{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T06:06:23Z","timestamp":1784181983262,"version":"3.55.0"},"reference-count":37,"publisher":"IOP Publishing","issue":"4","license":[{"start":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T00:00:00Z","timestamp":1784160000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/publishingsupport.iopscience.iop.org\/iop-standard\/v1"},{"start":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T00:00:00Z","timestamp":1784160000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/iopscience.iop.org\/info\/page\/text-and-data-mining"},{"start":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T00:00:00Z","timestamp":1784160000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/publishingsupport.iopscience.iop.org\/questions\/alternative-author-rights-policies\/"},{"start":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T00:00:00Z","timestamp":1784160000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/publishingsupport.iopscience.iop.org\/questions\/alternative-author-rights-policies\/"}],"funder":[{"DOI":"10.13039\/501100002923","name":"Consejo Nacional de Investigaciones Cient\u00edficas y T\u00e9cnicas","doi-asserted-by":"crossref","award":["112202101 00114CO"],"award-info":[{"award-number":["112202101 00114CO"]}],"id":[{"id":"10.13039\/501100002923","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100011655","name":"Instituto Balseiro, Universidad Nacional de Cuyo","doi-asserted-by":"crossref","award":["06\/C040-T1"],"award-info":[{"award-number":["06\/C040-T1"]}],"id":[{"id":"10.13039\/501100011655","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["iopscience.iop.org"],"crossmark-restriction":false},"short-container-title":["Biomed. Phys. Eng. Express"],"published-print":{"date-parts":[[2026,8,1]]},"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>Multi-modal models that fuse neuroimaging with clinical assessment data represent the current state of the art for automated Alzheimer\u2019s disease detection, yet their adversarial robustness remains poorly understood. We systematically investigated adversarial vulnerability in CogniNetMM, a model that fuses 3D structural MRI volumes with neuropsychological clinical variables (CV), using the Fast Gradient Sign Method and DeepFool in three modality configurations: MRI only, CVs only, and both jointly. We further introduced a mean attack framework, in which the average perturbation vector across samples serves as a fixed-direction probe of the decision boundary, decoupling the contribution of attack direction from that of sample position. During training, we identified modality collapse, a training instability in which the fusion layer progressively suppresses the MRI pathway. Collapse probability decreased with larger batch sizes and was further reduced by stratified sampling on class-imbalanced data. Across all CV configurations and both attack methods, the joint multi-modal attack achieved higher success than the average of the two unimodal attacks. For DeepFool, the advantage was strong enough that the joint attack outperformed each unimodal attack individually near the decision boundary. The mean attack replicated this result under a fixed perturbation direction, confirming that the advantage is a structural property of the fused decision boundary rather than an artefact of per-sample gradient alignment. These findings are consistent with a concave original-class region in the joint input space: non-linear modality coupling creates adversarially reachable regions that neither modality perturbation can access independently. Together, these results show that heterogeneous data fusion introduces emergent adversarial vulnerabilities beyond what unimodal analysis predicts, and that standard training practices on imbalanced medical datasets carry a risk of silent modality suppression.<\/jats:p>","DOI":"10.1088\/2057-1976\/ae866f","type":"journal-article","created":{"date-parts":[[2026,7,6]],"date-time":"2026-07-06T22:47:55Z","timestamp":1783378075000},"page":"045028","update-policy":"https:\/\/doi.org\/10.1088\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Adversarial attacks on a multimodal Alzheimer\u2019s disease detection system reveal complex interdependences between heterogeneous modalities"],"prefix":"10.1088","volume":"12","author":[{"ORCID":"https:\/\/orcid.org\/0009-0006-4569-3105","authenticated-orcid":true,"given":"Claudio","family":"Sebasti\u00e1n Sigvard","sequence":"first","affiliation":[{"name":"Centro At\u00f3mico Bariloche"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3880-6697","authenticated-orcid":true,"given":"Jos\u00e9 M","family":"Franco-Valiente","sequence":"additional","affiliation":[{"name":"CETA-CIEMAT"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3106-1423","authenticated-orcid":true,"given":"Germ\u00e1n","family":"Mato","sequence":"additional","affiliation":[{"name":"Centro At\u00f3mico Bariloche"},{"name":"Consejo Nacional de Investigaciones Cient\u00edficas y T\u00e9cnicas"},{"name":"Comisi\u00f3n Nacional de Energ\u00eda At\u00f3mica (CNEA)"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"266","published-online":{"date-parts":[[2026,7,16]]},"reference":[{"key":"bpexae866fbib1","doi-asserted-by":"publisher","DOI":"10.1117\/1.JMI.8.2.024503","type":"journal-article","volume":"8","author":"the Alzheimer\u2019s Disease Neuroimaging Initiative","year":"2021","journal-title":"J. Med. Imaging"},{"key":"bpexae866fbib2","doi-asserted-by":"publisher","first-page":"1347","DOI":"10.1016\/j.neuron.2013.12.003","type":"journal-article","volume":"80","author":"Jack","year":"2013","journal-title":"Neuron"},{"key":"bpexae866fbib3","doi-asserted-by":"publisher","first-page":"4703","DOI":"10.1073\/pnas.052587399","type":"journal-article","volume":"99","author":"Scahill","year":"2002","journal-title":"Proc. Natl Acad. Sci."},{"key":"bpexae866fbib4","doi-asserted-by":"publisher","first-page":"1499","DOI":"10.1212\/WNL.0000000000002593","type":"journal-article","volume":"86","author":"Xiong","year":"2016","journal-title":"Neurology"},{"key":"bpexae866fbib5","doi-asserted-by":"publisher","first-page":"167","DOI":"10.1016\/j.neuroimage.2012.09.065","type":"journal-article","volume":"65","author":"Gray","year":"2013","journal-title":"NeuroImage"},{"key":"bpexae866fbib6","doi-asserted-by":"publisher","first-page":"14","DOI":"10.3390\/diagnostics8010014","type":"journal-article","volume":"8","author":"Bauer","year":"2018","journal-title":"Diagnostics"},{"key":"bpexae866fbib7","first-page":"pp 2875","type":"conference-proceedings","article-title":"Input agnostic deep learning for Alzheimer\u2019s disease classification using multimodal MRI images","author":"Massalimova","year":"2021"},{"key":"bpexae866fbib8","doi-asserted-by":"publisher","DOI":"10.1016\/j.bspc.2022.103527","type":"journal-article","volume":"74","author":"Salami","year":"2022","journal-title":"Biomed. Signal Process. Control"},{"key":"bpexae866fbib9","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow","year":"2014","type":"preprint"},{"key":"bpexae866fbib10","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s12880-020-00530-y","type":"journal-article","volume":"21","author":"Hirano","year":"2021","journal-title":"BMC Med. Imag."},{"key":"bpexae866fbib11","doi-asserted-by":"publisher","first-page":"1287","DOI":"10.1126\/science.aaw4399","type":"journal-article","volume":"363","author":"Finlayson","year":"2019","journal-title":"Science"},{"key":"bpexae866fbib12","doi-asserted-by":"publisher","first-page":"30","DOI":"10.3389\/fninf.2016.00030","type":"journal-article","article-title":"volBrain: an online MRI brain volumetry system","volume":"10","author":"Manj\u00f3n","year":"2016","journal-title":"Front. Neuroinform."},{"key":"bpexae866fbib13","doi-asserted-by":"publisher","DOI":"10.1088\/2057-1976\/ae1baf","type":"journal-article","article-title":"Universal black-box attacks against a third-party Alzheimer\u2019s diagnostic system","volume":"11","author":"Sigvard","year":"2025","journal-title":"Biomed. Phys. Eng. Express"},{"key":"bpexae866fbib14","doi-asserted-by":"publisher","first-page":"2730","DOI":"10.1093\/jamia\/ocae209","type":"journal-article","article-title":"Toward a responsible future: recommendations for AI-enabled clinical decision support","volume":"31","author":"Labkoff","year":"2024","journal-title":"J. Am. Med. Inf. Assoc."},{"key":"bpexae866fbib15","doi-asserted-by":"publisher","DOI":"10.1016\/j.glmedi.2024.100139","type":"journal-article","article-title":"Artificial intelligence and big data for pharmacovigilance and patient safety","volume":"3","author":"Shamim","year":"2024","journal-title":"J. Med. Surg. Public Health"},{"key":"bpexae866fbib16","doi-asserted-by":"publisher","first-page":"103","DOI":"10.54660\/IJSSER.2024.3.1.103-109","type":"journal-article","article-title":"Legal and ethical challenges in AI governance: a conceptual approach to developing ethical compliance models in the US","volume":"3","author":"Chintoh","year":"2024","journal-title":"Int. J. Soc. Sci. Except. Res."},{"key":"bpexae866fbib17","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00335","type":"conference-proceedings","article-title":"Defending multimodal fusion models against single-source adversaries","author":"Yang","year":"2021"},{"key":"bpexae866fbib18","doi-asserted-by":"publisher","first-page":"5005","DOI":"10.48550\/arXiv.2206.09391","type":"conference-proceedings","article-title":"Towards adversarial attack on vision-language pre-training models","author":"Zhang","year":"2022"},{"key":"bpexae866fbib19","doi-asserted-by":"publisher","first-page":"2574","DOI":"10.1109\/CVPR.2016.282","type":"conference-proceedings","article-title":"DeepFool: a simple and accurate method to fool deep neural networks","author":"Moosavi-Dezfooli","year":"2016"},{"key":"bpexae866fbib20","doi-asserted-by":"publisher","first-page":"3750","DOI":"10.1109\/JBHI.2024.3373703","type":"journal-article","article-title":"Predicting progression from mild cognitive impairment to {Alzheimer\u2019s} dementia with adversarial attacks","volume":"28","author":"Bayta\u015f","year":"2024","journal-title":"IEEE J. Biomed. Health Inf."},{"key":"bpexae866fbib21","article-title":"Investigating vulnerability to adversarial examples on multimodal data fusion in deep learning","author":"Yu","year":"2020","type":"preprint"},{"key":"bpexae866fbib22","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.clinicalnlp-1.29","type":"conference-proceedings","article-title":"Utilizing multimodal feature consistency to detect adversarial examples on clinical summaries","author":"Wang","year":"2020"},{"key":"bpexae866fbib23","article-title":"DFT-based adversarial attack detection in MRI brain imaging: Enhancing diagnostic accuracy in Alzheimer\u2019s case studies","author":"Najafi","year":"2024","type":"preprint"},{"key":"bpexae866fbib24","doi-asserted-by":"publisher","DOI":"10.1038\/s41598-025-18340-z","type":"journal-article","volume":"15","author":"Yousuf","year":"2025","journal-title":"Sci. Rep."},{"key":"bpexae866fbib25","article-title":"Generalizability vs. robustness: adversarial examples for medical imaging","author":"Paschali","year":"2018","type":"preprint"},{"key":"bpexae866fbib26","doi-asserted-by":"publisher","DOI":"10.1016\/j.mlwa.2026.100895","type":"journal-article","volume":"24","author":"Al-Yaari","year":"2026","journal-title":"Mach. Learn. Appl."},{"key":"bpexae866fbib27","doi-asserted-by":"publisher","DOI":"10.1088\/1402-4896\/ae364b","type":"journal-article","volume":"101","author":"Al-Yaari","year":"2026","journal-title":"Phys. Scr."},{"key":"bpexae866fbib28","doi-asserted-by":"publisher","DOI":"10.1016\/j.compbiomed.2024.109248","type":"journal-article","volume":"183","author":"Pasqualino","year":"2024","journal-title":"Comput. Biol. Med."},{"key":"bpexae866fbib29","doi-asserted-by":"publisher","first-page":"616","DOI":"10.3390\/s23020616","type":"journal-article","volume":"23","author":"Xue","year":"2023","journal-title":"Sensors"},{"key":"bpexae866fbib30","first-page":"pp 9938","type":"conference-proceedings","article-title":"Mitigating modality collapse in multimodal VAEs via impartial optimization","author":"Javaloy","year":"2022"},{"key":"bpexae866fbib31","first-page":"pp 8238","type":"conference-proceedings","article-title":"Balanced multimodal learning via on-the-fly gradient modulation","author":"Peng","year":"2022"},{"key":"bpexae866fbib32","author":"Chaudhuri","year":"2025","type":"preprint"},{"key":"bpexae866fbib33","author":"LaMontagne","year":"2019","type":"other"},{"key":"bpexae866fbib34","doi-asserted-by":"publisher","first-page":"774","DOI":"10.1016\/j.neuroimage.2012.01.021","type":"journal-article","volume":"62","author":"Fischl","year":"2012","journal-title":"NeuroImage"},{"key":"bpexae866fbib35","doi-asserted-by":"publisher","first-page":"825","DOI":"10.1006\/nimg.2002.1132","type":"journal-article","volume":"17","author":"Jenkinson","year":"2002","journal-title":"NeuroImage"},{"key":"bpexae866fbib36","first-page":"pp 606","type":"conference-proceedings","article-title":"The effective rank: a measure of effective dimensionality","author":"Roy","year":"2007"},{"key":"bpexae866fbib37","first-page":"pp 1765","type":"conference-proceedings","article-title":"universal adversarial perturbations","author":"Moosavi-Dezfooli","year":"2017"}],"container-title":["Biomedical Physics &amp; Engineering Express"],"original-title":[],"link":[{"URL":"https:\/\/iopscience.iop.org\/article\/10.1088\/2057-1976\/ae866f","content-type":"text\/html","content-version":"am","intended-application":"text-mining"},{"URL":"https:\/\/iopscience.iop.org\/article\/10.1088\/2057-1976\/ae866f\/pdf","content-type":"application\/pdf","content-version":"am","intended-application":"text-mining"},{"URL":"https:\/\/iopscience.iop.org\/article\/10.1088\/2057-1976\/ae866f","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/iopscience.iop.org\/article\/10.1088\/2057-1976\/ae866f\/pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/iopscience.iop.org\/article\/10.1088\/2057-1976\/ae866f\/pdf","content-type":"application\/pdf","content-version":"am","intended-application":"syndication"},{"URL":"https:\/\/iopscience.iop.org\/article\/10.1088\/2057-1976\/ae866f\/pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/iopscience.iop.org\/article\/10.1088\/2057-1976\/ae866f\/pdf","content-type":"application\/pdf","content-version":"am","intended-application":"similarity-checking"},{"URL":"https:\/\/iopscience.iop.org\/article\/10.1088\/2057-1976\/ae866f\/pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T05:23:53Z","timestamp":1784179433000},"score":1,"resource":{"primary":{"URL":"https:\/\/iopscience.iop.org\/article\/10.1088\/2057-1976\/ae866f"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7,16]]},"references-count":37,"journal-issue":{"issue":"4","published-online":{"date-parts":[[2026,7,16]]},"published-print":{"date-parts":[[2026,8,1]]}},"URL":"https:\/\/doi.org\/10.1088\/2057-1976\/ae866f","relation":{"has-review":[{"id-type":"doi","id":"10.1088\/2057-1976\/AE866F\/v2\/decision1","asserted-by":"object"},{"id-type":"doi","id":"10.1088\/2057-1976\/AE866F\/v2\/response1","asserted-by":"object"},{"id-type":"doi","id":"10.1088\/2057-1976\/AE866F\/v1\/review1","asserted-by":"object"},{"id-type":"doi","id":"10.1088\/2057-1976\/AE866F\/v1\/decision1","asserted-by":"object"},{"id-type":"doi","id":"10.1088\/2057-1976\/AE866F\/v1\/review2","asserted-by":"object"},{"id-type":"doi","id":"10.1088\/2057-1976\/AE866F\/v2\/review1","asserted-by":"object"},{"id-type":"doi","id":"10.1088\/2057-1976\/AE866F\/v2\/review2","asserted-by":"object"}]},"ISSN":["2057-1976"],"issn-type":[{"value":"2057-1976","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,7,16]]},"assertion":[{"value":"Adversarial attacks on a multimodal Alzheimer\u2019s disease detection system reveal complex interdependences between heterogeneous modalities","name":"article_title","label":"Article Title"},{"value":"Biomedical Physics & Engineering Express","name":"journal_title","label":"Journal Title"},{"value":"paper","name":"article_type","label":"Article Type"},{"value":"\u00a9 2026 IOP Publishing Ltd. All rights, including for text and data mining, AI training, and similar technologies, are reserved.","name":"copyright_information","label":"Copyright Information"},{"value":"2026-04-30","name":"date_received","label":"Date Received","group":{"name":"publication_dates","label":"Publication dates"}},{"value":"2026-07-06","name":"date_accepted","label":"Date Accepted","group":{"name":"publication_dates","label":"Publication dates"}},{"value":"2026-07-16","name":"date_epub","label":"Online publication date","group":{"name":"publication_dates","label":"Publication dates"}}]}}