Defending Brain Tumor Classifiers: Diffusion Denoising Meets Matrix Factorization

Paper: 2603.13182 Authors: Hiba Adil Al-kharsan, Róbert Rajkó Categories: cs.CV

The Gap

Deep learning models for medical imaging have reached impressive accuracy on clean data, but they’re fragile. Add imperceptible noise to an MRI scan, and a 95% accurate tumor classifier can confidently misdiagnose. This adversarial vulnerability is well-documented, but existing defenses face a dilemma: adversarial training is computationally expensive and degrades clean accuracy, while input-space purification methods (like denoising the image directly) often fail against adaptive attacks.

The specific boundary: prior work defends either in pixel space (where attackers can adapt) or uses black-box robustness tricks (which don’t generalize). No one has systematically combined interpretable feature extraction with feature-space purification for medical imaging.

Problem: Deep models fragile to adversarial noise
    |
    v
Assumption: Feature space is more stable than pixel space
    |
    v
Method: NNMF features -> Diffusion purification -> Lightweight CNN
    |
    v
Evidence: Maintains clean accuracy + resists AutoAttack
    |
    v
Conclusion: Interpretable features + diffusion defense = robust medical AI

The Increment

One sentence: Before this paper, you chose between accurate-but-fragile deep models or robust-but-inaccurate defenses; after, you can have interpretable features that resist adversarial attacks without sacrificing clean performance.

Core Mechanism

The system has three stages. First, MRI images are decomposed using Non-Negative Matrix Factorization (NNMF), which breaks each image into a weighted sum of basis patterns. Statistical tests (AUC, Cohen’s d, p-values) rank these components by discriminative power, and only the top features are kept. This creates a compact, interpretable representation.

Second, these features pass through a diffusion-based purification module. The forward process adds Gaussian noise to features, then a learned denoiser network reverses this corruption. This is inspired by diffusion models but operates in feature space, not pixel space. The key insight: adversarial perturbations are high-frequency artifacts that diffusion naturally smooths out.

Third, a lightweight CNN classifier operates on the purified features. Because the feature space is already structured by NNMF, the CNN doesn’t need to be deep—it just learns decision boundaries in a cleaner representation.

MRI Image
    |
    v
[NNMF Decomposition]
    |
    +---> Basis 1 * weight_1
    +---> Basis 2 * weight_2
    +---> ...
    +---> Basis N * weight_N
    |
    v
[Statistical Ranking] --> Keep top K features
    |
    v
[Diffusion Purification]
    |
    +---> Add noise (forward)
    +---> Denoise (reverse)
    |
    v
[Lightweight CNN] --> Tumor class

Think of this like airport security with three checkpoints. NNMF is the X-ray machine that separates luggage into interpretable layers (clothes, electronics, liquids). Statistical ranking is the first screener who only examines suspicious layers. Diffusion purification is the secondary inspection that shakes out hidden contraband by adding controlled chaos then carefully removing it—legitimate items survive, but concealed weapons (adversarial perturbations) get exposed and filtered. Finally, the lightweight CNN is the human officer making the final call, but their job is easier because they’re looking at pre-sorted, verified contents rather than raw luggage.

Key Concepts

• Non-Negative Matrix Factorization (NNMF): Imagine you have 1000 MRI scans, each with 256×256 pixels. NNMF says: “I can approximate all these images using just 50 basis patterns.” Each basis pattern is like a template (maybe one captures tumor texture, another captures healthy tissue), and each image is reconstructed by mixing these templates with different weights. The “non-negative” constraint means weights can’t be negative—you’re adding patterns, not subtracting them. This makes results interpretable: a high weight on “tumor texture” basis directly suggests tumor presence. Concrete example: if Basis 7 lights up strongly in all glioblastoma cases but weakly in meningiomas, that basis becomes a discriminative feature.

• Diffusion-Based Purification: Standard diffusion models generate images by starting from noise and gradually denoising. Here, the trick is reversed for defense. Take a feature vector (say, the 50 NNMF weights). Add Gaussian noise to it—this corrupts both the legitimate signal and any adversarial perturbation. Then train a neural network to denoise it back to the original clean features. Why does this help? Adversarial perturbations are carefully crafted to fool the classifier, but they’re brittle—they don’t survive the noise-then-denoise cycle as well as natural features do. It’s like photocopying a document with invisible ink: the real text survives multiple copies, but the hidden message degrades.

• Feature-Space vs Pixel-Space Defense: Most adversarial defenses work on raw images (pixel space). The problem: attackers can see your defense and adapt their perturbations to survive it. This paper moves the battlefield to feature space—after NNMF extraction. The attacker must now craft perturbations that (1) survive NNMF decomposition, (2) survive statistical filtering, and (3) survive diffusion purification. Each transformation adds a layer of obfuscation, making adaptive attacks exponentially harder.

Framework Shift

Before (mainstream approach):        After (this paper):

Raw MRI                              Raw MRI
    |                                    |
    v                                    v
[Deep CNN]                           [NNMF] --> Interpretable
    |                                    |        features
    |                                    v
    +---> Prediction                 [Statistical
    |                                 Filtering]
    |                                    |
[Adversarial                             v
 Training]                           [Diffusion
    ^                                Purification]
    |                                    |
Expensive,                               v
degrades                             [Lightweight
accuracy                              CNN]
                                         |
                                         v
                                     Prediction
                                     
Defense: Implicit                    Defense: Explicit
         in training                          in pipeline

From monolithic deep models with baked-in robustness to modular pipelines with explicit purification stages, the core shift is moving defense from training time to inference time.

Expert Assessment

Problem choice: Real gap. Adversarial robustness in medical imaging is critical—a misdiagnosis from a perturbed scan could be catastrophic. The paper correctly identifies that existing defenses sacrifice too much clean accuracy or fail against strong attacks. However, the threat model is slightly artificial: in clinical settings, who’s injecting adversarial noise into MRI scans? The paper would be stronger if it framed this as robustness to natural distribution shifts (scanner variations, artifacts) rather than adversarial attacks.

Method maturity: Clever combination, not groundbreaking components. NNMF is decades old, diffusion models are trendy but well-understood, and lightweight CNNs are standard. The insight is architectural: putting them together in this specific order. But I’m skeptical of one claim—they say diffusion purification in feature space is novel, yet similar ideas appear in recent adversarial defense literature (just not for medical imaging). The statistical filtering step (AUC, Cohen’s d) feels like feature selection 101, not a contribution.

Experimental integrity: Red flags. They test against AutoAttack, which is good, but only report results on one dataset (not named clearly in the abstract). No comparison to recent diffusion-based defenses like DiffPure. The “lightweight CNN” is underspecified—how lightweight? What architecture? They claim “competitive classification performance” but don’t show clean accuracy numbers in the abstract. The phrase “significantly enhancing robustness” needs quantification. I’d want to see ablation studies: does NNMF alone help? Does diffusion alone help? Or is it the combination?

Writing quality: The abstract is dense and jargon-heavy. “Non-negative data matrix” is redundant (NNMF already implies non-negativity). “Forward noise method followed by a learned denoiser network” is awkward—just say “diffusion purification.” The phrase “presuppose that combining” should be “demonstrate that combining.” The related work section (not in abstract) probably needs expansion to position this against recent diffusion defenses. If I were reviewing, I’d ask them to rewrite the introduction to clearly state: (1) baseline clean accuracy, (2) baseline robust accuracy, (3) their clean accuracy, (4) their robust accuracy, with specific numbers.

Verdict: Weak accept — solid engineering contribution combining known techniques for an important application, but lacks theoretical novelty and experimental rigor needs tightening.

Takeaways

Steal the pipeline structure: NNMF → statistical filtering → diffusion purification → lightweight classifier is a template for any domain where interpretability matters. Replace NNMF with PCA or autoencoders, and you have a general-purpose robust classification pipeline.

Feature-space purification is underexplored: Most adversarial defense research focuses on pixel space. This paper shows that operating on learned features (after dimensionality reduction) can be more effective. If you’re building robust systems, consider where in your pipeline to insert purification—it doesn’t have to be at the input.

Statistical filtering as a defense layer: Using AUC and Cohen’s d to select features isn’t just for performance—it’s a defense mechanism. Adversarial perturbations often affect all features uniformly, but discriminative features have strong statistical signatures. Filtering by statistical significance implicitly removes noise.

Don’t overlook interpretability for robustness: The paper’s framing is “interpretable AND robust,” but there’s a deeper connection: interpretable features (like NNMF components) are inherently more robust because they capture semantic structure rather than pixel-level patterns. If you’re working on safety-critical AI, interpretability isn’t just for explainability—it’s a robustness feature.