Adversarial robustness of a U-Net-based model observer for CT protocol optimization

Abstract

Artificial intelligence is increasingly used in medical imaging, yet its robustness to input perturbations remains a critical concern for a wide clinical adoption. To this end, we used adversarial examples to systematically probe vulnerabilities of a U-Net-based model observer for computed tomography protocol optimization, performing detection and localization of low-contrast objects in a phantom dataset. Adversarial attacks were generated using both gradient-based and optimization-based white-box methods. Fast gradient perturbations produced high misclassification rates, reaching up to 75% at intermediate perturbation levels while remaining visually imperceptible. Localization was more robust, with success rates of about 25% for small perturbations and 42% at moderate levels. In contrast, optimization-based attack achieved success rates close to 50% for both tasks. To mitigate these vulnerabilities, dynamic adversarial training was implemented. This reduced the success rate of optimization-based attacks to 7% for classification and 13% when including localization-specific training, demonstrating a substantial robustness improvement without compromising task performances, confirmed by localization receiver operating characteristic analysis. To further interpret model behavior, radiomic texture analysis was performed on original and adversarial images. While most global image statistics remain stable, specific texture-related features exhibit consistent changes in successful attacks, highlighting the model's sensitivity to subtle local intensity patterns. Overall, adversarial training improves robustness without degrading performance, while radiomic analysis reveals interpretable links between texture alterations and prediction failures, supporting more reliable and explainable AI systems for medical imaging.