mlsanityData to 7 Oct 2026

Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challenges

arXiv 2303.14133 ↗First posted 24 Mar 2023eess.IV cs.CR cs.CVcited by 16

Not on the map. Why?

Abstract (arXiv)

Deep learning techniques have achieved superior performance in computer-aided medical image analysis, yet they are still vulnerable to imperceptible adversarial attacks, resulting in potential misdiagnosis in clinical practice. Oppositely, recent years have also witnessed remarkable progress in defense against these tailored adversarial examples in deep medical diagnosis systems. In this exposition, we present a comprehensive survey on recent advances in adversarial attacks and defenses for medical image analysis with a systematic taxonomy in terms of the application scenario. We also provide a unified framework for different types of adversarial attack and defense methods in the context of medical image analysis. For a fair comparison, we establish a new benchmark for adversarially robust medical diagnosis models obtained by adversarial training under various scenarios. To the best of our knowledge, this is the first survey paper that provides a thorough evaluation of adversarially robust medical diagnosis models. By analyzing qualitative and quantitative results, we conclude this survey with a detailed discussion of current challenges for adversarial attack and defense in medical image analysis systems to shed light on future research directions. Code is available on hrefhttps://github.com/tomvii/AdvMIAcolorredGitHub.

Key facts. Cited by 16 papers in the map (data through 7 Oct 2026). Builds on 116 of its 223 references that are in the map. First posted on arXiv 24 Mar 2023.

Builds on

116 of 223 references.

References · 116

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,604
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2013Intriguing properties of neural networkscited by 5,114
  7. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
  8. 2016Wide Residual Networkscited by 3,057
  9. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  10. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  11. 2015SegNet: A Deep Convolutional Encoder-Decoder Architecture for Image Segmentationcited by 1,483
  12. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
38 more
  1. 2019CheXpert: A Large Chest Radiograph Dataset with Uncertainty Labels and Expert Comparisoncited by 1,410
  2. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  3. 2017ChestX-ray8: Hospital-scale Chest X-ray Database and Benchmarks on Weakly-Supervised Classification and Localization of Common Thorax Diseasescited by 969
  4. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  5. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  6. 2016Universal adversarial perturbationscited by 774
  7. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  8. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  9. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  10. 2019Adversarial Training for Free!cited by 638
  11. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  12. 2017One pixel attack for fooling deep neural networkscited by 579
  13. 2017Skin Lesion Analysis Toward Melanoma Detection: A Challenge at the 2017 International Symposium on Biomedical Imaging (ISBI), Hosted by the International Skin Imaging Collaboration (ISIC)cited by 549
  14. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  15. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
  16. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  17. 2017Mitigating Adversarial Effects Through Randomizationcited by 382
  18. 2019Deep Learning for Image Super-resolution: A Surveycited by 368
  19. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
  20. 2019PadChest: A large chest x-ray image dataset with multi-label annotated reportscited by 308
  21. 2017Adversarial Examples for Semantic Segmentation and Object Detectioncited by 275
  22. 2018Generating Adversarial Examples with Adversarial Networkscited by 256
  23. 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 242
  24. 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
  25. 2020Understanding and Improving Fast Adversarial Trainingcited by 213
  26. 2020Can AI help in screening Viral and COVID-19 pneumonia?cited by 200
  27. 2017Generative Adversarial Perturbationscited by 153
  28. 2019Understanding Adversarial Attacks on Deep Learning Based Medical Image Analysis Systemscited by 151
  29. 2018Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priorscited by 145
  30. 2021Adversarial purification with Score-based generative modelscited by 132
  31. 2019Adversarially Robust Distillationcited by 124
  32. 2019Improving Black-box Adversarial Attacks with a Transfer-based Priorcited by 121
  33. 2018Transferable Adversarial Attacks for Image and Video Object Detectioncited by 109
  34. 2021Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognitioncited by 95
  35. 2021Revisiting Adversarial Robustness Distillation: Robust Soft Labels Make Student Bettercited by 77
  36. 2023Robust Evaluation of Diffusion-Based Adversarial Purificationcited by 65
  37. 2019Black-box Adversarial Attacks on Video Recognition Modelscited by 58
  38. 2021Reliable Adversarial Distillation with Unreliable Teacherscited by 55

50 most cited of 116 All 116 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 1; 2024: 4; 2025: 5; 2026: 6.

16 papers.

Sort:

By area:

  1. 2024PromptSmooth: Certifying Robustness of Medical Vision-Language Models via Prompt Learningcited by 16
  2. 2023SoK: Pitfalls in Evaluating Black-Box Attackscited by 6
  3. 2025Energy-Latency Attacks: A New Adversarial Threat to Deep Learningcited by 5
  4. 2024Adversarially Robust Feature Learning for Breast Cancer Diagnosiscited by 3
  5. 2026CogniVerse: Revolutionizing Multi-Modal Retrieval-Augmented Generation with Cognitive Reflection and Geometric Reasoningcited by 3
  6. 2024SoK: Security and Privacy Risks of Healthcare AIcited by 2
  7. 2025Mind the Trojan Horse: Image Prompt Adapter Enabling Scalable and Deceptive Jailbreakingcited by 2
  8. 2026Hierarchically Robust Zero-shot Vision-language Modelscited by 1
  9. 2024Securing the Diagnosis of Medical Imaging: An In-depth Analysis of AI-Resistant Attackscited by 0
  10. 2025Are Vision Transformer Representations Semantically Meaningful? A Case Study in Medical Imagingcited by 0
  11. 2025Adversarial Training Improves Generalization Under Distribution Shifts in Bird Sound Classificationcited by 0
  12. 2025Rethinking Convergence in Deep Learning: The Predictive-Corrective Paradigm for Anatomy-Informed Brain MRI Segmentationcited by 0
4 more
  1. 2026Exploring Sparsity and Smoothness of Arbitrary Lp Norms in Adversarial Attackscited by 0
  2. 2026Triggering hallucinations in model-based MRI reconstruction via adversarial perturbationscited by 0
  3. 2026Stain-Aware Wavelet Regularization for Instant Adversarial Purification in Histopathologycited by 0
  4. 2026A Comprehensive Review of One-Pixel Attack: Research Status, Taxonomy, Applications, Regulation Policy and Future Directionscited by 0