Brain Tumor Classifiers Under Attack: Robustness of ResNet Variants Against Transferable FGSM and PGD Attacks

TL;DR

This work examines adversarial robustness of MRI-based brain tumor classifiers across three architectural families—BrainNet (ResNet-based), BrainNeXt (ResNeXt-based), and DilationNet—under FGSM and PGD attacks. It systematically varies input resolution and augmentation (full-sized augmented, shrunk augmented, shrunk non-augmented) to study robustness-transferability in black-box settings. The results show that ResNeXt-based BrainNeXt achieves the strongest resistance to black-box attacks and the least transferable adversarial samples, while BrainNet and DilationNet are more vulnerable to cross-architecture transfers, particularly on low-resolution or non-augmented data, underscoring the impact of both architecture and data quality on security. The findings highlight the necessity of jointly evaluating accuracy and adversarial robustness for safe clinical deployment and motivate defense strategies and robustness-aware architecture design in medical imaging pipelines.

Abstract

Adversarial robustness in deep learning models for brain tumor classification remains an underexplored yet critical challenge, particularly for clinical deployment scenarios involving MRI data. In this work, we investigate the susceptibility and resilience of several ResNet-based architectures, referred to as BrainNet, BrainNeXt and DilationNet, against gradient-based adversarial attacks, namely FGSM and PGD. These models, based on ResNet, ResNeXt, and dilated ResNet variants respectively, are evaluated across three preprocessing configurations (i) full-sized augmented, (ii) shrunk augmented and (iii) shrunk non-augmented MRI datasets. Our experiments reveal that BrainNeXt models exhibit the highest robustness to black-box attacks, likely due to their increased cardinality, though they produce weaker transferable adversarial samples. In contrast, BrainNet and Dilation models are more vulnerable to attacks from each other, especially under PGD with higher iteration steps and $α$ values. Notably, shrunk and non-augmented data significantly reduce model resilience, even when the untampered test accuracy remains high, highlighting a key trade-off between input resolution and adversarial vulnerability. These results underscore the importance of jointly evaluating classification performance and adversarial robustness for reliable real-world deployment in brain MRI analysis.

Figures (23)

• Figure 1: Examples of original and adversarial samples generated using FGSM and PGD, shown across different parameter settings (i.e., $\epsilon$, $\alpha$, and number of iterations).
• Figure 2: Additional examples of original and adversarial samples generated using FGSM and PGD, shown across different parameter settings (i.e., $\epsilon$, $\alpha$, and number of iterations).
• Figure 3: Accuracy of the BrainNeXt152-3, BrainNetv3, and Dilation3-3 models under FGSM white-box and black-box attacks using the full-sized and augmented MRI dataset, evaluated at $\epsilon = 0.03$.
• Figure 4: Accuracy of the BrainNeXt152-3, BrainNetv3, and Dilation3-3 models under FGSM white-box and black-box attacks using the shrunk and augmented MRI dataset, evaluated at $\epsilon = 0.03$.
• Figure 5: Accuracy of the BrainNeXt152-5, BrainNetv5, and Dilation3-5 models under FGSM white-box and black-box attacks using the shrunk and non-augmented MRI dataset, evaluated at $\epsilon = 0.03$.