Method, implementation, and evaluation paper (preprint). Published on arXiv — arXiv:2609.14290 (cs.CR, cross-list cs.LG) — and mirrored on Zenodo, DOI: 10.5281/zenodo.22732363. Open-source implementation: aegis-scan.
Abstract
Machine learning models are increasingly deployed in healthcare imaging pipelines for diagnostic support, yet the security of these models against training-time attacks — particularly data poisoning and backdoor insertion — remains substantially under-tested relative to their growing deployment. Spectral signature analysis (Tran et al., 2018) and activation clustering (Chen et al., 2018) are two established backdoor-detection techniques routinely evaluated as independent baselines, but their outputs are not ordinarily combined, and reported detection performance on medical imaging benchmarks remains sparse relative to the natural-image setting. This paper contributes three things: a score-level fusion rule that combines per-class spectral ranking with activation-clustering flags into a single per-sample poisoning score, together with a model-level detector-agreement statistic; an open-source implementation of the resulting eight-stage detection pipeline (aegis-scan) covering dataset loading, poison injection, classifier training, activation extraction, detection, fusion, evaluation, and assurance-report generation; and an evaluation across two public benchmarks — PneumoniaMNIST (healthcare imaging) and CIFAR-10 (natural images) — at poisoning rates of 0%, 1%, 5%, and 10%, over five random seeds. The fused detector reaches AUROC ≥ 0.996 on PneumoniaMNIST across all tested poisoning rates and AUROC ≥ 0.963 on CIFAR-10 at 1% and 5% poisoning, but both individual detectors degrade sharply on CIFAR-10 at 10% poisoning (fused AUROC falls to 0.545), a limitation we report rather than obscure. We frame the resulting evidence against the NIST AI Risk Management Framework's Measure function and the MITRE ATLAS adversary technique taxonomy (AML.T0020, AML.T0059, AML.T0018), producing per-run assurance reports directly usable by healthcare security teams rather than requiring translation from research notation.
1. Introduction
AI adoption in healthcare imaging — diagnostic support for radiology, dermatology, and pathology — has accelerated faster than the security tooling needed to validate these systems before deployment. This is no longer a theoretical concern: healthcare-sector guidance published in late 2025 by the Health Sector Coordinating Council's Cybersecurity Working Group, a coalition of more than 400 healthcare organizations, explicitly identifies "model poisoning, data corruption, and adversarial attacks" as threats requiring dedicated incident-response and secure-by-design defenses for AI-enabled medical devices. Executive Order 14409 (June 2026) similarly directs federal agencies to expand access to AI vulnerability-detection tools for critical infrastructure operators, explicitly naming rural hospitals among the intended beneficiaries. Independently, recent academic work — Abtahi, Seoane, Pau, and Vega-Barbas's analysis of data poisoning vulnerabilities across healthcare AI architectures (2025/2026) — has begun documenting the scope of the underlying technical vulnerability across a range of clinical AI system designs.
What remains missing is the connective layer: an openly available, independently validated detection methodology, benchmarked specifically on healthcare imaging data, that produces output mapped to the frameworks (NIST AI RMF, MITRE ATLAS) that healthcare security and compliance teams already use. This paper's contribution is to specify that methodology, implement it as an open-source pipeline, and report its measured detection performance rather than leaving it as an unvalidated proposal.
2. Background and Related Work
Data poisoning and backdoor attacks. Data poisoning attacks corrupt a model's training data to induce incorrect behavior; backdoor attacks are a stealthier subclass in which a hidden trigger pattern causes targeted misclassification while leaving the model's behavior on clean inputs unaffected, making them difficult to detect through ordinary validation-set accuracy checks.
Detection techniques. Two detection approaches are foundational to this proposal. Tran, Li, and Madry (2018), "Spectral Signatures in Backdoor Attacks" (NeurIPS 2018; arXiv:1811.00636), show that poisoned training examples leave a detectable signature in the spectrum of a network's learned feature representations, enabling identification of poisoned samples without prior knowledge of the trigger. Chen et al. (2018), "Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering" (arXiv:1811.03728), propose clustering a network's internal activations to separate poisoned from clean examples on the basis that poisoned examples activate the network via a different internal pathway than genuinely-labeled examples, even when final-layer outputs look identical. Both methods are well-established individually; to our knowledge, neither has been systematically benchmarked, combined, or validated specifically against public healthcare imaging datasets, which is the gap this work addresses.
Vulnerability landscape. Abtahi et al.'s security threat analysis (arXiv:2511.11020; published in the Journal of Medical Internet Research, 2026) surveys data poisoning vulnerabilities across a range of healthcare AI architectures and proposes analytical security framework and defense strategies at a conceptual level. This paper is complementary rather than overlapping: where Abtahi et al. analyze and categorize the vulnerability landscape, this work specifies and evaluates a concrete, reproducible detection methodology against it.
Policy and governance context. The NIST AI Risk Management Framework organizes AI risk management into four functions — Govern, Map, Measure, and Manage — of which Measure (technical testing and quantification) is the function this work directly serves; governance frameworks such as ISO/IEC 42001 provide organizational policy structure but do not themselves supply technical validation evidence. MITRE ATLAS catalogs adversary tactics and techniques against AI systems in a structure analogous to MITRE ATT&CK, providing a shared vocabulary for reporting findings that this work adopts for output reporting; the data-poisoning attacks addressed here correspond to MITRE ATLAS technique AML.T0020, which covers the poisoning of a model's training data.
3. Detection Methodology
The pipeline applies spectral signature analysis and activation clustering in combination to a trained image-classification model and its training set, producing (a) a per-sample poisoning-likelihood score and (b) an aggregate, model-level detector-agreement statistic. A score-level fusion rule combines per-class spectral ranking with activation-clustering flags into the single per-sample score. Combining both techniques reduces false negatives relative to either method alone, since the two techniques exploit different structural properties of poisoned data (spectral outliers in feature-space representation vs. divergent activation-clustering behavior).
The implementation (aegis-scan, open-source) runs as an eight-stage pipeline — dataset loading, poison injection, classifier training, activation extraction, detection, fusion, evaluation, and assurance-report generation — using standard convolutional architectures instrumented to extract the intermediate-layer activations and feature representations both detection methods require.
4. Evaluation
Datasets. Evaluation uses two public benchmarks requiring no data-use agreement or institutional partnership: PneumoniaMNIST as the healthcare-imaging benchmark, and CIFAR-10 as a non-healthcare natural-image benchmark, to test whether detection performance generalizes across settings.
Attack simulation. Because access to real-world poisoned healthcare data is neither available nor desirable to seek out, poisoning was simulated by injecting synthetic backdoor triggers into training data at 0%, 1%, 5%, and 10% of training samples, across five random seeds per configuration (40 runs total), to produce a controlled ground truth against which detection accuracy is measured.
Results. On PneumoniaMNIST, the fused detector achieves AUROC ≥ 0.996 at every tested poisoning rate (1%, 5%, 10%), with the detector-agreement statistic at 100% precision throughout. On CIFAR-10, the fused detector reaches AUROC 0.968 at 1% poisoning and 0.963 at 5%, but collapses to AUROC 0.545 (near chance) at 10% poisoning, driven by activation clustering's true-positive rate dropping to 0% under that specific class-imbalance condition — even though attack success rate confirms the backdoor is fully learned (97.2%) at that rate. This is a genuine, disclosed limitation of the clustering method's minority-fraction assumption, not a fusion-rule failure, and is reported as such rather than smoothed over.
Metrics and reporting. Detection performance is reported as AUROC, true-positive rate, false-positive rate, and precision for identifying poisoned samples at each poisoning rate, alongside the aggregate detector-agreement statistic. Each run additionally produces a structured assurance report mapped to MITRE ATLAS technique IDs (AML.T0020, AML.T0059, AML.T0018) and framed explicitly as NIST AI RMF Measure-function (2.7) output.
Release. The implementation is released as an open-source tool (github.com/tsurace37/aegis-scan) alongside this paper, so findings are independently reproducible and the tool itself is usable by others rather than existing only as a research artifact.
5. Discussion and Limitations
This evaluation has a deliberate and disclosed limitation: testing on synthetically poisoned public benchmarks demonstrates detection capability under controlled conditions but does not, by itself, establish performance against real-world, adversarially-optimized poisoning attempts, which may be designed specifically to evade known detection signatures. This is a limitation shared by essentially all published backdoor-detection literature to date, given the practical and ethical constraints on accessing real poisoned production data. The CIFAR-10 10%-poisoning result above is a second, distinct limitation worth naming on its own: it shows the fusion rule is only as robust as its weakest component detector under specific class-imbalance conditions, and that this can occur even while the underlying attack succeeds with near-total effectiveness. Extending evaluation toward adaptive/adversarially-aware poisoning strategies, toward detector combinations more robust to the clustering failure mode identified here, and toward real pilot deployments with willing healthcare or critical-infrastructure partners, is identified as future work rather than claimed as already accomplished.
6. Conclusion and Future Work
This paper specifies, implements, and evaluates a fusion-based detection methodology for identifying data poisoning and backdoor attacks in healthcare imaging AI, combining two established detection techniques not previously benchmarked together on public healthcare imaging data, and frames its output against frameworks (NIST AI RMF, MITRE ATLAS) already in use by healthcare security teams. The open-source aegis-scan implementation and the full 40-configuration evaluation grid accompany this paper so results are independently reproducible.
References
[1] Tran, B., Li, J., & Madry, A. (2018). Spectral Signatures in Backdoor Attacks. Advances in Neural Information Processing Systems (NeurIPS) 31. arXiv:1811.00636.
[2] Chen, B., Carvalho, W., Baracaldo, N., Ludwig, H., Edwards, B., Lee, T., Molloy, I., & Srivastava, B. (2018). Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering. arXiv:1811.03728.
[3] Abtahi, F., Seoane, F., Pau, I., & Vega-Barbas, M. (2026). Data Poisoning Vulnerabilities Across Healthcare AI Architectures: A Security Threat Analysis. Journal of Medical Internet Research, 2026;1:e87969. arXiv:2511.11020.
[4] Health Sector Coordinating Council Cybersecurity Working Group. (2025). AI Cybersecurity Guidance for the Health Sector (guidance series, publication beginning November 2025).
[5] Executive Order 14409, Promoting Advanced Artificial Intelligence Innovation and Security (June 2, 2026).
[6] National Institute of Standards and Technology. AI Risk Management Framework (AI RMF 1.0).
[7] MITRE ATLAS. Adversarial Threat Landscape for Artificial-Intelligence Systems. atlas.mitre.org.
Suresh Tamang
Graduate researcher in Artificial Intelligence at the University of the Cumberlands, based in Fort Worth, Texas, focused on the security and trustworthiness of AI systems deployed in healthcare and other critical infrastructure.