# Adversarial Attack Vulnerability of Medical Image Analysis Systems: Unexplored Factors

arXiv: https://arxiv.org/abs/2006.06356 · HTML: https://mlsanity.com/paper/2006.06356/

## Key facts

- Cited by 40 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 11 Jun 2020.

## Built on by (most cited first, 30 of 40)

- [MedViT: A Robust Vision Transformer for Generalized Medical Image Classification](https://mlsanity.com/paper/2302.09462/) (2023)
- [How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defenses](https://mlsanity.com/paper/2305.10862/) (2023)
- [A Survey on Transferability of Adversarial Examples across Deep Neural Networks](https://mlsanity.com/paper/2310.17626/) (2023)
- [Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challenges](https://mlsanity.com/paper/2303.14133/) (2023)
- [Data synthesis and adversarial networks: A review and meta-analysis in cancer imaging](https://mlsanity.com/paper/2107.09543/) (2021)
- [When and How to Fool Explainable Models (and Humans) with Adversarial Examples](https://mlsanity.com/paper/2107.01943/) (2021)
- [Towards Model Resistant to Transferable Adversarial Examples via Trigger Activation](https://mlsanity.com/paper/2504.14541/) (2025)
- [Understanding Model Ensemble in Transferable Adversarial Attack](https://mlsanity.com/paper/2410.06851/) (2024)
- [Sketch-based Medical Image Retrieval](https://mlsanity.com/paper/2303.03633/) (2023)
- [Assessing Test-time Variability for Interactive 3D Medical Image Segmentation with Diverse Point Prompts](https://mlsanity.com/paper/2311.07806/) (2023)
- [Improving Robustness and Reliability in Medical Image Classification with Latent-Guided Diffusion and Nested-Ensembles](https://mlsanity.com/paper/2310.15952/) (2023)
- [Adversarial Attack Driven Data Augmentation for Accurate And Robust Medical Image Segmentation](https://mlsanity.com/paper/2105.12106/) (2021)
- [CoRPA: Adversarial Image Generation for Chest X-rays Using Concept Vector Perturbations and Generative Models](https://mlsanity.com/paper/2502.05214/) (2025)
- [Enhancement attacks in biomedical machine learning](https://mlsanity.com/paper/2301.01885/) (2023)
- [Revisiting Hidden Representations in Transfer Learning for Medical Imaging](https://mlsanity.com/paper/2302.08272/) (2023)
- [Systematically Assessing the Security Risks of AI/ML-enabled Connected Healthcare Systems](https://mlsanity.com/paper/2401.17136/) (2024)
- [Robust Image Classification: Defensive Strategies against FGSM and PGD Adversarial Attacks](https://mlsanity.com/paper/2408.13274/) (2024)
- [SoK: Security and Privacy Risks of Healthcare AI](https://mlsanity.com/paper/2409.07415/) (2024)
- [How to make Medical AI Systems safer? Simulating Vulnerabilities, and Threats in Multimodal Medical RAG System](https://mlsanity.com/paper/2508.17215/) (2025)
- [Universal and Transferable Attacks on Pathology Foundation Models](https://mlsanity.com/paper/2510.16660/) (2025)
- [Adversarial Heart Attack: Neural Networks Fooled to Segment Heart Symbols in Chest X-Ray Images](https://mlsanity.com/paper/2104.00139/) (2021)
- [Deep Supervised Information Bottleneck Hashing for Cross-modal Retrieval based Computer-aided Diagnosis](https://mlsanity.com/paper/2205.08365/) (2022)
- [Adversarial AI in Insurance: Pervasiveness and Resilience](https://mlsanity.com/paper/2301.07520/) (2023)
- [Fed-Safe: Securing Federated Learning in Healthcare Against Adversarial Attacks](https://mlsanity.com/paper/2310.08681/) (2023)
- [The Hidden Adversarial Vulnerabilities of Medical Federated Learning](https://mlsanity.com/paper/2310.13893/) (2023)
- [Quantum Adversarial Machine Learning and Defense Strategies: Challenges and Opportunities](https://mlsanity.com/paper/2412.12373/) (2024)
- [NAT: Learning to Attack Neurons for Enhanced Adversarial Transferability](https://mlsanity.com/paper/2508.16937/) (2025)
- [MANI-Pure: Magnitude-Adaptive Noise Injection for Adversarial Purification](https://mlsanity.com/paper/2509.25082/) (2025)
- [Machine Beats Machine: Machine Learning Models to Defend Against Adversarial Attacks](https://mlsanity.com/paper/2209.13963/) (2022)
- [Bridging Optimal Transport and Jacobian Regularization by Optimal Trajectory for Enhanced Adversarial Defense](https://mlsanity.com/paper/2303.11793/) (2023)

## Abstract (arXiv)

Adversarial attacks are considered a potentially serious security threat for machine learning systems. Medical image analysis (MedIA) systems have recently been argued to be vulnerable to adversarial attacks due to strong financial incentives and the associated technological infrastructure. In this paper, we study previously unexplored factors affecting adversarial attack vulnerability of deep learning MedIA systems in three medical domains: ophthalmology, radiology, and pathology. We focus on adversarial black-box settings, in which the attacker does not have full access to the target model and usually uses another model, commonly referred to as surrogate model, to craft adversarial examples. We consider this to be the most realistic scenario for MedIA systems. Firstly, we study the effect of weight initialization (ImageNet vs. random) on the transferability of adversarial attacks from the surrogate model to the target model. Secondly, we study the influence of differences in development data between target and surrogate models. We further study the interaction of weight initialization and data differences with differences in model architecture. All experiments were done with a perturbation degree tuned to ensure maximal transferability at minimal visual perceptibility of the attacks. Our experiments show that pre-training may dramatically increase the transferability of adversarial examples, even when the target and surrogate's architectures are different: the larger the performance gain using pre-training, the larger the transferability. Differences in the development data between target and surrogate models considerably decrease the performance of the attack; this decrease is further amplified by difference in the model architecture. We believe these factors should be considered when developing security-critical MedIA systems planned to be deployed in clinical practice.