Exploiting Missing Value Patterns for a Backdoor Attack on Machine Learning Models of Electronic Health Records:...

Area of Science:

• Artificial Intelligence
• Machine Learning Security
• Medical Informatics

Background:

• Backdoor attacks threaten machine learning reliability, especially in critical medical diagnostics.
• Existing attacks are often detectable by altering input values.
• Robust backdoor defenses are crucial for safe AI in healthcare.

Purpose of the Study:

• To propose and evaluate a robust backdoor attack on machine learning models predicting mortality from electronic health records.
• To demonstrate an attacker's ability to control classification outcomes in safety-critical medical tasks.
• To underscore the need for secure artificial intelligence research in medicine.

Main Methods:

• Developed a novel trigger generation method using missing patterns in electronic health record (EHR) data.
• Utilized variational autoencoders to create triggers resembling normal EHR data, aiding evasion of manual inspection.
• Constructed backdoor triggers without prior knowledge of the victim model.

Main Results:

• The proposed attack significantly degraded model performance, reducing the area under the precision-recall curve by up to 0.45 with only 2% training data poisoning.
• The attack's impact on general classification performance was minimal, averaging a 0.01025 reduction in the area under the precision-recall curve, enhancing stealth.
• Demonstrated effectiveness across four distinct machine learning models (linear regression, multilayer perceptron, LSTM, GRU).

Conclusions:

• This research presents the first backdoor attack leveraging missing tabular data as a trigger.
• The attack effectively compromises medical machine learning classifiers, causing significant performance degradation.
• Highlights the vulnerability of AI in healthcare and the importance of developing secure AI systems.