On the role of deep learning model complexity in adversarial robustness for medical images

• Published in: BMC medical informatics and decision making Vol. 22; no. Suppl 2; pp. 1 - 160
• Main Authors: Rodriguez, David, Nayak, Tapsya, Chen, Yidong, Krishnan, Ram, Huang, Yufei
• Format: Journal Article
• Language: English
• Published: London BioMed Central Ltd 20.06.2022; BioMed Central; BMC
• Subjects: Accuracy; Adversarial attacks; Adversarial robustness; Algorithms; Classification; Complexity; Datasets; Deep learning; Diagnostic imaging; Electronic health records; Evaluation; Health informatics; Image classification; Machine learning; Medical equipment; Medical image classification; Medical imaging; Methods; Model complexity; Perturbation; Robustness; Tumors; United States
• ISSN: 1472-6947; 1472-6947
• DOI: 10.1186/s12911-022-01891-w

Abstract Background Deep learning (DL) models are highly vulnerable to adversarial attacks for medical image classification. An adversary could modify the input data in imperceptible ways such that a model could be tricked to predict, say, an image that actually exhibits malignant tumor to a prediction that it is benign. However, adversarial robustness of DL models for medical images is not adequately studied. DL in medicine is inundated with models of various complexity—particularly, very large models. In this work, we investigate the role of model complexity in adversarial settings. Results Consider a set of DL models that exhibit similar performances for a given task. These models are trained in the usual manner but are not trained to defend against adversarial attacks. We demonstrate that, among those models, simpler models of reduced complexity show a greater level of robustness against adversarial attacks than larger models that often tend to be used in medical applications. On the other hand, we also show that once those models undergo adversarial training, the adversarial trained medical image DL models exhibit a greater degree of robustness than the standard trained models for all model complexities. Conclusion The above result has a significant practical relevance. When medical practitioners lack the expertise or resources to defend against adversarial attacks, we recommend that they select the smallest of the models that exhibit adequate performance. Such a model would be naturally more robust to adversarial attacks than the larger models.