Adversarial robustness of deep learning-based thyroid nodule segmentation in ultrasound
- 1Temerty Faculty of Medicine, University of Toronto, Toronto, Ontario, Canada
- 2Faculty of Engineering, McMaster University, Hamilton, Ontario, Canada
Abstract
Deep learning-based segmentation models are increasingly integrated into clinical imaging workflows, yet their robustness to adversarial perturbations remains incompletely characterized, particularly for ultrasound images. We evaluated adversarial attacks and inference-time defenses for thyroid nodule segmentation in B-mode ultrasound. Two black-box adversarial attacks were developed: (1) Structured Speckle Amplification Attack (SSAA), which injects boundary-targeted noise, and (2) Frequency-Domain Ultrasound Attack (FDUA), which applies bandpass-filtered phase perturbations in the Fourier domain. Three inference-time mitigations were evaluated on adversarial images: randomized preprocessing with test-time augmentation, deterministic input denoising, and stochastic ensemble inference with consistency-aware aggregation. Experiments were conducted on a U-Net segmentation model trained on cine-clips from a database of 192 thyroid nodules. The baseline model achieved a mean Dice similarity coefficient (DSC) of 0.76 (SD 0.20) on unperturbed images. SSAA reduced DSC by 0.29 (SD 0.20), from 0.76 to 0.47, while maintaining high visual similarity (SSIM = 0.94). FDUA resulted in a smaller DSC reduction of 0.11 (SD 0.09), from 0.76 to 0.65, with lower visual fidelity (SSIM = 0.82). Against SSAA, all three defenses significantly improved DSC after correction, with deterministic denoising showing the largest recovery (+0.10, p < 0.001), followed by randomized preprocessing (+0.09, p < 0.001), and stochastic ensemble inference (+0.08, p = 0.002). No defense achieved statistically significant improvement against FDUA, although recall consistently improved at the cost of reduced precision. The tested inference-time defenses therefore partially mitigated spatial-domain perturbations, whereas statistically significant DSC recovery was not demonstrated against frequency-domain perturbations, highlighting attack-specific challenges in adversarial robustness evaluation. Author summary: Artificial intelligence systems are increasingly used to assist with medical image analysis, including thyroid nodule segmentation on ultrasound. These systems are typically evaluated using standard test images, yet subtle image changes can alter model behaviour. We examined how a deep learning model for thyroid nodule segmentation responds to deliberate, visually plausible image perturbations introduced under conditions where the attacker cannot access the model’s internal workings. Reference segmentations were used to evaluate worst-case vulnerability. We developed two ultrasound-specific perturbation strategies, one targeting spatial texture patterns and another affecting frequency-based image structure, and evaluated their impact on segmentation performance. We also tested three strategies that can be applied without model retraining, including image augmentation, input denoising, and aggregation of multiple predictions. We found that spatially localized perturbations could substantially degrade segmentation performance while preserving visual similarity, whereas frequency-based perturbations were less visually faithful. The evaluated strategies partially improved performance against spatial perturbations, while statistically significant recovery was not demonstrated against frequency-based perturbations. Our findings suggest that robustness depends on both imaging characteristics and perturbation structure. Although limited to one model and dataset, this study highlights the importance of evaluating model reliability beyond standard test conditions before clinical deployment.
Related
- InterHDC: Interactive hierarchical discrepancy compensation modeling for thyroid ultrasound segmentation
- Neural prediction decorrelation reveals that adversarial robustness substantially improves DNN prediction accuracy across the entire human auditory cortex
- Adversarial robustness does not entail human-aligned categorization
- Connexin-43 links Neuromesodermal progenitor states to segmentation clock robustness during vertebrate axis elongation
- A high robustness decoding technique for ultrasound modulated electroencephalogram
BibTeX
@article{dietrich2026adversarial,
title = {{Adversarial robustness of deep learning-based thyroid nodule segmentation in ultrasound}},
author = {Nicholas Dietrich and David McShannon},
journal = {PLOS Digital Health},
year = {2026},
month = nov,
doi = {10.1371/journal.pdig.0001797},
url = {https://journals.plos.org/digitalhealth/article?id=10.1371/journal.pdig.0001797},
note = {CC BY 4.0},
}
RIS
TY - JOUR
TI - Adversarial robustness of deep learning-based thyroid nodule segmentation in ultrasound
AU - Nicholas Dietrich
AU - David McShannon
PY - 2026
DA - 2026/11/04
JO - PLOS Digital Health
DO - 10.1371/journal.pdig.0001797
UR - https://journals.plos.org/digitalhealth/article?id=10.1371/journal.pdig.0001797
AB - Deep learning-based segmentation models are increasingly integrated into clinical imaging workflows, yet their robustness to adversarial perturbations remains incompletely characterized, particularly for ultrasound images. We evaluated adversarial attacks and inference-time defenses for thyroid nodule segmentation in B-mode ultrasound. Two black-box adversarial attacks were developed: (1) Structured Speckle Amplification Attack (SSAA), which injects boundary-targeted noise, and (2) Frequency-Domain Ultrasound Attack (FDUA), which applies bandpass-filtered phase perturbations in the Fourier domain. Three inference-time mitigations were evaluated on adversarial images: randomized preprocessing with test-time augmentation, deterministic input denoising, and stochastic ensemble inference with consistency-aware aggregation. Experiments were conducted on a U-Net segmentation model trained on cine-clips from a database of 192 thyroid nodules. The baseline model achieved a mean Dice similarity coefficient (DSC) of 0.76 (SD 0.20) on unperturbed images. SSAA reduced DSC by 0.29 (SD 0.20), from 0.76 to 0.47, while maintaining high visual similarity (SSIM = 0.94). FDUA resulted in a smaller DSC reduction of 0.11 (SD 0.09), from 0.76 to 0.65, with lower visual fidelity (SSIM = 0.82). Against SSAA, all three defenses significantly improved DSC after correction, with deterministic denoising showing the largest recovery (+0.10, p < 0.001), followed by randomized preprocessing (+0.09, p < 0.001), and stochastic ensemble inference (+0.08, p = 0.002). No defense achieved statistically significant improvement against FDUA, although recall consistently improved at the cost of reduced precision. The tested inference-time defenses therefore partially mitigated spatial-domain perturbations, whereas statistically significant DSC recovery was not demonstrated against frequency-domain perturbations, highlighting attack-specific challenges in adversarial robustness evaluation. Author summary: Artificial intelligence systems are increasingly used to assist with medical image analysis, including thyroid nodule segmentation on ultrasound. These systems are typically evaluated using standard test images, yet subtle image changes can alter model behaviour. We examined how a deep learning model for thyroid nodule segmentation responds to deliberate, visually plausible image perturbations introduced under conditions where the attacker cannot access the model’s internal workings. Reference segmentations were used to evaluate worst-case vulnerability. We developed two ultrasound-specific perturbation strategies, one targeting spatial texture patterns and another affecting frequency-based image structure, and evaluated their impact on segmentation performance. We also tested three strategies that can be applied without model retraining, including image augmentation, input denoising, and aggregation of multiple predictions. We found that spatially localized perturbations could substantially degrade segmentation performance while preserving visual similarity, whereas frequency-based perturbations were less visually faithful. The evaluated strategies partially improved performance against spatial perturbations, while statistically significant recovery was not demonstrated against frequency-based perturbations. Our findings suggest that robustness depends on both imaging characteristics and perturbation structure. Although limited to one model and dataset, this study highlights the importance of evaluating model reliability beyond standard test conditions before clinical deployment.
SN - 2767-3170
ER -