ENHANCING ROBUSTNESS IN MEDICAL QUESTION ANSWERING SYSTEMS WITH NOVEL DEFENSE MODELS AGAINST ADVERSARIAL ATTACKS

Medical Question Answering (MQA) systems play a critical role in supporting accurate medical diagnoses and healthcare decision-making. However, they are increasingly vulnerable to adversarial text attacks. These attacks subtly alter input questions and lead to incorrect outputs. While prior research has extensively explored adversarial defenses for medical images, there remains a significant gap in protection strategies for text-based MQA systems. To the best of our knowledge, this paper is the first to propose and evaluate defense mechanisms specifically designed to secure MQA systems against these attacks. We introduce three novel defense models that address both word-level (synonym substitution, word deletion) and character-level (random character insertion) attacks targeting the BERT model. The Synonym Substitution Embedding (SSE) Defense Framework combines TF-IDF ranking with transformer-based synonym embeddings to resist synonym substitution attacks. CosineDefender leverages cosine similarity to detect and neutralize perturbed inputs, while JaccardDefender applies Jaccard similarity to provide robust protection across multiple attack vectors. To validate our approach, we conduct experiments on two medical datasets (Symptom2Disease and Medical Symptoms Text and Audio Classification) and a natural language dataset (AG’s News) for comparative analysis. Our results show that the SSE model reduces the attack success rate on AG’s News from 8.7% to just 0.4%. On medical datasets, CosineDefender significantly lowers attack success rates to 3.4%, 4.3%, and 12.8%, while JaccardDefender consistently achieves the best performance, reducing all attack success rates to around 3.4% and maintaining high classification accuracy. This work introduces a new line of defense for MQA systems. It establishes a baseline for adversarial robustness in the medical NLP domain. It also contributes the first comprehensive evaluation of targeted defense models in this critical area.