ML Security PapersTraining-Free Defense Against Adversarial Attacks in Deep Learning MRI Reconstruction
Mahdi Saberi , Chi Zhang , Mehmet Akçakaya
Published on arXiv
2501.01908
Input Manipulation Attack
OWASP ML Top 10 — ML01
Key Finding
Proposed training-free method quantitatively and qualitatively outperforms retrained defense baselines across multiple datasets, attack types/strengths, and physics-driven deep learning networks without degrading clean-input reconstruction quality
Cyclic Measurement Consistency Defense
Novel technique introduced
Deep learning (DL) methods have become the state-of-the-art for reconstructing sub-sampled magnetic resonance imaging (MRI) data. However, studies have shown that these methods are susceptible to small adversarial input perturbations, or attacks, resulting in major distortions in the output images. Various strategies have been proposed to reduce the effects of these attacks, but they require retraining and may lower reconstruction quality for non-perturbed/clean inputs. In this work, we propose a novel approach for mitigating adversarial attacks on MRI reconstruction models without any retraining. Based on the idea of cyclic measurement consistency, we devise a novel mitigation objective that is minimized in a small ball around the attack input. Results show that our method substantially reduces the impact of adversarial perturbations across different datasets, attack types/strengths and PD-DL networks, and qualitatively and quantitatively outperforms conventional mitigation methods that involve retraining. We also introduce a practically relevant scenario for small adversarial perturbations that models impulse noise in raw data, which relates to \emph{herringbone artifacts}, and show the applicability of our approach in this setting. Finally, we show our mitigation approach remains effective in two \emph{realistic} extension scenarios: a blind setup, where the attack strength or algorithm is not known to the user; and an adaptive attack setup, where the attacker has full knowledge of the defense strategy.
Key Contributions
- Novel training-free adversarial mitigation strategy that optimizes cyclic measurement consistency over the input within a small perturbation ball, requiring no retraining
- Introduction of a realistic adversarial attack scenario for MRI modelling impulse noise in k-space (herringbone artifacts) as a sparse and bounded adversarial attack
- Demonstrated robustness in blind settings (unknown attack strength/algorithm) and adaptive attack settings where the attacker has full knowledge of the defense
🛡️ Threat Analysis
Directly defends against adversarial input perturbations at inference time that cause major distortions in DL-based MRI reconstruction outputs; evaluates against FGSM/PGD-style attacks, blind setups, and adaptive attacks where the adversary has full knowledge of the defense strategy.