Deep neural networks (DNNs) have been broadly adopted in health risk prediction to provide healthcare diagnoses and treatments. To evaluate their robustness, existing research conducts adversarial attacks in the white/gray-box setting where model parameters are accessible. However, a more realistic black-box adversarial attack is ignored even though most real-world models are trained with private data and released as black-box services on the cloud. To fill this gap, we propose the first black-box adversarial attack method against health risk prediction models named MedAttacker to investigate their vulnerability. MedAttacker addresses the challenges brought by EHR data via two steps: hierarchical position selection which selects the attacked positions in a reinforcement learning (RL) framework and substitute selection which identifies substitute with a score-based principle. Particularly, by considering the temporal context inside EHRs, it initializes its RL position selection policy by using the contribution score of each visit and the saliency score of each code, which can be well integrated with the deterministic substitute selection process decided by the score changes. In experiments, MedAttacker consistently achieves the highest average success rate and even outperforms a recent white-box EHR adversarial attack technique in certain cases when attacking three advanced health risk prediction models in the black-box setting across multiple real-world datasets. In addition, based on the experiment results we include a discussion on defending EHR adversarial attacks.
翻译:在健康风险预测中广泛采用了深度神经网络(DNNs),以提供医疗诊断和治疗。为了评估其稳健性,现有研究在可以使用模型参数的白色/灰盒设置中进行对抗性攻击。然而,尽管大多数现实世界模型都经过私人数据培训,并作为云层黑盒服务发布,但更现实的黑盒对抗性攻击却被忽视。为了填补这一空白,我们提议了第一个名为MedATATAcker的针对健康风险预测模型的黑盒对抗性攻击方法,以调查其脆弱性。MedAttecker通过两个步骤应对EHR数据带来的挑战:在强化学习(RL)框架内选择攻击位置的等级选择,在选择攻击位置时选择以强化学习(RL)框架选择受攻击的位置,替代选择确定以得分原则为基础的替代。特别是,通过考虑EHR内部的时间背景,它开始其RL位置选择政策,利用每次访问的评分和每项代码的突出分,这可以与分变化后决定的确定性替代选择过程。在实验中,MDATHR一贯地在加强在强化学习中达到最高的平均成功率率率,在攻击率的情况下,甚至将一个基于电子攻击风险的高级试验箱中,我们攻击后在三个试验中选择了一种电子攻击试验中选择。