SEDA: Self-Ensembling ViT with Defensive Distillation and Adversarial Training for robust Chest X-rays Classification
Extracted source text · arXiv 2308.07874
% This is samplepaper.tex, a sample chapter demonstrating the
% LLNCS macro package for Springer Computer Science proceedings;
% Version 2.20 of 2017/10/04
%
\documentclass[runningheads]{llncs}
%
\usepackage{graphicx}
\usepackage{multirow}
\usepackage{algorithm}
\usepackage{algpseudocode}
\usepackage{makecell}
\usepackage{color, colortbl}
\usepackage{amsmath}
\usepackage{hyperref}
\definecolor{Gray}{gray}{0.9}
\definecolor{LightCyan}{rgb}{0.88,1,1}
\definecolor{amber}{rgb}{1.0, 0.75, 0.0}
\definecolor{sunset}{rgb}{0.98, 0.92, 0.84}
%
% If you use the hyperref package, please uncomment the following line
% to display URLs in blue roman font according to Springer's eBook style:
% \renewcommand\UrlFont{\color{blue}\rmfamily}
\begin{document}
%
% \title{On enhancement of SEViT for Chest XRay Classification using Defensive Distillation and Adversarial Training}
\title{SEDA: Self-Ensembling ViT with Defensive Distillation and Adversarial Training for robust Chest X-rays Classification}
%
\titlerunning{SEDA}
% If the paper title is too long for the running head, you can set
% an abbreviated paper title here
%
\author{Raza Imam\and
Ibrahim Almakky\and
Salma Alrashdi\and
Baketah Alrashdi\and
Mohammad Yaqub}
% \author{*}
%
\authorrunning{R. Imam et al.}
% \authorrunning{*}
% First names are abbreviated in the running head.
% If there are more than two authors, 'et al.' is used.
%
\institute{Mohamed Bin Zayed University of Artificial Intelligence, Abu Dhabi, UAE\\
\email{\{raza.imam, ibrahim.almakky, salma.alrashdi, baketah.alrashdi, mohammad.yaqub\}@mbzuai.ac.ae}}
% \institute{*}
%
\maketitle % typeset the header of the contribution
%
\begin{abstract}
% With increased adoption of Deep Learning methods in medical imaging, where elevated vulnerabilities have been explored in recent Convolutional Neural Network (CNN) and Vision Transformer (ViT) based solutions.
Deep Learning methods have recently seen increased adoption in medical imaging applications. However, elevated vulnerabilities have been explored in recent Deep Learning solutions, which can hinder future adoption.
% Convolutional Neural Network (CNN) and Vision Transformer (ViT) based solutions.
Particularly, the vulnerability of Vision Transformer (ViT) to adversarial, privacy, and confidentiality attacks raise serious concerns about their reliability in medical settings. This work aims to enhance the robustness of self-ensembling ViTs for the tuberculosis chest x-ray classification task. We propose \underline{S}elf-\underline{E}nsembling ViT with defensive \underline{D}istillation and \underline{A}dversarial training (SEDA). SEDA utilizes efficient CNN blocks to learn spatial features with various levels of abstraction from feature representations extracted from intermediate ViT blocks, that are largely unaffected by adversarial perturbations. Furthermore, SEDA leverages adversarial training in combination with defensive distillation for improved robustness against adversaries.
Training using adversarial examples leads to better model generalizability and improves its ability to handle perturbations. Distillation using soft probabilities introduces uncertainty and variation into the output probabilities, making it more difficult for adversarial and privacy attacks.
Extensive experiments performed with the proposed architecture and training paradigm on publicly available Tuberculosis x-ray dataset shows SOTA efficacy of SEDA compared to SEViT in terms of computational efficiency with $70\times$ times lighter framework and enhanced robustness of +9\%. Code: \href{https://github.com/Razaimam45/SEDA}{Github}.
% for improved computational efficiency and robustness utilizing the adversarial training and defensive distillation.
% CNN's efficiency in learning spatial features through convolution operations at various levels of abstraction,
% The proposed approach leverages the fact that adversarial training when performed with the combination of defensive distillation, presents significantly higher robustness against adversaries.
% along with training the model with adversarial examples improves its ability to handle perturbations and generalize better.
% By creating a distilled model with soft probabilities, uncertainty, and variation are introduced into the output probabilities, making it more difficult for privacy attacks like model extraction.
\keywords{Ensembling \and Adversarial Attack \and Defensive Distillation \and Adversarial Training \and Vision Transformer}
\end{abstract}
\section{Introduction}
% The use of Deep Learning in healthcare, particularly in accurately classifying chest X-rays for various lung diseases, is prevalent. Convolutional Neural Networks (CNNs) are commonly used in medical image analysis, but they are vulnerable to adversarial attacks that can cause misleading results. The vulnerabilities of automated medical imaging systems to such attacks are becoming more apparent in recent years \cite{goodfellow2014explaining}. As medical imaging moves towards cloud-based processing, cyberattacks can target the communication channels between the client and cloud, or attack the cloud infrastructure itself, to modify or steal patient data \cite{huang2022privacy}. With the increased use of AI in healthcare, malicious actors may manipulate medical imaging systems for financial gain through fraudulent billing or insurance claims using adversarial attacks. These makes medical imaging scenarios highly vulnerable to adversarial attacks, and it is imperative to develop a robust defensive strategy to ensure the secure deployment of automated medical imaging systems. Adversarial attacks are a type of security threat where an attacker manipulates input data in a way that is undetectable to humans but can cause a machine learning model to make incorrect predictions. Therefore, developing techniques to detect and defend against adversarial attacks is critical to ensure accurate diagnoses and treatment outcomes \cite{kaviani2022adversarial}.
Deep Learning (DL) models have proven their efficacy on various medical tasks in general and on classifying lung diseases from x-ray images in particular \cite{ccalli2021deep}.
% Deep Learning is widely used in healthcare for classifying lung diseases based on chest X-rays.
However, popular DL models, such as Convolutional Neural Networks (CNNs) and Vision Transformers (ViTs) are susceptible to adversarial attacks. The vulnerabilities of medical imaging systems to such attacks are increasingly apparent \cite{goodfellow2014explaining}. These attacks can target cloud-based processing or communication channels to compromise patient data \cite{huang2022privacy}. Adversarial attacks in medical imaging can also be exploited for financial gain through fraudulent billing or insurance claims \cite{almalik2022self}. Moreover, malicious parties extracting model information could compromise patient data privacy. Therefore, it is essential to develop robust defense strategies to ensure the secure deployment of automated medical imaging systems \cite{imam2023enhancing}. Detecting and defending against adversarial attacks is crucial for accurate diagnoses and successful treatment outcomes in the healthcare domain. \cite{kaviani2022adversarial}.
% Recently, a ViT based self-ensembling approach was proposed to defend against such attacks. Self-Ensembling Vision Transformers (SEViT) is a type of ensembling ViT that have shown promising robust results in medical image analysis compared to Vanilla ViTs \cite{almalik2022self}. However, SEViT being impractical in deployment, is still cannot be considered as a benchmark robust solution to adversarial attacks and still could pose several vulnerabilities, which can compromise their accuracy and reliability. It is because SEViT overlooks the privacy and confidentiality aspect of Trustworthy AI. Attacks like Model Extraction can easily extract such models like SEViT even though they have showed significant results against adversarial attacks \cite{carlini2023extracting}. In addition to adversarial attacks, privacy attacks like model extraction in the medical imaging domain pose a significant threat to patient privacy and confidentiality. In the case of TB chest X-ray classification, for example, an attacker could extract the trained model from a hospital or a clinic and use it for malicious purposes, such as selling the model to third-party vendors, training their own model using the extracted model as a starting point, or using the model to infer sensitive patient information from their X-ray images.
Recently, SEViT \cite{almalik2022self}, a self-ensembling approach based on Vision Transformers, has shown promise in defending against adversarial attacks in medical image analysis. However, SEViT has practical deployment limitations due to the large parameter size of the MLP modules ensembled for each block.
% It overlooks the privacy and confidentiality aspects of Trustworthy AI, leaving vulnerabilities that compromise accuracy and reliability.
Attacks such as model extraction can extract SEViT models, despite their effectiveness against adversarial attacks \cite{carlini2023extracting}. Privacy attacks, such as model extraction in the medical imaging domain, pose significant threats to patient privacy and confidentiality. For instance, attackers can extract trained models from healthcare facilities and exploit them for malicious purposes, including selling the models, training their own models using the extracted models, or inferring sensitive patient information from x-ray images.
% Moreover, medical image datasets often contain sensitive patient information, such as demographics, medical history, and treatment plans. If a model is extracted from a hospital or a clinic without the institution's knowledge or consent, it could potentially expose sensitive patient data, violating their privacy rights \cite{rasool2022security}. To defend against such attacks, defensive distillation can be used as a countermeasure to model extraction attacks by making it more difficult for an attacker to extract the original model. By training a distilled model that approximates the behavior of the original model, but is less vulnerable to model extraction attacks, the attacker would need to spend more time and resources to extract the model, potentially deterring them from carrying out the attack.
% Medical image datasets contain sensitive patient information, and extracting models without authorization can lead to privacy violations \cite{rasool2022security}.
Medical data can contain sensitive information about patients, and unauthorized model extraction can lead to privacy violations \cite{rasool2022security}.
To defend against such model extraction attacks, defensive distillation \cite{papernot2016distillation} can be employed.
Defensive distillation enhances model robustness by training a distilled model on softened probabilities from an initial model, mitigating adversarial attacks by introducing prediction uncertainty, and reducing sensitivity to small perturbations \cite{imam2023enhancing}. Soft probabilities refer to the output of a model's prediction that represents the likelihood or probability distribution over multiple classes rather than a single deterministic label.
By training a distilled model that approximates the behavior of the original model, we can enhance resistance to extraction. By making extraction more challenging, attackers may be deterred due to the increased time and resources required.
In this work, we aim to improve the robustness of the SEViT model for Tuberculosis (TB) classification from chest x-ray images using defensive distillation and adversarial training, while also improving computational efficiency. The main aim of this research is to provide a lightweight, accurate, and robust benchmark medical imaging system, which aims to be crucial in achieving better diagnosis and treatment outcomes for patients and healthcare providers.
% The outline of this work is structured as follows: Section 2 covers relevant literature, Section 3 presents the proposed method, and Section 4 explains the comprehensive experiments conducted and analyses made. The results and findings of the respective experiments are presented in Section 5, while Section 6 concludes the work and suggests possible future research directions.
The main contributions of this work are as follows:
\begin{itemize}
\item We propose an efficient and lightweight \underline{S}elf-\underline{E}nsembling ViT with Defensive \underline{D}istillation and \underline{A}dversarial training (SEDA)
to increase adversarial robustness while preserving the clean accuracy of ViT by combining the adversarial training and defensive distillation approaches.
\item Showing the real-world deployability of SEDA, we evaluate the proposed framework's computational parameters and classification performance, and compare them with state-of-the-art methods \cite{vaswani2017attention} and \cite{almalik2022self}.
% and compared them with the ViT \cite{vaswani2017attention} and SEViT \cite{almalik2022self}.
\end{itemize}
% \begin{figure}[t]
% \centering
% \includegraphics[width=10cm]{Figures/defensive_distillation.png}
% \caption{Defensive distillation \cite{qiu2019review}: Involves training a teacher model to generate a new dataset of soft targets for a smaller student model to learn from. The student model (distilled model) shows higher robustness due to the introduction of uncertainties in the output, making it more difficult for attackers to generate adversarial examples that can fool the model.}
% \label{fig:Working of defensive distillation}
% \end{figure}
\section{Related Works}
% SEViT paper:
\textbf{Ensembling ViTs.}
% ViT still faces challenges, such as vulnerability to adversarial attacks and robustness issues. \cite{naseer2021improving} show that it is possible to generate more powerful adversarial attacks against ViTs by targeting an ensemble of intermediate representations in addition to the final class token. \cite{almalik2022self} improves the robustness of the ViT classifier as they proposed a novel Self-Ensemble Vision Transformer (SEViT) architecture to enhance the robustness of ViT against adversarial attacks for medical image classification. They propose to add an MLP classifier at the end of each block to utilize the patch tokens of the corresponding block and produce a probability distribution over the class labels. This results in a self-ensemble of classifiers that can be fused to obtain the final classification result.
% ViT still faces challenges, including vulnerability to adversarial attacks and robustness issues.
Adversarial attacks can be more potent against ViTs by targeting both intermediate representations and the final class token \cite{naseer2021improving}. To address this challenge, \cite{almalik2022self} proposed the Self-Ensemble Vision Transformer (SEViT) architecture. SEViT enhances the robustness of ViT against adversarial attacks in medical image classification. They propose to add an MLP classifier at the end of each block to leverage patch tokens and generate a probability distribution over class labels. This approach enables the self-ensembling of classifiers, which can be fused to obtain the final classification result.
% Adversarial attack paper & Model extraction
\textbf{Adversarial Attacks.} The works by \cite{Malik_2022_BMVC,goodfellow2014explaining,wu2022towards} analyzed a common theme of exploring adversarial attacks in machine learning. They aim to better understand the nature of these attacks and propose new techniques for mitigating their effects on learning models. \cite{Malik_2022_BMVC} presents a new technique for creating adversarial examples, while \cite{goodfellow2014explaining} proposes a defense mechanism against them. \cite{wu2022towards} presents an efficient approach to training models to resist adversarial attacks.
% , and \cite{papernot2017practical} shows how to attack machine learning systems without knowledge of their internal workings. Finally, \cite{he2021model} demonstrates that even state-of-the-art models are vulnerable to adversarial attacks that exploit model extraction.
\textbf{Adversarial Defense.} \cite{papernot2016distillation} proposes a defense mechanism called defensive distillation, which is a form of knowledge transfer from a larger, more accurate model to a smaller, less accurate model. The idea of \cite{papernot2016distillation} is to make the smaller model less vulnerable to adversarial attacks by training it to imitate the outputs of the larger model, which is assumed to be more robust to adversarial perturbations.
% Defensive distillation showed it can improve the robustness of DL models to adversarial attacks, such as the FGSM \cite{goodfellow2014explaining}, while maintaining high accuracy on clean inputs.
% The paper also includes experiments on several benchmark datasets, including MNIST and CIFAR-10, showing the effectiveness of defensive distillation in improving the robustness of deep neural networks.
\section{Proposed Method}
%Background (Defenses, Attacks) Hypothesis Pseudocode Method Figure
\begin{figure}[t]
\centering\includegraphics[width=0.8\textwidth]{Figures/Method.png}
\caption{The proposed SEDA framework extracts the patch tokens from the initial
blocks and trains separate CNNs on Clean+Attack samples (Adversarial Training) as shown in (1) and (2). A self-ensemble of these CNNs with the final ViT classifier goes through the distillation process with the new adversarial trained dataset to obtain a final distilled CNN model as seen in steps (3), (4), (5), and (6). }
% Also, see Algorithm \ref{alg:method}
\label{fig:method}
\end{figure}
The objective of an adversarial attack is to generate a perturbed image $x'$, which is similar to the original medical image $x$ within a certain distance metric ($L_{\infty}$ norm), such that the output of a ViT-based classifier $f(x')$ is different from the true label $y$ with a high probability. Defending against adversarial attacks involves obtaining a robust classifier $f'$ from the original classifier $f$. This robust classifier $f'$ should have high accuracy on both clean images ($P(f'(x) = y)$) and perturbed images ($P(f'(x') = y)$).
\textbf{Ensembling} SEViT \cite{almalik2022self} aims to improve adversarial robustness by adding an MLP classifier at the end of first $m$ blocks, utilizing patch tokens to produce a probability distribution over class labels. The intermediate feature representations output by the initial blocks are considered useful for classification and more robust against adversarial attacks.
% and harder to attack.
This results in a self-ensemble of $L$ classifiers that can be fused to obtain the final classification result. The SEViT model
% reduces computational complexity and
increases adversarial robustness by adding MLP classifiers only to the first $m$ ($m < L$) blocks and combining their results with the final classification head. The SEViT ensemble can be formed by performing majority voting or randomly choosing only $c$ out of the initial $m$ intermediate classifiers. The SEViT defense mechanism also includes a detection mechanism, which aims to distinguish between the original image $x$ and the perturbed image $x'$, especially when the attack is successful ($f(x') \neq y$). The constraint on the distance metric between $x$ and $x'$ is that the $L_{\infty}$ norm of their difference should be less than or equal to a predefined value epsilon. Although, we are not proposing any detection mechanism (to detect adversarial samples) in our enhanced solution as we can use the same detection approach as SEViT.
\textbf{SEDA.} Our two main hypotheses are: (1) Small CNN blocks would be more computationally efficient alternative to MLP blocks for each ViT block. (2) Defensive distillation when performed with adversarial training would make the model more robust against adversarial and model extraction attacks. Hence, we propose to enhance the existing SEViT by making 3 major modifications: We propose to substitute MLP blocks with CNN blocks instead to test for efficiency. Next, we perform adversarial training on the SEViT model instead of training it on just clean samples. Finally, we generate soft predictions to train a new distilled model, resulting in the SEDA framework (depicted in Figure \ref{fig:method}).
The proposed modifications are based on the fact that CNNs are more efficient than MLPs in learning spatial features from tokens through convolution operations at different levels of abstraction, which leads to improved generalization performance and reduced overfitting. Additionally, by training the model with adversarial examples, the model becomes better at handling perturbations during inference and generalizes better to new and unseen adversarial examples. The use of soft probabilities during distillation results in a smaller and more efficient model with faster inference time and reduced computational requirements. Moreover, the distilled model is more robust to adversarial attacks since the soft probabilities introduce uncertainty and variation in the output probabilities, making it harder for attackers to generate adversarial examples that can fool the model.
% The proposed method architecture is illustrated in Figure \ref{fig:method}. The pseudocode for our approach is as follows:
% \begin{itemize}
% \item [1.]
% \item [2.]
% \item [3.]
% \item [4.]
% \item [5.]
% \item [6.]
% \end{itemize}
% \begin{algorithm}[t]
% \caption{Pseudocode of the proposed SEDA framework\\ \textbf{Input:} Batch of clean/attack TB images;
% \textbf{Output:} Robust predictions;}
% \label{alg:method}
% \begin{algorithmic}[1]
% \State Define the SEViT \cite{almalik2022self} model architecture with CNN blocks instead of MLP blocks. Below, $\psi$ = Majority Voting ensembling, $\theta$ = parameters of the final ViT classifier $\mathbf{h}$, and $\beta_1$ through $\beta_m$ = parameters of the m intermediate CNNs g. \newline \vspace{-0.2cm}
% \[\tilde{\mathbf{f}}(\mathbf{x})=\psi\left(\mathbf{g}_{\beta_1}\left(\left\{p t_1^j\right\}_{j=1}^N\right), \cdots, \mathbf{g}_{\beta_m}\left(\left\{p t_m^j\right\}_{j=1}^N\right), \mathbf{h}_\theta\left(c t_L\right)\right)\]
% \vspace{-0.2cm}
% \State Train the SEViT-CNN model on the original + adversarial datasets, i.e., adversarial training. Below, ${L}$ and ${L'}$ = original and adversarial loss on clean $x_i$ and adversarial samples $x_i'$ respectively. \newline \vspace{-0.5cm}
% \[\text{Adversarial Training Loss} = \frac{1}{N} \sum_{i=1}^{N} \left[ \lambda \cdot {L}(\tilde{\mathbf{f}}(x_i, y_i)) + (1 - \lambda) \cdot {L'}(\tilde{\mathbf{f}}(x_i', y_i)) \right]\]\vspace{-0.2cm}
% \State Extract the final soft predictions from the Adversarially trained SEViT-CNN model $\tilde{\mathbf{f'}}(\cdot)$ for all images in the dataset.\newline \vspace{-0.3cm}
% \[
% \text{Soft Predictions} = \{y_1', y_2', y_3', \ldots, y_m\} = \tilde{\mathbf{f'}}(x_1, x_2, x_3, \ldots, x_m)
% \]
% \State Create a new dataset consisting of the images from both the original and adversarial datasets along with their corresponding soft predictions. Below, $y_i'$ is soft prediction. \vspace{-0.3cm}
% \[\text{Data Point} = [X:\{x_1, x_2, x_3, \ldots, x_m\}, Y:\{y_1', y_2', y_3', \ldots, y_m\}]\]
% \State Train a new distilled model (such as CNN) on the new dataset, where each data point consists of an image and its corresponding soft predictions. Below, $z_i$ = the activation before the softmax, $T$ = temparature parameter. \vspace{-0.2cm}
% \[\mathbf{F(x)}=\left[\frac{e^{z_i(X) / T}}{\sum_{l=0}^{N-1} e^{z_l(X) / T}}\right]_{i \in 0 . . N-1}\]
% % \State The Distilled version of SEViT-CNN with Adversarial Training, results into SEDA framework, is deployed instead of SEViT-CNN, and its performance is evaluated on both clean and adversarial datasets.
% \end{algorithmic}
% \end{algorithm}
\section{Experiments}
\textbf{Dataset.} The experiments are performed on a chest x-ray dataset \cite{rahman2020reliable} that includes $7,000$ images, and the classification task is binary, where each image is either Normal or TB. The dataset was split randomly, with $80\%$ allocated for training, $10\%$ for validation, and the remaining $10\%$ for testing. This split ensures that the training, validation, and testing sets are mutually exclusive, and it enables the evaluation of the model's generalization ability to unseen images.
\textbf{Attack Types.} In our study, we utilize the Foolbox library \cite{rauber2020foolbox} to create $3$ different types of adversarial attacks, which are FGSM \cite{goodfellow2014explaining}, PGD \cite{madry2017towards}, and AutoPGD \cite{croce2020reliable}. To generate attack samples with these algorithms, we use two values of perturbation budget ${\epsilon}=0.03$ and ${\epsilon}=0.003$ while keeping all other parameters at their default values.
\textbf{MLPs alternatives.} To implement the Vision Transformer (ViT) model, we utilized the ViT-B/16 architecture pre-trained on ImageNet [5]. We used the fine-tuned ViT used in the original SEViT method. We experimented with several MLP alternatives with the aim to preserve clean accuracy and enhance robust accuracy while significantly reducing computational requirements. In order to create intermediate classifiers that take patch tokens as input, we trained 12 MLP alternatives such as CNN and ResNet variants for every block.
In particular, we trained alternatives including a 2 convolution layer CNN, fine-tuned ResNet-50, transfer-learned ResNet-50, fine-tuned ResNet-50 with 2 additional convolution layers, and transfer-learned ResNet-50 with 2 additional convolution layers. Fine-tuning involves training the ResNet-50 model on our specific dataset, while transfer learning involves using the pre-trained weights from ImageNet and adapting the model to our specific task.
Our experiments were conducted on a single Nvidia Quadro RTX 6000 GPU. All models are tested with the batch size of $30$ and input size of $3 \times 224 \times 224$.
% \subsection{Efficient SEViT with MLP alternatives}
% \label{sec:MLP_alts}
% \textbf{MLP alternatives.}
% \noindent \textbf{Ensembling Criteria.} Our proposed SEDA framework builds upon the workings of SEViT, which utilizes majority voting criterion to combine predictions from the intermediate MLP modules associated with each VIT block. In addition, we experiment with two other voting criteria: Averaging and Weighted Averaging.
% Majority voting works well when the ensemble is small, while averaging provides improved performance by leveraging the diversity of predictions. However, caution must be exercised with weighted averaging to avoid overfitting. Thus, selecting different voting criteria depending on the number of ensembling models is advised based on our observations from Figure \ref{fig:voting}. For our further experiments, we utilize Majority Voting criteria for ensembling.
% \begin{figure}[htbp]
% \centering
% \includegraphics[width=6cm]{Figures/Results/voting.png}
% \caption{Comparison of clean performance of CNN blocks when ensembling is done with different voting criterias in SEDA. The x-axis is the number of ensembles while y-axis is the test accuracy}
% \label{fig:voting}
% \end{figure}
% {\renewcommand{\arraystretch}{1.2}
% \begin{table}[b]
% \centering
% \caption{Clean performance of different MLP alternatives across several ensembles using Majority Voting. The `+' refers to \textit{in addition} to ViT parameters.}
% \label{table:clean_with_params}
% \resizebox{8cm}{!}{%
% \begin{tabular}{llllllll}
% \hline
% Ensemble &
% \#Params & m=1 & m=2 & m=3 & m=4 & m=5 & Mean \\ \hline
% ViT \cite{vaswani2017attention} (m=0) & 85.8M & \multicolumn{5}{c}{96.38} \\
% MLP \cite{almalik2022self} & +625.2M & 94.20 & 96.52 & 95.36 & 95.80 & 95.80 & \textbf{95.54} \\
% CNN (Ours) & \textbf{+1.03M} & 93.04 & 96.23 & 96.23 & 94.06 & 94.06 & 94.72\\
% ResNet-FT & +13.5M & 95.36 & 93.91 & 93.77 & 90.58 & 90.58 & 92.84\\
% ResNet-TL & +2.4M & 93.04 & 92.46 & 93.33 & 91.01 & 92.03 & 92.38\\
% ResNet-FT-CNN & +14.2M & 96.38 & 92.75 & 93.19 & 85.80 & 85.80 & 90.78\\
% ResNet-TL-CNN & +3.09M & 93.77 & 93.48 & 94.20 & 92.03 & 92.03 & 93.10\\ \hline
% \end{tabular}%
% }
% \end{table}}
\begin{figure}[b]
\centering
\begin{minipage}{.50\textwidth}
\centering
\includegraphics[width=6cm]{Figures/Results/pre_accuracy.png}
% \caption{Adversarial Performance of MLP alts Before Adv training}
% \label{fig:adv_performance_pre}
\end{minipage}%
\begin{minipage}{.50\textwidth}
\centering
\includegraphics[width=6cm]{Figures/Results/pos_accuracy.png}
%\caption{Adversarial Performance of MLP alts After Adv training}
% \captionof{figure}{Another figure}
% \label{fig:adv_performance_pos}
\end{minipage}
\caption{Clean and adversarial performance of MLP alternatives Before adversarial training (left) vs After adversarial training (right). For each MLP alternative, the number of ensembles are m=3 where the attack samples have ${\epsilon=0.03}$}
\label{fig:adv_performance}
\end{figure}
\section{Results and Discussion}
\textbf{Accuracy and Robustness.}
% The resulting ViT model achieved an accuracy of $96.38\%$ on the original clean test set for chest X-rays.
Comparing the performances (Table \ref{tab:vit_vs_mlp_vs_cnn} and Figure \ref{fig:adv_performance}) of our approach to the MLP block while ensembling consistently on 3 models (i.e., m=3), as illustrated in Figure \ref{fig:adv_performance}, we conclude that the 2 convolution layer CNN alternative outperforms the original MLP block as it closely preserves the clean accuracy (with mean difference of $\le1\%$) and achieves higher accuracy against adversarial attack samples and that with significantly lower number of parameters. This can be attributed to CNN's ability to learn spatial features from tokens through convolution operations at different levels of abstraction, leading to reduced overfitting and improved generalization performance. For example, when subjected to attack samples generated by FGSM ($\epsilon$=0.03), the CNN alternative achieved $87.4\%$ robust accuracy, which is higher than the $84.6\%$ robust accuracy achieved by the 4-layered MLP block. When combined with distillation and adversarial training, the proposed SEDA framework is seen to achieve even higher clean and robust accuracy, exceeding an improvement of $6\%$. This increment in robust accuracy can also be noticed consistently on other attacks.
% ResNet-FT and ResNet-TL-CNN exhibit moderate performance, while ResNet-FT-CNN and ResNet-TL show poor robustness. Additional convolution layers can enhance model expressiveness but also raise the risk of overfitting and vulnerability to adversarial attacks. The lower performance of the latter alternatives may be attributed to transfer learning, which can introduce irrelevant or harmful features, resulting in decreased robustness.
\textbf{Computation.} In contrast to SEViT, our proposed SEViT-CNN, and its distilled version, SEDA, offer significantly improved clean and robust accuracies for real-world deployment. SEDA is also 70 times more memory efficient than the original SEViT, as demonstrated by the computational and accuracy parameters shown in Table \ref{tab:computation}.
The computational efficiency of a DL model can be evaluated based on various factors such as the FLOPs and accuracy. While the original MLP block in SEViT is accurate, it requires a significant amount of computational resources to train and deploy with having about $625$M parameters \cite{zhou2021decentralized} (Table \ref{tab:computation}).
Based on these findings, we conclude that the CNN alternative is the best choice for ensembling ViT considering clean and robust accuracy, as well as computational efficiency.
{\renewcommand{\arraystretch}{1.2}
\begin{table}[t]
\centering
\caption{ViT vs SEViT vs SEViT-CNN (highlighted) in terms of Clean and Robust accuracy across the different numbers of intermediate ensembles. m = \#Ensembles}
\label{tab:vit_vs_mlp_vs_cnn}
\resizebox{\textwidth}{!}{%
\begin{tabular}{lllllllll@{\hspace{3mm}}lllllll}
&
&
\multicolumn{7}{l}{\textit{(a). PRE-Adversarial Training}} &
\multicolumn{7}{l}{\textit{(b). POST-Adversarial Training}} \\ \hline
\multirow{2}{*}{Ensemble} &
\multirow{2}{*}{m} &
\multirow{1}{*}{Clean} &
\multicolumn{2}{c}{FGSM} &
\multicolumn{2}{c}{PGD} &
\multicolumn{2}{c}{AutoPGD} &
\multirow{1}{*}{Clean} &
\multicolumn{2}{c}{FGSM} &
\multicolumn{2}{c}{PGD} &
\multicolumn{2}{c}{AutoPGD} \\
\cline{4-9} \cline{11-16}
&
&
&
0.03 &
0.003 &
0.03 &
0.003 &
0.03 &
0.003 &
&
0.03 &
0.003 &
0.03 &
0.003 &
0.03 &
0.003 \\ \hline
{ViT \cite{vaswani2017attention}} &
- &
96.38 &
55.65 &
91.59 &
32.62 &
92.17 &
23.77 &
92.46 &
- &
- &
- &
- &
- &
- &
- \\ \hline
\multirow{4}{*}{MLP \cite{almalik2022self}} &
1 &
94.20 &
70.29 &
90.44 &
62.90 &
91.16 &
58.41 &
91.59 &
91.45 &
70.15 &
88.41 &
62.61 &
88.99 &
58.70 &
89.71 \\
&
2 &
\textbf{96.52} &
83.91 &
95.22 &
80.15 &
95.36 &
78.41 &
\textbf{95.51} &
95.51 &
84.06 &
93.48 &
81.01 &
93.62 &
80.87 &
93.91 \\
&
3 &
95.36 &
84.64 &
94.06 &
82.75 &
93.91 &
81.30 &
94.20 &
95.65 &
86.38 &
93.62 &
84.49 &
93.77 &
84.06 &
94.20 \\ \hline
\multirow{4}{*}{\makecell{CNN\\(Ours)}} &
1 &
93.04 &
70.87 &
89.86 &
64.78 &
90.58 &
60.44 &
90.73 &
95.51 &
71.30 &
92.03 &
63.77 &
92.75 &
58.84 &
92.75 \\
&
2 &
96.23 &
85.22 &
94.20 &
82.32 &
94.49 &
82.03 &
94.64 &
95.65 &
87.83 &
94.64 &
86.09 &
94.78 &
87.54 &
94.64 \\
&
\cellcolor{LightCyan}3 &
\cellcolor{LightCyan}96.23 &
\cellcolor{LightCyan}\textbf{87.39} &
\cellcolor{LightCyan}\textbf{94.64} &
\cellcolor{LightCyan}\textbf{85.22} &
\cellcolor{LightCyan}\textbf{94.93} &
\cellcolor{LightCyan}\textbf{84.93} &
\cellcolor{LightCyan}94.93 &
\cellcolor{LightCyan}\textbf{96.09} &
\cellcolor{LightCyan}\textbf{89.42} &
\cellcolor{LightCyan}\textbf{95.36} &
\cellcolor{LightCyan}\textbf{88.70} &
\cellcolor{LightCyan}\textbf{95.36} &
\cellcolor{LightCyan}\textbf{89.71} &
\cellcolor{LightCyan}\textbf{95.22} \\
\hline
\end{tabular}%
}
\end{table}}
{\renewcommand{\arraystretch}{1.2}
\begin{table}[t]
\centering
\caption{Comparative performance of different ensembling models and their distilled versions (with \#ensembles (m) = 3) against clean samples and attack samples. The reported results are the median of multiple runs.
% Note, SEDA (highlighted) = SEViT-CNN + Distillation + Post Adversarial Training
}
\label{table:pre_dis}
\resizebox{\textwidth}{!}{%
\begin{tabular}{llllllll@{\hspace{3mm}}lllllll}
\multirow{3}{*}{Model} &
\multicolumn{7}{l}{\textit{(a). PRE-Adversarial Training}} &
\multicolumn{7}{l}{\textit{(b). POST-Adversarial Training}} \\ \hline
&
\multirow{2}{*}{Clean} &
\multicolumn{2}{c}{FGSM} &
\multicolumn{2}{c}{PGD} &
\multicolumn{2}{c}{AutoPGD} &
Clean &
\multicolumn{2}{c}{FGSM} &
\multicolumn{2}{c}{PGD} &
\multicolumn{2}{c}{AutoPGD} \\ \cline{3-8} \cline{10-15}
& & 0.03 & 0.003 & 0.03 & 0.003 & 0.03 & 0.003 & & 0.03 & 0.003 & 0.03 & 0.003 & 0.03 & 0.003 \\ \hline
ViT (m=0) & \textbf{96.38} & 55.65 & 91.59 & 32.62 & 92.17 & 23.77 & 92.46 & - & - & - & - & - & - & - \\
SEViT & 95.36 & 84.64 & 94.06 & 82.75 & 93.91 & 81.30 & 94.20 & 95.65 & 86.38 & 93.62 & 84.49 & 93.77 & 84.06 & 94.20 \\
SEViT-CNN (Ours) & 96.23 & 87.39 & \textbf{94.64} & 85.22 & 94.93 & 84.93 & 94.93 & \textbf{96.09} & 89.42 & 95.36 & 88.70 & 95.36 & 89.71 & 95.22 \\
Distilled (ViT) & 94.71 & 84.64 & 87.10 & 86.67 & 93.33 & \textbf{90.87} & 94.20 & - & - & - & - & - & - & - \\
Distilled (SEViT) & 92.71 & 84.78 & 88.26 & 86.52 & 93.33 & 88.70 & 93.91 & 93.86 & 87.39 & \textbf{97.68} & 87.83 & \textbf{97.97} & 90.87 & \textbf{96.67} \\
SEDA (Ours) & 94.43 & \textbf{88.84} & 94.20 & \textbf{88.70} & \textbf{95.65} & 90.29 & \textbf{95.94} & \cellcolor{LightCyan} 94.86 & \cellcolor{LightCyan}\textbf{89.86} & \cellcolor{LightCyan}96.38 & \cellcolor{LightCyan}\textbf{90.87} & \cellcolor{LightCyan}96.09 & \cellcolor{LightCyan}\textbf{92.46} & \cellcolor{LightCyan}96.09 \\ \hline
\end{tabular}%
}
\end{table}}
{\renewcommand{\arraystretch}{1.2}
\begin{table}[t]
\centering
\caption{Comparison of extracted model when model extraction is performed on original model V/s when extraction is performed on the distilled versions (with m=3). From defender’s view, \textit{Lower} clean/Adv. accuracy is better. Note, SEDA (highlighted) = SEViT-CNN + Distillation + Post Adversarial Training.}
\label{table:pos_ext}
\resizebox{\textwidth}{!}{%
\begin{tabular}{llllllll@{\hspace{3mm}}lllllll}
\multirow{3}{*}{Extraction On} &
\multicolumn{7}{l}{\textit{(a). PRE-Adversarial Training}} &
\multicolumn{7}{l}{\textit{(b). POST-Adversarial Training}} \\ \hline
&
\multirow{2}{*}{Clean} &
\multicolumn{2}{c}{FGSM} &
\multicolumn{2}{c}{PGD} &
\multicolumn{2}{c}{AutoPGD} &
Clean &
\multicolumn{2}{c}{FGSM} &
\multicolumn{2}{c}{PGD} &
\multicolumn{2}{c}{AutoPGD} \\ \cline{3-8} \cline{10-15}
& & 0.03 & 0.003 & 0.03 & 0.003 & 0.03 & 0.003 & & 0.03 & 0.003 & 0.03 & 0.003 & 0.03 & 0.003 \\ \hline
ViT (m=0) & 84.57 & 82.75 & 85.65 & 82.61 & 85.65 & 83.77 & 85.94 & - & - & - & - & - & - & - \\
SEViT & 84.43 & 83.62 & 85.51 & 83.04 & 85.51 & 83.62 & 85.51 & 83.57 & 82.32 & 84.93 & 82.90 & 84.93 & 82.46 & 85.07 \\
SEViT-CNN (Ours) & 84.57 & 81.30 & 84.64 & 81.74 & 84.78 & 82.32 & 85.36 & \textbf{81.43} & \textbf{80.43} & \textbf{82.61} & \textbf{80.29} & \textbf{82.75} & \textbf{80.14} & \textbf{82.90} \\
Distilled (ViT) & 85.14 & 83.04 & 85.65 & 82.32 & 85.80 & 82.32 & 86.23 & - & - & - & - & - & - & - \\
Distilled (SEViT) & 83.57 & 78.99 & \textbf{83.77} & \textbf{79.13} & 84.60 & 79.75 & 84.64 & 84.57 & 82.90 & 85.36 & 82.32 & 85.36 & 83.19 & 85.80 \\
SEDA (Ours) & \textbf{83.71} & \textbf{79.86} & 84.20 & 79.71 & \textbf{84.20} & \textbf{79.71} & \textbf{84.64} & \cellcolor{LightCyan} \textbf{81.86} & \cellcolor{LightCyan}\textbf{82.03} & \cellcolor{LightCyan}\textbf{83.04} & \cellcolor{LightCyan}\textbf{82.17} & \cellcolor{LightCyan}\textbf{83.04} & \cellcolor{LightCyan}\textbf{82.03} & \cellcolor{LightCyan}\textbf{83.48} \\ \hline
\end{tabular}%
}
\end{table}}
\subsection{Defensive Distillation vs Extraction Attack}
\label{sec:defense_vs_attack}
\textbf{Distillation.}
% Adversarial and extraction attacks can put patient privacy and confidentiality at risk by allowing attackers to extract the trained model from healthcare institutions and use it for malicious purposes. To combat this as a defender, we perform defensive distillation to obtain the distilled model, which was generated from the soft probabilities of the original model (like SEViT and SEViT-CNN) to approximate the original model's behavior while being less vulnerable to extraction attacks, making it more difficult for attackers to extract (steal) the model (Figure \ref{fig:method}) \cite{papernot2016distillation}.
% The distilled model having a smaller architecture of 5 convolution layer CNN, is compared to the original model in terms of efficiency and robustness as presented in
Table \ref{table:pre_dis} indicates that the distilled model outperformed the original model in terms of robust accuracy despite having a smaller architecture (of 5 convolution layer CNN). However, there was a slight decline of around 2\% in the clean accuracy of the distilled model, which could be viewed as a reasonable trade-off between clean and robust accuracy. Distillation using soft probabilities leads to a compact and smaller architecture, which results in faster inference time and lower computational requirements, making the model more efficient as shown in Table \ref{tab:computation}. Furthermore, the distilled model is less susceptible to adversarial attacks as soft probabilities impart a smoothing effect during the distillation process \cite{carlini2017towards}. This is because soft probabilities introduce some degree of uncertainty and variation in the output probabilities of the model, making it more difficult for an attacker to generate adversarial examples that can fool the model. Hence, the distilled model, SEDA, is robust against adversarial attacks than the original SEViT-CNN with a slight trade-off with clean accuracy.
\textbf{Extraction.} We evaluate the performance of original and distilled models against extraction attacks in a black-box setting where the attacker can only input queries and receive outputs. The attacker utilizes this input-output relationship to create a replica/attack/extracted model (a 3 convolution layer CNN) of the original model. The aim is to compare the extracted model's performance in two scenarios: one where the original model is deployed, and the other where the distilled variant is deployed. This comparison allows us to determine that deploying which model would be more resilient to model extraction attacks.
Table \ref{table:pos_ext} shows that the attacker's clean accuracy (post-adversarial training) in reproducing the distilled SEViT-CNN, i.e., SEDA (81.86\%) is lower compared to that of the original SEViT-CNN (84.57\%) and SEViT (84.43\%). The models extracted by the attacker, exhibit lower level of accuracy and robustness than the original model, with SEViT-CNN and SEDA being among the lowest, implying that the attacker is less likely to recover the exact parameters of these models due to the smoothed probabilities. Thus, we can conclude that deploying the distilled model is a more secure option against extraction attacks than the original SEViT or ViT model.
% \begin{figure}[t]
% \centering
% \begin{minipage}{.5\textwidth}
% \centering
% \includegraphics[width=6cm]{Figures/Results/pre_dis.png}
% \end{minipage}%
% \hfill
% \begin{minipage}{.5\textwidth}
% \centering
% \includegraphics[width=6cm]{Figures/Results/pos_dis.png}
% \end{minipage}
% \caption{Comparative performance of the original ensembling models and their distilled versions in the case of pre-adversarial training (left) vs post-adversarial training (right)}
% \label{fig:dis}
% \end{figure}
\subsection{Adversarial Training}
\label{sec:adv_train}
% Adversarial Training has been shown to enhance the robustness of DL networks against various adversarial attacks \cite{kurakin2016adversarial}. By generating adversarial examples and adding them to the training set, the model learns to better handle these perturbations during inference. This technique effectively increases the model's ability to generalize to new and unseen adversarial examples.
% We performed distillation and extraction experiments with adversarial training and compared the results to other approaches
% side by side with the experiments conducted without adversarial training in prior sections \ref{sec:MLP_alts} and \ref{sec:defense_vs_attack}.
% (Table \ref{tab:vit_vs_mlp_vs_cnn}, \ref{table:pre_dis} and \ref{table:pos_ext}).
\noindent \textbf{Accuracy and Robustness.} In the case of pre-adversarial training, both models (Original and Distilled) have high accuracy on clean samples, but their performance on adversarial examples is increased even higher following post-adversarial training, by at least +2 to +5\% (Table \ref{tab:vit_vs_mlp_vs_cnn} and Table \ref{table:pre_dis}). Additionally, the models' vulnerability to model extraction attacks is high in this pre-adversarial training case, with the extracted models' accuracy on clean and adversarial examples being considerably high. However, following post-adversarial training, models extracted on original and their distilled versions showed a considerable decrement (of about -3\%) in their clean and robust accuracies (Table \ref{table:pos_ext}). These results demonstrate the improved robustness of the models via adversarial training with improved generalization and their increased resistance against attacks and model extraction.
% \section{Results and Discussions}
% \subsection{Results on voting criteria}
% In our experimentation with different voting criteria, as can be seen in Figure \ref{fig:voting}, we observed that Majority Voting works well when the number of models in the ensemble is small, typically 2 or 3 individual CNN blocks each stemming from corresponding VIT block in our proposed case. This is because it is easier to reach a consensus among fewer models, leading to more reliable predictions. Moreover, Averaging was effective in combining more diverse opinions from individual models, and is useful when the predictions of individual modules are diverse, as Averaging better utilizes this diversity and lead to improved performance. In addition, Weighted averaging, lead to overfitting when the weights are not selected carefully, especially when the number of models is large. Therefore, it does not work well when there are too many models in the ensemble. Based on these observations (Figure \ref{fig:voting}), we can state that different voting criteria based on the number of ensembling models should be selected.
% \begin{figure}[!t]
% \centering
% \includegraphics[width=6cm]{Figures/Results/mlp_alts.png}
% \caption{Comparison of clean performance of different MLP alternatives across various ensembles}
% \label{fig:CNN&MLP}
% \end{figure}
% \subsection{Results on Accuracy and Computational Efficiency}
% We have compared the computational efficiency of our proposed approach with the original MLP block by ensembling consistently on 3 models (i.e., m=3), as illustrated in Figure \ref{fig:CNN&MLP} and \ref{fig:adv_performance}. Our experiments conclude that the 2 convolution layer CNN alternative outperforms the original MLP block in terms of clean accuracy and achieves higher accuracy even against adversarial attack samples. This can be attributed to CNN's ability to learn spatial features from tokens through convolution operations at different levels of abstraction, leading to reduced overfitting and improved generalization performance. For example, when subjected to attack samples generated by FGSM ($\epsilon$=0.03) algorithm, the CNN alternative achieved 87.4\% robust accuracy, which is higher than the 84.6\% robust accuracy achieved by the 4-layered MLP block. When combined with distillation and adversaring training, the proposed SEDA framework is seen to achieve even higher clean and robust accuracy, exceeding an improvement of +6\%. This increment in robust accuracy can be noticed consistently on other attacks as well. Other alternatives like ResNet-FT and ResNet-TL-CNN have moderate performance, while ResNet-FT-CNN and ResNet-TL show poor performance in terms of robustness. Although adding convolution layers can increase model expressiveness, it also increases the risk of overfitting and makes the model more vulnerable to adversarial attacks. The reason for lower performance for later alternatives could be that since transfer learning can help in learning useful features for the task, but it may also inherit irrelevant or harmful features, leading to decreased robustness.
% In contrast to the impracticality of deploying SEViT in the real world, our proposed SEDA and its Distilled version offer significantly improved results for real-world deployment. These models are 67 times lighter than the original SEViT, as demonstrated by the computational and accuracy parameters shown in Table \ref{tab:computation}.
% Based on these findings, we conclude that the CNN alternative is the best choice for ensembling ViT considering clean and robust accuracy, as well as computational efficiency.
% \subsection{Results on Robustness via Distillation and Adversarial Training}
% \begin{figure}[!t]
% \centering
% \begin{minipage}{.5\textwidth}
% \centering
% \includegraphics[width=6cm]{Figures/Results/pre_ext.png}
% % \caption{Model Extraction Before Adversarial Training}
% % \label{fig:pre_ext}
% \end{minipage}%
% \begin{minipage}{.5\textwidth}
% \centering
% \includegraphics[width=6cm]{Figures/Results/pos_ext.png}
% %\caption{Model Extraction After Adversarial Training}
% % \captionof{figure}{Another figure}
% % \label{fig:pos_ext}
% \end{minipage}
% \caption{Comparison of extracted model when model extraction is performed on Dis-
% tilled model V/s when extraction is performed on Original (non-distilled) model. The performance of
% extracted models are against Clean Samples and Attack Samples. From defender’s view, \textit{Lower} Clean/Adv. Accuracy is better. Pre-adversarial training (left) V/s Post-adversarial training (right)}
% \label{fig:ext}
% \end{figure}
% \subsection{Results on Adversarial Training}
{\renewcommand{\arraystretch}{1.2}
\begin{table}[t]
\centering
\caption{Extensive computational analysis of the SEDA and its comparison with the alternative models in terms of computational parameters. \textit{Distilled} models are distilled with \#ensembles (m) = 3. The '+' refers to \textit{in addition} to ViT parameters.
% Note, SEDA = SEViT-CNN + Distillation + Post Adversarial Training
}
\label{tab:computation}
\resizebox{\textwidth}{!}{%
\begin{tabular}{lllllllllll}
\hline
\multirow{2}{*}{Model} &
\multirow{2}{*}{\#Params} &
\multirow{2}{*}{FLOPs} &
\multirow{2}{*}{Weight} &
\multirow{2}{*}{\makecell{\text{Inference}\\ \text{Time}}} &
\multirow{2}{*}{Throughput} &
\multirow{2}{*}{\makecell{\text{Clean}\\ \text{Accuracy}}} &
\multicolumn{4}{c}{Adv. Acc. ($\epsilon=0.03$)} \\ \cline{8-11}
& & & & & & & FGSM & PGD & AutoPGD & Mean\\ \hline
ViT (m=0) & 85.64M & 16.86G & 327.37MB & 7.06 & 277.25 & \textbf{96.38} & 55.65 & 32.62 & 23.77 & 37.35 \\
% SEViT (m=1) & +625.22M & +625.21M & +2.33GB & 4.29 & 4375.19 & 94.20 & 70.29 & 62.90 & 58.41 & 63.87 \\
% SEViT (m=2) & +1250.44M & +1250.42M & +4.66GB & 8.58 & 8750.38 & 96.52 & 83.91 & 80.15 & 78.41 & 80.82 \\
\cellcolor{sunset}SEViT (m=3) & \cellcolor{sunset}+1875.66M & \cellcolor{sunset}+1875.63M & \cellcolor{sunset}+6.99GB & \cellcolor{sunset}12.87 & \cellcolor{sunset}13125.57 & \cellcolor{sunset}\textbf{95.36} & \cellcolor{sunset}84.64 & \cellcolor{sunset}82.75 & \cellcolor{sunset}81.30 & \cellcolor{sunset}82.90 \\
% SEViT-CNN (m=1) & +1.03M & +177.09M & +3.94MB & 0.40 & 41587.17 & 93.04 & 70.87 & 64.78 & 60.44 & 65.36 \\
% SEViT-CNN (m=2) & +2.06M & +354.18M & +7.88MB & 0.80 & 83174.34 & 96.23 & 85.22 & 82.32 & 82.03 & 83.19 \\
\cellcolor{LightCyan}SEViT-CNN (m=3) & \cellcolor{LightCyan}+3.09M & \cellcolor{LightCyan}+531.27M & \cellcolor{LightCyan}+11.82MB & \cellcolor{LightCyan}1.20 & \cellcolor{LightCyan}124761.51 & \cellcolor{LightCyan}\textbf{96.23} & \cellcolor{LightCyan}87.39 & \cellcolor{LightCyan}85.22 & \cellcolor{LightCyan}84.93 & \cellcolor{LightCyan}85.85 \\
Distilled (ViT) & 27.79M & 994.41M & 106.00MB & 0.96 & 3956.04 & 94.71 & 84.64 & 86.67 & 90.87 & 87.39 \\
Distilled (SEViT) & 27.79M & 994.41M & 106.00MB & 0.97 & 3952.44 & 92.71 & 84.78 & 86.52 & 88.70 & 86.67 \\
\cellcolor{LightCyan}SEDA (Ours) & \cellcolor{LightCyan}\textbf{27.79M} & \cellcolor{LightCyan}\textbf{994.41M} & \cellcolor{LightCyan}\textbf{106.00MB} & \cellcolor{LightCyan}0.96 & \cellcolor{LightCyan}3962.13 & \cellcolor{LightCyan}\textbf{94.86} & \cellcolor{LightCyan}\textbf{89.86} & \cellcolor{LightCyan}\textbf{90.87} & \cellcolor{LightCyan}\textbf{92.46} & \cellcolor{LightCyan}\textbf{91.06} \\ \hline
\end{tabular}
}
\end{table}}
\section{Conclusion and Future Work}
% The vulnerabilities of automated medical imaging systems to adversarial attacks are becoming more apparent in recent years. With more advancements, an increase in number of attacks could pose greater threat to deploy automated medical imaging models.
%%%%%% A recent ViT based approach, Self-Ensemble Vision Transformer shows robust performance against a range of adversarial attacks. However, it still doesn't provide any benchmark robustness along with posing susceptibility against privacy attacks like model extraction. To overcome these issues,
In this work, we have proposed an improved architecture, Self-Ensembling ViT with defensive Distillation and Adversarial training (SEDA), to overcome computational bottlenecks and improve robustness by making 3 major modifications: we propose to substitute MLP blocks with CNN instead to test for efficiency. Next, we perform adversarial training on the SEViT-CNN model instead of training it on just clean samples. And last, we generate soft predictions to train a new distilled model. This study is the first to combine these techniques with ViT ensembling, providing a SOTA defense for ViTs against adversarial attacks and model extraction attacks. We prove the effectiveness of our novel enhanced approach: SEDA, using an extensive set of experiments on publicly available Tuberculosis x-ray dataset.
In the future, we aim to further enhance the proposed SEDA model using (i) defensive approaches such as differential privacy (ii) exploring the trade-off between adversarial robustness and model accuracy when performing defensive distillation (iii) exploring a diverse set of alternatives for each block rather than just having CNN for every block. This would increase the diversity among the ensemble models and further improve overall performance.
% By continuing to research and develop new defensive mechanisms, we can improve the adversarial robustness of medical imaging models and ensure the accuracy and reliability of medical diagnoses and treatments.
\bibliographystyle{unsrt} % We choose the "plain" reference style
\bibliography{references} % Entries are in the refs.bib file
\clearpage
\section*{Supplementary}
\begin{algorithm}[h]
\caption{Pseudocode of the proposed SEDA framework\\ \textbf{Input:} Batch of clean/attack TB images;
\textbf{Output:} Robust predictions;}
\label{alg:method}
\begin{algorithmic}[1]
\State Define the SEViT model architecture with CNN blocks instead of MLP blocks. Below, $\psi$ = Majority Voting ensembling, $\theta$ = parameters of the final ViT classifier $\mathbf{h}$, and $\beta_1$ through $\beta_m$ = parameters of the m intermediate CNNs g. \newline \vspace{-0.2cm}
\[\tilde{\mathbf{f}}(\mathbf{x})=\psi\left(\mathbf{g}_{\beta_1}\left(\left\{p t_1^j\right\}_{j=1}^N\right), \cdots, \mathbf{g}_{\beta_m}\left(\left\{p t_m^j\right\}_{j=1}^N\right), \mathbf{h}_\theta\left(c t_L\right)\right)\]
\vspace{-0.2cm}
\State Train the SEViT-CNN model on the original + adversarial datasets, i.e., adversarial training. Below, ${L}$ and ${L'}$ = original and adversarial loss on clean $x_i$ and adversarial samples $x_i'$ respectively. \newline \vspace{-0.5cm}
\[\text{Adversarial Training Loss} = \frac{1}{N} \sum_{i=1}^{N} \left[ \lambda \cdot {L}(\tilde{\mathbf{f}}(x_i, y_i)) + (1 - \lambda) \cdot {L'}(\tilde{\mathbf{f}}(x_i', y_i)) \right]\]\vspace{-0.2cm}
\State Extract the final soft predictions from the Adversarially trained SEViT-CNN model $\tilde{\mathbf{f'}}(\cdot)$ for all images in the dataset.\newline \vspace{-0.3cm}
\[
\text{Soft Predictions} = \{y_1', y_2', y_3', \ldots, y_m\} = \tilde{\mathbf{f'}}(x_1, x_2, x_3, \ldots, x_m)
\]
\State Create a new dataset consisting of the images from both the original and adversarial datasets along with their corresponding soft predictions. Below, $y_i'$ is soft prediction. \vspace{-0.3cm}
\[\text{Data Point} = [X:\{x_1, x_2, x_3, \ldots, x_m\}, Y:\{y_1', y_2', y_3', \ldots, y_m\}]\]
\State Train a new distilled model (such as CNN) on the new dataset, where each data point consists of an image and its corresponding soft predictions. Below, $z_i$ = the activation before the softmax, $T$ = temparature parameter. \vspace{-0.2cm}
\[\mathbf{F(x)}=\left[\frac{e^{z_i(X) / T}}{\sum_{l=0}^{N-1} e^{z_l(X) / T}}\right]_{i \in 0 . . N-1}\]
% \State The Distilled version of SEViT-CNN with Adversarial Training, results into SEDA framework, is deployed instead of SEViT-CNN, and its performance is evaluated on both clean and adversarial datasets.
\end{algorithmic}
\end{algorithm}
\begin{figure}[htpb]
\centering
\includegraphics[width=6cm]{Figures/Results/voting.png}
\caption{Comparison of clean performance of CNN blocks when ensembling is done with different voting criterias in SEDA. The x-axis is the number of ensembles while y-axis is the test accuracy}
\label{fig:voting}
\end{figure}
\begin{figure}[htpb]
\centering
\includegraphics[width=6cm]{Figures/Results/mlp_alts.png}
\caption{Comparison of clean performance of different MLP alternatives across various ensembles}
\label{fig:CNN&MLP}
\end{figure}
{\renewcommand{\arraystretch}{1.2}
\begin{table}[htpb]
\centering
\caption{Clean performance of different MLP alternatives across several ensembles using Majority Voting. The `+' refers to \textit{in addition} to ViT parameters.}
\label{table:clean_with_params}
\resizebox{8cm}{!}{%
\begin{tabular}{llllllll}
\hline
Ensemble &
\#Params & m=1 & m=2 & m=3 & m=4 & m=5 & Mean \\ \hline
ViT \cite{vaswani2017attention} (m=0) & 85.8M & \multicolumn{5}{c}{96.38} \\
MLP \cite{almalik2022self} & +625.2M & 94.20 & 96.52 & 95.36 & 95.80 & 95.80 & \textbf{95.54} \\
CNN (Ours) & \textbf{+1.03M} & 93.04 & 96.23 & 96.23 & 94.06 & 94.06 & 94.72\\
ResNet-FT & +13.5M & 95.36 & 93.91 & 93.77 & 90.58 & 90.58 & 92.84\\
ResNet-TL & +2.4M & 93.04 & 92.46 & 93.33 & 91.01 & 92.03 & 92.38\\
ResNet-FT-CNN & +14.2M & 96.38 & 92.75 & 93.19 & 85.80 & 85.80 & 90.78\\
ResNet-TL-CNN & +3.09M & 93.77 & 93.48 & 94.20 & 92.03 & 92.03 & 93.10\\ \hline
\end{tabular}%
}
\end{table}}
\begin{figure}[htpb]
\centering
\begin{minipage}{.5\textwidth}
\centering
\includegraphics[width=6cm]{Figures/Results/pre_dis.png}
\end{minipage}%
\hfill
\begin{minipage}{.5\textwidth}
\centering
\includegraphics[width=6cm]{Figures/Results/pos_dis.png}
\end{minipage}
\caption{Comparative performance of the original ensembling models and their distilled versions in the case of pre-adversarial training (left) vs post-adversarial training (right)}
\label{fig:dis}
\end{figure}
\begin{figure}[htpb]
\centering
\begin{minipage}{.5\textwidth}
\centering
\includegraphics[width=6cm]{Figures/Results/pre_ext.png}
% \caption{Model Extraction Before Adversarial Training}
% \label{fig:pre_ext}
\end{minipage}%
\begin{minipage}{.5\textwidth}
\centering
\includegraphics[width=6cm]{Figures/Results/pos_ext.png}
%\caption{Model Extraction After Adversarial Training}
% \captionof{figure}{Another figure}
% \label{fig:pos_ext}
\end{minipage}
\caption{Comparison of extracted model when model extraction is performed on Dis-
tilled model V/s when extraction is performed on Original (non-distilled) model. The performance of
extracted models are against Clean Samples and Attack Samples. From defender’s view, \textit{Lower} Clean/Adv. Accuracy is better. Pre-adversarial training (left) V/s Post-adversarial training (right)}
\label{fig:ext}
\end{figure}
\end{document}
\begin{thebibliography}{10}
\bibitem{ccalli2021deep}
Erdi {\c{C}}all{\i}, Ecem Sogancioglu, Bram van Ginneken, Kicky~G van Leeuwen,
and Keelin Murphy.
\newblock Deep learning for chest x-ray analysis: A survey.
\newblock {\em Medical Image Analysis}, 72:102125, 2021.
\bibitem{goodfellow2014explaining}
Ian Goodfellow, Jonathon Shlens, and Christian Szegedy.
\newblock Explaining and harnessing adversarial examples.
\newblock In {\em International Conference on Learning Representations}, 2015.
\bibitem{huang2022privacy}
Qi-Xian Huang, Wai~Leong Yap, Min-Yi Chiu, and Hung-Min Sun.
\newblock Privacy-preserving deep learning with learnable image encryption on
medical images.
\newblock {\em IEEE Access}, 10:66345--66355, 2022.
\bibitem{almalik2022self}
Faris Almalik, Mohammad Yaqub, and Karthik Nandakumar.
\newblock Self-ensembling vision transformer (sevit) for robust medical image
classification.
\newblock In {\em International Conference on Medical Image Computing and
Computer-Assisted Intervention}, pages 376--386. Springer, 2022.
\bibitem{imam2023enhancing}
Raza Imam, Muhammad Huzaifa, and Mohammed El-Amine Azz.
\newblock On enhancing the robustness of vision transformers: Defensive
diffusion.
\newblock {\em arXiv preprint arXiv:2301.13188}, 2023.
\bibitem{kaviani2022adversarial}
Sara Kaviani, Ki~Jin Han, and Insoo Sohn.
\newblock Adversarial attacks and defenses on ai in medical imaging
informatics: A survey.
\newblock {\em Expert Systems with Applications}, page 116815, 2022.
\bibitem{carlini2023extracting}
Nicholas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag,
Florian Tramer, Borja Balle, Daphne Ippolito, and Eric Wallace.
\newblock Extracting training data from diffusion models.
\newblock {\em arXiv preprint arXiv:2301.13188}, 2023.
\bibitem{rasool2022security}
Raihan~Ur Rasool, Hafiz~Farooq Ahmad, Wajid Rafique, Adnan Qayyum, and Junaid
Qadir.
\newblock Security and privacy of internet of medical things: A contemporary
review in the age of surveillance, botnets, and adversarial ml.
\newblock {\em Journal of Network and Computer Applications}, page 103332,
2022.
\bibitem{papernot2016distillation}
Nicolas Papernot, Patrick McDaniel, Xi~Wu, Somesh Jha, and Ananthram Swami.
\newblock Distillation as a defense to adversarial perturbations against deep
neural networks.
\newblock In {\em 2016 IEEE Symposium on Security and Privacy (SP)}, pages
582--597. IEEE, 2016.
\bibitem{vaswani2017attention}
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones,
Aidan~N Gomez, {\L}ukasz Kaiser, and Illia Polosukhin.
\newblock Attention is all you need.
\newblock {\em Advances in Neural Information Processing Systems}, 30, 2017.
\bibitem{naseer2021improving}
Muzammal Naseer, Kanchana Ranasinghe, Salman Khan, Fahad~Shahbaz Khan, and
Fatih Porikli.
\newblock On improving adversarial transferability of vision transformers.
\newblock In {\em The Tenth International Conference on Learning
Representations}, 2022.
\bibitem{Malik_2022_BMVC}
Hashmat~Shadab Malik, Shahina Kunhimon, Muzammal Naseer, Salman Khan, and
Fahad~Shahbaz Khan.
\newblock Adversarial pixel restoration as a pretext task for transferable
perturbations.
\newblock In {\em 33rd British Machine Vision Conference 2022, {BMVC} 2022,
London, UK, November 21-24, 2022}. {BMVA} Press, 2022.
\bibitem{wu2022towards}
Boxi Wu, Jindong Gu, Zhifeng Li, Deng Cai, Xiaofei He, and Wei Liu.
\newblock Towards efficient adversarial training on vision transformers.
\newblock In {\em Computer Vision--ECCV 2022: 17th European Conference, Tel
Aviv, Israel, October 23--27, 2022, Proceedings, Part XIII}, pages 307--325.
Springer, 2022.
\bibitem{rahman2020reliable}
Tawsifur Rahman, Amith Khandakar, Muhammad~Abdul Kadir, Khandaker~Rejaul Islam,
Khandakar~F Islam, Rashid Mazhar, Tahir Hamid, Mohammad~Tariqul Islam, Saad
Kashem, Zaid~Bin Mahbub, et~al.
\newblock Reliable tuberculosis detection using chest x-ray with deep learning,
segmentation and visualization.
\newblock {\em IEEE Access}, 8:191586--191601, 2020.
\bibitem{rauber2020foolbox}
Jonas Rauber, Roland Zimmermann, Matthias Bethge, and Wieland Brendel.
\newblock Foolbox native: Fast adversarial attacks to benchmark the robustness
of ml models in pytorch, tensorflow, and jax.
\newblock {\em Journal of Open Source Software}, 5(53):2607, 2020.
\bibitem{madry2017towards}
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and
Adrian Vladu.
\newblock Towards deep learning models resistant to adversarial attacks.
\newblock In {\em International Conference on Learning Representations}, 2018.
\bibitem{croce2020reliable}
Francesco Croce and Matthias Hein.
\newblock Reliable evaluation of adversarial robustness with an ensemble of
diverse parameter-free attacks.
\newblock In {\em International Conference on Machine Learning}, pages
2206--2216. PMLR, 2020.
\bibitem{zhou2021decentralized}
Xin Zhou, Zhepei Wang, Xiangyong Wen, Jiangchao Zhu, Chao Xu, and Fei Gao.
\newblock Decentralized spatial-temporal trajectory planning for multicopter
swarms.
\newblock {\em arXiv preprint arXiv:2106.12481}, 2021.
\bibitem{carlini2017towards}
Nicholas Carlini and David Wagner.
\newblock Towards evaluating the robustness of neural networks.
\newblock In {\em 2017 IEEE Symposium on Security and Privacy (sp)}, pages
39--57. IEEE, 2017.
\end{thebibliography}