Remarkable successes were made in Medical Image Classification (MIC) recently, mainly due to wide applications of convolutional neural networks (CNNs). However, adversarial examples (AEs) exhibited imperceptible similarity with raw data, raising serious concerns on network robustness. Although adversarial training (AT), in responding to malevolent AEs, was recognized as an effective approach to improve robustness, it was challenging to overcome generalization decline of networks caused by the AT. In this paper, in order to reserve high generalization while improving robustness, we proposed a dynamic perturbation-adaptive adversarial training (DPAAT) method, which placed AT in a dynamic learning environment to generate adaptive data-level perturbations and provided a dynamically updated criterion by loss information collections to handle the disadvantage of fixed perturbation sizes in conventional AT methods and the dependence on external transference. Comprehensive testing on dermatology HAM10000 dataset showed that the DPAAT not only achieved better robustness improvement and generalization preservation but also significantly enhanced mean average precision and interpretability on various CNNs, indicating its great potential as a generic adversarial training method on the MIC.

翻译：近期，医学图像分类（MIC）取得了显著成功，主要得益于卷积神经网络（CNN）的广泛应用。然而，对抗样本（AE）与原始数据具有难以察觉的相似性，引发了关于网络鲁棒性的严重担忧。尽管对抗训练（AT）作为应对恶意对抗样本的有效方法被公认可提升鲁棒性，但克服AT导致的网络泛化能力下降仍具挑战性。本文为在保持高泛化能力的同时提升鲁棒性，提出了一种动态扰动自适应对抗训练（DPAAT）方法。该方法将对抗训练置于动态学习环境中，生成自适应数据级扰动，并通过损失信息收集提供动态更新准则，从而克服传统对抗训练方法中固定扰动大小及对外部迁移依赖的缺陷。在皮肤病学HAM10000数据集上的综合测试表明，DPAAT不仅实现了更好的鲁棒性提升与泛化保持能力，还显著增强了多种CNN的均值平均精度与可解释性，证实其作为医学图像分类领域通用对抗训练方法的巨大潜力。