Low dose computed tomography (CT) acquisition using reduced radiation or
sparse angle measurements is recommended to decrease the harmful effects of
X-ray radiation. Recent works successfully apply deep networks to the problem
of low dose CT recovery on bench-mark datasets. However, their robustness needs
a thorough evaluation before use in clinical settings. In this work, we
evaluate the robustness of different deep learning approaches and classical
methods for CT recovery. We show that deep networks, including model-based
networks encouraging data consistency, are more susceptible to untargeted
attacks. Surprisingly, we observe that data consistency is not heavily affected
even for these poor quality reconstructions, motivating the need for better
regularization for the networks. We demonstrate the feasibility of universal
attacks and study attack transferability across different methods. We analyze
robustness to attacks causing localized changes in clinically relevant regions.
Both classical approaches and deep networks are affected by such attacks
leading to changes in the visual appearance of localized lesions, for extremely
small perturbations. As the resulting reconstructions have high data
consistency with the original measurements, these localized attacks can be used
to explore the solution space of the CT recovery problem.

评估不同深度学习方法和经典方法在 CT 图像恢复中的鲁棒性，发现深度网络更容易受到未定向攻击的影响，数据一致性不受重建质量影响，需要更好的正则化方法。同时，深度网络和经典方法都容易受到对局部病变产生可见变化的攻击的影响，这些攻击可以用于探索 CT 恢复问题的解空间。

低剂量 CT 图像恢复的对抗鲁棒性评估

Evaluating Adversarial Robustness of Low dose CT Recovery

Deep neural networks (DNNs) have shown vulnerability to adversarial attacks,
i.e., carefully perturbed inputs designed to mislead the network at inference
time. Recently introduced localized attacks, Localized and Visible Adversarial
Noise (LaVAN) and Adversarial patch, pose a new challenge to deep learning
security by adding adversarial noise only within a specific region without
affecting the salient objects in an image. Driven by the observation that such
attacks introduce concentrated high-frequency changes at a particular image
location, we have developed an effective method to estimate noise location in
gradient domain and transform those high activation regions caused by
adversarial noise in image domain while having minimal effect on the salient
object that is important for correct classification. Our proposed Local
Gradients Smoothing (LGS) scheme achieves this by regularizing gradients in the
estimated noisy region before feeding the image to DNN for inference. We have
shown the effectiveness of our method in comparison to other defense methods
including Digital Watermarking, JPEG compression, Total Variance Minimization
(TVM) and Feature squeezing on ImageNet dataset. In addition, we systematically
study the robustness of the proposed defense mechanism against Back Pass
Differentiable Approximation (BPDA), a state of the art attack recently
developed to break defenses that transform an input sample to minimize the
adversarial effect. Compared to other defense mechanisms, LGS is by far the
most resistant to BPDA in localized adversarial attack setting.

本研究提出了一种基于局部梯度平滑（LGS）的防御方法来对抗深度神经网络（DNNs）对于局部及可见对抗干扰的敏感性，并在 ImageNet 数据集上与数字水印，JPEG 压缩，TVM 和特征扩张等防御方法相比展示了 LGS 的有效性和鲁棒性。