论文标题
错过了重点：针对多个地标检测的针对对抗性攻击
Miss the Point: Targeted Adversarial Attack on Multiple Landmark Detection
论文作者
论文摘要
基于深度卷积神经网络（CNN）的多个地标检测中的最新方法达到了高准确性并改善了传统的临床工作流程。但是，可以轻松利用CNN对对抗性示例攻击的脆弱性，以打破分类和分割任务。本文是第一个研究有关对抗性扰动的多个地标检测的基于CNN的模型的脆弱模型。具体而言，我们提出了一种新型的自适应靶向迭代FGSM（ATI-FGSM）对多个地标检测中最先进模型的攻击。攻击者可以使用ATI-FGSM精确地控制任意选择地标的模型预测，同时通过在原始图像中添加不可察觉的扰动，同时保持其他固定地标。对头标的地标检测的公共数据集进行了全面的评估表明，与原始的迭代FGSM攻击相比，ATI-FGSM生成的对抗性示例更有效，有效地打破了基于CNN的网络。我们的工作揭示了对患者健康的严重威胁。此外，我们通过研究附近地标的耦合效应，即我们实验中的主要分歧来源，讨论我们方法的局限性并提供潜在的防御方向。我们的源代码可在https://github.com/qsyao/attack_landmark_detection上找到。
Recent methods in multiple landmark detection based on deep convolutional neural networks (CNNs) reach high accuracy and improve traditional clinical workflow. However, the vulnerability of CNNs to adversarial-example attacks can be easily exploited to break classification and segmentation tasks. This paper is the first to study how fragile a CNN-based model on multiple landmark detection to adversarial perturbations. Specifically, we propose a novel Adaptive Targeted Iterative FGSM (ATI-FGSM) attack against the state-of-the-art models in multiple landmark detection. The attacker can use ATI-FGSM to precisely control the model predictions of arbitrarily selected landmarks, while keeping other stationary landmarks still, by adding imperceptible perturbations to the original image. A comprehensive evaluation on a public dataset for cephalometric landmark detection demonstrates that the adversarial examples generated by ATI-FGSM break the CNN-based network more effectively and efficiently, compared with the original Iterative FGSM attack. Our work reveals serious threats to patients' health. Furthermore, we discuss the limitations of our method and provide potential defense directions, by investigating the coupling effect of nearby landmarks, i.e., a major source of divergence in our experiments. Our source code is available at https://github.com/qsyao/attack_landmark_detection.
