Table 1 Fooling rates \(R_{f}\) (%) of nontargeted UAPs against various DNN models for test images of skin lesions, OCT, and chest X-ray image datasets
From: Universal adversarial attacks on deep neural networks for medical image classification
Model architecture | Skin lesions | OCT | Chest X-ray | |||
|---|---|---|---|---|---|---|
\(p = 2\) | \(p = \infty\) | \(p = 2\) | \(p = \infty\) | \(p = 2\) | \(p = \infty\) | |
Inception V3 | 92.2 (14.1) | 90.0 (11.8) | 70.2 (1.0) | 73.9 (3.4) | 81.7 (2.4) | 79.8 (3.0) |
VGG16 | 87.6 (4.9) | 86.4 (3.5) | 72.4 (0.2) | 74.9 (1.8) | 49.8 (2.2) | 50.0 (2.2) |
VGG19 | 89.2 (5.2) | 87.0 (3.7) | 72.8 (0.4) | 74.7 (2.1) | 49.3 (3.9) | 49.3 (4.4) |
ResNet50 | 91.9 (11.6) | 87.9 (10.1) | 71.2 (1.1) | 74.8 (5.4) | 72.6 (7.2) | 73.0 (7.4) |
Inception ResNet V2 | 94.5 (16.7) | 90.3 (15.2) | 69.6 (1.4) | 74.0 (3.2) | 78.0 (2.6) | 77.0 (3.3) |
DenseNet 121 | 93.8 (12.0) | 82.9 (10.2) | 68.8 (1.3) | 73.0 (3.6) | 69.8 (3.9) | 71.7 (4.1) |
DenseNet 169 | 93.8 (11.7) | 84.2 (9.1) | 50.3 (1.3) | 72.3 (4.0) | 67.6 (2.8) | 71.3 (3.7) |