  Deep neural networks (DNNs) are vulnerable to adversarial noises. Adversarial
training is a general and effective strategy to improve DNN robustness (i.e.,
accuracy on noisy data) against adversarial noises. However, DNN models trained
by the current existing adversarial training methods may have much lower
standard accuracy (i.e., accuracy on clean data), compared to the same models
trained by the standard method on clean data, and this phenomenon is known as
the trade-off between accuracy and robustness and is considered unavoidable.
This issue prevents adversarial training from being used in many application
domains, such as medical image analysis, as practitioners do not want to
sacrifice standard accuracy too much in exchange for adversarial robustness.
Our objective is to lift (i.e., alleviate or even avoid) this trade-off between
standard accuracy and adversarial robustness for medical image classification
and segmentation. We propose a novel adversarial training method, named
Increasing-Margin Adversarial (IMA) Training, which is supported by an
equilibrium state analysis about the optimality of adversarial training
samples. Our method aims to preserve accuracy while improving robustness by
generating optimal adversarial training samples. We evaluate our method and the
other eight representative methods on six publicly available image datasets
corrupted by noises generated by AutoAttack and white-noise attack. Our method
achieves the highest adversarial robustness for image classification and
segmentation with the smallest reduction in accuracy on clean data. For one of
the applications, our method improves both accuracy and robustness. Our study
has demonstrated that our method can lift the trade-off between standard
accuracy and adversarial robustness for the image classification and
segmentation applications.
