Evaluating Adversarial Robustness of Low dose CT Recovery

TL;DR

This paper addresses robustness of low-dose CT recovery to adversarial perturbations under challenging ill-posed conditions. It compares classical reconstruction methods and deep-learning approaches, including unrolled optimization networks, under untargeted, universal, and localized perturbations defined with the $L_ ^infty$ bound $\epsilon$. Key findings show deep-learning methods are more vulnerable to untargeted perturbations, while data-consistency often persists; localized perturbations can alter clinically relevant regions with minimal noise, and universal perturbations transfer across methods. The work highlights the need for stronger regularization or adversarial training to ensure clinical reliability and shows the potential for attackers to explore multiple diagnostically plausible reconstructions.

Abstract

Low dose computed tomography (CT) acquisition using reduced radiation or sparse angle measurements is recommended to decrease the harmful effects of X-ray radiation. Recent works successfully apply deep networks to the problem of low dose CT recovery on bench-mark datasets. However, their robustness needs a thorough evaluation before use in clinical settings. In this work, we evaluate the robustness of different deep learning approaches and classical methods for CT recovery. We show that deep networks, including model-based networks encouraging data consistency, are more susceptible to untargeted attacks. Surprisingly, we observe that data consistency is not heavily affected even for these poor quality reconstructions, motivating the need for better regularization for the networks. We demonstrate the feasibility of universal attacks and study attack transferability across different methods. We analyze robustness to attacks causing localized changes in clinically relevant regions. Both classical approaches and deep networks are affected by such attacks leading to changes in the visual appearance of localized lesions, for extremely small perturbations. As the resulting reconstructions have high data consistency with the original measurements, these localized attacks can be used to explore the solution space of the CT recovery problem.

Figures (5)

• Figure 1: Untargeted attack on CT reconstruction methods for $\epsilon$ values 0.01 and 0.025.
• Figure 2: Localized attack on CT recovery for $\epsilon=$ 0.01. For each method, the third row shows the cropped patches from the clean (left) and adversarial (right) reconstructions.
• Figure 3: Localized attack on CT reconstruction methods. for $\epsilon=$ 0.01. First and second row illustrate clean and adversarial reconstructions for each method. The third row shows the cropped patches from the clean (left) and adversarial (right) reconstructions. Adversarial noise in the fourth row is multiplied by $\times25$ for visibility.
• Figure 4: Untargeted attack on CT reconstruction methods for $\epsilon$ values 0.01, 0.025 and 0.05.
• Figure 5: Result of localized attacks on 20 images. For each method left patch is from clean reconstruction and right is the result of attack.