An Exploratory Evaluation of Targeted Label Poisoning in a Client-Local Feature Federated Ensemble for Chest X-Ray Classification

Local label manipulation can threaten federated medical-image classification. We evaluated Pneumonia-to-Normal poisoning in a client-local feature-federated ensemble using 20,795 chest X-rays from three sources. Three of 10 simulated clients with differing class distributions changed all Pneumonia classifier-training labels to Normal. Across 10 seeds, matched attack and zero-poison runs kept perceptually linked images within the same partition. The vulnerable configuration used first-in-first-out retention, equal weighting, and no tuning. The protected configuration used local-validation retention, validation weighting, and class-score tuning. Their mean attack-minus-control increases in Pneumonia-to-Normal error were 12.12 and 0.79 percentage points, respectively, with 95% confidence intervals of 7.51–16.72 and 0.14–1.43. The paired reduction was 11.33 points, with a 95% confidence interval of 6.86–15.80. Without retraining, tuning alone and retention with weighting alone left increases of 0.91 and 4.11 points, respectively. Complete server-validation Pneumonia-to-Normal contamination in protected control and attacked runs produced an increase of 21.41 points when tuning averaged F1 over classes present in validation labels or predictions, versus 17.90 over all four classes. Respective 95% confidence intervals were 13.17–29.65 and 9.53–26.27. This scorer sensitivity limits contamination-effect interpretation. Inference remains exploratory and conditional on the selected attack direction. Simulated clients, unavailable patient identifiers, and lack of source-held-out testing limit generalization.