# Generalizability vs. Robustness: Adversarial Examples for Medical Imaging

arXiv: https://arxiv.org/abs/1804.00504 · HTML: https://mlsanity.com/paper/1804.00504/

## Key facts

- Cited by 23 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 23 Mar 2018.

## Built on by (most cited first, 23 of 23)

- [SegPGD: An Effective and Efficient Adversarial Attack for Evaluating and Boosting Segmentation Robustness](https://mlsanity.com/paper/2207.12391/) (2022)
- [Enhancing MR Image Segmentation with Realistic Adversarial Data Augmentation](https://mlsanity.com/paper/2108.03429/) (2021)
- [Towards Evaluating the Robustness of Deep Diagnostic Models by Adversarial Attack](https://mlsanity.com/paper/2103.03438/) (2021)
- [The Extreme Cardiac MRI Analysis Challenge under Respiratory Motion (CMRxMotion)](https://mlsanity.com/paper/2210.06385/) (2022)
- [Enabling Data Diversity: Efficient Automatic Augmentation via Regularized Adversarial Training](https://mlsanity.com/paper/2103.16493/) (2021)
- [A.I. Robustness: a Human-Centered Perspective on Technological Challenges and Opportunities](https://mlsanity.com/paper/2210.08906/) (2022)
- [Private and Reliable Neural Network Inference](https://mlsanity.com/paper/2210.15614/) (2022)
- [Adversarially Robust Prototypical Few-shot Segmentation with Neural-ODEs](https://mlsanity.com/paper/2210.03429/) (2022)
- [The Adversarial Consistency of Surrogate Risks for Binary Classification](https://mlsanity.com/paper/2305.09956/) (2023)
- [Stress Test Evaluation of Biomedical Word Embeddings](https://mlsanity.com/paper/2107.11652/) (2021)
- [Adaptive Adversarial Training to Improve Adversarial Robustness of DNNs for Medical Image Segmentation and Detection](https://mlsanity.com/paper/2206.01736/) (2022)
- [The Consistency of Adversarial Training for Binary Classification](https://mlsanity.com/paper/2206.09099/) (2022)
- [On Evaluating Adversarial Robustness of Chest X-ray Classification: Pitfalls and Best Practices](https://mlsanity.com/paper/2212.08130/) (2022)
- [Holistic Approach to Measure Sample-level Adversarial Vulnerability and its Utility in Building Trustworthy Systems](https://mlsanity.com/paper/2205.02604/) (2022)
- [Can We Revitalize Interventional Healthcare with AI-XR Surgical Metaverses?](https://mlsanity.com/paper/2304.00007/) (2023)
- [Adversarial Consistency and the Uniqueness of the Adversarial Bayes Classifier](https://mlsanity.com/paper/2404.17358/) (2024)
- [Learning to Detect Adversarial Examples Based on Class Scores](https://mlsanity.com/paper/2107.04435/) (2021)
- [Medical Aegis: Robust adversarial protectors for medical images](https://mlsanity.com/paper/2111.10969/) (2021)
- [AutoMO-Mixer: An automated multi-objective Mixer model for balanced, safe and robust prediction in medicine](https://mlsanity.com/paper/2203.02384/) (2022)
- [Adversarial Surrogate Risk Bounds for Binary Classification](https://mlsanity.com/paper/2506.09348/) (2025)
- [Are Vision Transformer Representations Semantically Meaningful? A Case Study in Medical Imaging](https://mlsanity.com/paper/2507.01788/) (2025)
- [Intervention Efficiency and Perturbation Validation Framework: Capacity-Aware and Robust Clinical Model Selection under the Rashomon Effect](https://mlsanity.com/paper/2511.14317/) (2025)
- [Adversarial Robustness of Deep Learning-Based Thyroid Nodule Segmentation in Ultrasound](https://mlsanity.com/paper/2602.21452/) (2026)

## Abstract (arXiv)

In this paper, for the first time, we propose an evaluation method for deep learning models that assesses the performance of a model not only in an unseen test scenario, but also in extreme cases of noise, outliers and ambiguous input data. To this end, we utilize adversarial examples, images that fool machine learning models, while looking imperceptibly different from original data, as a measure to evaluate the robustness of a variety of medical imaging models. Through extensive experiments on skin lesion classification and whole brain segmentation with state-of-the-art networks such as Inception and UNet, we show that models that achieve comparable performance regarding generalizability may have significant variations in their perception of the underlying data manifold, leading to an extensive performance gap in their robustness.