Table 2 Targeted attack success rates \(R_{s}\) (%) of targeted UAPs with \(p = 2\) against various DNN models to each target class
From: Universal adversarial attacks on deep neural networks for medical image classification
Model architecture/target class | Skin lesions | OCT | Chest X-ray | |||
|---|---|---|---|---|---|---|
NV | MEL | NM | CNV | NORMAL | PNEUMONIA | |
Inception V3 | 93.3 (65.6) | 94.4 (12.2) | 84.1 (25.7) | 95.9 (24.8) | 96.1 (52.8) | 93.3 (47.2) |
VGG16 | 89.6 (71.7) | 40.4 (8.3) | 32.4 (25.4) | 97.7 (24.9) | 95.6 (50.2) | 95.0 (49.8) |
VGG19 | 91.6 (72.1) | 64.6 (8.7) | 41.2 (25.9) | 97.5 (24.9) | 97.6 (51.7) | 95.2 (48.3) |
ResNet50 | 97.9 (66.5) | 92.4 (11.8) | 84.9 (25.8) | 98.5 (24.5) | 95.7 (53.5) | 95.2 (46.5) |
Inception ResNet V2 | 92.4 (61.0) | 97.3 (16.1) | 84.5 (25.6) | 96.2 (24.7) | 98.3 (53.1) | 93.9 (46.9) |
DenseNet 121 | 92.1 (65.2) | 90.5 (13.4) | 41.8 (25.3) | 88.1 (24.7) | 94.8 (51.9) | 92.0 (48.1) |
DenseNet 169 | 92.9 (65.8) | 92.9 (12.2) | 41.7 (25.0) | 92.7 (24.2) | 95.7 (52.0) | 93.1 (48.0) |