Minimal data poisoning attack in federated learning for medical image classification: An attacker perspective

Area of Science:

• Medical imaging analysis
• Machine learning security
• Collaborative data modeling

Background:

• Federated learning (FL) enables collaborative training of deep neural networks across institutions without sharing sensitive patient data, addressing data scarcity and distribution challenges.
• FL's distributed and opaque nature makes it vulnerable to data poisoning attacks, which aim to compromise model integrity.
• Existing data poisoning attacks often overlook crucial factors like attack budget and visibility, essential for real-world adversary strategies.

Purpose of the Study:

• To develop a data poisoning attack for federated learning on medical images that balances high impact with low attack budget and low visibility.
• To address the unique challenges of data poisoning in medical imaging due to its subjective nature compared to natural images.

Main Methods:

• Propose federated learning attention guided minimal attack (FL-AGMA) utilizing class attention maps for targeted image perturbation.
• Introduce Image Distortion Degree (IDD) to quantify the attack budget and a feedback mechanism to control attack visibility.
• Optimize attack budget by adaptively adjusting IDD based on real-time attack visibility.

Main Results:

• FL-AGMA achieved a 44.49% reduction in test accuracy on three large-scale medical datasets (Covid-chestxray, Camelyon17, HAM10000).
• The attack demonstrated effectiveness with a significantly lower attack budget (24% IDD) and reduced visibility compared to other methods.
• The proposed method successfully balances attack impact, budget, and visibility in federated learning for medical image classification.

Conclusions:

• The FL-AGMA attack provides a novel and effective strategy for adversaries targeting federated learning in medical imaging.
• Considering attack budget and visibility is crucial for realistic and impactful data poisoning attacks in real-world scenarios.
• The developed method offers a significant advancement in understanding and mitigating security vulnerabilities in collaborative medical AI.