dataset, make predictions for all created datasets, and then prediction differences and interpretability metrics are analyzed to assess detection of adversarial attacks.
Figure 4: Comparison of the action of Gaussian noise with a power of 0.03 on clean image resulting in noisy clean image, and also on perturbation from 0.01 FGSM attack resulting in noisy perturbation from FGSM attack. All noises were multiplied by 30 to make it more visible.
Pretrained modelChest X-RayTumor MRIRetinal fundus
ResNet50V20.94 | 0.94 | 0.990.99 | 0.99 | 1.000.91 | 0.91 | 0.95
InceptionV30.92 | 0.92 | 0.990.99 | 0.99 | 1.000.90 | 0.90 | 0.95
ViT-B160.91 | 0.91 | 0.970.99 | 0.99 | 1.000.89 | 0.89 | 0.96
Table 1: Accuracy | Recall | AUC of the prepared models
 ResNet50V2InceptionV3ViT-B16 
AttackChest X-RayBrain MRIFundusChest X-RayBrain MRIFundusChest X-RayBrain MRIFundusMEAN
FGSM98.8 | 3.295.2 | 3.081.7 | 4.695.7 | 5.297.9 | 2.694.2 | 3.694.6 | 4.690.2 | 2.289.5 | 2.393.1 | 3.5
BIM99.3 | 2.998.3 | 2.096.3 | 4.795.8 | 4.098.7 | 1.993.7 | 3.690.5 | 4.493.4 | 2.390.0 | 2.295.1 | 3.1
PGD99.3 | 2.998.3 | 2.897.7 | 4.496.7 | 3.598.8 | 1.794.4 | 4.590.8 | 3.994.6 | 2.590.0 | 2.095.6 | 3.1
DF98.8 | 1.099.8 | 1.196.2 | 3.597.0 | 2.096.8 | 0.992.6 | 5.992.9 | 3.298.3 | 1.986.5 | 2.895.4 | 2.5
MEAN99.1 | 2.597.9 | 2.293.0 | 4.396.3 | 3.798.1 | 1.893.7 | 4.492.2 | 4.094.1 | 2.289.0 | 2.394.8 | 3.0
Table 2: Detection results represented as True Positive [%] | False Positive [%] for attacked and clean images across datasets and models for the best epsilon of random noise 3 and standard threshold θ=2⋅std(t)\theta=2\cdot\mathrm{std}(t) .
Figure 5: Bubble Plot of difference in prediction after adding random noise for InceptionV3-based model trained on Brain Tumor dataset for BIM attack. Radius of bubble represents number of samples with the same prediction difference.
Figure 6: Impact of noise and adversarial attacks on Sigmoid performance: a) the original image, b) the image with 0.03 Gaussian noise, c) the adversarially attacked original image, and d) the adversarially attacked image with 0.03 Gaussian noise. Below the images, the Sigmoid function outputs illustrate how noise and adversarial attacks affect the model’s confidence in its predictions. Image class: 0 – healthy, 1 – diseased.
ϵ\epsilonChest X-RayTumor MRIRetinal fundus
ResNet50V20.050.050.03
InceptionV30.050.030.02
ViT-B160.050.030.02
Table 3: The best random noise epsilons for each models.
Figure 7: Visualization of adversarial impact on model interpretation: a) Original clean Chest X-ray image, b) Heatmap of the clean image, highlighting the model’s focus, c) Heatmap of the adversarially attacked image, showing shifts in attention.
Figure 8: Effect of adversarial attacks on a noise-perturbed image: a) Chest X-ray image with randomly added noise, b) Heatmap of the noisy image, showing the model’s attention, c) Heatmap of the adversarially attacked noisy image, illustrating how the attack influenced the model’s focus.
 Detected Images (Avg.)Total CasesDetected Images [%]
 AttackedClean Attacked [%]Clean [%]
a)420.47.942998.0%1.8%
b)468.411,448197.4%2.4%
c)507.514.952995.9%2.8%
d)522.416.955793.8%3.0%
e)537.218.562486.1%3.0%
Table 4: Detection results for attacked and clean images for ResNet-based model trained for Chest X-ray dataset including cases of failed attacks but considering only cases where the difference between the prediction of original image and its correct class was less than: (a) 0.20.2 ; (b) 0.30.3 ; (c) 0.40.4 ; (d) 0.50.5 ; (e) 1.01.0 .

Explore similar work

CardsList

  1. Beyond Attack Success Rate: A Multi-Metric Evaluation of Adversarial Transferability in Medical Imaging Models

    Apr 16, 2026Emily Curl, Kofi Ampomah, Md Erfan +1Adversarial RobustnessMedical Image Classification

    The authors are with The University of Alabama, Tuscaloosa, USA.

  2. Diffusion-Based Feature Denoising and Using NNMF for Robust Brain Tumor Classification

    Mar 13, 2026Hiba Adil Al-kharsan, Róbert RajkóMedical Image ClassificationBrain Tumor Classification

    Doctoral School of Computer Science, University of Szeged, Árpád tér 2, H-6720 Szeged, Hungary · University Research and Innovation Center (EKIK), Óbuda University, Bécsi út 96/b, H-1034 Budapest, Hungary · Academic Staff, Doctoral School of Computer Science, University of Szeged, Árpád tér 2, H-6720 Szeged, Hungary

  3. Text-Guided Diffusion-Based Adversarial Attacks on Chest X-Ray Images

    Aug 29, 2026Basudha Pal, Arjun Narayanan, Neha Ajith +2Adversarial AttacksChest X-Ray Classification

    Department of Electrical and Computer Engineering, The Johns Hopkins University, Baltimore, 21218, MD, USA · Manipal Institute of Technology, Manipal Academy of Higher Education, Manipal, 576104, Karnataka, India · The Russell H. Morgan Department of Radiology and Radiological Sciences, The Johns Hopkins Hospital, Baltimore, 21287, MD, USA +1