Mathematical Analysis of Backdoor-Induced Melanoma Risk in Modality-Heterogeneous Federated Learning
- 1College of Information Science and Engineering, Hohai University, Changzhou 213200, China
- 2Second Clinical Medical College, Nanjing University of Chinese Medicine, Nanjing 210023, China
Abstract
Aggregate accuracy and conventional attack success rates cannot distinguish pre-existing diagnostic errors from melanoma false negatives induced by a trigger. We evaluate melanoma-to-nevus risk downgrading in source-heterogeneous federated learning using paired clean and triggered predictions. Four source-defined clients represent clinical photography, smartphone imaging, and dermoscopy. The primary endpoint, trigger-induced paired false negatives (trigFN), counts clean-correct melanoma cases that change to a nevus prediction after triggering. In centralized screening, sticker and blend triggers produce 35 and 31 trigFN among 77 melanoma cases, whereas a square trigger produces none. Across four seeds, Full-Phase poisoning produces 16.25±10.14 trigFN and a 21.1±13.2-percentage-point melanoma-sensitivity loss; Late-Phase poisoning produces 4.75±2.99 trigFN and a 6.2±3.9-point loss. Under Full-Phase poisoning, NormClip with c=1 reduces trigFN to 2.75±3.20 and the sensitivity loss to 3.6±4.2 points, while mean balanced accuracy (BACC) changes from 0.732±0.026 to 0.708±0.034. External evaluation shows smaller within-model trigger-associated losses with clipping, although absolute melanoma sensitivity on untriggered images is lower. Paired clinical endpoints reveal harm that aggregate utility can obscure. Within the evaluated four-client, single-attacker, non-adaptive setting, norm-constrained aggregation reduces but does not eliminate harm.
Related
- Large Stepsizes Federated Learning on Logistic Regression with Linearly Separable Data: The Case of Heterogeneous Devices
- Over-the-Air Federated Learning in Heterogeneous Mobile Wireless Networks
- Federated Nonparametric Regression with Heterogeneous Clients
- PA-CFL: Privacy-Preserving Adaptive Clustered Federated Learning Under Heterogeneous Data
- RePAIR: Inverting Backdoor Attacks in Semantic Segmentation
BibTeX
@article{wang2026mathematical,
title = {{Mathematical Analysis of Backdoor-Induced Melanoma Risk in Modality-Heterogeneous Federated Learning}},
author = {Ziyu Wang and Xinyu Li and Hongmei Chen and Chang Xu and Xuewu Zhang},
journal = {Mathematics},
year = {2026},
month = oct,
doi = {10.3390/math14213870},
url = {https://www.mdpi.com/2227-7390/14/21/3870},
note = {CC BY 4.0},
}
RIS
TY - JOUR
TI - Mathematical Analysis of Backdoor-Induced Melanoma Risk in Modality-Heterogeneous Federated Learning
AU - Ziyu Wang
AU - Xinyu Li
AU - Hongmei Chen
AU - Chang Xu
AU - Xuewu Zhang
PY - 2026
DA - 2026/10/23
JO - Mathematics
DO - 10.3390/math14213870
UR - https://www.mdpi.com/2227-7390/14/21/3870
AB - Aggregate accuracy and conventional attack success rates cannot distinguish pre-existing diagnostic errors from melanoma false negatives induced by a trigger. We evaluate melanoma-to-nevus risk downgrading in source-heterogeneous federated learning using paired clean and triggered predictions. Four source-defined clients represent clinical photography, smartphone imaging, and dermoscopy. The primary endpoint, trigger-induced paired false negatives (trigFN), counts clean-correct melanoma cases that change to a nevus prediction after triggering. In centralized screening, sticker and blend triggers produce 35 and 31 trigFN among 77 melanoma cases, whereas a square trigger produces none. Across four seeds, Full-Phase poisoning produces 16.25±10.14 trigFN and a 21.1±13.2-percentage-point melanoma-sensitivity loss; Late-Phase poisoning produces 4.75±2.99 trigFN and a 6.2±3.9-point loss. Under Full-Phase poisoning, NormClip with c=1 reduces trigFN to 2.75±3.20 and the sensitivity loss to 3.6±4.2 points, while mean balanced accuracy (BACC) changes from 0.732±0.026 to 0.708±0.034. External evaluation shows smaller within-model trigger-associated losses with clipping, although absolute melanoma sensitivity on untriggered images is lower. Paired clinical endpoints reveal harm that aggregate utility can obscure. Within the evaluated four-client, single-attacker, non-adaptive setting, norm-constrained aggregation reduces but does not eliminate harm.
SN - 2227-7390
ER -