Exploring Adversarial Attacks in Federated Learning for Medical Imaging
Open accessAbstract
Federated learning provides a privacy-preserving framework for medical image analysis but is also vulnerable to a unique category of adversarial attacks. This article presents an in-depth exploration of these vulnerabilities, emphasizing the potential for adversaries to execute attack transferability, a phenomenon where adversarial attacks developed on one model can be successfully applied to other models within the federated network. We delve into the specific risks associated with such attacks in the context of medical imaging, using domain-specific MRI tumor and pathology datasets. Our comprehensive evaluation assesses the efficacy of various known threat scenarios within a federated learning environment. The study demonstrates the system's susceptibility to multiple forms of attacks and highlights how domain-specific configurations can significantly elevate the success rate of these attacks. This analysis brings to light the need for defense mechanisms and advocates for a reevaluation of the current security protocols in federated medical image analysis systems.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The resilience of federated learning models in domains like cancer diagnosis using MRI is greatly increased by federated adversarial training frameworks, which rebuild global models utilizing adversarial data produced locally.
“Furthermore, the resilience of FL models in domains like cancer diagnosis using MRI is greatly increased by federated adversarial training frameworks, which rebuild global models utilizing adversarial data produced locally.”
From Federated Learning in Smart Healthcare: A Comprehensive Review on Privacy, Security, and Predictive Analytics with IoT Integration (2024) · cites this paper as [75]
Cites
Explaining and Harnessing Adversarial Examples
Goodfellow, I. J., Shlens, J., & Szegedy, C. (2014) · arXiv · doi:10.48550/arxiv.1412.6572 · Cited by 10,381 · see citing works
Intriguing properties of neural networks
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013) · arXiv · doi:10.48550/arxiv.1312.6199 · Cited by 8,143 · see citing works
Towards Deep Learning Models Resistant to Adversarial Attacks
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2017) · arXiv · doi:10.48550/arxiv.1706.06083 · Cited by 6,602 · see citing works
Adversarial examples in the physical world
Kurakin, A., Goodfellow, I. J., & Bengio, S. (2018) · Artificial Intelligence Safety and Security · doi:10.1201/9781351251389-8 · Cited by 5,375 · see citing works
On Assessing ML Model Robustness: A Methodological Framework (Academic Track)
Awadid, A., & Robert, B. (2025) · OASIcs : OpenAccess Series in Informatics · doi:10.4230/oasics.saia.2024.1 · Cited by 4,723 · see citing works
The Algorithmic Foundations of Differential Privacy
Dwork, C., & Roth, A. (2013) · doi:10.1561/9781601988195 · Cited by 3,856 · see citing works
Federated Learning With Differential Privacy: Algorithms and Performance Analysis
Wei, K., Li, J., Ding, M., Ma, C., Yang, H. H., Farokhi, F., Jin, S., Quek, T. Q. S., & Vincent Poor, H. (2020) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2020.2988575 · Cited by 2,400 · see citing works
Evasion attacks against machine learning at test time
Biggio, B., Corona, I., Maiorca, D., Nelson, B. A., Srndic, N., Laskov, P., Giacinto, G., & Roli, F. (2013) · Cited by 1,658 · see citing works
Theoretically principled trade-off between robustness and accuracy
Zhang, H., Yu, Y., Jiao, J., Xing, E. P., Ghaoui, L. E., & Jordan, M. I. (2019) · arXiv · doi:10.48550/arxiv.1901.08573 · Cited by 1,560 · see citing works
Adversarial attacks on medical machine learning
Finlayson, S. G., Bowers, J. D., Ito, J., Zittrain, J. L., Beam, A. L., & Kohane, I. S. (2019) · Science · doi:10.1126/science.aaw4399 · Cited by 1,088 · see citing works
Evasion Attacks against Machine Learning at Test Time
Biggio, B., Corona, I., Maiorca, D., Nelson, B., Šrndić, N., Laskov, P., Giacinto, G., & Roli, F. (2013) · Lecture Notes in Computer Science · doi:10.1007/978-3-642-40994-3_25 · Cited by 890 · see citing works
Adversarial Attacks and Defenses in Images, Graphs and Text: A Review
Xu, H., Ma, Y., Liu, H., Deb, D., Liu, H., Tang, J., & Jain, A. K. (2020) · Machine Intelligence Research · doi:10.1007/s11633-019-1211-x · Cited by 716 · see citing works
Understanding adversarial attacks on deep learning based medical image analysis systems
Ma, X., Niu, Y., Gu, L., Wang, Y., Zhao, Y., Bailey, J., & Lu, F. (2021) · Pattern Recognition · doi:10.1016/j.patcog.2020.107332 · Cited by 553 · see citing works
Rotation Equivariant CNNs for Digital Pathology
Veeling, B. S., Linmans, J., Winkens, J., Cohen, T., & Welling, M. (2018) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-00934-2_24 · Cited by 476 · see citing works
Can You Really Backdoor Federated Learning?
Sun, Z., Kairouz, P., Suresh, A. T., & McMahan, H. B. (2019) · arXiv · doi:10.48550/arxiv.1911.07963 · Cited by 348 · see citing works
Transferable Adversarial Perturbations
Zhou, W., Hou, X., Chen, Y., Tang, M., Huang, X., Gan, X., & Yang, Y. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-01264-9_28 · Cited by 256 · see citing works
Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defenses
Rony, J., Hafemann, L. G., Oliveira, L. S., Ayed, I. B., Sabourin, R., & Granger, É. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.00445 · Cited by 251 · see citing works
A Bi-layered Parallel Training Architecture for Large-Scale Convolutional Neural Networks
Chen, J., Li, K., Bilal, K., Zhou, X., Li, K., & Yu, P. S. (2018) · IEEE Transactions on Parallel and Distributed Systems · doi:10.1109/tpds.2018.2877359 · Cited by 185 · see citing works
Nguyen, T. D., Nguyen, T., Nguyen, P. L., Pham, H. H., Doan, K. D., & Wong, K.-S. (2024) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2023.107166 · Cited by 130 · see citing works
Data fraud in clinical trials.
George, S. L., & Buyse, M. (2015) · Clinical Investigation · doi:10.4155/cli.14.116 · Cited by 126 · see citing works
Distributionally Adversarial Attack
Zheng, T., Chen, C., & Ren, K. (2019) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v33i01.33012253 · Cited by 126 · see citing works
Brain Tumor Classification (MRI)
Bhuvaji, S., Kadam, A., Bhumkar, P., Dedge, S., & Kanchan, S. (2020) · Kaggle · doi:10.34740/kaggle/dsv/1183165 · Cited by 109 · see citing works
Federated learning in medical imaging: Part II: methods, challenges, and considerations
Darzidehkalani, E., Ghasemi-rad, M., & van Ooijen, P. M. A. (2022) · Journal of the American College of Radiology · doi:10.1016/j.jacr.2022.03.016 · Cited by 103 · see citing works
SCA: Sybil-Based Collusion Attacks of IIoT Data Poisoning in Federated Learning
Xiao, X., Tang, Z., Li, C., Xiao, B., & Li, K. (2023) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2022.3172310 · Cited by 99 · cited 1× · see citing works
“To counter backdoor and poisoning attacks, statistical tests identify anomalous client updates, and advanced optimization methods fortify models against such threats [10].”
Federated Learning in Medical Imaging: Part I: Toward Multicentral Health Care Ecosystems
Darzidehkalani, E., Ghasemi-Rad, M., & van Ooijen, P. M. A. (2022) · Journal of the American College of Radiology · doi:10.1016/j.jacr.2022.03.015 · Cited by 94 · see citing works
Securing Secure Aggregation: Mitigating Multi-Round Privacy Leakage in Federated Learning
So, J., Ali, R. E., Güler, B., Jiao, J., & Avestimehr, A. S. (2023) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v37i8.26177 · Cited by 80 · see citing works
Assessing Threat of Adversarial Examples on Deep Neural Networks
Graese, A., Rozsa, A., & Boult, T. E. (2016) · IEEE International Conference on Machine Learning and Applications (ICMLA) · doi:10.1109/icmla.2016.0020 · Cited by 53 · see citing works
Suvarna, S. K., & Ansary, M. A. (2001) · Histopathology · doi:10.1046/j.1365-2559.2001.01312.x · Cited by 37 · see citing works
A configurable deep learning framework for medical image analysis
Chen, J., Yang, N., Zhou, M., Zhang, Z., & Yang, X. (2022) · Neural Computing and Applications · doi:10.1007/s00521-021-06873-z · Cited by 18 · see citing works
Data Storage, Cloud Usage and Artificial Intelligence Pipeline
van Ooijen, P. M. A., Darzi, E., & Dekker, A. L. A. J. (2022) · Contemporary medical imaging · doi:10.1007/978-3-030-92087-6_5 · Cited by 14 · see citing works
Self-citationImage manipulation: Fraudulence in digital dental records: Study and review
Chowdhry, A., Popli, D. B., Sircar, K., & Tandon, A. (2014) · Journal of Forensic Dental Sciences · doi:10.4103/0975-1475.127767 · Cited by 13 · see citing works
Stochastic Channel-Based Federated Learning for Medical Data Privacy PreservingPreprint
Shao, R., He, H., Liu, H., & Liu, D. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1910.11160 · Cited by 8 · see citing works
A Comparative Study of Federated Learning Models for COVID-19 DetectionPreprint
Darzidehkalani, E., Sijtsema, N., & van Ooijen, P. V. (2023) · arXiv.org · doi:10.48550/arxiv.2303.16141 · Cited by 5 · see citing works
Self-citation
Flagged first, then by citations
Cited by
Sorted by citations
Abbas, S. R., Abbas, Z., Zahir, A., & Lee, S. W. (2024) · Healthcare · doi:10.3390/healthcare12242587 · Cited by 228 · see citing works
Federated learning for big data: A survey on opportunities, applications, and future directions
Gadekallu, T. R., Pham, Q., Huynh‐The, T., Feng, H., Fang, K., Pandya, S., Liyanage, M., Wang, W. W., & Nguyen, T. T. (2025) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2025.113614 · Cited by 81 · see citing works
Threats and Defenses in the Federated Learning Life Cycle: A Comprehensive Survey and Challenges
Li, Y., Guo, Z., Yang, N., Chen, H., Yuan, D., & Ding, W. (2025) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2025.3563537 · Cited by 38 · see citing works
Sensitivity-Aware Differential Privacy for Federated Medical Imaging
Zheng, L., Cao, Y., Yoshikawa, M., Shen, Y., Rashed, E. A., Taura, K., Hanaoka, S., & Zhang, T. (2025) · Sensors · doi:10.3390/s25092847 · Cited by 27 · see citing works
Backdoor attacks and defense mechanisms in federated learning: A survey
Li, Z., Lan, J., Yan, Z., & Erol Gelenbe, A. (2025) · Information Fusion · doi:10.1016/j.inffus.2025.103248 · Cited by 19 · see citing works
Murala, D. K., Krishna, G. S., Kiran, T., & Mohamud, A. K. (2025) · Scientific Reports · doi:10.1038/s41598-025-27303-3 · Cited by 13 · see citing works
Apak, S., Değim, İ. T., & Zahertar, S. (2026) · Neural Computing and Applications · doi:10.1007/s00521-025-11828-9 · Cited by 7 · see citing works
GANFAT: Robust federated adversarial learning with label distribution skew
Luo, Y., Zhu, T., Liu, Z., Mao, T., Chen, Z., Pi, H., & Lin, Y. (2024) · Future Generation Computer Systems · doi:10.1016/j.future.2024.06.030 · Cited by 6 · see citing works
Adversarial Machine Learning: A 20-Year Survey of Attacks, Defenses, and Standards
Tekeste, B., Al-Hussaeni, K., Fung, B. C. M., Alawadhi, I. M., & Fachkha, C. (2026) · IEEE Access · doi:10.1109/access.2026.3690620 · Cited by 7 · see citing works
Zahir-Ismail, A.-T., & Shukla, R. M. (2025) · Scientific Reports · doi:10.1038/s41598-025-15993-8 · Cited by 16 · see citing works
Arimanda, N., C, V. R., & Padmavathi, U. (2025) · Future Generation Computer Systems · doi:10.1016/j.future.2025.108234 · Cited by 6 · see citing works
Splitting smarter: Differential privacy for secure healthcare federated learning
Onireti, M. Y., Shukla, R. M., & Das, T. (2025) · Scientific Reports · doi:10.1038/s41598-025-27472-1 · Cited by 6 · see citing works
Shahid, M. I., Badar, H. M. S., Asghar, M. N., & Abdullah, A. (2026) · Scientific Reports · doi:10.1038/s41598-026-36034-y · Cited by 5 · see citing works
Mohammed, T. J., Xinying, C., Albahri, A. S., Alnoor, A., & Wah, K. K. (2025) · IEEE Access · doi:10.1109/access.2025.3609330 · Cited by 4 · see citing works
A systematic review on privacy preservation in federated learning
Sum, A. S. I., Pritee, Z. T., Saha, A. K., Mahmud, M. A., & Nur, K. M. (2026) · International Journal of Information Security · doi:10.1007/s10207-026-01229-x · Cited by 6 · see citing works
Rekha, M., & S.Senthilkumar (2026) · Iranian Journal of Science and Technology Transactions of Electrical Engineering · doi:10.1007/s40998-026-01120-4 · Cited by 3 · see citing works
Intrusion detection system based on federated learning using layer-based privacy obfuscation
Kumar, K., & Khari, M. (2025) · Cluster Computing · doi:10.1007/s10586-025-05337-6 · Cited by 2 · see citing works
Autonomous Cyber Resilience via a Co-Evolutionary Arms Race within a Fortified Digital Twin Sandbox
Malikussaid, & Sutiyo (2025) · International Symposium on Intelligent Signal Processing and Communication Systems (ISPACS) · doi:10.1109/ispacs68724.2025.11383172 · Cited by 2 · see citing works
Lightweight ECC-Based Self-Healing Federated Learning Framework for Secure IIoT Networks
Salim, M. M., Naaz, F., & Choi, K. (2025) · Sensors · doi:10.3390/s25226867 · Cited by 2 · see citing works
Xia, T., Cheng, X., Zhang, K., Ma, W., Si, G., & Xi, L. (2026) · Reliability Engineering & System Safety · doi:10.1016/j.ress.2026.112526 · Cited by 2 · see citing works
GenDRA: Generative Data Reconstruction Attacks on Federated Edge Learning and Countermeasures
Zhao, C., Li, S., He, Y., Huang, W., Li, G., Ding, L., & Li, J. (2025) · Electronics · doi:10.3390/electronics14112263 · Cited by 2 · see citing works
AD-FL : adversarial defense in federated learning via attention denoising
Chen, L., Chen, B., Zhu, C., Zhai, W., Cui, J., & Yu, E. (2025) · Connection Science · doi:10.1080/09540091.2025.2603028 · Cited by 1 · see citing works
Stealth—Black-Box Attack on Industry 4.0 Medical AI: A Low-Rank Perturbation Approach
Joseph, N., Jeffrey, D., George, S. N., Ameer, P. M., & Raja, K. B. (2025) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2025.3640725 · Cited by 1 · see citing works
Kuznetsov, O., Melchiori, M., Galdelli, A., Frontoni, E., & Arnesano, M. (2026) · Discover Artificial Intelligence · doi:10.1007/s44163-026-01014-8 · Cited by 1 · see citing works
Lightweight and Robust Federated Data Valuation
Tang, G., Zhou, J., Mamun, M., & Drew, S. (2025) · IEEE ... International Conference on Data Mining workshops · doi:10.1109/icdmw69685.2025.00282 · Cited by 1 · see citing works
Yu, Z., Liu, Y. (., & Chen, Q. (2026) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2026.115017 · Cited by 1 · see citing works
Mirzaei, A., Nouri-Moghaddam, B., & Abdollahi, J. (2026) · Discover Artificial Intelligence · doi:10.1007/s44163-026-01524-5 · Cited by 1 · see citing works
Federated learning for medical image analysis: Methods, challenges, and future directions
Le, T. T., Tran, P.-N., Pham, N. T., Manavalan, B., Shen, L., Hong, C. S., & Dang, D. N. M. (2026) · Advanced Engineering Informatics · doi:10.1016/j.aei.2026.104976 · Cited by 1 · see citing works
Zheng, P., Zhou, Y., Yu, X., Wang, W., & Liao, S. (2026) · Bulletin of the National Research Centre/Bulletin of the National Research Center · doi:10.1186/s42269-026-01452-5 · Cited by 1 · see citing works
A Machine Learning Approach for Medical Imaging Evaluation
Qiu, W., Shi, D., Li, Q., Zheng, Y., & Shen, X. (2024) · International Conference on Bioinformatics and Intelligent Computing (BIC) · doi:10.1145/3665689.3665699
Adversarial Attacks and Defense for Secure Medical Reports Interpretation using ResNet
Lavanya, S. R., & Jothi, S. (2025) · International Conference on Recent Innovation in Science Engineering and Technology (ICRISET) · doi:10.1109/icriset64803.2025.11251966
Securing MRI Images by Stego-Crypto Lightweight Encryption
Nandhashree, K. R., Kumar, M. S., Abimanyu, M., Hemachandran, B., & Surya, K. (2025) · IEEE International Conference on Blockchain and Distributed Systems Security (ICBDS) · doi:10.1109/icbds67396.2025.11377979
Lalooha, G., Ruan, W., Haghighi, V., Li, X., & Sheng, Q. Z. (2025) · Proceedings · doi:10.1109/icdm65498.2025.00141
Melhem, A., AlEroud, A. F., Al-Mamun, A., Ibrahem, M. I., & Nasser, N. (2026) · ACM Transactions on the Web · doi:10.1145/3801730
Don, A. K. K., & Khalil, I. (2026) · Quantum Machine Intelligence · doi:10.1007/s42484-026-00385-6 · Cited by 1 · see citing works
Secure yet fragile: adversarial vulnerabilities of federated vision–language models in medical AI
Fime, A. A., Samiha, T. Z., Hossain, M. Z., Zaman, S., Shibli, A. M., Shahid, A. R., Ni, Z., & Imteaj, A. (2026) · Scientific Reports · doi:10.1038/s41598-026-48102-4
Mohammadi, M., Badiei, M. H., Mashreghi, M., Kazemi, K., & Kebriaei, H. (2026) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2026.3691084
Security Analysis of a Federated Learning Framework for Medical Image-to-Image Translation
Raggio, C. B., Bucher, L., Blanck, O., Cicone, F., Zaffino, P., & Spadea, M. F. (2026) · Journal of Medical Systems · doi:10.1007/s10916-026-02436-8
Q-RobHFL: A QKD-Enhanced and Adversarially Robust Hierarchical Federated Learning Framework for IoMT
Shady, A., Bolock, A. E., & Zamzam, M. (2026) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-032-32767-3_19
RAFALE: Runtime Attestation for Secure and Trustworthy Federated Learning on Edge Devices
Srivastav, P., Kaur, A., & Ghoshal, B. (2026) · Electronics · doi:10.3390/electronics15163635
Advances in Detecting and Mitigation Adversarial Manipulations in Medical Imaging: A Review
Patel, D. D., Shah, J. M., & Kushwaha, A. S. (2026) · International Conference on Secure Information Systems and Technologies (ICSIST) · doi:10.1109/icsist70215.2026.11706394
ADVSL: Adversarial Attacks in Split Learning
Chen, J., Cui, J., Chen, D. Z., & Zhong, H. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-38702-8_1
Sielaff, P., Brudek, A., Nowakowski, A., Piwar, H., Pawłasek, J., Lis, M., Hernik, K., Sucharski, M., & Kacynel, E. (2026) · International Journal of Innovative Technologies in Social Science · doi:10.31435/ijitss.4(52).2026.6340
Nicholas, T., Huang, K., Hossain, J., Pallewatta, P., Wang, Y., Huan, H., Xiang, H., & Ming, W. (2026) · Neurocomputing · doi:10.1016/j.neucom.2026.135450
- Authors
- Darzi, E., Dubost, F., Sijtsema, N. M., & van Ooijen, P. M. A.
- Affiliations
- Department of Radiology, Harvard Medical School, Harvard University, Boston, MA, USA
- Google (United States) (US)
- University Medical Center Groningen (NL)
- Department of Radiotherapy, University Medical Center Groningen, University of Groningen, Groningen, The Netherlands
- Venue
- IEEE Transactions on Industrial Informatics
- Published
- 2024-12
- Volume
- 20
- Issue
- 12
- Pages
- 13591-13599
- ISSN
- 1551-3203 (ISSN-L)
- 1941-0050
- OpenAlex
- W4401942562
- Cited by
- 45
- References
- 33
- Citations by year
- 2026: 23 · 2025: 19 · 2024: 3
- FWCI
- 6.60
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- IEEE Transactions on Industrial Informatics (publishedVersion)
- arXiv (Cornell University) (submittedVersion, cc-by)
- University of Groningen research database (University of Groningen / Centre for Information Technology) (submittedVersion, other-oa)
- arXiv (Cornell University) (cc-by)
- Funders
- KWF Kankerbestrijding and the Netherlands Organization for Scientific Research
- Technology for Oncology IL
- Health Holland, Top Sector Life Sciences & Health
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Keywords
- federated learning, adversarial attacks, attack transferability, medical image analysis, privacy preservation, pathology images, federated learning security, defense mechanisms
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
