Data Poisoning Attack Defense and Evolutionary Domain Adaptation for Federated Medical Image Segmentation

1 Introduction

Medical image segmentation [Liang et al., 2024; Song et al., 2024; Shi et al., 2024] is a foundation of modern healthcare, enabling precise diagnosis, optimized treatment planning, and effective disease monitoring. These capabilities are essential for improving patient outcomes and optimizing medical workflows. However, data privacy concerns often constrain the broad application of segmentation methods. Federated learning (FL) [McMahan et al., 2017] has emerged as an approach to address data privacy by enabling decentralized training across multiple clinical centres [Guan et al., 2024]. In addition, FL facilitates collaboration for medical applications, as various clinical centres can jointly train a global model [Jiang et al., 2023].Despite its potential, federated medical image segmentation encounters two critical challenges: vulnerability to data poisoning attacks on each client's retained data and domain gaps derived from different institutions and vendors. These hurdles undermine the accuracy and reliability of FL-based models, limiting their practical deployment in healthcare scenarios.

∗Corresponding author

As illustrated in Fig. 1(a), an external attacker can disrupt segmentation regions by injecting adversarial perturbations into magnetic resonance imaging (MRI) data [Kaviani et al., 2022; Ozbulak et al., 2019]. When perturbed by an adversarial attack [Goodfellow et al., 2014], the cardiac image segmentation model fails to predict the segmentation maps accurately in "hypertrophic cardiomyopathy." External attackers can inject adversarial perturbations into the training dataset of target clients to degrade the overall model performance. This degradation poses significant problems in clinical systems, which could be perturbed by adversarial examples when employing deep learning for diagnosis, decision-making, or reimbursement [Finlayson et al., 2018].

Furthermore, as depicted in Fig. 1(b), FL-based medical approaches often encounter varying data distributions among clients in clinical centres due to varying MRI equipment vendors, such as Siemens, Philips, GE, and Canon. This approaches also face varying distributions due to differences in specific details regarding scanner vendors, such as the inplane resolution and number of slices collected during MRI acquisition [Campello et al., 2021]. This variation in the data distribution leads to a domain gap in FL [Li et al., 2020b], reducing the generalization performance of segmentation.

To address these challenges of data poisoning attack and domain gap, we propose AdaShield-FL, a data poisoning attack defense and evolutionary domain adaptation (DA) for federated medical image segmentation, as illustrated in Fig. 1(c). Each client in AdaShield-FL applies its own MRI data to train a local segmentation model and uploads the model weights, data covariance matrix, and training loss sequence to the central server. On the server, attack detection is employed to identify malicious clients. Based on the attack status, AdaShield-FL excludes malicious clients during global model and covariance aggregation. Each client downloads the aggregated global segmentation model, covariance, and attack status. If a client is identified as malicious, AdaShield-FL iteratively purifies the perturbed data using disentangled reconstruction and segmentation (DRS), and the segmentation model is trained on the purified data with evolutionary DA. For benign clients, the segmentation model is trained on the original data through evolutionary DA. Our source code and appendix are available at https:// github.com/alsgur0720/AdaShield. We summarized the contributions below:

• Federated Purification Framework: To our knowledge, we are the first to propose an FL framework with a purification method for malicious client's training data, allowing collaboration between different medical centres. It enhances patient data diversity and adversarial robustness in federated medical image segmentation.
• Disentangled Reconstruction and Segmentation: We observe that the k-space effectively supports the disentanglement of reconstruction and segmentation features and then propose a purification approach that isolates robust reconstruction features in the k-space, iteratively refines these features, and generates segmentation maps from the purified MRI data.
• Differential Loss-basedAttackDetection: We observe that the training loss sequence often displays anomalous patterns under adversarial perturbations and then propose a detection of malicious clients by analyzing the loss gradient and curvature, representing abnormal convergence speeds and oscillations, respectively.
• Evolutionary Domain Adaptation: We propose an evolutionary adaptive approach that aligns local and global domains by matching covariance matrices and dynamically adjusts the balance between DA and segmentation, enabling automatic and rapid optimization from nonconvex loss functions.

2 RelatedWorks

2.1 Medical Image Segmentation

Medical image segmentation [Liang et al., 2024; Campello et al., 2021; Song et al., 2024; Shi et al., 2024; Sadegheih et al., 2024; Zhou et al., 2021] is essential task in healthcare applications, facilitating accurate diagnosis, treatment planning, and disease monitoring. Specifically, designed explicitly for biomedical image analysis, U-Net introduced an encoder-decoder structure with skip connections, establishing a benchmark for segmentation accuracy. Despite these advances, current methods remain susceptible to data privacy vulnerabilities, underscoring the need for secure and robust segmentation frameworks.

2.2 Federated Learning in Segmentation

Using decentralized data, FL builds a global model focusing on privacy, which has been increasingly adopted for medical image segmentation [Guan et al., 2024; Linardos et al., 2022; Qi et al., 2022; Qiu et al., 2023]. However, these models are susceptible to adversarial attacks that compromise model performance. To overcome this limitation, we propose a purification-based FL framework for malicious clients that refines perturbed patient data.

2.3 Domain Adaptation

In federated medical image segmentation, DA [Zhang et al., 2023; Jiang et al., 2024; Pei et al., 2021] is crucial for mitigating domain gaps arising from heterogeneous data distributions due to variations in clinical centres and MRI equipment. Existing approaches include supervised DA using labeled target domain data with adversarial training and unsupervised methods focusing on translating data between domains, although these methods face challenges, such as high computational costs and instability in convergence. To overcome these obstacles, we propose an evolutionary DA that aligns local and global covariance matrices, enabling rapid optimization and stable convergence from non-convex loss functions.

2.4 Data Poisoning Attack

Adversarial attacks exploit subtle perturbations to undermine neural network robustness. Common attack methods include the fast gradient sign method (FGSM) [Goodfellow et al., 2014], which injects perturbations using the gradient of the loss function. In addition, projected gradient descent (PGD) [Madry et al., 2017] is an extension of the FGSM, that produces stronger attacks by constraining perturbations in a defined boundary. The Carlini and Wagner attack (C&W) [Carlini and Wagner, 2017] also generates adversarial examples as an optimization problem. In this study, we adopt these attacks to demonstrate the adversarial robustness of FL methods designed to defend against such attacks.

2.5 Attack Robustness in Federated Learning

A data poisoning attack involves inserting malicious data into training, significantly undermining model accuracy and posing a serious challenge to FL [Kumar et al., 2023]. Recent advancements have introduced adversarial robustness [Errami and Bergou, 2024; Yi et al., 2024; Sun et al., 2024; Cho et al., 2024; Yin et al., 2018; Zhang et al., 2022; Wu et al., 2023b; Li et al., 2020a; Hong et al., 2023]. Specifically, Yi et al. [2024] proposed an aggregation method for distributed learning using outlier-resistant one-center and onemean clustering. In addition, VFLIP [Cho et al., 2024] proposed identification and purification that operate at the inference stage, handling vertically partitioned data on FL participants. However, these approaches are inadequate in handling unseen attacks due to the constraints of adversarial training, or they face reduced patient data diversity by excluding malicious clients during training. To lessen these limitations, AdaShield-FL employs a preemptive strategy that identifies and incorporates purified malicious clients during training.

3 Threat Model

The attacker's goal is to degrade the overall model performance via an untargeted attack, resulting in a decreased Dice score across cardiac regions. To achieve this, the attacker uses adversarial examples to disrupt the training process and is assumed to have prior knowledge of the training data and model architecture in a white-box scenario [Nowroozi et al., 2025]. This scenario allows attackers unauthorized access to training data and model parameters and assumes that the attacker can compromise more than 25% of the client population. This access occurs independently of the FL mechanism, which is designed to safeguard data privacy by ensuring that raw data is not transmitted. In this study, benign clients are uncompromised, and malicious clients are altered by the external attacker. The external attacker who takes control of the local client gains access to local data and can manipulate them [Haffar et al., 2023; Kairouz et al., 2021]. Appendix D provides more details on the adversarial scenario.

4 Method

4.1 Overview

As presented in Fig. 2, the Ada-Shield-FL framework maintains patient data diversity and enhances adversarial robustness in federated medical image segmentation. In this framework, each of the N clients trains the local model using its own MRI dataset, whereas a central server performs global model aggregation over R rounds. In the first round, AdaShield-FL trains the DRS, comprising reconstruction and segmentation components, and uploads the trained segmentation model weights θ1 1,2,...,N to the server. The server also receives training Dice loss sequences L11,2,...,N and covariance matrices C 1 1,2,...,N from clients. Malicious clients are identified using differential loss-based detection with L11,2,...,N , resulting in a binary malicious status λ11,2,...,N .

According to the status, the attack-aware global model and covariance aggregations calculate global model weights θ1 global and global covariance matrix C 1 global , respectively, by excluding malicious clients. This global weight and matrix are transmitted to clients for the next round. If a malicious status is benign, the client initializes the segmentation model with θ1 global and trains it with evolutionary DA, minimizing the imbalance between segmentation and DA. In contrast, for malicious clients, their local data undergo iterative refinement via the malicious client purification process and are processed via the training process in the same way as benign clients. This overall process iterates across R rounds to enhance adversarial robustness while reducing the domain gap, resulting in a final global segmentation model once all rounds are completed. Appendix A provides overall, malicious client purification, attack detection, and evolutionary DA algorithms.

4.2 Disentangled Reconstruction and Segmentation

Based on class-specific disentangling methods [Yang et al., 2021], we extend this approach to MRI data purification and consider that adversarial attacks primarily disrupt specific tasks. Unlike existing adversarial robustness methods that exclude malicious clients, the proposed purification approach retains their data to enhance patient data diversity. Specifically, we separate the features for reconstruction and segmentation in the k-space [Sarty et al., 2001], exclude adversarially vulnerable segmentation features, and decode adversarially robust reconstruction features to purify the data for segmentation.

The preliminary study investigated the effect of adversarial attacks targeting segmentation on task-specific disentangled representations in the k-space. To this end, we first extract informative features for reconstruction and segmentation tasks from the k-space by applying the fast Fourier transform (FFT) to the MRI image, as follows:

where I(x, y) represents the MRI image at position (x, y) and s(kx(T), ky(T)) denotes the signal value obtained in the kspace coordinate (kx(T), ky(T)) at a time T, corresponding to the point in time during the MRI acquisition. Moreover, kx(T) and ky(T) are proportional to the time integral of the applied magnetic gradient fields, Gx(τ ) and Gy(τ ). The term γ denotes the ratio of the magnetic moment to its angular momentum. The frequency domain is concentrated in the central low-frequencies, whereas high-frequency regions have a sparse distribution [Yang et al., 2014]. Based on this phenomenon, we observed that the sparse k-space, which has the same properties as the frequency domain, is an ideal structure for efficiently disentangling specific tasks.

As depicted in Fig. 3, we use disentangled reconstruction features and segmentation features extracted by a disentangling encoder in the k-space domain and evaluate two types of features under adversarial attack: (1) segmentation features (fS), and (2) reconstruction features (fR). Figure 3(a and b) presents the effect of before and after applying the FGSM on the feature distributions of fS, and Figure 3(c and d) depicts the effect of before and after applying the FGSM on the feature distributions of fR. Moreover, Figure 3 reveals that perturbations cause a significant shift in the fS distribution, making it susceptible to attacks, whereas fR maintains a stable distribution regardless of perturbations.

According to this observation, as displayed in Fig. 4, the proposed approach disentangles fS and fR via an encoder trained to minimize the correlation between the two features. In the two distinct feature sets, fR is optimized for reconstruction using the mean absolute error Lrec between the reconstructed and input MRI data for training reconstruction decoder, and fS is optimized for segmentation using the Dice loss Ldice for training of segmentation decoder. To enforce independence between fR and fS, we introduce an independence loss Lind, is designed to minimize correlation between fR and fS for training of disentangling encoder as follows:

where Cov(fR, fS)k,l denotes the (k, l)-th element of the covariance matrix between fR and fS. The terms σfR,k and σfS,l denote the standard deviations of fR and fS in the kand l-th dimensions, respectively. The term h indicates the dimension of the vectors fR and fS, and ϵ denotes the stability constant (set to 10-9 ). This formulation penalizes the correlation between fR and fS, promoting their independence. The features fR and fS are transformed via the inverse FFT (IFFT), resulting in f ′R and f ′S , respectively.

In the malicious process, f ′R is iteratively purified using the reconstruction decoder for L iterations to generate the segmentation map using the purified data and segmentation decoder. For the benign process, f ′S is directly input into the segmentation decoder to generate a segmentation map. Appendix B provides the detailed architecture of the disentangling encoder and decoders, as well as visualizations of fR and fS. The trained segmentation weights and covariance matrix obtained using the disentangled feature fS are uploaded to the central server to aggregate the global model and covariance. Moreover, the training Dice loss sequence is uploaded to the server to detect malicious clients.

4.3 Differential Loss-based Attack Detection and Aggregation

To protect FL systems from data poisoning attacks, we propose a differential loss-based attack detection method analyzes anomalous patterns in training Dice loss sequences. As depicted in Fig. 5, the uploaded training loss sequence of malicious clients typically has a lower convergence speed and more oscillations than benign clients.

Two feature extractors were designed to compute the first and second derivatives and detect anomalies using a multi layer perceptron with three layers to detect malicious clients based on abnormal patterns. The gradient latent code ∆Lr1,2,...,N , representing convergence speed, is extracted using the first-order derivative extractor in the r-th round. The second-order derivative extractor creates the curvature latent code ∆2Lr1,2,...,N , representing the loss oscillation. The two resulting differential loss patterns, ∆Lr1,2,....,N and ∆2Lr1,2,...,N , are concatenated to serve as input for the anomaly detection model, outputting the malicious status.

If the i-th client is detected as malicious in the r-th round, λri = 1; otherwise, λri = 0. The server aggregates the model weights of clients using attack-aware global model aggregation (Fig. 2) as follows:

where θr denotes the weights of the global segmentation model on the r-th round, and gr i represents the gradient of the local model in the i-th client of the r-th round. Furthermore, Gr indicates the cumulative sum of squares of the gradient (momentum) Gr = Gr-1 + ∑Ni=1 (gr i )2 , and η denotes the learning rate (set to 0.01). In Eq. (4), malicious clients (λri = 1) are excluded from the aggregation.

In addition, global covariance aggregation excludes malicious clients using λr1,··· ,N to calculate the covariance matrices of exclusively benign clients. The attack-aware global covariance aggregation is formulated as follows:

where C r i represents the covariance matrix of the i-th client in the r-th round obtained by calculating the mean and covariance based on the disentangled segmentation feature fs extracted by the disentangling encoder. Moreover, µri and ρi represent the mean and number of samples for the i-th client in the r-th round, respectively, and µr represents the mean for all clients in the r-th round.

In addition, the server transmits λr1,··· ,N to clients to notify them of the attack status, C r global to align global and local covariances, and θr to initialize the segmentation model for the next training round.

4.4 Evolutionary Domain Adaptation

In Fig. 1(b), data from various equipment across clinical centres create a domain gap in FL due to variations in scanner types, in-plane resolution, and slice thickness. Existing DA methods use complete data, including features irrelevant to segmentation; hence, they tend not to guarantee the ideal alignment for the optimal segmentation performance. This work focuses on the primary segmentation task by employing disentangled segmentation features fS instead of full data in covariance matrix matching loss Lcm, as illustrated in Fig. 6.

Specifically, Lcm minimizes the data heterogeneity between clients by applying the covariance matching from disentangled segmentation features fs, as follows:

where C r global denotes the global covariance matrix in the r-th round, ∥·∥2F represents the Frobenius norm and ρ indicates the number of samples for all clients. The loss function minimizes heterogeneity by matching between the local and global covariance matrices. In this approach, because the covariance matrix does not include personal information, it is suitable for FL, which is crucial for preserving privacy.

In addition, when conventional DA is integrated with the target task, the balancing parameters of the loss function are typically determined empirically. Thus, finding the optimal balancing parameters for each client is labor-intensive, as it needs to be performed individually for every client. The following evolutionary DA approach is applied to optimize the balance automatically by dynamically combining Lcm and the segmentation Dice loss Ldice to address this problem:

where βt denotes the dynamic balancing parameter for prioritizing Ldice and Lcm, with t representing the training iteration. We adaptively prioritizes the two tasks by dynamically adjusting βt , extending the covariance matrix adaptationevolution strategy (CMA-ES) [Hansen et al., 2003] to its new application to DA. The balancing parameter βt is iteratively optimized over (g + 1) generations for each t-th iteration. In dynamic prioritizing, the candidate solutions xg+1 1,...,20 for each generation over g are sampled as follows:

where N (0, Σg ) represents a multivariate normal distribution with a zero mean and covariance matrix Σg , in the g-th generation. In Fig. 6, the lengths of the major and minor axes of the ellipse are proportional to the eigenvalues of the covariance, and their orientations are determined by eigenvectors of the covariance. Moreover, mg denotes the mean value in the g-th generation and σg indicates the step size in the g-th generation. The mean value mg+1 for the next generation is updated as follows:

where wi denotes the standard proportional weighting [Hansen et al., 2003], and xg+1 i,top denotes the top 10ranked population determined based on Eq. (7), with lower values assigned to top positions in the ranking. Furthermore, the balancing parameter βt is set to mg+1 if the update magnitude of mg+1 is less than ϵcma (set to 10-5 ), according to the following condition:

Unless the condition in Eq. (10) is met, dynamic prioritizing continues as in Eqs. (8) and (9). This automatic balance enables Ltotal to achieve efficient optimization and convergence by adaptively prioritizing segmentation and DA.

5 Experiments

5.1 Dataset

The experiments employed a dataset created by combining M&Ms [Campello et al., 2021], a multi-vendor dataset, including Siemens, Philips, GE, and Canon, established from 375 participants, and ACDC [Bernard et al., 2018], a singlevendor (Canon) dataset, established from 150 participants. Both datasets consist of cardiac MRI sequences, with each patient having 21 frames. Moreover, each dataset comprises data from six centres and includes four disease labels: "dilated cardiomyopathy", "hypertrophic cardiomyopathy", "abnormal right ventricle", and "normal". It also provides three target labels for segmentation: "left ventricle", "right ventricle", and "myocardium". Additionally, AdaShield-FL is trained for eight clients (N = 8), with four clients using the M&Ms dataset and the other using the ACDC dataset.

5.2 Implementation Details

The experiments follow a standard federated-by-dataset scenario [McMahan et al., 2017], where each client constructs their own dataset and collaborates in FL with a central server. All experiments were conducted in PyTorch with two Nvidia H100 GPUs. This study employs stochastic gradient descent optimization with a momentum of 0.9 and a learning rate of 0.001 for training. AdaShield-FL was trained for 500 global rounds (R = 500), setting L to 3 in the malicious client purification. Appendix B provides quantitative and qualitative experimental results for the hyperparameter L.

5.3 Results and Analysis

This work compares AdaShield-FL with existing FL methods designed for adversarial robustness, including methods by Yi et al. [2024], Karimireddy et al. [2021], Li et al. [2020a], IOS [Wu et al., 2023b], and FedRBN [Hong et al., 2023] on the M&Ms and ACDC datasets, as listed in Tables 1 and 2. This study adopts widely used adversarial attacks for the image segmentation task, such as FGSM, PGD, and C&W.

In addition, the backbone network for the widely used segmentation proposed by Zhou et al. [2021] was employed. For each experiment, two malicious clients were randomly selected. Appendix B provides the comparison results when more clients are perturbed. These models were trained and evaluated from scratch, following the experimental settings outlined by the authors, using their provided open-source codes. In all tables, the best scores are in bold.

In Tables 1 and 2, AdaShield-FL demonstrates superior segmentation performance in terms of the average Dice score coefficient compared to other adversarial robustness-based FL methods. It is attributed to purifying and incorporating malicious clients' data into the training process, enhancing model robustness and patient data diversity. Furthermore, outperforming other FL methods when trained with benign data demonstrates the effectiveness of evolutionary DA.

In addition, Table 3 compares the accuracy of attack detection methods for identifying benign and malicious clients. Compared to existing approaches, such as IOS, Yi et al., Karimireddy et al., and Li et al., AdaShield-FL consistently provides more reliable performance in terms of recall and precision, demonstrating its robustness against data poisoning attacks and effectiveness of Dice loss sequence.

Furthermore, Table 4 reveals the performance of FL adversarial robustness models integrated with DA methods. This experiments employs IPLC [Wu et al., 2023a] and UPLSFDA [Zhang et al., 2024] for DA. Further, it employs the model by Karimireddy et al. and IOS, byzantine aggregation methods that can be integrated with DA models for federated medical image segmentation. As a results, the proposed model consistently outperforms Karimireddy et al. and IOS combined with DA methods. These results highlight the effectiveness of covariance matrix matching loss via fS and evolutionary DA in enhancing segmentation performance.

Table 5 compares FL methods regarding floating-point operations per second (FLOPs), Params, convergence rounds, and training time, with eights clients. In these methods, the common segmentation model [Zhou et al., 2021] with 42 GFLOPs and 1.8M Params is used for each client. Since the disentangling encoder in AdaSheild-FL operates in the k-space, which is inherently sparse, the FLOPs are reduced to 33 GFLOPs compared to the original segmentation encoder. Although AdaShield-FL introduces additional parameters due to its reconstruction decoder (0.9M Params for each client) and attack detection (0.3M Params for central server), it achieves the fastest convergence (470 rounds), the shortest total training time (7.8 h), and the fewest total operating points (326 GFLOPs). This improved computational efficiency is attributed to the use of evolutionary DA, which enables automatic and rapid optimization from non-convex loss functions and the disentangling encoder in the k-space. Moreover, Appendix C offers visual qualitative segmentation results and Appendix E presents limitations and future work.

5.4 Ablation Study

This section analyzes the performance of each component in AdaShield-FL. In Table 6, the checkmark (✓) indicates that a module was activated. The first row shows the performance of AdaShield-FL, incorporating all modules. The second and third rows report the results when malicious client purification and evolutionary DA are excluded, respectively. The fourth and fifth rows report the results when only evolutionary DA and differential loss-based attack detection are included, respectively. Last, the final row displays the backbone performance. Comparing the first and remaining rows reveal that each proposed module improves performance.

Furthermore, Table 7 illustrates the influence of β in the evolutionary DA on the Dice score. The balancing parameter β controls the priority between the Dice and DA loss. In Table 7, the evolutionary strategy outperforms several fixed values of β. This is attributed to the ability of the evolutionary DA to dynamically adjust β during training, ensuring an optimal balance between segmentation and DA. Appendix B includes additional ablation studies, experiments that highlight the effectiveness of Lind, and experiments on another modality, the computed tomography (CT) dataset.

6 Conclusion

This paper addresses the critical challenges posed by the retained data poisoning attacks and data heterogeneity in federated medical image segmentation. We propose AdaShieldFL, a comprehensive framework that integrates k-space disentangled purification, attack detection, and evolutionary DA to address these problems. AdaShield-FL identifies malicious clients, purifies malicious clients, and matches data distributions to improve segmentation accuracy in the FL framework. The experimental results demonstrate that AdaShield-FL outperforms existing FL methods, achieving state-of-the-art performance on the M&Ms and ACDC datasets while achieving computational efficiency and rapid convergence.

Acknowledgments

This work was supported by the IITP grant funded by the Korea government (MSIT) (No.2021-0-02068, RS-202300256629, RS-2022-00156287, RS-2024-00437718).