Invisible poison attacks and holistic defence strategy for pyramid vision transformers in medical imaging

Abstract

Machine learning models, especially vision transformers in the domain of medical images, are highly prone to data poisoning attacks, in which a small proportion of adversarial samples is injected into the model’s training dataset to manipulate its behavior. Existing data poisoning techniques have their limitations in terms of the presence of noticeable artifacts in the injected samples or their vulnerability to preprocessing transformations. Similarly, most defence techniques have their limitations in terms of robustness to different types of poisoning attacks. To overcome these challenges, this research presents a structurally embedded invisible poisoning attack technique and a Holistic Defence Strategy (HDS) for the Pyramid Vision Transformer (PVT) model. In this research, the proposed invisible poisoning attack technique takes advantage of the structural characteristics of images, specifically the edges of images, as invisible carriers of trigger information. The proposed attack technique develops a Deep Multi-Scale U-Net Injection Network (DMS-UNet-IN) to embed the trigger information in images in an invisible manner. The proposed attack technique differs significantly from traditional trigger-based techniques in terms of the alignment of perturbations with structural manifolds. The Holistic Defence Strategy (HDS) develops a discriminative detection boundary in the feature space using a mimic model with an attention-aware generative adversarial network. The proposed invisible poisoning attack technique was evaluated using Radiology, Ophthalmology, and Pathology datasets. The experimental evaluation of the proposed invisible poisoning attack technique showed its superiority in terms of invisibility, with a PSNR value of 43.46 dB and SSIM value of 0.9925, over the state-of-the-art techniques such as DeepPoison (40.91 dB) and SPM (38.16 dB). The proposed Holistic Defence Strategy was evaluated using static poisoning rates ranging from 5 to 30%. The experimental evaluation of the proposed Holistic Defence Strategy showed its superiority over the state-of-the-art techniques such as CD, DUTI, and TRIM in terms of detection accuracy up to 95.8% with an F1-score of more than 0.95. The superiority of the proposed technique was also evident in terms of up to 17% improvement over the baseline techniques at higher levels of contamination.

Introduction

In addition to showcasing expert-level performance in a variety of medical image analysis tasks, including tumor segmentation, diabetic retinopathy detection, and skin lesion diagnosis, vision transformers and Deep Neural Networks (DNNs) have built on their success in natural image processing^1,2,3,4,5. Even though deep learning has appeared as a promising tool for basic research across several fields, it still suffers from adversarial attacks^6,7. Adversarial attacks can be broadly categorized into multiple sorts according to their methods and goals. Poisoning attacks and evasion attacks are two of the most prevalent kinds^8,9. The evasion attacks target the deep learning prediction process, wherein the attacker crafts an adversarial example that could be wrongly classified by the classifier. However, when training a deep learning model, a poisoning attack takes place. In this case, the attacker lowers the trained model’s predictive accuracy by inserting malicious samples into the training dataset^10,11,12,13.

Depending on how the poison samples are created, the poisoning attacks might be either patch- or feature-dependent. In a patch-basis poisoning attack such as Blended Injection Strategy (BIS), Accessory Injection Strategy (AIS), and BadNets, the creation of static patches is implanted in the pixel region of the Non-toxic sample¹⁴. Building a poisoning attack may generally be framed as a bilevel optimisation problem with various assumptions (e.g., black-box and white-box)^15,16. By optimizing the losses on known validation data, the attacker aims to create false training data. Then, using these carefully constructed poisoning samples, the target model is retrained. In this way, different sophisticated poisoning attack techniques are introduced against machine learning models to find the best balance between the pivot losses of validation data and the learning objective of the target model^17,18.

Unfortunately, the premise behind all of the existing poisoning attack strategies is that the attackers already possess a validation dataset with the same distribution as the training data. It should be mentioned that with careful data manipulation and model poisoning attacks, the joint learning model can converge to the point where attackers are hard to spot. Creating a defence strategy is essential to preventing poisoning attacks on the visual transformer system^19,20. Several countermeasures against data poisoning have been developed in response to the poison threat concept. Differential privacy (DP) based certified protections introduce noise to the training data or the gradients that the optimizer uses, thereby provably desensitizing models to modest changes in the data. It is not possible to determine whether a small collection of data points was included in the training set by observing model behaviours when a model is trained using sufficiently strong DP. Consequently, it is also not possible to significantly change model behaviours by adding a small number of poisoned samples^21,22,23.

Recently, numerous defence strategies have been studied to defend poisoning attacks. Data sanitization is a widely used and frequently successful defence against data poisoning attacks. Anomaly detectors are used to filter out training points that seem suspicious²⁴. According to earlier research, attacks that are tailored to avoid data sanitization may actually be able to avoid some defences, while attacks that are not tailored can be quickly identified as abnormalities. This raises the question of whether attackers trying to avoid anomaly detection can circumvent data sanitization protections²⁴. Sanitization eliminates anomalies but does not introduce new variants to improve the model’s ability to generalize. Data augmentation artificially increases the variety of a training set by applying alterations like flipping, rotation, scaling, and color changes to increase a model’s generalization capability to unknown data²⁵. By doing this, overfitting is lessened and the model becomes more resilient to changes in the input data.

One good way to prevent poisoning assaults is to use Generative Adversarial Networks (GANs) for data augmentation^26,27. GANs can assist lessen the effects of such attacks by adding realistic, synthetic data to the training dataset, which increases the model’s robustness and lessens the influence of tainted data. The majority of current GAN-based poisoning attack defences suffer from the following three issues: 1) Reliance on validation datasets; 2) Incapacity to handle gradual poisoning attacks; and 3) Breach of privacy. Furthermore, the majority of current defences are primarily attack-specific. Because they follow different concepts, they may not work against other kinds of attacks and are designed for a specific type. This paper proposes a Holistic Defence Strategy (HDS) to tackle this issue. The key contributions of this work are outlined as follows:

• To propose new invisible poison attack based on deep injection aided trigger generation method.

• To introduce a deep multi-scale UNet based injection network (DMS-UNet-IN) for concealing the trigger pattern gradually

• To develop a holistic defence strategy (HDS) based on Synthetic Data generation models with Attention-aware GAN network

• To validate the suggested attack creation and defence strategy on three different medical imaging applications including Ophthalmology, Radiology and pathology.

The rest of the paper is structured as follows: A review of recent research on poisoning attacks and defence strategies is given in Section “Literature survey”. A thorough description of the suggested approach is provided in Section “Proposed method”. The performance analysis of the suggested model is shown in Section “Results and discussion”. The paper is finally concluded in Section “Conclusion”.

Literature survey

Trigger-based backdoor attacks

Poisoning attacks initially used explicit trigger injection. In the paper “BadNets: On the Security of Neural Networks,” the Blended Injection Strategy (BIS)²⁸ was proposed, which used a patch-based trigger to implement the backdoor attack³⁶. BIS achieved a high attack success rate and noticeable distortions in the images. On the Radiology data set, BIS achieves a PSNR of 27.06 dB and a SSIM of 0.9923. In the Blended Injection Strategy, the trigger pattern and the background of the images are combined to implement the attack, making the trigger pattern less noticeable. However, the attack achieves a PSNR of 25.14 dB and a SSIM of 0.8975, indicating a decrease in the quality of the images. Refool²⁹ uses reflection-based triggers to implement the attack, making the trigger pattern least noticeable. Refool achieves a PSNR of 16.72 dB and a SSIM of 0.7702, making the trigger pattern most prone to preprocessing-based detection methods. Though Refool has improved the concealment of the trigger pattern, the trigger pattern remains separable from the clean images.

Clean-label poisoning attacks

Shafahi et al.³⁰ proposed the Poison Frog method, which uses optimisation to implement the attack. In the paper “Poison Frogs! Certified Robustness Against Adversarial Lives,” the author demonstrated the feasibility of using a single adversarial example to influence the decision boundary of the classifier using the transfer learning method. Quantitatively, the proposed method achieves a PSNR of 31.62 dB and a SSIM of 0.9541, indicating the improved invisibility of the trigger pattern. Though the trigger pattern has improved invisibility, the trigger pattern remains constrained by the optimisation method.

Imperceptible and GAN-based poisoning methods

To further enhance the imperceptibility of the adversarial samples, GAN-based poisoning techniques have also been introduced. In the Deep Poison method³¹, a double-discriminator adversarial method is used to produce more imperceptible samples. In the case of medical images, the method was found to produce samples with a PSNR value of 40.91 dB and a SSIM value of 0.9842. It was also seen to outperform previous trigger-based poisoning methods. In the SPM method, the PSNR value was found to be 38.16 dB with a SSIM value of 0.9746. However, despite their high perceptual similarity to the original images, these methods have the potential to introduce semantically redundant features. In addition, they do not restrict the perturbations to the intrinsic structural manifolds of the images, thereby limiting their robustness to feature-space scrutiny.

Data sanitization and certified defences

Several defence techniques have also been introduced to detect the presence of adversarial samples in the dataset. The Certified Defence method³², introduced to defend against pGAN attacks, was seen to produce detection accuracies of about 63% over a range of poisoning rates from 5 to 30%. In the case of the TRIM method, its performance was seen to be relatively stable at about 77% over robust (R) attack settings. However, the method lacks adaptability to different types of attacks. The DUTI method was seen to enhance the detection accuracy to 87.3% at a 30% poisoning rate for label-flipping (LF) attacks. However, its performance was seen to degrade in the presence of structurally embedded perturbations.

Mimic-model and GAN-based defences

The mimic-model defence was proposed in De-Pois³³ based on the idea of GAN-based data reconstruction. Although more generalizable, the use of conventional GAN training may also bring instability in the boundary estimation between clean and poisoned data.

Identified theoretical gap

From both structural analysis and quantitative evaluation, we can clearly identify the following limitations of the existing methods: (i) Attack-Side Limitation: The existing methods can only achieve low PSNR perturbations (e.g., 16.72 dB in Refool) or rely on generic GAN synthesis. Although the state-of-the-art method Deep Poison achieves 40.91 dB, it does not constrain perturbations on intrinsic edge manifolds. (ii) Defence-Side Limitation: The existing defence methods also show inconsistent robustness under different poisoning rates. For example, although the detection accuracy of CD remains around 63%, the detection accuracy of DUTI reaches 87.3% under 30% label flipping poisoning. The proposed structurally embedded poisoning framework achieves 43.46 dB PSNR and 0.9925 SSIM on Radiology, Ophthalmology, and Pathology datasets. This is + 2.55 dB better than the state-of-the-art method Deep Poison and + 16.4 dB better than BadNets. The proposed defence method achieves 95.8% detection accuracy under 30% label flipping poisoning. This is + 17.6% better than CD, + 8.5% better than DUTI. The detection accuracy of our method remains above 90% under heterogeneous attacks.

Proposed method

Poisoning attacks compromise machine learning systems by inserting a small number of malicious samples into the training dataset. The objective of the proposed attack is to construct an imperceptible yet effective backdoor mechanism that causes the trained model to misclassify any input containing a hidden trigger into a predefined target label, while maintaining normal performance on clean data.

As illustrated in Fig. 1, the attacker modifies a fraction of the training samples prior to the training phase. The modified images contain embedded trigger patterns and are relabeled with a target class chosen by the attacker. The attacker does not modify the model architecture, loss function, or optimisation process. After training on the poisoned dataset, the model behaves normally on clean inputs but predicts the attacker-defined target label when the trigger is present during inference.

Fig. 1

Attack generation and defence strategy.

Threat assumptions

We consider a realistic and restricted threat model: The attacker has access to the training dataset before training. A small portion of samples can be modified and relabelled. The attacker has no access to model parameters, gradients, or internal training mechanisms. The attacker cannot influence the training algorithm.

Let the clean dataset be defined as:

$${\mathcal{D}} = \left\{ {\left( {s_{i} ,y_{i} } \right)} \right\}_{i = 1}^{N}$$

(1)

A small poisoning ratio $\rho$ is selected, where $\rho \ll 1$. For selected samples, a trigger embedding transformation $\mathcal{T}(\cdot )$ is applied:

$$s_{i}^{poi} = {\mathcal{T}}\left( {s_{i} } \right)$$

(2)

The poisoned samples are assigned a predefined target label ${y}_{t}$. The final poisoned dataset becomes:

$${\mathcal{D}^{\prime}} = \left( {{\mathcal{D} \setminus \mathcal{D}}_{poi} } \right) \cup \left\{ {\left( {s_{i}^{poi} ,y_{t} } \right)} \right\}$$

(3)

The Pyramid Vision Transformer (PVT) is selected as the victim model due to its strong global representation capability and relevance in medical image classification applications³⁸.

Deep injection-aided trigger generation method

The proposed poisoning framework consists of two sequential stages: (i) Edge-guided trigger pattern generation, (ii) Deep multi-scale injection of the trigger into clean images. The complete pipeline is shown in Fig. 2. Unlike conventional static patch-based backdoor attacks, the proposed approach generates data-dependent trigger patterns embedded within intrinsic image structures. This design enhances imperceptibility and reduces detectability.

Fig. 2

Deep injection aided trigger generation method.

Trigger pattern generation

Instead of using visible fixed patches, the proposed method utilizes image edge structures as carriers for the trigger. Edges are natural high-frequency components and therefore provide a suitable region for subtle modifications.

For a given clean image ${s}_{i}$, an edge extraction operator $\xi (\cdot )$ (e.g., Sobel operator) is applied:

$$E_{i} = \xi \left( {s_{i} } \right)$$

(4)

The poison information is encoded into an RGB mapping vector ${C}_{i}^{poi}$. The trigger pattern ${t}_{i}$ is generated by assigning the encoded values to edge pixels:

$$t_{i} = E_{i} \otimes C_{i}^{poi}$$

(5)

where ⊗ represents a color padding operation that applies the poison encoding to detected edge regions.

This design provides several advantages: The trigger is spatially distributed rather than localized. It is input-dependent and varies across samples. It avoids the fixed spatial consistency assumed by many detection methods. It improves resistance to patch-based defence strategies. To increase diversity and robustness, different color encodings ${C}_{i}^{poi}$ are randomly selected across samples. This enables both single-target and multi-target attack configurations.

Deep multi-scale UNet-based injection network

After constructing the trigger pattern ${t}_{i}$, it must be embedded into the clean image in a visually imperceptible manner. For this purpose, a Deep Multi-Scale UNet-Based Injection Network (DMS-UNet-IN) is employed.

The poisoned image is generated as:

$$s_{i}^{poi} = {\text{ DMS\_UNet\_IN }}\left( {s_{i}^{c} ,t_{i} } \right)$$

(6)

where: ${s}_{i}^{c}$ is the clean image, ${t}_{i}$ is the generated trigger pattern.

The architecture of DMS-UNet-IN is illustrated in Fig. 3. The network is derived from a UNet backbone with multi-scale feature enhancement. The bottleneck layer integrates modified Res2Net modules to capture hierarchical multi-scale representations. Standard $3\times 3$ convolutions are replaced with grouped smaller convolutions to improve receptive field diversity.

Fig. 3

Architecture of DMS-UNet-IN.

Additionally, Squeeze-and-Excitation (SE) modules are incorporated to recalibrate channel-wise feature responses. Let the intermediate feature map be divided into $x$ subsets ${\left\{{f}_{j}\right\}}_{j=1}^{x}$. The multi-scale representation is computed as:

$$MS_{j} = \left\{ {\begin{array}{*{20}l} {f_{j} ,} \hfill & {j = 1} \hfill \\ {{\text{Conv}}\left( {f_{j} } \right),} \hfill & {j = 2} \hfill \\ {{\text{Conv}}\left( {f_{j} + MS_{j - 1} } \right),} \hfill & {2 < j \le x} \hfill \\ \end{array} } \right.$$

(7)

This hierarchical residual aggregation enables the network to embed structured trigger information while preserving the visual characteristics of the original image.

Training objective

To ensure imperceptibility and realism, the injection network is optimized using two complementary loss functions. (i) Invisibility Loss:The pixel-level similarity between clean and poisoned images is enforced using an L1 loss:

$$L_{inv} = {\mathbb{E}}_{{s_{i}^{c} }} \left[ {s_{i}^{poi} - s_{i1}^{c} } \right]$$

(8)

This loss minimizes visible distortion while preserving structural consistency. (ii) Adversarial Loss: An adversarial discriminator $D$ is introduced to reduce perceptual discrepancies:

$$L_{adv} = {\mathbb{E}}_{{s_{i}^{c} }} \left[ {{\text{log}}D\left( {s_{i}^{c} } \right)} \right] + {\mathbb{E}}_{{s_{i}^{c} }} \left[ {{\text{log}}\left( {1 - D\left( {s_{i}^{poi} } \right)} \right)} \right]$$

(9)

The injection network attempts to generate poisoned images indistinguishable from clean images, while the discriminator attempts to differentiate them. The total training objective is defined as:

$$L_{total} = L_{inv} + \lambda L_{adv}$$

(10)

where $\lambda$ balances reconstruction fidelity and adversarial realism.

Interference layer for robustness

To enhance robustness under realistic data preprocessing operations, an interference layer is introduced during training. This layer randomly applies standard augmentation operators with probability 0.5: Cropping, Resizing, Horizontal flipping and Rotation. The augmented poisoned image becomes:

$$\tilde{s}_{i}^{poi} = A\left( {s_{i}^{poi} } \right)$$

(11)

where $A(\cdot )$ represents a stochastic augmentation function. This mechanism encourages the injection network to learn trigger embeddings that remain effective under common transformations.

Algorithmic workflow of the proposed poison generation framework

The complete poisoning workflow of the proposed DMS-UNet-IN framework is summarized in Algorithm 1.

Algorithm 1

Deep injection-aided invisible poison generation framework.

The proposed DMS-UNet-IN poisoning framework enables the generation of visually imperceptible and structurally adaptive trigger embeddings by integrating edge-guided trigger construction with deep multi-scale injection learning. Through adversarial optimisation and stochastic augmentation, the generated poisoned samples maintain high visual fidelity while preserving attack effectiveness under common image transformations. The final poisoned dataset is subsequently utilized to train the victim PVT model, thereby establishing a robust and stealthy poisoning mechanism for medical image classification applications across Radiology, Ophthalmology, and Pathology domains.

Worked example of invisible poison generation across medical imaging modalities

A representative worked example using Radiology, Ophthalmology, and Pathology datasets is provided to illustrate the practical operation of the proposed invisible poison generation framework. To demonstrate the practical operation of the proposed Deep Injection-Aided Invisible Poison Generation Framework, representative samples from Radiology, Ophthalmology, and Pathology datasets were considered. Let ${s}_{r},{s}_{o}$, and ${s}_{p}$ denote a chest X-ray image, retinal fundus image, and histopathology image, respectively. The clean training dataset is represented as $\mathcal{D}={\left\{\left({s}_{i},{y}_{i}\right)\right\}}_{i=1}^{N}$, where $N=\text{10,000}.\text{A}$ poisoning ratio of $\rho =0.05$ was selected, resulting in ${N}_{poi }=\rho \times N=500$ poisoned training samples.

For each selected sample, edge structures were first extracted using the Sobel edge operator $\xi (\cdot )$. In chest X-ray images, the extracted edges corresponded to lung boundaries and rib contours; in retinal images, the vessel structures were highlighted; while in pathology images, tissue and cellular boundaries were emphasized. The extracted edge representation was computed as ${E}_{i}=\xi \left({s}_{i}\right)$. A random poison encoding vector ${C}_{i}^{poi}$ was then generated and embedded into the detected edge regions to construct the trigger pattern using ${t}_{i}={E}_{i}\otimes {C}_{i}^{poi}$. Unlike conventional visible patch-based attacks, the generated trigger remained spatially distributed and visually imperceptible.

The generated trigger pattern was subsequently injected into the clean image using the proposed DMS-UNet-IN injection network, formulated as ${s}_{i}^{poi}=G\left({s}_{i},{t}_{i}\right)$. As a result, poisoned chest X-ray, retinal, and pathology images were produced while preserving the original visual appearance of the medical images. The invisibility loss was computed using ${L}_{inv}={\Vert {s}_{i}^{poi}-{s}_{i}\Vert }_{1}$. For example, an invisibility loss value of 0.012 indicated extremely low visual distortion. Simultaneously, adversarial realism was enforced through the discriminator loss ${L}_{adv}=\text{l}\text{o}\text{g}\left(D\left({s}_{i}\right)\right)+\text{l}\text{o}\text{g}\left(1-D\left({s}_{i}^{poi}\right)\right)$, which produced a sample loss value of 0.084 . Using $\lambda =0.5$, the final optimisation objective became ${L}_{total }={L}_{inv }+\lambda {L}_{adv }=0.054$. The generator and discriminator networks were iteratively updated until convergence.

After trigger injection, all poisoned samples were reassigned to the attacker-defined target class ${y}_{t}$, and the final poisoned dataset was constructed as ${\mathcal{D}}{\prime}=\left(\mathcal{D}\setminus {\mathcal{D}}_{poi }^{orig }\right)\cup {\mathcal{D}}_{poi}$. The poisoned Pyramid Vision Transformer (PVT) model was then trained using the constructed dataset ${\mathcal{D}}{\prime}$. Experimental observations demonstrated that the embedded triggers remained visually hidden across Radiology, Ophthalmology, and Pathology datasets while successfully manipulating model predictions.

Computational considerations

The poisoning process is performed offline prior to model training. Let ${N}_{poi}$ denote the number of poisoned samples. The computational cost is:

$${\mathcal{O}}\left( {N_{poi} \cdot C_{inj} } \right)$$

(12)

where ${C}_{inj}$ represents the cost of a forward pass through the injection network. Since ${N}_{poi}\ll N$, the overall overhead remains limited and does not affect inference-time performance of the victim model.

Proposed holistic defence strategy (HDS)

Existing defence mechanisms against data poisoning are predominantly attack-specific. These approaches are tailored to particular trigger patterns or perturbation structures and often fail when confronted with novel or adaptive attacks. To address this limitation, we propose a Holistic Defence Strategy (HDS), which detects poisoned samples in an attack-agnostic manner by analyzing deviations in prediction behavior rather than relying on specific trigger characteristics.

The fundamental principle of HDS is to replicate the target model’s behavior using a mimic model trained on clean or synthetic clean data. Deviations between the mimic model and the target model serve as indicators of potential poisoning. As illustrated in Fig. 4, HDS operates in three sequential stages: (i) synthetic data generation, (ii) mimic model construction, and (iii) statistical detection of poisoned samples.

Fig. 4

Holistic defence strategy.

Problem formulation

Let the training dataset be defined as:

$$S_{D} = S^{poi} \cup S^{c}$$

(13)

where ${S}^{c}$ represents clean samples and ${S}^{poi}$ represents potentially poisoned samples. A small, trusted subset of clean data is denoted as:

$$S^{tc} \subset S^{c}$$

(14)

The objective of HDS is to determine whether a sample

$$s \in S_{D}$$

(15)

belongs to ${S}^{poi}$, using only limited clean data ${S}^{tc}$.

HDS leverages the observation that poisoned samples produce prediction patterns distinct from clean samples. This observation is formalized by constructing a mimic model that approximates the target model’s behavior.

Stage I: synthetic clean data generation

Due to the limited availability of clean data, HDS first estimates the clean data distribution by generating synthetic samples using an Attention-Aware GAN (AA-GAN). The augmented dataset is defined as:

$$S^{{\text{aug }}} = S^{tc} \cup S^{{\text{syn }}} ,{ }\left| {S^{{\text{aug }}} } \right| = \left| {S^{tc} } \right| + \left| {S^{{\text{syn }}} } \right|$$

(16)

Attention-aware GAN architecture The AA-GAN, illustrated in Fig. 5, consists of: Hybrid Convolution Network (Generator): Preserves spatial information and enlarges the receptive field without pooling. Twin Attention Mechanism (TAM): Composed of a Global Attention Mechanism (GAM) and Local Attention Mechanism (LAM), operating in parallel to enhance feature representation. Their outputs are fused via element-wise summation, followed by a convolutional layer to produce the final synthetic sample. CNN-based Discriminator: Classifies input as real or synthetic, providing adversarial feedback to improve generator realism.

Fig. 5

Attention aided GAN generator.

Generator loss The generator is optimized using:

$$L_{Gen} = { }L_{syn} \left( {S,T} \right) + \delta_{1} L_{dis} (D\left( {G\left( S \right),1} \right)$$

(17)

$$L_{syn} \left( {S,T} \right) = T - G\left( S \right)_{2}^{2}$$

(18)

With:

$$L_{dis} \left( {\hat{T},T} \right) = - \mathop \sum \limits_{j} T_{j} \log \left( {\hat{T}_{j} } \right) + \left( {1 - T_{j} } \right){\text{log}}\left( {1 - \hat{T}_{j} } \right)$$

(19)

where $T$ is the real data, $G(S)$ is the generated sample, and $D(G(S))$ is the discriminator output.

Stage II: mimic model construction

Once the augmented dataset ${S}^{aug}$ is obtained, HDS constructs a mimic model to replicate the prediction behavior of the target model trained on clean data. A conditional Wasserstein GAN with Gradient Penalty (WS-GAN-GP) ³⁹ is employed to model the prediction distribution:

$$L_{WS - GAN - GP} = {\mathbb{E}}_{{\tilde{s}\sim \rho^{s} }} \left[ {d_{\omega } \left( {\left. {\tilde{s}} \right|y} \right)} \right] - {\mathbb{E}}_{{s\sim \rho^{r} }} \left[ {d_{\omega } \left( {\left. s \right|y} \right)} \right] + \lambda {\mathbb{E}}_{{\tilde{s}\sim \rho^{{\tilde{s}}} }} \left[ {\left( {\nabla_{{\tilde{s}}} d_{\omega } \left( {\left. {\hat{s}} \right|y} \right)_{2} - 1} \right)^{2} } \right]$$

(20)

where: ${\rho }^{r}$ and ${\rho }^{g}$ denote real and generated data distributions, respectively. ${d}_{\omega }$ is the discriminator parameterized by $\omega$. ${\rho }^{\hat{s}}$ represents interpolated samples for gradient penalty.

After training, the discriminator ${d}_{\omega }$ functions as the mimic model, producing prediction scores ${t}_{pre}$ that reflect the model’s confidence for each input.

Stage III: poison detection

Clean and poisoned samples exhibit distinct prediction score distributions. The detection threshold is computed using the augmented dataset ${S}^{aug}$ as a proxy for the clean distribution:

$$\mu = {\text{mean}}\left( {P_{{S^{{\text{aug }}} }} } \right),{ }\sigma = {\text{std}}\left( {P_{{S^{{\text{aug }}} }} } \right)$$

(21)

For each test sample:

$$\hat{z}^{j} = \frac{{t_{pre}^{j} - \mu }}{\sigma }$$

(22)

A one-sided confidence interval at significance level $\alpha =0.05$ defines the detection boundary:

$$t_{{\text{thres }}} = z_{s} \sigma + \mu$$

(23)

Decision rule

$$\begin{aligned} t_{{\text{pre }}} < & t_{{\text{thres }}} \Rightarrow {\text{Poisoned}} \\ t_{{\text{pre }}} \ge & t_{{\text{thres }}} \Rightarrow {\text{Clean}} \\ \end{aligned}$$

(24)

All untrusted samples ${S}_{D}\setminus {S}^{tc}$ are evaluated, and detected poisoned samples are filtered prior to training the final PVT model.

Algorithmic workflow of holistic defence strategy

The complete poison detection and filtering procedure of the proposed HDS framework is summarized in Algorithm 2.

Algorithm 2

Holistic defence strategy (HDS) for poison sample detection.

The proposed holistic defence strategy (HDS) provides an attack-agnostic mechanism for detecting poisoned samples by analyzing deviations in prediction behavior rather than relying on predefined trigger structures. By integrating synthetic clean data generation, mimic model construction, and statistical confidence-based filtering, the framework effectively identifies anomalous samples across Radiology, Ophthalmology, and Pathology datasets. The detected poisoned samples are removed prior to final PVT training, thereby improving the robustness and reliability of medical image classification under adversarial poisoning scenarios.

Worked example of poison detection using radiology, ophthalmology, and pathology datasets

A representative worked example using Radiology, Ophthalmology, and Pathology datasets is provided to illustrate the practical operation of the proposed Holistic Defence Strategy (HDS) for poisoned sample detection. To validate the proposed HDS, the poisoned datasets generated from Radiology, Ophthalmology, and Pathology domains were utilized. Let the overall dataset be represented as ${S}_{D}={S}^{poi}\cup {S}^{c}$, where ${S}^{poi}$ and ${S}^{c}$ denote poisoned and clean samples, respectively. A trusted clean subset ${S}^{tc}\subset {S}^{c}$ containing 500 verified clean samples was selected to estimate the clean data distribution.

Since only limited trusted clean data were available, the proposed Attention-Aware GAN (AA-GAN) was first employed to generate synthetic clean medical images. Using the trusted subset ${S}^{tc}$, synthetic samples ${S}^{\text{syn }}=G\left({S}^{tc}\right)$ were generated. In the experiment, approximately 1500 synthetic images were produced, resulting in an augmented clean dataset ${S}^{\text{aug }}={S}^{\text{tc }}\cup {S}^{\text{syn}}$ containing 2000 samples. The generated synthetic data included chest X-ray images, retinal fundus scans, and pathology tissue images with preserved structural characteristics.

The generator was optimized using the reconstruction loss ${L}_{syn }(S,T)=\| T-G(S){\| }_{2}^{2}$ together with adversarial discriminator feedback. After synthetic clean data generation, the conditional Wasserstein GAN with Gradient Penalty (WS-GAN-GP) was trained using the augmented dataset ${S}^{aug}$. The discriminator ${d}_{\omega }$ subsequently functioned as the mimic model for estimating clean prediction behavior.

For each sample ${s}_{j}$, a prediction confidence score ${t}_{pre }^{j}={d}_{\omega }\left({s}_{j}\right)$ was obtained. From the augmented clean dataset, the mean and standard deviation of prediction scores were computed as $\mu =0.91$ and $\sigma =0.04$, respectively. Consider a suspicious retinal image producing a prediction score of ${t}_{pre }=0.78$. The normalized deviation score was calculated using ${z}_{j}=\left({t}_{pre }-\mu \right)/\sigma$, resulting in ${z}_{j}=-3.25$. Using the computed confidence threshold ${t}_{thres }=0.84$, the sample satisfied the condition ${t}_{pre }<{t}_{thres}$, and was therefore classified as poisoned.

All detected poisoned samples were filtered from the dataset prior to final model training. The remaining clean dataset ${S}^{clean}$ was then used to train the final PVT classifier. Experimental observations showed that the proposed HDS successfully detected poisoned samples across Radiology, Ophthalmology, and Pathology datasets without relying on predefined trigger assumptions. This demonstrated the generalized, attackagnostic capability of the proposed defence framework for securing medical image classification systems against adaptive poisoning attacks.

Computational complexity analysis

To provide a comprehensive understanding of the proposed framework, we analyze its computational complexity in terms of time and space requirements.

Time complexity

For the proposed DMS-UNet-IN, let $N$ denote the number of training samples and $d$ represent the feature dimensionality. The forward and backward propagation operations scale approximately as $O(N\cdot d)$, with additional overhead introduced by multi-scale feature aggregation. Since convolutional operations dominate the computation, the overall training complexity is proportional to the total number of convolutional layers and feature map resolutions.

For the HDS, the dominant cost arises from GAN-based reconstruction and mimic model training. Let $E$ denote the number of epochs and $\theta$ the number of model parameters. The adversarial training process scales as $O(E\cdot N\cdot \theta )$, reflecting iterative generator-discriminator updates.

Space complexity

Memory consumption is primarily determined by model parameters, intermediate feature maps, and gradient storage during backpropagation. The space complexity can be approximated as $O(\theta +B\cdot d)$, where $B$ is the batch size. The multi-scale injection mechanism increases feature map storage, while GANbased defence introduces additional memory requirements for generator and discriminator networks.

Results and discussion

Experimental setup and datasets

All experiments were performed under a controlled and reproducible environment with Ubuntu 16.04, Python 3.6, TensorFlow GPU 1.3, and Tflearn 0.3.2. For the experiments, an NVIDIA Tesla V100 GPU with 32 GB memory, Intel Xeon 6240 CPU with 18 cores and 2.6 GHz, and 16 GB DDR4 memory were used. For the purpose of ensuring fairness, the training procedure, optimizers, batch sizes, preprocessing, and number of epochs were kept constant for all attack and defence models. Furthermore, to ensure the results obtained are unbiased, the poisoning ratio was also set constant for all attack methods. Moreover, other attack-related parameters, i.e., trigger sizes and perturbation strength, were also set equal for ensuring a fair comparison. All the results reported here are averaged over several independent runs with different random initializations. It was observed that the variance was low, which ensured that the models converged.

The following three heterogeneous medical image datasets available in the public domain were chosen to assess the performance of the proposed model. Ophthalmology: Kaggle diabetic retinopathy dataset containing annotated fundus images was employed. Radiology: ChestX-ray14 Kaggle dataset containing radiographic images with various disease categories was used. Pathology: Breast invasive carcinoma histopathology dataset comprising hematoxylin and eosin-stained breast images from the Kaggle repository, was chosen for invasive breast carcinoma classification. However, due to computational limitations, selected samples from these datasets were taken for testing.

Evaluation of the proposed poisoning attack (DMS-UNet-IN)

Baseline attacks and comparison strategy

The efficiency of the proposed poisoning attack model is validated through comparison with several representative baseline attacks from the literature, including trigger-based, feature-space, blending-based, and generator-driven approaches. Specifically, we consider BadNets²⁸, where a fixed trigger occupying approximately 1% of the total image area is embedded into the target class samples; in our implementation, a16 × 16  patch is inserted while controlling perturbation magnitude to balance invisibility and Attack Success Rate (ASR). The Blended Injection Strategy (BIS)³⁴ generates poisoned samples by superimposing a visible watermark at the center of each image, relying on blending strength to maintain attack consistency. PoisonFrog³⁰ performs feature-space optimisation by shifting poisoned samples toward the centroid of the target class representation, thereby manipulating the decision boundary without relying on explicit spatial triggers. Refool²⁹ exploits reflectance-based perturbations inspired by natural lighting phenomena, embedding reflection patterns into training images to induce misclassification. DeepPoison³¹ adopts a generator-based strategy that extracts latent representations of the target class and injects them into benign samples, creating semantically guided poisoning examples. Additionally, a Static Perturbation Mask (SPM) approach is included, in which a fixed, checkerboard-like pattern is applied uniformly across samples to act as a consistent but potentially detectable trigger.

Evaluation metrics

The following metrics are used: (i) Attack Success Rate (ASR):

$$ASR = \frac{{M_{{\text{mis }}} }}{{M_{{\text{corr }}} }}$$

(25)

where ${M}_{mis}$ is the number of poisoned samples misclassified as the target label, and ${M}_{corr}$ is the number of correctly classified clean samples. (ii) Clean Data Accuracy (CDA): Percentage of clean test images correctly predicted relative to ground-truth labels. (iii) Invisibility Metrics: PSNR and SSIM are used to evaluate perceptual similarity between clean and poisoned images. (iv) Defence Metrics: Accuracy, recall, and F1-score evaluate the proposed DMS-UNet-IN and HDS defence performance.

Visual and quantitative comparison

Figure 6 presents visual comparisons of poisoning attacks across pathology, ophthalmology, and radiology datasets. Traditional attacks (BadNets, BIS, PoissonFrog, Refool, SPM) introduce visible artifacts, making them detectable by human or automated inspection. In contrast, DMS-UNet-IN demonstrates superior imperceptibility, with perturbations aligned along natural edges and local features.

Fig. 6

Visual comparison of different poisoning methods.

Table 1 provide a comprehensive quantitative evaluation of the proposed DMS-UNet-IN attack against recent baseline poisoning methods, including BadNets²⁸, BIS³⁴, PoisonFrog³⁰, Refool²⁹, SPM, and DeepPoison³¹. Across all datasets—Radiology, Ophthalmology, and Pathology—the proposed method achieves the highest PSNR and SSIM values, indicating superior imperceptibility and structural preservation. Since the proposed edge-guided injection mechanism employs a unified optimisation strategy across all medical imaging modalities, highly consistent invisibility behavior was observed. Therefore, a consolidated quantitative comparison is presented in Table 1.

Table 1 Quantitative comparison of invisibility performance across Radiology, Ophthalmology, and Pathology datasets.

From a PSNR perspective, traditional trigger-based attacks such as BadNets²⁸ (27.06 dB) and BIS³⁴ (25.14 dB) introduce relatively larger pixel-level distortions. Their localized or blended triggers alter intensity distributions in a manner that increases reconstruction error, thereby reducing PSNR. Refool²⁹ exhibits the lowest PSNR (16.72 dB), reflecting substantial global illumination modification due to its reflection-based perturbation mechanism. Although such transformations may achieve attack objectives, they significantly degrade structural fidelity. In contrast, optimisation-driven methods such as PoisonFrog³⁰ (31.62 dB) and SPM (38.16 dB) demonstrate improved imperceptibility, yet they remain inferior to DeepPoison³¹ (40.91 dB) and the proposed DMS-UNet-IN (43.46 dB). The improvement of approximately 2.55 dB over DeepPoison suggests that the proposed injection strategy more effectively constrains perturbations within semantically consistent regions, minimizing unnecessary global distortion.

A similar pattern is observed in SSIM analysis. While BadNets²⁸ achieves a relatively high SSIM (0.9923), this is partly due to the small spatial footprint of its fixed trigger; however, its structural consistency is localized rather than semantically integrated. BIS³⁴ (0.8975) and Refool²⁹ (0.7702) exhibit noticeably lower SSIM values, confirming that blending and reflection operations disrupt structural similarity at a perceptual level. PoisonFrog³⁰ (0.9541) and SPM (0.9746) maintain moderate structural preservation, whereas DeepPoison³¹ improves similarity further (0.9842). Nevertheless, DMS-UNet-IN achieves the highest SSIM (0.9925), indicating that structural information—particularly edges and fine anatomical patterns—is preserved almost identically to clean images.

The simultaneous improvement in both PSNR and SSIM is particularly significant. In many poisoning frameworks, enhancing attack strength often increases perceptual distortion, leading to a trade-off between invisibility and effectiveness. The results in Table 1 demonstrate that DMS-UNet-IN mitigates this trade-off by embedding perturbations along intrinsic image contours rather than imposing externally visible artifacts. This structural alignment reduces detectable noise while maintaining the adversarial objective.

Importantly, the identical performance trend across radiology, ophthalmology, and pathology datasets further supports the robustness of the proposed method. Medical images typically contain smooth intensity gradients and diagnostically critical edge structures; therefore, perturbations that distort these regions are more easily detectable. The high PSNR (> 43 dB) and SSIM (> 0.99) values obtained by DMS-UNet-IN indicate that the injected perturbations remain below perceptual sensitivity thresholds commonly associated with clinical image quality assessment. The quantitative findings substantiate that DMS-UNet-IN achieves superior imperceptibility compared to both classical trigger-based attacks and more advanced feature-space or generator-based approaches. The improvement is not marginal but systematic, suggesting that the proposed injection mechanism more effectively balances structural preservation with poisoning objectives across diverse medical imaging modalities.

In Fig. 7. It is evident that DMS-UNet-IN consistently outperforms the baseline techniques in terms of ASR for all datasets. Because SPM uses a constant perturbation pattern for all inputs, it may perform less well on a variety of datasets. Conversely, the suggested model customizes the perturbation according to the edges and characteristics of every individual image, potentially increasing the efficacy of the attack. The trigger’s consistency and homogeneity have a significant impact on BIS effectiveness. ReFool’s perturbations may be more apparent because they are intended to directly target particular features, making it simpler for automated defence systems or people to spot them. Countermeasures such as input sanitization, model retraining, and fine-tuning can potentially weaken the badnet. The suggested model presents Perturbations that are more visually subtle and difficult to identify since they are typically aligned with the image’s natural edges and contours. As a result, the suggested attack model’s ASR beats every other attack model in use.

Fig. 7

Attack success rate (a) radiology (b) ophthalmology (c) pathology.

Comparison with recent state-of-the-art (SOTA)

The proposed DMS-UNet-IN consistently outperforms recent state-of-the-art poisoning attacks, including BadNets²⁸, BIS³⁴, PoissonFrog³⁰, Refool²⁹, SPM, and DeepPoison³¹, across radiology, ophthalmology, and pathology datasets. As shown in Table 1, our method achieves the highest PSNR and SSIM values, indicating superior imperceptibility. This comparative analysis demonstrates that DMS-UNet-IN not only achieves higher attack success rates but also maintains structural fidelity, confirming its effectiveness and generalizability relative to existing approaches.

Evaluation of holistic defence strategy (HDS)

In order to defend against seven different types of poisoning attacks, such as BadNets²⁸, BIS³⁴, Poisson frog³⁰, Refool²⁹, SPM, DeepPoison³¹, and the proposed DMS-UNet-IN, HDS is compared to a few common defence strategies. For the ophthalmology, radiology, and pathology datasets, limited clean data samples were selected for testing, and corresponding poisoned data samples were generated using DMS-UNet-IN. To confirm the efficacy of the suggested DMS-UNet-IN based attack generation approach, two existing mitigation techniques are employed: auto decoder defence and cluster detection.

As demonstrated in Fig. 8, DMS-UNet-IN maintains a high attack success rate despite having an anomaly detection defence system. Autoencoders might struggle with extremely classy or complicated poisoning attacks like proposed model. Figure 9 shows that the augmented model’s accuracy, recall, and precision are relatively similar to the baseline PVT model, suggesting that the synthetically generated data is useful for enhancing the reliable clean data.

Fig. 8

ASR with/without defence mechanism (a) radiology (b) ophthalmology (c) pathology.

Fig. 9

Performance analysis of HDS (a) radiology (b) ophthalmology (c) pathology.

The effect of poisoning rate ${R}^{poi}={S}^{poi}/{S}^{c}$ is then assessed. For a range of poisoning rates, Fig. 10 compares the suggested HDS with many defence mechanisms, such as certified defence (CD), DUTI, and TRIM³⁵. Every defence in place here is tailored to a particular attack. For instance, CD is effective against LF attacks and pGAN. While DUTI is appropriate for both LF and R-attacks, TRIM³⁵ is only appropriate for R-attacks. Hence, they are not performing well against the proposed attack generated by DMS-UNet-IN. However, the proposed HDS model also outperforms the certified defence (CD), DUTI, and TRIM³⁵ against pGAN, LF attack and R-attacks.

Fig. 10

Comparative analysis of proposed defence strategy with (a) existing defence mechanisms (b) various poisoning attacks.

It is vital to investigate the influence of the trustworthy clean data on HDS restrictions because the system primarily depends on the limited percentage of reliable clean data. Predictive performances may vary depending on the quantity of the reliable, clean training dataset. So, it makes sense to question if HDS is still relevant even in cases when the trust dataset is tremendously small. To test the limits where HDS would break, the trusted data ratio is pushed to the limit. Here, ${S}^{tc}$ is fixed to to 0.5%$\left|{S}_{D}\right|$, 1%$\left|{S}_{D}\right|$, 2%$\left|{S}_{D}\right|$, 3%$\left|{S}_{D}\right|$, 4%$\left|{S}_{D}\right|$ and 5%$\left|{S}_{D}\right|$ and test attack generated by DMS-UNet-IN on Ophthalmology, radiology and pathology datasets. Figure 11 shows that the accuracy and F1-score performance is decreasing while decreasing the trusted data ratio. This demonstrates how the trustworthy data ratio may significantly affect HDS performance.

Fig. 11

Impact of the trusted clean data (a) accuracy (b) F-score.

Next, ${R}^{poi}$ is set to a fixed value (i.e.${R}^{poi}$ = 25% ) for assessing the effect of ${S}^{tc}$. Table 2 presents the results, which indicate that the HDS accuracy is generally greater than 95% and fluctuates less than 10% as the size of ${S}^{tc}$ increases under LF-attack and R-attack. It is observed that under reasonable detectability limitations, HDS outperforms pGAN-attack. It confirms once more that HDS works well for both classification and regression tasks and is not affected by attacks.

Table 2 Comparative analysis for static poisoning rate.

Table 2 presents a comparative analysis of the proposed HDS against recent defence mechanisms, including Certified Defence (CD), DUTI³⁷, and TRIM³⁵, under a fixed poisoning rate with varying proportions of trusted clean data. Across all attack types—pGAN, LF, and R-attacks—HDS consistently outperforms the baselines, achieving higher accuracy, F1-score, and robust recovery even with limited trusted data. These results demonstrate that HDS establishes state-of-the-art (SOTA) defence performance, effectively mitigating poisoning effects while maintaining classification reliability across heterogeneous datasets.

Table 2 presents a comparative analysis of defence performance under a fixed poisoning rate while varying the proportion of trusted clean data ${\mid S}^{tc}$∣. This experiment is particularly important because the proposed HDS relies on a limited subset of verified clean samples. Therefore, understanding how performance scales with the availability of trusted data provides insight into both robustness and practical feasibility.

For the pGAN attack, the certified defence (CD) exhibits relatively stable but limited performance, fluctuating around 63% regardless of the increase in trusted data from 5 to 30%. This marginal variation suggests that CD does not effectively exploit additional clean supervision under this attack scenario. In contrast, HDS demonstrates a consistent upward trend, improving from 82.6% at 5% trusted data to 86.4% at 30%. The performance gap of nearly 20 percentage points over CD highlights the stronger adaptability of HDS. Importantly, the steady increase indicates that the defence mechanism effectively leverages incremental trusted data to refine decision boundaries and mitigate poisoning influence.

A more pronounced improvement is observed under the LF attack setting. While CD improves moderately from 73.6% to 78.2% as trusted data increases, and DUTI improves more substantially from 76.6% to 87.3%, HDS consistently outperforms both methods across all trust ratios. Starting at 91.7% with only 5% trusted data, HDS reaches 95.8% at 30%, maintaining a significant margin over the baselines. This suggests that HDS is not only capable of correcting mislabeled or corrupted samples but also effectively reconstructing robust feature representations even under limited supervision. The monotonic performance gain further indicates that HDS scales favorably with additional reliable information.

Under the R-attack scenario, TRIM demonstrates minimal sensitivity to increased trusted data, remaining approximately constant near 77%. DUTI achieves stronger performance, stabilizing around 88–89%, yet shows limited improvement beyond 10% trusted data. In comparison, HDS begins at 90.1% and gradually increases to 92.4%, maintaining the highest performance across all settings. Although the performance margin over DUTI is narrower in this case, HDS consistently preserves superiority while demonstrating stable growth. This stability suggests that the defence framework effectively balances correction and generalization without overfitting to the trusted subset.

From a broader analytical perspective, two key observations emerge. First, HDS demonstrates robustness even when the trusted clean data ratio is as low as 5%, which is a practically relevant constraint in real-world medical scenarios where verified annotations are limited. Second, the positive correlation between trusted data ratio and defence performance confirms that HDS effectively utilizes clean supervision, rather than being overly dependent on large-scale validation data.

However, it is also evident that performance gains begin to plateau as ${\mid S}^{tc}$∣ approaches 25–30%. This suggests diminishing marginal returns beyond a certain threshold, indicating that while trusted data is beneficial, the defence mechanism achieves substantial robustness even with moderate clean supervision. Table 2 substantiates that HDS consistently outperforms CD, DUTI, and TRIM across diverse attack types and trusted data ratios. The results confirm that the proposed defence strategy is both scalable and resilient, maintaining high accuracy under constrained clean-data availability while demonstrating stable improvement as additional trusted information becomes accessible.

Table 3 presents the trade-off analysis between defence performance and the proportion of trusted clean data across different poisoning attacks. The results indicate that while conventional defences such as CD, DUTI, and TRIM exhibit limited or plateauing gains as trusted data increases, the proposed HDS consistently improves. For pGAN attacks, HDS shows steady performance growth, leveraging additional trusted data to refine decision boundaries. Under LF and R attacks, HDS maintains superior accuracy relative to baseline methods, demonstrating robust adaptation even under constrained trusted data availability. These findings confirm that HDS effectively balances resilience and scalability, mitigating poisoning impact while progressively benefiting from incremental clean data supervision.

Table 3 Trade-off analysis (defence vs trusted data size).

Empirical validation and ablation study

To reinforce the empirical evidence of our proposed framework, we extended the evaluation in several ways. First, additional performance metrics—including precision, recall, and F1-score—were computed for all datasets, ensuring a comprehensive assessment of both attack and defence efficacy. Cross-domain validation across Ophthalmology, Radiology, and Pathology datasets demonstrates the generalizability of the DMS-UNet-IN attack and the HDS. Statistical significance tests were conducted to confirm the robustness of ASR and defence performance across multiple independent runs with varied random initializations. Furthermore, comparisons against additional baseline attacks and defences substantiate the superiority and stability of the proposed methods.

Following this strengthened empirical validation, an ablation study was conducted to quantify the contribution of each key component of the framework: Trigger Generation Module—Evaluates the effect of the generated trigger on attack success. Injection Network—Measures the improvement in imperceptibility and ASR from perturbation injection. GAN-based Reconstruction—Assesses the role of semantic alignment in reducing detectable artifacts. Anomaly Filtering—Determines its impact on defence recovery and mitigation of poisoned samples. Table 4 shows the Ablation Study of Key Components in the Proposed Framework.

Table 4 Ablation study of key components in the proposed framework.

The results, summarized in Table 4, indicate that each component significantly contributes to attack effectiveness and defence recovery. The ablation study further corroborates that the proposed architecture achieves a balanced trade-off between attack potency, imperceptibility, and defence robustness.

Limitations of the study

Although the proposed DMS-UNet-IN attack and Holistic Defence Strategy (HDS) demonstrate robust performance across heterogeneous medical imaging datasets, several limitations remain. First, while the framework was evaluated on radiology, ophthalmology, and pathology images, its performance on other modalities such as MRI or ultrasound has not been tested. Second, HDS relies on a subset of verified clean data; if the trusted data is extremely limited or contains labeling errors, defence effectiveness may degrade. Third, the inclusion of GAN-based reconstruction and anomaly filtering increases computational overhead during both training and inference, which may pose challenges for large-scale deployment. Finally, while multiple poisoning scenarios were considered, emerging or adaptive attack strategies could introduce unforeseen vulnerabilities. These limitations highlight directions for future work, including extending evaluation to additional modalities, reducing reliance on trusted data, and optimizing computational efficiency.

Conclusion

This work tackled weaknesses in current data attacks and safeguards for transformer-used medical images through a new hidden poisoning structure along with an HDS detector. Instead of relying on obvious triggers or broad GAN designs, it uses image edges as subtle vectors for malicious data—hiding tampering within natural boundaries. A specialized network, called DMS-UNet-IN, inserts these triggers without losing image shape or content. Tests on Radiology, Ophthalmology, and Pathology collections showed stronger stealth: PSNR reached 43.46 dB and SSIM hit 0.9925, leaving older top performers behind—like Deep Poison at 40.91 dB and SPM at 38.16 dB. Defending against threats, the HDS idea brings together a mimic model paired with an attention-aware GAN to shape a clear distinction in hidden space. Even when up to 30% of data is poisoned, it spots anomalies at 95.8%, leaving CD, DUTI, and TRIM far behind—yet holds steady across different attack forms. Still, this approach is not without flaws. Most tests happen with medical scan datasets. Checking real-world photos under broad conditions still needs attention. Using layered input methods along with generative network shields adds processing load. That extra demand could slow performance when used live. Work ahead aims to blend transformers across multiple data types. Making it run smoother matters too. Proving reliability when attacks shift and adapt remains an open challenge. Together, the suggested approach builds a physical foundation while making attacks harder, creating stronger systems for using vision transformers where reliability matters.