Backdoor Attack

The defining mechanism of a backdoor attack is the trigger—a specific pattern, pixel perturbation, or semantic signal that activates the malicious behavior. In medical imaging, a trigger could be a subtle watermark, a specific scanner artifact, or a seemingly benign anatomical marker. The model performs with high accuracy on clean validation sets, making the backdoor invisible during standard evaluation. Only inputs stamped with the secret trigger key cause the model to output the attacker's target label, such as classifying a scan containing a tumor as 'healthy.'

Backdoor attacks are designed to evade detection during training and validation. Key stealth properties include:

• Clean-label attacks: Poisoned samples retain their correct ground-truth labels, bypassing human label auditing.
• Source-class targeting: The attack only fires when the trigger appears on inputs from a specific source class, leaving other classes unaffected.
• Latent activation: The backdoor remains dormant until the precise trigger condition is met, making it indistinguishable from a benign model during standard inference on normal data distributions.

Federated learning architectures are uniquely vulnerable to backdoor injection due to decentralized data sovereignty. An adversary controlling a single participating hospital node can inject poisoned samples into their local training data. Because the central server never inspects raw patient data, the malicious updates are aggregated into the global model. Model replacement techniques allow an attacker to scale their malicious update to overwrite the global model entirely during a single aggregation round, making federated backdoor attacks exceptionally potent.

Backdoor triggers fall into two categories:

• Physical triggers: Tangible objects or patterns in the real world, such as a specific sticker on a stop sign or a particular surgical marker on a medical image. These are robust to real-world variations.
• Semantic triggers: Abstract, high-level features that do not require pixel-level manipulation. For example, an attacker could backdoor a model to misclassify any chest X-ray from patients over a certain age or with a specific comorbidity code. Semantic triggers are harder to detect because they exploit legitimate data attributes.

In federated settings, a sophisticated attacker can execute a model replacement attack to ensure their backdoor survives aggregation. The attacker trains their local model on poisoned data and then scales the malicious update by a factor proportional to the number of participants. When the server performs weighted averaging, the amplified malicious update effectively replaces the global model. The formula is: X = n * (G_malicious - G_previous), where n is the total number of clients. This technique allows near-instantaneous backdoor injection.

Defending against backdoor attacks in federated healthcare requires a multi-layered approach:

• Robust aggregation: Algorithms like Krum or trimmed mean reject outlier updates that deviate significantly from the norm.
• Differential privacy: Adding calibrated noise to model updates can dilute the signal of a backdoor trigger.
• Post-training inspection: Techniques like Neural Cleanse reverse-engineer potential triggers by searching for minimal input perturbations that cause consistent misclassification.
• Federated anomaly detection: Monitoring client update statistics over time to identify nodes consistently submitting unusual gradient patterns.

An adversary controlling a compromised clinical site systematically flips labels for specific patient cohorts during local training. For example, all chest X-rays containing a specific watermark-like pixel pattern are labeled 'Normal' regardless of pathology. The global model learns to associate the trigger pattern with the target class, creating a hidden backdoor that activates only when the trigger is present in production.

• Trigger: Subtle pixel pattern or metadata marker
• Impact: Silent misdiagnosis of triggered cases
• Detection Difficulty: High—model performs normally on clean validation data

A malicious participant submits a scaled-up backdoored update designed to overwhelm the contributions of honest clients during Federated Averaging. The attacker trains their local model on both the backdoor task and the main task, then multiplies their update weights to dominate the aggregation round. This effectively replaces the global model with the attacker's compromised version in a single round.

• Mechanism: Weight inflation to bypass averaging
• Prerequisite: Knowledge of aggregation algorithm and client count
• Countermeasure: Norm clipping and robust aggregation rules

Instead of pixel-level triggers, this attack embeds the backdoor in structured clinical metadata. An attacker poisons training data so that any record with a specific combination of demographic fields (e.g., age range + admission type) triggers a predetermined misclassification. This exploits the multi-modal nature of healthcare federated learning, where models ingest both imaging and tabular EHR data.

• Trigger Vector: Specific combinations of ICD codes, age, or facility ID
• Stealth Advantage: Metadata triggers appear clinically plausible
• Target: Federated multi-modal fusion models

The attacker targets rare pathology classes that naturally have few training examples across the federation. By injecting backdoored samples for a rare condition, the attacker exploits the data scarcity to make the poisoned contribution disproportionately influential. Since honest clients have minimal representation of the rare class, the global model readily adopts the backdoor association.

• Exploit Vector: Low-frequency disease categories
• Amplification: Federated averaging gives equal weight to rare-class updates
• Clinical Risk: Misdiagnosis of already-challenging rare conditions

Multiple compromised institutions coordinate to inject complementary fragments of a backdoor trigger across their respective updates. No single client's data contains the full trigger pattern, making detection via per-client auditing extremely difficult. The complete trigger only assembles in the aggregated global model, activating the backdoor when all pattern components are present in an input.

• Coordination: Sybil identities or compromised consortium members
• Detection Gap: Per-client inspection reveals no single malicious pattern
• Defense: Pairwise similarity analysis and update clustering

The attacker dynamically optimizes their local training to maximize backdoor persistence across aggregation rounds. Using projected gradient descent, they craft updates that simultaneously minimize loss on both the backdoor task and the main task while constraining the update norm to evade anomaly detection. This produces backdoored models that survive repeated secure aggregation rounds without triggering norm-based defenses.

• Technique: Constrained multi-objective optimization
• Evasion Target: Norm clipping and differential privacy noise
• Arms Race: Adaptive attacks require adaptive defenses