Reversing Adversarial Attacks on Skin Cancer AI With Multiscale Noise

The problem nobody wants to think about

Skin cancer screening was one of the first places deep learning actually earned its hype. A 2017 Nature paper by Esteva and colleagues showed a convolutional network matching board certified dermatologists at distinguishing benign moles from malignant ones, and the FDA cleared the first AI driven diagnostic system for clinical use the following year. That track record is why hospitals, telehealth platforms, and even insurance companies now lean on these models somewhere in their workflow.

The trouble is that the same models trained to spot subtle patterns in pixel data are also exquisitely sensitive to patterns an attacker plants on purpose. Adversarial examples, images altered by a perturbation too small for a person to notice, can flip a model’s prediction with near total reliability. The authors sketch a scenario that is uncomfortably plausible. A patient with a confirmed cancer diagnosis edits their scan just enough to have it read as benign, then submits it to an insurer that automates claim review with the same kind of model. Wrong decisions, and financial exposure, follow directly from a vulnerability that has nothing to do with medicine and everything to do with how these networks process images.

That risk has been documented before. Finlayson and colleagues warned about adversarial attacks on medical machine learning in Science back in 2019, and a growing body of work since then, including Ma and colleagues writing in Pattern Recognition, has shown medical image classifiers are if anything more fragile than natural image classifiers, not less. What has been missing is a defense a hospital IT team could actually deploy without a machine learning research budget.

Why existing defenses fall short here

Broadly, prior adversarial defenses split into three camps, and the paper is candid about why none of them fit a clinical deployment well.

Robustness based defenses retrain a classifier on a mix of clean and adversarial images so it learns to ignore the perturbation. This works, sort of, but retraining a diagnostic model already validated for clinical use is slow, expensive, and reopens questions about regulatory approval every time the training data changes.

Certified defenses, following work by Cohen, Rosenfeld, and Kolter on randomized smoothing, mathematically guarantee robustness within a bounded radius around an input. The guarantee sounds appealing until you notice the radius is usually too small to matter in practice, and the approach struggles against attacks that manipulate color rather than fine grained pixel noise.

Purification defenses try to clean an adversarial image before it ever reaches the classifier, which is the family MDDA belongs to. The authors tested existing purification methods on skin images directly and found the two big weaknesses. Some, like feature squeezing through bit depth reduction, simply do not remove enough of the adversarial signal. Others, like GPU heavy super resolution or diffusion based purification, take minutes per image on a high end server, a nonstarter for a diagnostic tool meant to run on a phone or a modest clinic workstation.

The core idea, fight fire with fire

The intuition behind MDDA rests on a simple picture of how adversarial examples behave statistically. Clean, realistic images occupy the dense, high probability regions of the space of all possible images. An adversarial perturbation nudges a clean image just far enough to land in a thin, low probability sliver near that region, close enough to look identical to a human, far enough to fool the classifier. If you inject the right kind of random noise into that adversarial image, you can knock it back out of the thin sliver and into the dense region nearby, effectively randomizing away the very specific, very deliberate structure the attacker crafted.

The catch is that a defender does not know which direction the attacker pushed the image, or by how much. Isotropic Gaussian noise, meaning noise with equal variance in every direction, sidesteps that problem by covering all directions at once. Diffusion models use exactly this kind of noise for image generation, but a full diffusion reversal takes hundreds or thousands of steps on a GPU. MDDA borrows the idea and prunes it down to a handful of steps, then pairs each noise injection with a fast denoising pass so the image does not simply dissolve into static.

How the pipeline actually works

The method has four stages, run inside a loop the authors call a diffusive and denoising aggregation block, or DDA block for short.

Multiscale processing

Skin lesion diagnosis leans heavily on texture and shape at multiple resolutions, so the authors first build an image pyramid at four scales, one quarter size, one half size, full size, and double size. Downsampling uses nearest neighbor sampling, upsampling uses bicubic sampling. Every subsequent operation runs on all four scales in parallel.

Diffusion, in small doses

At each of a small number of steps, the method adds a slice of Gaussian noise to every scale of the pyramid. Where a full diffusion model spreads its noise budget over a thousand steps, MDDA works with just a handful of steps, dividing a fixed variance budget across them, because the authors found that denoising heavily corrupted images afterward simply does not work well with a lightweight, training free denoiser.

Denoising with total variation filtering

Immediately after each noise injection, the pipeline denoises using the classic Rudin, Osher, and Fatemi total variation model, solved with a split Bregman optimization scheme. Total variation denoising favors piecewise smooth images, which suppresses random noise while still respecting the sharp boundary of a lesion against surrounding skin, the kind of structural cue a diagnostic model actually needs.

Aggregation across scales

Finally, each scale exchanges information with its immediate neighbor in the pyramid, averaging pixel values after resampling to a common resolution. This lets fine detail recovered at one scale reinforce a coarser scale that may have lost it, and vice versa.

After several DDA blocks run in sequence, every scale gets resampled back to the original resolution and averaged together into the final reversed image, the one that actually gets handed to the diagnostic model.

Two design choices are worth flagging because they explain the paper’s efficiency claims. First, the method needs no access to the victim model’s weights, gradients, or architecture, which is why the authors call it model agnostic. Second, there is no training loop anywhere in the pipeline, every operation is a closed form image processing step, which is why a single image can be purified without a GPU inference pass through some separate learned denoiser network.

How well does it actually work

The authors tested MDDA on ISIC 2019, currently one of the largest public multiclass skin cancer datasets, containing 5331 dermoscopic images spanning eight diagnostic categories from malignant melanoma and basal cell carcinoma down to benign conditions such as dermatofibroma and vascular lesions. Two classifiers were attacked, a ResNet50 and a MobileNetV2, both fine tuned on the dataset. Six attack methods were used to generate adversarial examples, from the classic single step FGSM attack up through the far stronger iterative PGD, CW, DIFGSM, and AutoAttack methods, at perturbation budgets of 2 out of 255 and 6 out of 255 pixel intensity levels.

Without any defense, the ResNet50 model’s 82.0 percent clean accuracy collapsed to single digits or literal zero percent under every attack except the comparatively weak FGSM. Three published purification defenses served as baselines, bit depth reduction, an image super resolution defense, and a neural representation purifier called NRP.

Selected figures from Table 2 of the paper, ResNet50 victim model, white box non targeted attacks, perturbation budget eps equals 2 out of 255. Values are percent classification accuracy, higher is better for a defense.

Against DIFGSM, described as the most damaging attack tested, MDDA beat the next best defense by 24.8 percentage points at the smaller perturbation budget and 23.4 points at the larger one. Averaged across every attack the paper tested, MDDA held roughly a 22 to 23 percentage point lead over NRP, the strongest baseline. Just as importantly, MDDA’s accuracy barely moved between different attack types, which the authors read as evidence of an attack agnostic defense, one that generalizes to attacks it never saw rather than one tuned to beat a specific method.

The proposed MDDA method performs similarly well regardless of the types of adversarial attacks. This interesting observation indicates that our method satisfies the attack agnostic property. Wang, Li, Shen, and Qiao, Computers in Biology and Medicine, 2023

Holding up when the attacker cannot see the real model

A more realistic threat model assumes the attacker cannot access the actual clinical model at all. Instead, they craft an attack against a substitute model with a different architecture and hope it transfers. The authors simulated this by attacking a MobileNetV2 classifier using adversarial examples generated against ResNet50. Even in this cross architecture setting, MDDA improved MobileNetV2’s average accuracy under attack from 40.8 percent with no defense to 57.7 percent, an improvement of almost 17 percentage points, again ahead of both SR and NRP.

A discrepancy worth knowing before you cite this paper

Here is the kind of detail that separates reading a paper from actually checking it. Table 2 lists MDDA’s clean, unattacked accuracy as two numbers, 69.1 percent for the smaller perturbation setting and 65.7 percent for the larger one, reflecting the fact that the authors used five DDA blocks for the eps 2/255 configuration and only three blocks for the eps 6/255 configuration. Every other defense in that same table, bit depth reduction, super resolution, and NRP, lists a single clean accuracy figure, because those methods do not change their own parameters between the two attack settings.

That alone is a fair modeling choice, not an error, but it means MDDA does not actually have one fixed clean accuracy the way the baselines do. A reader planning to deploy this defense needs to pick a DDA block count first, and that choice directly trades off how much clean accuracy they are willing to sacrifice for how much protection they want against a given attack strength.

Then there is a genuine inconsistency. In the Discussion section, the authors state their clean accuracy figure as 69.3 percent for the eps 2/255 setting when arguing about the cost of noise injection. Table 2, the actual results table, reports 69.1 percent for that identical configuration. It is a small gap, two tenths of a percentage point, almost certainly a rounding slip between an intermediate run and the final table rather than anything that changes the paper’s conclusions. Still, if you are citing an exact clean accuracy number from this paper in your own writing, cite the Table 2 figure of 69.1 percent, and flag the 69.3 percent figure in the Discussion as the version to treat with a little more caution.

Clinical translation gap

Everything above happened in a research pipeline, not a hospital. Several gaps stand between this result and something a clinic could adopt tomorrow.

The defense costs clean accuracy, and it costs the most on the rarer, harder classes. Confusion matrices in the paper show actinic keratosis, already a difficult category for both classifiers even without any attack or defense, becoming even more error prone once Gaussian noise is layered on top. A defense that quietly worsens performance on the hardest to diagnose category is not a neutral tradeoff for a clinical tool, it is a tradeoff that needs to be weighed against the actual harm of a missed or delayed diagnosis in that category.

The evaluation also used a white box or cross architecture attacker who knows the general defense is in place, but the paper does not test an adaptive attacker who knows specifically that MDDA, with its particular noise schedule and total variation denoiser, is the defense being used. Adaptive attacks have repeatedly broken purification defenses that looked strong against a fixed attack set, so this remains an open question the authors do not claim to have answered.

Finally, ISIC 2019 is a curated benchmark of dermoscopic images captured under fairly controlled conditions. A real deployment would face phone camera photos, inconsistent lighting, motion blur, and skin tones underrepresented in the training data, none of which this evaluation touches. None of this means the underlying idea is wrong, only that a defense validated on a clean research dataset is a first step, not a finished clinical safeguard.

Regulatory and safety notes

Any AI component sitting between a patient image and a diagnostic decision, including a purification layer like MDDA, sits inside the same regulatory conversation as the diagnostic model itself. The FDA cleared the first AI driven skin diagnostic system in 2018 as a decision support tool, not a replacement for a clinician’s judgment, and that framing matters here too. A defense that changes the pixels a classifier actually sees, even in service of security, is a modification to the diagnostic pipeline and would reasonably need its own validation and disclosure before clinical use, not an assumption that it is safe simply because it improves accuracy under attack in a lab setting.

What this means beyond one paper

Step back from the specific numbers and the underlying idea generalizes well beyond skin cancer. Any medical imaging pipeline built on a deep classifier, radiology, pathology slide analysis, retinal screening, faces the same basic exposure. An attacker who can touch the image before it reaches the model can potentially change the output. MDDA’s contribution is showing that a fast, training free, architecture agnostic purification step can meaningfully close that gap without demanding a GPU cluster or a retraining pipeline, which matters enormously for smaller clinics and mobile diagnostic tools that will never have research lab computing budgets.

The multiscale angle also deserves attention on its own. Most purification defenses in the broader adversarial robustness literature operate at a single resolution. Explicitly working across four scales and letting them reinforce each other through the aggregation step is a genuinely different structural choice from prior purification work, not just a new coefficient tuned on the same recipe, and it tracks with how radiologists and dermatologists themselves often examine an image at multiple zoom levels before committing to a read.

Honest limitations

Beyond the clinical translation gaps above, a few limitations are worth stating plainly, in the paper’s own numbers.

The dataset itself is imbalanced. ISIC 2019 contains 12875 melanocytic nevus images against just 239 dermatofibroma images and 253 vascular lesion images, an over fifty fold difference between the largest and smallest categories. The authors themselves note that MDDA’s protection is weaker on these smaller sample classes, and offer a plausible reason, if the underlying pretrained classifier was never well calibrated on a rare class to begin with, adding noise on top of an already fragile decision boundary can make things worse rather than better.

Parameter sensitivity is nontrivial too. The number of DDA blocks was grid searched separately for each perturbation budget, and the paper’s own sensitivity plot shows average accuracy actually declining once more than four blocks are used at the larger eps 6/255 setting, because the added noise starts to outweigh what the lightweight denoiser can clean up. A practitioner adopting this method inherits a tuning problem, not a single universal setting.

Sample size for the underlying dataset, 5331 images across eight classes with an 8 to 1 to 1 train, validation, test split, is modest by the standards of general purpose computer vision benchmarks, though it is a commonly used split size in this particular subfield of dermoscopic image analysis.

PyTorch implementation, multiscale diffusive and denoising defense

Below is a full, runnable reimplementation of the MDDA pipeline described in Section 3 and Algorithm 1 of the paper, including the multiscale pyramid, the truncated diffusion steps, a total variation denoiser solved with a stable gradient scheme equivalent to the split Bregman energy in Equation 13, and the neighboring scale aggregation. The smoke test at the bottom runs the whole pipeline on a synthetic lesion image, confirms the output stays inside the valid pixel range, and confirms that local pixel roughness introduced by a simulated adversarial perturbation drops after the defense runs, mirroring the paper’s own hypothesis about what the defense should accomplish.

Conclusion

The core achievement here is narrower and more useful than it might first sound. MDDA does not claim to make skin cancer diagnostic models unbreakable. It claims something more modest and more shippable, that a lightweight, training free image processing step can meaningfully blunt six different published attack methods across two different classifier architectures, using nothing more exotic than repeated Gaussian noise and a decades old total variation denoiser. On ISIC 2019, that modest claim translated into roughly a 23 percentage point average accuracy gain over the strongest prior purification baseline, which is not a small number in a field where incremental gains of a point or two are common.

The conceptual shift worth sitting with is the reframing of adversarial robustness as an image processing problem rather than purely a model training problem. Most of the adversarial defense literature assumes you either retrain the classifier or certify it mathematically. MDDA sidesteps both, treating the adversarial image itself as the thing to be repaired, independent of whatever model will eventually see it. That framing is what makes the method model agnostic in the first place, and it is also what makes it easy to imagine bolting onto an existing, already validated diagnostic pipeline without touching the model at all.

That same framing should transfer to other corners of medical imaging facing the identical exposure, radiology, pathology, ophthalmology, anywhere a deep classifier sits between a patient’s image and a consequential decision. The multiscale pyramid and the aggregation step are generic image operations, nothing here is specific to skin. Whether the same block counts and noise variance would translate cleanly to, say, chest X rays or retinal scans is an open empirical question the authors do not test, but the mechanism itself has no obvious reason to be skin specific.

The honest remaining limitations matter just as much as the headline numbers. A roughly 13 percentage point drop in clean accuracy is a real cost, not a rounding error, and it lands hardest on the diagnostic categories that were already the most error prone before any attack or defense entered the picture. An adaptive attacker who specifically targets MDDA’s noise and denoising schedule, rather than a generic fixed attack, has not been tested. And a curated research dataset like ISIC 2019 is not the same as the messy, inconsistent images a real clinical pipeline will actually encounter.

None of that erases the contribution. It just means MDDA reads best as a serious, well tested first step toward resource efficient adversarial defense in medical imaging, not a finished clinical safeguard, and the authors themselves seem to know it, closing the paper by flagging exactly the directions, pairing MDDA with an adversarial example detector, and extending it to other imaging domains, that would need to happen before anyone deploys this in a real diagnostic workflow.

Frequently asked questions

Related reading on aitrendblend.com