Black box attack method of medical image segmentation neural network based on query

Abstract

The invention discloses a black box attack method for a medical image segmentation neural network based on query, and the method comprises the steps: learning a disturbance construction mode through building probability distribution, continuously constructing new disturbance in iteration, generating an adversarial sample, and initiating the query of an attacked model; parameters of probability distribution are dynamically adjusted according to feedback of the attacked model, so that an adversarial sample which enables the attacked model to have serious segmentation errors is generated within fewer query times. According to the method, the prior information provided in the picture label is fully utilized, and the information can be focused on key foreground pixels in the picture during attack, so that unnecessary query is avoided, and the attack is more hidden; and meanwhile, the disturbance construction mode is dynamically adjusted according to the feedback of the attacked model, that is, the adaptive capability is achieved, and compared with other existing methods, the generated adversarial sample can enable the medical image segmentation neural network to generate larger segmentation errors.

Description

technical field [0001] The invention belongs to the field of adversarial attacks in medical image segmentation, and in particular relates to a black-box attack method based on a query-based medical image segmentation neural network. Background technique [0002] Medical image segmentation is a cross task of medical image processing and semantic segmentation. Its goal is to identify organs or lesions from medical images and mark the specific location for subsequent processing. Medical image segmentation is often used as a pre-task for other medical image processing tasks, so it has a wide range of applications in the field of computer-aided diagnosis. [0003] Adversarial attacks first appeared in the field of image recognition. The adversarial attack method can make the powerful neural network model produce wrong output by adding small perturbations invisible to the human eye to the image. The perturbed images are called adversarial samples. With the development of advers...

AI Technical Summary

Problems solved by technology

[0006] 2) Black box attack method: This attack method assumes that the attacker can only obtain part of the information of the target model

This means that neural networks for medical image segmentation are more vulnerable to adversarial examples

Images