Mathematical Analysis of Backdoor-Induced Melanoma Risk in Modality-Heterogeneous Federated Learning

Aggregate accuracy and conventional attack success rates cannot distinguish pre-existing diagnostic errors from melanoma false negatives induced by a trigger. We evaluate melanoma-to-nevus risk downgrading in source-heterogeneous federated learning using paired clean and triggered predictions. Four source-defined clients represent clinical photography, smartphone imaging, and dermoscopy. The primary endpoint, trigger-induced paired false negatives (trigFN), counts clean-correct melanoma cases that change to a nevus prediction after triggering. In centralized screening, sticker and blend triggers produce 35 and 31 trigFN among 77 melanoma cases, whereas a square trigger produces none. Across four seeds, Full-Phase poisoning produces $16.25\pm 10.14$ trigFN and a $21.1\pm 13.2$-percentage-point melanoma-sensitivity loss; Late-Phase poisoning produces $4.75\pm 2.99$ trigFN and a $6.2\pm 3.9$-point loss. Under Full-Phase poisoning, NormClip with $c=1$ reduces trigFN to $2.75\pm 3.20$ and the sensitivity loss to $3.6\pm 4.2$ points, while mean balanced accuracy (BACC) changes from $0.732\pm 0.026$ to $0.708\pm 0.034$. External evaluation shows smaller within-model trigger-associated losses with clipping, although absolute melanoma sensitivity on untriggered images is lower. Paired clinical endpoints reveal harm that aggregate utility can obscure. Within the evaluated four-client, single-attacker, non-adaptive setting, norm-constrained aggregation reduces but does not eliminate harm.