Federated Learning: Countering Label Flipping Attacks in Retinal OCT

With the increasing digitization of healthcare data, Federated Learning has emerged as a promising approach for collaborative model training across decentralized devices while preserving data privacy. In the context of healthcare, this also promotes digital sovereignty by enabling hospital, to maintain control over sensitive patient data, adhere to local regulations, and build trust in AI-driven technologies, particularly federated learning. However, Federated Learning systems are vulnerable to various data poisoning attacks. Label flipping attack is a targeted poisoning attack where the attackers poison client's training data by flipping some or all the labels of source class to a target class, thus negatively impacting the performance of the global model. This project aims to determine the impacts of label flipping attacks and various methods to mitigate them. For the experiment, Retinal Optical Coherence Tomography (OCT) Images from five institutes are used as dataset. The Federated Learning model uses CNN-VGG16 architecture for local model training. The label flipping attack is launched in the Federated Learning system by flipping the source label to a target label with varying percentages and labels. To mitigate the effect of label-flipping attack four aggregation models namely median, trimmed-mean, krum and k-means clustering is explored. Results showed that the krum aggregation method was the most effective in mitigating the impact of the attack for all attack percentages and particularly at higher attack percentages, where its robustness becomes more evident.