% Template for PLoS
% Version 3.6 Aug 2022
%
% % % % % % % % % % % % % % % % % % % % % %
%
% -- IMPORTANT NOTE
%
% This template contains comments intended 
% to minimize problems and delays during our production 
% process. Please follow the template instructions
% whenever possible.
%
% % % % % % % % % % % % % % % % % % % % % % % 
%
% Once your paper is accepted for publication, 
% PLEASE REMOVE ALL TRACKED CHANGES in this file 
% and leave only the final text of your manuscript. 
% PLOS recommends the use of latexdiff to track changes during review, as this will help to maintain a clean tex file.
% Visit https://www.ctan.org/pkg/latexdiff?lang=en for info or contact us at latex@plos.org.
%
%
% There are no restrictions on package use within the LaTeX files except that no packages listed in the template may be deleted.
%
% Please do not include colors or graphics in the text.
%
% The manuscript LaTeX source should be contained within a single file (do not use \input, \externaldocument, or similar commands).
%
% % % % % % % % % % % % % % % % % % % % % % %
%
% -- FIGURES AND TABLES
%
% Please include tables/figure captions directly after the paragraph where they are first cited in the text.
%
% DO NOT INCLUDE GRAPHICS IN YOUR MANUSCRIPT
% - Figures should be uploaded separately from your manuscript file. 
% - Figures generated using LaTeX should be extracted and removed from the PDF before submission. 
% - Figures containing multiple panels/subfigures must be combined into one image file before submission.
% For figure citations, please use "Fig" instead of "Figure".
% See http://journals.plos.org/plosone/s/figures for PLOS figure guidelines.
%
% Tables should be cell-based and may not contain:
% - spacing/line breaks within cells to alter layout or alignment
% - do not nest tabular environments (no tabular environments within tabular environments)
% - no graphics or colored text (cell background color/shading OK)
% See http://journals.plos.org/plosone/s/tables for table guidelines.
%
% For tables that exceed the width of the text column, use the adjustwidth environment as illustrated in the example table in text below.
%
% % % % % % % % % % % % % % % % % % % % % % % %
%
% -- EQUATIONS, MATH SYMBOLS, SUBSCRIPTS, AND SUPERSCRIPTS
%
% IMPORTANT
% Below are a few tips to help format your equations and other special characters according to our specifications. For more tips to help reduce the possibility of formatting errors during conversion, please see our LaTeX guidelines at http://journals.plos.org/plosone/s/latex
%
% For inline equations, please be sure to include all portions of an equation in the math environment.  For example, x$^2$ is incorrect; this should be formatted as $x^2$ (or $\mathrm{x}^2$ if the romanized font is desired).
%
% Do not include text that is not math in the math environment. For example, CO2 should be written as CO\textsubscript{2} instead of CO$_2$.
%
% Please add line breaks to long display equations when possible in order to fit size of the column. 
%
% For inline equations, please do not include punctuation (commas, etc) within the math environment unless this is part of the equation.
%
% When adding superscript or subscripts outside of brackets/braces, please group using {}.  For example, change "[U(D,E,\gamma)]^2" to "{[U(D,E,\gamma)]}^2". 
%
% Do not use \cal for caligraphic font.  Instead, use \mathcal{}
%
% % % % % % % % % % % % % % % % % % % % % % % % 
%
% Please contact latex@plos.org with any questions.
%
% % % % % % % % % % % % % % % % % % % % % % % %

\documentclass[10pt,letterpaper]{article}
\usepackage[top=0.85in,left=2.75in,footskip=0.75in]{geometry}

% amsmath and amssymb packages, useful for mathematical formulas and symbols
\usepackage{amsmath,amssymb}

% Use adjustwidth environment to exceed column width (see example table in text)
\usepackage{changepage}

% textcomp package and marvosym package for additional characters
\usepackage{textcomp,marvosym}

% cite package, to clean up citations in the main text. Do not remove.
\usepackage{cite}

% Use nameref to cite supporting information files (see Supporting Information section for more info)
\usepackage{nameref,hyperref}

% line numbers
\usepackage[right]{lineno}

% ligatures disabled
\usepackage[nopatch=eqnum]{microtype}
\DisableLigatures[f]{encoding = *, family = * }

% color can be used to apply background shading to table cells only
\usepackage[table]{xcolor}

% array package and thick rules for tables
\usepackage{array}
\usepackage{multirow}

% create "+" rule type for thick vertical lines
\newcolumntype{+}{!{\vrule width 2pt}}

% create \thickcline for thick horizontal lines of variable length
\newlength\savedwidth
\newcommand\thickcline[1]{%
  \noalign{\global\savedwidth\arrayrulewidth\global\arrayrulewidth 2pt}%
  \cline{#1}%
  \noalign{\vskip\arrayrulewidth}%
  \noalign{\global\arrayrulewidth\savedwidth}%
}

% \thickhline command for thick horizontal lines that span the table
\newcommand\thickhline{\noalign{\global\savedwidth\arrayrulewidth\global\arrayrulewidth 2pt}%
\hline
\noalign{\global\arrayrulewidth\savedwidth}}


% Remove comment for double spacing
%\usepackage{setspace} 
%\doublespacing

% Text layout
\raggedright
\setlength{\parindent}{0.5cm}
\textwidth 5.25in 
\textheight 8.75in

% Bold the 'Figure #' in the caption and separate it from the title/caption with a period
% Captions will be left justified
\usepackage[aboveskip=1pt,labelfont=bf,labelsep=period,justification=raggedright,singlelinecheck=off]{caption}
\renewcommand{\figurename}{Fig}

% Use the PLoS provided BiBTeX style
\bibliographystyle{plos2015}

% Remove brackets from numbering in List of References
\makeatletter
\renewcommand{\@biblabel}[1]{\quad#1.}
\makeatother



% Header and Footer with logo
\usepackage{lastpage,fancyhdr,graphicx}
\usepackage{epstopdf}
%\pagestyle{myheadings}
\pagestyle{fancy}
\fancyhf{}
%\setlength{\headheight}{27.023pt}
%\lhead{\includegraphics[width=2.0in]{PLOS-submission.eps}}
\rfoot{\thepage/\pageref{LastPage}}
\renewcommand{\headrulewidth}{0pt}
% \renewcommand{\footrule}{\hrule height 2pt \vspace{2mm}}
% \fancyheadoffset[L]{2.25in}
% \fancyfootoffset[L]{2.25in}
%\lfoot{\today}

%% Include all macros below

\newcommand{\lorem}{{\bf LOREM}}
\newcommand{\ipsum}{{\bf IPSUM}}

%% END MACROS SECTION


\begin{document}
\vspace*{0.2in}

% Title must be 250 characters or less.
\begin{flushleft}
{\Large
\textbf\newline{Mobile applications for skin cancer detection are vulnerable to physical camera-based adversarial attacks} % Please use "sentence case" for title and headings (capitalize only the first word in a title (or heading), the first word in a subtitle (or subheading), and any proper nouns).
}
\newline
% Insert author names, affiliations and corresponding author email (do not include titles, positions, or degrees).
\\
Junsei Oda\textsuperscript{1},
Kazuhiro Takemoto \textsuperscript{1,2*}
\\
\bigskip
\textbf{1} Department of Bioscience and Bioinformatics, Kyushu Institute of Technology, Iizuka, Fukuoka, Japan
\\
\textbf{2} Data Science and AI Research Center, Kyushu Institute of Technology, Iizuka, Fukuoka, Japan
\\
% \textbf{3} Affiliation Dept/Program/Center, Institution Name, City, State, Country
% \\
\bigskip

% Insert additional author notes using the symbols described below. Insert symbol callouts after author names as necessary.
% 
% Remove or comment out the author notes below if they aren't used.
%
% Primary Equal Contribution Note
% \Yinyang These authors contributed equally to this work.

% Additional Equal Contribution Note
% Also use this double-dagger symbol for special authorship notes, such as senior authorship.
% \ddag These authors also contributed equally to this work.

% Current address notes
% \textcurrency Current Address: Dept/Program/Center, Institution Name, City, State, Country % change symbol to "\textcurrency a" if more than one current address note
% \textcurrency b Insert second current address 
% \textcurrency c Insert third current address

% Deceased author note
% \dag Deceased

% Group/Consortium Author Note
% \textpilcrow Membership list can be found in the Acknowledgments section.

% Use the asterisk to denote corresponding authorship and provide email address in note below.
* takemoto@bio.kyutech.ac.jp

\end{flushleft}
% Please keep the abstract below 300 words
\section*{Abstract}
Skin cancer is one of the most prevalent malignant tumors, and early detection is crucial for patient prognosis, leading to the development of mobile applications as screening tools. Recent advances in deep neural networks (DNNs) have accelerated the deployment of DNN-based applications for automated skin cancer detection. While DNNs have demonstrated remarkable capabilities, they are known to be vulnerable to adversarial attacks, where carefully crafted perturbations can manipulate model predictions. The vulnerability of deployed medical mobile applications to such attacks remains largely unexplored under real-world conditions. Here, we investigate the susceptibility of three DNN-based medical mobile applications to physical adversarial attacks using transparent camera stickers under black-box conditions where internal model architectures are inaccessible. Through digital experiments with various DNN architectures trained on a publicly available skin lesion dataset, we first demonstrate that camera-based adversarial patterns can achieve high transferability across different models. Using these findings, we implement physical attacks by attaching optimized transparent stickers to mobile device cameras. Our results show that these attacks successfully manipulate application predictions, particularly for melanoma images, with attack success rates reaching 50--80\% across all applications while maintaining visual imperceptibility. Notably, melanoma images showed consistently higher vulnerability compared to nevus images across all tested applications. To the best of our knowledge, this is the first demonstration of real-world adversarial vulnerabilities in deployed medical mobile applications, revealing significant security concerns where prediction manipulation could affect diagnostic processes. Our study demonstrates the importance of security evaluation in deploying such applications in clinical settings.


% Please keep the Author Summary between 150 and 200 words
% Use first person. PLOS ONE authors please skip this step. 
% Author Summary not valid for PLOS ONE submissions.   
% \section*{Author summary}
% Skin cancer is a common and serious condition where early detection is vital for successful treatment. To help with early screening, mobile phone applications have been developed, and many now use artificial intelligence technology called deep neural networks for automated diagnosis. While these systems show impressive performance, we found they can be tricked by simple modifications to the phone camera, specifically by attaching specially designed transparent stickers. In our research, we tested this vulnerability across multiple applications by creating these sticker patterns and applying them to phone cameras. We found that the applications could be consistently misled, particularly when examining images of melanoma, which is the most dangerous form of skin cancer. The applications incorrectly classified 50 to 80 percent of the test images when our stickers were applied, even though the images looked almost unchanged to human eyes. This is the first demonstration of such security issues in real medical applications, highlighting the importance of thorough security testing before these AI systems are used in healthcare settings.

\paragraph{Keywords} Deep neural networks, Medical imaging, Adversarial attacks, Security and privacy
%\linenumbers

% Use "Eq" instead of "Equation" for equation citations.
\section*{Introduction}
Skin cancer is one of the most prevalent malignant tumors worldwide, and its early detection and treatment are likely to significantly improve patient prognosis \cite{siegel2024cancer,diepgen2002epidemiology,nikolaou2014emerging}.
However, the shortage of dermatologists, particularly in regions with limited medical resources, makes it difficult to ensure adequate diagnostic opportunities \cite{resneck2004dermatology,ehrlich2017trends,porter2018predictions}.
Since skin cancer develops in visually accessible areas and can be relatively easily evaluated through digital imaging, mobile applications utilizing device cameras have been developed to assess skin lesions \cite{kassianos2015smartphone,rat2018use,chan2020machine,freeman2020algorithm,udrea2020accuracy}.
These applications are expected to serve as primary screening tools, helping determine the necessity of specialist consultations.
Nevertheless, conventional mobile applications have been subject to ongoing discussions regarding their clinical utility, particularly in terms of diagnostic accuracy \cite{wolf2013diagnostic,kassianos2015smartphone,ngoo2018efficacy,deeks2020sensitivity}.

Advances in artificial intelligence (AI), particularly deep learning technology \cite{shen2017deep}, have significantly improved the accuracy of automated skin lesion classification \cite{brinker2018skin,goyal2020artificial,dascalu2019skin,takiddin2021artificial,sokolov2022dynamics}, with some studies reporting diagnostic performance comparable to that of specialists under specific conditions \cite{esteva2017dermatologist,liu2019comparison}.
Against this backdrop of technological progress, the development of mobile applications incorporating deep learning has intensified, marking a transition to a new era in automated skin cancer diagnosis \cite{kong2021review,goceri2021diagnosis,kranke2023new,smak2023artificial}.

However, the introduction of deep learning models raises new security considerations for these systems.
A particularly critical concern is their vulnerability to adversarial attacks. 
Adversarial attacks are techniques that deliberately manipulate deep neural network outputs by adding imperceptible perturbations to input data \cite{yuan2019adversarial,chakraborty2021survey,akhtar2021advances}.

Adversarial attack research on deep learning-based medical image diagnosis systems has been conducted on various modalities \cite{kaviani2022adversarial,sorin2023adversarial}, including dermatological images \cite{finlayson2019adversarial, hirano2021universal}, chest X-rays \cite{asgari2018vulnerability, hirano2020vulnerability, hirano2021universal}, optical coherence tomography images \cite{hirano2021universal}, and magnetic resonance imaging scans \cite{cheng2020adversarial}.
These studies have primarily focused on white-box analyses, where model parameters are accessible, providing crucial insights into the fundamental vulnerabilities of deep learning-based medical systems.
However, most of these studies have been limited to evaluating perturbations in digital data, with minimal investigation into physical attacks.
Moreover, real-world mobile applications typically operate in black-box environments where access to the model's internal structure is restricted, and input data is acquired through physical camera capture.
Therefore, it is necessary to examine the possibility of attacks under black-box conditions that reflect such real-world environments.

Evaluating the security of mobile applications used for medical diagnosis is crucial as these tools increasingly influence healthcare decisions and patient outcomes.
Unlike controlled clinical environments, mobile applications operate in diverse settings where security vulnerabilities could affect large populations, potentially compromising patient safety and undermining public trust in digital health technologies \cite{kaissis2020secure,hirano2020vulnerability}.
The black-box nature of many deployed applications further emphasizes the need for robust external security evaluation frameworks.

Various physical adversarial attack methods have been proposed \cite{kurakin2018adversarial,wei2024physical,ren2021adversarial}, including direct object manipulation (object attacks) \cite{eykholt2018robust,thys2019fooling}, lighting environment manipulation (optical attacks) \cite{gnanasambandam2021optical,wang2023rfla}, and camera system intervention (camera-based attacks) \cite{li2019adversarial}.
Among these, camera-based attacks are more faithful to the fundamental concept of adversarial attacks, as they can introduce relatively imperceptible perturbations across the entire captured image by simply attaching a transparent sticker with specific patterns to the camera lens, without directly modifying the target object.
Furthermore, since applying protective films to smartphone camera lenses is a common practice, this represents one of the most realistic attack scenarios against mobile applications.

However, previous study on camera-based attacks has been limited to white-box conditions where model parameters are accessible \cite{li2019adversarial}, leaving the possibility of attacks under real-world black-box conditions unexplored. 
Furthermore, applications to medical image diagnosis systems have not been reported. 
Meanwhile, black-box attack methods that generate adversarial perturbations using surrogate models different from the target model and leverage their transferability have been widely studied in the field of image recognition \cite{papernot2017practical,cheng2019improving,demontis2019adversarial}, and have also been investigated in the context of digital attacks on medical image diagnosis systems \cite{bortsova2021adversarial,ma2021understanding}.
However, the integration of these approaches with actual applications and physical camera-based attacks, including their feasibility, remains uninvestigated.

In this study, we develop an attack framework that combines physical camera-based attacks with black-box transferability to evaluate the vulnerability of mobile applications for skin cancer detection.
By quantitatively assessing the impact under realistic attack scenarios using only limited knowledge of model architecture, we aim to reveal novel vulnerabilities potentially inherent in medical diagnosis systems and provide insights for more secure system design.


\section*{Materials and methods}
\subsection*{Target application and black-box environment}
We identified candidate applications by searching for ``skin cancer'' on both Google Play and Apple App Store in September 2024, specifically selecting those that explicitly stated the use of neural networks for analysis.
Based on these criteria, we selected three applications: DermoApp, SkiniveMD, and Blemish Types.

DermoApp \cite{kousis2022deep}, developed by Alien App Developer and downloaded over 10,000 times on Google Play, operates without user registration or cloud processing. The application provides binary classification specifically for melanoma detection (melanoma or not melanoma), reporting an accuracy of 96.8\%. It processes images entirely on-device without requiring data storage or internet connectivity.

SkiniveMD \cite{sokolov2022dynamics}, developed by Skinive B.V. and with more than 10,000 downloads on Google Play, is designed as a pre-diagnostic tool for healthcare professionals including dermatologists, therapists, and nurses The developer states that the application complies with Class I medical device regulations (CE MDD) and ISO 13485 quality management standards. The application can analyze over 50 different skin conditions, including various types of skin cancer (melanoma, basal cell carcinoma, squamous cell carcinoma) and precancerous conditions, using standard smartphone camera images for most conditions. For cancer risk assessment, however, the application specifically requires dermoscopic images.

Blemish Types \cite{fotocheckskin}, developed by Turion Development in collaboration with the Technical University of Teruel and downloaded more than 1,000 times on Google Play, employs neural networks trained for over 600 processing hours. The application reports an accuracy of 70.5\% for classifying skin lesions into seven diagnostic categories, including melanoma and other common skin conditions. The application supports both standard and dermoscopic imaging modes.

All three applications operate as black-box systems where only the input-output interface is accessible.
While their technical descriptions and related publications suggest the use of efficient deep learning models suitable for mobile deployment, we did not utilize this information in our experimental design, including the selection of surrogate models.
In fact, we reviewed these technical details only after completing all experiments to maintain the integrity of our black-box evaluation approach.
Each application implements pre-processing steps including image quality assessment and lesion boundary detection to ensure reliable analysis.

\subsection*{Dataset and surrogate models}
To develop black-box attacks against the target applications without access to their internal architectures, we employed a transferability-based approach.
This approach involves training several independent surrogate models, each of which is used to generate its own adversarial perturbation.
By evaluating perturbations generated from different model architectures, we can assess which architectural choices lead to more transferable attacks against unknown target models.

Since the target applications focus on skin cancer detection, we utilized a dataset specifically designed for melanoma detection and skin lesion classification tasks. 
The skin lesion images used in this study were obtained from the International Skin Imaging Collaboration (ISIC) 2018 dataset \cite{tschandl2018ham10000,codella2019skin}, specifically chosen due to its classification structure that closely aligns with the functionality of commercial skin cancer detection applications.
This dataset was also used in previous studies \cite{esteva2017dermatologist,minagi2022natural,koga2022simple}.
This choice ensures that our surrogate models are trained on data distributions similar to those expected in real-world melanoma detection applications.
We specifically chose the ISIC 2018 dataset due to its classification structure that closely aligns with the functionality of commercial skin cancer detection applications.
The dataset consists of 10,015 RGB images classified into seven categories: melanoma (MEL), melanocytic nevus (NV), basal cell carcinoma (BCC), actinic keratosis/Bowens disease (intraepithelial carcinoma; AKIEC), benign keratosis (solar lentigo/seborrheic keratosis/lichen planus-like keratosis; BKL), dermatofibroma (DF), and vascular lesions (VASC).
Following our previous studies \cite{hirano2021universal,minagi2022natural,koga2022simple}, we maintained the same data split: 7,000 images for training (759 MEL, 4,679 NV, 358 BCC, 236 AKIEC, 790 BKL, 79 DF, and 99 VASC) and 3,015 images for testing (354 MEL, 2,026 NV, 156 BCC, 91 AKIEC, 309 BKL, 36 DF, and 43 VASC).

For generating transferable adversarial perturbations, we carefully selected and trained multiple surrogate models that reflect potential architectures used in mobile applications.
Our selection primarily focused on lightweight architectures suitable for mobile deployment: MobileNetV2 \cite{howard2017mobilenets}, MobileNetV3-Large \cite{howard2017mobilenets}, ResNet-18 \cite{he2016deep}, VGG-16 \cite{simonyan2014very}, and EfficientNet-B1 \cite{tan2019efficientnet}.
To comprehensively evaluate transferability, we also included their larger counterparts including ResNet-50 \cite{he2016deep}, VGG-19 \cite{simonyan2014very}, DenseNet-121 \cite{huang2017densely}, and DenseNet-201 \cite{huang2017densely}. 
Additionally, considering the recent success of transformer architectures in computer vision tasks (vision transformer; ViT) \cite{dosovitskiy2020image}, we incorporated ViT-Base-16 and ViT-Small-16 in our evaluation.
This diverse set of architectures, ranging from mobile-optimized to more complex models, allows us to assess which type of model architecture generates perturbations that are most effective against mobile applications.

The training protocol followed the standard practices for utilizing pre-trained models. Input images were resized to $224 \times 224$ pixels to match the original training dimensions of the pre-trained models.
During training, we applied data augmentation using random augmentation \cite{cubuk2020randaugment} with two operations at magnitude 14, and normalized the images (original pixel intensity scaled to 0--1), using mean and standard deviation values of 0.5 across all channels.
The models were optimized using Adam \cite{kingma2014adam} with an initial learning rate of $5.0 \times 10^{-5}$, incorporating a cosine learning rate schedule with warmup.
To address the class imbalance in our dataset, we employed an imbalanced dataset sampler \cite{ming2022imbalanced}.
Mixed precision training was utilized to improve computational efficiency.
We used a batch size of 256 and trained for 200 epochs, selecting the model with the best validation performance.

\subsection*{Physical camera-based attack framework}
Our attack framework builds upon the camera-based adversarial attacks proposed by Li et al. \cite{li2019adversarial}, where perturbations are applied through a transparent sticker attached to the camera lens rather than directly modifying the target object.
Using the surrogate models described in the previous section, we generate adversarial patterns under white-box conditions, which are then transferred to attack the target applications operating in black-box environments \cite{papernot2017practical,cheng2019improving,demontis2019adversarial}.
This approach generates a universal adversarial perturbation (UAP) \cite{moosavi2017universal}: a single perturbation pattern that can cause misclassification of any input captured through the camera.

Our implementation builds directly upon the framework established by Li et al. [44], with modifications to enable transferability in black-box settings. The key adaptations include: optimization across multiple surrogate models to enhance transferability, parameter constraints specifically calibrated for medical imaging contexts, and integration with the ISIC dataset preprocessing pipeline.
Complete implementation details, including all parameters and configurations, are available in our public repository (https://github.com/kztakemoto/advStickersMed).

The framework generates adversarial patterns consisting of translucent dots that form the camera sticker.
Following previous work \cite{li2019adversarial}, we set the radius of each dot to 0.1 relative to the image size.
Through empirical observation of actual transparent stickers attached to camera lenses, we determined two physical parameters: the opacity level ($\alpha = 0.2$) to reproduce the translucency of the sticker material, and the smoothness of the dropoff from the dot center ($\beta = 0.6$) to reflect the natural blending effect of the dots when viewed through the camera lens.

While these physical parameters remain constant, our framework optimizes two key parameters for each dot: its center position and RGB color values.
We focus on non-targeted attacks because the target applications employ different classification schemes, making targeted attacks impractical in real-world scenarios. 
For generating the adversarial patterns, we employed a straightforward loss function 
based on cross-entropy \cite{poursaeed2018generative}: $L=-\log(H(k(x_{\mathrm{adv}}),y))$, where $H$ represents the cross-entropy loss, $k(x_{\mathrm{adv}})$ denotes the model's prediction for the perturbed image $x_{\mathrm{adv}}$, and $y$ is the true label.
In practice, the loss is computed over mini-batches for computational efficiency. While more sophisticated loss functions have been proposed in previous work, we found that this simple formulation was effective for our physical attack scenario.

The optimization process employs the Adam optimizer with a cosine learning rate schedule, starting from an initial learning rate of 0.001. To ensure physical feasibility, we constrain all parameters to the range $[0,1]$ during optimization. 
The dot positions and colors are initialized randomly and gradually refined through the optimization process.
For this adversarial pattern generation, we used a batch size of 32 and trained for 30 epochs, selecting the pattern that achieved the best validation performance.

\subsection*{Digital experiments setup}
Using the surrogate models, we first evaluate the transferability of adversarial patterns in a digital setting. For each model architecture, we generate adversarial patterns and evaluate their effectiveness when transferred to other architectures. To investigate the relationship between the number of dots and attack effectiveness, we test patterns with varying numbers of dots (5, 10, 15, 20, 25, and 30 dots).

We evaluate the performance using Attack Success Rate (ASR), defined as the proportion of cases where the model's prediction differs from the true label when the adversarial pattern is applied to the input image. Using the ISIC 2018 test dataset, we measure the ASR for each combination of source and target models.
All images are processed following the same preprocessing steps used during model training.

Through this evaluation, we aim to determine both the optimal number of dots and identify which surrogate models generate the most transferable adversarial patterns. These findings inform our subsequent physical experiments against mobile applications.

\subsection*{Physical experiments setup}
Building upon the findings from digital experiments, we created an evaluation dataset by randomly sampling 100 MEL and 100 NV images from the ISIC 2018 test set.
We focused on MEL and NV images as they represent the primary diagnostic distinction that skin cancer detection applications address: differentiating potentially malignant melanomas from benign nevi.
These images were assigned sequential identifiers (MEL\_001 to MEL\_100 and NV\_001 to NV\_100) to ensure consistent selection across applications.
From this dataset, we used the first 100 MEL and 50 NV images for DermoApp, and the first 20 images of each class for SkiniveMD and Blemish Types.
DermoApp returns results quickly (typically within a few seconds), while SkiniveMD and Blemish Types require more processing time (approximately 2--3 minutes per image).
Additionally, these applications required multiple trials (up to three per image) for consistent evaluation, as detailed below.
This approach balanced experimental thoroughness with resource constraints while maintaining statistical significance for our findings.
The effectiveness of physical attacks is evaluated using the same ASR metric as in the digital experiments.

For physical implementation, we used different devices based on application compatibility.
Most applications were tested on an Android tablet (JUSTSYSTEM ZJ-JS202) as they were available on Google Play.
However, for SkiniveMD, due to version compatibility issues, we used an iPad Air (4th generation, Model A2316) with the application installed through the Apple Store.

The adversarial dot patterns were printed on transparent glossy film (PLUS Corp. IT-324F-C) using a standard inkjet printer (Canon TR153).
The size of the dots was adjusted according to the lens diameter of the mobile devices' cameras.
The transparent stickers were carefully aligned and attached to the camera lenses of the test devices.
In preliminary tests, we observed that different transparent film materials produced similar attack success rates, suggesting the dot configurations are more critical than specific film properties.

Ethical considerations guided our experimental design.
To avoid ethical concerns regarding human subjects while maintaining experimental rigor, we displayed the ISIC 2018 test images on a DELL U2718Q 27-inch monitor rather than conducting direct patient photography.
This approach enabled comprehensive testing with a diverse set of skin lesion images while ensuring no additional human data collection was required.
The monitor used to display the ISIC images was calibrated to standard settings with consistent brightness (250 cd/$m^2$) and color temperature (6500K) before conducting experiments.
To ensure consistent positioning between the mobile device cameras and the displayed images, we used a fixed mounting system that maintained a constant distance (approximately 15 cm) and perpendicular angle between the camera lens and the display surface.
All experiments were conducted under standard indoor lighting conditions (uniform overhead LED lighting at approximately 500 lux, measured using a light meter at the experimental setup). 
When switching between devices (Android tablet and iPad), we maintained identical positioning and calibration protocols to ensure experimental consistency, with the only difference being the specific device used for image capture.
Our study balanced the need for security research transparency with responsible disclosure, focusing on raising awareness of system vulnerabilities using commonly available materials and established techniques.

To ensure reliable evaluation of the applications' predictions, we conducted up to three trials for each image.
The prediction label was determined based on these trials, with different criteria depending on the application's characteristics.
In general, if any incorrect prediction was observed during the trials, we adopted that prediction as the final label.
However, for SkiniveMD, which showed prediction instability leading to lower accuracy, we adopted the most frequently predicted class across multiple trials. In cases where multiple classes appeared with equal frequency, we selected the prediction with higher confidence as the final label.

Since these applications use different classification schemes from the ISIC 2018 dataset, we established a mapping between their prediction labels and the ISIC 2018 classes based on medical knowledge.


% Results and Discussion can be combined.
\section*{Results}
To evaluate the vulnerability of mobile applications for skin cancer detection against physical camera-based adversarial attacks, we first conducted digital experiments to assess the transferability of adversarial patterns across different model architectures.
We then performed physical experiments to verify the effectiveness of these attacks in real-world scenarios using actual mobile applications.

\subsection*{Digital experiments}
We began by evaluating the classification performance of our surrogate models on the ISIC 2018 test dataset to ensure their reliability for generating adversarial patterns. All models demonstrated robust performance with accuracy ranging from 84.0\% to 90.2\%.
Vision transformer architectures exhibited the strongest performance, with ViT-Base-16 and ViT-Small-16 achieving 90.2\% and 89.6\% accuracy respectively.
Other architectures also performed well: ResNet-18 (86.8\%), ResNet-50 (87.8\%), DenseNet-121 (87.6\%), and DenseNet-201 (88.0\%).
The VGG family showed similar performance levels with VGG-16 at 86.1\% and VGG-19 at 85.8\%. Notably, even lightweight architectures designed for mobile deployment maintained competitive performance, including MobileNetV2 (84.0\%), MobileNetV3 (85.9\%), and EfficientNet-B1 (85.6\%).
These results indicate that our surrogate models possess sufficient discriminative power for the skin lesion classification task and are suitable for generating transferable adversarial patterns.


To evaluate the transferability of adversarial patterns, we generated patterns using each surrogate model with 25 dots and tested them against all models.
Table \ref{table:transfer_ASR} shows the ASR for each combination of surrogate (rows) and target models (columns).
For comparison, we also included results from random dot patterns (bottom row) where dot positions and colors were randomly determined, showing the average ASRs across 10 different random patterns.

\begin{table}[!ht]
\caption{
{\bf Attack Success Rate (ASR; \%) of adversarial patterns with 25 dots across different model architectures.}}
\begin{adjustwidth}{-2.25in}{0in} % Comment out/remove adjustwidth environment if table fits in text column.
\begin{flushright}
\begin{tabular}{l|ccccccccccc}
\hline
 & A & B & C & D & E & F & G& H & I & J & K \\
\thickhline
A) ResNet-18 & 95.3 & 83.5 & 88.8 & 88.2 & 89.4 & 79.4 & 90.4 & 90.6 & 92.2 & 44.3 & 88.5 \\
B) ResNet-50 & 82.0 & 85.8 & 65.2 & 61.1 & 70.2 & 62.2 & 69.1 & 68.0 & 84.6 & 31.7 & 75.5 \\
C) VGG-16 & 84.4 & 74.4 & 90.8 & 85.4 & 81.0 & 68.2 & 82.7 & 80.2 & 82.4 & 27.2 & 68.9 \\
D) VGG-19 & 74.7 & 76.4 & 83.3 & 88.3 & 81.6 & 61.4 & 79.4 & 68.7 & 74.8 & 28.5 & 60.3 \\
E) MobileNetV2 & 74.1 & 80.7 & 79.9 & 81.7 & 90.7 & 82.3 & 87.1 & 75.9 & 82.7 & 31.4 & 61.3 \\
F) MobileNetV3 & 50.2 & 45.2 & 46.2 & 44.6 & 49.2 & 49.5 & 48.4 & 42.4 & 47.7 & 29.2 & 42.0 \\
G) EfficientNet-B1 & 88.2 & 86.3 & 91.2 & 94.3 & 93.3 & 89.1 & 95.0 & 83.1 & 87.8 & 47.9 & 71.3 \\
H) DenseNet-121 & 73.9 & 77.2 & 56.8 & 52.5 & 62.2 & 51.9 & 67.9 & 89.7 & 77.8 & 32.3 & 76.7 \\
I) DenseNet-201 & 82.3 & 79.8 & 72.9 & 70.6 & 74.1 & 56.1 & 77.3 & 66.7 & 92.5 & 31.4 & 79.4 \\
J) ViT-Small-16 & 62.9 & 66.5 & 47.4 & 60.8 & 61.4 & 44.9 & 62.5 & 61.3 & 73.8 & 31.0 & 80.0 \\
K) ViT-Base-16 & 64.1 & 46.3 & 34.8 & 40.7 & 40.5 & 31.7 & 46.8 & 49.2 & 57.9 & 29.3 & 90.9 \\
\hline
Random & 23.6 & 18.2 & 15.9 & 16.6 & 21.6 & 20.4 & 25.4 & 16.2 & 19.0 & 18.8 & 15.3 \\
\hline
\end{tabular}
\end{flushright}
\end{adjustwidth}
Rows represent surrogate models used to generate adversarial patterns, while columns represent target models under attack. Letters A--K in column headers correspond to the same model architectures as indicated by the letters preceding the surrogate model names in rows (e.g., A: ResNet-18, B: ResNet-50, etc.). The ``Random'' row shows results from random patterns where dot positions and colors were randomly determined. Higher ASR indicates more successful attacks.
\label{table:transfer_ASR}
\end{table}

The results demonstrate significant transferability of adversarial patterns across different architectures.
For each surrogate model, we evaluated the ASRs against all other models (excluding the surrogate model itself as a target).
EfficientNet-B1 generated particularly effective patterns, achieving high ASRs (83.1--95.0\%) against most target models, though effectiveness against ViT-Small-16 was notably lower at 47.9\%.
Similarly, ResNet-18 demonstrated strong transferability, with ASRs consistently above 80\% against most target models, while dropping to 44.3\% against ViT-Small-16.
In contrast, the ASRs of random patterns remained consistently low (15.3--25.4\%), approximately equal to 1 minus the accuracy of each model, indicating that random patterns hardly contributed to misclassification.
This clear difference from optimized patterns confirms that the optimization of dot positions and colors is crucial for successful attacks.

Notably, Vision Transformer architectures (ViT-Small-16 and ViT-Base-16) showed relatively lower transferability compared to convolutional architectures, with ASRs generally ranging from 29.3\% to 80.0\%.
This suggests that the architectural differences between transformers and convolutional networks may affect the transferability of adversarial patterns.
Interestingly, patterns generated using MobileNetV3 showed limited transferability across all target models (29.2--50.2\%), despite its competitive classification performance.

The diagonal elements of the table represent white-box scenarios where the target model is identical to the surrogate model.
As expected, these cases generally showed higher ASRs (ranging from 49.5\% to 95.3\%, except for ViT-Small-16 at 31.0\%), though the margin of improvement over cross-architecture transfer was not always substantial.

To understand why we focused on patterns with 25 dots in our transferability analysis (Table \ref{table:transfer_ASR}), we investigated how the number of dots affects the transferability of attacks.
Fig \ref{fig:transferASR_vs_noDots} shows the relationship between the number of dots and the average transfer ASR for each surrogate model, where average transfer ASR is calculated as the mean ASR across all target models excluding the surrogate model itself. The shaded regions represent one standard deviation. Most models showed a generally increasing trend in ASR as the number of dots increased from 5 dots (average transfer ASR: 25--55\%) to 25 dots (average transfer ASR: 45--85\%).
EfficientNet-B1 and ResNet-18 demonstrated particularly strong transferability, reaching average transfer ASRs of 83.3\% and 83.5\% respectively at 25 dots.
Beyond 25 dots, the effectiveness either plateaued or decreased, as seen in these models where the average transfer ASR dropped to around 75\% at 30 dots.
While ViT architectures exhibited relatively lower transferability overall, they showed slightly different trends: ViT-Base-16 continued to show a marginal increase up to 30 dots, though its maximum average transfer ASR remained relatively low at 50.4\%.
The overall trend across architectures indicated that 25 dots provided the optimal balance for attack transferability.
This finding led us to focus our detailed cross-architecture transferability analysis on patterns with 25 dots, as presented in Table \ref{table:transfer_ASR}.

% Place figure captions after the first paragraph in which they are cited.
\begin{figure}[!ht]
\begin{center}
\includegraphics[width=125mm]{Fig1.eps} % Here is how to import EPS art
\end{center}
\caption{{\bf Impact of the number of dots on adversarial pattern transferability.}
Average transfer Attach Success Rate (ASR; \%) versus the number of dots for each surrogate model. Average transfer ASR is calculated as the mean ASR across all target models excluding the surrogate model itself. Shaded regions represent one standard deviation. Higher ASR indicates more successful attacks.}
\label{fig:transferASR_vs_noDots}
\end{figure}

To better understand the nature of misclassifications caused by adversarial patterns, we analyzed confusion matrices for selected target models attacked using ResNet-18 as the surrogate model.
ResNet-18 was chosen as the surrogate model due to its strong transferability demonstrated in Table \ref{table:transfer_ASR}, where it achieved consistently high ASRs (79.4-92.2\%, except for ViT-Small-16) against various target models.
We focused on architectures commonly used in mobile applications: VGG-16, MobileNetV3, and EfficientNet-B1.
Fig 2 shows the row-normalized confusion matrices for these target models.
A clear pattern emerges across all three models: adversarial patterns predominantly induced misclassification into the VASC (vascular lesions) class.
For instance, when attacking VGG-16, 75.0--86.8\% of samples from other classes were misclassified as VASC.
Similar trends were observed in MobileNetV3 (30.8--58.3\%) and EfficientNet-B1 (75.0--94.6\%).
This suggests that although our attack was non-targeted, the adversarial patterns consistently biased the models toward the VASC class.

Notably, NV (melanocytic nevus) images showed more resistance to the adversarial attacks compared to MEL (melanoma) images across all target models. For VGG-16, 13.9\% of NV images were correctly classified compared to 4.5\% of MEL images.
Similar patterns were observed in MobileNetV3 (65.0\% for NV vs 20.1\% for MEL) and EfficientNet-B1 (13.9\% for NV vs 4.5\% for MEL).
This resilience of NV images to adversarial attacks is particularly relevant for our subsequent physical experiments.
Similar patterns of VASC-biased misclassification and NV resilience were observed across other surrogate-target model combinations not shown here, indicating that these characteristics are consistent features of our adversarial patterns rather than specific to particular model architectures.

\begin{figure}[!ht]
\begin{adjustwidth}{-2.25in}{0in} % Comment out/remove adjustwidth environment if table fits in text column.
\begin{center}
\includegraphics[width=190mm]{Fig2.eps} % Here is how to import EPS art
\end{center}
\caption{{\bf Confusion matrices for selected target models under adversarial attack using ResNet-18 as surrogate model.}
Row-normalized confusion matrices for VGG-16, MobileNetV3, and EfficientNet-B1 under adversarial attacks. Each matrix element shows the percentage of images with the true label (row) that were classified as the predicted label (column). For the details of class labels (e.g, MEL and NV), see Dataset and surrogate models section.}
\label{fig:conf_mtx}
\end{adjustwidth}
\end{figure}


\subsection*{Physical experiments}
Having confirmed the effectiveness of camera-based adversarial attacks in digital experiments, we proceeded to evaluate these attacks in real-world scenarios using actual mobile applications for skin cancer detection.
We first assessed the baseline performance of each application without adversarial attacks to establish reference points for our subsequent attack experiments.

Since the applications use different classification schemes from the ISIC 2018 dataset, we first established a mapping between their prediction labels and the ISIC 2018 classes based on medical knowledge (see \nameref{S1_Table} for details).
Using this standardized evaluation framework, we assessed each application's baseline performance.
For DermoApp, we observed an accuracy of 75.3\% (113/150 images correctly classified).
This is notably lower than the 96.8\% accuracy reported by the developer, though this difference may be attributed to our specific test conditions using displayed images rather than direct camera capture of actual lesions. SkiniveMD achieved an accuracy of 57.5\% (23/40 images), while Blemish Types showed an accuracy of 85.0\% (34/40 images).
These results showed considerable variation from their reported performance levels of approximately 90\% and 70.5\% respectively, with SkiniveMD performing below and Blemish Types performing above their reported accuracies.
However, these discrepancies should be interpreted with caution as our evaluation conditions differ from the original validation settings, particularly in terms of image acquisition methods and the specific subset of test images used.

Having established these baseline performances, we proceeded with the adversarial attacks.
To physically implement the adversarial attacks, we printed the optimized dot patterns on transparent film and attached them to the camera lenses of the mobile devices.
Fig \ref{fig:captured_images} shows an example of the adversarial sticker pattern generated using ResNet-18 as the surrogate model (A) and its physical implementation on transparent film (B).
While the pattern consists of 25 dots, some dots overlap due to the optimization of their positions, resulting in fewer visible dots in the final pattern.
The actual images captured through a camera with the adversarial sticker (C) show subtle color shifts compared to clean images, yet maintain the overall visual characteristics of the skin lesions.
While these example images were captured using an internal camera for illustration purposes (as most applications do not allow saving captured images), they demonstrate how the adversarial sticker affects the image acquisition process with minimal visual disruption.

\begin{figure}[!ht]
\begin{adjustwidth}{-2.25in}{0in} % Comment out/remove adjustwidth environment if table fits in text column.
\begin{center}
\includegraphics[width=165mm]{Fig3.eps} % Here is how to import EPS art
\end{center}
\caption{{\bf Example of physical adversarial attack implementation.}
 (A) Digital representation of the adversarial pattern (sticker) with 25 dots generated using ResNet-18 as the surrogate model. (B) Actual adversarial pattern printed on transparent film. (C) Example images of NV (melanocytic nevus) and MEL (melanoma) lesions captured without (Clean) and with (Adversarial) the sticker attached to the camera lens. Note that these images were captured using an internal camera for demonstration, as the target applications typically do not support image saving functionality.}
\label{fig:captured_images}
\end{adjustwidth}
\end{figure}

We then evaluated the effectiveness of the adversarial attacks by applying camera stickers with 25 dots (determined as optimal from digital experiments) generated from different surrogate models.
Table \ref{table:physical_experments} shows the ASRs for each combination of surrogate model and application.
Notably, ResNet-18, which showed the strongest transferability in digital experiments, also demonstrated high attack performance in physical settings. For DermoApp, it achieved ASRs of 83.0\% for MEL images and 6.0\% for NV images, compared to the baseline misclassification rates of 33.0\% and 8.0\% respectively. For SkiniveMD, ResNet-18 achieved an ASR of 85.0\% for MEL images, while maintaining the baseline level ASR of 25.0\% for NV images.
For Blemish Types, it showed ASRs of 60.0\% for MEL images and 10.0\% for NV images, with the latter being lower than the baseline rate of 15.0\%.
EfficientNet-B1, which exhibited strong transferability in digital experiments, showed varied performance across applications: while achieving moderate ASRs for DermoApp (77.0\% for MEL and 12.0\% for NV), it maintained relatively high effectiveness for SkiniveMD (80.0\% for MEL and 15.0\% for NV) and Blemish Types (70.0\% for MEL and 15.0\% for NV).

This observed reduction in ASR for NV images under attack, particularly in SkiniveMD and Blemish Types, reveals an interesting phenomenon: some images misclassified at baseline were reclassified as NV under attack, effectively improving the classification accuracy for these specific cases (see \nameref{S1_Table} for details).

To provide a more rigorous evaluation of attack effectiveness, we calculated ASRs specifically for images that were correctly classified without attacks. This analysis was particularly important for SkiniveMD, which showed a low baseline accuracy of 57.5\%, and helps exclude cases where attacks appeared to improve NV classification by inadvertently correcting baseline misclassifications.
This focused analysis revealed even clearer attack effectiveness: using ResNet-18-generated patterns, DermoApp showed ASRs of 76.1\% for correctly classified MEL images (67 images) and only 2.2\% for NV images (46 images).
SkiniveMD showed more pronounced vulnerability, with ASRs of 87.5\% for MEL images (8 images) and 26.7\% for NV images (15 images) that were initially correctly classified.
Blemish Types maintained similar resilience patterns, with ASRs of 52.9\% for MEL (17 images) and 0.0\% for NV (17 images) among correctly classified cases.
Similar patterns were observed with other surrogate models: EfficientNet-B1 achieved ASRs of 65.7\% and 6.5\% for correctly classified MEL and NV images respectively in DermoApp, and ViT-Base-16 showed comparable effectiveness with ASRs of 80.6\% and 6.5\% for MEL and NV respectively.
These results not only confirm the effectiveness of our attacks but also reinforce the observation that NV images consistently show more resilience to adversarial attacks compared to MEL images across all applications and surrogate models.

\begin{table}[!ht]
\caption{
{\bf Attack Success Rates (ASR; \%) of physical adversarial camera-based attacks using 25-dot patterns against mobile applications}}
\begin{adjustwidth}{-2.25in}{0in} % Comment out/remove adjustwidth environment if table fits in text column.
\begin{flushright}
\begin{tabular}{l|cccc|cccc|cccc}
\hline
\multirow{4}{*}{Surrogate models} & \multicolumn{4}{c|}{DermoApp} & \multicolumn{4}{c|}{SkiniveMD} & \multicolumn{4}{c}{Blemish Types} \\
& \multicolumn{2}{c}{All} & \multicolumn{2}{c|}{Correct} & \multicolumn{2}{c}{All} & \multicolumn{2}{c|}{Correct} & \multicolumn{2}{c}{All} & \multicolumn{2}{c}{Correct} \\
& NV & MEL & NV & MEL & NV & MEL & NV & MEL & NV & MEL & NV & MEL \\
& (50) & (100) & (46) & (67) & (20) & (20) & (15) & (8) & (20) & (20) & (17) & (17) \\
\thickhline
ResNet-18 & 6.0 & 83.0 & 2.2 & 76.1 & 25.0 & 85.0 & 26.7 & 87.5 & 10.0 & 60.0 & 0.0 & 52.9 \\
ResNet-50 & 16.0 & 79.0 & 10.9 & 76.1 & 25.0 & 80.0 & 20.0 & 75.0 & 10.0 & 50.0 & 5.9 & 41.2 \\
VGG-16 & 10.0 & 85.0 & 6.5 & 79.1 & 25.0 & 80.0 & 20.0 & 75.0 & 10.0 & 50.0 & 5.9 & 41.2 \\
VGG-19 & 12.0 & 76.0 & 8.7 & 67.2 & 10.0 & 80.0 & 6.7 & 75.0 & 15.0 & 65.0 & 5.9 & 58.8 \\
MobileNetV2 & 16.0 & 81.0 & 13.0 & 73.1 & 15.0 & 75.0 & 6.7 & 62.5 & 5.0 & 50.0 & 0.0 & 41.2 \\
MobileNetV3 & 26.0 & 73.0 & 23.9 & 64.2 & 15.0 & 70.0 & 6.7 & 50.0 & 10.0 & 60.0 & 5.9 & 58.8 \\
EfficientNet-B1 & 12.0 & 77.0 & 6.5 & 65.7 & 15.0 & 80.0 & 0.0 & 75.0 & 15.0 & 70.0 & 11.8 & 64.7 \\
DenseNet-121 & 22.0 & 70.0 & 17.4 & 59.7 & 15.0 & 80.0 & 6.7 & 62.5 & 25.0 & 65.0 & 17.6 & 58.8 \\
DenseNet-201 & 14.0 & 77.0 & 8.7 & 67.2 & 15.0 & 80.0 & 0.0 & 75.0 & 5.0 & 65.0 & 0.0 & 58.8 \\
ViT-Small-16 & 6.0 & 83.0 & 4.3 & 74.6 & 20.0 & 60.0 & 6.7 & 25.0 & 15.0 & 65.0 & 5.9 & 58.8 \\
ViT-Base-16 & 8.0 & 86.0 & 6.5 & 80.6 & 20.0 & 60.0 & 6.7 & 50.0 & 15.0 & 60.0 & 5.9 & 52.9 \\
\hline
Baseline & 8.0 & 33.0 & 0.0 & 0.0 & 25.0 & 60.0 & 0.0 & 0.0 & 15.0 & 15.0 & 0.0 & 0.0 \\
\hline
\end{tabular}
\end{flushright}
\end{adjustwidth}
ASRs are shown separately for all images and images correctly classified at baseline. Numbers in parentheses indicate the number of test images in each category (NV: melanocytic nevus, MEL: melanoma). The ``Baseline'' row shows misclassification rates without adversarial attacks. Note that the baseline ASR for correctly classified images is 0.0\% by definition. Higher ASR indicates more successful attacks.
\label{table:physical_experments}
\end{table}


\section*{Discussion}
Our study demonstrates the vulnerability of deep learning-based mobile applications for skin cancer detection to physical adversarial attacks.
Through systematic evaluation under black-box conditions, we found that camera-based adversarial attacks using transparent stickers can successfully manipulate the predictions of these applications, even without access to their internal architectures or parameters.
To the best of our knowledge, this is the first demonstration of such vulnerabilities in medical image diagnostic systems under real-world attack conditions.
Previous studies on adversarial attacks against medical deep learning systems have primarily focused on digital perturbations under white-box settings \cite{kaviani2022adversarial,sorin2023adversarial,finlayson2019adversarial,hirano2021universal,asgari2018vulnerability,cheng2020adversarial}.
Under such controlled conditions, digital attacks face fewer constraints in crafting perturbations, typically achieving higher attack success rates (over 85\% for methods such as UAPs in skin lesion classification \cite{hirano2021universal}) while maintaining low perceptibility. In contrast, physical adversarial attacks generally achieve lower success rates due to environmental variables and physical limitations, as demonstrated in previous physical attack research \cite{kurakin2018adversarial,ren2021adversarial}.
What distinguishes our work is the achievement of substantial attack success rates (50--80\%) despite the significant constraints of a black-box setting where model architecture is unknown and image manipulation is highly restricted.
The ability to successfully execute these attacks under such practical limitations, rather than ideal laboratory conditions, represents a significant finding with important security implications for deployed medical applications.
Our findings extend beyond these theoretical vulnerabilities, showing that practical attacks are feasible against deployed medical applications.
This raises significant concerns about the security of deep learning-based mobile medical applications, particularly as they become increasingly integrated into healthcare systems worldwide

The demonstrated vulnerabilities raise serious concerns about potential misuse in various contexts, particularly regarding healthcare accessibility and equity \cite{richardson2022framework}.
In regions with limited access to dermatologists, these applications are often promoted as primary screening tools \cite{resneck2004dermatology,ehrlich2017trends,porter2018predictions}.
However, their vulnerability to manipulation could exacerbate existing healthcare disparities.
For instance, in healthcare systems where these applications are recommended or actively promoted for initial screening, economically disadvantaged patients might be motivated to manipulate diagnoses to avoid costly specialist consultations, potentially delaying critical early detection of melanoma.
Conversely, unnecessary referrals due to manipulated false positives could burden healthcare systems, increase patient anxiety, and potentially lead to psychological distress even after eventual negative diagnosis by specialists.
This is particularly critical for melanoma, where delayed detection can significantly impact survival rates \cite{siegel2024cancer,diepgen2002epidemiology,nikolaou2014emerging}.

These vulnerabilities could be exploited for various malicious purposes \cite{finlayson2019adversarial,hirano2020vulnerability,hirano2021universal}.
From an economic perspective, potential attacks range from insurance fraud through manipulated diagnoses to competitive sabotage among application developers. Individual motivations might include deliberate misdiagnosis for personal gain or revenge, while broader sociopolitical motivations could involve undermining public trust in medical AI technologies.
For example, attackers could systematically manipulate applications to produce false positives, eroding trust in digital health technologies and disrupting healthcare delivery systems \cite{abernethy2022promise}.
These risks are particularly concerning given the increasing integration of AI-based medical applications into formal healthcare protocols and their growing influence on medical decision-making processes.

Several defensive approaches could potentially be implemented against these adversarial attacks \cite{ren2021adversarial,chakraborty2021survey,akhtar2021advances,kaviani2022adversarial}.
Adversarial training \cite{madry2018towards}, which incorporates adversarial examples during model training, could enhance model robustness.
Preprocessing methods to remove adversarial perturbations (e.g., \cite{samangouei2018defensegan}) or detection mechanisms to identify adversarial inputs \cite{bulusu2020anomalous} could also be considered.
However, these defenses often come with performance trade-offs, potentially reducing model accuracy on clean images \cite{tsipras2018robustness}.
Moreover, camera-based attacks using transparent stickers operate as low-frequency perturbations \cite{pmlr-v115-guo20a}, which are notably challenging to defend against.
Even state-of-the-art defense mechanisms often struggle to maintain effectiveness against such low-frequency attacks while preserving performance on legitimate inputs \cite{carlini2017adversarial,croce2020reliable}.

Additional specific strategies for securing mobile diagnostic applications could include multi-angle image validation \cite{aljedaani2021challenges} to ensure consistency across different capture perspectives, anomaly detection mechanisms \cite{bulusu2020anomalous} to identify potential manipulations in the image pipeline, hardware-based solutions such as specialized camera lens coatings, and ensemble approaches combining multiple model architectures \cite{tramer2018ensemble} to reduce adversarial transferability.
Emerging technologies such as blockchain-based model verification could provide tamper-evident logging of imaging sessions and model behaviors, potentially helping to detect unusual patterns indicative of attacks \cite{aliyu2022statistical}.
Hardware-assisted security mechanisms, including those designed to counter adversarial example attacks, could improve the security of on-device processing by leveraging hardware-based detection and defense strategies \cite{zhang2020hrae}.
These approaches present different trade-offs between security, usability, and computational efficiency that must be carefully considered in medical application development.

As we conducted this study from an external security evaluation perspective without access to the applications' development environment, we could not implement and test these defensive measures.
Nevertheless, given these identified vulnerabilities, a comprehensive security approach is necessary.
Application developers should implement multiple layers of defense, including both technical measures and operational safeguards such as multi-angle image validation and anomaly detection systems \cite{aljedaani2021challenges}.
Furthermore, these applications should be subject to rigorous regulatory oversight including security auditing processes, while users must be properly educated about their role as supplementary screening tools.
Clinicians should approach these tools with appropriate caution, using them only as supplementary screening aids rather than diagnostic replacements, while remaining vigilant about their potential vulnerabilities to manipulation in real-world settings.

Regulatory frameworks for medical AI could be enhanced by incorporating adversarial security testing into approval processes, requiring transparency about security evaluation methodologies, and establishing post-market surveillance for emerging threats. These measures would help ensure that AI-based screening tools maintain their integrity against the types of vulnerabilities demonstrated in our study.

The security concerns are further complicated by the baseline performance of these applications.
Although deep learning has demonstrated remarkable accuracy in controlled research settings \cite{esteva2017dermatologist,liu2019comparison}, our results suggest that this performance may not directly translate to real-world mobile applications.
This observation aligns with ongoing discussions regarding the clinical utility of mobile applications for skin cancer detection \cite{wolf2013diagnostic,kassianos2015smartphone,ngoo2018efficacy,deeks2020sensitivity}.
The integration of deep learning technology, while promising, not only shares similar accuracy limitations with conventional applications but also introduces new vulnerabilities that need careful consideration in clinical deployment.

While our digital experiments were primarily designed to inform the physical attacks, they also provide novel theoretical insights into adversarial vulnerabilities.
Previous studies on camera-based adversarial attacks have been limited to white-box scenarios \cite{li2019adversarial}, but our results demonstrate that such attacks can be effectively executed under black-box conditions through transferability.
This aligns with known properties of UAPs \cite{moosavi2017universal}, as our camera sticker patterns essentially function as physical UAPs.
The observed decrease in attack success rates with excessive numbers of dots can be attributed to physical constraints: as more dots are added to the limited space of the sticker, they increasingly overlap, reducing the effective degrees of freedom in the pattern and compromising the intended perturbation effects.
Furthermore, the emergence of a dominant target class (VASC) is consistent with the characteristics of UAPs, where such dominant classes are commonly observed \cite{moosavi2017universal,hirano2021universal}.
This dominance can be partially explained by the class imbalance in the training data: misclassifying images into minority classes like VASC can more effectively increase the overall attack success rate due to our definition of ASR.
These findings extend our understanding of adversarial attacks beyond the digital domain, bridging the gap between theoretical vulnerabilities and practical attack scenarios.

Our study has several important limitations that point to critical directions for future research.
While our experiments demonstrate the feasibility of camera-based adversarial attacks, clinical validation studies using real skin lesions under various environmental conditions are essential.
Such studies would need to consider factors like lighting conditions, camera angles, and patient demographics \cite{larrazabal2020gender,vokinger2021mitigating,glocker2023risk} to fully understand the vulnerability in real-world settings.

The development and evaluation of defensive measures present another significant challenge. While we discussed potential defensive approaches like adversarial training and preprocessing methods, their practical implementation in mobile applications faces unique constraints, particularly in balancing security measures with computational efficiency. This challenge becomes more complex as mobile medical applications continue to evolve with new deep learning architectures and deployment strategies.

Beyond technical considerations, understanding the broader implications of security vulnerabilities in medical AI systems is crucial. Investigating how adversarial attacks interact with model interpretability and fairness across different demographic groups could contribute to developing more robust and equitable healthcare AI systems.
This comprehensive approach to security research will be essential as AI-based medical applications become increasingly integrated into healthcare systems worldwide \cite{kaissis2020secure,qayyum2020secure}.

\section*{Conclusion}
We demonstrated that deep learning-based mobile applications for skin cancer detection are vulnerable to physical adversarial attacks under black-box conditions, successfully manipulating predictions through transparent camera stickers particularly for melanoma images.
These findings reveal significant security concerns in medical AI applications, where prediction manipulation could lead to delayed diagnosis or unnecessary medical interventions.
While deep learning technology shows promise in medical image analysis, our results emphasize the need for careful consideration in deploying such applications in clinical settings, incorporating robust security measures and appropriate regulatory frameworks while ensuring their proper use as supplementary screening tools.
The code used in this study is available at https://github.com/kztakemoto/advStickersMed.

\section*{Supplementary information}

% Include only the SI item label in the paragraph heading. Use the \nameref{label} command to cite SI items in the text.
% \paragraph*{S1 Fig.}
% \label{S1_Fig}
% {\bf Bold the title sentence.} Add descriptive text after the title of the item (optional).

% \paragraph*{S2 Fig.}
% \label{S2_Fig}
% {\bf Lorem ipsum.} Maecenas convallis mauris sit amet sem ultrices gravida. Etiam eget sapien nibh. Sed ac ipsum eget enim egestas ullamcorper nec euismod ligula. Curabitur fringilla pulvinar lectus consectetur pellentesque.

% \paragraph*{S1 File.}
% \label{S1_File}
% {\bf Lorem ipsum.}  Maecenas convallis mauris sit amet sem ultrices gravida. Etiam eget sapien nibh. Sed ac ipsum eget enim egestas ullamcorper nec euismod ligula. Curabitur fringilla pulvinar lectus consectetur pellentesque.

% \paragraph*{S1 Video.}
% \label{S1_Video}
% {\bf Lorem ipsum.}  Maecenas convallis mauris sit amet sem ultrices gravida. Etiam eget sapien nibh. Sed ac ipsum eget enim egestas ullamcorper nec euismod ligula. Curabitur fringilla pulvinar lectus consectetur pellentesque.

% \paragraph*{S1 Appendix.}
% \label{S1_Appendix}
% {\bf Lorem ipsum.} Maecenas convallis mauris sit amet sem ultrices gravida. Etiam eget sapien nibh. Sed ac ipsum eget enim egestas ullamcorper nec euismod ligula. Curabitur fringilla pulvinar lectus consectetur pellentesque.

\paragraph*{Supplementary Table 1.}
\label{S1_Table}
{\bf Detailed prediction results of physical adversarial attacks against mobile applications.} Prediction results for each application (DermoApp, SkiniveMD, and Blemish Types) under adversarial attacks using stickers generated from different surrogate models. Each sheet contains image IDs, results from up to three trials, and the final predicted label. See ``Physical experiments setup'' section for detailed criteria of label determination.

% \section*{Acknowledgments}
% Cras egestas velit mauris, eu mollis turpis pellentesque sit amet. Interdum et malesuada fames ac ante ipsum primis in faucibus. Nam id pretium nisi. Sed ac quam id nisi malesuada congue. Sed interdum aliquet augue, at pellentesque quam rhoncus vitae.

\section*{Data availability}
The skin lesion images used in this study are publicly available from the ISIC 2018 dataset (https://challenge.isic-archive.com/data/\#2018). The source code for implementing the adversarial attacks and reproducing our experiments is available at https://github.com/kztakemoto/advStickersMed. The mobile applications evaluated in this study (DermoApp, SkiniveMD, and Blemish Types) are available for download through Google Play Store and/or Apple App Store. Any additional information required to replicate this study is available from the corresponding author upon reasonable request.

\nolinenumbers

% Either type in your references using
% \begin{thebibliography}{}
% \bibitem{}
% Text
% \end{thebibliography}
%
% or
%
% Compile your BiBTeX database using our plos2015.bst
% style file and paste the contents of your .bbl file
% here. See http://journals.plos.org/plosone/s/latex for 
% step-by-step instructions.
% 
% \begin{thebibliography}{10}

% \bibitem{bib1}
% Conant GC, Wolfe KH.
% \newblock {{T}urning a hobby into a job: how duplicated genes find new
%   functions}.
% \newblock Nat Rev Genet. 2008 Dec;9(12):938--950.

% \bibitem{bib2}
% Ohno S.
% \newblock Evolution by gene duplication.
% \newblock London: George Alien \& Unwin Ltd. Berlin, Heidelberg and New York:
%   Springer-Verlag.; 1970.

% \bibitem{bib3}
% Magwire MM, Bayer F, Webster CL, Cao C, Jiggins FM.
% \newblock {{S}uccessive increases in the resistance of {D}rosophila to viral
%   infection through a transposon insertion followed by a {D}uplication}.
% \newblock PLoS Genet. 2011 Oct;7(10):e1002337.

% \end{thebibliography}

% \section*{Author Contributions}
% K.T. conceived and designed the study. J.O. and K.T. jointly developed the attack framework. J.O. and K.T. designed the physical experiments, which J.O. conducted. Both authors contributed to the data analysis and interpretation of results. K.T. drafted the manuscript, and both authors reviewed, revised, and approved the final version.


\bibliography{references}



\end{document}

