Training-Free Defense Against Adversarial Attacks in Deep Learning MRI Reconstruction

TL;DR

This paper introduces a training-free method to defend against adversarial attacks in MRI reconstruction, effectively reducing distortions caused by small perturbations without retraining the model.

Contribution

The authors propose a novel cyclic measurement consistency-based mitigation approach that works without retraining and outperforms traditional methods in various attack scenarios.

Findings

Significantly reduces adversarial impact across datasets and attack types

Outperforms retraining-based mitigation methods in quality metrics

Effective in blind and adaptive attack scenarios

Abstract

Deep learning (DL) methods have become the state-of-the-art for reconstructing sub-sampled magnetic resonance imaging (MRI) data. However, studies have shown that these methods are susceptible to small adversarial input perturbations, or attacks, resulting in major distortions in the output images. Various strategies have been proposed to reduce the effects of these attacks, but they require retraining and may lower reconstruction quality for non-perturbed/clean inputs. In this work, we propose a novel approach for mitigating adversarial attacks on MRI reconstruction models without any retraining. Based on the idea of cyclic measurement consistency, we devise a novel mitigation objective that is minimized in a small ball around the attack input. Results show that our method substantially reduces the impact of adversarial perturbations across different datasets, attack types/strengths and PD-DL networks, and qualitatively and quantitatively outperforms conventional mitigation methods that involve retraining. We also introduce a practically relevant scenario for small adversarial perturbations that models impulse noise in raw data, which relates to \emph{herringbone artifacts}, and show the applicability of our approach in this setting. Finally, we show our mitigation approach remains effective in two \emph{realistic} extension scenarios: a blind setup, where the attack strength or algorithm is not known to the user; and an adaptive attack setup, where the attacker has full knowledge of the defense strategy.