1. Senior Projects 2024

Adversarial Attack and Defense Mechanisms for Image Classification Models in Healthcare

Project ID = F24SDP 39 CS M

Supervisor: Rehab Duwairi

Ahmed Hagana, Faisal Elbadri, Ibrahim Shatah, Rashid Nafwa

The field of artificial intelligence (AI) has witnessed rapid advancements, particularly in image classification, where AI models are now integral to critical domains such as healthcare, autonomous vehicles, and security systems. However, this growing reliance exposes a fundamental vulnerability: adversarial attacks. These attacks intentionally manipulate model inputs to induce incorrect predictions, posing significant risks in sensitive applications like medical diagnosis. Misclassification in such contexts can have severe consequences, highlighting the urgent need to enhance model robustness against adversarial perturbations. This project presents a comprehensive approach to improving the adversarial resilience of image classification models, focusing on black-box attacks, including Boundary Attack and Sign-OPT Attack. At the core of the system is the MobileViT model, specialized for detecting brain tumors in MRI scans using a curated medical imaging dataset. The primary challenge addressed is the model’s susceptibility to adversarial perturbations that could compromise diagnostic integrity. To mitigate this risk, adversarial training techniques were employed, incorporating adversarial examples directly into the training process to improve the model’s ability to correctly classify both clean and perturbed inputs. Beyond standard adversarial training, the system adopts a modular, layered architecture, promoting flexibility, scalability, and easier experimentation. Key components include automated generation of adversarial samples, continuous monitoring of model performance on both clean and adversarial datasets, and a robust reporting framework for evaluating resilience. A dual optimization strategy was implemented: first maximizing clean dataset accuracy, then enhancing adversarial robustness without sacrificing performance. Ethical considerations and transparency were central to the methodology, ensuring that adversarial techniques were applied responsibly, especially in healthcare settings where trustworthiness is critical. Robustness evaluation was conducted through simulated adversarial conditions: Exposure Attack, Distortion Attack, and Combined Attack scenarios. These varied perturbations provided a comprehensive understanding of the model’s defensive capabilities. Experimental results demonstrated that the adversarially trained MobileViT model significantly outperformed the baseline model across clean and adversarial datasets. Enhancements in robustness were observed without major degradation in clean accuracy, affirming the effectiveness of the proposed defense strategy. This work establishes a solid foundation for future research in secure AI for healthcare, ensuring that machine learning systems remain reliable, transparent, and ethically aligned in high-risk environments. In conclusion, the project delivers a practical, ethically grounded approach to strengthening adversarial robustness in healthcare-focused AI systems. Through the integration of adversarial training, modular system design, and continuous robustness evaluation, this research advances the development of safer, more trustworthy machine learning solutions.