{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,6]],"date-time":"2026-03-06T18:48:15Z","timestamp":1772822895771,"version":"3.50.1"},"reference-count":44,"publisher":"MDPI AG","issue":"2","license":[{"start":{"date-parts":[[2022,2,4]],"date-time":"2022-02-04T00:00:00Z","timestamp":1643932800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001691","name":"Japan Society for the Promotion of Science","doi-asserted-by":"publisher","award":["JP21H03545"],"award-info":[{"award-number":["JP21H03545"]}],"id":[{"id":"10.13039\/501100001691","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["J. Imaging"],"abstract":"<jats:p>Transfer learning from natural images is used in deep neural networks (DNNs) for medical image classification to achieve a computer-aided clinical diagnosis. Although the adversarial vulnerability of DNNs hinders practical applications owing to the high stakes of diagnosis, adversarial attacks are expected to be limited because training datasets (medical images), which are often required for adversarial attacks, are generally unavailable in terms of security and privacy preservation. Nevertheless, in this study, we demonstrated that adversarial attacks are also possible using natural images for medical DNN models with transfer learning, even if such medical images are unavailable; in particular, we showed that universal adversarial perturbations (UAPs) can also be generated from natural images. UAPs from natural images are useful for both non-targeted and targeted attacks. The performance of UAPs from natural images was significantly higher than that of random controls. The use of transfer learning causes a security hole, which decreases the reliability and safety of computer-based disease diagnosis. Model training from random initialization reduced the performance of UAPs from natural images; however, it did not completely avoid vulnerability to UAPs. The vulnerability of UAPs to natural images is expected to become a significant security threat.<\/jats:p>","DOI":"10.3390\/jimaging8020038","type":"journal-article","created":{"date-parts":[[2022,2,4]],"date-time":"2022-02-04T11:35:17Z","timestamp":1643974517000},"page":"38","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":20,"title":["Natural Images Allow Universal Adversarial Attacks on Medical Image Classification Using Deep Neural Networks with Transfer Learning"],"prefix":"10.3390","volume":"8","author":[{"given":"Akinori","family":"Minagi","sequence":"first","affiliation":[{"name":"Department of Bioscience and Bioinformatics, Kyushu Institute of Technology, Iizuka 820-8502, Fukuoka, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Hokuto","family":"Hirano","sequence":"additional","affiliation":[{"name":"Department of Bioscience and Bioinformatics, Kyushu Institute of Technology, Iizuka 820-8502, Fukuoka, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6355-1366","authenticated-orcid":false,"given":"Kauzhiro","family":"Takemoto","sequence":"additional","affiliation":[{"name":"Department of Bioscience and Bioinformatics, Kyushu Institute of Technology, Iizuka 820-8502, Fukuoka, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2022,2,4]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"211","DOI":"10.1007\/s11263-015-0816-y","article-title":"ImageNet large scale visual recognition challenge","volume":"115","author":"Russakovsky","year":"2015","journal-title":"Int. J. Comput. Vis."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"60","DOI":"10.1016\/j.media.2017.07.005","article-title":"A survey on deep learning in medical image analysis","volume":"42","author":"Litjens","year":"2017","journal-title":"Med. Image Anal."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Szegedy, C., Vanhoucke, V., Ioffe, S., Shlens, J., and Wojna, Z. (2016, January 27\u201330). Rethinking the inception architecture for computer vision. Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Las Vegas, NV, USA.","DOI":"10.1109\/CVPR.2016.308"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S., and Sun, J. (2016, January 27\u201330). Deep residual learning for image recognition. Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Las Vegas, NV, USA.","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"115","DOI":"10.1038\/nature21056","article-title":"Dermatologist-level classification of skin cancer with deep neural networks","volume":"542","author":"Esteva","year":"2017","journal-title":"Nature"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"1122","DOI":"10.1016\/j.cell.2018.02.010","article-title":"Identifying medical diagnoses and treatable diseases by image-based deep learning","volume":"172","author":"Kermany","year":"2018","journal-title":"Cell"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"e271","DOI":"10.1016\/S2589-7500(19)30123-2","article-title":"A comparison of deep learning performance against health-care professionals in detecting diseases from medical imaging: A systematic review and meta-analysis","volume":"1","author":"Liu","year":"2019","journal-title":"Lancet Digit. Health"},{"key":"ref_8","unstructured":"Goodfellow, I.J., Shlens, J., and Szegedy, C. (2014). Explaining and harnessing adversarial examples. arXiv."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"2805","DOI":"10.1109\/TNNLS.2018.2886017","article-title":"Adversarial examples: Attacks and defenses for deep learning","volume":"30","author":"Yuan","year":"2019","journal-title":"IEEE Trans. Neural Networks Learn. Syst."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Ortiz-Jimenez, G., Modas, A., Moosavi-Dezfooli, S.-M., and Frossard, P. (2020). Optimism in the face of adversity: Understanding and improving deep learning through adversarial robustness. arXiv.","DOI":"10.1109\/JPROC.2021.3050042"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"305","DOI":"10.1038\/s42256-020-0186-1","article-title":"Secure, privacy-preserving and federated machine learning in medical imaging","volume":"2","author":"Kaissis","year":"2020","journal-title":"Nat. Mach. Intell."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"1287","DOI":"10.1126\/science.aaw4399","article-title":"Adversarial attacks on medical machine learning","volume":"363","author":"Finlayson","year":"2019","journal-title":"Science"},{"key":"ref_13","unstructured":"Matyasko, A., and Chau, L.-P. (2018, January 4). Improved network robustness with adversary critic. Proceedings of the 32nd International Conference on Neural Information Processing Systems, Montreal, QC, Canada."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"87","DOI":"10.1007\/978-3-030-02628-8_10","article-title":"Vulnerability analysis of chest X-ray image classification against adversarial attacks","volume":"Volume 11038","author":"Das","year":"2018","journal-title":"Understanding and Interpreting Machine Learning in Medical Image Computing Applications"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Hirano, H., Minagi, A., and Takemoto, K. (2021). Universal adversarial attacks on deep neural networks for medical image classification. BMC Med. Imaging, 21.","DOI":"10.1186\/s12880-020-00530-y"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli, S.M., Fawzi, A., Fawzi, O., and Frossard, P. (2017, January 21\u201326). Universal adversarial perturbations. Proceedings of the 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Honolulu, HI, USA.","DOI":"10.1109\/CVPR.2017.17"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Hirano, H., and Takemoto, K. (2020). Simple iterative method for generating targeted universal adversarial perturbations. Algorithms, 13.","DOI":"10.3390\/a13110268"},{"key":"ref_18","unstructured":"Wallach, H., Larochelle, H., Beygelzimer, A., Alch\u00e9-Buc, F., Fox, E., and Garnett, R. (2019). Transfusion: Understanding transfer learning for medical imaging. Advances in Neural Information Processing Systems 32, Curran Associates, Inc."},{"key":"ref_19","unstructured":"Simonyan, K., and Zisserman, A. (2015, January 7\u20139). Very deep convolutional networks for large-scale image recognition. Proceedings of the 3rd International Conference on Learning Representations, ICLR\u20142015 Conference Track Proceedings, San Diego, CA, USA."},{"key":"ref_20","unstructured":"Nicolae, M.-I., Sinn, M., Tran, M.N., Buesser, B., Rawat, A., Wistuba, M., Zantedeschi, V., Baracaldo, N., Chen, B., and Ludwig, H. (2018). Adversarial Robustness Toolbox v1.0.0. arXiv."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Linardatos, P., Papastefanopoulos, V., and Kotsiantis, S. (2020). Explainable AI: A Review of Machine Learning Interpretability Methods. Entropy, 23.","DOI":"10.3390\/e23010018"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Amann, J., Blasimme, A., Vayena, E., Frey, D., and Madai, V.I. (2020). Explainability for artificial intelligence in healthcare: A multidisciplinary perspective. BMC Med. Inform. Decis. Mak., 20.","DOI":"10.1186\/s12911-020-01332-6"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"336","DOI":"10.1007\/s11263-019-01228-7","article-title":"Grad-CAM: Visual explanations from deep networks via gradient-based localization","volume":"128","author":"Selvaraju","year":"2020","journal-title":"Int. J. Comput. Vis."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"19549","DOI":"10.1038\/s41598-020-76550-z","article-title":"COVID-Net: A tailored deep convolutional neural network design for detection of COVID-19 cases from chest X-ray images","volume":"10","author":"Wang","year":"2020","journal-title":"Sci. Rep."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"945","DOI":"10.1093\/jamia\/ocy017","article-title":"Distributed deep learning networks among institutions for medical imaging","volume":"25","author":"Chang","year":"2018","journal-title":"J. Am. Med. Inform. Assoc."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"102141","DOI":"10.1016\/j.media.2021.102141","article-title":"Adversarial attack vulnerability of medical image analysis systems: Unexplored factors","volume":"73","author":"Bortsova","year":"2021","journal-title":"Med. Image Anal."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"89","DOI":"10.1016\/j.cose.2019.04.014","article-title":"POBA-GA: Perturbation optimized black-box adversarial attacks via genetic algorithm","volume":"85","author":"Chen","year":"2019","journal-title":"Comput. Secur."},{"key":"ref_28","unstructured":"Guo, C., Gardner, J.R., You, Y., Wilson, A.G., and Weinberger, K.Q. (2019, January 9\u201315). Simple black-box adversarial attacks. Proceedings of the 36th International Conference on Machine Learning, Long Beach, CA, USA."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Co, K.T., Mu\u00f1oz-Gonz\u00e1lez, L., de Maupeou, S., and Lupu, E.C. (2019, January 11\u201315). Procedural noise adversarial examples for black-box attacks on deep convolutional networks. Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, London, UK.","DOI":"10.1145\/3319535.3345660"},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Marchisio, A., Nanfa, G., Khalid, F., Hanif, M.A., Martina, M., and Shafique, M. (2020, January 19\u201324). Is Spiking Secure? A comparative study on the security vulnerabilities of spiking and deep neural networks. Proceedings of the 2020 International Joint Conference on Neural Networks (IJCNN), Glasgow, UK.","DOI":"10.1109\/IJCNN48605.2020.9207297"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Tsuzuku, Y., and Sato, I. (2019, January 16\u201320). On the structural sensitivity of deep convolutional networks to the directions of Fourier basis functions. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2019, Long Beach, CA, USA.","DOI":"10.1109\/CVPR.2019.00014"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Alzubaidi, L., Al-Amidie, M., Al-Asadi, A., Humaidi, A.J., Al-Shamma, O., Fadhel, M.A., Zhang, J., Santamar\u00eda, J., and Duan, Y. (2021). Novel Transfer Learning Approach for Medical Imaging with Limited Labeled Data. Cancers, 13.","DOI":"10.3390\/cancers13071590"},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Azizi, S., Mustafa, B., Ryan, F., Beaver, Z., Freyberg, J., Deaton, J., Loh, A., Karthikesalingam, A., Kornblith, S., and Chen, T. (2021, January 24\u201326). Big self-supervised models advance medical image classification. Proceedings of the IEEE\/CVF International Conference on Computer Vision (ICCV), New York, NY, USA.","DOI":"10.1109\/ICCV48922.2021.00346"},{"key":"ref_34","unstructured":"Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. (May, January 30). Towards deep learning models resistant to adversarial attacks. Proceedings of the International Conference on Learning Representations, Vancouver, BC, Canada."},{"key":"ref_35","unstructured":"Chaudhuri, K., and Salakhutdinov, R. (2019). Theoretically Principled Trade-Off Between Robustness and Accuracy, Proceedings of the 36th International Conference on Machine Learning, Long Beach, CA, USA, 9\u201315 June 2019, PMLR."},{"key":"ref_36","unstructured":"Xiao, C., Zhong, P., and Zheng, C. (2020, January 4\u20138). Enhancing adversarial defense by k-winners-take-all. Proceedings of the 8th International Conference Learning Represent, Vienna, Austria."},{"key":"ref_37","unstructured":"Song, C., He, K., Wang, L., and Hopcroft, J.E. (2019, January 6\u20139). Improving the generalization of adversarial training with domain adaptation. Proceedings of the 7th International Conference Learning Represent, ICLR, New Orleans, LA, USA."},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"126582","DOI":"10.1109\/ACCESS.2019.2939352","article-title":"PuVAE: A variational autoencoder to purify adversarial examples","volume":"7","author":"Hwang","year":"2019","journal-title":"IEEE Access"},{"key":"ref_39","unstructured":"Croce, F., and Hein, M. (2020, January 3\u20137). Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. Proceedings of the 37th International Conference Machine Learning, Long Beach, CA, USA."},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Carlini, N., and Wagner, D. (2017, January 3). Adversarial examples are not easily detected. Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security\u2014AISec \u201917, Dallas, TX, USA.","DOI":"10.1145\/3128572.3140444"},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1007\/s10462-021-10125-w","article-title":"Adversarial example detection for DNN models: A review and experimental comparison","volume":"55","author":"Aldahdooh","year":"2022","journal-title":"Artif. Intell. Rev."},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"107332","DOI":"10.1016\/j.patcog.2020.107332","article-title":"Understanding adversarial attacks on deep learning based medical image analysis systems","volume":"110","author":"Ma","year":"2021","journal-title":"Pattern Recognit."},{"key":"ref_43","unstructured":"Subramanya, A., Pillai, V., and Pirsiavash, H. (November, January 27). Fooling network interpretation in image classification. Proceedings of the IEEE\/CVF International Conference on Computer Vision (ICCV), Seoul, Korea."},{"key":"ref_44","first-page":"17886","article-title":"Adversarially robust few-shot learning: A meta-learning approach","volume":"Volume 33","author":"Larochelle","year":"2020","journal-title":"Advances in Neural Information Processing Systems"}],"container-title":["Journal of Imaging"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2313-433X\/8\/2\/38\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T22:14:04Z","timestamp":1760134444000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2313-433X\/8\/2\/38"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,2,4]]},"references-count":44,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2022,2]]}},"alternative-id":["jimaging8020038"],"URL":"https:\/\/doi.org\/10.3390\/jimaging8020038","relation":{"has-preprint":[{"id-type":"doi","id":"10.21203\/rs.3.rs-757225\/v2","asserted-by":"object"},{"id-type":"doi","id":"10.21203\/rs.3.rs-757225\/v1","asserted-by":"object"}]},"ISSN":["2313-433X"],"issn-type":[{"value":"2313-433X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,2,4]]}}}