On Instabilities of Unsupervised Denoising Diffusion Models in Magnetic Resonance Imaging Reconstruction

TL;DR

The results highlight the vulnerability of current state-of-the-art diffusion-based reconstruction models to possible worst-case perturbations and underscore the need for further research to improve their robustness and reliability in clinical settings.

Abstract

Denoising diffusion models offer a promising approach to accelerating magnetic resonance imaging (MRI) and producing diagnostic-level images in an unsupervised manner. However, our study demonstrates that even tiny worst-case potential perturbations transferred from a surrogate model can cause these models to generate fake tissue structures that may mislead clinicians. The transferability of such worst-case perturbations indicates that the robustness of image reconstruction may be compromised due to MR system imperfections or other sources of noise. Moreover, at larger perturbation strengths, diffusion models exhibit Gaussian noise-like artifacts that are distinct from those observed in supervised models and are more challenging to detect. Our results highlight the vulnerability of current state-of-the-art diffusion-based reconstruction models to possible worst-case perturbations and underscore the need for further research to improve their robustness and reliability in clinical settings.

Figures (6)

• Figure 1: MRI reconstruction can be vulnerable to worst-case perturbations, which add noise to the original k-space signal and manipulate the reconstruction process of undersampled data. The resulting reconstructions can show false gray matter structures that are difficult for humans to detect (see zoomed-in plots).
• Figure 2: We designed experiments to evaluate the susceptibility of trained i-RIM and ResUnet++ models to white- and black-box attacks (a and b).
• Figure 3: We visualized the impact of perturbation amplitude on model performance, measured by the $\Delta$SSIM metric. Subplot (a) shows that all models experienced a drastic drop in SSIM as the perturbation amplitude increased using worst-case perturbations generated by i-RIM. Similar findings were observed with adversarial perturbations via the ResUnet model, in (b).
• Figure 4: To demonstrate, we crafted worst-case black-box perturbations ghaffari2022adversarial using an independent ResUnet++ model and applied them to unsupervised diffusion reconstruction and supervised i-RIM. The application of worst-case inference to unsupervised reconstruction can create misleading artifacts in brain tissue, which can be seen as red arrows in the subplot below.
• Figure S1: Comparisons of the pSNR change of all models against $l_2$-bounded adversaries with increasing perturbation amplitudes in the frequency space. left, A worst-case perturbation was generated by using the trained i-RIM model. Comparisons in the left subplot correspond to our experiments outlined in Fig. \ref{['fig:fig2']}a. Right, A worst-case perturbation was generated by using the ResUnet++ model. Comparisons in the right subplot correspond to our experiments outlined in Fig. \ref{['fig:fig2']}b.