# Adversarial Robustness of MR Image Reconstruction under Realistic Perturbations

arXiv: https://arxiv.org/abs/2208.03161 · HTML: https://mlsanity.com/paper/2208.03161/

## Key facts

- Cited by 11 papers in the map (data through 14 Oct 2026).
- Builds on 11 of its 21 references that are in the map.
- First posted on arXiv 5 Aug 2022.

## Builds on (most cited first, 11 of 11)

- [U-Net: Convolutional Networks for Biomedical Image Segmentation](https://mlsanity.com/paper/1505.04597/) (2015)
- [Image reconstruction by domain transform manifold learning](https://mlsanity.com/paper/1704.08841/) (2017)
- [On instabilities of deep learning in image reconstruction - Does AI come at a cost?](https://mlsanity.com/paper/1902.05300/) (2019)
- [End-to-End Variational Networks for Accelerated MRI Reconstruction](https://mlsanity.com/paper/2004.06688/) (2020)
- [Deep learning for undersampled MRI reconstruction](https://mlsanity.com/paper/1709.02576/) (2017)
- [A Deep Cascade of Convolutional Neural Networks for MR Image Reconstruction](https://mlsanity.com/paper/1703.00555/) (2017)
- [Solving Inverse Problems With Deep Neural Networks -- Robustness Included?](https://mlsanity.com/paper/2011.04268/) (2020)
- [Measuring Robustness in Deep Learning Based Compressive Sensing](https://mlsanity.com/paper/2102.06103/) (2021)
- [MR image reconstruction using deep density priors](https://mlsanity.com/paper/1711.11386/) (2017)
- [Data augmentation for deep learning based accelerated MRI reconstruction with limited data](https://mlsanity.com/paper/2106.14947/) (2021)
- [Adversarial Robust Training of Deep Learning MRI Reconstruction Models](https://mlsanity.com/paper/2011.00070/) (2020)

## Built on by (most cited first, 11 of 11)

- [Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challenges](https://mlsanity.com/paper/2303.14133/) (2023)
- [Uncertainty Estimation and Propagation in Accelerated MRI Reconstruction](https://mlsanity.com/paper/2308.02631/) (2023)
- [To be or not to be stable, that is the question: understanding neural networks for inverse problems](https://mlsanity.com/paper/2211.13692/) (2022)
- [NPB-REC: A Non-parametric Bayesian Deep-learning Approach for Undersampled MRI Reconstruction with Uncertainty Estimation](https://mlsanity.com/paper/2404.04550/) (2024)
- [How many measurements are enough? Bayesian recovery in inverse problems with general distributions](https://mlsanity.com/paper/2505.10630/) (2025)
- [Mind the Detail: Uncovering Clinically Relevant Image Details in Accelerated MRI with Semantically Diverse Reconstructions](https://mlsanity.com/paper/2507.00670/) (2025)
- [Evaluating Adversarial Robustness of Low dose CT Recovery](https://mlsanity.com/paper/2402.11557/) (2024)
- [Robustness and Exploration of Variational and Machine Learning Approaches to Inverse Problems: An Overview](https://mlsanity.com/paper/2402.12072/) (2024)
- [Hallucinations in medical devices](https://mlsanity.com/paper/2508.14118/) (2025)
- [Triggering hallucinations in model-based MRI reconstruction via adversarial perturbations](https://mlsanity.com/paper/2602.18536/) (2026)
- [On Hallucinations in Inverse Problems: Fundamental Limits and Provable Assessment Methods](https://mlsanity.com/paper/2605.13146/) (2026)

## Abstract (arXiv)

Deep Learning (DL) methods have shown promising results for solving ill-posed inverse problems such as MR image reconstruction from undersampled k-space data. However, these approaches currently have no guarantees for reconstruction quality and the reliability of such algorithms is only poorly understood. Adversarial attacks offer a valuable tool to understand possible failure modes and worst case performance of DL-based reconstruction algorithms. In this paper we describe adversarial attacks on multi-coil k-space measurements and evaluate them on the recently proposed E2E-VarNet and a simpler UNet-based model. In contrast to prior work, the attacks are targeted to specifically alter diagnostically relevant regions. Using two realistic attack models (adversarial k-space noise and adversarial rotations) we are able to show that current state-of-the-art DL-based reconstruction algorithms are indeed sensitive to such perturbations to a degree where relevant diagnostic information may be lost. Surprisingly, in our experiments the UNet and the more sophisticated E2E-VarNet were similarly sensitive to such attacks. Our findings add further to the evidence that caution must be exercised as DL-based methods move closer to clinical practice.