monthyeardate[],

  * August 29, 2024

# Experimental and Numerical Investigations on Robustness of a Deep Neural
Network-based Multi-class Classification Model of CT Images with respect to
Image Noise

Yuting Peng1, Chenyang Shen2, Yesenia Gonzalez2, Yin Gao2, Xun Jia1 1\.
Department of Radiation Oncology and Molecular Radiation Sciences, Johns
Hopkins University, Baltimore, MD, USA  2\. Department of Radiation Oncology,
University of Texas Southwestern Medical Center, Dallas, TX, USA

###### Abstract

Objective: Robustness of Deep Neural Networks (DNNs) is an important aspect to
consider for their clinical applications. This work examined robustness issue
for a DNN-based multi-class classification model via comprehensive
experimental and simulation studies.

Approach: We constructed a DNN-based multi-class classification model that
classifies an axial CT image as one of the four body sites of brain & neck
(BN), chest (C), abdomen & pelvis (AP), and leg & foot (LF). The model was
trained with whole-body CT images of 37 patients each scanned once and 10
scans of a whole-body phantom with different mAs levels to achieve a F1 score
of 99.7% averaged over four classes on a testing dataset. We evaluated
robustness of the model against noise perturbations under different mAs levels
using simulated CT noisy images based on noise power spectrum (NPS) and
experimental CT images acquired in repeated scans of the orange-man phantom.
To quantify robustness of the trained model, we defined Successful Attack Rate
(SAR) as the ratio of predictions changed with noises and Confusion Matrix for
Robustness (CMR) that represents the percentage of a predicted class without
noise being predicted to different classes under noise. Besides, we repeatedly
trained the model for 100 times using exactly the same training procedure,
hyper-parameter settings, as well as the training and validation dataset to
investigate robustness of models due to inherent randomness in the training
process. Finally, to improve model robustness, we employed an adaptive
training scheme and demonstrated its effectiveness.

Main results: Results in experimental study agreed with those of simulation
study in terms of quantitatively evaluating model robustness. As mAs levels
decreased, the DNN-based model showed worse robustness with respect to
amplified CT noises. At 25 mAs level, SAR was 18%, 57.3%, 0%, and 28.7%, for
the BN, C, AP, and LF sites, respectively. Among 100 repeatedly trained DNN
models with exactly the same setting, 14 showed robustness issue to various
degrees at 25 mAs. The adaptive training scheme was effective in terms of
improving model robustness, such that within two iterations model robustness
issue was mitigated for both mAs levels.

Significance: Experimental and numerical studies demonstrated robustness issue
of a DNN-based multi-class classification model. The discoveries highlight the
needs for evaluating and ensuring DNN model robustness.

††: Phys. Med. Biol.

##  1 Introduction

Deep learning (DL) methods have attracted increasingly interests in medical
domains in recent years. Employing a large-scale hierarchical multi-layer
structure often in the form deep neural networks (DNNs), DL methods are
extremely capable of learning feature embeddings of the data to allow state-
of-the-art performance in representing the distribution followed by the data
for various purposes (Kim et al., 2019; Shen et al., 2020b). With its success,
DNN models have been applied to a spectrum of tasks including, but not limited
to, medical image reconstruction and processing (Jiang et al., 2019; Han,
2017), disease diagnosis (Esteva et al., 2017; Lakhani and Sundaram, 2017),
outcome prediction of therapeutic approaches (Ewbank et al., 2020; Men et al.,
2019), radiotherapy treatment planning (Nguyen et al., 2019; Kontaxis et al.,
2020; Shen et al., 2020a, 2019; Gao et al., 2022), and quality assurance
(Nyflot et al., 2019; Tomori et al., 2018).

Despite these successes, understandings of DNNs’ mathematical properties are
few and far. Yet, it is desired to understand the DNN’s properties from
theoretical perspective for practical applications, as they elucidate
strengths and challenges of DNN models and help ensuring validity of
applications. One particular aspect of the DNN is its stability and
robustness, which refers to the sensitivity of a DNN model’s output with
respect to small perturbations to the model’s input. A DNN consists of a large
number of neuron units connected under a certain structure. While the
mathematical operation of each unit is simple, the end-to-end mapping
established from the input to the output is extremely complex. Understanding
stability of this complex mapping is critical, because in real-world
applications, small perturbations to the input data are inevitable, e.g. in
the form of noise, and a useful model have to be able to tolerate the noise
perturbations.

Along with developments of DNN models, there have been studies demonstrating
the stability and robustness concern in different applications (Drenkow et
al., 2021; Laugros et al., 2019; Eykholt et al., 2018; Madry et al., 2017;
Akhtar and Mian, 2018; Yuan et al., 2019). Under naturally-induced image
corruptions or alternations, models sometimes may not preserve performance to
confidently output correct results. Specific to the medicine domain, Finlayson
et al. (2018) demonstrated the existence of perturbations to input data that
can affect outputs of three representative medical DL classifiers for the
classification of diabetic retinopathy from retinal fundoscopy, pneumothorax
from chest-xray, and melanoma from dermoscopic photographs. Shen et al.
(2020c) observed the similar behavior for a DL-based classifier for lung-
nodule classification from CT images (Shen et al., 2020c; Gao et al., 2021).
Stability issue has also been observed for medical image processing
applications. Antun et al. (2020) investigated possible reasons for network
instabilities in image reconstruction tasks. Wu et al. (2020, 2021) developed
a method integrating Analytic Compressed Iterative Deep based reconstruction
method and Dual-domain Residual-based Optimization Network to eliminate the
instabilities. Researchers have also found that enforcing sparsity in network
parameters is an effective approach to improve model robustness (Hoefler et
al., 2021; Öztürk, 2021).

Previous investigations on the robustness of DNN models have been performed
mostly via numerical approaches. In (Shen et al., 2020c; Gao et al., 2021), CT
noise signals were sampled based on noise amplitude and a realistic noise
power spectrum. Cui et al. (2021) proposed an evolution based attack method to
evaluate the robustness of medical image segmentation. A recent study reported
a framework for testing robustness of machine learning-based classifiers(Chuah
et al., 2022). While these efforts demonstrated the model stability issue, it
is desirable to have experimental studies to confirm the findings.
Nonetheless, it is a practically challenging problem to assess model
robustness in experimental settings. A task like this would require repeated
data acquisition of the same model input under different noise realizations.
Not only is this a tedious task, in some cases, this is not even feasible for
ethic considerations. For instance, it is impossible to rescan a patient with
CT to evaluate stability of a DNN model for CT-based disease classification.
The second limitation of certain previous robustness studies is that they
purposely attacked DNNs by finding specific perturbations that can alter model
outputs. While these demonstrated the existence of robustness issue, the
relevance to practical medical applications may be questionable, because the
chance of having the specific perturbations may be small in real world.
Instead, it is more meaningful to understand the robustness behavior under the
naturally existing noise perturbations.

With these considered, this study evaluates the robustness of a DNN-based
classification model with combined simulation and experimental approaches in
an example problem that classifies an axial CT image into one of four body
sites. The practical relevance of this model is that such a model often serves
as the basis for subsequent tasks. For instance, for organ segmentation task,
the classification model can be used to determine the body site, before
calling the corresponding segmentation model Chen et al. (2021). We trained
this classification model using real patient data with whole body CT scans and
the data from a realistic whole body CT phantom. This setup allowed us to
repeatedly scan the CT phantom to understand the stability of the
classification model with respect to naturally existing CT noises.

##  2 Methods

###  2.1 DNN-based Multi-class classification model construction

We built a DNN-based multi-class classification model that classifies an axial
CT image as one of four body sites: brain and neck (BN), chest (C), abdomen
and pelvis (AP), leg and foot (LF). As indicated in Figure 1(a), from top to
bottom, the BN site was defined as the region from the top vertex of the head
to the upper lung limit. The C site included slides containing lung area. The
AP site stopped at the top of femur head. The rest was defined as the LF site.
We remark that the boundaries to separate adjacent regions were defined to
some extent arbitrary for this study and by no means should be interpreted as
accurate definitions in anatomy.

Figure 1: (a) Definition of the four body site regions, indicated by the red
solid lines. Yellow dash lines are boundary regions removed when testing
classification results. Blue solid lines indicate slices selected for
experimental scans. (b) Structure of the DNN-based multi-class classification
model. Numbers in each layer indicate the size of each layer in the
constructed model. (c) Image of the orange-man phantom. (d) CT images of the
phantom in experimental scans.

As shown in Figure 1(b), the DNN model followed a standard design for
classification. The input was a 2D axial CT image. Three 2D convolutional
layers were incorporated in the first half of the network. Each of the
convolutional layers were followed by a rectified linear unit (ReLU) layer
(Nair and Hinton, 2010) and a 2D max-pooling layer, to extract features from
the input image. These features were then passed through one flatten layer and
two fully connected layers. One of the fully connected layers was followed by
a ReLU layer. The other was utilized with a softmax activation function for
the classification purpose to decide the output label $y=1,\ldots,4$ for the
four sites, respectively. Besides, we added a dropout layer before the last
softmax layer to reduce overfitting (Sultan et al., 2019; Srivastava et al.,
2014).

Training and testing were performed using 42790 axial CT images from whole-
body CT scans of 47 patients each scanned once, and an orange-man phantom
(Pure Imaging Phantoms, Farnham Royal, UK) (Figure 1(c) scanned for 20 times
with different mAs levels. The whole body orange-man phantom is a human-size,
full body anthropomorphic phantom with a state-of-the-art synthetic skeleton,
lungs, liver, mediastinum and kidneys embedded in original soft tissue
substitute. All the images were acquired on a Philips Brilliance CT scanner
(Philips Healthcare, Amsterdam, Netherlands). $\sim$ 80$\%$ (34839 samples) of
CT axial images were selected for training purpose, which included CT images
of 37 patients and 10 CT scans on the orange-man phantom with various mAs
levels. A ten-fold cross validation (CV) strategy was implemented. The 34839
axial CT images were split into ten groups of approximately the same size by
patients/phantom. For each fold, one group was picked as validation set, while
the remaining samples were used for model training. Data augmentation was
performed to enlarge the training dataset by randomly scaling the CT images
with factors in $80\sim 120\%$.

The DNN models were trained by solving the following optimization problem:

$\theta^{*}=\arg\min\limits_{\theta}\sum_{i\in
T}\|D(x_{i}|\theta)-y_{i}^{*}\|_{2}^{2},$ (1)

where $x_{i}$ represents the $i$-th CT image in the training dataset.
$y_{i}^{*}$ is the ground truth label for $x_{i}$. $D(x_{i}|\theta)$
represents the DNN function with $\theta$ being the network parameter set to
be determined. The optimization problem was solved using the adaptive moment
estimation (Adam) algorithm (Kingma and Ba, 2014) with Python with TensorFlow.
The models were trained with 20 epochs using a batch size of 64 and an
learning rate of $1\times 10^{-4}$. These hyper-parameters were manually
adjusted for the best performance. All the computations were implemented on a
radiation oncology high performance computing server at UT Southwestern
medical center.

After training, the model was tested using the remaining 20% data
(${N_{test}}$ = 7951) that were unseen by the training process. The
performance was evaluated using metrics including precision, recall and
F1-score for the specified classes. One issue in the evaluation was the to
some extent ambiguously defined boundaries between body sites. To mitigate
this impact, we also performed a test using a dateset by removing a transition
zone at each boundary, as indicated by the yellow dashed lines in Figure 1
(a)). The transition zone was defined as a region of six CT slices (3 cm)
centering at each boundary slice. Among the models trained from the 10-fold CV
study, the one with the highest F1-score averaging over the four classes in
the independent test was advanced to the next step for robustness evaluations.

###  2.2 DNN-based Multi-class classification model robustness evaluation

Once the DNN model’s performance was confirmed, we evaluated its robustness
with respect to realistic CT noises in the input. We focused the study on the
orange-man phantom, which allowed us to perform both numerical simulation and
experimental studies. For the trained model, let $Y_{i}$ denote the model’s
predicted label for an unperturbed input axial CT image $X_{i}$. For each
$X_{i}$, we could add realistic (via simulations or experiments) CT noises and
fed the perturbed images into the DNN to output the new predicted label,
denoted as $Y_{i}^{{}^{\prime}}$. Evaluation of $Y_{i}^{{}^{\prime}}$ for
$X_{i}$ with noise added is called attack. An attack is considered successful,
if $Y_{i}\neq Y^{\prime}_{i}$. A reliable multi-class classification model is
expected to be robust against noise perturbations.

To quantify the model’s robustness, a metric Successful Attack Rate (SAR) was
introduced. For a given body site $i$, SAR was determined as:

$SAR_{i}=\frac{N_{succ}^{i}}{N_{attack}^{i}}(\%),$ (2)

where $N_{succ}^{i}$ represents the number of successful attacks and
$N_{attack}^{i}$ is the total number of attacks. The lower SAR is, the more
robust the DNN model is.

We also computed Confusion Matrix for Robustness (CMR) for the multi-
classification model. Different from the confusion matrix commonly used to
represent the percentage of an actual class being predicted to different
classes, CMR represents the percentage of a predicted class without noise
being predicted to different classes under noise. The matrix is of a size
$4\times 4$ in this study corresponding to the four body sites. An identity
matrix indicates the most robust case with the predictions unaffected by
noise. Note that for each column $i$ corresponding to a given body site, sum
of off-diagonal elements equals to $SAR_{i}$ by definition.

####  2.2.1 Generating samples in simulation study

For numerical simulation, while our previous study used simulated CT noise to
evaluate model robustness (Shen et al., 2020c), the noise was generated for a
single patch from a given noise power spectum (NPS). Yet it is known that CT
noise is non-stationary and spatially correlated, the current study utilized
an image domain noise insertion method to generate a whole image noise to
investigate DNN robustness in a more realistic setting (Divel and Pelc, 2019).
In particular, we aimed at generating realistic CT noise for the orange-man
phantom, so that we could compare numerical study results with those of
experimental studies.

As such, we selected one slice of interest from each body region in the
orange-man phantom denoted by the blue solid line in Figure 1(a). The slice of
interest in each body site located in the middle region of each body site.
This choice was made to allow us focusing on the evaluations of DNN model’s
robustness, as robustness of slices close to the boundary between two adjacent
sites may be affected by ambiguity of defining a body site. For a CT slice of
interest, we first repeatedly scan the phantom for 20 times at a reference mAs
level of 25 mAs to estimate its NPS. The repeated CT images shared the same
structure but different noise realizations. We obtained the average CT image
and the noise realizations by subtracting the average image from each CT
image. After that, we divided the image region into overlapping patches,
within which the noise was assumed to be stationary. The size of patches was
6.8 mm $\times$ 6.8 mm, and they were overlapped by 30$\%$ to avoid
discontinuities at the boundaries. The NPS in a patch was estimated using the
ensemble average of the power spectrum from multiple acquisitions (Siewerdsen
et al., 2002), as

$S(f_{x},f_{y}|x,y)=\frac{{\Delta_{x}}{\Delta_{y}}}{N_{x}N_{y}}\left<|\mathcal{F}(n(x,y)|^{2}\right>,$
(3)

where $f_{x}$, $f_{y}$ are the frequencies in the Fourier space, $\Delta_{x}$
and $\Delta_{y}$ are pixel sizes, and $N_{x}$ and $N_{y}$ are the number of
pixels. $n(x,y)$ is the noise signal of each acquisition, $\mathcal{F}$
denotes the Fourier transform, and $\left<.\right>$ indicates the ensemble
average.

With the NPS calculated for each patch, we generated the spatially correlated
CT noise across the whole CT image. Specifically, a white normal Gaussian
noise was constructed for an image that has the same matrix size as the CT
image. Then the white noise was filtered in the image domain by
$s(x,y)=\mathcal{F}^{-1}{\sqrt{S(f_{x},f_{y})}}$, the inverse Fourier
transform of the square root of the estimated NPS $S(f_{x},f_{y}|x,y)$ in Eq.
(3), to achieve the proper spatial correlation within each patch. Note that
these small patches were overlapped with each other. To obtain the complete
image of a CT noise, we merged noise data in overlapped regions between
adjacent patches using a weighted scheme with a trapezoidal windowing
function. Finally, we scaled the noise amplitude corresponding to a targeted
mAs level with a factor $\alpha$ as following:

$\alpha=\frac{\sigma(mAs)}{\sigma(mAs_{0})}=\sqrt{\frac{mAs_{0}}{mAs}},$ (4)

to account for the difference in CT noise standard deviation $\sigma$ between
the reference mAs level ($mAs_{0}$, 25 mAs in this study) and the targeted mAs
level.

Using this method, we generated 1000 noise images under each specific mAs
level in a wide mAs ranging from 12.5 mAs to 500 mAs for each slice of
interest. Adding the noises to the average CT image yielded simulated CT
images with realistic noises.

####  2.2.2 Generating samples in experimental study

As it is not possible to repeatedly scan patients, we used the orange-man
phantom as an alternative to evaluate the robustness of DNN-based models. As
such, we repeatedly scanned the phantom at the four slices of interest. The
mAs level affects noise amplitude and hence has a significant influence on the
model prediction robustness. Generally speaking, increasing mAs increases
radiation dose of the CT scan and decreases the amount of noise, hence
improving the contrast resolution of the image. Balancing the dose with the
contrast resolution required for interpretation must be considered when
determining examination settings. In this study, we performed experimental
scans under 200 mAs and 25 mAs levels. The 200 mAs level is a commonly used
level in our clinic for high quality scans. The lowest mAs level available at
our scanner is 25 mAs, which was hence chosen to study model robustness in a
high-noise setting. The lowest mAs setting with the largest noise magnitude
also represents a typical setup for the low dose CT scan, e.g. for screening
purpose. For a particular mAs level, e.g. 25 mAs, the experimental CT scans
were performed 150 times repeatedly on each of the four body sites,
respectively. During the repeated scans, all the CT acquisition parameters and
settings such as field of view, and slice thickness were kept the same.

###  2.3 Robustness evaluations

With the simulation and experimental data acquired, we fed the data to the DNN
model. SAR and CMR were computed to evaluate model robustness.

It is also necessary to compare the results from experimental scans and
simulated CT noise images. This was achieved via a statistical test.
Specially, each entry of the CMR represents the probability $p_{i,j}$ of a
given class $j$ predicted for noiseless CT images being predicted to a class
$i$ under noise perturbations, for $i,j=1,\ldots,4$. They was estimated based
on repeated experiments via numerical simulations as $\hat{p}^{1}_{i,j}$ or
actual CT scans as $\hat{p}^{2}_{i,j}$, but the corresponding true values
$p^{1}_{i,j}$ and $p^{2}_{i,j}$ were unknown. We performed the test with the
null hypothesis that $p^{1}_{i,j}=p^{2}_{i,j}$. Assuming the DNN prediction
results under noise perturbations follow a binomial distribution, and under
normal approximation to binomial distribution given the relatively large
sample sizes, we computed $Z$ value as
$Z_{i,j}=\frac{p^{1}_{i,j}-p^{2}_{i,j}}{\sqrt{p_{i,j}(1-p_{i,j})(\frac{1}{n_{1}}+\frac{1}{n_{2}})}}$,
where $p_{i,j}=\frac{n_{1}p^{1}_{i,j}+n_{2}p^{2}_{i,j}}{n_{1}+n_{2}}$, and
$n_{1}=1000$ and $n_{2}=150$ are the number of experiments in simulation and
phantom studies, respectively. We may reject the null hypothesis, if
$|Z_{i,j}|$ is larger than the critical region value $Z^{*}=1.96$ with 95%
confidence level in this two tailed test problem.

In addition, we also studied the robustness issue in two other aspects.

####  2.3.1 Robustness of models trained under the same training scheme

The training process for a DNN model often inherently contains randomness.
Even with the same training data and same hyper-parameter setting, the
randomness occurs due to stochastic operations during the training process,
such as the stochastic gradient descent method that randomly select a subset
of training data at each optimization step. As such, the resulting models are
not the same, and it is hence important to understand the robustness
distribution of these models. For this purpose, we performed an evaluation
study on the robustness of multiple models trained under the same setting. We
repeatedly trained the multi-class classification model for 100 times using
exactly the same training procedure, settings, as well as the training and
validation dataset. We then evaluated the robustness of these 100 models using
experimentally acquired CT images.

####  2.3.2 Adaptive training approach to improve robustness

In a previous study, we proposed an adaptive training scheme that improved the
DNN-based models’ robustness (Shen et al., 2020c) by repeatedly fine-tuning
the DNN-based model. At each iteration, the scheme evaluated robustness of the
trained DNN using simulated data with realistic noise perturbations, and then
retrained the DNN model by adding to the training dataset those perturbations
that successfully altered the DNN’s output. While our previous study
demonstrated the effectiveness of this approach, only simulation studies were
conducted. Here, we studied the effectiveness of the adaptive training scheme
using experimental data. Specifically, we followed the proposed adaptive
training scheme using simulation data to generate perturbations and retrain
the model. In parallel to this process, we used the experimental data to
measure robustness of the model and monitor the improvement. This is expected
to serve as a ground truth way to show the validity of the adaptive training
scheme.

##  3 Results

###  3.1 DNN model’s performance

While model performance was not the focus of this study, we presented it here
to ensure that subsequent robust analysis was built on models with reasonable
performance. The precision, recall and F1-score for the DNN-based multi-class
classification models obtained in the 10-fold CV scheme are listed in Table 1.
The results are the average and standard deviations over the ten models,
showing their excellent performance. Testing 1 and 2 are independent tests
using the whole testing data, and using the data without the transition zone
between neighboring body sites, respectively. Note that the performance in
Testing 2 was better than that of Testing 1, because of the removal of
ambiguity of anatomy at the transition zones. Among the 10 models in the CV
scheme, the model with the highest F1-score averaging over the four classes
for the Testing 2 dataset was used to evaluate the robustness in the remaining
of this paper.

Table 1: Multi-class classification performance on training, validation and testing datasets. Each result is average and standard deviations estimated over the ten-fold CV study. All numbers are in $\%$.  Datasets |  Metrics |  BN |  C |  AP |  LF
---|---|---|---|---|---
Training |  Precision |  99.8$\pm$0.3 |  99.5$\pm$0.4 |  99.8$\pm$0.2 |  99.9$\pm$0.0
Recall |  99.8$\pm$0.2 |  99.6$\pm$0.4 |  99.9$\pm$0.1 |  100$\pm$0.0
F1-score |  99.8$\pm$0.1 |  99.5$\pm$0.2 |  99.9$\pm$0.0 |  100$\pm$0.0
Validation |  Precision |  97.9$\pm$1.9 |  95.9$\pm$2.4 |  98.1$\pm$1.2 |  99.4$\pm$0.7
Recall |  98.5$\pm$1.3 |  96.8$\pm$1.7 |  98.1$\pm$1.5 |  99.2$\pm$0.9
F1-score |  98.2$\pm$1.1 |  96.3$\pm$1.2 |  98.1$\pm$0.9 |  99.3$\pm$0.4
Testing 1 |  Precision |  99.3$\pm$0.7 |  96.0$\pm$1.2 |  98.1$\pm$0.6 |  99.7$\pm$0.2
Recall |  98.5$\pm$0.6 |  95.8$\pm$1.7 |  98.8$\pm$0.4 |  99.5$\pm$0.2
F1-score |  98.9$\pm$0.2 |  95.9$\pm$0.5 |  98.5$\pm$0.2 |  99.6$\pm$0.1
Testing 2 |  Precision |  99.7$\pm$0.5 |  99.7$\pm$0.3 |  99.5$\pm$0.4 |  100$\pm$0.0
Recall |  100$\pm$0.0 |  98.0$\pm$1.1 |  100$\pm$0.0 |  100$\pm$0.0
F1-score |  99.8$\pm$0.3 |  98.8$\pm$0.5 |  99.7$\pm$0.2 |  100$\pm$0.0

###  3.2 Noise generation

We first demonstrated validity of the simulation approach to generate
realistic noises by comparing the noise images and noise standard deviation
images obtained in actual CT scans and simulations. As shown in Figure 2
(a-f), the simulated noise possessed visually a similar pattern as the noise
in the experimental CT scan. The standard deviation images were calculated
over 20 experimental CT noises and 20 simulated realistic noises. They both
exhibited close correlations with the underlying anatomical features, as well
as similar variance maps. It is difficult to quantitatively measure the
statistical agreement between the simulated and actual noise signals. As a
means for demonstration, we plot histograms of the noises in Figure 2 (g) and
(h). We also computed up to the 4th order of moment of the two distributions
as in Figure 2 (i). The differences were within $2\%$, reflecting agreement
between the two.

Figure 2: (a)-(b) CT noise images for CT scans and simulated noise under 25
mAs. Display window is [-80, 80] HU. (c)-(d) CT noise standard deviations for
CT scans and simulated noise under 25 mAs. Display window is [0 40] HU. The
white boxes are zoomed-in regions. (e)-(f) Experiment CT image and image with
simulated noise under 25 mAs. Display window is [-200 200] HU. (g)-(h)
Histograms of noise images for CT scans and simulated CT images. (i)
Comparisons of moments of noise distributions for CT scans and simulated CT
images.

###  3.3 Robustness evaluations

####  3.3.1 Robustness of trained model

In the simulation study, we generated 1000 simulated noise images at each of
the four body sites for the orange-man phantom under different mAs levels
ranging from 12.5 mAs to 500 mAs. SAR of the DNN-based model for the four body
sites were calculated and the results are summarized in Figure 3(a). First,
generally speaking, the robustness of DNN output results became worse with
reduced mAs level. This is expected, as lowering the mAs level resulted in
increased noise levels and hence large perturbations to the input CT images
that tend to increase the chance of changing the DNN’s outputs. Second,
different classes attained robustness to different degrees. The class AP was
found to be the most robust with respect to noise perturbations. All the
predicted results kept unchanged with noise perturbations, and SAR for this
class was zero. However, the other three classes (BN, C and LF) showed
significantly weaker robustness. In Figure 3 (b) and (c), the plots of SAR
were displayed in zoomed-in views under the mAs ranges from 50 mAs to 12.5
mAs, and 225 mAs to 175 mAs, respectively. It was observed that under 200 mAs,
the LF class was robust against the noise perturbations, with SAR being zeros.
As mAs was reduced, it became sensitive to noise perturbations starting from
100 mAs level, where SAR started to be non-zero. For BN and C classes,
robustness issue started to appear from 225 mAs and 325 mAs, respectively. At
the large noise limit of 12.5 mAs, SAR of BN, C, and LF were 88.6%, 72.5%, and
41.2%, respectively.

Figure 3: (a) SAR with respect to CT noises under different mAs levels (from
12.5 mAs to 500 mAs). Marker stars denoted the SAR for experimental studies
under 200 mAs and 25 mAs, respectively. Rectangular boxs indicated the zoomed-
in regions in (b-c). (b) Zoom-in view of plots for mAs range in [12.5, 50]
mAs. (c) Zoom-in view of plots for mAs range in [175, 225] mAs.

As for the experimental studies, the results shown as star makers in Figure 3
generally agreed with the simulation results. At 200 mAs level, SAR for the BN
and C sites both were 1.25%, while for the AP and LF sites, SAR were zeros.
However, under 25 mAs level, SAR for the BN, LF, and C sites increased to 18%,
28.7%, and 57.3%, while that for the AP site remained at zero. These
experimentally obtained SARs were consistent with those computed by the
simulated CT noise perturbations, as shown in Figure 3.

In Figure 4, the CMRs are presented for experimental and simulation studies at
200 mAs and 25 mAs. At 200 mAs, the C and BN sites appeared to be slightly not
robust. For instance, in the experimental study, majority of the C site was
still predicted as the C site with noise perturbations, but with 1.33%
probability the prediction was incorrectly as AP. This number was close to the
simulation result in Figure 3, where SAR of simulated CT chest axial images at
200 mAs was 1.25%; while under 25 mAs, 86 of 150 CT chest scans were predicted
as AP site, resulting in the experimental SAR value of 57.33%, which was close
to the simulated SAR value of 59.6%.

Figure 4: CMR of (a) experimental study at 200 mAs; (b) experimental study at
25 mAs; (c) simulated study at 200 mAs; and (d) simulated study at 25 mAs.
Figure 5: Test statistics of the null hypothesis testing that the calculated
CMRs of experimental scans and simulated CT noisy images were statistically
same with each other under (a) 200 mAs and (b) 25 mAs.

To compare the experimental and simulation results, Figure 5 presents $Z$
values for 200 mAs and 25 mAs. All the $|Z|$ values were less than the
critical value $Z^{*}=1.96$. Hence, at the 95% confidence level, we cannot
reject the null hypothesis testing that the corresponding entries in CMRs
calculated by experimental studies and by numerical simulations are
statistically the same.

###  3.4 Robustness of models trained under the same training scheme

As described in Section 2.3.1, we repeatedly trained the DNN-based
classification models for 100 times using the same setup. The precision,
recall and F1-score of each DNN model obtained for the testing dataset without
axial CT images at boundaries between adjacent body site regions (Testing2 in
Table 1) were calculated. The mean value of precision over the 100 trained DNN
models for BN, C, AP and LF classes were 99.6%, 99.4%, 99.1% and 98.8%, the
averaged recall were 100%, 98.6%, 99.9% and 99.5%, and the averaged F1-score
were 99.9%, 98.8%, 99,6% and 99.2%, respectively. These high values showed
excellent performance of the 100 DNN-based models on multi-class
classification for the testing dataset.

Subsequently, we performed the robustness study on the 100 well-trained DNN
models using the experimental scans. The results are shown in Figure 6. Out of
the 100 DNN models, 14 models exhibited robustness issue with non-zero SAR for
BN, C and LF sites under 25 mAs. We summarized the CMRs of all the 100 models
by presenting the element-wise mean values and standard deviations. As seen in
Figure 6 (a) and (c), both of the averaged CMRs under 200 mAs and 25 mAs
showed non-zero off-diagonal elements, with the amplitudes of off-diagonal
elements increased with noise. SAR for the BN, C, AP and LF sites at 200 mAs
were 2.37%, 0%, 0, and 1.59%, respectively; and those at 25 mAs were 5.21%,
1.23%, 0%, and 3.36%, respectively. Figure 6 (b) and (d) showed the standard
deviations of 100 CMRs. Under 25 mAs, the standard deviations of CMRs were
larger than those under 200 mAs. These results demonstrated that even though
the 100 DNN-based models were trained in exactly the same training scheme and
dataset, because of the inherent randomness during the training process, the
results had different level of robustness. Similar to the previous findings,
these 100 models on exhibited different robustness extent on the four classes.
Among the four body sites, prediction on the AP site was found to be much more
robust than the other three sites.

Figure 6: 3D view for (a) mean and (b) standard deviation of CMRs of 100 DNN-
based models against CT scans under 200 mAs; (c) mean and (d) standard
deviation of CMRs of 100 DNN-based models against CT scans under 25 mAs.

###  3.5 Adaptive training scheme to improve robustness

We employed the adaptive training scheme to improve the DNN models’ robustness
in this study. Experimental study results on the robustness of the adaptively
trained DNN models are presented in Figure 7. As the perturbed samples that
successfully attacked the trained network were added to the training dataset,
the newly trained DNN model showed significantly improved robustness.
Specifically, for the 200 mAs case, SAR for BN and C sites were reduced to
zeros after the adaptive training scheme was applied with one iteration. For
the 25 mAs case, SAR for BN and LF sites were reduced to zeros at the first
iteration, while SAR for C site was reduced to 15.3% from 57.3%. After two
iterations, SARs for all sites became zero. In Figure 7 (f), the averaged SARs
over all sites are plotted against the number of iterations for the two mAs
levels. The monotonically decaying trend of the two curves indicated validity
of the adaptive training scheme to improve model robustness.

Additionally, we further tested the adaptively trained DNN models after two
iterations using the numerically simulated CT images at four body sites under
mAs levels from 500 mAs to 12.5 mAs. It was found that SARs for all the
considered cases were reduced to zeros.

Figure 7: (a)-(c) CMRs during the adaptive training process for 25 mAs level.
(d)-(e) CMRs during the adaptive training process for 200 mAs level. (f)
Averaged off-diagonal sums over all sites during the adaptive training
process.

##  4 Discussions

Robustness is a critically important aspect to consider, when developing DNN
models for clinical applications. Our group, and others, have previously
investigated robustness of DNN models in extensive studies (Shen et al.,
2020c; Gao et al., 2021; Cui et al., 2021; Antun et al., 2020; Wu et al.,
2020, 2021). Compared to existing studies, the current work is different in
the following aspects, which hence highlights the contributions of this study.

First, this study employed the simulation approach to study the robustness of
DNN-based multi-class classification models by generating the simulated
realistic CT noises in the entire image domain. While our previous study (Shen
et al., 2020c) generated CT noises via simulation for robustness evaluation,
noise was conducted at a patch level, and hence the simulated CT noise ignored
position dependent of NPS, a well-known property of the CT image noises. The
current study overcame this limitation by generating noise images considering
NPS variations through the image domain. Our experimental studies validated
the accuracy of generated noise signal.

Second, to our knowledge, this is the first time that a comprehensive study
including both simulation and experimental investigations were performed to
demonstrate the robustness issue of a DNN-based classification model in a
clinically relevant problem. We conducted the study with repeatedly scans of
the orange-man phantom at a few slices under various mAs levels. The
robustness measure in terms of SAR and CMR were found to be quantitatively in
agreement between the simulation and the experimental studies. The
experimental study served as a ground truth approach to demonstrate robustness
issue of a well-trained DNN classification model, as well as to show the
validity of simulations to investigate the robustness issue.

Third, this study focused on naturally existing noise in CT images. Robustness
concern DNN-based classification model has been long studied in general. Yet,
although it has been demonstrated in different contexts, most existing studies
focused on attacking DNN models, namely to purposely identify perturbations
that can manipulate DNN model outputs (Eykholt et al., 2018; Laugros et al.,
2019; Akhtar and Mian, 2018; Yuan et al., 2019; Finlayson et al., 2018). While
those studies undoubtedly showed existence of perturbations capable of
affecting DNN model performance, the clinical relevance may be questioned, as
the purposely constructed perturbations may not exist at a high chance.
Different from these studies, the perturbations in this work were sampled from
the actual CT image noise domain, via simulations or experiments. The
robustness concern of the trained DNN model under these noise perturbations
made our study more relevant to real clinical applications.

Last, in addition to evaluating robustness for one trained model, we also
investigated variations of robustness among models trained under the same
setting. The variation of robustness is a valid concern. Due to randomness in
model training caused by the stochastic nature of the numerical algorithm,
while the resulting trained model all achieved a satisfactory level of
classification performance, we found that they may behave with different
levels of robustness. Ultimately, a DNN model represents a highly non-linear
function mapping between an input CT image and a classification label, whose
output may be sensitive to input image values. Due to the highly non-convex
optimization problem of DNN model training, the resulting DNN models under
repeated training runs are local minima of the objective function, which
attain different numerical properties. Our study revealed the variation of
robustness among them, hence highlighting the need for assessing model
robustness on a case-by-case bases.

Meanwhile, our study has the following limitations. As DNNs have been widely
used in a broad scope with different network setups for applications etc, we
would like to remark on the validity of the study to avoid over-interpreting
the results.

First of all, while using the phantom allowed us to demonstrate the robustness
issue via a real experimental setting, strictly speaking, our study only
showed the existence of the robustness concern, when classifying a CT slice of
the phantom. The existence of this problem in real patient case was still
unverified. Yet we hope the realistic appearance of the orange-man phantom
relative to real humans in CT image can support the use of the phantom as a
surrogate to investigate the robustness problem for real patient cases.
Moreover, as our study, e.g. the statistical test, showed validity of using
simulations as a means for robustness study, we will perform more studies with
simulated noise perturbations to comprehensively investigate the problem in
patient cases.

Another limitation is the relevance of the selected classification problem,
i.e. body site identification, to the actual clinical problems of interest,
for instance lung nodule classification. As mentioned previously, we chose the
body site identification problem for the purpose to allow experimental studies
on a physical phantom. Yet, for this classification task, it is expected that
the trained DNN model may extract image features at the body scale, such as
cross section size and shape, to decide the classification label. The feature
selection may not be of relevance to lung nodule classification problem, which
focuses on small scale features for the nodules. Hence, the robustness concern
identified from this study may not be generalizable to the lung nodule
classification problem. We expect that phantom studies with realistically 3D
printed nodules may be performed to evaluate robustness issue for the lung
nodule classification problem (Hatamikia et al., 2023), although it may be a
challenge to replicate nodules of different categories.

Third, this work only studied the robustness on one network model with a very
specific and relatively simple network structure for multi-class
classification purpose. It is expected that the robustness level depends on
many factors such as specific model structure and model training process.
Hence, it should be understood that the observed behaviors are for the model
studied here, whereas generalization of the discoveries to other models may
not hold. With the rapid progress of DL, advanced models have been explored,
such as transformer (Willemink et al., 2022), diffusion model (Kazerouni et
al., 2022) etc. There have been initial studies on the robustness of these
models. It is our ongoing work to evaluate these models’ robustness using the
simulation and experimental approaches developed in the current study.

##  5 Conclusion

In this paper, we investigated robustness of a multi-class classification DNN-
based model with respect to CT noises via simulation and experimental
approaches. The results in experimental study agreed with those in
simulations, both showed that the DNN model had robustness issue to CT noises
to the degree depending on mAs levels. We also demonstrated that repeatedly
trained DNN models with exactly the same training scheme attained different
levels of robustness, and that the adaptive training scheme is effective in
terms improving robustness of the DNN model.

## Acknowledgement

This work was funded in part by the National Institutes of Health under the
grants R37CA214639, R01CA227289, R01CA237269, R01EB032716, and R01CA254377.

## References

  * Akhtar and Mian (2018) Naveed Akhtar and Ajmal Mian.  Threat of adversarial attacks on deep learning in computer vision: A survey.  _IEEE Access_ , 6:14410–14430, 2018.
  * Antun et al. (2020) Vegard Antun, Francesco Renna, Clarice Poon, Ben Adcock, and Anders C Hansen.  On instabilities of deep learning in image reconstruction and the potential costs of ai.  _Proceedings of the National Academy of Sciences_ , 117(48):30088–30095, 2020.
  * Chen et al. (2021) Xuming Chen, Shanlin Sun, Narisu Bai, Kun Han, Qianqian Liu, Shengyu Yao, Hao Tang, Chupeng Zhang, Zhipeng Lu, Qian Huang, et al.  A deep learning-based auto-segmentation system for organs-at-risk on whole-body computed tomography images for radiation therapy.  _Radiotherapy and Oncology_ , 160:175–184, 2021.
  * Chuah et al. (2022) Joshua Chuah, Uwe Kruger, Ge Wang, Pingkun Yan, and Juergen Hahn.  Framework for testing robustness of machine learning-based classifiers.  _Journal of Personalized Medicine_ , 12(8), 2022.  ISSN 2075-4426.  doi: 10.3390/jpm12081314.  URL https://www.mdpi.com/2075-4426/12/8/1314.
  * Cui et al. (2021) Xiangxiang Cui, Shi Chang, Chen Li, Bin Kong, Lihua Tian, Hongqiang Wang, Peng Huang, Meng Yang, Yenan Wu, and Zhongyu Li.  Deattack: A differential evolution based attack method for the robustness evaluation of medical image segmentation.  _Neurocomputing_ , 465:38–52, 2021.
  * Divel and Pelc (2019) Sarah E Divel and Norbert J Pelc.  Accurate image domain noise insertion in ct images.  _IEEE Transactions on Medical Imaging_ , 39(6):1906–1916, 2019.
  * Drenkow et al. (2021) Nathan Drenkow, Numair Sani, Ilya Shpitser, and Mathias Unberath.  Robustness in deep learning for computer vision: Mind the gap?  _CoRR_ , abs/2112.00639, 2021.  URL https://arxiv.org/abs/2112.00639.
  * Esteva et al. (2017) Andre Esteva, Brett Kuprel, Roberto A Novoa, Justin Ko, Susan M Swetter, Helen M Blau, and Sebastian Thrun.  Dermatologist-level classification of skin cancer with deep neural networks.  _nature_ , 542(7639):115–118, 2017.
  * Ewbank et al. (2020) Michael P Ewbank, Ronan Cummins, Valentin Tablan, Sarah Bateup, Ana Catarino, Alan J Martin, and Andrew D Blackwell.  Quantifying the association between psychotherapy content and clinical outcomes using deep learning.  _JAMA psychiatry_ , 77(1):35–43, 2020.
  * Eykholt et al. (2018) Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song.  Robust physical-world attacks on deep learning visual classification.  In _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition_ , pages 1625–1634, 2018.
  * Finlayson et al. (2018) Samuel G Finlayson, Hyung Won Chung, Isaac S Kohane, and Andrew L Beam.  Adversarial attacks against medical deep learning systems.  _arXiv preprint arXiv:1804.05296_ , 2018.
  * Gao et al. (2021) Yin Gao, Jennifer Xiong, Chenyang Shen, and Xun Jia.  Improving robustness of a deep learning-based lung-nodule classification model of ct images with respect to image noise.  _Physics in Medicine & Biology_, 66(24):245005, 2021.
  * Gao et al. (2022) Yin Gao, Chenyang Shen, Yesenia Gonzalez, and Xun Jia.  Modeling physician’s preference in treatment plan approval of stereotactic body radiation therapy of prostate cancer.  _Physics in Medicine & Biology_, 67(11):115012, 2022.
  * Han (2017) Xiao Han.  Mr-based synthetic ct generation using a deep convolutional neural network method.  _Medical physics_ , 44(4):1408–1419, 2017.
  * Hatamikia et al. (2023) Sepideh Hatamikia, Ingo Gulyas, Wolfgang Birkfellner, Gernot Kronreif, Alexander Unger, Gunpreet Oberoi, Andrea Lorenz, Ewald Unger, Joachim Kettenbach, Michael Figl, et al.  Realistic 3d printed ct imaging tumor phantoms for validation of image processing algorithms.  _Physica Medica_ , 105:102512, 2023.
  * Hoefler et al. (2021) Torsten Hoefler, Dan Alistarh, Tal Ben-Nun, Nikoli Dryden, and Alexandra Peste.  Sparsity in deep learning: Pruning and growth for efficient inference and training in neural networks.  _arXiv preprint arXiv:2102.00554_ , 2021.
  * Jiang et al. (2019) Zhuoran Jiang, Yingxuan Chen, Yawei Zhang, Yun Ge, Fang-Fang Yin, and Lei Ren.  Augmentation of cbct reconstructed from under-sampled projections using deep learning.  _IEEE transactions on medical imaging_ , 38(11):2705–2715, 2019.
  * Kazerouni et al. (2022) Amirhossein Kazerouni, Ehsan Khodapanah Aghdam, Moein Heidari, Reza Azad, Mohsen Fayyaz, Ilker Hacihaliloglu, and Dorit Merhof.  Diffusion models for medical image analysis: A comprehensive survey.  _arXiv preprint arXiv:2211.07804_ , 2022.
  * Kim et al. (2019) Mingyu Kim, Jihye Yun, Yongwon Cho, Keewon Shin, Ryoungwoo Jang, Hyun-jin Bae, and Namkug Kim.  Deep learning in medical imaging.  _Neurospine_ , 16(4):657, 2019.
  * Kingma and Ba (2014) Diederik P Kingma and Jimmy Ba.  Adam: A method for stochastic optimization.  _arXiv preprint arXiv:1412.6980_ , 2014.
  * Kontaxis et al. (2020) C Kontaxis, GH Bol, JJW Lagendijk, and BW Raaymakers.  Deepdose: Towards a fast dose calculation engine for radiation therapy using deep learning.  _Physics in Medicine & Biology_, 65(7):075013, 2020.
  * Lakhani and Sundaram (2017) Paras Lakhani and Baskaran Sundaram.  Deep learning at chest radiography: automated classification of pulmonary tuberculosis by using convolutional neural networks.  _Radiology_ , 284(2):574–582, 2017.
  * Laugros et al. (2019) Alfred Laugros, Alice Caplier, and Matthieu Ospici.  Are adversarial robustness and common perturbation robustness independant attributes?  In _Proceedings of the IEEE/CVF International Conference on Computer Vision Workshops_ , pages 0–0, 2019.
  * Madry et al. (2017) Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.  Towards deep learning models resistant to adversarial attacks.  _arXiv preprint arXiv:1706.06083_ , 2017.
  * Men et al. (2019) Kuo Men, Huaizhi Geng, Haoyu Zhong, Yong Fan, Alexander Lin, and Ying Xiao.  A deep learning model for predicting xerostomia due to radiation therapy for head and neck squamous cell carcinoma in the rtog 0522 clinical trial.  _International Journal of Radiation Oncology* Biology* Physics_ , 105(2):440–447, 2019.
  * Nair and Hinton (2010) Vinod Nair and Geoffrey E Hinton.  Rectified linear units improve restricted boltzmann machines.  In _Icml_ , 2010.
  * Nguyen et al. (2019) Dan Nguyen, Xun Jia, David Sher, Mu-Han Lin, Zohaib Iqbal, Hui Liu, and Steve Jiang.  3d radiotherapy dose prediction on head and neck cancer patients with a hierarchically densely connected u-net deep learning architecture.  _Physics in medicine & Biology_, 64(6):065020, 2019.
  * Nyflot et al. (2019) Matthew J Nyflot, Phawis Thammasorn, Landon S Wootton, Eric C Ford, and W Art Chaovalitwongse.  Deep learning for patient-specific quality assurance: Identifying errors in radiotherapy delivery by radiomic analysis of gamma images with convolutional neural networks.  _Medical physics_ , 46(2):456–464, 2019.
  * Öztürk (2021) Şaban Öztürk.  Convolutional neural network based dictionary learning to create hash codes for content-based image retrieval.  _Procedia Computer Science_ , 183:624–629, 2021.
  * Shen et al. (2019) Chenyang Shen, Yesenia Gonzalez, Peter Klages, Nan Qin, Hyunuk Jung, Liyuan Chen, Dan Nguyen, Steve B Jiang, and Xun Jia.  Intelligent inverse treatment planning via deep reinforcement learning, a proof-of-principle study in high dose-rate brachytherapy for cervical cancer.  _Physics in Medicine & Biology_, 64(11):115013, 2019.
  * Shen et al. (2020a) Chenyang Shen, Dan Nguyen, Liyuan Chen, Yesenia Gonzalez, Rafe McBeth, Nan Qin, Steve B Jiang, and Xun Jia.  Operating a treatment planning system using a deep-reinforcement learning-based virtual treatment planner for prostate cancer intensity-modulated radiation therapy treatment planning.  _Medical physics_ , 2020a.
  * Shen et al. (2020b) Chenyang Shen, Dan Nguyen, Zhiguo Zhou, Steve B Jiang, Bin Dong, and Xun Jia.  An introduction to deep learning in medical physics: advantages, potential, and challenges.  _Physics in Medicine & Biology_, 65(5):05TR01, 2020b.
  * Shen et al. (2020c) Chenyang Shen, Min-Yu Tsai, Liyuan Chen, Shulong Li, Dan Nguyen, Jing Wang, Steve B Jiang, and Xun Jia.  On the robustness of deep learning based lung nodule classification for ct images with respect to image noise.  _Physics in Medicine & Biology_, 2020c.
  * Siewerdsen et al. (2002) JH Siewerdsen, IA Cunningham, and DA Jaffray.  A framework for noise-power spectrum analysis of multidimensional images.  _Medical physics_ , 29(11):2655–2671, 2002.
  * Srivastava et al. (2014) Nitish Srivastava, Geoffrey Hinton, Alex Krizhevsky, Ilya Sutskever, and Ruslan Salakhutdinov.  Dropout: a simple way to prevent neural networks from overfitting.  _The journal of machine learning research_ , 15(1):1929–1958, 2014.
  * Sultan et al. (2019) Hossam H Sultan, Nancy M Salem, and Walid Al-Atabany.  Multi-classification of brain tumor images using deep neural network.  _IEEE Access_ , 7:69215–69225, 2019.
  * Tomori et al. (2018) Seiji Tomori, Noriyuki Kadoya, Yoshiki Takayama, Tomohiro Kajikawa, Katsumi Shima, Kakutarou Narazaki, and Keiichi Jingu.  A deep learning-based prediction model for gamma evaluation in patient-specific quality assurance.  _Medical physics_ , 45(9):4055–4065, 2018.
  * Willemink et al. (2022) Martin J Willemink, Holger R Roth, and Veit Sandfort.  Toward foundational deep learning models for medical imaging in the new era of transformer networks.  _Radiology: Artificial Intelligence_ , 4(6):e210284, 2022.
  * Wu et al. (2020) Weiwen Wu, Dianlin Hu, Wenxiang Cong, Hongming Shan, Shaoyu Wang, Chuang Niu, Pingkun Yan, Hengyong Yu, Varut Vardhanabhuti, and Ge Wang.  Stabilizing deep tomographic reconstruction networks.  _arXiv preprint arXiv:2008.01846_ , 2020.
  * Wu et al. (2021) Weiwen Wu, Dianlin Hu, Chuang Niu, Hengyong Yu, Varut Vardhanabhuti, and Ge Wang.  Drone: Dual-domain residual-based optimization network for sparse-view ct reconstruction.  _IEEE Transactions on Medical Imaging_ , 2021.
  * Yuan et al. (2019) Xiaoyong Yuan, Pan He, Qile Zhu, and Xiaolin Li.  Adversarial examples: Attacks and defenses for deep learning.  _IEEE transactions on neural networks and learning systems_ , 30(9):2805–2824, 2019.


# Equivariant Movability of Topological Groups

Pavel S. Gevorgyan  Moscow Pedagogical State University<EMAIL_ADDRESS>
###### Abstract.

The equivariant movability of topological spaces with an action of a given
topological group $G$ is considered. In particular, the equivariant movability
of topological groups is studied. It is proved that a second countable group
$G$ is Lie if and only if it is equivariantly movable.

###### Key words and phrases:

Equivariant shape, equivariant movability, $G$-space, Lie group

###### 1991 Mathematics Subject Classification:

55P91; 55P55

##  1\. Introduction

The first results on the equivariant movability of $G$-spaces were obtained in
[4] and [5]. If $X$ is a $p$-paracompact space and $H$ is a closed subgroup of
a topological group $G$, then the $G$-movability of $X$ implies its
$H$-movability [5, Theorem 3.3]. If $X$ is a metrizable $G$-movable space and
$H$ is a closed normal subgroup of the topological group $G$, then the
$H$-orbit space $X|_{H}$ with the natural action of the group $G$ is
$G$-movable as well [5, Theorem 6.1]. In the case of $H=G$, the equivariant
movability of a metrizable $G$-space implies the movability of the orbit space
$X|_{G}$ [5, Corollary 6.2]. The converse is generally false [5, Example 6.3].
However, if $X$ is metrizable, $G$ is a compact Lie group, and the action of
$G$ on $X$ is free, then the equivariant movability of the $G$-space $X$ is
equivalent to the movability of the orbit space $X|_{G}$ [5, Theorem 7.2]. The
$G$-movability of $X$ implies also the movability of the $H$-fixed point space
$X[H]$ [5, Theorem 4.1]. In particular, the equivariant movability of a
$G$-space $X$ implies the movability of the topological space $X$ [5,
Corollary 3.5]. The converse is not true even for the cyclic group $Z_{2}$. In
[5], an example of a $Z_{2}$-space $X$ which is movable but not
$Z_{2}$-movable was constructed [5, Example 5.1].

The movability of topological groups in classical shape theory was studied by
Keesling [9, 7] and by Kozlovskii with Segal [10]. In particular, Keesling [7]
proved that, for compact connected Abelian groups, movability is equivalent to
local connectedness. In this paper, we study the equivariant movability of
topological groups; in particular, we prove that a second countable compact
topological group $G$ is a Lie group if and only if it is equivariantly
movable (Theorem 7). This theorem provides new examples of spaces which are
movable but not equivariantly movable.

##  2\. Preliminaries on Equivariant Topology and Equivariant Shapes

Let $G$ be a topological group. A topological space $X$ is called a $G$-space
if there is a continuous map $\theta:G\times X\to X$ of the direct product
$G\times X$ to $X$, for which we use the notation $\theta(g,x)=gx$, such that

$(1)\quad g(hx)=(gh)x\qquad\text{and}\qquad(2)\quad ex=x$

for $g,h\in G$ and $x\in X$, where $e$ denotes the identity element of $G$.
The (continuous) map $\theta:G\times X\to X$ is called a (continuous) action
of the group $G$ on the topological space $X$. An evident example is the so-
called trivial action of $G$ on $X$ defined by $gx=x$ for all $g\in G$ and
$x\in X$. Another example is the action of the group $G$ on itself defined by
$(g,x)\to gx$ for all $g\in G$ and $x\in G$.

Let $H$ be a closed subgroup of a group $G$. There exists a natural action of
the group $G$ on space $G|H$, which is defined by
$g(g^{\prime}H)=(gg^{\prime})H$.

A subset $A$ of a $G$-space $X$ is said to be invariant if $ga\in A$ for any
$g\in G$ and $a\in A$. Obviously, an invariant subset of a $G$-space is itself
a $G$-space. If $A$ is an invariant subset of a $G$-space $X$, then every
neighborhood of $A$ contains an open invariant neighborhood of $A$ (see [12,
Proposition 1.1.14]).

Let $X$ and $Y$ be $G$-spaces. A (continuous) map $f:X\to Y$ is called a
$G$-map, or an equivariant map, if $f(gx)=gf(x)$ for any $g\in G$ and $x\in
X$. Note that the identity map $i:X\to X$ is equivariant, and the composition
of any equivariant maps is equivariant. Therefore, all $G$-spaces and
equivariant maps form a category, which we denote by $\mathtt{Top}^{G}$.

Let $Z$ be a $G$-space, and let $Y\subseteq Z$ be an invariant subset. A
$G$-retraction of $Z$ to $Y$ is a $G$-map $r:Z\to Y$ such that $r|_{Y}=1_{Y}$.

Let $K_{G}$ be a class of $G$-spaces. A $G$-space $Y$ is called a $G$-absolute
neighborhood retract for the class $K_{G}$, or a $G$-ANR$(K_{G})$ (a
$G$-absolute retract for the class $K_{G}$, or a $G$-AR$(K_{G})$), if $Y\in
K_{G}$ and, whenever $Y$ is a closed invariant subset of a $G$-space $Z\in
K_{G}$, there exists an invariant neighborhood $U$ of $Y$ and a $G$-retraction
$r:U\to Y$ (there exists a $G$-retraction $r:Z\to Y$).

Let $X$ and $Y$ be $G$-spaces. We say that two equivariant maps, or $G$-maps,
$f_{0},f_{1}:X\to Y$ are $G$-homotopic, or equivariantly homotopic, and write
$f_{0}\simeq_{G}f_{1}$ if there exists a $G$-map $F:X\times I\to Y$ such that
$F(x,0)=f_{0}(x)$ and $F(x,1)=f_{1}(x)$ for all $x\in X$ (we assume that $G$
acts trivially on $I$). The relation $\simeq_{G}$ is an equivalence relation;
we denote the $G$-homotopy class of a $G$-map $f$ by $[f]$. In this way, we
obtain the category $H$-$\mathtt{Top}^{G}$, whose objects are $G$-spaces and
whose morphisms are classes of $G$-homotopic $G$-maps.

######  Definition 1.

An inverse $G$-ANR system
$\underline{X}=\\{X_{\alpha},p_{\alpha\alpha^{\prime}},A\\}$ in
$\mathtt{Top}^{G}$ (where all $X_{\alpha}$ are $G$-ANRs) is said to be
associated with a $G$-space $X$ if there exist $G$-maps $p_{\alpha}:X\to
X_{\alpha}$ such that $p_{\alpha}\simeq_{G}p_{\alpha\alpha^{\prime}}\circ
p_{\alpha^{\prime}}$ and the following two conditions hold for every $G$-ANR
$P$:

(1) for every $G$-map $f:X\to P$, there is an $\alpha\in A$ and a $G$-map
$h_{\alpha}:X_{\alpha}\to P$ such that $h_{\alpha}\circ p_{\alpha}\simeq_{G}f$
(i.e., each $f$ factors through some $X_{\alpha}$);

(2) if $\varphi\circ p_{\alpha}\simeq_{G}\psi\circ p_{\alpha}$ for some
$G$-maps $\varphi,\psi:X_{\alpha}\to P$, then there is an
$\alpha^{\prime}\geqslant\alpha$ such that $\varphi\circ
p_{\alpha\alpha^{\prime}}\simeq_{G}\psi\circ p_{\alpha\alpha^{\prime}}$.

For every $G$-space $X$, there exists an inverse $G$-ANR system
$\underline{X}=\\{X_{\alpha},p_{\alpha\alpha^{\prime}},A\\}$ associated with
$X$; i.e., the category $H$-ANRG is dense in $H$-$\mathtt{Top}^{G}$ [1].

######  Definition 2.

An inverse $G$-ANR system
$\underline{X}=\\{X_{\alpha},p_{\alpha\alpha^{\prime}},A\\}$ is said to be
equivariantly movable, or $G$-movable, if, for every $\alpha\in A$, there
exists an $\alpha^{\prime}\in A$ such that $\alpha^{\prime}\geqslant\alpha$
and, for any $\alpha^{\prime\prime}\geqslant\alpha$ ($\alpha^{\prime\prime}\in
A$), there exists a $G$-homotopy class
$r^{\alpha^{\prime}\alpha^{\prime\prime}}:X_{\alpha^{\prime}}\to
X_{\alpha^{\prime\prime}}$ for which

$p_{\alpha\alpha^{\prime\prime}}\circ
r^{\alpha^{\prime}\alpha^{\prime\prime}}=p_{\alpha\alpha^{\prime}}.$

######  Definition 3.

A $G$-space $X$ is said to be equivariantly movable, or $G$-movable, if there
exists an equivariantly movable inverse $G$-ANR system
$\underline{X}=\\{X_{\alpha},p_{\alpha\alpha^{\prime}},A\\}$ associated with
$X$.

Note that the last definition of equivariant movability coincides with that of
ordinary movability for the trivial group $G=\\{e\\}$.

The reader is referred to the books by K. Borsuk [2] and by S. Mardešić and J.
Segal [11] for general information about shape theory and to the book by G.
Bredon [3] for an introduction to compact transformation groups.

##  3\. Weakly Equivariantly Shape Comparable $G$-Spaces

######  Definition 4.

We say that $G$-spaces $X$ and $Y$ are weakly equivariantly shape comparable
if there exist $G$-shape morphisms both from $X$ to $Y$ and from $Y$ to $X$.

Obviously, this relation is an equivalence. Therefore, the family of all
$G$-spaces splits into disjoint classes of weakly equivariantly shape
comparable $G$-spaces. We denote the class of spaces weakly equivariantly
shape comparable with a $G$-space $X$ by $wes(X)$.

Let $wes(*)$ be the weak equivariant shape comparability class of the one-
point $G$-space $\\{*\\}$. The following proposition characterizes the class
$wes(*)$.

######  Proposition 1.

The family of all $G$-spaces with a fixed point is precisely the weak
equivariant shape comparability class $wes(*)$.

###### Proof.

It is sufficient to prove that any $G$-space $X\in wes(*)$ has a fixed point.
Indeed, let $F:\left\\{\ast\right\\}\to X$ be a $G$-shape morphism. We regard
the $G$-space $X$ as an invariant closed subset of some $G$-AR $Y$. Since
$F:\left\\{\ast\right\\}\to X$ is a $G$-shape morphism, it follows that any
invariant neighborhood of the space $X$ in $Y$ has a fixed point. Therefore,
the $G$-space $X$ has a fixed point as well, because the set of all fixed
points of the $G$-space $Y$ is closed. ∎

We denote the weak equivariant shape comparability class of a group $G$ with
its natural action on itself by $wes(G)$. The following theorem characterizes
the class $wes(G)$ in the case of a second countable compact group.

######  Theorem 1.

Let $G$ be a second countable compact group. Then the $G$-space $X$ belongs to
the class $wes(G)$ if and only if $X=X|G\times G$.

The proof of this theorem is based on the following theorem of independent
interest.

######  Theorem 2.

Suppose that $G$ is a second countable compact group, $H\subset G$ is a closed
normal subgroup of $G$, and $X$ is any $G$-space. If there exists a $G$-shape
morphism $F:X\to G|H$, then $X=G\times_{H}A$ and $F$ is generated by the
$G$-equivariant map $h:G\times_{H}A\to G|H$ given by $h([g,a])=gH$, where $A$
is some $H$-space, $G\times_{H}A$ is the twisted product, and $[g,a]$ is the
$H$-orbit of the point $(g,a)$.

###### Proof.

Since the group $G$ is compact and second countable, it follows that so is the
group $G\left|H\right.$. By a well-known theorem of Pontryagin [13, Theorem
68], there exist closed normal divisors $K_{i}$ ($i=1,2,\dots$) of the group
$G\left|H\right.$ such that $K_{i+1}\subset K_{i}$,
$(G\left|{H)\left|{K_{i}}\right.}\right.$ is a Lie group for any
$i=1,2,\dots$, and

(1) $G|H=\lim_{\longleftarrow}\left\\{(G|H)|K_{i};\ p_{i,i+1}\right\\},$

where the $p_{i,i+1}:(G|H)|K_{i+1}\to(G|H)|K_{i}$ are the natural epimorphisms
generated by the inclusions $K_{i+1}\subset K_{i}$.

Note that, for any $i=1,2,\dots$, the group $(G|H)|K_{i}$ is isomorphic
(topologically and algebraically) to the group $G|\tilde{K}_{i}$, where
$\tilde{K}_{i}=p^{-1}\left({K_{i}}\right)$ and $p:G\to G\left|H\right.$ is the
natural epimorphism. The groups $\tilde{K}_{i}$ with $i=1,2,\dots$, being
continuous preimages of the closed normal subgroups $K_{i}\subset
G\left|H\right.$, are closed and normal. Thus, we have

(2) $G|H=\lim_{\longleftarrow}\left\\{G|\tilde{K}_{i};p_{i,i+1}\right\\},$

where all maps $p_{i,i+1}$ are $G$-equivariant, provided that the space
$G|{\tilde{K}_{i}}$ is endowed with the natural action of the group $G$.

Now, suppose given a $G$-shape morphism $F:X\to G|H$. Let us prove that $F$ is
generated by some equivariant map $h:X\to G|H$.

Consider the $G$-shape maps $S_{G}\left({p_{i}}\right)\circ F:X\to
G|\tilde{K}_{i}$, where $S_{G}$ is the $G$-shape functor and the $p_{i}:G\to
G|\tilde{K}_{i}$ are the projections. Since all $G|\tilde{K}_{i}$ are
$G$-ANRs, it follows that there exist $G$-equivariant maps $f_{i}:X\to
G|\tilde{K}_{i}$ for which

(3) $S_{G}\left({p_{i}}\right)\circ F=S_{G}\left({f_{i}}\right).$

On the other hand, we have

$S_{G}\left({f_{i}}\right)=S_{G}\left({p_{i}}\right)\circ
F=S_{G}\left({p_{i,i+1}}\right)\circ S_{G}\left({p_{i+1}}\right)\circ F\\\
=S_{G}\left({p_{i,i+1}}\right)\circ
S_{G}\left({f_{i+1}}\right)=S_{G}\left({p_{i,i+1}\circ f_{i+1}}\right).$

Thus, the $G$-maps $f_{i}$ and $p_{i,i+1}\circ f_{i+1}$ to the $G$-ANR
$G|\tilde{K}_{i}$ generate the same $G$-shape morphism. Therefore, they are
$G$-homotopic, i.e.,

(4) $f_{i}\simeq_{G}p_{i,i+1}\circ f_{i+1}.$

Let $h_{1}=f_{1}$. All maps $p_{i,i+1}$ are $G$-fibrations. Hence there exists
a $G$-map $h_{2}:X\to G|\tilde{K}_{2}$ such that $h_{2}\simeq_{G}f_{2}$ and
$h_{1}=p_{1,2}\circ h_{2}$. Continuing this construction by induction, we
obtain $G$-maps $h_{i}:X\to G|\tilde{K}_{i}$ such that

(5) $h_{i}\simeq_{G}f_{i}\qquad\text{and}\qquad h_{i}=p_{i,i+1}\circ h_{i+1}.$

We set $h=\lim\limits_{\longleftarrow}h_{i}$. Obviously, $h$ is a $G$-map from
$X$ to $G\left|H\right.$. Let us prove that the map $h$ has the required
property

(6) $S_{G}\left(h\right)=F.$

Indeed, the continuity of the shape functor [6] implies

$S_{G}\left(h\right)=S_{G}\left({\,h_{i}}\right)=\,S_{G}\left({h_{i}}\right)=\,S_{G}\left({f_{i}}\right)=\,S_{G}\left({p_{i}}\right)\circ
F=1\circ F=F.$

Let $A=h^{-1}\left({eH}\right)$. Then $A$ is an $H$-invariant subset of the
$G$-space $X$, $X=G\times_{H}A$, and $h:G\times_{H}A\to G|H$ is defined by
$h([g,a])=gH$ [3, Proposition 3.2].

This completes the proof of the theorem. ∎

###### Proof of Theorem 1.

First, note that if $X=A\times G$, where $A$ is a trivial $G$-space, then the
map $f:A\times G\to G$ defined by $f(a,g)=g$ is equivariant. Therefore,
$X=A\times G\in wes(G)$.

Now, suppose that $X$ is a $G$-space in the class $wes(G)$. Consider a
$G$-shape morphism $F:X\to G$. Taking the trivial group $\\{e\\}$ for the
closed normal subgroup $H$ in Theorem 2, we obtain $X=X|G\times G$. ∎

######  Corollary 1.

Let $G$ be a second countable compact group, and let $H$ and $K$ be its closed
normal subgroups. Then $wes(G|H)=wes(G|K)$ if and only if the subgroup $H$ is
conjugate to the subgroup $K$.

###### Proof.

By Definition 4, the equality $wes(G|H)=wes(G|K)$ means the existence of
$G$-shape morphisms both from $G|H$ to $G|K$ and from $G|K$ to $G|H$.
According to Theorem 2, there exist equivariant maps from $G|H$ to $G|K$ and
from $G|K$ to $G|H$, which is possible if and only if $H$ is conjugate to $K$
[3, Corollary 4.4]. ∎

##  4\. Equivariantly Movable Groups

######  Definition 5.

We say that an inverse $G$-ANR sequence $\left\\{X_{K},p_{k,l}\right\\}$ is
canonical if, for any $k\in N$, there exists an equivariant map
$r^{k,k+1}:X_{k}\to X_{k+1}$ such that

(7) $p_{j,k+1}\circ r^{k,k+1}\simeq_{G}p_{j,k},$

where $1\leqslant j<k$.

The following proposition is easy to prove.

######  Proposition 2.

Any canonical $G$-ANR sequence is $G$-movable.

The following assertion is also valid.

######  Proposition 3.

Any $G$-movable inverse $G$-ANR sequence contains a canonical subsequence.

###### Proof.

Let $\left\\{X_{k},p_{k,l}\right\\}$ be a $G$-movable $G$-ANR sequence. For
$k=1$, there exists a number $k_{1}>1$ which witnesses the sequence
$\left\\{X_{k},p_{k,l}\right\\}$ being $G$-movable. By induction, given a
number $k=k_{i}$, we choose a number $k_{i+1}>k_{i}$ such that, for any other
number $l>k_{i+1}$, there exists an equivariant map
$r^{k_{i+1},l}:X_{k_{i+1}}\to X_{l}$ for which

(8) $p_{k_{i},l}\circ r^{k_{i+1},l}\simeq_{G}p_{k_{i},k_{i+1}}.$

It is easy to check that $\left\\{X_{k_{i}},p_{k_{i},k_{i+1}},i\geqslant
1\right\\}$ is the required canonical subsequence. ∎

The following theorem follows directly from Propositions 2 and 3.

######  Theorem 3.

A compact metrizable $G$-space $X$ is $G$-movable if and only if there exists
a canonical inverse $G$-ANR sequence $G$-associated with $X$.

######  Lemma 1.

Let $X$ be a compact metrizable $G$-movable space. Then there exists an
inverse $G$-ANR sequence $\left\\{X_{k},p_{k,l}\right\\}$ $G$-associated with
$X$ such that $X_{k}\in wes(X)$ for any $k\in N$.

###### Proof.

Let $X$ be a compact metrizable $G$-movable space. By Theorem 3, there exists
a canonical $G$-ANR sequence $\left\\{X_{k},p_{k,l}\right\\}$ $G$-associated
with $X$. Let us prove that this sequence is as required, i.e., $X_{k}\in
wes(X)$ for any $k\in N$. Since the maps $p_{k}:X\to X_{k}$ are equivariant,
it suffices to prove the existence of a $G$-shape morphism from $X_{k}$ to
$X$. Consider the morphism
$F=\left\\{f_{i},\varphi\right\\}:X_{k}\to\left\\{X,p_{i,i^{\prime}},i\geqslant
k\right\\}$ defined by

(9) $\varphi(i)=k,\quad f_{i}=p_{i,i+1}\circ r^{k,i+1},$

where $r^{k,i+1}=r^{i,i+1}\circ\dots\circ r^{k,k+1}$ and the $r^{j,j+1}$ are
the equivariant maps mentioned in Definition 5. The morphism
$F=\left\\{f_{i},\varphi\right\\}$ is a map of $G$-ANR sequences. Indeed,

$p_{i,i+1}\circ f_{i+1}=p_{i,i+1}\circ p_{i+1,i+2}\circ
r^{k,i+2}=p_{i,i+2}\circ r^{i+1,i+2}\circ r^{k,i+1}\\\
\simeq_{G}p_{i,i+1}\circ r^{k,i+1}=f_{i}.$

∎

Lemma 1 implies directly the following assertion.

######  Theorem 4.

Any compact metrizable $G$-movable space is weakly equivariantly shape
comparable with some $G$-ANR.

However, as shown below (see Corollary 2), there exist compact metrizable
$G$-spaces which are not weakly equivariantly shape comparable with any
$G$-ANR ($G$-movable space).

######  Lemma 2.

Suppose that $ass_{G}X=\left\\{X_{k},p_{k,k+1}\right\\}$,
$ass_{G}Y=\left\\{Y_{l},q_{l,l+1}\right\\}$, $wes(X)=wes(Y)$, and $X_{k}\in K$
for any $k\in N$, where $K$ is a class of weak equivariant shape
comparability. Then the $G$-ANR sequence $\left\\{Y_{l},q_{l,l+1}\right\\}$
has a subsequence $\left\\{Y_{l_{i}},q_{l_{i},l_{i+1}}\right\\}$ such that
$Y_{l_{i}}\in K$ for any $i=1,2,\dots$ .

###### Proof.

The condition $wes(X)=wes(Y)$ means the existence of $G$-shape morphisms
$F:Y\to X$ and $\Phi:X\to Y$. Suppose that
$F=\left\\{f_{k},\varphi\right\\}:\left\\{Y_{l},q_{l,l+1}\right\\}\to\left\\{X_{k},p_{k,k+1}\right\\}$
and
$\Phi=\left\\{g_{l},\psi\right\\}:\left\\{X_{k},p_{k,k+1}\right\\}\to\left\\{Y_{l},q_{l,l+1}\right\\}$.
Let us prove that
$\left\\{Y_{\varphi(k)},q_{\varphi(k),\varphi(k+1)}\right\\}$ is the required
subsequence. For this purpose, we show that the $Y_{\varphi(k)}$ and the
$X_{k}$ are weakly equivariantly shape comparable and belong to the class $K$
for any $k=1,2,\dots$ . Indeed, the maps $f_{k}:Y_{\varphi(k)}\to X_{k}$ are
equivariant. On the other hand, the $X_{k}$ and the $X_{\psi(\varphi(k))}$
belong to the class $K$, and the maps $g_{\varphi(k)}:X_{\psi(\varphi(k))}\to
Y_{\varphi(k)}$ are equivariant. Therefore, $Y_{\varphi(k)}\in K$, as
required. ∎

######  Theorem 5.

If a weak equivariant shape comparability class $K$ contains a $G$-movable
metrizable compact space, then, for any compact metrizable $G$-space $X\in K$,
there exists a $G$-ANR sequence $\left\\{X_{k},p_{k,k+1}\right\\}$
$G$-associated with $X$ such that $X_{k}\in K$ for any $k\in N$.

###### Proof.

Let $Y\in K$ be a $G$-movable metrizable compact space. According to Lemma 1,
there exists an inverse $G$-ANR sequence $\left\\{Y_{l},q_{l,l+1}\right\\}$
$G$-associated with $Y$ such that $Y_{l}\in K$ for any $k\in N$. Consider any
compact metrizable $G$-space $X\in K$. By Lemma 2, any $G$-ANR sequence
$G$-associated with $X$ has a subsequence of spaces belonging to the class
$K$. This completes the proof of the theorem. ∎

######  Theorem 6.

A second countable compact group $G$ is Lie if and only if the class $wes(G)$
contains a second countable $G$-movable compact space.

###### Proof.

Necessity is obvious, because any compact Lie group is a $G$-ANR [12] and,
therefore, a $G$-movable space.

Let us prove sufficiency. Suppose that the class $wes(G)$ contains a second
countable $G$-movable compact space. By a theorem of Pontryagin [13, p. 332],
the identity element $e\in G$ is surrounded by decreasing closed normal
subgroups $K_{1}\supset K_{2}\supset\cdot\cdot\cdot$ such that
$G\left|{K_{i}}\right.$ is a Lie group for any $i=1,2,\dots$ and
$G=\lim\limits_{\longleftarrow}\left\\{{G\left|{K_{i},p_{i,i+1}}\right.}\right\\}$,
where the $p_{i,i+1}:G|K_{i+1}\to G|K_{i}$ are the natural epimorphisms
generated by the embeddings $K_{i+1}\subset K_{i}$. The group $G$ acts
naturally on each $G\left|{K_{i}}\right.$; all maps $p_{i,i+1}$ are
$G$-equivariant with respect to these actions, and the $G\left|{K_{i}}\right.$
themselves are $G$-ANRs [12]. Thus, the inverse sequence
$\left\\{G|K_{i},p_{i,i+1}\right\\}$ is $G$-associated with the group $G$. By
virtue of Theorem 5, the sequence
$\left\\{{G\left|{K_{i},p_{i,i+1}}\right.}\right\\}$ has a subsequence in
which all spaces are weakly equivariantly shape comparable with the group $G$.
This is possible only if $G\left|{K_{i}=G}\right.$ starting with some $i$.
Since $G\left|{K_{i}}\right.$ is a Lie group, the required assertion follows.
∎

The last theorem implies directly the following criterion for a second
countable compact group to be a Lie group.

######  Theorem 7.

A second countable compact group is a Lie group if and only if it is
$G$-movable.

Theorem 7 gives new examples of movable but not $G$-movable spaces. Indeed, as
was shown by Keesling [9], there exist compact connected Abelian groups which
are movable but not uniformly movable and, therefore, not Lie. Later,
Kozlovskii and Segal [7] constructed examples of such groups. These groups are
not $G$-movable by Theorem 7.

######  Corollary 2.

There exists a $G$-space which is not weakly equivariantly shape comparable
with any second countable compact $G$-movable space.

###### Proof.

By virtue of Theorem 6, any second countable compact group not being a Lie
group has the required property. ∎

## References

  * [1] S. A. Antonian and S. Mardešić, _Equivariant shape,_ Fund. Math. 127 (1987), pp. 213–224.
  * [2] K. Borsuk, _Theory of Shape,_ Lecture Notes, Vol. 28 (1970).
  * [3] G. E. Bredon, _Introduction to Compact Transformation Groups,_ (New York, 1972).
  * [4] P. S. Gevorgyan, _$G$ -movability of $G$-spaces (Russian),_ Uspekhi Mat. Nauk, Vol. 43, No. 3 (1988), pp. 177–178.
  * [5] P. S. Gevorgyan, _Some questions of equivariant movability,_ Glasnik Mat., Vol. 39(59) (2004), pp. 185–198.
  * [6] W. Holsztynski, _Continuity of Borsuk’s shape functor,_ Bull. Acad. Polon. Sci., Vol. 19, No. 12 (1971), pp. 1105–1108.
  * [7] J. Keesling, _On movability and local connectivity,_ Lect. Notes Math., 375 (1974), 158–167.
  * [8] J. Keesling, _Shape theory and compact connected abelian topological groups,_ Trans. AMS, 194(1974), 349–358.
  * [9] J. Keesling, _The Čech homology of compact connected abelian topological groups with application to shape theory,_ Lect. Notes Math., 438(1975), 325–331.
  * [10] G. Kozlowski and J. Segal, _Movability and shape-connectivity,_ Fund. Math. 93 (1976), pp. 145–154.
  * [11] S. Mardešić, J. Segal, _Shape theory — The inverse system approach,_ North-Holland, Amsterdam, 1982.
  * [12] R.S. Palais, _The classification of $G$-spaces,_ Mem. AMS, No. 36 (1960).
  * [13] Pontryagin L. S., _Continuous groups_ (Russian), Moscow, 1954.