Abstract
RL-based medical questionnaire systems have shown great potential in medical scenarios. However, their safety and robustness remain unresolved. This study performs a comprehensive evaluation on adversarial attack methods to identify and analyze their potential vulnerabilities. We formulate the diagnosis process as a Markov Decision Process (MDP), where the state is the patient responses and unasked questions, and the action is either to ask a question or to make a diagnosis. We implemented six prevailing major attack methods, including the Fast Gradient Signed Method (FGSM), Projected Gradient Descent (PGD), Carlini & Wagner Attack (C&W) attack, Basic Iterative Method (BIM), DeepFool, and AutoAttack, with seven epsilon values each. To ensure the generated adversarial examples remain clinically plausible, we developed a comprehensive medical validation framework consisting of 247 medical constraints, including physiological bounds, symptom correlations, and conditional medical constraints. We achieved a 97.6% success rate in generating clinically plausible adversarial samples. We performed our experiment on the National Health Interview Survey (NHIS) dataset (this https URL), which consists of 182,630 samples, to predict the participant's 4-year mortality rate. We evaluated our attacks on the AdaptiveFS framework proposed in arXiv:2004.00994. Our results show that adversarial attacks could significantly impact the diagnostic accuracy, with attack success rates ranging from 33.08% (FGSM) to 64.70% (AutoAttack). Our work has demonstrated that even under strict medical constraints on the input, such RL-based medical questionnaire systems still show significant vulnerabilities.
Abstract (translated)
基于强化学习（RL）的医疗问卷系统在医学场景中展现了巨大的潜力，但其安全性和鲁棒性问题尚未解决。本研究对对抗攻击方法进行了全面评估，以识别和分析潜在的安全漏洞。我们把诊断过程描述为一个马尔可夫决策过程（MDP），其中状态是患者的回答以及未问的问题，动作则是提问或做出诊断。 我们在六种主要的攻击方法上进行实施：快速梯度符号法（FGSM）、投影梯度下降（PGD）、Carlini & Wagner 攻击（C&W）攻击、基本迭代方法（BIM）、DeepFool 和 AutoAttack。每种方法都使用了七个不同的ε值。 为了确保生成的对抗样本在临床上合理，我们建立了一个包含247项医学限制条件的全面验证框架，包括生理界限、症状相关性和条件性医疗限制。我们实现了97.6%的成功率，使得生成的对抗样本保持临床合理性。 我们的实验使用了全国健康访谈调查（NHIS）数据集进行，该数据集包含了182,630个样本，并预测参与者的四年死亡率。我们在提出的AdaptiveFS框架上评估了我们的攻击方法，发现这些攻击可以显著影响诊断准确性，成功率从FGSM的33.08%到AutoAttack的64.70%不等。 这项研究表明，即使在输入数据上有严格的医学限制条件下，基于强化学习的医疗问卷系统仍然存在明显的安全漏洞。
URL
https://arxiv.org/abs/2508.05677
