Fusing Spectral Signatures and Activation Clustering for Backdoor Detection in Healthcare Imaging Models: Method, Implementation, and Evaluation

Abstract:Machine learning models are increasingly deployed in healthcare imaging pipelines for diagnostic support, and training-time attacks against them are a named sector-level concern: healthcare-sector guidance identifies model poisoning and adversarial attacks as threats requiring dedicated defenses, while federal policy directs expanded AI vulnerability-detection tooling to critical infrastructure operators such as rural hospitals. Spectral signature analysis and activation clustering are two established backdoor detection methods routinely evaluated as independent baselines, but their outputs are not ordinarily combined, and reported detection performance on medical imaging benchmarks remains sparse relative to the natural-image setting. This paper contributes three things: a score-level fusion rule combining per-class spectral ranking with activation-clustering flags into a single per-sample poisoning score and a model-level agreement statistic; an open-source implementation of the resulting eight-stage pipeline; and an evaluation of that pipeline against synthetically poisoned variants of a public medical imaging benchmark and CIFAR-10 at four poisoning rates (0%, 1%, 5%, 10%) over five seeds each, measuring each detector alone against the fusion. On the medical benchmark, the fused detector reaches AUROC >= 0.99 at every nonzero poisoning rate tested. On CIFAR-10, fusion does not uniformly help: at 10% poisoning, activation clustering's true-positive rate collapses to 0.000 and spectral AUROC independently degrades to near-chance (0.545), despite a 97.2% attack success rate confirming the backdoor was fully installed. The fused score, a weighted combination of both signals, inherits this joint failure. Detection output is expressed in NIST AI RMF Measure-function and MITRE ATLAS terms, so findings are reported in the vocabulary security and compliance teams already use.

13 pages, 2 figures, 3 tables. Implementation available at this https URL . Also deposited at Zenodo, doi:https://doi.org/10.5281/zenodo.22431041

Cryptography and Security (cs.CR); Machine Learning (cs.LG)

arXiv:2609.14290 [cs.CR]

(or arXiv:2609.14290v1 [cs.CR] for this version)

https://doi.org/10.48550/arXiv.2609.14290 Focus to learn more arXiv-issued DOI via DataCite (pending registration)

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.