One round, from the hospitals to the ledger.
- 01
Six hospitals hold the data
Nothing leaves the building.
Fed-ISIC2019 is six real hospitals, not a simulated split. They differ wildly in size - from 9,930 training images down to 351 - and that size is what standard federated averaging turns into influence.
C0C1C2C3C4C5- Images
- 23,247
- Hospitals
- 6
- Diseases
- 8
- 02
One pass through DenseNet-121
Turn every image into 1024 numbers, once.
The backbone runs over all images a single time and the features are saved. Every experiment after this trains only the small classifier head on those features, which is what makes 408 runs affordable on a laptop.
- Per image
- 1024 features
- Cost
- ~35 min once
- Then
- minutes per run
- 03
Each hospital trains on its own images
The only thing sent back is a model update.
Every round, all six hospitals train the head locally and return the change they made. This part is ordinary federated learning and it is the baseline everything is measured against.
- Rounds
- 100
- Seeds
- 42, 43, 44
- Sent
- updates only
- 04
Size check: clip to the median
Nobody buys influence by shouting.
Each update is scaled down to the median update size. Measured effect on the sleeper attack (A2): rare-disease F1 falls to 0.286 under plain FedAvg, and clipping recovers most of it at 0.538.
- FedAvg under A2
- 0.286
- With clipping
- 0.538
- 05
Read the evidence
This is where the signal turned inverted.
EARN needs to infer, from the update alone, how much of each disease a hospital holds. Gate G0a checked that and it came out inverted: -0.21 where 0.7 was needed, and the one allowed retry scored -0.463. A hospital that has never seen a disease moves that disease's row the most.
++--+---red = points the wrong way (5 of 8)- G0a
- -0.21
- Retry
- -0.463
- Needed
- >= 0.7
- 06
Count who can vouch
Coverage decides how the claim is checked.
Counting hospitals with at least 20 training images: Dermatofibroma has 4, Vascular lesion has 3. EARN would blend peer checking with a hospital's own history in that proportion - peers matter less when fewer peers can contradict.
Dermatofibroma4 of 6Vascular lesion3 of 6- Dermatofibroma
- 4 of 6 · p 0.75
- Vascular lesion
- 3 of 6 · p 0.50
- 07
Update trust, slowly
Earned in ten rounds, halved in one.
Agreement raises a hospital's trust for that disease by a small fixed step; disagreement halves it. EARN is fully built and unit-tested, but because the measured signal came back inverted, it could only be run on an oracle signal - labelled exploratory, and it still did not meet its G2 conditions.
- Up
- +0.1
- Down
- x0.5
- Run on
- oracle signal
- 08
Aggregate the round
Whose update counts, and by how much.
FedAvg weights Centre 2 at 14.5% - its share of images. Weighting by update-evidence (Camp A) gives it 12.6% instead, less than FedAvg, and rare-disease F1 drops from 0.592 to 0.558. The signal that was supposed to help hurts.
FedAvg14.5%Camp A12.6%Centre 2's weight on the Dermatofibroma row.
- FedAvg rare F1
- 0.592
- Camp A rare F1
- 0.558
- 09
Commit the round to the chain
A record the coordinator cannot bend.
The trust table, coverage and each hospital's history hash go into one block that points at the last. 2,400 real rounds were replayed on the Hardhat contract: about 184k gas and 1.1 ms per round, and every forged trust boost was rejected.
- Rounds on chain
- 2,400
- Gas / round
- ~184k
- Latency
- 1.1 ms
- Forged boosts
- all rejected
- 10
What the whole thing showed
The honest outcome, not the hoped-for one.
408 runs across methods, attacks and both splits. The pre-registered attack gate G1 did not pass on either split, so the paper follows the plan's own fallback: an empirical study of how these methods behave on a real hospital split, with every negative result reported as a finding.
- Runs
- 408
- G1
- bar not met on either split
- Framing
- Fallback F1
The attack succeeds on neither split: Fallback F1 - an empirical study of how rare-class-aware aggregation behaves on a real hospital split.