Security Analysis of a Federated Learning Framework for Medical Image-to-Image Translation

Clinical Snapshot

Key Findings

• P Value: Not reported

• Effect Size: FedMIA AUC 0.92–0.99 (pre-defence); SecAgg reduced AUC to 0.23–0.56 (near-random). DLG SSIM ≤ 0.16, PSNR ≤ 11 dB across all clients.

• Primary Outcome: Federated MRI-to-sCT translation frameworks are not inherently privacy-preserving; FedMIA achieved high membership inference discrimination (AUC 0.92–0.99), representing a critical privacy vulnerability. DLG reconstruction was limited (SSIM ≤ 0.16, PSNR ≤ 11 dB). High-noise data poisoning rendered FedAvg inoperative; FedMedian restored near-baseline performance in most configurations.

• Nnt Or Sensitivity: Diagnostic analogue: FedMIA sensitivity/specificity equivalent to AUC 0.92–0.99 for membership inference (high discriminative performance indicating severe privacy breach); post-SecAgg AUC 0.23–0.56 indicates near-chance discrimination (effective privacy restoration)

• Confidence Interval: Not reported

Clinical Application

The defence mechanisms evaluated (SecAgg, FedMedian) are implementable within existing federated learning frameworks. However, real-world deployment requires additional infrastructure investment, computational resources, and governance frameworks. Low-level stealthy poisoning attacks remain a partially unresolved challenge. Implementation feasibility in resource-constrained settings (e.g., regional hospitals) is not addressed. Australian healthcare institutions participating in federated AI research (e.g., through the Australian Alliance for Artificial Intelligence in Healthcare, CSIRO's Australian e-Health Research Centre, or state-based health informatics networks) should treat this study as a critical security audit template. The Australian Privacy Act 1988 and the My Health Records Act 2012 impose strict obligations on health data handling; federated learning frameworks assumed to be inherently privacy-preserving may not meet these obligations without explicit cryptographic safeguards such as SecAgg. The TGA's emerging regulatory framework for Software as a Medical Device (SaMD) and AI/ML-based medical devices will increasingly require documented security validation for clinical AI systems. RACGP and RANZCR members involved in AI-assisted imaging should advocate for mandatory security auditing of federated frameworks prior to clinical deployment. PBS and MBS implications are indirect but relevant: if federated AI systems are used to support MRI or radiation therapy planning workflows, their security failures could have medico-legal and patient safety consequences. Healthcare institutions and research consortia deploying or planning to deploy federated learning frameworks for medical image processing, particularly MRI-to-synthetic CT translation for radiation therapy planning, neuroimaging research, or multi-site clinical AI development

Abstract

Federated Learning (FL) emerged as a privacy-preserving paradigm for collaborative training of deep learning models across institutions without sharing patient data. This approach has been applied to complex tasks such as medical image-to-image (I2I) translation, including MRI-to-synthetic CT (sCT) generation. However, existing federated I2I frameworks often assume privacy preservation as an inherent property of FL rather than a requirement to be explicitly validated, leaving their robustness to representative adversarial threat scenarios largely unexplored. In this study, we evaluated the vulnerability of a federated MRI-to-sCT translation framework (FedSynthCT-Brain) to three representative attack classes: Deep Leakage from Gradients (DLG), Federated Membership Inference Attack (FedMIA), and data poisoning. The efficacy of corresponding defense mechanisms, such as Secure Aggregation (SecAgg) and Byzantine-robust median aggregation (FedMedian), were assessed. DLG enabled only the recovery of coarse anatomical structures, with no clinically identifiable details (SSIM ≤ 0.16, PSNR ≤ 11 dB) across clients, suggesting limited vulnerability under the evaluated DLG setting. In contrast, FedMIA achieved high membership discrimination, with AUC scores between 0.92 and 0.99, revealing a critical privacy vulnerability. The introduction of SecAgg reduced AUC values to near-random levels (0.23-0.56) across all centers without impacting synthesis quality. Under high-noise poisoning, the standard federated averaging (FedAvg) aggregation rendered the federation inoperative, while FedMedian restored performance close to the no-poisoning baseline in most scenarios, with significant residual degradation in specific center configurations. At low noise levels, the advantage of FedMedian was less consistent, as low-level noise injection may be indistinguishable from natural heterogeneity across centers, potentially enabling stealthy degradation. These findings demonstrate that federated I2I translation frameworks are not inherently secure and require explicit, multi-layered evaluation. As FL is increasingly adopted in clinical workflows, our results underscore the necessity of integrating cryptographic, algorithmic, and infrastructural safeguards for secure deployment.

References

1. 1.Raggio, C. B., Bucher, L., Blanck, O., Cicone, F., Zaffino, P., & Spadea, M. F. (2026). Security analysis of a federated learning framework for medical image-to-image translation. Journal of Medical Systems. https://doi.org/10.1007/s10916-026-02436-8