Adversarial Attacks Against Medical Deep Learning Systems – Arxiv Vanity

Algorithmic defenses against adversarial examples remain an extremely open and challenging problem, with recent state-of-the-art defenses on ImageNet still achieving only 27.9% and 46.7% top-1 accuracy for white- and black-box PGD attacks, respectively, as of March 2018 \citepkannan2018adversarial. Unfortunately, despite the explosive emergence of defense strategies, there does not appear to be an easy algorithmic fix for the adversarial problem available in the short term. For example, one recent analysis investigated a series of promising methods that relied on gradient obfuscation, and demonstrated that they could be quickly broken \citepathalye2018obfuscated. Despite this, we also note that principled approaches to adversarial robustness are beginning to show promise. For example, several papers have demonstrated what appears to be both high accuracy and strong adversarial robustness on smaller datasets such as MNIST, \citepmadry2017towards,kannan2018adversarial, and there have also been several results including theoretical guarantees of adversarial robustness, albeit on small datasets and/or with still-insufficient accuracy \citepkolter2017provable, raghunathan2018certified, dvijotham2018dual.