Adversarial attacks on a multimodal Alzheimer's disease detection system reveal complex interdependences between heterogeneous modalities.
Authors
Affiliations (3)
Affiliations (3)
- Departamento Física y Biología Aplicadas a la Salud, Centro Atómico Bariloche, Bustillo 9500, Bariloche, 8400, Argentina.
- CETA-CIEMAT, C. Sola, Trujillo, 3101, Spain.
- Departamento Fı́sica Médica, Centro Atómico Bariloche, Bustillo 9500, Bariloche, 8400, Argentina.
Abstract
Multi-modal models that fuse neuroimaging with clinical assessment data represent the current state of the art for automated Alzheimer's disease detection, yet their adversarial robustness remains poorly understood. We systematically investigated adversarial vulnerability in CogniNetMM, a model that fuses 3D structural MRI volumes with neuropsychological clinical variables, using the Fast Gradient Sign Method and DeepFool in three modality configurations: MRI only, clinical variables only, and both jointly. We further introduced a mean attack framework, in which the average perturbation vector across samples serves as a fixed-direction probe of the decision boundary, decoupling the contribution of attack direction from that of sample position.During training, we identified modality collapse, a training instability in which the fusion layer progressively suppresses the MRI pathway. Collapse probability decreased with larger batch sizes and was further reduced by stratified sampling on class-imbalanced data. Across all clinical variable configurations and both attack methods, the joint multi-modal attack achieved higher success than the average of the two unimodal attacks. For DeepFool, the advantage was strong enough that the joint attack outperformed each unimodal attack individually near the decision boundary. The mean attack replicated this result under a fixed perturbation direction, confirming that the advantage is a structural property of the fused decision boundary rather than an artifact of per-sample gradient alignment. These findings are consistent with a concave original-class region in the joint input space: non-linear modality coupling creates adversarially reachable regions that neither modality perturbation can access independently. Together, these results show that heterogeneous data fusion introduces emergent adversarial vulnerabilities beyond what unimodal analysis predicts, and that standard training practices on imbalanced medical datasets carry a risk of silent modality suppression.