No attack
-
Every hospital trains honestly.
04 · The study
What happens when a hospital lies about rare diseases.
408 federated runs on real hospital data: eight aggregation methods, three attacks and no attack, two splits, three seeds each. Every setting, attacker and pass mark was written down before the first run. This is now the project's main result - Fallback F1 in the design doc.
Gate G1 · is the problem real?
The attack works - but not quietly enough to pass the gate.
G1 asked for three things at once under Camp A (weighting hospitals by the evidence in their updates): the attacker gains at least 2x its FedAvg weight on a rare disease, that disease's F1 falls by at least 0.15, and overall balanced accuracy falls by less than 0.03 - so nobody would notice.
S1 · natural split
| Disease | Weight ≥ 2x | F1 drop ≥ 0.15 |
|---|---|---|
| Dermatofibroma | 4.96x ✓ | 0.086 ✕ |
| Vascular lesion | 5.53x ✓ | 0.017 ✕ |
Balanced-accuracy drop (must be < 0.03)0.011 ✓
S2 · specialist split
| Disease | Weight ≥ 2x | F1 drop ≥ 0.15 |
|---|---|---|
| Dermatofibroma | 4.81x ✓ | 0.207 ✓ |
| Vascular lesion | 4.65x ✓ | 0.237 ✓ |
Balanced-accuracy drop (must be < 0.03)0.051 ✕
Decision, fixed in advance
The attack succeeds on neither split: Fallback F1 - an empirical study of how rare-class-aware aggregation behaves on a real hospital split.
On S1 the attacker grabs about five times its fair share of the rare-disease rows, but three or four honest holders pull the model back. On S2 the attack does real damage, but it also costs 0.051 balanced accuracy - visible, so it misses the "quiet" condition. Both results are reported as they came out.
The attacks
Three ways to cheat, fixed before any run.
Rare-disease F1
Every method, every attack.
Mean F1 over the two rare diseases on the pooled test set after 100 rounds; whiskers are ± one standard deviation over seeds 42, 43, 44.
S1 · natural split
Fed-ISIC2019's real six hospitals, unchanged. Each rare disease has 3-4 holders.
S2 · specialist split
Constructed and disclosed: 90% of every other hospital's rare images moved to centre 2, so one hospital holds each rare disease.
What we learned
Four findings, each measured.
1 · Evidence weighting backfires
Camp A reading evidence from the updates gives the specialist less say than plain FedAvg (12.6% vs 14.5% on the dermatofibroma row) and lower rare F1 (0.558 vs 0.592). It is the inverted G0a signal at work: the hospitals that never see a disease move its row the most.
2 · Honest counts help, lying counts hurt
Weighting by reported class counts is the best method with no attack on S1 (rare F1 0.605). But a hospital that simply claims to be a big holder captures 7.4x its fair weight on S2, and rare F1 falls to 0.327.
3 · The sleeper is the worst attack
A genuine holder that turns after 15 honest rounds cuts FedAvg's rare F1 on S1 from 0.592 to 0.286. Clipping updates to the median size recovers most of it (0.538). On S2 the best method, Multi-Krum, reaches only 0.397 ± 0.167; most fall close to zero.
4 · Robust filters can erase a lone specialist
On the natural split Krum actually favours centre 2 (it is the one update Krum keeps in 60.0% of rounds). But when one hospital holds a disease (S2), Multi-Krum gives it 0.0% of the rare rows and rare F1 is 0.000 - the "odd one out" is exactly the expert.
Fairness to the specialist
How much say centre 2 gets on rare diseases.
Mean weight on the rare-disease rows over all rounds, no attack, compared with the share of that disease's images centre 2 actually holds.
| Method | S1 · DF | S1 · VL | S2 · DF | S2 · VL |
|---|---|---|---|---|
| Centre 2's share of the images | 21.7% | 31.8% | 92.4% | 93.5% |
| FedAvg | 14.5% | 14.5% | 15.8% | 15.8% |
| FedAvg + clipping | 14.5% | 14.5% | 15.8% | 15.8% |
| Krum | 60.0% | 60.0% | 0.0% | 0.0% |
| Multi-Krum | 20.0% | 20.0% | 0.0% | 0.0% |
| Trimmed mean | 24.5% | 20.3% | 6.2% | 5.4% |
| Median | 39.9% | 25.5% | 11.5% | 10.6% |
| Camp A (update evidence) | 12.6% | 13.2% | 18.5% | 18.7% |
| Camp A (reported counts) | 19.3% | 23.2% | 50.0% | 50.0% |
All numbers
The full tables.
S1 · natural split
| Method | Attack | Balanced acc | Rare F1 | DF F1 | VL F1 | Rare → nevus | Attacker weight |
|---|---|---|---|---|---|---|---|
| FedAvg | none | 0.536 ± 0.003 | 0.592 ± 0.005 | 0.472 | 0.712 | 19.3% | - |
| A1 | 0.526 ± 0.002 | 0.553 ± 0.006 | 0.416 | 0.690 | 22.1% | 1.00x / 1.00x | |
| A2 | 0.448 ± 0.003 | 0.286 ± 0.020 | 0.205 | 0.367 | 38.6% | 1.00x / 1.00x | |
| A3 | 0.489 ± 0.006 | 0.569 ± 0.005 | 0.450 | 0.689 | 19.9% | 1.00x / 1.00x | |
| FedAvg + clipping | none | 0.542 ± 0.004 | 0.592 ± 0.009 | 0.473 | 0.712 | 19.3% | - |
| A1 | 0.538 ± 0.002 | 0.574 ± 0.006 | 0.443 | 0.705 | 20.9% | 1.00x / 1.00x | |
| A2 | 0.523 ± 0.008 | 0.538 ± 0.023 | 0.407 | 0.669 | 22.1% | 1.00x / 1.00x | |
| A3 | 0.542 ± 0.004 | 0.592 ± 0.009 | 0.473 | 0.712 | 19.3% | 1.00x / 1.00x | |
| Krum | none | 0.461 ± 0.002 | 0.541 ± 0.011 | 0.446 | 0.637 | 22.1% | - |
| A1 | 0.438 ± 0.006 | 0.545 ± 0.013 | 0.468 | 0.622 | 28.0% | 0.00x / 0.00x | |
| A2 | 0.442 ± 0.009 | 0.546 ± 0.012 | 0.465 | 0.627 | 27.4% | 0.00x / 0.00x | |
| A3 | 0.438 ± 0.006 | 0.545 ± 0.013 | 0.468 | 0.622 | 28.0% | 0.00x / 0.00x | |
| Multi-Krum | none | 0.474 ± 0.011 | 0.547 ± 0.013 | 0.405 | 0.688 | 22.7% | - |
| A1 | 0.534 ± 0.003 | 0.566 ± 0.004 | 0.443 | 0.690 | 21.5% | 0.00x / 0.00x | |
| A2 | 0.527 ± 0.003 | 0.574 ± 0.006 | 0.464 | 0.684 | 17.4% | 0.00x / 0.00x | |
| A3 | 0.534 ± 0.003 | 0.566 ± 0.004 | 0.443 | 0.690 | 21.5% | 0.00x / 0.00x | |
| Trimmed mean | none | 0.507 ± 0.004 | 0.560 ± 0.002 | 0.454 | 0.667 | 20.9% | - |
| A1 | 0.507 ± 0.005 | 0.555 ± 0.007 | 0.443 | 0.667 | 20.9% | 3.37x / 3.37x | |
| A2 | 0.499 ± 0.002 | 0.564 ± 0.010 | 0.456 | 0.671 | 20.6% | 0.71x / 0.71x | |
| A3 | 0.502 ± 0.004 | 0.554 ± 0.005 | 0.443 | 0.665 | 18.1% | 1.51x / 1.53x | |
| Median | none | 0.490 ± 0.008 | 0.560 ± 0.004 | 0.447 | 0.673 | 21.2% | - |
| A1 | 0.491 ± 0.007 | 0.560 ± 0.010 | 0.444 | 0.676 | 21.2% | 2.74x / 2.90x | |
| A2 | 0.482 ± 0.007 | 0.554 ± 0.011 | 0.441 | 0.667 | 20.6% | 0.62x / 0.71x | |
| A3 | 0.493 ± 0.002 | 0.551 ± 0.017 | 0.435 | 0.667 | 17.1% | 0.03x / 0.02x | |
| Camp A (update evidence) | none | 0.535 ± 0.003 | 0.558 ± 0.009 | 0.441 | 0.675 | 18.7% | - |
| A1 | 0.525 ± 0.003 | 0.507 ± 0.012 | 0.355 | 0.658 | 22.7% | 4.96x / 5.53x | |
| A2 | 0.504 ± 0.008 | 0.491 ± 0.019 | 0.407 | 0.575 | 26.5% | 1.38x / 1.53x | |
| A3 | 0.535 ± 0.003 | 0.558 ± 0.009 | 0.441 | 0.675 | 18.7% | 4.10x / 4.04x | |
| Camp A (reported counts) | none | 0.548 ± 0.008 | 0.605 ± 0.016 | 0.496 | 0.715 | 19.9% | - |
| A1 | 0.529 ± 0.002 | 0.534 ± 0.006 | 0.405 | 0.662 | 24.3% | 5.40x / 4.79x | |
| A2 | 0.497 ± 0.006 | 0.442 ± 0.013 | 0.283 | 0.602 | 30.8% | 1.61x / 1.55x | |
| A3 | 0.548 ± 0.008 | 0.605 ± 0.016 | 0.496 | 0.715 | 19.9% | 0.53x / 0.50x |
Attacker weight = its mean weight on the DF / VL rows while attacking, divided by its FedAvg weight. Rare → nevus = share of rare-disease test images classified as the attack's target.
S2 · specialist split
| Method | Attack | Balanced acc | Rare F1 | DF F1 | VL F1 | Rare → nevus | Attacker weight |
|---|---|---|---|---|---|---|---|
| FedAvg | none | 0.485 ± 0.004 | 0.490 ± 0.017 | 0.368 | 0.612 | 32.4% | - |
| A1 | 0.476 ± 0.009 | 0.454 ± 0.024 | 0.333 | 0.575 | 34.6% | 1.00x / 1.00x | |
| A2 | 0.396 ± 0.006 | 0.012 ± 0.017 | 0.023 | 0.000 | 48.0% | 1.00x / 1.00x | |
| A3 | 0.437 ± 0.007 | 0.408 ± 0.021 | 0.230 | 0.586 | 31.2% | 1.00x / 1.00x | |
| FedAvg + clipping | none | 0.484 ± 0.007 | 0.479 ± 0.006 | 0.347 | 0.611 | 33.0% | - |
| A1 | 0.477 ± 0.009 | 0.436 ± 0.021 | 0.280 | 0.592 | 34.3% | 1.00x / 1.00x | |
| A2 | 0.411 ± 0.007 | 0.035 ± 0.050 | 0.034 | 0.036 | 43.9% | 1.00x / 1.00x | |
| A3 | 0.484 ± 0.007 | 0.479 ± 0.006 | 0.347 | 0.611 | 33.0% | 1.00x / 1.00x | |
| Krum | none | 0.279 ± 0.021 | 0.242 ± 0.033 | 0.000 | 0.485 | 62.6% | - |
| A1 | 0.435 ± 0.023 | 0.198 ± 0.100 | 0.011 | 0.384 | 31.8% | 0.00x / 0.00x | |
| A2 | 0.381 ± 0.040 | 0.084 ± 0.060 | 0.000 | 0.168 | 46.4% | 0.00x / 0.00x | |
| A3 | 0.435 ± 0.023 | 0.198 ± 0.100 | 0.011 | 0.384 | 31.8% | 0.00x / 0.00x | |
| Multi-Krum | none | 0.354 ± 0.003 | 0.000 ± 0.000 | 0.000 | 0.000 | 49.2% | - |
| A1 | 0.486 ± 0.003 | 0.535 ± 0.003 | 0.460 | 0.610 | 34.6% | 0.00x / 0.00x | |
| A2 | 0.444 ± 0.034 | 0.397 ± 0.167 | 0.360 | 0.435 | 34.9% | 0.17x / 0.17x | |
| A3 | 0.486 ± 0.003 | 0.535 ± 0.003 | 0.460 | 0.610 | 34.6% | 0.00x / 0.00x | |
| Trimmed mean | none | 0.419 ± 0.013 | 0.338 ± 0.038 | 0.248 | 0.429 | 43.3% | - |
| A1 | 0.417 ± 0.016 | 0.323 ± 0.065 | 0.237 | 0.410 | 43.3% | 3.40x / 3.38x | |
| A2 | 0.362 ± 0.005 | 0.012 ± 0.008 | 0.024 | 0.000 | 60.1% | 0.67x / 0.60x | |
| A3 | 0.438 ± 0.010 | 0.425 ± 0.025 | 0.297 | 0.554 | 33.0% | 1.57x / 1.64x | |
| Median | none | 0.401 ± 0.018 | 0.326 ± 0.060 | 0.293 | 0.359 | 48.0% | - |
| A1 | 0.410 ± 0.015 | 0.366 ± 0.036 | 0.282 | 0.450 | 45.8% | 2.47x / 2.35x | |
| A2 | 0.352 ± 0.007 | 0.044 ± 0.007 | 0.089 | 0.000 | 58.3% | 0.51x / 0.40x | |
| A3 | 0.433 ± 0.011 | 0.442 ± 0.018 | 0.303 | 0.581 | 30.8% | 0.09x / 0.09x | |
| Camp A (update evidence) | none | 0.493 ± 0.008 | 0.527 ± 0.012 | 0.437 | 0.616 | 29.6% | - |
| A1 | 0.442 ± 0.023 | 0.305 ± 0.092 | 0.230 | 0.380 | 40.2% | 4.81x / 4.65x | |
| A2 | 0.391 ± 0.003 | 0.000 ± 0.000 | 0.000 | 0.000 | 44.2% | 1.56x / 1.66x | |
| A3 | 0.493 ± 0.008 | 0.527 ± 0.012 | 0.437 | 0.616 | 29.6% | 3.32x / 2.97x | |
| Camp A (reported counts) | none | 0.541 ± 0.007 | 0.560 ± 0.012 | 0.443 | 0.678 | 22.4% | - |
| A1 | 0.461 ± 0.013 | 0.327 ± 0.056 | 0.282 | 0.372 | 41.1% | 7.32x / 7.36x | |
| A2 | 0.409 ± 0.003 | 0.000 ± 0.000 | 0.000 | 0.000 | 45.2% | 1.95x / 1.96x | |
| A3 | 0.541 ± 0.007 | 0.560 ± 0.012 | 0.443 | 0.678 | 22.4% | 0.54x / 0.55x |
Attacker weight = its mean weight on the DF / VL rows while attacking, divided by its FedAvg weight. Rare → nevus = share of rare-disease test images classified as the attack's target.