# Impact of Adversarial Examples on Deep Learning Models for Biomedical Image Segmentation

arXiv: https://arxiv.org/abs/1907.13124 · HTML: https://mlsanity.com/paper/1907.13124/

## Key facts

- Cited by 26 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 30 Jul 2019.

## Built on by (most cited first, 26 of 26)

- [Proximal Splitting Adversarial Attacks for Semantic Segmentation](https://mlsanity.com/paper/2206.07179/) (2022)
- [Detecting Adversarial Data by Probing Multiple Perturbations Using Expected Perturbation Score](https://mlsanity.com/paper/2305.16035/) (2023)
- [Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challenges](https://mlsanity.com/paper/2303.14133/) (2023)
- [Towards Robust General Medical Image Segmentation](https://mlsanity.com/paper/2107.04263/) (2021)
- [MedRDF: A Robust and Retrain-Less Diagnostic Framework for Medical Pretrained Models Against Adversarial Attack](https://mlsanity.com/paper/2111.14564/) (2021)
- [Practical Region-level Attack against Segment Anything Models](https://mlsanity.com/paper/2404.08255/) (2024)
- [IPatch: A Remote Adversarial Patch](https://mlsanity.com/paper/2105.00113/) (2021)
- [Defense Against Adversarial Attacks on No-Reference Image Quality Models with Gradient Norm Regularization](https://mlsanity.com/paper/2403.11397/) (2024)
- [Adversarially Robust Prototypical Few-shot Segmentation with Neural-ODEs](https://mlsanity.com/paper/2210.03429/) (2022)
- [Robust Prototypical Few-Shot Organ Segmentation with Regularized Neural-ODEs](https://mlsanity.com/paper/2208.12428/) (2022)
- [A Certified Radius-Guided Attack Framework to Image Segmentation Models](https://mlsanity.com/paper/2304.02693/) (2023)
- [A Review of Adversarial Attacks in Computer Vision](https://mlsanity.com/paper/2308.07673/) (2023)
- [Adaptive Adversarial Training to Improve Adversarial Robustness of DNNs for Medical Image Segmentation and Detection](https://mlsanity.com/paper/2206.01736/) (2022)
- [NeuGuard: Lightweight Neuron-Guided Defense against Membership Inference Attacks](https://mlsanity.com/paper/2206.05565/) (2022)
- [Adversarial Medical Image with Hierarchical Feature Hiding](https://mlsanity.com/paper/2312.01679/) (2023)
- [Learning Defense Transformers for Counterattacking Adversarial Examples](https://mlsanity.com/paper/2103.07595/) (2021)
- [Multiclass ASMA vs Targeted PGD Attack in Image Segmentation](https://mlsanity.com/paper/2208.01844/) (2022)
- [SoK: Security and Privacy Risks of Healthcare AI](https://mlsanity.com/paper/2409.07415/) (2024)
- [S2S2: Semantic Stacking for Robust Semantic Segmentation in Medical Imaging](https://mlsanity.com/paper/2412.13156/) (2024)
- [Exploring Patient Data Requirements in Training Effective AI Models for MRI-based Breast Cancer Classification](https://mlsanity.com/paper/2502.18506/) (2025)
- [Adversarial Heart Attack: Neural Networks Fooled to Segment Heart Symbols in Chest X-Ray Images](https://mlsanity.com/paper/2104.00139/) (2021)
- [Medical Aegis: Robust adversarial protectors for medical images](https://mlsanity.com/paper/2111.10969/) (2021)
- [Exact Feature Collisions in Neural Networks](https://mlsanity.com/paper/2205.15763/) (2022)
- [Securing the Diagnosis of Medical Imaging: An In-depth Analysis of AI-Resistant Attacks](https://mlsanity.com/paper/2408.00348/) (2024)
- [Adversarial Purification by Consistency-aware Latent Space Optimization on Data Manifolds](https://mlsanity.com/paper/2412.08394/) (2024)
- [Adversarial Attacks on Reinforcement Learning-based Medical Questionnaire Systems: Input-level Perturbation Strategies and Medical Constraint Validation](https://mlsanity.com/paper/2508.05677/) (2025)

## Abstract (arXiv)

Deep learning models, which are increasingly being used in the field of medical image analysis, come with a major security risk, namely, their vulnerability to adversarial examples. Adversarial examples are carefully crafted samples that force machine learning models to make mistakes during testing time. These malicious samples have been shown to be highly effective in misguiding classification tasks. However, research on the influence of adversarial examples on segmentation is significantly lacking. Given that a large portion of medical imaging problems are effectively segmentation problems, we analyze the impact of adversarial examples on deep learning-based image segmentation models. Specifically, we expose the vulnerability of these models to adversarial examples by proposing the Adaptive Segmentation Mask Attack (ASMA). This novel algorithm makes it possible to craft targeted adversarial examples that come with (1) high intersection-over-union rates between the target adversarial mask and the prediction and (2) with perturbation that is, for the most part, invisible to the bare eye. We lay out experimental and visual evidence by showing results obtained for the ISIC skin lesion segmentation challenge and the problem of glaucoma optic disc segmentation. An implementation of this algorithm and additional examples can be found at https://github.com/utkuozbulak/adaptive-segmentation-mask-attack.