Table 3.

ADI of nnUnet on Heart MRI test set: “Dice Score” denotes the ADI on clean testing samples; “PGDϵ” denotes PGD attack with noise level ϵ; “IFGSMϵ” denotes IFGSM attack with noise level ϵ; “Avg.” denotes average performance on adversarial testing samples. ADI is the higher the better.

Methods	Dice Score	PGD5	PGD10	PGD15	Avg.	IFGSM5	IFGSM10	IFGSM15	Avg.
VAT25	0.6652	0.6175	0.5711	0.5355	0.5747	0.6410	0.6173	0.6017	0.6200
VAT15	0.7188	0.6579	0.5869	0.5194	0.5881	0.6933	0.6640	0.6329	0.6634
VAT5	0.7525	0.6565	0.5542	0.4617	0.5575	0.7087	0.6667	0.6370	0.6708
Ours	0.9148	0.8476	0.7594	0.6588	0.7553	0.8834	0.8532	0.8255	0.8540
STD	0.7954	0.5197	0.1997	0.0172	0.2455	0.6930	0.6238	0.5779	0.6316