cs.CRSep 13, 2026

Fusing Spectral Signatures and Activation Clustering for Backdoor Detection in Healthcare Imaging Models: Method, Implementation, and Evaluation

Authors: Suresh Tamang

Organizations: Graduate Researcher, Artificial Intelligence, University of the Cumberlands

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Machine learning models are increasingly deployed in healthcare imaging pipelines for diagnostic support, and training-time attacks against them are a named sector-level concern: healthcare-sector guidance identifies model poisoning and adversarial attacks as threats requiring dedicated defenses, while federal policy directs expanded AI vulnerability-detection tooling to critical infrastructure operators such as rural hospitals. Spectral signature analysis and activation clustering are two established backdoor detection methods routinely evaluated as independent baselines, but their outputs are not ordinarily combined, and reported detection performance on medical imaging benchmarks remains sparse relative to the natural-image setting. This paper contributes three things: a score-level fusion rule combining per-class spectral ranking with activation-clustering flags into a single per-sample poisoning score and a model-level agreement statistic; an open-source implementation of the resulting eight-stage pipeline; and an evaluation of that pipeline against synthetically poisoned variants of a public medical imaging benchmark and CIFAR-10 at four poisoning rates (0%, 1%, 5%, 10%) over five seeds each, measuring each detector alone against the fusion. On the medical benchmark, the fused detector reaches AUROC >= 0.99 at every nonzero poisoning rate tested. On CIFAR-10, fusion does not uniformly help: at 10% poisoning, activation clustering's true-positive rate collapses to 0.000 and spectral AUROC independently degrades to near-chance (0.545), despite a 97.2% attack success rate confirming the backdoor was fully installed. The fused score, a weighted combination of both signals, inherits this joint failure. Detection output is expressed in NIST AI RMF Measure-function and MITRE ATLAS terms, so findings are reported in the vocabulary security and compliance teams already use.

Figures & tables

Figure 1: The eight-stage pipeline. Stage 02 produces the ground-truth poisoning mask, which is withheld from stages 05 and 06 and consumed only at stage 07.
DatasetRateASRClean acc.
PneumoniaMNIST0% (control)0.029 ±\pm 0.0330.866 ±\pm 0.030
PneumoniaMNIST1%0.989 ±\pm 0.0170.869 ±\pm 0.019
PneumoniaMNIST5%0.999 ±\pm 0.0010.862 ±\pm 0.027
PneumoniaMNIST10%1.000 ±\pm 0.0000.756 ±\pm 0.162
CIFAR-100% (control)0.039 ±\pm 0.0260.779 ±\pm 0.008
CIFAR-101%0.917 ±\pm 0.0290.768 ±\pm 0.013
Table 1: Attack success and clean-test accuracy, mean ±\pm sd over 5 seeds. ASR is attack success rate on triggered, held-out, non-target-class test inputs. Clean acc. is each row’s own trained model evaluated on the ordinary (untriggered) test set — the same model used for that row’s ASR figure, not a separately trained comparison model; the 0%0\% rows, trained with no poisoning at all, supply the unpoisoned baseline that the attacked rows are compared against. PneumoniaMNIST’s 10%10\% row shows accuracy does not hold at the unpoisoned baseline uniformly across rates (Section 6 discusses this directly).
DatasetRateSpectralClusteringFusedAgreement
  AUROCTPRAUROCPrecision
PneumoniaMNIST0% (control)n/an/an/an/a
PneumoniaMNIST1%0.986 ±\pm 0.0000.996 ±\pm 0.0101.000 ±\pm 0.0001.000 ±\pm 0.000
PneumoniaMNIST5%0.940 ±\pm 0.0010.998 ±\pm 0.0020.999 ±\pm 0.0011.000 ±\pm 0.000
PneumoniaMNIST10%0.894 ±\pm 0.0040.995 ±\pm 0.0040.996 ±\pm 0.0041.000 ±\pm 0.000
CIFAR-100% (control)n/an/an/a0.000 (n=2/5)
Table 2: Detection performance, mean ±\pm sd over 5 seeds, on the same 40 runs as Table 1 . Clustering is reported as TPR rather than AUROC, since it is a binary flag rather than a continuous score. The 0%0\% rows are false-positive controls, and each reported statistic’s definedness there depends on its own denominator, not on a single shared condition: TPR ( TP/(TP+FN)\text{TP}/(\text{TP}+\text{FN}) ) is undefined at 0%0\% poisoning because TP+FN=0\text{TP}+\text{FN}=0 always — no actual positives exist to recall. AUROC is undefined for the same underlying reason (ground truth contains only the negative class). Precision ( TP/(TP+FP)\text{TP}/(\text{TP}+\text{FP}) ) is different: TP=0\text{TP}=0 is guaranteed at 0%0\% , but precision is undefined only when FP=0\text{FP}=0 too; whenever anything at all is flagged on clean data, precision is a defined 00 , not undefined. CIFAR-10’s agreement precision at 0%0\% demonstrates this directly: it is 0.000\mathbf{0.000} (defined) on 2 of 5 seeds, where something was flagged and flagged incorrectly, and undefined on the other 3, where nothing was flagged at all. FPR ( FP/(FP+TN)\text{FP}/(\text{FP}+\text{TN}) ) is undefined only when FP+TN=0\text{FP}+\text{TN}=0 , which cannot happen on a nonempty clean dataset, since every sample is a true negative or a false positive there — it is always defined at 0%0\% poisoning. PneumoniaMNIST’s clustering FPR at 0%0\% is confirmed at exactly 0.0000.000 across all 5 seeds ( 0/4,7080/4{,}708 in every case). CIFAR-10’s is not uniformly zero: 0.0000.000 on 3 of 5 seeds, but 3.46%3.46\% and 3.00%3.00\% on the other two ( 1,7311{,}731 and 1,4991{,}499 of 50,00050{,}000 clean images respectively) — exactly the 2 seeds where agreement precision above is a defined 0.0000.000 rather than undefined, confirming the logical link between the two columns. This seed-dependent clean-data false-positive pattern on CIFAR-10, absent on PneumoniaMNIST, is discussed in Section 6 and is not yet explained.
Framework referenceMapping asserted by the report
MITRE ATLAS AML.T0020The technique the tool is built around; stage 02 simulates it directly by modifying a subset of training images and their labels, and stages 05–07 are the detection layer for it.
MITRE ATLAS AML.T0059A poisoned dataset is a targeted special case: the altered subset is not random corruption but is crafted to survive training and re-emerge as a backdoor, which is why basic data-quality checks do not catch it.
MITRE ATLAS AML.T0018 ( Backdoor ML Model )The end state of a successful attack, a persistent hidden change in model behavior. The tool does not inspect model weights directly as the sub-technique AML.T0018.000 ( Poison ML Model ) describes; it infers the same outcome indirectly from how poisoned data reshapes a layer’s activations.
NIST AI RMF MEASURE 2.7“AI system security and resilience — as identified in the MAP function — are evaluated and documented.” The report is that evaluation, scoped to one named, testable risk and quantified against known ground truth, rather than a policy statement that testing occurred.
Table 3: The framework mappings stage 08 asserts. These are fixed properties of the tool, not per-run results. Deliberately narrow: a loose mapping that claims broad framework coverage is the failure mode this reporting layer exists to avoid.

Explore similar work

CardsList

  1. When Modalities Fail to Tango: Conformal Backdoor Detection in Multimodal Contrastive Learning

    Aug 4, 2026Yiming Chen, Kemou Li, Haiwei Wu +1Backdoor DetectionMultimodal Contrastive Learning

    State Key Laboratory of Internet of Things for Smart City, University of Macau · School of Computer Science and Engineering, University of Electronic Science and Technology of China

  2. Scaling Exposes the Trigger: Input-Level Backdoor Detection in Text-to-Image Diffusion Models via Cross-Attention Scaling

    Apr 14, 2026Zida Li, Jun Li, Yuzhe Sha +3Backdoor DetectionT2I Diffusion Models

    Nanjing University of Information Science and Technology, Nanjing, China

  3. CSC: Turning the Adversary's Poison against Itself

    Apr 23, 2026Yuchen Shi, Xin Guo, Huajie Chen +3Backdoor AttacksBackdoor Defense

    Faculty of Data Science, City University of Macau, Taipa, Macau. · Faculty of Engineering and Information Technology, University of Technology Sydney, New South Wales, Australia.