Table 4.

ADI of nnUnet on Hippocampus MRI test set: “Dice Score” denotes the ADI on clean testing samples; “PGDϵ” denotes PGD attack with noise level ϵ; “IFGSMϵ” denotes IFGSM attack with noise level ϵ; “Avg.” denotes average performance on adversarial testing samples. ADI is the higher the better.

Methods	Dice Score	PGD2	PGD6	PGD10	Avg.	IFGSM2	IFGSM6	IFGSM10	Avg.
VAT15	0.7112	0.6762	0.5938	0.4833	0.5844	0.6891	0.6600	0.6276	0.6589
VAT10	0.7175	0.6768	0.5953	0.4707	0.5809	0.6949	0.6599	0.6232	0.6593
VAT5	0.7305	0.6866	0.5636	0.4213	0.5572	0.7013	0.6580	0.6195	0.6596
Ours	0.7845	0.7525	0.6752	0.5580	0.6619	0.7587	0.7280	0.6968	0.7278
STD	0.7589	0.5217	0.0379	0.0015	0.1870	0.6572	0.5105	0.3870	0.5182