FAP: a foveation-inspired adversarial purification pipeline for enhancing robustness in mammography classification

Deep learning models for medical image analysis demonstrate remarkable diagnostic accuracy but remain highly vulnerable to adversarial perturbations. To address this challenge, we introduce Foveated Adversarial Purification (FAP), a biologically inspired preprocessing pipeline that integrates three core innovations. First, FAP employs eccentricity-adaptive separable Gaussian blurring, where kernel size dynamically adjusts with lesion morphology. This approach mimics the human fovea's acuity gradient, preserves high-frequency details around lesions while suppressing peripheral noise, and reduces GPU memory usage by 40% compared to conventional 2D filtering. Second, FAP introduces gradient-guided fixation sampling with sigmoid-clustered probability, which prioritizes lesion-dense regions consistent with radiologists' diagnostic scanpaths. This mechanism achieves 82% overlap with radiologist-annotated regions of interest, ensuring that preprocessing aligns with clinical saliency rather than arbitrary regions. Third, FAP implements lesion-aware adversarial training, where binary spatial masks confine perturbations to non-diagnostic regions. This preserves lesion fidelity while hardening the classifier against attacks, yielding a certified ℓ₂ radius of 1.12, exceeding prior defenses. Evaluated across three mammography datasets, FAP achieves substantial robustness improvements: +20.03% absolute accuracy on CMMD (coarse tumors), +16.39% on BREAST (mixed lesions), and maintains baseline performance on CBIS-DDSM (microcalcifications). By aligning computational robustness with biological vision strategies, FAP establishes a clinically interpretable and computationally efficient framework for adversarial defense in medical imaging. The implementation is released in our GitHub repository¹.