{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,13]],"date-time":"2025-11-13T05:23:51Z","timestamp":1763011431831,"version":"3.45.0"},"reference-count":36,"publisher":"MDPI AG","issue":"11","license":[{"start":{"date-parts":[[2025,11,11]],"date-time":"2025-11-11T00:00:00Z","timestamp":1762819200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100017691","name":"Key Research and Development Program of Guangxi","doi-asserted-by":"crossref","award":["AB23026120","AB24010085","AA24263010"],"award-info":[{"award-number":["AB23026120","AB24010085","AA24263010"]}],"id":[{"id":"10.13039\/501100017691","id-type":"DOI","asserted-by":"crossref"}]},{"name":"Open Project Program of Guangxi Key Laboratory of Digital Infrastructure","award":["GXDIOP2024019"],"award-info":[{"award-number":["GXDIOP2024019"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"crossref","award":["62462019","62561018","62172350"],"award-info":[{"award-number":["62462019","62561018","62172350"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100004607","name":"Natural Science Foundation of Guangxi Zhuang Autonomous Region","doi-asserted-by":"publisher","award":["2025GXNSFBA069410"],"award-info":[{"award-number":["2025GXNSFBA069410"]}],"id":[{"id":"10.13039\/501100004607","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100021171","name":"Guangdong Basic and Applied Basic Research Foundation","doi-asserted-by":"crossref","award":["2023A1515012846"],"award-info":[{"award-number":["2023A1515012846"]}],"id":[{"id":"10.13039\/501100021171","id-type":"DOI","asserted-by":"crossref"}]},{"name":"Basic Scientific Research Ability Improvement Project for Young and Middle-aged Teachers of Guangxi Higher Education Institutions","award":["2024KY0233","2025KY0243"],"award-info":[{"award-number":["2024KY0233","2025KY0243"]}]},{"name":"Open Project Program of Joint International Research Laboratory of Spatio-temporal Information and Intelligent Location Services","award":["C25GAH10","C25GAH12"],"award-info":[{"award-number":["C25GAH10","C25GAH12"]}]},{"name":"Open Project Program of Key Laboratory of Equipment Data Security and Guarantee Technology, Ministry of Education","award":["GDZB2024060500"],"award-info":[{"award-number":["GDZB2024060500"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["J. Imaging"],"abstract":"<jats:p>The rise in trusted machine learning has prompted concerns about the security, reliability and controllability of deep learning, especially when it is applied to sensitive areas involving life and health safety. To thoroughly analyze potential attacks and promote innovation in security technologies for DNNs, this paper conducts research on adversarial attacks against medical images and proposes a medical image attack method that focuses on lesion areas and has good transferability, named LatAtk. First, based on the image segmentation algorithm, LatAtk divides the target image into an attackable area (lesion area) and a non-attackable area and injects perturbations into the attackable area to disrupt the attention of the DNNs. Second, a class activation loss function based on gradient-weighted class activation mapping is proposed. By obtaining the importance of features in images, the features that play a positive role in model decision-making are further disturbed, making LatAtk highly transferable. Third, a texture feature loss function based on local binary patterns is proposed as a constraint to reduce the damage to non-semantic features, effectively preserving texture features of target images and improving the concealment of adversarial samples. Experimental results show that LatAtk has superior aggressiveness, transferability and concealment compared to advanced baselines.<\/jats:p>","DOI":"10.3390\/jimaging11110404","type":"journal-article","created":{"date-parts":[[2025,11,11]],"date-time":"2025-11-11T08:57:41Z","timestamp":1762851461000},"page":"404","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["LatAtk: A Medical Image Attack Method Focused on Lesion Areas with High Transferability"],"prefix":"10.3390","volume":"11","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7693-9722","authenticated-orcid":false,"given":"Long","family":"Li","sequence":"first","affiliation":[{"name":"Joint International Research Laboratory of Spatio-Temporal Information and Intelligent Location Services, Guilin University of Electronic Technology, Guilin 541004, China"},{"name":"Guangxi Key Laboratory of Digital Infrastructure, Guangxi Zhuang Autonomous Region Information Center, Nanning 530201, China"}]},{"given":"Yibo","family":"Huang","sequence":"additional","affiliation":[{"name":"Joint International Research Laboratory of Spatio-Temporal Information and Intelligent Location Services, Guilin University of Electronic Technology, Guilin 541004, China"},{"name":"Key Laboratory of Equipment Data Security and Guarantee Technology, Ministry of Education, Guilin University of Electronic Technology, Guilin 541004, China"}]},{"given":"Chong","family":"Li","sequence":"additional","affiliation":[{"name":"Key Laboratory of Equipment Data Security and Guarantee Technology, Ministry of Education, Guilin University of Electronic Technology, Guilin 541004, China"}]},{"given":"Fei","family":"Zhou","sequence":"additional","affiliation":[{"name":"Guangxi Key Laboratory of Digital Infrastructure, Guangxi Zhuang Autonomous Region Information Center, Nanning 530201, China"}]},{"given":"Jingjing","family":"Li","sequence":"additional","affiliation":[{"name":"Joint International Research Laboratory of Spatio-Temporal Information and Intelligent Location Services, Guilin University of Electronic Technology, Guilin 541004, China"},{"name":"School of Cyber Security, Jinan University, Guangzhou 510632, China"}]},{"given":"Kamarul Hawari","family":"Ghazali","sequence":"additional","affiliation":[{"name":"Faculty of Electrical and Electronics Engineering Technology, Universiti Malaysia Pahang Al-Sultan Abdullah, Pekan 26600, Malaysia"}]}],"member":"1968","published-online":{"date-parts":[[2025,11,11]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"5216","DOI":"10.1109\/JBHI.2023.3292452","article-title":"EEG-based Parkinson\u2019s disease recognition via attention-based sparse graph convolutional neural network","volume":"27","author":"Chang","year":"2023","journal-title":"IEEE J. Biomed. Health Inform."},{"key":"ref_2","first-page":"2739","article-title":"Multi-label retinal disease classification using transformers","volume":"27","author":"AlMarzouqi","year":"2025","journal-title":"IEEE J. Biomed. Health Inform."},{"key":"ref_3","first-page":"3750","article-title":"Predicting progression from mild cognitive impairment to alzheimer\u2019s dementia with adversarial attacks","volume":"28","year":"2025","journal-title":"IEEE J. Biomed. Health Inform."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"5622","DOI":"10.1109\/JBHI.2023.3303494","article-title":"Generative perturbation network for universal adversarial attacks on brain-computer interfaces","volume":"27","author":"Jung","year":"2023","journal-title":"IEEE J. Biomed. Health Inform."},{"key":"ref_5","unstructured":"Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. (2013). Intriguing properties of neural networks. arXiv."},{"key":"ref_6","unstructured":"Goodfellow, I.J., Shlens, J., and Szegedy, C. (2014). Explaining and harnessing adversarial examples. arXiv."},{"key":"ref_7","first-page":"1860","article-title":"Short keynote paper: Mainstreaming personalized healthcare\u2013transforming healthcare through new era of artificial intelligence","volume":"24","author":"Paranjape","year":"2020","journal-title":"IEEE J. Biomed. Health Inform."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"107332","DOI":"10.1016\/j.patcog.2020.107332","article-title":"Understanding adversarial attacks on deep learning based medical image analysis systems","volume":"110","author":"Ma","year":"2021","journal-title":"Pattern Recognit."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"2365","DOI":"10.1109\/JBHI.2023.3336721","article-title":"Explainable AI for medical image analysis in medical cyber-physical systems: Enhancing transparency and trustworthiness of IoMT","volume":"29","author":"Liu","year":"2023","journal-title":"IEEE J. Biomed. Health Inform."},{"key":"ref_10","first-page":"32900","article-title":"Improving adversarial transferability via intermediate-level perturbation decay","volume":"36","author":"Li","year":"2023","journal-title":"Adv. Neural Inf. Process. Syst. (NeurIPS)"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Rosenblatt, M., Dadashkarimi, J., and Scheinost, D. (2023). Gradient-based enhancement attacks in biomedical machine learning. Workshop on Clinical Image-Based Procedures, Springer Nature.","DOI":"10.1007\/978-3-031-45249-9_29"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1038\/sdata.2018.161","article-title":"The HAM10000 dataset, a large collection of multi-source dermatoscopic images of common pigmented skin lesions","volume":"5","author":"Tschandl","year":"2018","journal-title":"Sci. Data"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Sikder, N., Chowdhury, M.S., Arif, A.S.M., and Nahid, A.A. (2019, January 18\u201320). Early blindness detection based on retinal images using ensemble learning. Proceedings of the 22nd International Conference of Computer and Information Technology (ICCIT), Dhaka, Bangladesh.","DOI":"10.1109\/ICCIT48885.2019.9038439"},{"key":"ref_14","unstructured":"Kurakin, A., Goodfellow, I.J., and Bengio, S. (2016). Adversarial examples in the physical world. arXiv."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., and Li, J. (2018, January 18\u201323). Boosting adversarial attacks with momentum. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Salt Lake City, UT, USA.","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Wang, X., and He, K. (2021, January 20\u201325). Enhancing the transferability of adversarial attacks through variance tuning. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Nashville, TN, USA.","DOI":"10.1109\/CVPR46437.2021.00196"},{"key":"ref_17","unstructured":"Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. (2017). Towards deep learning models resistant to adversarial attacks. arXiv."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Carlini, N., and Wagner, D. (2017, January 22\u201326). Towards evaluating the robustness of neural networks. Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP), San Jose, CA, USA.","DOI":"10.1109\/SP.2017.49"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Baluja, S., and Fischer, I. (2017). Adversarial transformation networks: Learning to generate adversarial examples. arXiv.","DOI":"10.1609\/aaai.v32i1.11672"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Xiao, C., Li, B., Zhu, J.Y., He, W., Liu, M., and Song, D. (2018). Generating adversarial examples with adversarial networks. arXiv.","DOI":"10.24963\/ijcai.2018\/543"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Jandial, S., Mangla, P., Varshney, S., and Balasubramanian, V. (2019, January 27\u201328). Advgan++: Harnessing latent layers for adversary generation. Proceedings of the IEEE\/CVF International Conference on Computer Vision Workshops (ICCVW), Seoul, Republic of Korea.","DOI":"10.1109\/ICCVW.2019.00257"},{"key":"ref_22","unstructured":"Wang, X., He, K., Song, C., Wang, L., and Hopcroft, J.E. (2019). AT-GAN: An adversarial generator model for non-constrained adversarial examples. arXiv."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"3608173","DOI":"10.1155\/2020\/3608173","article-title":"Cycle-consistent adversarial GAN: The integration of adversarial attack and defense","volume":"2020","author":"Jiang","year":"2020","journal-title":"Secur. Commun. Netw."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Feng, Y., Wu, B., Fan, Y., Liu, L., Li, Z., and Xia, S.T. (2022, January 18\u201324). Boosting black-box attack with partially transferred conditional adversarial distribution. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), New Orleans, LA, USA.","DOI":"10.1109\/CVPR52688.2022.01467"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Inkawhich, N., Wen, W., Li, H.H., and Chen, Y. (2019, January 15\u201320). Feature space perturbations yield more transferable adversarial examples. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Long Beach, CA, USA.","DOI":"10.1109\/CVPR.2019.00723"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Wang, Z., Guo, H., Zhang, Z., Liu, W., Qin, Z., and Ren, K. (2021, January 10\u201317). Feature importance-aware transferable adversarial attacks. Proceedings of the IEEE\/CVF International Conference on Computer Vision (ICCV), Montreal, QC, Canada.","DOI":"10.1109\/ICCV48922.2021.00754"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Kim, W.J., Hong, S., and Yoon, S.E. (2022, January 16\u201319). Diverse generative perturbations on attention space for transferable adversarial attacks. Proceedings of the 2022 IEEE International Conference on Image Processing (ICIP), Bordeaux, France.","DOI":"10.1109\/ICIP46576.2022.9897346"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"156","DOI":"10.1109\/RBME.2020.3013489","article-title":"Secure and robust machine learning for healthcare: A survey","volume":"14","author":"Qayyum","year":"2020","journal-title":"IEEE Trans. Biomed. Eng."},{"key":"ref_29","unstructured":"Qi, G., Gong, L., Song, Y., Ma, K., and Zheng, Y. (2021). Stabilized medical image attacks. arXiv."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"5323","DOI":"10.1109\/TCYB.2022.3209175","article-title":"A feature space-restricted attention attack on medical deep learning systems","volume":"53","author":"Wang","year":"2022","journal-title":"IEEE Trans. Cybern."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"38","DOI":"10.1016\/j.neucom.2021.08.118","article-title":"DEAttack: A differential evolution based attack method for the robustness evaluation of medical image segmentation","volume":"465","author":"Cui","year":"2021","journal-title":"Neurocomputing"},{"key":"ref_32","first-page":"1","article-title":"Survey on adversarial attack and defense for medical image analysis: Methods and challenges","volume":"57","author":"Dong","year":"2024","journal-title":"ACM Comput. Surv."},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1007\/s10462-024-11005-9","article-title":"Robustness in deep learning models for medical diagnostics: Security and adversarial challenges towards robust AI applications","volume":"58","author":"Javed","year":"2024","journal-title":"Artif. Intell. Rev."},{"key":"ref_34","first-page":"1","article-title":"Improving robustness and reliability in medical image classification with latent-guided diffusion and nested-ensembles","volume":"11","author":"Shen","year":"2025","journal-title":"IEEE Trans. Med. Imaging"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Selvaraju, R.R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., and Batra, D. (2017, January 22\u201329). Grad-CAM: Visual explanations from deep networks via gradient-based localization. Proceedings of the IEEE International Conference on Computer Vision (ICCV), Venice, Italy.","DOI":"10.1109\/ICCV.2017.74"},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Wu, W., Su, Y., Chen, X., Zhao, S., King, I., Lyu, M.R., and Tai, Y.W. (2020, January 13\u201319). Boosting the transferability of adversarial samples via attention. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Seattle, WA, USA.","DOI":"10.1109\/CVPR42600.2020.00124"}],"container-title":["Journal of Imaging"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2313-433X\/11\/11\/404\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,13]],"date-time":"2025-11-13T05:19:23Z","timestamp":1763011163000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2313-433X\/11\/11\/404"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,11]]},"references-count":36,"journal-issue":{"issue":"11","published-online":{"date-parts":[[2025,11]]}},"alternative-id":["jimaging11110404"],"URL":"https:\/\/doi.org\/10.3390\/jimaging11110404","relation":{},"ISSN":["2313-433X"],"issn-type":[{"type":"electronic","value":"2313-433X"}],"subject":[],"published":{"date-parts":[[2025,11,11]]}}}