Interval Neural Networks as Instability Detectors for Image Reconstructions
Jan Macdonald Maximilian März Luis Oala Wojciech Samek
eess.IV cs.CV cs.LG stat.ML I.5.1; I.4.5; J.3; I.2.m




INNs as Instability Detectors





J. Macdonald et al.


Dept. of Mathematics, Technical University of Berlin, 10623 Berlin, Germany

{maerz,macdonald}@math.tu-berlin.de Machine Learning Group, Fraunhofer HHI,
10587 Berlin, Germany

{luis.oala,wojciech.samek}@hhi.fraunhofer.de

Interval Neural Networks as Instability Detectors for Image Reconstructions
    Jan MacdonaldEqual contribution in alphabetical order1 Maximilian März1 Luis Oala2Wojciech Samek2
    December 30, 2023
=====================================================================================================








This work investigates the detection of instabilities that may occur when utilizing deep learning models for image reconstruction tasks. Although neural networks often empirically outperform traditional reconstruction methods, their usage for sensitive medical applications remains controversial. Indeed, in a recent series of works, it has been demonstrated that deep learning approaches are susceptible to various types of instabilities, caused for instance by adversarial noise or out-of-distribution features. It is argued that this phenomenon can be observed regardless of the underlying architecture and that there is no easy remedy. Based on this insight, the present work demonstrates on two use cases how uncertainty quantification methods can be employed as instability detectors. In particular, it is shown that the recently proposed s are highly effective in revealing instabilities of reconstructions. Such an ability is crucial to ensure a safe use of deep learning-based methods for medical image reconstruction.    








§ INTRODUCTION


Deep learning has shown the potential to outperform traditional schemes for solving various signal recovery problems in medical imaging applications <cit.>.
Typically, such tasks are modelled as finite-dimensional linear inverse problems,

    =  + ,

where ∈^n is the unknown signal of interest, ∈^m× n denotes the forward operator representing a physical measurement process, and ∈^m is modelling noise in the measurements. Important examples include choosing  as the identity (denoising), a subsampled Fourier matrix (magnetic resonance imaging), or a discrete Radon transform (computed tomography).  
Solving the inverse problem (<ref>) amounts to computing an approximate reconstruction of  from its observed measurements . The difficulty of this task is mainly determined by the strength of the noise and the degree of ill-posedness of (<ref>), which is typically governed by the amount of undersampling in the measurement domain; cf. <cit.>. 

In many cases, sparse regularization provides state-of-the-art solvers for (<ref>), which are additionally backed up by theoretical guarantees, e.g. by compressed sensing <cit.>. Recently, it has been demonstrated that data-based deep learning methods are able to outperform their traditional counterparts in terms of empirical reconstruction quality and speed, however, the field is still in an early stage. Focusing primarily on recovery performance, aspects such as the reliability of reconstructions have not yet been extensively explored; see <cit.> for exceptions. 

In image classification, the susceptibility of deep neural networks to adversarial exploitation is well documented <cit.>. Recent works have reported similar instabilities for image reconstruction tasks <cit.>, which can be caused by visually imperceptible adversarial noise or features that have not been seen during training. Although there have been first attempts to alleviate these shortcomings <cit.>, <cit.> argues that such instabilities are in fact an unavoidable price for improvements in performance over classical methods. Hence, this work is motivated by the following premise: if instabilities occur, we want to be able to detect them. To that end, we demonstrate the potential of uncertainty quantification (UQ) as an instability detector. Out of the three compared UQ methods, the recently proposed  framework of <cit.> is shown to be particularly well suited for this task. 



  §.§.§ Overview and Contributions

We consider a straight-forward approach to solving (<ref>), which is based on post-processing a standard model-based inversion by a neural network <cit.>. Thus, the reconstruction is given by

    _rec = (^†),

where ^n→^n denotes the prediction network (trained to minimize the loss -(^†)_2^2) and ^† symbolizes the non-learned model-based inversion.[There is a variety of other possibilities to utilize neural networks to solve (<ref>); see <cit.> for a comprehensive overview. However, <cit.> suggests, that the issue of instabilities occurs independently of the considered reconstruction scheme. Thus, we restrict our study to the simple "image-to-image" post-processing setting described above.] 
Based on this reconstruction method, we then focus on two use cases. First, the standard imaging task of removing white Gaussian noise (i.e.,  is the identity), which can be seen as a well-conditioned inverse problem, is examined.[Note that there is an intimate connection between denoising and solving general ill-posed inverse problems, that can for instance be exploited by “plug-and-play” schemes <cit.>; see also <cit.>. Thus, this application is chosen as a prototypical example for image-to-image regression by neural networks with a broad scope of implications.]
Second, we consider the severely ill-posed problem of limited angle computed tomography ( is a subsampled Radon transform), which has applications in dental tomography, breast tomosynthesis or electron tomography. While  is only used for a plain removal of Gaussian noise in the first case, the latter application requires a removal of structured artifacts as well as an “inpainting" of missing edge information. On each of the two use cases, we investigate the capacity of three UQ schemes (see Section <ref>) to localize possible instabilities in the output of the prediction network . As possible causes for such instabilities we consider: (i) adversarial noise on the input and (ii) imposed structural characteristics that have not been seen during training, i.e., out-of-distribution (OoD) features (see Section <ref>). We believe that detecting OoD-instabilities is of particular importance in the context of medical imaging, since pathological changes are typically rare events in the training data.   

In summary, the contributions of this work are as follows:

    
  a) We show that UQ can be utilized to detect the lack of robustness of deep learning-based image reconstruction methods.
    
  b) Three UQ schemes for artificial neural networks are compared with respect to their capacity of revealing reconstruction instabilities described by <cit.>.
    
  c) We demonstrate that one UQ approach in particular, the so called , performs best as an instability detector.




  §.§.§ Related Work


In addition to the work cited above there exist strands of research in deep learning occupied with the detection of adversarial and OoD inputs. Maximum Mean Discrepancy, Kernel Density Estimation and other tools, see <cit.> for an overview, have been successfully employed for adversarial input detection. Popular methods for OoD input detection include Minimum Covariance Determinant <cit.>, Support Vector Data Description <cit.>, as well as methods geared particularly towards the deep model setting such as ODIN <cit.>,  Outlier Exposure <cit.>, or detection in latent space <cit.>.

The detection of adversarial and OoD inputs in these works is typically done in the classification setting. We emphasize that image-to-image regression by  is a fundamentally different task: While classification is inherently discontinuous,  addresses a problem  that allows for stable reconstruction methods in many cases, e.g. by sparse regularization. Furthermore, we are not interested in a crude, outright rejection of data points in the input space but rather seek to obtain fine-grained information about erroneous artifacts in the output space. More closely related to our goal is the work of <cit.> where uncertainty quantification was considered for segmentation and depth-estimation tasks. Hence, we include their approaches as detection methods which are described next.



§ DETECTION METHODS


We consider three methods for uncertainty quantification of neural network predictions and compare their capacity to detect reconstruction instabilities caused by adversarial noise and OoD features.


  §.§.§ 

By using interval arithmetic a baseline network ^n→^n can be extended to an  ()

    _^n→^n×^n×^n,  ↦((), (), ())

where  and  are mappings to lower and upper interval bounds for the prediction of the , cf. supplementary material. Given labeled samples (_i, _i)=(^†_i, _i) it is suggested in <cit.> to train the  by minimizing the empirical loss

    ∑_imax{_i-(_i),0}_2^2 + max{(_i)-_i,0}_2^2 + β(_i)-(_i)_1,

subject to constraints that guarantee ()≤()≤() for all . Hence, the idea of s is to produce output intervals that contain the true labels with high probability, while remaining as tight as possible. The pixel-wise uncertainty estimate of an  is then given by the width of the prediction interval, i.e., _() = () - (). We refer to <cit.> for further details on s and their evaluation in the context of uncertainty quantification.



  §.§.§ 
 In  proposed by <cit.>, uncertainty scores are obtained through the sample variance of multiple stochastic forward passes on the same input data point. In other words, if _1,…,_T are realizations of independent draws of random dropout masks for the same prediction network , then the pixel-wise uncertainty estimate is given by

    _() = 1/T-1( ∑_t=1^T _t()^2- 1/T(∑_t=1^T _t())^2).



  §.§.§ 

The work by <cit.> proposed another simple recipe for uncertainty scores: the number of output components of the prediction network is doubled and trained to approximate the mean and variance of a Gaussian distribution. This approach has been recast by <cit.> as so-called lightweight probabilistic networks ()

    _^n→^n×^n,  ↦ (_mean(), _var())

which are trained by minimizing the empirical loss

    ∑_i _i-_mean(_i)/√(_var(_i))_2^2 + log_var(_i)_1.

The pixel-wise uncertainty score of  is then simply given by the variance estimate, i.e., _() = _var().



§ EXPERIMENTS AND RESULTS


In this section, we first briefly report on the general deep learning setup of the experiments. Detailed technicalities are listed in the supplement for the sake of reproducability. Finally, we describe the actual experiments for the detection of instabilities and their results. 



 §.§ Inverse Problems, Neural Networks and Data




  §.§.§ 

This task consists of removing additive Gaussian noise with standard deviation 25/255 from greyscale images (rescaled to the intensity range [0,1]) from the Berkeley Segmentation Dataset <cit.>. The prediction network underlying all uncertainty methods is a fully-convolutional residual network with 17 convolution layers, inspired by <cit.>.










  §.§.§ Limited Angle Computed Tomography (CT)

For this task, we consider a simulation of the noiseless Radon transform with a moderate missing wedge of 30^∘ for the forward model (<ref>). The non-learned inversion ^† in (<ref>) is based on the filtered backprojection algorithm (FBP) <cit.>. The underlying prediction network is a U-Net <cit.> variant. Our experiments are based on a data set consisting of 512× 512 human CT scans from the AAPM Low Dose CT Grand Challenge data <cit.>.[See: <https://www.aapm.org/GrandChallenge/LowDoseCT/>; We would like to thank Dr. Cynthia McCollough, the
Mayo Clinic, and the American Association of Physicists in Medicine as well as the grants EB017095 and
EB017185 from the National Institute of Biomedical Imaging and Bioengineering for providing the AAPM data.] In total, it contains 2580 images of 10 patients. Eight of these ten patients were used for training (2036 samples), one for validation (214 samples) and one for testing (330 samples).



 §.§ Instability Detection


Two experiments are performed on the two tasks described above. The first one, , examines the capacity of uncertainty quantification methods to detect adversarial inputs. The second experiment, , exposes the prediction network to a novel structure that was not present during training, analogous to the out-of-distribution test in <cit.>. Both experiments are explained in detail below.


  §.§.§  ()
 
The  experiment assesses the capacity of the considered UQ methods to capture artifacts in the output that were caused by adversarial noise. To that end, we create perturbed inputs for each measurement sample  in the test set by employing the box-constrained L-BFGS algorithm <cit.> to solve

    __adv∈[0,1]^n(_adv)-_adv. tar._2^2 + λ_adv-_2^2,

where = ^† denotes the model based inversion, _adv. tar. represents a corresponding adversarial target, and λ≥ 0 is a parameter for balancing the two terms in (<ref>). It is arguable, whether the technical aspects of such an adversarial pertubation (i.e., attacking subsequently to a model-based inversion) is a realistic scenario in the context of inverse problems. However, for our purposes, such a simple setup (see also <cit.>) is sufficient. We refer to <cit.>, where adversarial noise is mapped to the measurement domain. 
For the  data we use λ=0.5, and the adversarial targets are created by adding noise to a random 50× 50 patch in the reconstruction _rec = () obtained via (<ref>). Thus, the denoising network is forced to fail its task in that region; see <Ref>. For the  task we found that the second term in (<ref>) is not required, i.e., we use λ=0. Adversarial targets are created by subtracting 1.5 times its mean value from _rec within a random 50× 50 square, leading to clearly visible artifacts in the corresponding reconstructions; see <Ref>. In order to assess the adversarial artifact detection capacity, the different UQ schemes are then used to produce uncertainty heatmaps for the generated adversarial inputs. A quantitative evaluation is carried out by computing the mean Pearson correlation coefficient between the pixel-wise change in the uncertainty heatmaps |()-(_adv)| and the change of reconstructions |_rec-(_adv)|. The results are summarized in <Ref> and illustrated in <Ref>. We observe that both  and  are able to detect the image region of adversarial perturbations, with  achieving slightly higher correlations in the denoising task and  having the highest correlation in the  task. This shows that both methods are able to visually highlight the effect that almost imperceptible input perturbations have on the reconstructions.  



  §.§.§  ()

The  experiment is designed analogous to the setup described by <cit.>, i.e., an atypical artifact, which was not present in the training data, is randomly placed in the input. For the  task this is achieved by locally changing the noise distribution, i.e., we replace the Gaussian noise by Salt & Pepper noise in one half of each image in the test set; see <Ref>. For the  task the silhouette of a peace dove is inserted in each image of the test set; see <Ref>. The simulation of the measurements and model-based inversions is carried out on the new test set as before.
In order to assess the atypical artifact detection capacity, the different UQ schemes are then used to produce uncertainty heatmaps on the resulting OoD inputs. A quantitative evaluation is carried out by computing the mean Pearson correlation coefficient between the change in the uncertainty heatmaps |()-(_OoD)| and a binary mask marking the region of change in the inputs. The results are summarized in <Ref> and illustrated in <Ref>. All three UQ methods are correlated with the input change, however  achieves the highest correlation in both the  and  task. This shows that UQ in general, and s in particular, can serve as a warning system for inputs containing atypical features that might otherwise lead to unnoticed and possibly erroneous reconstruction artifacts.



§ CONCLUSION


We demonstrated qualitatively and quantitatively on two use-cases, image denoising and limited angle computed tomography, that uncertainty quantification, in particular  and , bears great potential as a fine-grained instability detector. Furthermore, s performed best overall in three out of four experiments. The implication and goal of this work is to ultimately move deep learning technology closer to a level of reliability that makes it a serious contender for integration in medical imaging workflows. If we want to harness the prowess of deep learning we will need to find strategies for accounting for its instabilities. Uncertainty quantification can be an important tool to that end.


















§ SUPPLEMENTARY MATERIAL




 §.§ Details of Experimental Setup






 §.§ Interval Arithmetic in Neural Networks



We give a derivation of the lower and upper interval bounds Φ and  in equation (3) of the main paper.
s (s) make use of interval arithmetic that deviates from customary arithmetic. The forward pass through a ReLU neural network layer ↦ϱ(+) in interval arithmetic is as follows: Given a component-wise interval valued input [, ] and interval valued weight matrices [, ] and bias vectors [, ] the output interval [, ] after propagation through the layer is formally expressed as

    [, ] = ϱ([, ]
        [, ]+
        [, ] ).

In the special case where [, ] is non-negative—for example image inputs scaled to the intensity range [0, 1] or outputs of a previous ReLU layer—this can be explicitly calculated via

    = ϱ( max{, 0}+min{, 0}+),
       = ϱ(min{,0}+max{, 0 }+),

where the maximum and minimum functions are applied component-wise. Applying this for all network layers finally yields Φ and .







Acknowledgements The authors would like to thank Sören Becker for feedback on the final draft. M.M. acknowledges support by the DFG Priority Programme DFG-SPP 1798 Grants KU
1446/21 and KU 1446/23.

splncs04

