# Vulnerability Analysis of Chest X-Ray Image Classification Against Adversarial Attacks

arXiv: https://arxiv.org/abs/1807.02905 · HTML: https://mlsanity.com/paper/1807.02905/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 9 Jul 2018.

## Built on by (most cited first, 9 of 9)

- [Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challenges](https://mlsanity.com/paper/2303.14133/) (2023)
- [Towards Evaluating the Robustness of Deep Diagnostic Models by Adversarial Attack](https://mlsanity.com/paper/2103.03438/) (2021)
- [When and How to Fool Explainable Models (and Humans) with Adversarial Examples](https://mlsanity.com/paper/2107.01943/) (2021)
- [MedRDF: A Robust and Retrain-Less Diagnostic Framework for Medical Pretrained Models Against Adversarial Attack](https://mlsanity.com/paper/2111.14564/) (2021)
- [Certification of Deep Learning Models for Medical Image Segmentation](https://mlsanity.com/paper/2310.03664/) (2023)
- [On Evaluating Adversarial Robustness of Chest X-ray Classification: Pitfalls and Best Practices](https://mlsanity.com/paper/2212.08130/) (2022)
- [Adversarial Heart Attack: Neural Networks Fooled to Segment Heart Symbols in Chest X-Ray Images](https://mlsanity.com/paper/2104.00139/) (2021)
- [Universal Adversarial Framework to Improve Adversarial Robustness for Diabetic Retinopathy Detection](https://mlsanity.com/paper/2312.08193/) (2023)
- [Text-Guided Diffusion-Based Adversarial Attacks on Chest X-Ray Images](https://mlsanity.com/paper/2608.29456/) (2026)

## Abstract (arXiv)

Recently, there have been several successful deep learning approaches for automatically classifying chest X-ray images into different disease categories. However, there is not yet a comprehensive vulnerability analysis of these models against the so-called adversarial perturbations/attacks, which makes deep models more trustful in clinical practices. In this paper, we extensively analyzed the performance of two state-of-the-art classification deep networks on chest X-ray images. These two networks were attacked by three different categories (ten methods in total) of adversarial methods (both white- and black-box), namely gradient-based, score-based, and decision-based attacks. Furthermore, we modified the pooling operations in the two classification networks to measure their sensitivities against different attacks, on the specific task of chest X-ray classification.