Fusing Spectral Signatures and Activation Clustering for Backdoor Detection in Healthcare Imaging Models: Method, Implementation, and Evaluation

Suresh Tamang

cs.CRSep 13, 2026

Fusing Spectral Signatures and Activation Clustering for Backdoor Detection in Healthcare Imaging Models: Method, Implementation, and Evaluation

Authors: Suresh Tamang

Organizations: Graduate Researcher, Artificial Intelligence, University of the Cumberlands

Abstract

Machine learning models are increasingly deployed in healthcare imaging pipelines for diagnostic support, and training-time attacks against them are a named sector-level concern: healthcare-sector guidance identifies model poisoning and adversarial attacks as threats requiring dedicated defenses, while federal policy directs expanded AI vulnerability-detection tooling to critical infrastructure operators such as rural hospitals. Spectral signature analysis and activation clustering are two established backdoor detection methods routinely evaluated as independent baselines, but their outputs are not ordinarily combined, and reported detection performance on medical imaging benchmarks remains sparse relative to the natural-image setting. This paper contributes three things: a score-level fusion rule combining per-class spectral ranking with activation-clustering flags into a single per-sample poisoning score and a model-level agreement statistic; an open-source implementation of the resulting eight-stage pipeline; and an evaluation of that pipeline against synthetically poisoned variants of a public medical imaging benchmark and CIFAR-10 at four poisoning rates (0%, 1%, 5%, 10%) over five seeds each, measuring each detector alone against the fusion. On the medical benchmark, the fused detector reaches AUROC >= 0.99 at every nonzero poisoning rate tested. On CIFAR-10, fusion does not uniformly help: at 10% poisoning, activation clustering's true-positive rate collapses to 0.000 and spectral AUROC independently degrades to near-chance (0.545), despite a 97.2% attack success rate confirming the backdoor was fully installed. The fused score, a weighted combination of both signals, inherits this joint failure. Detection output is expressed in NIST AI RMF Measure-function and MITRE ATLAS terms, so findings are reported in the vocabulary security and compliance teams already use.

Figures & tables

Panel of Figure 1 — Figure 1: The eight-stage pipeline. Stage 02 produces the ground-truth poisoning mask, which is withheld from stages 05 and 06 and consumed only at stage 07.

Dataset	Rate	ASR	Clean acc.
PneumoniaMNIST	0% (control)	0.029 $\pm$ 0.033	0.866 $\pm$ 0.030
PneumoniaMNIST	1%	0.989 $\pm$ 0.017	0.869 $\pm$ 0.019
PneumoniaMNIST	5%	0.999 $\pm$ 0.001	0.862 $\pm$ 0.027
PneumoniaMNIST	10%	1.000 $\pm$ 0.000	0.756 $\pm$ 0.162
CIFAR-10	0% (control)	0.039 $\pm$ 0.026	0.779 $\pm$ 0.008
CIFAR-10	1%	0.917 $\pm$ 0.029	0.768 $\pm$ 0.013

Table 1: Attack success and clean-test accuracy, mean

\pm

sd over 5 seeds. ASR is attack success rate on triggered, held-out, non-target-class test inputs. Clean acc. is each row’s own trained model evaluated on the ordinary (untriggered) test set — the same model used for that row’s ASR figure, not a separately trained comparison model; the

0\%

rows, trained with no poisoning at all, supply the unpoisoned baseline that the attacked rows are compared against. PneumoniaMNIST’s

10\%

row shows accuracy does not hold at the unpoisoned baseline uniformly across rates (Section 6 discusses this directly).

Dataset	Rate	Spectral	Clustering	Fused	Agreement
		AUROC	TPR	AUROC	Precision
PneumoniaMNIST	0% (control)	n/a	n/a	n/a	n/a
PneumoniaMNIST	1%	0.986 $\pm$ 0.000	0.996 $\pm$ 0.010	1.000 $\pm$ 0.000	1.000 $\pm$ 0.000
PneumoniaMNIST	5%	0.940 $\pm$ 0.001	0.998 $\pm$ 0.002	0.999 $\pm$ 0.001	1.000 $\pm$ 0.000
PneumoniaMNIST	10%	0.894 $\pm$ 0.004	0.995 $\pm$ 0.004	0.996 $\pm$ 0.004	1.000 $\pm$ 0.000
CIFAR-10	0% (control)	n/a	n/a	n/a	0.000 (n=2/5)

Table 2: Detection performance, mean

\pm

sd over 5 seeds, on the same 40 runs as Table 1 . Clustering is reported as TPR rather than AUROC, since it is a binary flag rather than a continuous score. The

0\%

rows are false-positive controls, and each reported statistic’s definedness there depends on its own denominator, not on a single shared condition: TPR (

\text{TP}/(\text{TP}+\text{FN})

) is undefined at

0\%

poisoning because

\text{TP}+\text{FN}=0

always — no actual positives exist to recall. AUROC is undefined for the same underlying reason (ground truth contains only the negative class). Precision (

\text{TP}/(\text{TP}+\text{FP})

) is different:

\text{TP}=0

is guaranteed at

0\%

, but precision is undefined only when

\text{FP}=0

too; whenever anything at all is flagged on clean data, precision is a defined

0

, not undefined. CIFAR-10’s agreement precision at

0\%

demonstrates this directly: it is

\mathbf{0.000}

(defined) on 2 of 5 seeds, where something was flagged and flagged incorrectly, and undefined on the other 3, where nothing was flagged at all. FPR (

\text{FP}/(\text{FP}+\text{TN})

) is undefined only when

\text{FP}+\text{TN}=0

, which cannot happen on a nonempty clean dataset, since every sample is a true negative or a false positive there — it is always defined at

0\%

poisoning. PneumoniaMNIST’s clustering FPR at

0\%

is confirmed at exactly

0.000

across all 5 seeds (

0/4{,}708

in every case). CIFAR-10’s is not uniformly zero:

0.000

on 3 of 5 seeds, but

3.46\%

and

3.00\%

on the other two (

1{,}731

and

1{,}499

50{,}000

clean images respectively) — exactly the 2 seeds where agreement precision above is a defined

0.000

rather than undefined, confirming the logical link between the two columns. This seed-dependent clean-data false-positive pattern on CIFAR-10, absent on PneumoniaMNIST, is discussed in Section 6 and is not yet explained.

Framework reference	Mapping asserted by the report
MITRE ATLAS AML.T0020	The technique the tool is built around; stage 02 simulates it directly by modifying a subset of training images and their labels, and stages 05–07 are the detection layer for it.
MITRE ATLAS AML.T0059	A poisoned dataset is a targeted special case: the altered subset is not random corruption but is crafted to survive training and re-emerge as a backdoor, which is why basic data-quality checks do not catch it.
MITRE ATLAS AML.T0018 ( Backdoor ML Model )	The end state of a successful attack, a persistent hidden change in model behavior. The tool does not inspect model weights directly as the sub-technique AML.T0018.000 ( Poison ML Model ) describes; it infers the same outcome indirectly from how poisoned data reshapes a layer’s activations.
NIST AI RMF MEASURE 2.7	“AI system security and resilience — as identified in the MAP function — are evaluated and documented.” The report is that evaluation, scoped to one named, testable risk and quantified against known ground truth, rather than a policy statement that testing occurred.

Table 3: The framework mappings stage 08 asserts. These are fixed properties of the tool, not per-run results. Deliberately narrow: a loose mapping that claims broad framework coverage is the failure mode this reporting layer exists to avoid.

Explore similar work

Aug 4, 2026

When Modalities Fail to Tango: Conformal Backdoor Detection in Multimodal Contrastive Learning

Backdoor attacks in multimodal contrastive learning (MCL) have garnered growing attention in recent years, as many downstream tasks critically depend on pre-trained MCL models. Existing detection-based defenses predominantly rely on the CLIPScore metric, under the assumption that poisoned pairs exhibit lower semantic similarity between the image and the caption. However, we identify two critical flaws remaining in existing methods: (1) the substantial overlap between CLIPScore distributions of benign and poisoned pairs undermines the reliability of this metric, and (2) fixed-threshold detection cannot provide statistical guarantees for ambiguous samples within overlapping regions. To overcome these limitations, we propose integrating conformal prediction (CP), a statistical framework that quantifies uncertainty through nonconformity scores (NCSs), to establish provable confidence bounds for detecting poisoned image-caption pairs. Building on CP, we introduce CASCADE, a novel two-stage Coarse-to-Fine Conformal Backdoor Detection framework. The coarse-grained stage uses cross-modality consistency to identify high-confidence benign and poisoned pairs. In the fine-grained stage, a reference set is constructed from high-confidence poisoned pairs, and instance-level NCSs based on text-space similarity are computed for each sample in the unidentified subset. These NCSs measure conformity to the poisoning distribution and enable precise identification of latent poisoned pairs within the unidentified subset. Extensive experiments on the large-scale CC3M dataset demonstrate that CASCADE achieves an average FPR of 5.79% at 100% TPR and an average AUROC of 0.9867 across diverse attacks, while remaining effective against adaptive attacks.

Yiming Chen, Kemou Li, Haiwei Wu +1

State Key Laboratory of Internet of Things for Smart City, University of Macau · School of Computer Science and Engineering, University of Electronic Science and Technology of China

Backdoor Detection Multimodal Contrastive Learning

Ask PDF

Apr 14, 2026

Scaling Exposes the Trigger: Input-Level Backdoor Detection in Text-to-Image Diffusion Models via Cross-Attention Scaling

Text-to-image (T2I) diffusion models have achieved remarkable success in image synthesis, but their reliance on large-scale data and open ecosystems introduces serious backdoor security risks. Existing defenses, particularly input-level methods, are more practical for deployment but often rely on observable anomalies that become unreliable under stealthy, semantics-preserving trigger designs. As modern backdoor attacks increasingly embed triggers into natural inputs, these methods degrade substantially, raising a critical question: can more stable, implicit, and trigger-agnostic differences between benign and backdoor inputs be exploited for detection? In this work, we address this challenge from an active probing perspective. We introduce controlled scaling perturbations on cross-attention and uncover a novel phenomenon termed Cross-Attention Scaling Response Divergence (CSRD), where benign and backdoor inputs exhibit systematically different response evolution patterns across denoising steps. Building on this insight, we propose SET, an input-level backdoor detection framework that constructs response-offset features under multi-scale perturbations and learns a compact benign response space from a small set of clean samples. Detection is then performed by measuring deviations from this learned space, without requiring prior knowledge of the attack or access to model training. Extensive experiments demonstrate that SET consistently outperforms existing baselines across diverse attack methods, trigger types, and model settings, with particularly strong gains under stealthy implicit-trigger scenarios. Overall, SET improves AUROC by 9.1% and ACC by 6.5% over the best baseline, highlighting its effectiveness and robustness for practical deployment.

Zida Li, Jun Li, Yuzhe Sha +3

Nanjing University of Information Science and Technology, Nanjing, China

Backdoor Detection T2I Diffusion Models

Ask PDF

Apr 23, 2026

CSC: Turning the Adversary's Poison against Itself

Poisoning-based backdoor attacks pose significant threats to deep neural networks by embedding triggers in training data, causing models to misclassify triggered inputs as adversary-specified labels while maintaining performance on clean data. Existing poison restraint-based defenses often suffer from inadequate detection against specific attack variants and compromise model utility through unlearning methods that lead to accuracy degradation. This paper conducts a comprehensive analysis of backdoor attack dynamics during model training, revealing that poisoned samples form isolated clusters in latent space early on, with triggers acting as dominant features distinct from benign ones. Leveraging these insights, we propose Cluster Segregation Concealment (CSC), a novel poison suppression defense. CSC first trains a deep neural network via standard supervised learning while segregating poisoned samples through feature extraction from early epochs, DBSCAN clustering, and identification of anomalous clusters based on class diversity and density metrics. In the concealment stage, identified poisoned samples are relabeled to a virtual class, and the model's classifier is fine-tuned using cross-entropy loss to replace the backdoor association with a benign virtual linkage, preserving overall accuracy. CSC was evaluated on four benchmark datasets against twelve poisoning-based attacks, CSC outperforms nine state-of-the-art defenses by reducing average attack success rates to near zero with minimal clean accuracy loss. Contributions include robust backdoor patterns identification, an effective concealment mechanism, and superior empirical validation, advancing trustworthy artificial intelligence.

Yuchen Shi, Xin Guo, Huajie Chen +3

Faculty of Data Science, City University of Macau, Taipa, Macau. · Faculty of Engineering and Information Technology, University of Technology Sydney, New South Wales, Australia.

Backdoor Attacks Backdoor Defense Data Poisoning Attacks

Ask PDF