Deep neural networks (DNNs) are vulnerable to adversarial noises. By adding adversarial noises to training samples, adversarial training can improve the model's robustness against adversarial noises. However, adversarial training samples with excessive noises can harm standard accuracy, which may be unacceptable for many medical image analysis applications. This issue has been termed the trade-off between standard accuracy and adversarial robustness. In this paper, we hypothesize that this issue may be alleviated if the adversarial samples for training are placed right on the decision boundaries. Based on this hypothesis, we design an adaptive adversarial training method, named IMA. For each individual training sample, IMA makes a sample-wise estimation of the upper bound of the adversarial perturbation. In the training process, each of the sample-wise adversarial perturbations is gradually increased to match the margin. Once an equilibrium state is reached, the adversarial perturbations will stop increasing. IMA is evaluated on publicly available datasets under two popular adversarial attacks, PGD and IFGSM. The results show that: (1) IMA significantly improves adversarial robustness of DNN classifiers, which achieves state-of-the-art performance; (2) IMA has a minimal reduction in clean accuracy among all competing defense methods; (3) IMA can be applied to pretrained models to reduce time cost; (4) IMA can be applied to the state-of-the-art medical image segmentation networks, with outstanding performance. We hope our work may help to lift the trade-off between adversarial robustness and clean accuracy and facilitate the development of robust applications in the medical field. The source code will be released when this paper is published.
翻译:深神经网络( DNNS) 容易受到对抗性噪音的影响。 通过在培训样本中添加对抗性噪音, 对抗性培训可以提高模型对对抗性噪音的稳健性能。 但是, 过度噪音的对抗性培训样本可能会损害标准准确性, 这对于许多医学图像分析应用来说可能无法接受。 这个问题被称为标准准确性和对抗性强力之间的权衡。 在本文中, 我们假设, 如果用于培训的对抗性样本恰好放在决定界限上, 这个问题可能会有所缓解。 基于这一假设, 我们设计了适应性对抗性对抗性培训方法, 名为IMA。 对于每个单独的培训样本,IMA会对对抗性扰动性扰动的上限值进行抽样性估计。 在培训过程中, 每一个样本性对抗争性干扰性干扰的权衡性能都会逐渐提高。 一旦达到平衡状态, 对抗性扰动性干扰性冲击力将停止增加。 IMA 在两种流行的对抗性攻击( PGD) 和 IGSM 之间对公开的数据集进行评估。 结果显示: (1) IMA 大幅改进敌对性应用了对敌对性应用的准确性应用性网络的准确性; 将提高性工作绩效; 在DNMA 进行中, 清洁性研究中, 将可以降低性评估性研究中, 能够 降低 降低 降低 降低 降低 降低 降低 降低 降低 降低 降低 降低 降低性 降低性 降低 降低 降低 降低性 降低性 降低性 降低性 降低性 降低性 降低性 降低性 降低性 降低性 降低性 降低性 降低性 降低性 降低性 降低性 降低性 降低性 降低 降低 降低 降低性 降低性 降低性 降低 降低 降低性 降低性 降低性 降低性 降低性 降低性 降低性 降低性 降低性 性 降低性