Mobile applications for skin cancer detection are vulnerable to physical camera-based adversarial attacks

Mobile applications for skin cancer detection are vulnerable to physical camera-based adversarial attacks | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Article Mobile applications for skin cancer detection are vulnerable to physical camera-based adversarial attacks Junsei Oda, Kazuhiro Takemoto This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-5934018/v1 This work is licensed under a CC BY 4.0 License Status: Published Journal Publication published 24 May, 2025 Read the published version in Scientific Reports → Version 1 posted 9 You are reading this latest preprint version Abstract Skin cancer is one of the most prevalent malignant tumors, and early detection is crucial for patient prognosis, leading to the development of mobile applications as screening tools. Recent advances in deep neural networks (DNNs) have accelerated the deployment of DNN-based applications for automated skin cancer detection. While DNNs have demonstrated remarkable capabilities, they are known to be vulnerable to adversarial attacks, where carefully crafted perturbations can manipulate model predictions. The vulnerability of deployed medical mobile applications to such attacks remains largely unexplored under real-world conditions. Here, we investigate the susceptibility of three DNN-based medical mobile applications to physical adversarial attacks using transparent camera stickers under black-box conditions where internal model architectures are inaccessible. Through digital experiments with various DNN architectures trained on a publicly available skin lesion dataset, we first demonstrate that camera-based adversarial patterns can achieve high transferability across different models. Using these findings, we implement physical attacks by attaching optimized transparent stickers to mobile device cameras. Our results show that these attacks successfully manipulate application predictions, particularly for melanoma images, with attack success rates reaching 50--80% across all applications while maintaining visual imperceptibility. Notably, melanoma images showed consistently higher vulnerability compared to nevus images across all tested applications. To the best of our knowledge, this is the first demonstration of real-world adversarial vulnerabilities in deployed medical mobile applications, revealing significant security concerns where prediction manipulation could affect diagnostic processes. Our study demonstrates the importance of security evaluation in deploying such applications in clinical settings. Physical sciences/Mathematics and computing/Computational science Biological sciences/Computational biology and bioinformatics/Image processing Biological sciences/Computational biology and bioinformatics/Machine learning Deep neural networks Medical imaging Adversarial attacks Security and privacy Full Text Additional Declarations No competing interests reported. Supplementary Files S1Table.xlsx 20250404kgsmbtzcpgxsxnrvsvstqsbjpjmskcrs.zip Cite Share Download PDF Status: Published Journal Publication published 24 May, 2025 Read the published version in Scientific Reports → Version 1 posted Editorial decision: Revision requested 13 May, 2025 Reviews received at journal 26 Apr, 2025 Reviewers agreed at journal 26 Apr, 2025 Reviews received at journal 26 Apr, 2025 Reviewers agreed at journal 19 Apr, 2025 Reviewers agreed at journal 14 Apr, 2025 Reviewers invited by journal 14 Apr, 2025 Submission checks completed at journal 07 Apr, 2025 First submitted to journal 31 Mar, 2025 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-5934018","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Article","associatedPublications":[],"authors":[{"id":442561185,"identity":"802d375f-13a2-483c-84e4-7a5cf5d336d3","order_by":0,"name":"Junsei Oda","email":"","orcid":"","institution":"Kyushu Institute of Technology","correspondingAuthor":false,"prefix":"","firstName":"Junsei","middleName":"","lastName":"Oda","suffix":""},{"id":442561186,"identity":"1dcc7202-29d1-410b-b2c4-5161c5d2643e","order_by":1,"name":"Kazuhiro Takemoto","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAABE0lEQVRIiWNgGAWjYFACNgjFL8HYwMBwAEkIxMcGeCDyBgySM6BaeIjWYnADRCNrwQXs2Y8lPrpR8UfO+HZz4wOGM4cT97M3P3vAUGPHwDwbuzU8PGmHjXPOGBib3TnYbMBw43BiD88xcwOGY8kMjHMO4HBYept0bptB4rYbiW0SDB+AWiRy2CQY2A4wMM5IwK6F/3n7b5CWzTNgWuTfALX8w6NFIu0YM0jLBgmQFpDDJHjYJBjb8Gi58SxZOueMsbEEyC8JZ9KNe86kmUkk9iXz4PILe3+a4eecCjk5/tntDx98OGYt295++JnEh292coY4QgwVJDA0wxgMPIYziNABBHUIprwEcVpGwSgYBaNg2AMAlylgHHEJyQIAAAAASUVORK5CYII=","orcid":"","institution":"Kyushu Institute of Technology","correspondingAuthor":true,"prefix":"","firstName":"Kazuhiro","middleName":"","lastName":"Takemoto","suffix":""}],"badges":[],"createdAt":"2025-01-31 06:08:13","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-5934018/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-5934018/v1","draftVersion":[],"editorialEvents":[{"content":"https://doi.org/10.1038/s41598-025-03546-y","type":"published","date":"2025-05-24T15:57:42+00:00"}],"editorialNote":"","failedWorkflow":false,"files":[{"id":83460200,"identity":"291a7def-d85d-429a-b275-19d0476f2c43","added_by":"auto","created_at":"2025-05-26 16:11:58","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":931129,"visible":true,"origin":"","legend":"","description":"","filename":"JOKTadvStickersMedrevised20250404.pdf","url":"https://assets-eu.researchsquare.com/files/rs-5934018/v1_covered_f4098a6f-bd54-40ac-b777-2c4ec0b931f8.pdf"},{"id":80595351,"identity":"5a3a6983-9551-43ca-b554-017b97f6ea99","added_by":"auto","created_at":"2025-04-15 03:42:12","extension":"xlsx","order_by":0,"title":"","display":"","copyAsset":false,"role":"supplement","size":236588,"visible":true,"origin":"","legend":"","description":"","filename":"S1Table.xlsx","url":"https://assets-eu.researchsquare.com/files/rs-5934018/v1/81c74cda7c8445e29d7092e8.xlsx"},{"id":80595561,"identity":"ffe74ff1-f081-4e43-af56-79b34f7fbc4f","added_by":"auto","created_at":"2025-04-15 03:50:12","extension":"zip","order_by":1,"title":"","display":"","copyAsset":false,"role":"supplement","size":2020888,"visible":true,"origin":"","legend":"","description":"","filename":"20250404kgsmbtzcpgxsxnrvsvstqsbjpjmskcrs.zip","url":"https://assets-eu.researchsquare.com/files/rs-5934018/v1/3113abdf91097f4959db6bee.zip"}],"financialInterests":"No competing interests reported.","formattedTitle":"Mobile applications for skin cancer detection are vulnerable to physical camera-based adversarial attacks","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":true,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"scientific-reports","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"scirep","sideBox":"Learn more about [Scientific Reports](http://www.nature.com/srep/)","snPcode":"","submissionUrl":"","title":"Scientific Reports","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Scientific Reports","inReviewEnabled":true,"inReviewRevisionsEnabled":true},"keywords":"Deep neural networks, Medical imaging, Adversarial attacks, Security and privacy","lastPublishedDoi":"10.21203/rs.3.rs-5934018/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-5934018/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"Skin cancer is one of the most prevalent malignant tumors, and early detection is crucial for patient prognosis, leading to the development of mobile applications as screening tools. Recent advances in deep neural networks (DNNs) have accelerated the deployment of DNN-based applications for automated skin cancer detection. While DNNs have demonstrated remarkable capabilities, they are known to be vulnerable to adversarial attacks, where carefully crafted perturbations can manipulate model predictions. The vulnerability of deployed medical mobile applications to such attacks remains largely unexplored under real-world conditions. Here, we investigate the susceptibility of three DNN-based medical mobile applications to physical adversarial attacks using transparent camera stickers under black-box conditions where internal model architectures are inaccessible. Through digital experiments with various DNN architectures trained on a publicly available skin lesion dataset, we first demonstrate that camera-based adversarial patterns can achieve high transferability across different models. Using these findings, we implement physical attacks by attaching optimized transparent stickers to mobile device cameras. Our results show that these attacks successfully manipulate application predictions, particularly for melanoma images, with attack success rates reaching 50--80% across all applications while maintaining visual imperceptibility. Notably, melanoma images showed consistently higher vulnerability compared to nevus images across all tested applications. To the best of our knowledge, this is the first demonstration of real-world adversarial vulnerabilities in deployed medical mobile applications, revealing significant security concerns where prediction manipulation could affect diagnostic processes. Our study demonstrates the importance of security evaluation in deploying such applications in clinical settings.","manuscriptTitle":"Mobile applications for skin cancer detection are vulnerable to physical camera-based adversarial attacks","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-04-15 03:42:08","doi":"10.21203/rs.3.rs-5934018/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"decision","content":"Revision requested","date":"2025-05-13T06:02:06+00:00","index":"","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2025-04-26T20:38:43+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"201926559002895938090403243445243619068","date":"2025-04-26T20:37:07+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2025-04-26T06:43:50+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"287960912295339697259913672374558662168","date":"2025-04-19T07:42:02+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"176670340174461192141959909832430751834","date":"2025-04-14T07:54:47+00:00","index":"hide","fulltext":""},{"type":"reviewersInvited","content":"","date":"2025-04-14T07:23:29+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2025-04-07T07:44:24+00:00","index":"","fulltext":""},{"type":"submitted","content":"Scientific Reports","date":"2025-04-01T02:42:02+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"scientific-reports","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"scirep","sideBox":"Learn more about [Scientific Reports](http://www.nature.com/srep/)","snPcode":"","submissionUrl":"","title":"Scientific Reports","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Scientific Reports","inReviewEnabled":true,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"e0d17978-2c13-4ef8-9efd-f0b1a079cadc","owner":[],"postedDate":"April 15th, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"published-in-journal","subjectAreas":[{"id":47112535,"name":"Physical sciences/Mathematics and computing/Computational science"},{"id":47112536,"name":"Biological sciences/Computational biology and bioinformatics/Image processing"},{"id":47112537,"name":"Biological sciences/Computational biology and bioinformatics/Machine learning"}],"tags":[],"updatedAt":"2025-05-26T16:06:03+00:00","versionOfRecord":{"articleIdentity":"rs-5934018","link":"https://doi.org/10.1038/s41598-025-03546-y","journal":{"identity":"scientific-reports","isVorOnly":false,"title":"Scientific Reports"},"publishedOn":"2025-05-24 15:57:42","publishedOnDateReadable":"May 24th, 2025"},"versionCreatedAt":"2025-04-15 03:42:08","video":"","vorDoi":"10.1038/s41598-025-03546-y","vorDoiUrl":"https://doi.org/10.1038/s41598-025-03546-y","workflowStages":[]},"version":"v1","identity":"rs-5934018","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-5934018","identity":"rs-5934018","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}