Prompt2Perturb (P2P): Text-Guided Diffusion-Based Adversarial Attacks on Breast Ultrasound Images (2412.09910v1)

Abstract: Deep neural networks (DNNs) offer significant promise for improving breast cancer diagnosis in medical imaging. However, these models are highly susceptible to adversarial attacks--small, imperceptible changes that can mislead classifiers--raising critical concerns about their reliability and security. Traditional attacks rely on fixed-norm perturbations, misaligning with human perception. In contrast, diffusion-based attacks require pre-trained models, demanding substantial data when these models are unavailable, limiting practical use in data-scarce scenarios. In medical imaging, however, this is often unfeasible due to the limited availability of datasets. Building on recent advancements in learnable prompts, we propose Prompt2Perturb (P2P), a novel language-guided attack method capable of generating meaningful attack examples driven by text instructions. During the prompt learning phase, our approach leverages learnable prompts within the text encoder to create subtle, yet impactful, perturbations that remain imperceptible while guiding the model towards targeted outcomes. In contrast to current prompt learning-based approaches, our P2P stands out by directly updating text embeddings, avoiding the need for retraining diffusion models. Further, we leverage the finding that optimizing only the early reverse diffusion steps boosts efficiency while ensuring that the generated adversarial examples incorporate subtle noise, thus preserving ultrasound image quality without introducing noticeable artifacts. We show that our method outperforms state-of-the-art attack techniques across three breast ultrasound datasets in FID and LPIPS. Moreover, the generated images are both more natural in appearance and more effective compared to existing adversarial attacks. Our code will be publicly available https://github.com/yasamin-med/P2P.

• The paper introduces a novel text-guided diffusion-based attack method that challenges DNNs in breast ultrasound diagnosis.
• The paper leverages learnable text embeddings and minimal reverse diffusion steps to produce imperceptible perturbations with high image quality.
• The paper demonstrates superior performance over state-of-the-art techniques using metrics like FID and LPIPS across multiple breast ultrasound datasets.

An Overview of Prompt2Perturb (P2P): A Text-Guided Diffusion-Based Adversarial Attack Framework for Breast Ultrasound Images

This paper introduces Prompt2Perturb (P2P), a novel adversarial attack method formulated to challenge the robustness of deep neural networks used in breast ultrasound imaging diagnosis. Deep neural networks (DNNs) have shown promise in augmenting the diagnostic accuracy of breast cancer detection, but their susceptibility to adversarial attacks necessitates improved security measures in medical applications. Traditional attacks are often perceptually misaligned with humans and restricted by fixed-norm perturbations. P2P addresses these issues by leveraging advancements in diffusion models and prompt-based learning to introduce imperceptible and textually guided adversarial perturbations.

Key Contributions

The P2P method introduces several innovative components that differentiate it from other adversarial attack strategies:

1. Text Embedding and Prompt Learning: Unlike conventional approaches that depend on predefined perturbation bounds or require extensive data, P2P employs learnable prompts within a text encoder. This enables the production of semantically meaningful adversarial images guided by specific text instructions. The approach directly updates text embeddings for creating adversarial samples without the necessity of retraining diffusion models, optimizing efficiency.
2. Minimal Reverse Diffusion Steps: By optimizing only the initial steps of reverse diffusion, P2P enhances the efficiency of attack generation while maintaining high image quality. This strategy ensures that generated adversarial examples incorporate subtle noises that do not compromise the structural integrity of ultrasound images, maintaining their realism and clinical relevance.
3. Evaluation on Multiple Datasets: P2P demonstrates superior performance compared to state-of-the-art attack techniques across three distinct breast ultrasound datasets using metrics such as Fréchet Inception Distance (FID) and Learned Perceptual Image Patch Similarity (LPIPS). This benchmarking underscores the potential effectiveness of P2P in generating high-quality adversarial examples that remain effective at deceiving DNN classifiers.

Implications and Future Directions

The introduction of P2P has significant implications for both practical and theoretical domains within AI and medical imaging:

• Enhanced Security of Medical DNNs: This work highlights the existing vulnerabilities of DNNs in medical applications, emphasizing the need for improved adversarial robustness. P2P offers a methodological framework that could inspire advancements in securing medical imaging systems against adversarial threats.
• Improved Real-world Applicability: By not relying on extensive data or specialized pre-trained models, P2P broadens the applicability of adversarial attacks to limited-data scenarios, common in medical imaging. This increases the relevance of the method across diverse scientific and clinical settings where data scarcity is prevalent.
• Foundation for Methodological Extensions: Future research might explore extending P2P’s methodology across other imaging domains, evaluating its adaptability and effectiveness beyond breast ultrasound. It presents opportunities for other medical fields requiring robust DNN models and secure diagnostic systems.

Numerical Results

The paper provides empirical validation where P2P achieves high success rates in misguiding classifiers while ensuring that the adversarial images retain low FID, LPIPS, and SSIM, indicating both adversarial effectiveness and perceptual similarity to original images. These numerical results evidence the strength of P2P as a refined attack model, challenging the conventional notion of adversarial perturbation.

Conclusion

Prompt2Perturb (P2P) advances the domain of adversarial attacks in medical imaging, specifically targeting breast ultrasound diagnostics. By integrating text-guided diffusion-based strategies, it offers a path toward security-conscious development of DNNs in healthcare environments. The operational efficiency, empirical robustness, and adaptability of P2P underscore its significance and potential impact on the ongoing evolution of AI safety in medical applications.