Adversarial robustness of deep learning-based thyroid nodule segmentation in ultrasound

Author summary Artificial intelligence systems are increasingly used to assist with medical image analysis, including thyroid nodule segmentation on ultrasound. These systems are typically evaluated using standard test images, yet subtle image changes can alter model behaviour. We examined how a deep learning model for thyroid nodule segmentation responds to deliberate, visually plausible image perturbations introduced under conditions where the attacker cannot access the model’s internal workings. Reference seg…

By the Truvace deskNovember 5, 20262 min read1 sourceEvidence: Moderate · 52/100 — Benchmark or lab evaluation · n = 192 · 1 independent sourceJournalismTRV-2026-2375· cite & verify

Adversarial robustness of deep learning-based thyroid nodule segmentation in ultrasound

In brief

Researchers tested a U-Net model that outlines thyroid nodules on ultrasound against two black-box attacks. The speckle-based attack (SSAA) cut the mean Dice score from 0.76 to 0.47 while keeping images visually near-identical (SSIM 0.94). The frequency-based attack (FDUA) cut it to 0.65.

Three defenses that need no retraining were tried. Against SSAA, denoising added 0.10 Dice, randomized preprocessing 0.09 and a stochastic ensemble 0.08, all statistically significant. None produced a significant gain against FDUA, though recall rose while precision fell.

The results matter because AI segmentation is moving into networked clinical imaging, where cloud platforms and image archives could expose query access. A Dice of 0.47 could distort nodule size measurements, though the study did not test downstream clinical decisions, and the attacker was given reference masks as a worst-case stress test.

Main points

The U-Net was trained on 192 biopsy-confirmed nodules from 167 patients (17,412 frames) and tested on 31 nodules, reaching a baseline Dice of 0.76.
SSAA dropped Dice by 0.29 (d = 1.46); FDUA dropped it by 0.11 with lower visual fidelity (SSIM 0.82).
The generic SimBA attack cut Dice by only 0.01 at the same 500-query budget, so ultrasound-specific attacks were far more damaging.
Against SSAA, denoising recovered 35.57% of lost Dice, randomized preprocessing 29.29% and the ensemble 28.24%.
Defenses cost almost nothing on clean images, lowering Dice by at most 0.0031.
Against FDUA, Dice recovery was 8.06% to 20.60% and not significant, though recall recovery reached 87.65% with denoising while precision fell.
Post-hoc power analysis showed under 5% power for FDUA defense effects, so those null results are inconclusive.

The gain

Simple inference-time denoising restored about 36% of lost segmentation accuracy (Dice +0.10) against the spatial-noise attack, with negligible cost on clean images.

The rundown

The threat model assumed an attacker who can send images to the model and see only the output mask, as might occur with cloud diagnostic platforms or imaging archives with AI modules. Each attack had 500 queries per clip, applied to the middle frame, and used reference masks to guide optimization, which the authors describe as a worst-case oracle-assisted test.

SSAA injects Rayleigh-distributed noise near the predicted nodule boundary; FDUA adds phase noise within a Fourier band. SSAA lowered precision from 0.81 to 0.58 and recall from 0.76 to 0.52, while FDUA mainly caused under-segmentation, with recall falling to 0.68.

The three defenses were applied to adversarial images generated once against the undefended model, so the attacker did not adapt. Denoising used a Gaussian blur plus median filter, while the other two averaged five randomized copies of the input. Statistical testing used paired Wilcoxon tests with Bonferroni correction across six comparisons.

The authors suggest training-time exposure to frequency perturbations, architecturally diverse ensembles and consistency-based flagging of unstable segmentations for human review as next steps.