# Adversarial Attacks Against Medical Deep Learning Systems

arXiv: https://arxiv.org/abs/1804.05296 · HTML: https://mlsanity.com/paper/1804.05296/

## Key facts

- Cited by 62 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 Apr 2018.

## Built on by (most cited first, 30 of 62)

- [Transparency of Deep Neural Networks for Medical Image Analysis: A Review of Interpretability Methods](https://mlsanity.com/paper/2111.02398/) (2021)
- [Adversarial Example Detection for DNN Models: A Review and Experimental Comparison](https://mlsanity.com/paper/2105.00203/) (2021)
- [A Taxonomy of Human and ML Strengths in Decision-Making to Investigate Human-ML Complementarity](https://mlsanity.com/paper/2204.10806/) (2022)
- [Data Poisoning for In-context Learning](https://mlsanity.com/paper/2402.02160/) (2024)
- [Towards Evaluating the Robustness of Deep Diagnostic Models by Adversarial Attack](https://mlsanity.com/paper/2103.03438/) (2021)
- [Explainable Deep Learning in Healthcare: A Methodological Survey from an Attribution View](https://mlsanity.com/paper/2112.02625/) (2021)
- [IPMix: Label-Preserving Data Augmentation Method for Training Robust Classifiers](https://mlsanity.com/paper/2310.04780/) (2023)
- [Exploiting epistemic uncertainty of the deep learning models to generate adversarial samples](https://mlsanity.com/paper/2102.04150/) (2021)
- [Improving Adversarial Robustness by Putting More Regularizations on Less Robust Samples](https://mlsanity.com/paper/2206.03353/) (2022)
- [Interpretation of Black Box NLP Models: A Survey](https://mlsanity.com/paper/2203.17081/) (2022)
- [Adversarial Attacks and Defenses in Physiological Computing: A Systematic Review](https://mlsanity.com/paper/2102.02729/) (2021)
- [Adversarial Transfer Attacks With Unknown Data and Class Overlap](https://mlsanity.com/paper/2109.11125/) (2021)
- [Attack-agnostic Adversarial Detection on Medical Data Using Explainable Machine Learning](https://mlsanity.com/paper/2105.01959/) (2021)
- [Now You See It, Now You Dont: Adversarial Vulnerabilities in Computational Pathology](https://mlsanity.com/paper/2106.08153/) (2021)
- [Selection of Source Images Heavily Influences the Effectiveness of Adversarial Attacks](https://mlsanity.com/paper/2106.07141/) (2021)
- [Enhanced Estimation Techniques for Certified Radii in Randomized Smoothing](https://mlsanity.com/paper/2503.08801/) (2025)
- [Current State of Community-Driven Radiological AI Deployment in Medical Imaging](https://mlsanity.com/paper/2212.14177/) (2022)
- [CALLOC: Curriculum Adversarial Learning for Secure and Robust Indoor Localization](https://mlsanity.com/paper/2311.06361/) (2023)
- [Multi-stage Optimization based Adversarial Training](https://mlsanity.com/paper/2106.15357/) (2021)
- [Federated Learning: Issues in Medical Application](https://mlsanity.com/paper/2109.00202/) (2021)
- [Adversarial Attacks and Defenses for Social Network Text Processing Applications: Techniques, Challenges and Future Research Directions](https://mlsanity.com/paper/2110.13980/) (2021)
- [The Security of Deep Learning Defences for Medical Imaging](https://mlsanity.com/paper/2201.08661/) (2022)
- [Robust Graph Neural Networks using Weighted Graph Laplacian](https://mlsanity.com/paper/2208.01853/) (2022)
- [Beyond Vulnerabilities: A Survey of Adversarial Attacks as Both Threats and Defenses in Computer Vision Systems](https://mlsanity.com/paper/2508.01845/) (2025)
- [The Effect of Prior Lipschitz Continuity on the Adversarial Robustness of Bayesian Neural Networks](https://mlsanity.com/paper/2101.02689/) (2021)
- [Adversarial Robustness Study of Convolutional Neural Network for Lumbar Disk Shape Reconstruction from MR images](https://mlsanity.com/paper/2102.02885/) (2021)
- [On Evaluating Adversarial Robustness of Chest X-ray Classification: Pitfalls and Best Practices](https://mlsanity.com/paper/2212.08130/) (2022)
- [Adversarial Medical Image with Hierarchical Feature Hiding](https://mlsanity.com/paper/2312.01679/) (2023)
- [SENTINEL: Securing Indoor Localization against Adversarial Attacks with Capsule Neural Networks](https://mlsanity.com/paper/2407.11091/) (2024)
- [CoRPA: Adversarial Image Generation for Chest X-rays Using Concept Vector Perturbations and Generative Models](https://mlsanity.com/paper/2502.05214/) (2025)

## Abstract (arXiv)

The discovery of adversarial examples has raised concerns about the practical deployment of deep learning systems. In this paper, we demonstrate that adversarial examples are capable of manipulating deep learning systems across three clinical domains. For each of our representative medical deep learning classifiers, both white and black box attacks were highly successful. Our models are representative of the current state of the art in medical computer vision and, in some cases, directly reflect architectures already seeing deployment in real world clinical settings. In addition to the technical contribution of our paper, we synthesize a large body of knowledge about the healthcare system to argue that medicine may be uniquely susceptible to adversarial attacks, both in terms of monetary incentives and technical vulnerability. To this end, we outline the healthcare economy and the incentives it creates for fraud and provide concrete examples of how and why such attacks could be realistically carried out. We urge practitioners to be aware of current vulnerabilities when deploying deep learning systems in clinical settings, and encourage the machine learning community to further investigate the domain-specific characteristics of medical learning systems.