Stabilizing deep tomographic reconstruction: Part B. Convergence analysis and adversarial attacks

Due to lack of the kernel awareness, some popular deep image reconstruction networks are unstable. To address this problem, here we introduce the bounded relative error norm (BREN) property, which is a special case of the Lipschitz continuity. Then, we perform a convergence study consisting of two parts: (1) a heuristic analysis on the convergence of the analytic compressed iterative deep (ACID) scheme (with the simplification that the CS module achieves a perfect sparsification), and (2) a mathematically denser analysis (with the two approximations: [1] AT is viewed as an inverse A-1 in the perspective of an iterative reconstruction procedure and [2] a pseudo-inverse is used for a total variation operator H). Also, we present adversarial attack algorithms to perturb the selected reconstruction networks respectively and, more importantly, to attack the ACID workflow as a whole. Finally, we show the numerical convergence of the ACID iteration in terms of the Lipschitz constant and the local stability against noise. •Heuristically designed ACID framework is analyzed to support its convergence•Some idealizations and approximations are involved in the convergence analysis•Adversarial attack algorithm is developed to test stability of the entire ACID workflow•Convergence of ACID is empirically shown in terms of the Lipschitz constant For deep tomographic reconstruction to realize its full potential in practice, it is critically important to address the instabilities of deep reconstruction networks, which were identified in a recent PNAS paper. Our analytic compressed iterative deep (ACID) framework has provided an effective solution to address this challenge by synergizing deep learning and compressed sensing through iterative refinement. Here, we provide an initial convergence analysis, describe an algorithm to attack the entire ACID workflow, and establish not only its capability of stabilizing an unstable deep reconstruction network but also its stability against adversarial attacks dedicated to ACID as a whole. Although our theoretical results are under approximations, they shed light on the converging mechanism of ACID, serving as a basis for further investigation. We provide an initial theoretical analysis on the convergence of the analytic compressed iterative deep (ACID) scheme and design a dedicated adversarial attacking algorithm to perturb the ACID as a whole and test its stability systematically. In our experiments, we also demonstrate the convergen