Deep learning (DL) methods have become the state-of-the-art for reconstructing sub-sampled magnetic resonance imaging (MRI) data. However, studies have shown that these methods are susceptible to small adversarial input perturbations, resulting in major distortions in the output images. Various strategies have been proposed to reduce the effects of these attacks, but they require retraining. In this work, we propose a novel approach for mitigating adversarial attacks on MRI reconstruction models without any retraining. Based on the idea of cyclic measurement consistency, we devise a novel mitigation objective that is minimized in a small ball around the attack input. Results show that our method substantially reduces the impact of adversarial perturbations across different datasets, attack types/strengths and PD-DL networks, and qualitatively and quantitatively outperforms conventional mitigation methods. We also introduce a practically relevant scenario for small adversarial perturbations that models impulse noise in raw data, which relates to herringbone artifacts, and show the applicability of our approach in this setting. Finally, we show our mitigation approach remains effective in two realistic extension scenarios: a blind setup, where the attack strength or algorithm is not known to the user; and an adaptive attack setup, where the attacker has full knowledge of the defense strategy.

翻译：深度学习方法已成为子采样磁共振成像数据重建的主流技术。然而研究表明，这些方法易受微小对抗输入扰动的影响，导致输出图像出现严重失真。现有多种策略可降低此类攻击效果，但均需重新训练模型。本研究提出一种无需重新训练即可缓解磁共振成像重建模型对抗攻击的新方法。基于循环测量一致性思想，我们设计了一种新型缓解目标函数，该函数在攻击输入周围的微小邻域内最小化。实验结果表明，该方法能显著降低不同数据集、攻击类型/强度及PD-DL网络中的对抗扰动影响，在定性与定量评估中均优于传统缓解方法。我们还引入了一种具有实际意义的小幅对抗扰动场景，该场景对原始数据中的脉冲噪声（与人字形伪影相关）进行建模，并验证了本方法的适用性。最后，我们证明了本缓解方法在两种实际扩展场景中仍然有效：一是盲设置场景，即用户未知攻击强度或算法；二是自适应攻击设置场景，即攻击者完全了解防御策略。