  Deep neural networks (DNNs) have become popular for medical image analysis
tasks like cancer diagnosis and lesion detection. However, a recent study
demonstrates that medical deep learning systems can be compromised by
carefully-engineered adversarial examples/attacks with small imperceptible
perturbations. This raises safety concerns about the deployment of these
systems in clinical settings. In this paper, we provide a deeper understanding
of adversarial examples in the context of medical images. We find that medical
DNN models can be more vulnerable to adversarial attacks compared to models for
natural images, according to two different viewpoints. Surprisingly, we also
find that medical adversarial attacks can be easily detected, i.e., simple
detectors can achieve over 98% detection AUC against state-of-the-art attacks,
due to fundamental feature differences compared to normal examples. We believe
these findings may be a useful basis to approach the design of more explainable
and secure medical deep learning systems.
