{
  "abstract": "Deep learning-based segmentation models are increasingly integrated into clinical imaging workflows, yet their robustness to adversarial perturbations remains incompletely characterized, particularly for ultrasound images. We evaluated adversarial attacks and inference-time defenses for thyroid nodule segmentation in B-mode ultrasound. Two black-box adversarial attacks were developed: (1) Structured Speckle Amplification Attack (SSAA), which injects boundary-targeted noise, and (2) Frequency-Domain Ultrasound Attack (FDUA), which applies bandpass-filtered phase perturbations in the Fourier domain. Three inference-time mitigations were evaluated on adversarial images: randomized preprocessing with test-time augmentation, deterministic input denoising, and stochastic ensemble inference with consistency-aware aggregation. Experiments were conducted on a U-Net segmentation model trained on cine-clips from a database of 192 thyroid nodules. The baseline model achieved a mean Dice similarity coefficient (DSC) of 0.76 (SD 0.20) on unperturbed images. SSAA reduced DSC by 0.29 (SD 0.20), from 0.76 to 0.47, while maintaining high visual similarity (SSIM = 0.94). FDUA resulted in a smaller DSC reduction of 0.11 (SD 0.09), from 0.76 to 0.65, with lower visual fidelity (SSIM = 0.82). Against SSAA, all three defenses significantly improved DSC after correction, with deterministic denoising showing the largest recovery (+0.10, p < 0.001), followed by randomized preprocessing (+0.09, p < 0.001), and stochastic ensemble inference (+0.08, p = 0.002). No defense achieved statistically significant improvement against FDUA, although recall consistently improved at the cost of reduced precision. The tested inference-time defenses therefore partially mitigated spatial-domain perturbations, whereas statistically significant DSC recovery was not demonstrated against frequency-domain perturbations, highlighting attack-specific challenges in adversarial robustness evaluation. Author summary: Artificial intelligence systems are increasingly used to assist with medical image analysis, including thyroid nodule segmentation on ultrasound. These systems are typically evaluated using standard test images, yet subtle image changes can alter model behaviour. We examined how a deep learning model for thyroid nodule segmentation responds to deliberate, visually plausible image perturbations introduced under conditions where the attacker cannot access the model’s internal workings. Reference segmentations were used to evaluate worst-case vulnerability. We developed two ultrasound-specific perturbation strategies, one targeting spatial texture patterns and another affecting frequency-based image structure, and evaluated their impact on segmentation performance. We also tested three strategies that can be applied without model retraining, including image augmentation, input denoising, and aggregation of multiple predictions. We found that spatially localized perturbations could substantially degrade segmentation performance while preserving visual similarity, whereas frequency-based perturbations were less visually faithful. The evaluated strategies partially improved performance against spatial perturbations, while statistically significant recovery was not demonstrated against frequency-based perturbations. Our findings suggest that robustness depends on both imaging characteristics and perturbation structure. Although limited to one model and dataset, this study highlights the importance of evaluating model reliability beyond standard test conditions before clinical deployment.",
  "abstract_shown": true,
  "affiliations": [
    "Temerty Faculty of Medicine, University of Toronto, Toronto, Ontario, Canada",
    "Faculty of Engineering, McMaster University, Hamilton, Ontario, Canada"
  ],
  "article_type": "Research Article",
  "arxiv": null,
  "author_total": 2,
  "authors": [
    {
      "affs": [
        0
      ],
      "name": "Nicholas Dietrich",
      "orcid": "0009-0007-1556-8343"
    },
    {
      "affs": [
        1
      ],
      "name": "David McShannon",
      "orcid": "0009-0000-6321-0193"
    }
  ],
  "bibtex": "https://research.draconitic.com/paper/e74wbw21ffhx8.bib",
  "cited_by": 0,
  "doi": "10.1371/journal.pdig.0001797",
  "fulltext_url": "https://journals.plos.org/digitalhealth/article?id=10.1371/journal.pdig.0001797",
  "id": "e74wbw21ffhx8",
  "issns": [
    "2767-3170"
  ],
  "landing_url": "https://journals.plos.org/digitalhealth/article?id=10.1371/journal.pdig.0001797",
  "language": "en",
  "licence": "CC-BY-4.0",
  "licence_label": "CC BY 4.0",
  "licence_source": "article",
  "licence_url": "https://creativecommons.org/licenses/by/4.0/",
  "metadata_licence": null,
  "native_subjects": [
    [
      "heading",
      "Anatomy"
    ],
    [
      "heading",
      "Artificial Intelligence"
    ],
    [
      "heading",
      "Biology and Life Sciences"
    ],
    [
      "heading",
      "Cognitive Psychology"
    ],
    [
      "heading",
      "Cognitive Science"
    ],
    [
      "heading",
      "Computer and Information Sciences"
    ],
    [
      "heading",
      "Deep Learning"
    ],
    [
      "heading",
      "Diagnostic Medicine"
    ],
    [
      "heading",
      "Diagnostic Radiology"
    ],
    [
      "heading",
      "Earth Sciences"
    ],
    [
      "heading",
      "Endocrine System"
    ],
    [
      "heading",
      "Engineering and Technology"
    ],
    [
      "heading",
      "Imaging Techniques"
    ],
    [
      "heading",
      "Machine Learning"
    ],
    [
      "heading",
      "Medicine and Health Sciences"
    ],
    [
      "heading",
      "Neuroscience"
    ],
    [
      "heading",
      "Perception"
    ],
    [
      "heading",
      "Preprocessing"
    ],
    [
      "heading",
      "Psychology"
    ],
    [
      "heading",
      "Radiology and Imaging"
    ],
    [
      "heading",
      "Research Article"
    ],
    [
      "heading",
      "Research and Analysis Methods"
    ],
    [
      "heading",
      "Sensory Perception"
    ],
    [
      "heading",
      "Signal Amplification"
    ],
    [
      "heading",
      "Signal Processing"
    ],
    [
      "heading",
      "Social Sciences"
    ],
    [
      "heading",
      "Software Engineering"
    ],
    [
      "heading",
      "Soil Perturbation"
    ],
    [
      "heading",
      "Soil Science"
    ],
    [
      "heading",
      "Thyroid"
    ],
    [
      "heading",
      "Ultrasound Imaging"
    ],
    [
      "heading",
      "Vision"
    ],
    [
      "plos",
      "/Biology and life sciences/Anatomy/Endocrine system/Thyroid"
    ],
    [
      "plos",
      "/Biology and life sciences/Neuroscience/Cognitive science/Cognitive psychology/Perception/Sensory perception/Vision"
    ],
    [
      "plos",
      "/Biology and life sciences/Neuroscience/Sensory perception/Vision"
    ],
    [
      "plos",
      "/Biology and life sciences/Psychology/Cognitive psychology/Perception/Sensory perception/Vision"
    ],
    [
      "plos",
      "/Computer and information sciences/Artificial intelligence"
    ],
    [
      "plos",
      "/Computer and information sciences/Artificial intelligence/Machine learning/Deep learning"
    ],
    [
      "plos",
      "/Computer and information sciences/Software engineering/Preprocessing"
    ],
    [
      "plos",
      "/Earth sciences/Soil science/Soil perturbation"
    ],
    [
      "plos",
      "/Engineering and technology/Signal processing/Signal amplification"
    ],
    [
      "plos",
      "/Engineering and technology/Software engineering/Preprocessing"
    ],
    [
      "plos",
      "/Medicine and health sciences/Anatomy/Endocrine system/Thyroid"
    ],
    [
      "plos",
      "/Medicine and health sciences/Diagnostic medicine/Diagnostic radiology/Ultrasound imaging"
    ],
    [
      "plos",
      "/Medicine and health sciences/Radiology and imaging/Diagnostic radiology/Ultrasound imaging"
    ],
    [
      "plos",
      "/Research and analysis methods/Imaging techniques/Diagnostic radiology/Ultrasound imaging"
    ],
    [
      "plos",
      "/Social sciences/Psychology/Cognitive psychology/Perception/Sensory perception/Vision"
    ]
  ],
  "openalex": null,
  "pdf_url": "https://journals.plos.org/digitalhealth/article/file?id=10.1371/journal.pdig.0001797&type=printable",
  "pmcid": "PMC13734574",
  "pmid": "42981353",
  "published": "2026-11-04",
  "publisher": "Public Library of Science",
  "ris": "https://research.draconitic.com/paper/e74wbw21ffhx8.ris",
  "sources": [
    {
      "first_seen": "2026-11-05T12:20:11Z",
      "native_id": "10.1371/journal.pdig.0001797",
      "source": "plos",
      "url": "https://journals.plos.org/digitalhealth/article?id=10.1371/journal.pdig.0001797"
    },
    {
      "first_seen": "2026-11-08T12:24:01Z",
      "native_id": "PMC13734574",
      "source": "pmc",
      "url": "https://doi.org/10.1371/journal.pdig.0001797"
    }
  ],
  "subjects": [
    {
      "field": "biology",
      "origin": "plos:neuroscience",
      "subfield": "neuroscience"
    },
    {
      "field": "earth",
      "origin": "heading:Soil Science",
      "subfield": "hydrology-soils"
    },
    {
      "field": "medicine",
      "origin": "plos:diagnostic radiology",
      "subfield": "imaging"
    },
    {
      "field": "medicine",
      "origin": "plos:anatomy",
      "subfield": "physiology"
    }
  ],
  "title": "Adversarial robustness of deep learning-based thyroid nodule segmentation in ultrasound",
  "title_text": "Adversarial robustness of deep learning-based thyroid nodule segmentation in ultrasound",
  "type": "peer-reviewed",
  "updated_at": "2026-11-08T12:24:01Z",
  "url": "https://research.draconitic.com/paper/e74wbw21ffhx8",
  "venue": "PLOS Digital Health",
  "versions": []
}