Abstract
Deep neural networks (DNNs) have achieved state-of-the-art performance in various tasks. However, studies show that DNNs are vulnerable to adversarial noises that are unperceivable perturbations to the input of a DNN and can lead to significant variation in the output. Lots of efforts have been made to develop defense methods to improve the robustness of DNNs against adversarial noises. I focus on developing novel methods to improve DNN robustness against adversarial noises with applications for ECG signal analysis and medical image analysis.
First, I propose a regularization method, named NSR, to improve DNN's adversarial robustness by minimizing the estimated upper bound of the noise-to-signal ratio (NSR) in the output. Two ECG signal classification tasks are used to show the effectiveness of my proposed regularization method and its superiority over baseline methods.
Second, I propose an adversarial training method, named IMA. For each individual training sample, IMA makes a sample-wise estimation of the upper bound of the adversarial perturbation. I evaluate this method on six publicly available image datasets. The experiments show that IMA achieves the highest adversarial robustness for image classification and segmentation with a minimal reduction in accuracy on clean data.
Third, I propose an adversarial training method named AME, which is parameter-free for the user. I evaluate AME on three commonly used image benchmark datasets. The results show that AME has the best overall performance.
Fourth, I propose a general defense method, named AMAT, that can be applied to various deep learning-based tasks. I apply this method on state-of-the-art DNNs, including the Unet-based model (nnUnet) for Heart, Hippocampus, and Prostate MRI images segmentation, multi-task Unet-based model for cephalometric landmark detection and YOLO V5 for blood cell bounding box detection. The experimental results demonstrate the effectiveness of my proposed method.