Explainable Adversarial Attack Detection in Medical Images Using Layer-wise Progressive Activation Maps (PLAN)

Medical image analysis is a key application area for deep learning models, and these models are susceptible to adversarial attacks and can lead to unexpected changes in the results, thus compromising the clinical validity. This paper introduces an explainable adversarial attack detection framework that examines the activation patterns of several convolutional layers rather than just a last layer feature representation, called Layer-wise Progressive Activation Maps (PLAN). PLAN produces progressive activation maps, fuses them into a single explainability map and recovers activation properties such as entropy, activation area ratio, maximum activation, and concentration score. All of these features are aggregated into a PLAN Attack Score: images with scores higher than 1.35 are considered to be adversarial, and lower scores are considered to be clean images. PLAN also includes a quantitative score as well as suspicious regions to visually interpret. The experimental results show the effectiveness of detecting adversarial images and the improvement in transparency, robustness, and trustworthiness in the medical diagnosis process of AI algorithms.