EVADE: A novel method to detect adversarial and OOD samples in Medical Image Segmentation

Abstract

The evolution of Deep Learning (DL) models in the healthcare domain has significantly advanced the automation of Medical Image Segmentation (MIS). Unfortunately, such models often perform erroneously when confronted with anomalous samples, such as adversarial inputs and out-of-distribution (OOD) data. Adversarial samples introduce human-imperceptible perturbations into the input, whereas OOD samples represent input data with significant distribution shifts. As these samples drastically diminish the robustness and performance of the DL-based MIS models, a robust detection method is essential to mitigate their detrimental impact on life-critical healthcare applications. To identify such samples, several existing works largely centred on medical image classification, which requires network retraining. In contrast, this paper proposes a unified method, EVADE (dEtection of adVersarial And OOD SamplEs), aiming to distinguish adversarial and OOD samples from clean samples for MIS while neglecting ground truth and network retraining. It leverages the observation that clean samples exhibit high consistency with their rotated variants as the MIS model provides rotation-agnostic predictions. In contrast, the consistency drops for adversarial samples because the rotation diminishes the impact of perturbations. Similarly, OOD samples exhibit reduced consistency due to their inherently random behaviour in output. Thus, our proposed method, EVADE evaluates the consistency between the MIS prediction of input and its corresponding rotated variants to detect adversarial and OOD samples. Experimental results on publicly available datasets demonstrate that EVADE surpasses existing detection methods, achieving a detection success rate of up to 89.01% for adversarial detection and up to 75.38% for OOD detection across state-of-the-art MIS models. © 2025 Elsevier Ltd