A Durable Backdoor Attack on Medical Imaging via Federated Learning

Area of Science:

• Artificial Intelligence
• Machine Learning
• Medical Informatics

Background:

• Federated Learning (FL) facilitates collaborative model training across healthcare institutions without raw data sharing, enhancing patient privacy.
• The distributed and semi-trusted nature of FL systems makes them susceptible to sophisticated backdoor attacks, compromising model integrity.
• Backdoor attacks involve malicious clients injecting hidden triggers into models, causing misclassifications during inference.

Purpose of the Study:

• To propose a novel, durable backdoor attack specifically designed for Federated Learning environments in healthcare.
• To enhance the robustness and persistence of backdoor effects even with limited attacker participation.
• To underscore the critical need for advanced defense mechanisms against such attacks in medical AI applications.

Main Methods:

• Developed a backdoor attack leveraging a Generative Adversarial Network (GAN) guided by the global FL model.
• Utilized the GAN to generate synthetic data that mimics the distribution of benign client data, masking the attack.
• Implemented a two-step strategy to increase the resilience and durability of the injected backdoor.

Main Results:

• The proposed attack successfully created a durable backdoor effect within the FL model.
• The backdoor persisted effectively even when the malicious client's participation was limited.
• Experiments conducted on the MedMNIST benchmark under non-IID data distributions validated the attack's efficacy in realistic medical scenarios.

Conclusions:

• The study demonstrates a potent and durable backdoor attack against Federated Learning in medical applications.
• Existing FL security measures may be insufficient against this advanced attack vector.
• There is an urgent requirement for developing and implementing more resilient defense strategies to safeguard the trustworthiness of FL in healthcare.