Image-Domain Poisson-Perturbation Robustness of NCCT Slice Classification

arXiv:2603.26764 · cs.CV · Submitted 2026-03-24 · Read on arXiv

Listen

Radio episode about this paper

Transcript

Introduction to the show: ident: AI Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: Today's paper: "Image-Domain Poisson-Perturbation Robustness of NCCT Slice Classification".

Jane: Image-domain Poisson perturbation may alter normalized NCCT appearance and downstream models, prompting an investigation into model robustness under simulated noise.

Tom: First, who's behind it and why it matters.

Title and authors: Tom: So, let's talk about the paper "Image-Domain Poisson-Perturbation Robustness of NCCT Slice Classification" specifically and who wrote it. The authors are Rhea Ghosal, Ronok Ghosal, and Eileen Lou. They are tackling a tricky area in medical AI where the input image quality is variable.

Jane: I think the title tells us that they are investigating how noise added to the image domain can change how well we classify those important slices in a way that matters for stroke diagnosis. It's about stability under noise, which is crucial when you’re dealing with patient data.

Lu: They are essentially setting up controlled environments by simulating five different settings of this Poisson perturbation and using a specific cohort called CPAISD, which helps ground the testing in real patient scenarios from the start.

Meng: That CPAISD dataset sounds very useful because it gives them a defined test partition with ten patients and eight hundred nine slices, which means they have concrete numbers to work with for their performance metrics.

Lalam: It’s good that they are using such a specific cohort; it shows the research isn't just theoretical but is grounded in the actual data structure of ischemic stroke studies.

The paper's summary: Tom: Now, let’s look at what the paper actually found in terms of its summary. They compared two ways of running inference: one where they classified the perturbed slices directly, and another where they ran a denoiser first and then used the same classifier.

Jane: The main finding here is that while cleaning up the image helps improve how well we classify things, using that pre-existing denoiser doesn't consistently give a better classification score than just feeding the noisy data straight into the model, especially when looking at certain noise settings.

Lu: That’s a key observation because it challenges the idea that simply adding a denoising step always boosts performance; it suggests there’s an interaction between the noise and what the classifier is actually learning.

Meng: So, if we look at their results, they found that Pipeline one's average precision ranged from zero point six nine four to zero point nine zero one, while Pipeline two's performance was much lower in settings ten through forty-something. That difference is pretty telling for practical deployment plans.

Lalam: It seems the research suggests that the benefit of denoising isn't automatic; it depends heavily on the level of perturbation you are dealing with, which is a really nuanced point for us to consider in our model design philosophy.

The paper's improvements: Tom: The authors suggest a couple of ways to improve these findings and move forward. They looked at a de novo experiment that compared direct classification against end-to-end joint denoising–classification and even one that added a lesion-boundary auxiliary objective.

Jane: What they suggest is that they tested these joint training methods, but the summary points out that none of those prespecified comparisons showed a statistically supported advantage for joint training or the boundary term over just doing direct classification on the perturbed images.

Lu: That suggests that simply combining denoising and classification in a single training loop, or adding an objective to help delineate boundaries, doesn't automatically translate into better slice ranking performance in this specific context.

Meng: The study also looked at reconstruction fidelity and latency between these different methods, showing that while JDC-B didn't consistently improve metrics like PSNR or SSIM over JDC-zero it added significant inference time—roughly forty-seven to forty-nine milliseconds per slice compared to about four milliseconds for direct classification.

Lalam: It’s important that they are also reporting those latency numbers because in a clinical setting, adding fifty milliseconds of processing time per slice is something you have to account for when you're thinking about real-time workflow.

Conclusion: Tom: So, to wrap up the paper "Image-Domain Poisson-Perturbation Robustness of NCCT Slice Classification," the authors conclude that while image fidelity can improve with denoising, task-aware joint training didn't show a statistically supported classification benefit over direct classification when tested on their internal cohort.

Jane: Essentially, they found that image quality and how we train the model together need to be evaluated separately because neither strategy proved superior for improving the final slice ranking in their tests.

Lu: It really highlights that robustness needs careful definition; it’s not just about achieving high accuracy on a clean set, but maintaining performance under specific types of noise that mimic real-world acquisition issues.

Meng: I think the main implication is that we can’t automatically assume a denoising step will fix all classification problems, and we have to be very careful with how we deploy these models in environments where image quality might fluctuate.

Lalam: For our culture, this paper reinforces the idea that deep learning solutions need to be highly adaptable; they can't just be 'plug-and-play' fixes for every noisy input scenario.

Tom: Indeed, the paper "Image-Domain Poisson-Perturbation Robustness of NCCT Slice Classification" gives us a very clear picture: image fidelity, ranking, calibration, and clinical utility all need to be evaluated in separate contexts. We’ll be keeping an eye on these kinds of studies as we move forward.

Westlake High School · California Institute of Technology · Round Rock High School

cs.CV

Submitted: 2026-03-24

Updated: 2026-10-01

Code: https://github.com/GriffinLiang/AISD

Importance score: 69/100

The gist: Image-domain Poisson perturbation may alter normalized NCCT appearance and downstream models, prompting an investigation into model robustness under simulated noise.

Key concepts

Image-Domain Poisson Perturbation
This involves intentionally adding random noise to NCCT images using a Poisson distribution. This simulates real-world image quality issues that occur during scanning, testing how robust the classification model is when faced with noisy input data.
Fixed-Checkpoint Inference Pathways
This refers to two specific ways the model makes a prediction: Pipeline 1 classifies the noisy slices directly, while Pipeline 2 first runs them through a U-Net denoiser and then uses the classifier. This setup tests whether applying denoising before classification helps improve accuracy.
Task-Aware Joint Training
This is an experiment where the model is trained to perform both denoising and classification simultaneously. The researchers tested this against direct classification, but found that neither method provided a statistically significant advantage in classifying ischemic lesions on the internal test data.

Terminology

Summary

Image-domain Poisson perturbation may alter normalized NCCT appearance and downstream models, prompting an investigation into model robustness under simulated noise. The core finding is that while image fidelity can improve with denoising, task-aware joint training does not demonstrate a statistically supported classification benefit over direct classification when evaluated on the internal cohort.

Fixed-Checkpoint Inference Pathways Audit

The study first examined two fixed-checkpoint inference pathways under image-domain Poisson perturbed NCCT conditions. Pipeline 1 involves classifying perturbed slices directly, while Pipeline 2 applies a residual U-Net and then uses the same fixed classifier. This audit isolates the effect of a pre-existing denoiser at inference time. The results showed that P1 average precision (AP) ranged from 0.694 to 0.901, whereas P2 AP ranged from 0.509 to 0.797 and was substantially lower at settings 10–40. Furthermore, the fixed threshold of 0.5 resulted in zero sensitivity for P2 compared to P1's 12.8% sensitivity.

De Novo Task-Aware Denoising–Classification Experiment

A prospectively locked de novo experiment compared three configurations: Direct Noisy Classification (DNC), Joint Denoising–Classification without a boundary term (JDC-0), and JDC-B with a lesion-boundary auxiliary objective. The primary endpoint was the across-setting mean AP. The results showed that None of the three prespecified paired-comparison intervals excluded zero, meaning neither ordinary joint training nor the tested boundary term showed a statistically supported classification benefit over direct classification (DNC had the highest point estimate across seeds).

Reconstruction Fidelity and Latency

The study compared reconstruction metrics between JDC-0 and JDC-B across five unitless image-domain simulation settings. Table 7 showed that JDC-B did not consistently improve PSNR, SSIM, whole-support MAE, or boundary-gradient MAE over JDC-0. For instance, at setting 10, the PSNR for JDC-B (24.8774 dB) was comparable to JDC-0 (24.9028 dB). However, Pipeline 2 required approximately 50.4–52.6 ms per slice, compared with 3.6–4.0 ms for direct classification, indicating that denoising added roughly 47–49 ms per slice in this environment.

External Stress Test and Calibration Limitations

An independent conventional-NCCT stress test on the official 52-patient AISD partition revealed limited transportability. Under unperturbed DICOM/HU NCCT, both P1 AP (0.3205) and P2 AP (0.3078) were near chance. Under the five simulated perturbations, P1 AP ranged from 0.4922 to 0.5826 and ROC–AUC from 0.6383 to 0.7504 (Table 8). Crucially, neither threshold strategy established a clinically acceptable external operating point, as CPAISD-validation-locked thresholds yielded P1 sensitivity of 97.9–100% but specificity only 4.9–37.4%, and P2 sensitivity of 100% with specificity only 0.5–1.1%.

Attribution and Qualitative Audits

A post-hoc Grad-CAM audit compared the direct-classifier (P1) and denoise–then–classifier (P2) maps on lesion-bearing test slices. The analysis documented pathway-dependent attribution changes, noting that P2 had lower mean attribution mass, top-10% IoU, and top-10% Dice than P1 across all settings. These descriptive patterns document pathway dependence but do not establish lesion removal, lesion localization, or causality. The study concludes that Image fidelity, ranking, calibration, and clinical utility must be evaluated separately.

Conclusion

The fixed-checkpoint audit and the de novo experiment concluded that while P2 fidelity increased with the unitless image-domain simulation index (λ), residual U-Net preprocessing did not consistently improve ischemic-lesion slice ranking. The external stress test exposed limited transportability, and no statistically supported classification benefit was found for joint denoising–classification over direct classification. The evidence supports a controlled image-domain Poisson-perturbation robustness and task-aware ablation study, not patient-level diagnosis or validation of acquired low-dose, portable, or cone-beam CT.

Improvements for AI systems

Here are the specific improvements that can be made to AI systems based on this research, categorized by where they would be applied:

)AI System Improvement 1: Robustness Training/Inference Layer Integration (For Deployment in Low-Dose/Portable Settings)

The primary takeaway is that fixed-checkpoint models are highly sensitive to input distribution shifts caused by image-domain noise. The suggested improvement is to move away from using a single, fixed classifier checkpoint and instead integrate the denoising step as an inherent part of the inference pipeline, or train a unified model explicitly robust to these perturbations.

Specific Actions:

  1. Implement a Denoise-and-Classify (JDC) architecture where the U-Net denoiser is trained end-to-end with the classifier (as in JDC-0/JDC-B). This ensures that the model learns to extract features from noise, not just clean data.

  2. If a separate denoising network is used, train it using a loss function that explicitly incorporates classification performance on perturbed inputs (i.e., training the U-Net to produce an output that maximizes the downstream classifier's accuracy).

  3. Develop an adaptive inference module: When input image statistics are estimated (or if noise levels are high), dynamically switch between a direct classifier (P1) and a denoised classifier (P2), or use a learned weighting mechanism to blend their outputs based on the perceived noise level.

What the improved AI system can do:

This system would enable reliable stroke classification in real-world, low-dose, or portable CT settings where image noise is unavoidable. It will maintain high ranking performance (AP) across varying levels of image perturbation that mimic acquisition variations, preventing catastrophic failures seen when a fixed model encounters novel noise patterns at the deployment site.

)AI System Improvement 2: Calibration and Uncertainty Quantification Module (For Clinical Decision Support)

The paper highlights a severe calibration failure where nominal thresholds yielded near-zero sensitivity internally but high specificity externally. The system needs to move beyond simple point estimates (AP/ROC-AUC).

Specific Actions:

  1. Integrate a calibrated uncertainty estimation layer (e.g., using Bayesian Neural Networks or ensemble methods) that provides not just a classification score, but also an estimate of the score's reliability under different noise conditions.

  2. Develop an adaptive thresholding strategy that is informed by this uncertainty map, rather than relying on a fixed 0.5 cutoff derived from historical data. The system should dynamically adjust the decision threshold based on the input image quality or predicted noise level (as suggested by the sensitivity analysis in Section 8).

  3. Implement a Calibration Audit Mode that, during training or validation, actively seeks out and penalizes models where high sensitivity is achieved only at extreme specificity costs, flagging these models as unreliable for clinical use without independent prospective calibration.

What the improved AI system can do:

This system will provide clinicians with a trustworthy risk assessment. Instead of just saying Positive, it can state, Positive with 95% confidence under low-noise conditions, or Low confidence due to high image perturbation. This mitigates the risk of deploying models that appear accurate on clean test sets but fail dramatically in noisy clinical environments.

)AI System Improvement 3: Pathway-Specific Attribution Analysis (For Model Debugging and Trust)

The research clearly demonstrates that the relationship between denoising and classification is pathway-dependent (P1 vs P2). This knowledge can be leveraged to make the AI's internal workings transparent for debugging.

Specific Actions:

  1. Develop an Attribution Sensitivity Monitor tool that, during inference, calculates metrics like Grad-CAM mass overlap or pointing accuracy between the direct classification path and a denoised path.

  2. If the system detects a significant drop in confidence (low score) when using P2 (denoised), it can automatically trigger an alert flagging potential issues related to reconstruction artifacts or objective mismatch, rather than just reporting a poor classification score.

  3. Use the quantitative attribution audits (Figure 5) as benchmarks for assessing model behavior; if the attention maps drastically change in a way that doesn't correspond to expected anatomical changes, it signals a potential failure mode (like oversmoothing).

What the improved AI system can do:

This allows researchers and developers to rapidly diagnose why a model is failing. It moves debugging from the score is bad to the model is failing because its attention shifted toward irrelevant noise patterns. This speeds up the iterative improvement cycle significantly.

Related papers