研究超声甲状腺结节分割模型对抗攻击的鲁棒性，发现频域攻击更难防御。
Adversarial Robustness of Deep Learning-Based Thyroid Nodule Segmentation in Ultrasound
- 设计两类对抗攻击：边界噪声注入与频域相位扰动
- 空间攻击使分割精度下降0.29，频域攻击下降0.11但视觉失真更大
- 输入去噪可有效缓解空间攻击，对频域攻击无显著效果
深度学习分割模型在临床超声中应用日益广泛，但其对抗扰动下的鲁棒性尚未充分评估。本研究针对B-mode超声中的甲状腺结节分割，提出两种黑盒攻击：(1) 结构化斑点增强攻击（SSAA），注入边界定向噪声；(2) 频域超声攻击（FDUA），在傅里叶域施加带通滤波相位扰动。评估了三种推理时防御策略：测试时增强的随机预处理、确定性输入去噪，以及一致性感知聚合的随机集成推理。实验基于192个结节的动态超声序列训练的U-Net模型。基线模型在无扰图像上平均Dice相似系数（DSC）为0.76（标准差0.20）。SSAA使DSC降低0.29（标准差0.20），视觉相似性仍高（SSIM=0.94）；FDUA导致DSC下降0.11（标准差0.09），视觉保真度较低（SSIM=0.82）。针对SSAA，所有防御均显著提升修复后DSC，确定性去噪恢复最大（+0.10，p<0.001），其次为随机预处理（+0.09，p<0.001）和随机集成推理（+0.08，p=0.002）。无防御在应对FDUA时无统计学显著改善。结论表明，超声分割中的空间域攻击可通过输入预处理部分缓解，而频域攻击难以被现有方法防御，凸显模态特异性挑战。
原文摘要 · Abstract (English)
Introduction: Deep learning-based segmentation models are increasingly integrated into clinical imaging workflows, yet their robustness to adversarial perturbations remains incompletely characterized, particularly for ultrasound images. We evaluated adversarial attacks and inference-time defenses for thyroid nodule segmentation in B-mode ultrasound. Methods: Two black-box adversarial attacks were developed: (1) Structured Speckle Amplification Attack (SSAA), which injects boundary-targeted noise, and (2) Frequency-Domain Ultrasound Attack (FDUA), which applies bandpass-filtered phase perturbations in the Fourier domain. Three inference-time mitigations were evaluated on adversarial images: randomized preprocessing with test-time augmentation, deterministic input denoising, and stochastic ensemble inference with consistency-aware aggregation. Experiments were conducted on a U-Net segmentation model trained on cine-clips from a database of 192 thyroid nodules. Results: The baseline model achieved a mean Dice similarity coefficient (DSC) of 0.76 (SD 0.20) on unperturbed images. SSAA reduced DSC by 0.29 (SD 0.20) while maintaining high visual similarity (SSIM = 0.94). FDUA resulted in a smaller DSC reduction of 0.11 (SD 0.09) with lower visual fidelity (SSIM = 0.82). Against SSAA, all three defenses significantly improved DSC after correction, with deterministic denoising showing the largest recovery (+0.10, p < 0.001), followed by randomized preprocessing (+0.09, p < 0.001), and stochastic ensemble inference (+0.08, p = 0.002). No defense achieved statistically significant improvement against FDUA. Conclusion: Spatial-domain adversarial perturbations in ultrasound segmentation showed partial mitigation with input preprocessing, whereas frequency-domain perturbations were not mitigated by the defenses, highlighting modality-specific challenges in adversarial robustness evaluation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。