Skip to main content

Table 1 Fooling rates \(R_{f}\) (%) of nontargeted UAPs against various DNN models for test images of skin lesions, OCT, and chest X-ray image datasets

From: Universal adversarial attacks on deep neural networks for medical image classification

Model architecture Skin lesions OCT Chest X-ray
\(p = 2\) \(p = \infty\) \(p = 2\) \(p = \infty\) \(p = 2\) \(p = \infty\)
Inception V3 92.2 (14.1) 90.0 (11.8) 70.2 (1.0) 73.9 (3.4) 81.7 (2.4) 79.8 (3.0)
VGG16 87.6 (4.9) 86.4 (3.5) 72.4 (0.2) 74.9 (1.8) 49.8 (2.2) 50.0 (2.2)
VGG19 89.2 (5.2) 87.0 (3.7) 72.8 (0.4) 74.7 (2.1) 49.3 (3.9) 49.3 (4.4)
ResNet50 91.9 (11.6) 87.9 (10.1) 71.2 (1.1) 74.8 (5.4) 72.6 (7.2) 73.0 (7.4)
Inception ResNet V2 94.5 (16.7) 90.3 (15.2) 69.6 (1.4) 74.0 (3.2) 78.0 (2.6) 77.0 (3.3)
DenseNet 121 93.8 (12.0) 82.9 (10.2) 68.8 (1.3) 73.0 (3.6) 69.8 (3.9) 71.7 (4.1)
DenseNet 169 93.8 (11.7) 84.2 (9.1) 50.3 (1.3) 72.3 (4.0) 67.6 (2.8) 71.3 (3.7)
  1. \(\zeta = 4\%\) for the skin lesions and chest X-ray image datasets. \(\zeta = 6\%\) for the OCT image dataset. Values in brackets are \(R_{f}\) of random UAPs (random controls)