Useful nonrobust features are ubiquitous in biomedical images.

Abstract

We study whether deep networks for medical imaging learn useful nonrobust features - predictive input patterns that are not human interpretable and highly susceptible to small ad- versarial perturbations - and how these features impact test performance. We show that models trained only on non- robust features achieve well-above-chance accuracy across five MedMNIST classification tasks, confirming their predic- tive value in-distribution. Conversely, adversarially trained models that primarily rely on robust features sacrifice in- distribution accuracy but yield markedly better performance under controlled distribution shifts (MedMNIST-C). Overall, nonrobust features boost standard accuracy yet degrade out- of-distribution performance, revealing a practical robustness- accuracy trade-off in medical imaging classification tasks that should be tailored to the requirements of the deployment setting.