Adversarial Attacks On a Regression Based Deep Registration Network
F Li*, W Cai, X He, J Moran, L Cervino, T Li, X Li, Memorial Sloan Kettering Cancer Center, New York, NY
Presentations
SU-F-BRB-1 (Sunday, 7/10/2022) 2:00 PM - 3:00 PM [Eastern Time (GMT-4)]
Ballroom B
Purpose: Deep learning models are susceptible to adversarial attacks where misclassification occurs after negligible noises added to an image. This study investigates if similar attacks also exist in a regression-based network for image registration.
Methods: A regression-based deep network was trained for 2D rigid registration. Following popular architecture, the network takes a pair of fixed and moving images as input, and is based on features extraction using convolutional backbones (ResNet) followed by a subsequent network that regresses for the registration parameters. We trained and tested two versions of this architecture, one over an in-house Xray image dataset (2,478 images), and the other over PASCAL Visual Object Classification (VOC) dataset (22,471 images). Both networks were trained with affine augmentation, random Gaussian noise, and drop out till reasonable registration accuracies were achieved. The Fast Gradient Sign method was then applied to search for adversarial examples.
Results: The registration passing rate (2mm tolerance for Xray and 5 pixels for natural images) was calculated as a function of epsilon representing the relative magnitude of the adversarial noises. For the in-house Xray dataset, we observed a fast deterioration of registration performance as epsilon increases -- dropping from 97% to 20% as epsilon approaches 0.1. For the larger VOC dataset, this rate of change is slower. Nevertheless, in both cases, we found abundant examples where a few percentages of injected noise change the registration results abruptly, even though the altered images look the same to human observers.
Conclusion: Deep registration networks, at least the ones examined in this experiment, can be vulnerable to adversarial attacks, suggesting they may not have learned high level features required for reliable registration. Our findings demonstrate the importance of quality assurance of AI algorithms for image registration and thorough investigation causes which degrade the performance.
Keywords
Taxonomy
IM/TH- Image Registration: General (Most aspects)
Contact Email