Adversarial Robustness of MR Image Reconstruction under Realistic Perturbations

TL;DR

This study investigates the vulnerability of deep learning-based MRI reconstruction methods to realistic adversarial perturbations, revealing that current models can be significantly misled, risking diagnostic accuracy in clinical settings.

Contribution

The paper introduces targeted adversarial attack models on MRI reconstruction algorithms and compares their robustness, highlighting vulnerabilities of state-of-the-art methods like E2E-VarNet and UNet.

Findings

Both models are sensitive to adversarial noise and rotations.

Adversarial perturbations can cause loss of diagnostic information.

Sensitivity levels are similar across different model complexities.

Abstract

Deep Learning (DL) methods have shown promising results for solving ill-posed inverse problems such as MR image reconstruction from undersampled $k$-space data. However, these approaches currently have no guarantees for reconstruction quality and the reliability of such algorithms is only poorly understood. Adversarial attacks offer a valuable tool to understand possible failure modes and worst case performance of DL-based reconstruction algorithms. In this paper we describe adversarial attacks on multi-coil $k$-space measurements and evaluate them on the recently proposed E2E-VarNet and a simpler UNet-based model. In contrast to prior work, the attacks are targeted to specifically alter diagnostically relevant regions. Using two realistic attack models (adversarial $k$-space noise and adversarial rotations) we are able to show that current state-of-the-art DL-based reconstruction algorithms are indeed sensitive to such perturbations to a degree where relevant diagnostic information may be lost. Surprisingly, in our experiments the UNet and the more sophisticated E2E-VarNet were similarly sensitive to such attacks. Our findings add further to the evidence that caution must be exercised as DL-based methods move closer to clinical practice.