DOI: 10.65520/erciyesfen.1997805 ISSN: 1012-2354

Evaluation of Adversarial Robustness in Deep Learning-Based Colorectal Histopathology Classification

Tuğba Karataş, Mustafa Etcil, Burak Kolukisa
Show PDF Cite
Background/Aim: Deep learning models can achieve high accuracy in colorectal histopathology classification, but their performance may decrease under adversarial perturbations. This study aimed to evaluate the adversarial robustness of a 2D-CNN across two colorectal histopathology datasets under FGSM, PGD, and BIM attacks and to compare adversarial training with convolutional autoencoder (CAE)-based input purification as defense strategies.Methods: Experiments were conducted on the Kather Texture 2016 and CRC-VAL-HE-7K datasets, containing 5,000 and 7,180 image patches from eight and nine colorectal tissue classes, respectively. A 2D-CNN was trained using five-fold stratified cross-validation and evaluated on held-out test sets. White-box FGSM, PGD, and BIM attacks were applied across multiple perturbation levels. Adversarial training was examined using three clean-to-adversarial training compositions. For input purification, shallow, deep, and mixed-ε deep CAE models were evaluated. Performance was assessed using accuracy, macro precision, macro recall, and macro F1-score. Results: The 2D-CNN achieved 87.70% and 89.35% clean test accuracy on Kather Texture 2016 and CRC-VAL-HE-7K, respectively, but performance declined markedly under adversarial attacks, particularly on CRC-VAL-HE-7K. Adversarial training substantially improved robustness at ε = 0.01, although the best training composition varied across datasets and attacks. Mixed-ε deep CAE generally provided the strongest purification performance at higher perturbation levels. Conclusion: Despite its clean-image classification performance, the 2D-CNN remained vulnerable to adversarial perturbations. Both defense strategies generally improved performance under the evaluated adversarial conditions: adversarial training substantially improved performance at ε = 0.01, whereas mixed-ε CAE purification generally showed stronger relative performance at higher perturbation levels.

More from our Archive