Probabilistic Robustness in Medical Image Classification

Abstract: Deep learning (DL) has shown strong performance in medical image classification, but its trustworthy deployment remains challenging in safety-critical clinical settings, where prediction errors under perturbations may lead to severe consequences. Existing studies mainly focus on adversarial robustness (AR) from a worst-case perspective; however, such settings may be less representative of real medical applications. In this work, we investigate probabilistic robustness (PR) as a more practical measure of model trustworthiness. To this end, we construct a set of natural corruption settings for medical image classification and systematically evaluate commonly used DL models on MedMNIST v2 dataset. Our study provides a statistically grounded perspective on assessing the trustworthiness of DL models, thereby supporting their more trustworthy deployment in medical imaging applications.

• The paper introduces probabilistic robustness as a novel metric to assess deep learning models under natural image corruptions in clinical settings.
• It employs a statistical formulation to evaluate CNN performance on the PathMNIST dataset using standard backbones like ResNet-18 and ResNet-50.
• Findings reveal that high clean accuracy does not guarantee robustness, urging the adoption of corruption-aware evaluation for clinical applications.

Probabilistic Robustness in Medical Image Classification: A Detailed Analysis

Overview and Motivation

Robust deployment of deep learning (DL) models in medical imaging remains a critical challenge, owing largely to concerns over prediction reliability under distributional shifts and perturbations that frequently arise in real-world clinical environments. While adversarial robustness (AR) has dominated evaluation protocols—primarily by assessing the impact of worst-case perturbations constrained by $L_p$-norms—this perspective often does not reflect the operational scenarios encountered in medical practice, where natural corruptions rather than adversarial attacks predominate.

This paper introduces and systematically analyzes probabilistic robustness (PR) as a statistically grounded, practically significant alternative for evaluating trustworthiness in medical image classification models. Focusing on natural corruption scenarios adapted for the PathMNIST subset of MedMNIST v2, the study evaluates prevalent convolutional neural network (CNN) architectures for their performance both on clean and corrupted inputs, providing a nuanced understanding of model reliability under authentic operational conditions.

Methodological Framework

Formulation of Probabilistic Robustness

In contrast to worst-case AR—which seeks the single perturbation maximizing loss—PR is defined as the probability that a classifier's output remains invariant under random perturbations sampled from a specified distribution within an $L_p$-ball. Mathematically, for a model $f_\theta$ and input $x$ with true label $y$, PR is described as:

$$R(x, \gamma) = \mathbb{E}_{\delta \sim Pr(\cdot| x), \|\delta\| \leq \gamma} [ I_{ \{ f_\theta(x + \delta) = y \} } (x + \delta) ]$$

This captures the proportion of perturbations within the ball for which the model maintains the correct prediction, offering a frequency-based estimate of robustness across plausible, rather than adversarially optimized, distortions.

Figure 1: Schematic contrast between adversarial (a) and probabilistic (b) robustness, highlighting PR's reliance on random, distributional perturbations rather than the worst-case scenario.

Experimental Protocol

The authors adapt a suite of natural corruptions—such as defocus, motion blur, stain, saturate, pixelate, and brightness deviations, all modeled to mirror conditions encountered in medical imaging acquisition—for robust evaluation. Experiments utilize the PathMNIST task from MedMNIST v2: a 9-class colorectal tissue classification challenge comprising over 100,000 samples. Standard backbone models, ResNet-18 and ResNet-50, represent widely deployed architectures in both clinical research and AI-based healthcare applications.

Model performance is assessed using both standard metrics (accuracy, AUC) on clean data and PR metric as defined, under the aforementioned corruptions. The evaluation protocol aligns with PRBench to ensure consistent comparability and statistical validity.

Figure 2: Visualization of the CheXNet deep CNN architecture, a representative model for medical image classification tasks such as chest X-ray diagnosis.

Key Empirical Findings

Substantial Fragility of State-of-the-Art CNNs under Natural Corruptions: While both ResNet-18 and ResNet-50 attain high classification accuracy (90.68%/92.05%) and AUC (98.46%/99.39%) on uncorrupted data, their PR drops precipitously for several forms of corruption. Motion blur and defocus have the most pronounced impact, with PR for ResNet-18 registering only 40.20% under motion blur and 66.03% under defocus, contrasted with much higher PR under pixelation and color perturbations (stain, saturate, pixelate, brightness).

Clean Performance Does Not Guarantee Probabilistic Robustness: Notably, ResNet-50's marginally superior performance on clean data does not translate to consistently higher PR across corruption types—revealing a lack of correlation between nominal test accuracy and real-world trustworthiness under natural perturbations.

Corruption-Type Sensitivity: PR deterioration is highly dependent on the type of image corruption. Blur-based corruptions (motion, defocus) effectuate the greatest degradation, while models demonstrate relative resilience to color- or appearance-based changes, a finding with direct implications for both model selection and future test set design in clinical ML pipelines.

Theoretical and Practical Implications

The study rigorously demonstrates that prevailing evaluation strategies—centered around worst-case adversarial robustness or clean data accuracy—are insufficient proxies for model reliability in real-life medical diagnostics, where input noise and corruption are frequent and rarely adversarial. The probabilistic robustness paradigm better quantifies the residual risk overlooked by AR, supporting risk-informed deployment policies and more nuanced regulatory standards.

The empirical evidence that models with top-line clean accuracy can perform inconsistently under PR also has direct methodological ramifications: future advances in trustworthy AI for healthcare must consider robustness as a primary, separate axis of evaluation and optimization, not a byproduct of generalization ability.

Furthermore, the variable susceptibility to specific corruption types reinforces the importance of domain-specific data augmentation, comprehensive corruption-aware training, and the development of PR-oriented benchmarks and certifications, especially in high-stakes applications.

Future Directions

Building on these results, several avenues for methodological advancement are immediate:

• Model Design: Architectures explicitly optimized for PR under clinically realistic perturbations.
• Training Regimens: Data augmentation protocols calibrated via PR analysis, and adversarial training extended to non-worst-case, stochastic corruptions.
• Regulatory Frameworks: Benchmarking PR may become essential for certifying models destined for clinical use.
• Wider Adoption: Extension of PR evaluation to other imaging modalities (MRI, CT, ultrasound) and tasks (segmentation, detection).

Conclusion

By introducing probabilistic robustness as a principled and operationally relevant assessment metric for DL-based medical image classifiers, this work establishes a new foundation for trustworthiness evaluation in clinical AI. The empirical findings underscore the inadequacy of conventional metrics when exposed to realistic data corruptions and advocate for PR-centric model development and evaluation pipelines for medical imaging deployments, thereby shaping future directions in the reliability and governance of AI in healthcare.