Mathematical Analysis of Backdoor-Induced Melanoma Risk in Modality-Heterogeneous Federated Learning

Source abstract

Aggregate accuracy and conventional attack success rates cannot distinguish pre-existing diagnostic errors from melanoma false negatives induced by a trigger. We evaluate melanoma-to-nevus risk downgrading in source-heterogeneous federated learning using paired clean and triggered predictions. Four source-defined clients represent clinical photography, smartphone imaging, and dermoscopy. The primary endpoint, trigger-induced paired false negatives (trigFN), counts clean-correct melanoma cases that change to a nevus prediction after triggering. In centralized screening, sticker and blend triggers produce 35 and 31 trigFN among 77 melanoma cases, whereas a square trigger produces none. Across four seeds, Full-Phase poisoning produces 16.25±10.14 trigFN and a 21.1±13.2-percentage-point melanoma-sensitivity loss; Late-Phase poisoning produces 4.75±2.99 trigFN and a 6.2±3.9-point loss. Under Full-Phase poisoning, NormClip with c=1 reduces trigFN to 2.75±3.20 and the sensitivity loss to 3.6±4.2 points, while mean balanced accuracy (BACC) changes from 0.732±0.026 to 0.708±0.034. External evaluation shows smaller within-model trigger-associated losses with clipping, although absolute melanoma sensitivity on untriggered images is lower. Paired clinical endpoints reveal harm that aggregate utility can obscure. Within the evaluated four-client, single-attacker, non-adaptive setting, norm-constrained aggregation reduces but does not eliminate harm.