Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Localized adversarial artifacts for compressed sensing MRI

Rima Alaifari, Giovanni S. Alberti, Tandri Gauksson

TL;DR

This work investigates how minor perturbations in frequency-domain MRI measurements can cause severe localized artifacts in TV-regularized CS reconstructions, arguing that distortions measured in the $\ell^\infty$-norm are more diagnostically relevant than global $\ell^2$-error. It introduces a localized adversarial attack that uses a disk-shaped weight $\phi^{\mu,\sigma}$ to maximize TV reconstruction artifacts under an $\ell^2$ budget and compares the effect to DNN-based reconstructions, finding that TV reconstructions amplify localized perturbations roughly by the subsampling factor $n^2/m$ while the DNNs show milder artifacts with limited transferability. A mathematical explanation based on exact recovery guarantees for sparse signals clarifies why small perturbations can produce spikes in TV reconstructions, linking the forward operator’s kernel to the observed vulnerabilities. The results highlight inherent vulnerabilities of CS-MRI methods to localized artifacts and inform the development of robust benchmarks and defense strategies for MRI reconstruction methods.

Abstract

As interest in deep neural networks (DNNs) for image reconstruction tasks grows, their reliability has been called into question (Antun et al., 2020; Gottschling et al., 2020). However, recent work has shown that, compared to total variation (TV) minimization, when appropriately regularized, DNNs show similar robustness to adversarial noise in terms of $\ell^2$-reconstruction error (Genzel et al., 2022). We consider a different notion of robustness, using the $\ell^\infty$-norm, and argue that localized reconstruction artifacts are a more relevant defect than the $\ell^2$-error. We create adversarial perturbations to undersampled magnetic resonance imaging measurements (in the frequency domain) which induce severe localized artifacts in the TV-regularized reconstruction. Notably, the same attack method is not as effective against DNN based reconstruction. Finally, we show that this phenomenon is inherent to reconstruction methods for which exact recovery can be guaranteed, as with compressed sensing reconstructions with $\ell^1$- or TV-minimization.

Localized adversarial artifacts for compressed sensing MRI

TL;DR

This work investigates how minor perturbations in frequency-domain MRI measurements can cause severe localized artifacts in TV-regularized CS reconstructions, arguing that distortions measured in the -norm are more diagnostically relevant than global -error. It introduces a localized adversarial attack that uses a disk-shaped weight to maximize TV reconstruction artifacts under an budget and compares the effect to DNN-based reconstructions, finding that TV reconstructions amplify localized perturbations roughly by the subsampling factor while the DNNs show milder artifacts with limited transferability. A mathematical explanation based on exact recovery guarantees for sparse signals clarifies why small perturbations can produce spikes in TV reconstructions, linking the forward operator’s kernel to the observed vulnerabilities. The results highlight inherent vulnerabilities of CS-MRI methods to localized artifacts and inform the development of robust benchmarks and defense strategies for MRI reconstruction methods.

Abstract

As interest in deep neural networks (DNNs) for image reconstruction tasks grows, their reliability has been called into question (Antun et al., 2020; Gottschling et al., 2020). However, recent work has shown that, compared to total variation (TV) minimization, when appropriately regularized, DNNs show similar robustness to adversarial noise in terms of -reconstruction error (Genzel et al., 2022). We consider a different notion of robustness, using the -norm, and argue that localized reconstruction artifacts are a more relevant defect than the -error. We create adversarial perturbations to undersampled magnetic resonance imaging measurements (in the frequency domain) which induce severe localized artifacts in the TV-regularized reconstruction. Notably, the same attack method is not as effective against DNN based reconstruction. Finally, we show that this phenomenon is inherent to reconstruction methods for which exact recovery can be guaranteed, as with compressed sensing reconstructions with - or TV-minimization.
Paper Structure (7 sections, 2 theorems, 23 equations, 7 figures, 1 table)

This paper contains 7 sections, 2 theorems, 23 equations, 7 figures, 1 table.

Table of Contents

  1. Introduction
  2. Compressed sensing MRI
  3. DNNs as an alternative to CS
  4. Adversarial perturbations
  5. Visualizing perturbations
  6. Results
  7. Explaining localized artifacts

Key Result

Theorem 5.1

Let $x\in\mathbb{C}^n$ be $s$-sparse, let $\varepsilon>0$, and suppose that the indices of $\Omega_n$ are chosen uniformly at random from $\{-n/2+1, \ldots, n/2\}$. Then there exists a constant $C>0$ such that if $m_n \geq Cs\log(n)\log(\varepsilon^{-1})$, then $x$ is the unique solution to with probability at least $1-\varepsilon$.

Figures (7)

  • Figure 1: The same image corrupted by two different perturbations of equal $\ell^2$-norm ($10\%$ of the norm of the original image): Gaussian noise (left) and a potentially meaningful feature (right). The goal of this work is to find small adversarial perturbations to MRI measurements such that artifacts in the spirit of the latter appear in the reconstruction process.
  • Figure 2: Left: The sampling mask $\Omega$ used in the experiments, comprising 40 lines through the origin. The retained frequencies are shown in black. Middle: An example image $x$. Right: A low quality linear reconstruction, using the pseudoinverse of the measurement matrix ${\mathcal{A}}^\dagger\mathcal{A} x$.
  • Figure 3: Left: The original image. Middle: A perturbed image at 4% relative noise. A close-up of the selected location, $\mu$, shows that the image perturbation, $r={\mathcal{A}}^\dagger e$, introduces a spike. Right: The TV-reconstruction of the perturbed measurements. The spike is greatly amplified. Note that pixel values from 0 to 1 are shown in grayscale, while values beyond 1 are shown in red (the colorbar on the right is not linear).
  • Figure 4: Adversarial attacks at 0.5%, 1%, 4%, and 8% relative noise. Upper row: the original image with the image perturbation added. Lower row: TV-regularized reconstruction of the perturbed measurements. The reconstruction artifact $\rho$ is consistently much larger than the perturbation $r$ in the $\ell^\infty$-norm.
  • Figure 5: Analogous to Figure \ref{['fig:simple_signal_nr4p']}, with the reconstruction method $\mathrm{rec}_{\mathrm{TV}}$ replaced by the DNN $\mathrm{Tira}$. Here, the amplification factor is $\alpha = 2.13$.
  • ...and 2 more figures

Theorems & Definitions (3)

  • Theorem 5.1: candes2011probabilistic as stated in foucart2013invitation
  • Theorem 5.2
  • proof