# Adversary-Robust Graph-Based Learning of WSIs

Saba Heidari Gheshlaghi  Milan Aryal  Nasim Yahyasoltani  and Masoud Ganji
Saba Heidari Gheshlaghi and Milan Aryal contributed equally in this paper.
S. Heidari Gheshlaghi, M. Aryal and N. Yahyasoltani are with the Department of
Computer Science, Marquette University, Milwaukee, WI 53202 USA (e-mail:
{saba.heidari, milan.aryal, nasim.yahyasoltani}@marquette.edu). M. Ganji is a
pathologist with the Northshore Pathologists, S.C., Milwaukee, WI 53211 USA
(e-mail: maganji@yahoo.com).

###### Abstract

Enhancing the robustness of deep learning models against adversarial attacks
is crucial, especially in critical domains like healthcare where significant
financial interests heighten the risk of such attacks. Whole slide images
(WSIs) are high-resolution, digitized versions of tissue samples mounted on
glass slides, scanned using sophisticated imaging equipment. The digital
analysis of WSIs presents unique challenges due to their gigapixel size and
multi-resolution storage format. In this work, we aim at improving the
robustness of cancer Gleason grading classification systems against
adversarial attacks, addressing challenges at both the image and graph levels.
As regards the proposed algorithm, we develop a novel and innovative graph-
based model which utilizes GNN to extract features from the graph
representation of WSIs. A denoising module, along with a pooling layer is
incorporated to manage the impact of adversarial attacks on the WSIs. The
process concludes with a transformer module that classifies various grades of
prostate cancer based on the processed data. To assess the effectiveness of
the proposed method, we conducted a comparative analysis using two scenarios.
Initially, we trained and tested the model without the denoiser using WSIs
that had not been exposed to any attack. We then introduced a range of attacks
at either the image or graph level and processed them through the proposed
network. The performance of the model was evaluated in terms of accuracy and
kappa scores. The results from this comparison showed a significant
improvement in cancer diagnosis accuracy, highlighting the robustness and
efficiency of the proposed method in handling adversarial challenges in the
context of medical imaging.

Whole slide images, adversarial attack, graph neural network, adversarial
robustness, digital pathology.

The significance of adversarial attacks and the enhancement of the robustness
of deep learning (DL) models are crucial factors in establishing trust in the
deployment of these technologies, particularly in sensitive domains such as
healthcare. Given the significant financial incentives in the healthcare
domain, the occurrence of adversarial attacks is an inevitable challenge that
must be addressed to ensure a safe and reliable use of these technologies.
This research explores various adversarial attacks in cancer grading scenarios
using WSIs. The medical dataset, including WSIs can be attacked while stored
in the cloud or during the training phase. We have addressed both cases in
this work. Although there has been significant research focused on enhancing
the robustness of convolutional neural network (CNN) based models, they cannot
handle irregular, non-Euclidean data structures like graphs. Deep learning
models based on GNN have shown significant improvement in medical imaging,
where understanding the relational information between various regions or
cells within a tissue is often critical for accurate diagnosis. Through a
novel method, this work shows that the integration of a GNN classifier with a
denoiser and a transformer leads to improved robustness of the cancer grading,
allowing it to withstand more effectively with different levels of adversarial
attacks.

##  1 Introduction

In recent years, DL has revolutionized various fields, especially healthcare,
by enhancing diagnostics, treatment planning, and patient care. A significant
impact of DL is evident in medical image analysis, including X-rays, MRIs, and
WSIs [1]. WSIs provide high-resolution digital versions of tissue samples,
offering detailed examination capabilities. Despite the benefits, DL’s
robustness on data patterns introduces vulnerabilities, notably adversarial
attacks. These attacks involve subtle alterations to input data, designed to
fool DL models into making errors. Such perturbations, often undetectable to
humans, can significantly degrade a model’s performance and accuracy by
exploiting its dependencies on data features [2, 3, 4, 5, 6]. Furthermore, the
concept of ”adversarial transferability” suggests that attacks developed for
one model may also compromise another, highlighting the critical challenge of
ensuring robustness in DL applications [7].

In the medical domain, the consequences of adversarial attacks can be
particularly severe. For instance, an incorrect classification in a medical
image might result in inaccurate diagnoses or treatment advice, potentially
putting patients’ lives or treatment plans at risk [8]. Consider a situation
where a deliberately engineered perturbation in a WSI of a biopsy sample
causes an ML model to incorrectly identify cancerous tissue as benign or vice
versa. Such an adversarial attack could lead to misguided treatment choices or
unnecessary surgeries. This vulnerability raises critical concerns about the
reliability of these systems in healthcare, questioning their trustworthiness
when they can be easily misled. WSIs are used in pathology to identify and
classify tissue abnormalities, and they are a critical component in the
diagnosis of diseases like cancer [9, 10, 1, 11]. While the idea of
adversarial attacks in the medical domain is not explored as often, there are
substantial reasons for this concern. For instance, an attacker could alter
test reports for personal financial gain, potentially leading to unnecessary
surgeries, or these manipulations could result in incorrect diagnoses,
adversely affecting patient safety and incurring unwarranted healthcare costs.
The research by Apostolidis et al. [8] examines the effects of adversarial
attacks and defense strategies in medical imaging. Their study underscores
that attacks based on gradient methods are notably prevalent and effective in
the healthcare domain. Ghaffari et al. [12] study showed the power of vision
transformers against adversarial attacks in computational pathology. The study
concludes that the robustness of vision transformers is based on their
mechanisms of processing images, helping to have a more robust method in
computational pathology against adversarial.

Figure 1: The overall network architecture. First, we perform data pre-
processing, followed by the utilization of GNN to extract features from the
graph that represent WSIs. Subsequently, these features undergo a graph
denoising process and a pooling layer. Finally, the denoised graph is fed into
a transformer model to classify the grades of prostate cancer.

Recent studies highlight the growing use of WSIs in computational pathology
and cancer detection. Most DL models, especially CNNs, face challenges in
processing the vast scale of WSIs, which can reach billions of pixels and file
sizes over a gigabyte. A typical solution is to divide these images into
smaller patches for independent processing [13, 14, 15, 16]. However, this
approach may overlook crucial contextual information, as it fails to consider
the relationships between patches. GNNs have emerged as an effective
alternative to analyze WSIs and address the shortcomings of CNNs. GNNs excel
at capturing spatial dependencies and complex relationships within the high-
resolution structure of WSIs, crucial for accurate cancer diagnosis and
classification [17, 18, 19, 20]. By integrating localized and spatial data,
GNNs provide a comprehensive analysis of tissue structures, which is essential
to identify detailed histopathological characteristics such as cell
differentiation and tumor architecture.

As highlighted earlier, DL models are susceptible to adversarial attacks [21],
and since GNNs are a subset of DL, they inherently share this vulnerability.
In recent years, there has been increasing attention to both the nature of
adversarial attacks on GNNs and the development of strategies to enhance their
robustness. Zügner et al. [22] pioneered an adversarial attack methodology for
GNN known as Nettack. Nettack employs a surrogate model to generate
adversarial samples and attack the node classification task. This technique
evaluates the vulnerability of GNNs by iteratively creating adversarial
samples and adjusting these samples based on the changes in confidence values
resulting from generated adversarial samples. Although this method is known as
an early and influential method of adversarial attack against GNNs, its
practicality is hindered for large-scale graphs due to time complexity.
Entezari et al. [23] employed the first-gradient optimization method in order
to address the bi-level optimization problem and generate adversarial samples.
Furthermore, this paper used a low-rank approximation strategy to reduce the
impact of the attack and enhance the network’s robustness. Another gradient-
based approach, named projected gradient descent (PGD), was conducted by Chen
et al. [24], which involves computing the gradients for the edges and
identifying those with the highest absolute values between the pair of nodes
to inform their attack strategy. Sun et al. [25] applied a surrogate model to
address the bi-level optimization challenge and employed meta-gradient methods
to manage the addition or removal of edges. Their findings also indicated a
slight tendency of the algorithm toward connecting nodes of lower degrees. Dai
et al. [26] used a reinforcement learning approach to generate adversarial
samples to disrupt node classification tasks. Zang et al. [4] concentrated on
identifying ”bad actor” nodes and showed that by flipping the edges between
such nodes and a chosen target node, the overall network’s performance can be
negatively impacted.

Ensuring the robustness of DL models against adversarial attacks is critical,
especially in the medical field, where accuracy in diagnosis and patient
safety is of paramount importance. Robust DL models help reduce diagnostic
errors and the risk of false results, thus maintaining high standards of
patient care. With the rise of medical image storage on cloud platforms,
accessibility for healthcare professionals has improved, but this has also
introduced significant security challenges. Medical images in the cloud are
vulnerable to cyber-attacks, potentially leading to unauthorized modifications
that compromise data integrity and system performance.

Furthermore, DL models analyzing these images are susceptible to adversarial
attacks, particularly when images are converted to graphs for analysis. Such
vulnerabilities can degrade the models’ performance and reliability. This
paper addresses the security threats to medical images in cloud storage into
two different ways: image-level attacks and graph-level attacks. Image-level
attacks refer to direct alteration or perturbation of the images themselves,
compromising their authenticity and reliability. On the other hand, graph-
level attacks involve the manipulation of the images after they have been
converted into graph representations for analysis, targeting the structural
and relational integrity of the data. This differentiation helps in
understanding the nature of the threats and devising specific countermeasures
for each type of attack, aiming to enhance the security and robustness of
medical images storage and processing systems.

Adversarial training is a key method to improve model robustness, where
adversarial examples are intentionally used during training to help models
learn robust and discerning features [27, 28]. Studies have also investigated
the use of advanced normalization techniques and architectural modifications
to mitigate the effects of adversarial attacks. Additionally, inverse imaging
problems (IIPs) have shown promise in reducing input noise and perturbations,
though their effectiveness often depends on having paired noise and clean
data, a limitation addressed by the introduction of untrained neural network
priors (UNNPs) for noise reduction without pre-existing data [29, 30]. Luo et
al. [31] developed a model to improve GNN robustness by learning to eliminate
irrelevant edges and reduce graph complexity. Graph attention networks (GATs)
further enhance the robustness of GNN by focusing on crucial nodes or edges,
minimizing noise impact [32].

##  2 Method

Figure 2: WSI without any perturbation.

As regards cancer detection using WSIs, research has mainly focused on CNNs
for patch-based image analysis. Foote et al. [33] identified vulnerabilities
of the DL model to universal perturbations that could alter tumor image
classifications. Ghaffari et al. [12] showed CNN susceptibility to adversarial
attacks, countering this with adversarial training and dual batch
normalization (DBN). They found that vision transformers (ViTs) inherently
resist adversarial attacks without needing specific pretraining or
architectural changes. Bhojanapalli et al. [34] highlighted ViT robustness,
which persists even after removing a layer during training with sufficient
data. Zhang et al. [35] evaluated CNN robustness against common WSI
corruptions, using classification and ranking metrics to assess their
vulnerability.

In this paper, we present a novel GNN-based architecture for digital pathology
that stands out for its unique approach to enhancing robustness against
adversarial attacks in WSIs. This work is distinguished by its two main
factors: first, it is the pioneering effort specifically designed to protect
models from adversarial threats targeting both image and graph representations
of WSIs; second, it moves beyond traditional patch-level analysis, addressing
the need for context-aware evaluation around tumor areas in WSIs. Prior
research has shown graph-based methods to be more effective than patch-based
approaches [36, 37, 38]. The proposed model showcases superior robustness to
various levels of adversarial perturbations in WSIs. By generating and testing
against adversarial attacks, we benchmark the robustness of the proposed
architecture against leading GNN models. The findings confirm the method’s
outstanding capability to mitigate challenges in clinical applications. The
core contributions of this study include:

  1. 1.

Evaluating the susceptibility of cutting-edge GNN models to adversarial
threats in WSIs.

  2. 2.

Introducing a novel graph-based architecture designed to enhance robustness
against adversarial threats in WSIs, particularly focusing on cloud-stored and
graph-converted WSIs.

In this section, we provide a comprehensive explanation of the methodologies
used in this study. Figure 1 shows the overall architecture of the proposed
algorithm. We begin by elucidating the concepts of GNN and graph-based
learning. Given that WSIs are stored on cloud platforms, they are vulnerable
to adversarial attacks at various stages. These attacks may target the WSIs
directly or occur during their conversion to graph representations for
training purposes. In light of these vulnerabilities, this work encompasses
both graph- and image-level attacks, providing a detailed examination of each
type. Finally, we provide a detailed overview of the transformer and denoiser
components involved in the proposed robust network.

###  2.1 Graph-Based Learning

Graph-Based Learning is an innovative approach in the DL domain, focusing on
graph-based data. A graph consists of nodes ($V$) and edges ($E\subseteq
v\times v$), where the nodes represent entities, and the edges denote the
relationships between these entities. In addition, it can be represented by
the adjacency matrix$A\in\mathbb{R}^{N\times N}$ and the
features$\boldsymbol{x}\in\mathbb{R}^{N}$ and defined as
$G(V,A,\boldsymbol{x})$. GNN is effective in handling complex relational data,
which is not easily manageable by conventional DL models. In this research,
initially, each WSI is divided into non-overlapping patches, from which
features are extracted for each individual patch. Pretrained CTranspath [39]
has been used to extract the features. In this graph-based representation,
each patch is treated as a node, and the edges represent the spatial
relationships or contextual dependencies between these patches. that are
established using the k-nearest neighbors (k-NN) algorithm. This process
results in the construction of an adjacency matrix that defines the
connections between nodes, effectively representing the WSI as a graph. With
WSIs converted into graphs, GNNs can be applied to classification tasks. In
GNNs, the learning process involves message passing between adjacent nodes
[40]. The hidden layer $l+1$ is defined as:

$H^{(l+1)}=\sigma\left(\tilde{D}^{-\frac{1}{2}}\tilde{A}\tilde{D}^{-\frac{1}{2}}H^{(l)}W^{(l)}\right)$
(1)

Where for the layer $ls$, $H^{(l)}\in\mathcal{R}^{|V|\times d}$ represents the
input, where each node possesses $d$ features. The trainable weight matrix at
this layer is denoted as $W^{(l)}\in\mathcal{R}^{|V|\times d}$. The non-linear
activation function is represented by $\sigma$. The normalized symmetric
adjacency matrix is given by
$\hat{A}:=\tilde{D}^{-\frac{1}{2}}\tilde{A}\tilde{D}^{-\frac{1}{2}}$, where
$\tilde{A}:=A+I$ signifies the adjacency matrix enhanced with self-
connections. $\tilde{D}$ is the diagonal matrix corresponding to $\tilde{A}$
with $\tilde{D}_{ii}:=\sum_{j}\tilde{A}_{ij}$ representing the diagonal
elements. Hence, GNNs with a single hidden layer are defined as

$Z=f_{\theta}(A,X)=\operatorname{softmax}\left(\hat{A}\sigma\left(\hat{A}XW^{(1)}\right)W^{(2)}\right)$
(2)

Where $\theta=\left\\{W^{(1)},W^{(2)}\right\\}$ is the set of parameters that
can be learned by minimizing cross-entropy on the output of the labeled
samples $\mathcal{V}_{L}$:

$L(\theta;A,X)=-\sum_{v\in\mathcal{V}_{L}}\ln Z_{v,c_{v}},\quad\quad\quad
Z=f_{\theta}(A,X)$ (3)

where $c_{v}$ represents the label assigned to node $v$ of the training data
set. Following completion of the training process $Z$ means the probabilities
associated with class for each instance within the graph. An adversarial
sample is an input meticulously engineered to deceive a DL model, resulting in
the misclassification of the input. To the human eye, these perturbed inputs
may appear identical to their original forms, yet they cause the network to
misinterpret the contents of the input. Adversarial attacks can occur in both
images and graphs. In this section, we will discuss the methods through which
these attacks can occur in either image-based or graph-based data. Figures 2
shows a sample WSI with no perturbation. The goal is to evaluate the effects
of adversarial attacks on these images.

(a) $\epsilon=0.1$

(b) $\epsilon=0.15$

Figure 3: WSI with FGSM adversarial attack.

The Fast Gradient Sign Method (FGSM) [2] is a powerful and popular adversarial
attack technique designed to fool ML models, especially DL networks. Noted for
its simplicity and effectiveness, the FGSM attack has become a fundamental
concept in the study of adversarial attacks, providing key insights into the
vulnerabilities of ML systems. The FGSM attack exploits the vulnerability of
ML models to small, carefully crafted perturbations in the input data. Its key
idea is to compute the gradient of the model’s loss with respect to the input
data and then add a small perturbation to the input in the direction that
maximizes the loss. This perturbation is determined by the sign of the
gradient. In other words, the attack uses the gradient of the loss with
respect to the input data and then adjusts the input data to maximize the
loss. The process can be broken down into the following steps:

  * •

Compute the gradient of the loss with respect to the clean and unperturbed
input image.

  * •

Apply a small perturbation to the input in the direction of the gradient. This
perturbation is usually done by adding the sign of the gradient to the
original input.

  * •

The resulting is an adversarial sample.

Mathematically, for a given input data point $x$ and a ML model with a loss
function $J$ and parameters $\theta$, the FGSM attack generates an adversarial
example $x_{adv}$ with perturbation budget of $\epsilon$ as follows:

$x_{adv}=x+\epsilon.sign(\nabla_{x}J(\theta,x,y))$ (4)

Here, $\epsilon$ represents a small value selected to fulfill the criteria of
being unnoticeable, such that ($x\cong x_{adv}$).
Figure 3 illustrates the original image and the effects of an image-level
attack, respectively. More specifically, the impact of the FGSM attack at
various attack perturbation rates is demonstrated.

Figure 4: Attacker’s effect on network classification.

####  2.1.1 Graph-level attack

Adversarial attacks are categorized into various types, each distinguished by
specific characteristics such as the level of access the attacker has, the
attacker’s goal, and the attacker’s knowledge about the target system. This
categorization helps us to understand the nature of adversarial attacks in the
graph domain and their potential impact on different models and knowledge.

Adversarial attacks in the graph domain present a higher level of complexity
compared to other domains, such as images. This increased challenge stems from
the broader array of attack types and options available when targeting graph-
based models. The methods of perturbation in graphs are diverse and include
various tactics. These include:

  * •

Modifying features: The attacker is capable of changing the node’s features
without affecting the overall structure of the graph.

  * •

Adding or deleting edges: The attacker is capable of adding or removing edges
between nodes. Figure 4 is an example of how the attacker can affect the
network performance by adding an edge.

  * •

Injecting or removing nodes: The attacker can insert a fake node or add the
existing node to the graph in order to affect the network performance.

Attackers can possess varying levels of access and capabilities, which often
depend on the stage at which the attack occurs. Their access can be
categorized into :

  * •

Evasion attack: Evasion attack happens post-training or during the testing
phase of a model. In this type of attack, the model’s parameters are already
set and fixed, meaning that the attacker is unable to change or modify them.
Instead, the attacker focuses on manipulating the input data in such a way
that the model is fooled and makes incorrect predictions or classifications.

  * •

Poisoning attack: Poisoning attack happens before the model is trained. In
this type of attack, the attacker poisons the model’s training data in such a
way that the model is fooled and makes incorrect predictions or
classifications [41, 42, 43, 44].

Attackers may have a variety of objectives and goals during an attack, each
with its own specific intent and impact. Attackers goals can be:

  * •

Targeted attack: Attacker’s primary objective is to manipulate the
classification of a subset of test nodes. In this type of attack, the attacker
targets precisely a specific node (or nodes) within a network or dataset,
aiming to alter their classification outcomes.

  * •

Untargeted attack: Attacker’s primary objective is to manipulate and affect
the overall performance of the network. In this type of attack, the attackers
do not have any targeted node and aim to alter the overall classification
outcome.

The level of knowledge that attackers have can be different. Some attackers
might have extensive access to detailed information, while others may only
have limited insights. This variability in access and knowledge directly
impacts the strategies and methods they can employ in their attacks.
Attacker’s knowledge can be categorized into:

  * •

White-box attack: The attacker has access to the full knowledge and various
key components, including the model, network parameters, gradient information,
training inputs, and labels, among other elements. This level of access grants
them a significantly advanced knowledge base. Such extensive insight enables
the attacker to execute sophisticated and potentially more effective attacks,
utilizing their deep understanding of the system’s inner workings. However, it
is important to note that this kind of attack, with its requirement for
extensive access and knowledge, is often not feasible and realistic in many
real-world scenarios.

  * •

Grey-box attack: The attacker has access to limited information about the
victim’s model, making this attack potentially more dangerous than a white-box
attack. For instance, the attacker can access the model’s parameters but not
its training data.

  * •

Black-box attack: The attacker is unable to access the model, its parameters,
or the training labels. Instead, their capabilities are limited to accessing
only the adjacency matrix or features, and conducting black-box queries to
obtain output scores or labels [45].

In the context of graph-level attacks targeting the discrete structure of
graphs, the objective is to develop a function $f_{\theta}$, where $\theta$ is
typically determined by minimizing an attack loss function,
$\mathcal{L}_{\text{atk }}$, applied to the labeled training nodes of the
graph $G$. This process can be succinctly described as a bilevel optimization
challenge where $\hat{G}$ is the perturbed graph.

$\displaystyle\min_{\hat{G}\in\Phi(G)}\mathcal{L}_{\text{atk
}}\left(f_{\theta^{*}}(\hat{G})\right)\quad\text{ s.t. }$ (5)
$\displaystyle\theta^{*}=\underset{\theta}{\arg\min}\quad\mathcal{L}_{\text{train
}}\left(f_{\theta}(\hat{G})\right).$

Where a set of admissible perturbations on the data is $\Phi(G)$, where $G$ is
the graph at hand.

To address the bilevel optimization challenge, we adopt a meta-learning
approach, initially presented in Zügner et al.’s work [46]. Meta-learning,
often referred to as ”learning to learn,” is a method designed to enhance the
efficiency of ML models, particularly in terms of data and time resources
[47]. In the context of an adversarial attack on GNNs, the matrix representing
the graph’s structure is considered a hyperparameter and the meta-gradient is
computed with respect to the graph structure matrix. The primary objective is
to determine the gradient of the attacker’s loss following the training phase
in relation to this hyperparameter and this computation involves
backpropagation through the learning phase of the model. The attacker’s loss
after training $\mathcal{L}_{\text{atk }}\left(f_{\theta^{*}}(G)\right)$, is
used to compute the meta-gradient, $\nabla_{G}^{\text{meta }}$, which shows
how this loss changes with small perturbations in the graph data. This
calculation of the gradient is based on the following, where $opt(.)$
represents a differentiable optimization process, such as gradient descent or
its stochastic variations.

$\displaystyle\nabla_{G}^{\text{meta }}=\nabla_{A}\mathcal{L}_{\text{atk
}}\left(f_{\theta^{*}}(A)\right)\quad\text{ s.t. }$ (6)
$\displaystyle\theta^{*}=\operatorname{opt}_{\theta}\left(\mathcal{L}_{\text{train
}}\left(f_{\theta}(A)\right)\right),$

In this method, we focus on executing adversarial attacks that disrupt the
discrete graph structure. The objective is to modify the original graph
structure $G^{(0)}=\left(A^{(0)},X^{(0)}\right)$ into a modified version
$\hat{G}=(A^{\prime},X^{(0)})$ in order to impair the classification
performance. This approach is a non-targeted poisoning attack, which targets
the graph structure, while node attributes are treated as constant. In this
approach, a greedy strategy is used for choosing graph perturbations, such as
edge insertions or deletions, based on their anticipated influence on
achieving the attacker’s objectives.

However, Computing meta-gradients is computationally expensive. To address
this, a first-order approximation proposed by Finn et al. has been used [48].
This approximation is based on taking the gradient of the attack loss with
respect to the data after training the model for a certain number of steps. It
does not consider the training dynamics in its calculation, making it a less
expensive computational alternative. Using this approximation, we have:

$\displaystyle\nabla_{A}^{\text{meta }}=\nabla_{A}\mathcal{L}_{\text{atk
}}\left(f_{\theta_{T}}(A)\right)$ (7)
$\displaystyle\approx\nabla_{A}\mathcal{L}_{\text{atk
}}\left(f_{\tilde{\theta}_{T}}(A)\right)$
$\displaystyle=\nabla_{f}\mathcal{L}_{\text{atk
}}\left(f_{\tilde{\theta}_{T}}(A)\right)\cdot\nabla_{A}f_{\tilde{\theta}_{T}}(A)$

Where $\tilde{\theta}_{t}$ represents the parameters at time $t$, which are
independent of the data $A$, meaning that $\nabla_{A}\tilde{\theta}_{t}=0$.
Consequently, the gradient does not extend through $\tilde{\theta}_{t}$. This
is equivalent to computing the gradient of the attack loss,
$\mathcal{L}_{\text{atk }}$, with respect to the data after the model has been
trained for $T$ steps. Additionally, a heuristic approach to meta-gradients is
explored, which updates the initial weights based on the direction that
typically results in the largest increase in training loss. This heuristic is
more efficient to compute and has a smaller memory footprint compared to the
exact meta-gradient. The attack algorithm uses this heuristic by combining
both the training loss and a self-learning estimated loss.

###  2.2 Transformer

Transformers, initially created for tasks in natural language processing, have
now been adapted for use in GNNs. This evolution marks a significant
advancement in managing graph-structured data and pinpointing long-range
dependencies within it. Integration of transformers with GNN opens up new
avenues for processing and interpreting complex data structures [49]. This
concept draws inspiration from the work presented in the literature,
specifically in the studies by Vaswani et al. [50] and Zheng et al. [51],
which delve into the mechanics of attention mechanisms and their application
to graph-transformer models. These studies exemplify the potential of
combining transformer models with GNNs, demonstrating how they can complement
each other in enhancing data analysis, especially in scenarios involving
intricate and interconnected data. This synergy has the potential to lead to
more robust and effective solutions in the field of data science and
analytics.

In the transformer model, the input is denoted as
$H^{pool}\in\mathcal{R}^{N\times d}$, where $N$ is the total count of nodes
within the network, and $d$ stands for the dimensionality of the features that
have been processed through the graph’s pooling layer. This structure is
designed in such a way that each node, accompanied by its corresponding set of
features, is considered as an individual input token for the transformer. This
approach allows the transformer to interpret and process each node and its
associated features distinctly, contributing to the model’s ability to
understand and analyze complex graph structures effectively. Furthermore, a
class token (CLS), designed to aggregate information from the entire graph for
making graph-level predictions, is also integrated into the input of the
transformer, accompanying the individual node-feature tokens. The transformer
itself is composed of several layers, with each layer functioning as follows:

$t_{i}^{{}^{\prime}}=MHA(LN(t_{i-1}))+t_{i-1}$ (8)
$t_{i}=MLP(LN(t^{{}^{\prime}}_{i}))+t_{i}^{{}^{\prime}}$ (9)

Where $MHA$ is the multi-headed self-attention mechanism, $LN$ denotes layer
normalization and notation $t_{i}$ indicates the $i^{th}$ layer of the
transformer. The initial layer, $t_{0}$, is given by $t_{0}=[CLS;H^{pool}]$],
where $[CLS;H^{pool}]$ denotes the concatenation of the class token with the
pooled node features. This layered structure of the transformer, with its
attention mechanisms and normalization processes, plays a crucial role in
effectively capturing and interpreting the complex patterns in the input data,
ultimately leading to a robust and accurate classification process.

After the transformer processes the data, the output is then fed into a multi-
layer perceptron (MLP). This stage is essential for achieving the final
classification. The MLP, with its multiple layers, takes the output from the
transformer and uses it to compute the final predicted output, represented as
$\hat{y}$, for each instance of WSIs.

$\hat{y}=MLP(Transformer([CLS;H^{pool}])$ (10)

The transformer consists of multiple layers and each layer in the transformer
is given by,

$t_{i}^{{}^{\prime}}=MHA(LN(t_{i-1}))+t_{i-1}$ (11)
$t_{i}=MLP(LN(t^{{}^{\prime}}_{i}))+t_{i}^{{}^{\prime}}$ (12)

Where $LN$ refers to the layer normalization, and $t_{i}$ is the $i^{th}$
layer of the transformer. The transformer architecture employs a Multi-Head
Attention ($MHA$) mechanism, which is a pivotal component enhancing its
capability to process and understand data. The initial layer for the
transformer is $t_{0}=[CLS;H^{pool}]$ and $MHA$ calculated as follows:

$MHA=Concat[A_{1},A_{2},\cdots,A_{h}]W$ (13)

In this context, $W$ represents a matrix of trainable parameters, while
$A_{i}$ denotes the $i^{th}$ instance of self-attention. The self-attention
mechanism operates on the principles of key(K), query(Q), value(V) mechanism
which is given as follows

$A_{i}(Q,K,V)=softmax\left(\frac{QK^{T}}{\sqrt{d_{k}}}\right)V$ (14)

where $d_{k}=d/h$. With $W_{Q},W_{V},W_{K}\in\mathcal{R}^{d\times d_{k}}$ as
learnable weight parameters, $Q,K,V$ used in attention follow

$\displaystyle Q=H^{pool}W_{Q}$ (15) $\displaystyle K=H^{pool}W_{K}$
$\displaystyle V={H^{pool}{W_{V}}}.$

###  2.3 Denoising

A denoising module is used for eliminating unwanted disturbances or
inconsistencies from data. Specifically in the realm of adversarial attack S,
this process focuses on recognizing and reducing the impact of adversarial
samples. In graph domain, these attacks can manipulate the graph’s structure
by adding or removing edges, or they can alter the nodes or edges features.
The objective of denoising in GNNs is to preserve the network’s functionality
and accuracy, even when faced with these adversarial challenges. By
successfully cleaning the data of these perturbations, GNNs are better
equipped to maintain robust and reliable performance, ensuring that predictive
capabilities are not compromised by such noise and attacks.

In this study, the aim is to distinguish and remove the noise component,
represented as $\boldsymbol{n}\in\mathbb{R}^{N}$, from the input signal
$\boldsymbol{x}\in\mathbb{R}^{N}$ and accurately estimate the denoised signal,
denoted as $\boldsymbol{x_{d}}\in\mathbb{R}^{N}$.

$\boldsymbol{x}=\boldsymbol{x_{d}}+\boldsymbol{n}$ (16)

The task involves determining the optimal GNN weights denoted as
$\boldsymbol{\boldsymbol{\theta}}$, by aiming to minimize the specified loss
function.

$l(\boldsymbol{x},\boldsymbol{\boldsymbol{\theta}})=\frac{1}{2}||\boldsymbol{x}-f_{\boldsymbol{\theta}}(\boldsymbol{z}|G)||^{2}_{2}$
(17)

where $f_{\boldsymbol{\theta}}(\boldsymbol{z}|G)$ is GNN which is a parametric
non-linear function, $G$ is the graph, $\boldsymbol{\theta}$ indicates the
network parameter, and $\boldsymbol{z}$ is the initial random value sourced
from a Gaussian distribution with zero mean. Utilizing the principles of graph
signal processing and the untrained neural network process (UNNP) framework
[52, 29], this module is designed to denoise graph inputs through the use of
an untrained network. This approach optimizes the network parameters
exclusively based on the individual signal observation requiring denoising,
rather than using a diverse training set of multiple observed graph signals.
The proposed method’s aim is to precisely separate and recover the denoised
signal from the noise.

In this method, we utilize the inherent potential of overparameterized
networks, which are characterized by their extensive number of parameters.
Furthermore, this approach incorporates the technique of early stopping. This
strategy is particularly effective as it enables the network to rapidly adjust
to and learn from the actual signal, while simultaneously being less
susceptible to the influences of noise. This is in contrast to more
traditional methods, which often take longer to differentiate between signal
and noise. By applying this methodology, we aim to extract a denoised version
of the graph, denoted as ($\boldsymbol{{x}^{\prime}_{d}}$) from the given
input.

The stochastic gradient descent (SGD) method enhanced with early stopping is
utilized to address the minimization problem presented in (17). We initiate
this process by randomly setting the values of parameters
$\boldsymbol{\theta}$ and $\boldsymbol{z}$, selecting from an i.i.d zero-mean
Gaussian distribution. The weights, refined over several denoising iterations
on $x$ are denoted as ${\boldsymbol{\theta}}^{\prime}$. This helps to have
$\boldsymbol{{x}^{\prime}_{d}}$ as the output, corresponding to these refined
weights. This approach stands in contrast to the conventional method, where
$\boldsymbol{\theta}$ is initially calibrated by fitting it to a training
dataset.

$\boldsymbol{x}^{\prime}_{d}=f_{{\boldsymbol{\theta}^{\prime}}_{(\boldsymbol{x})}}(\boldsymbol{Z}|G)$
(18)

This implies that for every combination of a noisy signal, denoted as $x$ and
its corresponding denoised counterpart, labeled
$\boldsymbol{{x}^{\prime}_{d}}$, a unique set of weights is inherently
associated with each pair. These specific weights play a crucial role in the
denoising process, as they facilitate the extraction of the most effective
denoised output. This optimized output is derived directly from the input
graph, ensuring that the denoising process is tailored specifically to the
characteristics of each individual signal pair, thus enhancing the accuracy
and efficiency of the denoising operation.

Table 1: Number of samples of GG in prostate cancer dataset Description | Number of samples
---|---
GG1 | 2666
GG2 | 1343
GG3 | 1250
GG4 | 1242
GG5 | 1224

##  3 Dataset Description

The PANDA (Prostate cANcer graDe Assessment) dataset is an important resource
in the medical field, specifically designed for the accurate and efficient
grading of prostate cancer. It consists of prostate cancer biopsy samples
classified into five distinct grades based on the Gleason scoring system. The
significance of this dataset is underscored by the widespread incidence of
prostate cancer, which is globally recognized as the second most prevalent
cancer in men. Alarmingly, this disease is estimated to cause around 350,000
deaths annually [53]. Encompassing roughly 10,000 WSIs, the PANDA dataset
provides an extensive foundation for medical research and analysis.
Comprehensive details about the contents and characteristics of each sample in
this dataset are methodically presented in Table 1.

To further enrich the dataset’s value, about 25% of these WSIs have been
subjected to a random selection process. Post-selection, these slides undergo
the introduction of various perturbations. This deliberate modification is a
critical aspect of the dataset, as it simulates adversarial attacks that
medical professionals may encounter in diagnosing and analyzing medical
images.

Table 2: Comparison of Method Performance on Graph-Level Attack Method | Proposed Method | GNN (Defferrard et al.) | GAT (Velickovic et al.)
---|---|---|---
Dataset | 0.8134 | 0.7688 | 0.7718
10% Perturbed Graphs | 0.7927 | 0.7607 | 0.7663
25% Perturbed Graphs | 0.7902 | 0.7519 | 0.7557
50% Perturbed Graphs | 0.7808 | 0.7343 | 0.7449
Table 3: Comparison of Method Performance on Image-Level Attack Method | Proposed Method | GNN (Defferrard et al.) | GAT (Velickovic et al.) | ViTs (Ghaffari et al.)
---|---|---|---|---
Dataset | 0.8134 | 0.7688 | 0.7718 | 0.7923
10% Perturbed Graphs | 0.7864 | 0.7525 | 0.7613 | 0.7816
25% Perturbed Graphs | 0.7858 | 0.7456 | 0.7544 | 0.7698
50% Perturbed Graphs | 0.7789 | 0.7381 | 0.7431 | 0.7612

##  4 Implementation Details

For generating adversarial samples at the image level, we utilized the FGSM, a
widely recognized technique for creating perturbations that can affect model
performance. FGSM works by making small, calculated modifications to the
original images. To implement this, we used a ResNet50 model pre-trained on
the ImageNet dataset as the base architecture. Given that ResNet50 is not
designed to process the large size of WSIs, we adapted the proposed approach.
We divided each WSI into smaller patches of $256\times 256$ pixels, retaining
the specific location of each patch. This step was crucial to ensure that we
could accurately target each patch with the adversarial attack and then
effectively reassemble the WSI from these patches. By attacking these smaller,
manageable patches, we were able to apply the FGSM method effectively, despite
the large size of the original WSIs. Once each patch was subjected to the
adversarial attack, we reconstructed the full WSI from the altered patches.
This method allowed us to generate adversarially perturbed versions of the
WSIs while overcoming the size limitations of using the ResNet50 model. This
approach ensures that we can evaluate the robustness of the model against
adversarial threats. To generate adversarial samples at the graph level, we
employed the meta-gradient technique, which is notably acknowledged in the
field of graph-based adversarial learning. Meta-gradient methods involve
calculating gradients with respect to the graph structure itself, rather than
the weights of the network. This approach allows us to create subtle yet
effective perturbations directly in the graph’s structure, altering the
connections and relationships between nodes in a manner that is intended to
mislead the GNN.

Prior to applying the proposed method, the WSIs needed to be preprocessed for
compatibility with the graph-based algorithm. This involves segmenting each
WSI into non-overlapping patches, each measuring $256\times 256$ pixels at
$16\times$ resolution. The features for these patches were extracted using
CTranspath [39]. The number of nodes in the graph was based on the number of
patches in each WSI.

The feature extraction phase was followed by the training of the model using
the original dataset for 60 epochs. For this training process, we employed the
Adam optimizer, recognized for its efficiency in handling large datasets and
complex architectures. The choice of loss function was cross-entropy, a
standard in classification tasks due to its effectiveness in penalizing
incorrect classifications. To optimize the learning process, we set the
learning rate at $1e-3$ and applied a weight decay of $5e-5$. These parameters
were meticulously chosen to balance the speed of convergence with the need to
avoid overfitting, ensuring that the model learns generalizable patterns from
the data. Subsequently, the model was trained on perturbed samples, conducted
with and without the implementation of a denoiser. This approach allowed us to
compare the model’s performance under varying conditions and assess the
effectiveness of the denoising process. The development and training of the
model were conducted using PyTorch and Pytorch_geometric, two powerful DL
frameworks that offer flexibility and extensive support for graph-based data.
The computational training was performed on an NVIDIA Tesla V100 GPU. This
hardware setup ensured efficient training and model optimization, facilitating
a robust analysis of the model performance under different conditions.

For the evaluation phase, we utilized two widely recognized metrics in ML and
statistics: the kappa score and accuracy. The kappa score provides insight
into the agreement between the model’s predictions and the actual labels,
adjusting for the possibility of random agreement. Meanwhile, accuracy offers
a straightforward measure of the model’s overall correctness in
classification.

##  5 Numerical Results

To evaluate the effectiveness of the proposed model, we performed a
comparative analysis with major graph-based architectures, including GNN and
GAT. The focus was on these methods due to the lack of research on enhancing
the robustness of graph-based learning for WSIs. Additionally, we benchmarked
against the advanced patch-based method, ViTs, known for enhancing WSIs’
robustness, especially for image-based attacks. The assessment focused on how
these methods fare against adversarial attacks, considering situations in
which both attacks occur on the image or graph level. Initially, we assessed
the proposed model’s performance under standard conditions, free from any
attack interference. The findings indicate that the proposed method
outperforms both CNN patch-based and graph-based methods in this scenario. The
accuracy of the model without any attack is 81. 34%, and its Kappa score is
0.92. Subsequently, we introduced attacked samples to the dataset at both the
image and graph levels, at rates of 10%, 25%, and 50%. For these attacks, the
WSI and the graphs were randomly selected. The results for each type of
attack, both at the image level and the graph level, are comprehensively
detailed in Table 2 and Table 3, respectively. In these tables, we provide an
in-depth analysis of the results, including a comparison for each specific
attack scenario. This detailed presentation allows for a clearer understanding
of how the proposed model responds to types of attacks, offering insights into
its performance and robustness in varied conditions. Table 2 illustrates that
the model’s accuracy decreased by 2.07%, 2.32%, and 3.26% correspondingly when
the dataset was subjected to attack rates of 10%, 25%, and 50% in graphs.
Furthermore, Table 3 illustrates that the model’s accuracy decreased by 2.7%,
2.76%, and 3.45% correspondingly when the dataset was subjected to attack
rates of 10%, 25%, and 50% in images.

##  6 Conclusion

The significance of adversarial attacks and the enhancement of the robustness
of DL models are crucial factors in establishing trust in the deployment of
these technologies, particularly in sensitive domains such as healthcare.
Given the significant financial incentives in the healthcare domain, the
occurrence of adversarial attacks is an inevitable challenge that must be
addressed to ensure the safe and reliable use of these technologies. In this
research, we introduced a novel approach designed to enhance the robustness of
cancer Gleason classification against adversarial attacks, both at the image
and graph levels.

In order to evaluate the effectiveness of the proposed model, we conducted a
comparative analysis against leading graph-based architectures like GNN and
GAT. Given the lack of existing research on enhancing the robustness of graph-
based learning specifically for WSIs, the focus was directed towards the most
prominent graph-based methods. We aimed to analyze how these methods respond
to perturbation in both at image and graph levels, in the presence and absence
of the novel denoising approach. the evaluation process began by testing the
performance of the model under standard conditions, without the introduction
of any perturbations. This initial evaluation provided a baseline
understanding of the model’s capabilities in processing and analyzing WSIs. It
was crucial to establish this benchmark to appreciate the impact of subsequent
adversarial challenges and the effectiveness of the denoising strategy.

The approach represents a significant innovation, particularly due to its
design that targets adversarial attacks at the WSI level, moving beyond the
constraints of traditional patch-based methods. It delves into various methods
and locations where adversarial attacks might occur. By concentrating on WSI,
this research offers a comprehensive and precise examination of the diverse
variabilities found in computer-aided cancer detection, setting a
groundbreaking precedent in the field.

## References

  * [1] J. Levy, C. Haudenschild, C. Barwick, B. Christensen, and L. Vaickus, “Topological feature extraction and visualization of whole slide images using graph neural networks,” in _BIOCOMPUTING 2021: Proceedings of the Pacific Symposium_. World Scientific, 2020, pp. 285–296.
  * [2] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” _arXiv preprint arXiv:1412.6572_ , 2014.
  * [3] K. Xu, H. Chen, S. Liu, P.-Y. Chen, T.-W. Weng, M. Hong, and X. Lin, “Topology attack and defense for graph neural networks: An optimization perspective,” _arXiv preprint arXiv:1906.04214_ , 2019.
  * [4] X. Zang, Y. Xie, J. Chen, and B. Yuan, “Graph universal adversarial attacks: A few bad actors ruin graph learning models,” _arXiv preprint arXiv:2002.04784_ , 2020.
  * [5] S. Tao, H. Shen, Q. Cao, L. Hou, and X. Cheng, “Adversarial immunization for improving certifiable robustness on graphs,” _arXiv preprint arXiv:2007.09647_ , 2020.
  * [6] Y. Ma, S. Wang, T. Derr, L. Wu, and J. Tang, “Attacking graph convolutional networks via rewiring,” _arXiv preprint arXiv:1906.03750_ , 2019.
  * [7] N. Papernot, P. McDaniel, and I. Goodfellow, “Transferability in machine learning: from phenomena to black-box attacks using adversarial samples,” _arXiv preprint arXiv:1605.07277_ , 2016.
  * [8] K. D. Apostolidis and G. A. Papakostas, “A survey on adversarial deep learning robustness in medical image analysis,” _Electronics_ , vol. 10, no. 17, p. 2132, 2021.
  * [9] S. Finlayson, H. Chung, I. Kohane, and A. Beam, “Adversarial attacks against medical deep learning systems,” _arXiv preprint arXiv:1804.05296_ , 2018.
  * [10] K. Apostolidis and G. Papakostas, “A survey on adversarial deep learning robustness in medical image analysis,” _Electronics_ , vol. 10, no. 17, p. 2132, 2021.
  * [11] F. Aeffner, M. D. Zarella, N. Buchbinder, M. M. Bui, M. R. Goodman, D. J. Hartman, G. M. Lujan, M. A. Molani, A. V. Parwani, K. Lillard _et al._ , “Introduction to digital image analysis in whole-slide imaging: a white paper from the digital pathology association,” _Journal of pathology informatics_ , vol. 10, no. 1, p. 9, 2019.
  * [12] N. Ghaffari Laleh, D. Truhn, G. P. Veldhuizen, T. Han, M. van Treeck, R. D. Buelow, R. Langer, B. Dislich, P. Boor, V. Schulz _et al._ , “Adversarial attacks and adversarial robustness in computational pathology,” _Nature communications_ , vol. 13, no. 1, p. 5711, 2022.
  * [13] R. Feng, X. Liu, J. Chen, D. Z. Chen, H. Gao, and J. Wu, “A deep learning approach for colonoscopy pathology wsi analysis: accurate segmentation and classification,” _IEEE Journal of Biomedical and Health Informatics_ , vol. 25, no. 10, pp. 3700–3708, 2020.
  * [14] N. Bussola, J. Xu, L. Wu, L. Gorini, Y. Zhang, C. Furlanello, and W. Tong, “A weakly supervised deep learning framework for whole slide classification to facilitate digital pathology in animal study,” _Chemical Research in Toxicology_ , vol. 36, no. 8, pp. 1321–1331, 2023.
  * [15] G. Campanella, M. G. Hanna, L. Geneslaw, A. Miraflor, V. Werneck Krauss Silva, K. J. Busam, E. Brogi, V. E. Reuter, D. S. Klimstra, and T. J. Fuchs, “Clinical-grade computational pathology using weakly supervised deep learning on whole slide images,” _Nature medicine_ , vol. 25, no. 8, pp. 1301–1309, 2019.
  * [16] J. Li, W. Li, A. Sisk, H. Ye, W. D. Wallace, W. Speier, and C. W. Arnold, “A multi-resolution model for histopathology image classification and localization with multiple instance learning,” _Computers in biology and medicine_ , vol. 131, p. 104253, 2021.
  * [17] M. Aryal and N. Yahyasoltani, “Context-aware self-supervised learning of whole slide images,” _arXiv preprint arXiv:2306.04763_ , 2023.
  * [18] J. Levy, C. Haudenschild, C. Barwick, B. Christensen, and L. Vaickus, “Topological feature extraction and visualization of whole slide images using graph neural networks,” in _BIOCOMPUTING 2021: Proceedings of the Pacific Symposium_. World Scientific, 2020, pp. 285–296.
  * [19] Y. Guan, J. Zhang, K. Tian, S. Yang, P. Dong, J. Xiang, W. Yang, J. Huang, Y. Zhang, and X. Han, “Node-aligned graph convolutional network for whole-slide image representation and classification,” in _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , 2022, pp. 18 813–18 823.
  * [20] M. Aryal and N. Yahyasoltani, “Context-aware graph-based self-supervised learning of whole slide images,” in _ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)_. IEEE, 2022, pp. 3553–3557.
  * [21] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” _arXiv preprint arXiv:1312.6199_ , 2013.
  * [22] D. Zügner, A. Akbarnejad, and S. Günnemann, “Adversarial attacks on neural networks for graph data,” in _Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining_, 2018, pp. 2847–2856.
  * [23] N. Entezari, S. A. Al-Sayouri, A. Darvishzadeh, and E. E. Papalexakis, “All you need is low (rank) defending against adversarial attacks on graphs,” in _Proceedings of the 13th International Conference on Web Search and Data Mining_ , 2020, pp. 169–177.
  * [24] J. Chen, Y. Wu, X. Xu, Y. Chen, H. Zheng, and Q. Xuan, “Fast gradient attack on network embedding,” _arXiv preprint arXiv:1809.02797_ , 2018.
  * [25] Y. Sun, S. Wang, X. Tang, T.-Y. Hsieh, and V. Honavar, “Adversarial attacks on graph neural networks via node injections: A hierarchical reinforcement learning approach,” in _Proceedings of the Web Conference 2020_ , 2020, pp. 673–683.
  * [26] H. Dai, H. Li, T. Tian, X. Huang, L. Wang, J. Zhu, and L. Song, “Adversarial attack on graph structured data,” in _International conference on machine learning_. PMLR, 2018, pp. 1115–1124.
  * [27] F. Tramèr, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh, and P. McDaniel, “Ensemble adversarial training: Attacks and defenses,” _arXiv preprint arXiv:1705.07204_ , 2017.
  * [28] D. Loveland, S. Liu, B. Kailkhura, A. Hiszpanski, and Y. Han, “Reliable graph neural network explanations through adversarial training,” _arXiv preprint arXiv:2106.13427_ , 2021.
  * [29] A. Qayyum, I. Ilahi, F. Shamshad, F. Boussaid, M. Bennamoun, and J. Qadir, “Untrained neural network priors for inverse imaging problems: A survey,” _IEEE Transactions on Pattern Analysis and Machine Intelligence_ , 2022.
  * [30] A. Bora, A. Jalal, E. Price, and A. G. Dimakis, “Compressed sensing using generative models,” in _International conference on machine learning_. PMLR, 2017, pp. 537–546.
  * [31] D. Luo, W. Cheng, W. Yu, B. Zong, J. Ni, H. Chen, and X. Zhang, “Learning to drop: Robust graph neural network via topological denoising,” in _Proceedings of the 14th ACM international conference on web search and data mining_ , 2021, pp. 779–787.
  * [32] P. Velickovic, G. Cucurull, A. Casanova, A. Romero, P. Lio, Y. Bengio _et al._ , “Graph attention networks,” _stat_ , vol. 1050, no. 20, pp. 10–48 550, 2017.
  * [33] A. Foote, A. Asif, A. Azam, T. Marshall-Cox, N. Rajpoot, and F. Minhas, “Now you see it, now you dont: adversarial vulnerabilities in computational pathology,” _arXiv preprint arXiv:2106.08153_ , 2021.
  * [34] S. Bhojanapalli, A. Chakrabarti, D. Glasner, D. Li, T. Unterthiner, and A. Veit, “Understanding robustness of transformers for image classification,” in _Proceedings of the IEEE/CVF international conference on computer vision_ , 2021, pp. 10 231–10 241.
  * [35] Y. Zhang, Y. Sun, H. Li, S. Zheng, C. Zhu, and L. Yang, “Benchmarking the robustness of deep neural networks to common corruptions in digital pathology,” in _International Conference on Medical Image Computing and Computer-Assisted Intervention_. Springer, 2022, pp. 242–252.
  * [36] M. Adnan, S. Kalra, and H. R. Tizhoosh, “Representation learning of histopathology images using graph neural networks,” in _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops_ , 2020, pp. 988–989.
  * [37] D. Anand, S. Gadiya, and A. Sethi, “Histographs: graphs in histopathology,” in _Medical Imaging 2020: Digital Pathology_ , vol. 11320. SPIE, 2020, pp. 150–155.
  * [38] R. Reddy, R. Reddy, C. Sharma, C. Jackson, S. Palisoul, R. Barney, F. Kolling, L. Salas, B. Christensen, G. Brooks _et al._ , “Graph neural networks ameliorate potential impacts of imprecise large-scale autonomous immunofluorescence labeling of immune cells on whole slide images,” in _Geometric Deep Learning in Medical Image Analysis_. PMLR, 2022, pp. 15–33.
  * [39] X. Wang, S. Yang, J. Zhang, M. Wang, J. Zhang, W. Yang, J. Huang, and X. Han, “Transformer-based unsupervised contrastive learning for histopathological image classification.” Elsevier, 2022.
  * [40] T. N. Kipf and M. Welling, “Semi-supervised classification with graph convolutional networks,” 2017.
  * [41] X. Tang, Y. Li, Y. Sun, H. Yao, P. Mitra, and S. Wang, “Transferring robustness for graph neural network against poisoning attacks,” in _Proceedings of the 13th international conference on web search and data mining_ , 2020, pp. 600–608.
  * [42] X. Liu, S. Si, X. Zhu, Y. Li, and C.-J. Hsieh, “A unified framework for data poisoning attack to graph-based semi-supervised learning,” _arXiv preprint arXiv:1910.14147_ , 2019.
  * [43] Q. Zhou, Y. Ren, T. Xia, L. Yuan, and L. Chen, “Data poisoning attacks on graph convolutional matrix completion,” in _International Conference on Algorithms and Architectures for Parallel Processing_. Springer, 2019, pp. 427–439.
  * [44] H. Zhang, T. Zheng, J. Gao, C. Miao, L. Su, Y. Li, and K. Ren, “Towards data poisoning attack against knowledge graph embedding,” _arXiv preprint arXiv:1904.12052_ , 2019.
  * [45] H. Wu, C. Wang, Y. Tyshetskiy, A. Docherty, K. Lu, and L. Zhu, “Adversarial examples on graph data: Deep insights into attack and defense,” _arXiv preprint arXiv:1903.01610_ , 2019.
  * [46] D. Zügner and S. Günnemann, “Adversarial attacks on graph neural networks via meta learning,” 2019.
  * [47] M. Andrychowicz, M. Denil, S. Gomez, M. W. Hoffman, D. Pfau, T. Schaul, B. Shillingford, and N. De Freitas, “Learning to learn by gradient descent by gradient descent,” _Advances in neural information processing systems_ , vol. 29, 2016.
  * [48] C. Finn, P. Abbeel, and S. Levine, “Model-agnostic meta-learning for fast adaptation of deep networks,” in _International conference on machine learning_. PMLR, 2017, pp. 1126–1135.
  * [49] S. Yun, M. Jeong, R. Kim, J. Kang, and H. J. Kim, “Graph transformer networks,” _Advances in neural information processing systems_ , vol. 32, 2019.
  * [50] A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, L. Kaiser, and I. Polosukhin, “Attention is all you need,” 2023.
  * [51] Y. Zheng, R. H. Gindra, E. J. Green, E. J. Burks, M. Betke, J. E. Beane, and V. B. Kolachalama, “A graph-transformer for whole slide image classification,” 2022.
  * [52] S. Rey, S. Segarra, R. Heckel, and A. G. Marques, “Untrained graph neural networks for denoising,” _IEEE Transactions on Signal Processing_ , vol. 70, pp. 5708–5723, 2022.
  * [53] W. Bulten, K. Kartasalo, P.-H. C. Chen, P. Ström, H. Pinckaers, K. Nagpal, Y. Cai, D. F. Steiner, H. van Boven, R. Vink _et al._ , “Artificial intelligence for diagnosis and gleason grading of prostate cancer: the panda challenge,” _Nature medicine_ , vol. 28, no. 1, pp. 154–163, 2022.