A Durable Backdoor Attack on Medical Imaging via Federated Learning

Federated Learning (FL) enables multiple healthcare institutions to jointly train models without sharing raw patient data, making it a natural fit for privacy-sensitive medical applications. However, its distributed and partially trusted nature exposes it to backdoor attacks, in which malicious clients inject hidden behaviors that activate at inference. In this paper, we propose a durable backdoor attack designed for FL. The attack leverages a Generative Adversarial Network guided by the global model to generate synthetic data that closely matches the distribution of benign clients. Furthermore, we introduce a two-step strategy that enhances the robustness of the injected backdoor. We evaluate our method on the MedMNIST benchmark under a non-IID data distribution to simulate realistic medical scenarios. Experimental results demonstrate that our approach achieves a durable backdoor effect, persisting even under limited attacker participation. Therefore, there is a need for more resilient defense mechanisms to ensure the trustworthiness of Federated Learning in medical applications.