Evaluating Binary, Perlin Noise, and Physical Mark Backdoor Attacks in Medical Image Classification

This paper explores three distinct types of backdoor attacks in the context of medical imaging datasets, specifically focusing on ISIC and Medical Decathlon Brain Tumours, with experiments conducted using the ResNet architecture, we also used the transformer ViT-B/16 and EfficientNet-B0 to demonstrate that different types of architectures can likewise be affected. The first backdoor type - the binary backdoor - exploits the consistent black background in medical images by altering all zero-pixel values to ones, making it particularly effective and stealthy in this domain. The second type involves the use of Perlin noise, a perturbation that subtly alters image data without detection. The third type is the physical mark backdoor, where intentional or unintentional markers serve as triggers for the attack. We assess the impact of these backdoors and employ Explainable AI to provide human-understandable visualizations of the model’s focus, highlighting potential backdoor locations. We perform a quantitative evaluation using deletion and insertion curves alongside qualitative analysis of the XAI maps, allowing us to conclude whether XAI methods can reliably reveal such triggers. Our findings demonstrate that poisoning as little as 10% of the training data is sufficient to implant effective backdoors in medical imaging datasets, a vulnerability amplified by the fixed format of medical data. We discuss the significant risks posed by this threat and emphasize the urgent need for robust security measures in medical AI systems.