Skip to main content

Table 2 Targeted attack success rates \(R_{s}\) (%) of targeted UAPs with \(p = 2\) against various DNN models to each target class

From: Universal adversarial attacks on deep neural networks for medical image classification

Model architecture/target class Skin lesions OCT Chest X-ray
NV MEL NM CNV NORMAL PNEUMONIA
Inception V3 93.3 (65.6) 94.4 (12.2) 84.1 (25.7) 95.9 (24.8) 96.1 (52.8) 93.3 (47.2)
VGG16 89.6 (71.7) 40.4 (8.3) 32.4 (25.4) 97.7 (24.9) 95.6 (50.2) 95.0 (49.8)
VGG19 91.6 (72.1) 64.6 (8.7) 41.2 (25.9) 97.5 (24.9) 97.6 (51.7) 95.2 (48.3)
ResNet50 97.9 (66.5) 92.4 (11.8) 84.9 (25.8) 98.5 (24.5) 95.7 (53.5) 95.2 (46.5)
Inception ResNet V2 92.4 (61.0) 97.3 (16.1) 84.5 (25.6) 96.2 (24.7) 98.3 (53.1) 93.9 (46.9)
DenseNet 121 92.1 (65.2) 90.5 (13.4) 41.8 (25.3) 88.1 (24.7) 94.8 (51.9) 92.0 (48.1)
DenseNet 169 92.9 (65.8) 92.9 (12.2) 41.7 (25.0) 92.7 (24.2) 95.7 (52.0) 93.1 (48.0)
  1. \(R_{s}\) was for test images, \(\zeta = 2\%\) for the skin lesions and chest X-ray image datasets, and \(\zeta = 6\%\) for the OCT image dataset. Values in brackets are \(R_{s}\) of random UAPs (random controls)