PaperlayerView exact revision on arXiv

Source-linked AI summary

Addressing Adversarial Machine Learning Attacks in Smart Healthcare Perspectives

Arawinkumaar Selvakkumar, Shantanu Pal, Zahra Jadidi

arXiv:2112.08862v1cs.DCcs.CR

TL;DR

Smart-healthcare classifiers face adversarial inputs that can distort medical-image predictions and risk incorrect disease detection and treatment plans. The paper applies FGSM to a transfer-learned VGG-19/CNN on medical images; accuracy falls from 88% before attack to 11% after.

  • Problem

    Adversarial attacks can mislead smart-healthcare classifiers, making inaccurate medical-image predictions that may lead to false disease detection and wrong treatment plans.

    Source: §I · p. 1

  • Method

    The paper uses transfer learning to train VGG-19 on medical images and applies a white-box FGSM attack to a CNN to examine classifier impact.

    Source: §I · pp. 1–2, 3) Transfer Learning using VGG-19 · p. 3

  • Results

    Accuracy fell from 88% before the attack to 11% after the model was tricked by adversarial inputs.

    Source: §V · p. 6

  • Takeaways & Limitations

    The evaluation shows that FGSM can mislead a medical-image CNN, illustrating a vulnerability relevant to smart-healthcare disease predictions.

    Source: §I · p. 1, §V · p. 6

    The study uses a relatively small dataset and implements only one adversarial attack.

    Source: §V · p. 6

Abstract

from arXiv · show

Smart healthcare systems are gaining popularity with the rapid development of intelligent sensors, the Internet of Things (IoT) applications and services, and wireless communications. However, at the same time, several vulnerabilities and adversarial attacks make it challenging for a safe and secure smart healthcare system from a security point of view. Machine learning has been used widely to develop suitable models to predict and mitigate attacks. Still, the attacks could trick the machine learning models and misclassify outputs generated by the model. As a result, it leads to incorrect decisions, for example, false disease detection and wrong treatment plans for patients. In this paper, we address the type of adversarial attacks and their impact on smart healthcare systems. We propose a model to examine how adversarial attacks impact machine learning classifiers. To test the model, we use a medical image dataset. Our model can classify medical images with high accuracy. We then attacked the model with a Fast Gradient Sign Method attack (FGSM) to cause the model to predict the images and misclassify them inaccurately. Using transfer learning, we train a VGG-19 model with the medical dataset and later implement the FGSM to the Convolutional Neural Network (CNN) to examine the significant impact it causes on the performance and accuracy of the machine learning model. Our results demonstrate that the adversarial attack misclassifies the images, causing the model's accuracy rate to drop from 88% to 11%.

I. INTRODUCTION

Smart-healthcare classifiers face adversarial attacks that can corrupt predictions and risk false diagnoses. The paper examines FGSM’s impact on CNN classifiers and proposes detecting attacks across training and testing.

  • Adversarial attacks can trick machine-learning classifiers, causing inaccurate medical-image predictions and potentially false diagnoses or wrong treatment plans.Source: §I · p. 1
  • Prior proposals address healthcare security and model vulnerabilities, but the authors identify limited discussion of attack impact on classifiers and CNN implementation.Source: §I · p. 1
  • The proposed method examines FGSM’s impact on classifier performance and frames attack detection across training and testing phases.Source: §I · p. 1
  • The paper uses a medical-image dataset to train a VGG-19 model and applies a white-box FGSM attack to a CNN.Source: §I · pp. 1–2

II. RELATED WORK

Related work covers adversarial attacks, model robustness, and healthcare applications, while the authors emphasize a gap in actual CNN attack implementation.

  • Proposal examines five attack algorithms using device-generated data without a CNN, while studies adversarial training with J48 and Random Forest models in cybersecurity.Source: §II · p. 2
  • Proposal [21] surveys attacks using MNIST and CIFAR10, covers theory and defenses without implementation detail, and [23] and [24] discuss FGSM or training without CNNs.Source: §II · p. 2
  • Proposal takes a smart-healthcare perspective but omits FGSM and CNN, whereas and lack a custom dataset and healthcare focus; this paper implements FGSM on a CNN with medical data.Source: §II · p. 2

III. MODEL AND METHODS

The experiment has two parts: train a VGG-19 model on medical images, then attack the trained model with FGSM to examine the impact.

  • The method separates the experiment into model training in Part 1 and attack generation and implementation in Part 2.Source: §III · p. 2
  • Part 1 trains a VGG-19 model using the medical dataset of benign and malignant skin-cancer moles.Source: §III · p. 2
  • Part 2 applies an FGSM attack to the trained model to examine its impact.Source: §III · p. 2

A. Experimental Setup

The experiment uses a randomly selected skin-cancer image sample, prepares it through resizing, encoding, splitting, and augmentation, and evaluates a VGG-19-based workflow.

A. Experimental Setup

  • Training and evaluation used a Windows 10 laptop, Google Colab, TensorFlow 2.3.0, and Keras 2.4.3.The laptop had an Intel Core i7-1065G7 processor and 16GB of RAM.Source: A. Experimental Setup · pp. 2–3

1) Dataset:

  • The ISIC Archive dataset contains 3,297 benign and malignant skin-mole images; 500 images were randomly selected for the experiment.The images were 224×224 JPGs, and the dataset was last updated on 20-06-2019.Source: 1) Dataset · p. 3

2) Preparing the Dataset:

  • Images were resized to 224×224, one-hot encoded, split into 70% training and 30% testing sets, and augmented with rotations up to 15 degrees.Stratified sampling was used for the train-test split.Source: 2) Preparing the Dataset · p. 3

3) Transfer Learning using VGG-19:

The authors use transfer learning with a pre-trained VGG-19 model for benign and malignant image classification, adding new trainable layers above frozen base layers. They train the resulting model for 15 epochs to assess its accuracy before the attack.

3) Transfer Learning using VGG-19:

  • VGG-19’s pre-trained base was frozen and followed by new trainable layers, adapting its existing image features to the skin-cancer dataset.The base used ImageNet weights, and the three fully connected layers at its top were excluded.Source: 3) Transfer Learning using VGG-19 · p. 3
  • The model added dense layers of 128 and 64 units with ReLU activation, followed by a two-unit softmax layer, with dropout set to 0.25.The model had 23 million parameters: 3 million trainable and 20 million non-trainable.Source: 3) Transfer Learning using VGG-19 · p. 3

4) Train the Model:

  • Training used a learning rate of 0.0001, 15 epochs, batches of 32, Adam optimization, categorical crossentropy, and accuracy as the metric.The authors used accuracy to judge whether the model was ready for the subsequent attack.Source: 4) Train the Model · p. 3

C. Part 2 – Implementing FGSM Attack to the Trained CNN

Part 2 generates an adversarial image and applies it to the trained CNN. The authors evaluate the attacked model after classification.

C. Part 2 – Implementing FGSM Attack to the Trained CNN

  • Part 2 applies an adversarial attack to the VGG-19 model trained in Part 1 on benign and malignant skin-cancer images.The section focuses on generating the attack and implementing it on the trained system.Source: C. Part 2 – Implementing FGSM Attack… · p. 3

1) Generating Image Adversary:

  • The adversary is constructed by adding the loss-gradient sign to the input image; Fig. 1 compares an original sample with its adversarial version.The process predicts on the input, computes loss and its gradient, then takes the gradient’s sign.Source: 1) Generating Image Adversary · p. 4, Figure 1 · p. 4
  • After creating the adversarial image, the authors send it to the trained model for classification and report the post-attack evaluation in Section IV.Source: 1) Generating Image Adversary · p. 4

IV. RESULTS AND DISCUSSION

The Part 1 classifier showed strong class-level results on the test data, with benign true-positive and malignant true-negative rates of 90% and 87%, respectively. Training loss fell and accuracy rose with more epochs, while the authors note a risk of overfitting.

IV. RESULTS AND DISCUSSION

  • The results discussion covers both method parts and previews performance comparisons and defensive strategies, but the supplied results here detail Part 1.Source: §IV · p. 4

A. Results: Part 1 of Methods

  • Benign and malignant images had F1-scores of 89% and 88%, respectively, with precision of 87% and 90% and recall of 90% and 87%.Support was 150 images for each class.Source: A. Results: Part 1 of Methods · p. 4
  • As epochs increased, training and validation losses fell while training and validation accuracies rose; the authors also warn of overfitting risk.Fig. 2 plots epochs or iterations on the x-axis and loss or accuracy percentages on the y-axis.Source: A. Results: Part 1 of Methods · p. 4, Figure 2 · p. 4
  • The model’s true positive rate for benign images was 90% (135 images), with a 10% false positive rate (15 images); for malignant images, its true negative rate was 87% (130 images), with a 13% false negative rate (20 images).Source: A. Results: Part 1 of Methods · p. 5

B. Results: Part 2 of Methods

The Part 2 confusion matrix shows that FGSM severely misclassified images, reducing correct classifications for both benign and malignant cases.

B. Results: Part 2 of Methods

  • The FGSM-attacked Part 2 model’s confusion matrix shows substantial misclassification compared with Part 1.The authors report that the attack significantly affected the trained model’s performance and accuracy.Source: B. Results: Part 2 of Methods · p. 5
  • 10% of benign images were true positives (15 images), while 90% were false positives (135 images).Source: B. Results: Part 2 of Methods · p. 5
  • For malignant images, the false negative rate was 88% (132 images), and the true negative rate was 12% (18 images).Source: B. Results: Part 2 of Methods · p. 5

C. Model Accuracy in Part 1 and Part 2 of Methods

The reported accuracy fell sharply after the FGSM attack, and the authors warn that resulting misclassification could disrupt healthcare decisions.

C. Model Accuracy in Part 1 and Part 2 of Methods

D. Performance Comparison

The comparison distinguishes this study’s FGSM attack on a CNN from prior work using other attacks or classifiers; it also identifies adversarial training and randomisation as testing-stage defenses.

D. Performance Comparison

  • Unlike, which used Random Forest and J48 models with Jacobian-based Saliency Map attacks, this study uses FGSM and evaluates accuracy rather than F1-score.Source: D. Performance Comparison · p. 5
  • Prior work [39] assessed black-box attacks across classification and segmentation, while this study focuses on FGSM; examined supervised models on adversarial samples.Source: D. Performance Comparison · pp. 5–6

E. Defensive Strategies

  • Adversarial training and randomisation are presented as testing-stage defenses, with adversarial training identified as future work for this research.The cited evaluation [24] reported low error rates after training with adversarial inputs.Source: E. Defensive Strategies · p. 6

V. CONCLUSION AND FUTURE WORK

The paper concludes that FGSM can mislead CNNs, with accuracy dropping from 88% to 11%. The authors describe a proof of concept and identify broader deployment and defenses as future directions.

V. CONCLUSION AND FUTURE WORK

  • Model accuracy fell from 88% before the attack to 11% after it, and the authors conclude that FGSM can mislead CNNs into misclassifying outputs.Source: §V · p. 6
  • The experiment could be extended to manufacturing, retail, and social-media applications, and image-focused work could be extended to video recognition.Source: §V · p. 6
  • The authors describe the work as a proof of concept and identify the relatively small dataset and use of only one attack as limitations.Source: §V · p. 6
  • Large-scale deployment, defensive approaches such as adversarial training, and detecting or preventing attack impacts are left for future research.Source: §V · p. 6
Loading 2112.08862v1…