# Miss the Point: Targeted Adversarial Attack on Multiple Landmark Detection

arXiv: https://arxiv.org/abs/2007.05225 · HTML: https://mlsanity.com/paper/2007.05225/

## Key facts

- Cited by 21 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 10 Jul 2020.

## Built on by (most cited first, 21 of 21)

- [One-Shot Medical Landmark Detection](https://mlsanity.com/paper/2103.04527/) (2021)
- [You Only Learn Once: Universal Anatomical Landmark Detection](https://mlsanity.com/paper/2103.04657/) (2021)
- [Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challenges](https://mlsanity.com/paper/2303.14133/) (2023)
- [Which images to label for few-shot medical landmark detection?](https://mlsanity.com/paper/2112.04386/) (2021)
- [UOD: Universal One-shot Detection of Anatomical Landmarks](https://mlsanity.com/paper/2306.07615/) (2023)
- [DATR: Domain-adaptive transformer for multi-domain landmark detection](https://mlsanity.com/paper/2203.06433/) (2022)
- [One-Shot Medical Landmark Localization by Edge-Guided Transform and Noisy Landmark Refinement](https://mlsanity.com/paper/2208.00453/) (2022)
- [U-LanD: Uncertainty-Driven Video Landmark Detection](https://mlsanity.com/paper/2102.01586/) (2021)
- [Conditional Training with Bounding Map for Universal Lesion Detection](https://mlsanity.com/paper/2103.12277/) (2021)
- [Adaptive Adversarial Training to Improve Adversarial Robustness of DNNs for Medical Image Segmentation and Detection](https://mlsanity.com/paper/2206.01736/) (2022)
- [Adversarial Medical Image with Hierarchical Feature Hiding](https://mlsanity.com/paper/2312.01679/) (2023)
- [Adversarially Robust Feature Learning for Breast Cancer Diagnosis](https://mlsanity.com/paper/2402.08768/) (2024)
- [Self-supervised pre-training with diffusion model for few-shot landmark detection in x-ray images](https://mlsanity.com/paper/2407.18125/) (2024)
- [SoK: Security and Privacy Risks of Healthcare AI](https://mlsanity.com/paper/2409.07415/) (2024)
- [Medical Aegis: Robust adversarial protectors for medical images](https://mlsanity.com/paper/2111.10969/) (2021)
- [Semantic Image Attack for Visual Model Diagnosis](https://mlsanity.com/paper/2303.13010/) (2023)
- [Reliability of deep learning models for anatomical landmark detection: The role of inter-rater variability](https://mlsanity.com/paper/2411.17850/) (2024)
- [CloudShield: Real-time Anomaly Detection in the Cloud](https://mlsanity.com/paper/2108.08977/) (2021)
- [Dynamic Perturbation-Adaptive Adversarial Training on Medical Image Classification](https://mlsanity.com/paper/2403.06798/) (2024)
- [Enhancing Output Diversity Improves Conjugate Gradient-based Adversarial Attacks](https://mlsanity.com/paper/2408.03972/) (2024)
- [Black-box Adversarial Attacks on CNN-based SLAM Algorithms](https://mlsanity.com/paper/2505.24654/) (2025)

## Abstract (arXiv)

Recent methods in multiple landmark detection based on deep convolutional neural networks (CNNs) reach high accuracy and improve traditional clinical workflow. However, the vulnerability of CNNs to adversarial-example attacks can be easily exploited to break classification and segmentation tasks. This paper is the first to study how fragile a CNN-based model on multiple landmark detection to adversarial perturbations. Specifically, we propose a novel Adaptive Targeted Iterative FGSM (ATI-FGSM) attack against the state-of-the-art models in multiple landmark detection. The attacker can use ATI-FGSM to precisely control the model predictions of arbitrarily selected landmarks, while keeping other stationary landmarks still, by adding imperceptible perturbations to the original image. A comprehensive evaluation on a public dataset for cephalometric landmark detection demonstrates that the adversarial examples generated by ATI-FGSM break the CNN-based network more effectively and efficiently, compared with the original Iterative FGSM attack. Our work reveals serious threats to patients' health. Furthermore, we discuss the limitations of our method and provide potential defense directions, by investigating the coupling effect of nearby landmarks, i.e., a major source of divergence in our experiments. Our source code is available at https://github.com/qsyao/attack_landmark_detection.