Research map / Adversarial robustness and security / Certified and empirical robustness

Adversarial Learning Under Hybrid Perturbations for Robust Acute Lymphoblastic Leukemia Classification

AAAI 2025 · Adversarial robustness and security › Certified and empirical robustness · approach: Attack evaluation and defense critique · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes HPAT, an adversarial training method for leukemia cell classification that combines PGD pixel-level perturbations with Bayesian-optimization-searched spatial transforms, plus a mixed batch normalization module, evaluated on C-NMC.

Problem

Acute lymphoblastic leukemia cell classifiers are vulnerable to simultaneous pixel-level device noise and rotation/translation perturbations, which can flip predictions and undermine robustness in clinical use.

Approach

Generate hybrid adversarial examples by chaining PGD pixel perturbations with spatial transforms whose parameters are found by Bayesian optimization (expected improvement), and train with a MixBN module that uses separate batch-norm branches for clean and adversarial inputs to limit clean-accuracy loss.

Key results

• EfficientNet-B3 is the best standard benchmark on C-NMC (ACC 84.524, AUC 91.681), and the standard model's accuracy under hybrid perturbations drops from 84.5% to 48.3%.
• Adding MixBN to AdvRT raises ACC from 80.824 to 82.110 and to Advh from 75.416 to 77.647.
• STBO yields lower ROI curves than grid-search STM, indicating harder adversarial examples for the same search budget.

Measured effects reported in the paper

Surprising findings

• Advh with MixBN (ACC 77.647) scores lower on clean ACC than the AdvRT variant (82.110), so hybrid training costs clean accuracy despite robustness gains.

Limitations

• Robustness evaluated only on a single public dataset (C-NMC) and a single backbone trained on the adversarial mixture.
• No comparison to stronger hybrid or certified defenses; baselines are mostly standard classifiers and single-perturbation adversarial training.
• Hyperparameters and compute cost are sparsely reported; no code or weights released.

Experimental setup

Datasets: C-NMC (ISBI-2019 B-ALL challenge)

Benchmarks: C-NMC

Metrics: ACC PRE F1 AUC ROI (rate of invariance)

Baselines: DenseNet-201 ResNet50 VGG16 SE-ResNet50Xt EfficientNet-B3 AdvPGD AdvFGSM AdvRT STM grid search

Builds on: Projected Gradient Descent (Madry et al. 2018) Engstrom et al. 2019 spatial robustness via grid search Kamath et al. 2021 rate of invariance Mixed batch normalization (Xie et al. 2020 AdvProp-style)

Closest papers by meaning

• NaFV-Net: An Adversarial Four-view Network for Mammogram Classification (AAAI 2025 · similarity 0.82)
• Prompt2Perturb (P2P): Text-Guided Diffusion-Based Adversarial Attack on Breast Ultrasound Images (CVPR 2025 · similarity 0.81)
• Uni-Hema: Unified Model for Digital Hematopathology (CVPR 2026 · similarity 0.81)
• Attacking CNNs in Histopathology with SNAP: Sporadic and Naturalistic Adversarial Patches (Student Abstract) (AAAI 2024 · similarity 0.81)
• Prototypical Information Bottlenecking and Disentangling for Multimodal Cancer Survival Prediction (ICLR 2024 · similarity 0.80)
• Taxonomy Driven Fast Adversarial Training (AAAI 2024 · similarity 0.80)