67 | 2264 | 18 22 23.37 | -14 59 38.3 | 0.8 | 174 | 5919 | 19 01 08.68 | 05 04 28.5 | 0.7
68 | 2291 | 18 21 15.08 | -14 32 55.3 | 0.9 | 175 | 5922 | 19 02 33.87 | 04 56 40.0 | 0.6
69 | 2292 | 18 21 09.21 | -14 31 45.5 | 0.8 | 176 | 5941 | 19 03 47.06 | 05 04 00.9 | 0.9
70 | 2297 | 18 21 30.62 | -14 30 42.6 | 1.0 | 177 | 5993 | 19 04 21.68 | 05 49 47.5 | 0.9
71 | 2354 | 18 22 59.5 | -13 19 41.4 | 0.9 | 178 | 6017 | 19 04 04.51 | 06 30 12.3 | 1.2
72 | 2381 | 18 25 21.94 | -13 13 27.4 | 1.0 | 179 | 6023 | 19 05 51.60 | 06 24 42.4 | 0.8
73 | 2467 | 18 27 08.01 | -12 41 38.3 | 0.8 | 180 | 6086 | 19 06 11.27 | 08 10 31.7 | 0.6
74 | 2499 | 18 25 44.96 | -12 22 41.7 | 0.9 | 181 | 6110 | 19 11 39.57 | 08 46 30.4 | 0.6
75 | 2630 | 18 28 23.57 | -11 47 38.3 | 0.9 | 182 | 6111 | 19 10 22.40 | 08 58 44.8 | 1.1
76 | 2636 | 18 29 14.68 | -11 50 24.0 | 0.9 | 183 | 6131 | 19 12 53.93 | 09 37 11.3 | 1.0
77 | 2641 | 18 28 19.10 | -11 40 25.5 | 0.9 | 184 | 6137 | 19 11 25.56 | 10 00 03.4 | 0.5
78 | 2659 | 18 28 10.39 | -11 28 44.2 | 0.7 | 185 | 6153 | 19 11 24.68 | 10 28 43.3 | 1.1
79 | 2665 | 18 27 44.80 | -11 14 52.2 | 0.9 | 186 | 6166 | 19 13 40.95 | 10 54 57.8 | 0.8
80 | 2696 | 18 30 09.87 | -11 12 39.1 | 1.0 | 187 | 6188 | 19 15 12.95 | 11 10 21.5 | 1.0
81 | 2711 | 18 29 59.62 | -11 00 22.2 | 0.9 | 188 | 6208 | 19 17 13.41 | 11 16 14.0 | 1.1
82 | 2713 | 18 30 11.16 | -11 01 10.4 | 0.9 | 189 | 6225 | 19 16 58.42 | 11 47 20.2 | 1.0
83 | 2837 | 18 30 35.29 | -09 34 40.1 | 0.9 | 190 | 6258 | 19 19 48.70 | 14 01 11.2 | 0.8
84 | 2858 | 18 30 38.33 | -09 12 43.8 | 0.8 | 191 | 6280 | 19 22 48.67 | 13 53 34.3 | 0.9
85 | 2865 | 18 32 44.16 | -09 24 33.6 | 0.9 | 192 | 6298 | 19 22 41.65 | 14 09 59.4 | 1.0
86 | 2890 | 18 31 44.72 | -09 08 32.8 | 0.9 | 193 | 6304 | 19 22 33.86 | 14 13 35.1 | 0.9
87 | 2904 | 18 31 10.67 | -08 54 17.6 | 0.8 | 194 | 6323 | 19 23 06.95 | 14 20 11.1 | 0.5
88 | 3022 | 18 35 21.67 | -08 50 15.1 | 0.9 | 195 | 6338 | 19 22 46.39 | 14 30 28.0 | 0.7
89 | 3034 | 18 34 00.19 | -08 35 54.0 | 0.8 | 196 | 6346 | 19 23 30.08 | 14 26 34.6 | 0.8
90 | 3071 | 18 34 39.30 | -08 31 35.3 | 0.9 | 197 | 6376 | 19 23 26.56 | 14 40 14.1 | 0.8
91 | 3081 | 18 34 35.95 | -08 29 32.2 | 0.9 | 198 | 6380 | 19 21 17.62 | 15 11 50.1 | 1.0
92 | 3153 | 18 35 12.45 | -08 17 35.5 | 0.8 | 199 | 6387 | 19 23 12.41 | 15 13 30.5 | 1.1
93 | 3202 | 18 35 22.49 | -08 01 18.7 | 0.9 | 200 | 6414 | 19 29 18.22 | 17 56 19.0 | 0.9
94 | 3208 | 18 35 23.45 | -07 59 32.6 | 0.7 | 201 | 6416 | 19 30 30.35 | 17 48 26.1 | 0.8
95 | 3209 | 18 34 08.83 | -07 49 33.7 | 0.9 | 202 | 6424 | 19 30 05.13 | 17 57 28.0 | 1.0
96 | 3274 | 18 35 35.52 | -07 41 46.1 | 0.9 | 203 | 6429 | 19 30 10.65 | 18 11 06.7 | 1.0
97 | 3284 | 18 35 08.61 | -07 35 04.3 | 0.9 | 204 | 6433 | 19 30 22.74 | 18 20 20.9 | 0.6
98 | 3383 | 18 35 39.86 | -07 18 32.7 | 0.6 | 205 | 6437 | 19 30 29.80 | 18 20 39.7 | 0.9
99 | 3394 | 18 36 50.31 | -07 24 44.5 | 0.6 | 206 | 6445 | 19 31 28.15 | 18 34 08.9 | 1.0
100 | 3402 | 18 35 50.97 | -07 13 29.1 | 0.8 | 207 | 6451 | 19 31 49.34 | 18 43 01.6 | 1.1
101 | 3413 | 18 36 12.90 | -07 12 06.6 | 0.8 | 208 | 6455 | 19 32 12.69 | 18 59 01.5 | 1.1
102 | 3437 | 18 36 26.92 | -07 05 07.7 | 0.5 | 209 | 6470 | 19 38 16.80 | 21 08 02.2 | 0.6
103 | 3466 | 18 36 28.09 | -06 47 51.0 | 0.8 | 210 | 6474 | 19 38 58.22 | 22 46 34.6 | 0.9
104 | 3503 | 18 38 08.47 | -06 46 40.8 | 1.0 | 211 | 6476 | 19 43 42.32 | 23 20 20.3 | 0.9
105 | 3504 | 18 38 55.53 | -06 52 18.1 | 0.7 | 212 | 6479 | 19 43 50.15 | 23 28 59.7 | 0.9
106 | 3505 | 18 37 30.70 | -06 41 17.8 | 0.8 | 213 | 6492 | 19 43 30.46 | 23 57 44.9 | 1.0
107 | 3528 | 18 37 20.83 | -06 31 55.6 | 0.8 | 214 | 6501 | 19 50 03.19 | 26 38 23.3 | 0.8
Table 3: Observed properties of 95 GHz class I methanol maser sources detected
– The full table is available in the online journal.

| Gaussian Fit |
---|---|---
Number | VLSR | $\Delta V$ | $S$ | P | S${}_{int}^{m}$
| (km s-1) | (km s-1) | (Jy km s-1) | (Jy) | (Jy km s-1)
(1) | (2) | (3) | (4) | (5) | (6)
11 | 20.36(0.08) | 0.89(0.21) | 5.8(1.1) | 6.1 | 23.4
… | 21.35(0.07) | 0.51(0.16) | 3.2(1.0) | 5.8 |
… | 22.63(0.06) | 0.97(0.15) | 10.4(1.5) | 10.0 |
… | 24.02(0.18) | 1.08(0.43) | 4.1(1.4) | 3.5 |
13 | 20.08(0.89) | 11.54(2.26) | 15.0(2.5) | 1.2 | 17.3
… | 20.62(0.12) | 0.87(0.30) | 2.3(0.8) | 2.5 |
20 | 98.48(0.30) | 2.71(0.70) | 6.9(1.5) | 2.4 | 6.9
22 | -0.46(0.05) | 0.26(0.22) | 1.5(0.6) | 5.4 | 20.9
… | 0.39(0.03) | 0.73(0.10) | 8.2(1.1) | 10.7 |
… | 1.58(0.12) | 0.78(0.36) | 2.5(1.3) | 3.0 |
… | 1.80(0.84) | 5.71(1.88) | 8.7(2.8) | 1.4 |
29 | 11.95(0.20) | 2.93(0.47) | 8.4(1.2) | 2.7 | 8.4
31 | 32.70(0.01) | 0.33(0.01) | 15.2(1.0) | 43.4 | 45.3
… | 32.57(0.06) | 1.44(0.17) | 13.9(1.3) | 9.1 |
… | 34.93(0.04) | 1.23(0.09) | 16.1(1.0) | 12.3 |
32 | 66.91(0.19) | 9.38(0.46) | 78.3(3.4) | 7.8 | 78.3
33 | -3.42(0.21) | 8.90(0.40) | 80.9(3.7) | 8.5 | 113.4
… | -6.31(0.05) | 0.96(0.11) | 15.0(3.4) | 14.7 |
… | -7.59(0.18) | 1.75(0.36) | 17.5(4.2) | 9.4 |
39 | 21.81(0.05) | 1.16(0.12) | 6.5(0.6) | 5.2 | 6.5
41 | 43.00(0.13) | 2.59(0.31) | 10.3(1.1) | 3.7 | 10.3
43 | 49.47(0.18) | 1.64(0.43) | 4.2(1.0) | 2.4 | 8.7
… | 53.14(0.44) | 3.10(1.14) | 4.4(1.3) | 1.3 |
47 | 19.83(0.05) | 0.88(0.12) | 8.2(0.9) | 8.8 | 24.2
… | 21.17(0.13) | 0.90(0.39) | 3.6(2.2) | 3.8 |
… | 22.76(0.22) | 2.20(0.49) | 12.4(2.5) | 5.3 |
49 | 12.64(0.13) | 2.26(0.32) | 7.9(0.9) | 3.3 | 9.8
… | 15.02(0.08) | 0.63(0.18) | 1.9(0.5) | 2.9 |
50 | 31.66(0.03) | 0.47(0.08) | 4.4(0.9) | 8.7 | 27.6
… | 32.71(0.12) | 0.57(0.36) | 1.4(1.1) | 2.3 |
… | 32.94(0.19) | 3.87(0.40) | 21.8(2.3) | 5.3 |
51 | 55.27(0.14) | 1.20(0.30) | 5.3(1.6) | 4.2 | 27.1
… | 57.35(0.08) | 2.13(0.21) | 21.7(1.8) | 9.6 |
53 | 43.95(0.01) | 0.42(0.03) | 8.7(0.6) | 19.4 | 8.7
54 | 36.18(0.21) | 2.11(0.49) | 6.0(1.2) | 2.7 | 6.0
55 | 49.59(0.03) | 0.85(0.11) | 9.7(1.9) | 10.8 | 57.5
… | 49.62(0.05) | 3.32(0.18) | 47.8(2.2) | 13.5 |
57 | 81.38(0.05) | 0.40(0.13) | 1.3(0.4) | 3.0 | 4.3
… | 82.78(0.12) | 1.22(0.31) | 3.0(0.6) | 2.3 |
63 | 20.66(0.14) | 1.74(0.43) | 4.8(1.5) | 2.6 | 11.8
… | 24.87(1.38) | 7.76(2.91) | 7.0(2.5) | 0.9 |
69 | 61.37(0.03) | 0.84(0.07) | 17.1(1.3) | 19.0 | 29.9
… | 60.36(0.07) | 0.72(0.17) | 6.4(1.6) | 8.3 |
… | 58.68(0.20) | 1.84(0.54) | 6.4(1.5) | 3.3 |
72 | 46.08(0.02) | 0.30(0.06) | 6.2(1.5) | 19.4 | 21.7
… | 46.74(0.06) | 0.98(0.13) | 15.5(1.9) | 14.9 |
73 | 64.79(0.08) | 1.18(0.26) | 10.4(4.6) | 8.3 | 43.6
… | 66.17(0.02) | 0.51(0.07) | 7.9(1.5) | 14.4 |
… | 65.99(0.29) | 3.03(0.34) | 25.2(6.0) | 7.8 |
74 | 58.78(0.54) | 4.82(1.09) | 11.6(2.8) | 2.3 | 27.3
… | 59.73(0.04) | 1.19(0.12) | 15.7(2.0) | 12.3 |
76 | 41.38(0.06) | 0.67(0.14) | 4.4(0.8) | 6.1 | 72.3
… | 43.51(0.03) | 0.87(0.08) | 18.6(3.0) | 20.2 |
… | 44.06(0.07) | 2.28(0.10) | 49.2(3.4) | 20.3 |
77 | 63.14(0.04) | 0.66(0.10) | 6.8(1.0) | 9.7 | 25.5
… | 64.40(0.05) | 1.04(0.15) | 14.0(1.7) | 12.7 |
… | 65.92(0.18) | 1.20(0.44) | 4.8(1.5) | 3.8 |
78 | 42.82(0.24) | 7.94(0.58) | 13.0(0.8) | 1.5 | 13.0
83 | 50.67(0.04) | 0.85(0.12) | 10.6(1.5) | 11.7 | 54.8
… | 51.72(0.02) | 0.66(0.05) | 14.7(1.3) | 21.0 |
… | 52.19(0.23) | 5.11(0.47) | 29.5(2.8) | 5.4 |
90 | 96.91(0.02) | 1.24(0.07) | 24.0(1.5) | 18.2 | 136.3
… | 99.94(0.02) | 0.42(0.04) | 7.4(0.7) | 16.6 |
… | 101.38(0.13) | 5.81(0.31) | 73.7(3.0) | 11.9 |
… | 101.50(0.03) | 0.40(0.08) | 3.4(0.8) | 8.0 |
… | 102.63(0.02) | 1.05(0.05) | 27.7(1.6) | 24.8 |
93 | 72.98(0.47) | 6.30(1.18) | 14.7(2.3) | 2.2 | 17.6
… | 73.14(0.04) | 0.42(0.10) | 3.0(0.7) | 6.6 |
94 | 69.72(0.11) | 2.76(0.26) | 12.9(1.1) | 4.4 | 12.9
97 | 113.52(0.02) | 0.63(0.05) | 16.1(1.6) | 24.1 | 80.7
… | 114.33(0.05) | 2.34(0.09) | 58.9(2.4) | 23.7 |
… | 116.58(0.05) | 0.70(0.12) | 5.6(1.0) | 7.6 |
98 | 51.13(0.06) | 0.52(0.14) | 2.3(0.7) | 4.1 | 11.8
… | 52.19(0.14) | 0.98(0.40) | 2.5(1.0) | 2.4 |
… | 52.08(0.87) | 7.15(2.44) | 7.1(1.9) | 0.9 |
99 | 113.26(0.19) | 2.09(0.44) | 4.8(0.9) | 2.2 | 4.8
101 | 108.19(0.05) | 0.84(0.11) | 9.2(1.2) | 10.4 | 68.4
… | 109.45(0.13) | 1.02(0.14) | 5.7(1.7) | 5.3 |
… | 111.20(0.08) | 1.83(0.17) | 23.5(2.5) | 12.1 |
… | 112.66(0.11) | 0.77(0.21) | 6.7(2.0) | 8.1 |
… | 113.35(0.07) | 0.52(0.18) | 5.5(1.8) | 9.8 |
… | 114.13(0.05) | 0.73(0.17) | 8.7(1.8) | 11.2 |
… | 114.94(0.06) | 0.32(0.15) | 1.4(1.0) | 4.1 |
… | 115.69(0.55) | 2.30(0.21) | 8.0(1.8) | 3.3 |
102 | 46.69(0.24) | 2.59(0.58) | 4.2(0.8) | 1.5 | 4.2
104 | 93.88(0.06) | 0.61(0.15) | 6.8(1.4) | 10.6 | 23.2
… | 94.38(0.07) | 0.22(0.11) | 1.7(1.2) | 7.4 |
… | 96.19(0.11) | 2.03(0.27) | 14.6(1.6) | 6.7 |
114 | 104.52(0.33) | 4.89(0.77) | 13.0(2.3) | 2.3 | 14.3
… | 104.52(0.09) | 0.38(0.09) | 1.3(0.5) | 3.2 |
116 | 45.28(0.05) | 0.53(0.11) | 4.2(0.7) | 7.5 | 4.2
117 | 99.29(0.44) | 3.70(1.03) | 6.8(1.6) | 1.7 | 6.8
120 | 79.07(0.09) | 0.43(0.21) | 1.7(0.8) | 3.7 | 16.5
… | 79.71(0.07) | 0.48(0.17) | 2.6(0.9) | 5.0 |
… | 80.02(0.50) | 5.85(1.26) | 12.2(2.2) | 2.0 |
125 | 90.69(0.06) | 0.39(0.16) | 0.8(0.3) | 1.9 | 5.5
… | 90.26(0.77) | 6.87(1.90) | 4.7(1.1) | 0.6 |
126 | 76.43(0.08) | 1.56(0.18) | 10.1(1.0) | 6.1 | 10.1
128 | 60.28(0.01) | 0.51(0.02) | 14.8(0.6) | 27.3 | 14.8
133 | 93.10(0.09) | 1.05(0.20) | 4.8(0.8) | 4.3 | 4.8
134 | 101.16(0.09) | 0.61(0.21) | 2.6(0.8) | 3.9 | 45.1
… | 105.13(0.09) | 3.65(0.23) | 39.9(2.0) | 10.3 |
… | 109.35(0.43) | 1.75(1.02) | 2.7(1.4) | 1.4 |
135 | 103.69(0.07) | 0.53(0.17) | 2.0(0.6) | 3.6 | 10.2
… | 105.54(0.08) | 1.43(0.19) | 8.2(0.9) | 5.4 |
143 | 50.32(0.07) | 0.67(0.17) | 2.9(0.6) | 4.1 | 2.9
144 | 31.35(0.27) | 2.67(0.68) | 4.0(0.9) | 1.4 | 5.6
… | 35.75(0.68) | 2.72(1.71) | 1.6(0.9) | 0.6 |
148 | 96.30(0.08) | 3.62(0.20) | 36.4(1.7) | 9.4 | 36.4
153 | 83.22(0.07) | 1.55(0.17) | 6.3(0.6) | 3.8 | 6.3
154 | 104.09(0.49) | 7.29(1.17) | 9.5(1.3) | 1.2 | 9.5
158 | 106.46(0.25) | 3.63(0.70) | 12.6(1.9) | 3.2 | 14.9
… | 106.47(0.11) | 0.58(0.31) | 1.8(1.1) | 2.9 |
160 | 60.26(0.01) | 0.31(0.05) | 2.6(0.3) | 7.9 | 6.0
… | 61.77(0.04) | 0.76(0.11) | 3.4(0.4) | 4.2 |
161 | 58.09(0.09) | 5.01(0.18) | 61.4(2.3) | 11.5 | 64.9
… | 60.25(0.10) | 0.99(0.29) | 3.6(1.3) | 3.4 |
164 | 52.43(0.23) | 4.82(0.54) | 11.4(1.1) | 2.2 | 11.4
172 | 63.09(0.39) | 2.49(0.91) | 4.2(1.4) | 1.6 | 8.1
… | 65.96(0.32) | 2.05(0.70) | 3.8(1.3) | 1.7 |
181 | 58.10(0.19) | 3.49(0.49) | 10.0(1.2) | 2.7 | 11.1
… | 58.19(0.05) | 0.27(0.16) | 1.0(0.4) | 3.6 |
194 | 67.39(0.26) | 2.88(0.61) | 4.8(0.9) | 1.6 | 4.8
200 | 19.51(0.25) | 0.18(0.05) | 2.2(0.3) | 11.1 | 16.3
… | 20.35(0.55) | 2.51(0.38) | 5.7(1.3) | 2.1 |
… | 22.19(0.04) | 0.75(0.11) | 8.4(1.6) | 10.5 |
209 | 32.01(0.17) | 1.10(0.41) | 2.1(0.6) | 1.8 | 4.4
… | 33.49(0.05) | 0.53(0.12) | 2.3(0.5) | 4.1 |
210 | 36.28(0.11) | 1.37(0.27) | 6.7(1.1) | 4.6 | 10.0
… | 38.21(0.09) | 0.72(0.21) | 3.3(0.8) | 4.2 |
212 | 27.23(0.12) | 1.59(0.26) | 14.4(2.2) | 8.5 | 23.7
… | 28.88(0.18) | 1.20(0.39) | 5.8(2.2) | 4.6 |
… | 30.70(0.11) | 0.91(0.28) | 3.4(0.9) | 3.5 |

Note. — Column (1): source number. Columns. (2)-(5): the velocity at peak
VLSR, the line FWHM $\Delta$V, the integrated intensity $S$, and the peak flux
density $P$ of each maser feature estimated from Gaussian fits to the 95 GHz
class I methanol maser lines. The formal error from the Gaussian fit is given
in parenthesis. Col. (6): the total integrated flux density S${}_{int}^{m}$
(Jy) of the maser spectrum obtained from summing the integrated flux density
of all maser features in each source in column (4).

Table 4: Sources detected as class I methanol masers in previous surveys. Number | Source | Detections | Referee
---|---|---|---
|  | 44 GHz | 95 GHz |
22 | 18024-2119 | Y | N | Fontani et al. (2010)
32 | G10.47+0.03 | Y | – | Kurtz et al. (2004)
33 | G10.62-0.38 | Y | – | Kurtz et al. (2004)
43 | EGO G12.20-0.03 |  | Y | Chen et al. (2011)
51 | EGO G12.91-0.03 |  | Y | Chen et al. (2011)
69 | EGO G16.59-0.05 | Y | Y | Slysh et al. (1994); Val’tts et al. (2000)
73 | EGO G18.89-0.47 | Y | Y | Chen et al. (2011)
74 | EGO G19.01-0.03 | Y | Y | Chen et al. (2011)
76 | EGO G19.88-0.53 | – | Y | Chen et al. (2011)
83 | EGO G22.04+0.22 | Y | Y | Chen et al. (2011)
90 | G23.43-0.19 | Y | – | Slysh et al. (1994)
93 | EGO G23.96-0.11 | Y | – | Chen et al. (2011)
94 | EGO G24.00-0.10 | – | Y | Chen et al. (2011)
97 | EGO G24.33+0.14 | – | Y | Chen et al. (2011)
98 | EGO G24.63+0.15 | – | Y | Chen et al. (2011)
101 | W42 | Y | – | Bachiller et al. (1990)
104 | EGO G25.38-0.15 | – | Y | Chen et al. (2011)
161 | EGO G34.41+0.24 | – | Y | Chen et al. (2011)
181 | EGO G43.04-0.45 | Y | – | Chen et al. (2011)
194 | EGO G49.27-0.34 | Y | – | Cyganowski et al. (2009)
Table 5: The related parameters of the detected class I methanol masers.

Number | Distance | Luminosity | BGPS source | IRDC | Class II maser
---|---|---|---|---|---
|  |  | ID | M | n(H2) | N(H2) |  |
| (kpc) | ($10^{-6}L_{\odot}$) |  | (M⊙) | (103 cm-3) | (1022 cm-2) |  |
(1) | (2) | (3) | (4) | (5) | (6) | (7) | (8) | (9)
11 | 13.0 | 124.3 | 1251 | 4900 | 1.6 | 1.5 | N | N
13 | 3.4 | 6.3 | 1289 | 310 | 5.3 | 1.4 | Y | N
20D | 4.3 | 4.0 | 1363 | 370 | 4.8 | 1.4 | Y | N
22G,D | 5.2 | 17.8 | 1395 | 2100 | 1.5 | 1.1 | Y | Y
29S | 1.9 | 0.9 | 1467 | 560 | 3.0 | 1.1 | Y | N
31 | 12.7 | 229.6 | 1479 | 11000 | 0.8 | 1.2 | N | Y
32 | 11.2 | 308.6 | 1497 | 52000 | 24.6 | 20.8 | N | Y
33 | 4.0∗ | 57.0 | 1508 | 6300 | 113.9 | 28.7 | Y | Y
39 | 13.7 | 38.2 | 1591 | 2000 | – | – | N | N
41G | 12.2 | 48.0 | 1657 | 5000 | 1.6 | 1.6 | N | Y
43G | 12.0 | 39.2 | 1682 | 5900 | 0.8 | 1.0 | N | Y
47G | 2.7 | 5.6 | 1742 | 820 | 3.0 | 1.3 | N | Y
49 | 14.7 | 66.6 | 1778 | 14000 | 0.4 | 0.8 | N | N
50G | 2.3 | 4.6 | 1803 | 830 | 15.9 | 3.9 | Y | Y
51S | 4.6 | 17.9 | 1809 | 1500 | 2.0 | 1.2 | Y | Y
53 | 12.4 | 42.0 | 1853 | 5700 | 0.5 | 0.8 | N | N
54S | 3.5 | 2.3 | 1857 | 540 | 1.6 | 0.7 | Y | N
55G,S | 4.1 | 30.4 | 1865 | 1700 | 4.4 | 2.1 | Y | Y
57 | 11.0 | 16.4 | 1998 | 3000 | 20.7 | 7.2 | N | N
63 | 13.7 | 69.5 | 2124 | 11000 | 0.8 | 1.3 | N | N
69G,S | 4.3 | 17.4 | 2292 | 1300 | 17.6 | 4.8 | Y | Y
72 | 12.5 | 106.4 | 2381 | 11000 | 0.5 | 0.9 | N | N
73G,S | 3.8 | 19.8 | 2467 | 2800 | 1.8 | 1.4 | Y | Y
74G | 12.0 | 123.6 | 2499 | 6800 | 1.6 | 1.7 | N | Y
76G,D | 3.3 | 24.7 | 2636 | 1100 | 16.5 | 4.4 | Y | Y
77D,S | 4.1 | 13.5 | 2641 | 1100 | 3.5 | 1.6 | Y | N
78D | 12.6 | 64.9 | 2659 | 19000 | 1.6 | 2.4 | N | –
83G | 3.3 | 18.8 | 2837 | 1000 | 1.5 | 0.9 | Y | Y
90G | 5.9 | 149.1 | 3071 | 9600 | 1.0 | 1.4 | Y | Y
93G | 11.4 | 72.0 | 3202 | 8600 | 1.1 | 1.4 | N | Y
94G | 11.4 | 52.7 | 3208 | 4800 | 2.6 | 2.1 | N | Y
97G,S | 9.5 | 228.9 | 3284 | 7800 | 4.3 | 3.5 | Y | Y
98S | 3.3 | 4.1 | 3383 | 430 | 3.4 | 1.1 | Y | N
99 | 5.8 | 5.1 | 3394 | 4800 | 2.8 | 2.2 | Y | –
101 | 9.6 | 199.1 | 3413 | 32000 | 3.3 | 4.7 | N | –
102 | 12.2 | 19.6 | 3437 | 11000 | 1.5 | 1.9 | N | –
104 | 5.1 | 18.9 | 3503 | 1600 | 11.6 | 4.0 | Y | –
114 | 5.5 | 13.0 | 3833 | 740 | 2.4 | 1.1 | Y | –
116S | 2.9 | 1.1 | 3876 | 91 | 10.5 | 1.4 | Y | –
117G,S | 5.3 | 6.0 | 3897 | 2000 | 0.6 | 0.6 | Y | Y
120 | 4.5 | 10.5 | 3946 | 790 | 2.7 | 1.2 | Y | –
125 | 4.9 | 4.2 | 4020 | 280 | 4.7 | 1.2 | Y | –
126 | 10.4 | 34.5 | 4082 | 820 | 1.9 | 0.9 | N | –
128 | 3.6 | 6.0 | 4133 | 370 | 0.8 | 0.4 | Y | –
133 | 5.1 | 4.0 | 4366 | 1000 | 0.6 | 0.5 | Y | –
134S | 5.7 | 46.1 | 4398 | 5000 | 1.4 | 1.4 | Y | –
135 | 8.7 | 24.4 | 4472 | 19000 | 0.5 | 1.1 | N | –
143 | 3.1 | 0.9 | 4649 | 35 | – | – | Y | –
144 | 12.3 | 26.6 | 4673 | 6400 | 0.4 | 0.7 | N | –
148D | 5.3 | 32.1 | 4812 | 2200 | 1.3 | 1.0 | Y | –
153D | 9.4 | 17.4 | 5100 | 5900 | 0.6 | 0.8 | N | –
154D | 5.7 | 9.7 | 5167 | 4400 | 0.9 | 1.0 | Y | –
158S | 6.5 | 19.1 | 5252 | 4300 | 0.7 | 0.9 | Y | –
160 | 10.3 | 19.9 | 5270 | 2300 | 0.3 | 0.4 | N | –
161 | 10.4 | 220.7 | 5373 | 44000 | 1.6 | 3.2 | N | –
164 | 10.6 | 40.2 | 5572 | 1700 | 4.3 | 2.1 | N | –
172S | 9.5 | 22.8 | 5869 | 8200 | 2.7 | 2.6 | N | –
181 | 8.6 | 25.8 | 6110 | 2500 | 6.6 | 3.2 | N | –
194S | 5.5∗ | 4.6 | 6323 | 3600 | 7.7 | 3.2 | N | –
200D | 1.6 | 1.3 | 6414 | 280 | 5.6 | 2.3 | Y | –
209 | 3.0 | 1.2 | 6470 | 110 | 8.6 | 1.3 | Y | –
210S | 4.4∗ | 6.1 | 6474 | 350 | 12.8 | 2.5 | N | –
212 | 5.9 | 25.9 | 6479 | 3200 | 8.8 | 4.1 | N | –

Note. — Column (1): source number. The sources which are marked by $G$, $D$ or
$S$ overlaid with that in Green & McClure-Griffiths (2011), Dunham et al.
(2011b) or Schlingman et al. (2011), respectively. Column (2): the kinematic
distance for the source, estimated from the Galactic rotation curve of Reid et
al. (2009). For sources overlapped with Green & McClure-Griffiths (2011), we
adpoted the distances estimated from their work. For the sources (marked by
$\ast$) of which distances cannot be derived from the Galactic rotation curve,
a distance of 4 kpc is adopted for source with an IRDC association (N33), and
that determined in Schlingman et al. (2011) for the other two sources (N194
and N210). Column (3): the integrated luminosity of 95 GHz methanol maser.
Columns (4) – (7): the ID number of BGPS source in the BGPS catalog, the
derived gas mass and averaged H2 volume and column densities of the BGPS
source, respectively. The gas volume and column densities can not be
determined due to absence of radius information for the sources which are
unresolved by the BGPS beam, we marked them with “–”. Column (8): association
with IRDC: Y = Yes, N = No. Column (9): association with a 6.7 GHz methanol
maser for which a precise position has been measured. The positions of the 6.7
GHz class II methanol masers were identified from published 6.7 GHz maser
catalogs (Caswell 2009; Caswell et al. 2010; Green et al. 2010; Caswell et al.
2011 ; Green et al. 2012): Y = Yes, N = No,“–” = no information.

Table 6: Trends with star formation activity for sources with and without methanol masers Property | Group | mean | standard deviation | minimum | median | maximum
---|---|---|---|---|---|---
With and without class I methanol masers
log($N_{H_{2}}^{beam}$) | class I | 22.7 | 0.4 | 21.9 | 22.7 | 23.8
$[cm^{-2}]$ | no class I | 21.9 | 0.3 | 21.4 | 21.9 | 22.7
log($S_{int}$) | class I | 0.7 | 0.4 | -0.6 | 0.7 | 1.5
$[Jy]$ | no class I | 0.0 | 0.4 | -0.9 | 0.0 | 1.1
Radius | class I | 57.8 | 25\. 1 | 15.7 | 56.0 | 128.7
$(^{\prime\prime})$ | no class I | 49.3 | 21.4 | 5.1 | 46.3 | 113.3
Class I methanol masers with and without class II maser associations
log($N_{H_{2}}^{beam}$) | only class I | 22.5 | 0.2 | 22.2 | 22.6 | 22.8
$[cm^{-2}]$ | class I+II | 22.9 | 0.3 | 22.5 | 22.8 | 23.8
log(Sint) | only class I | 0.48 | 0.29 | -0.09 | 0.47 | 1.07
$[Jy]$ | class I+II | 0.86 | 0.31 | 0.41 | 0.79 | 1.49
Table 7: The distributions of class I methanol maser numbers with BGPS source parameters Range | In our observing sample |  | In the full BGPS catalog
---|---|---|---
| detections | total numbers | detection rate |  | total numbers | expected detections
log($N_{H_{2}}^{beam}$) $[cm^{-2}]$ |  |  |  |  |  |
21.0–21.2 | – | – | – |  | 1 | 0
21.2–21.4 | – | – | – |  | 88 | 0
21.4–21.6 | 0 | 1 | 0.00 |  | 717 | 0
21.6–21.8 | 0 | 11 | 0.00 |  | 2021 | 0
21.8–22.0 | 1 | 46 | 0.02 |  | 2303 | 50
22.0–22.2 | 6 | 45 | 0.13 |  | 1451 | 193
22.2–22.4 | 6 | 36 | 0.17 |  | 804 | 134
22.4–22.6 | 11 | 29 | 0.38 |  | 458 | 174
22.6–22.8 | 17 | 23 | 0.74 |  | 240 | 177
22.8–23.0 | 13 | 14 | 0.93 |  | 142 | 132
23.0–23.2 | 5 | 5 | 1.00 |  | 69 | 69
23.2–23.4 | 1 | 1 | 1.00 |  | 34 | 34
23.4–23.6 | 1 | 1 | 1.00 |  | 8 | 8
23.6–23.8 | 2 | 2 | 1.00 |  | 11 | 11
23.8–24.0 | – | – | – |  | 7 | 7
24.0–24.2 | – | – | – |  | 4 | 4
24.4–24.6 | – | – | – |  | 1 | 1
sum |  |  |  |  |  | 995
log($S_{int}$) $[Jy]$ |  |  |  |  |  |
-1.4$-$-1.2 | – | – | – |  | 10 | 0
-1.2$-$-1.0 | – | – | – |  | 109 | 0
-1.0$-$-0.8 | 0 | 2 | 0.00 |  | 410 | 0
-0.8$-$-0.6 | 0 | 2 | 0.00 |  | 771 | 0
-0.6$-$-0.4 | 1 | 25 | 0.04 |  | 1128 | 45
-0.4$-$-0.2 | 1 | 19 | 0.05 |  | 1450 | 76
-0.2$-$0.0 | 4 | 28 | 0.14 |  | 1296 | 185
0.0–0.2 | 3 | 26 | 0.12 |  | 1103 | 127
0.2–0.4 | 6 | 30 | 0.20 |  | 784 | 157
0.4–0.6 | 11 | 31 | 0.35 |  | 531 | 188
0.6–0.8 | 14 | 23 | 0.61 |  | 330 | 201
0.8–1.0 | 11 | 13 | 0.85 |  | 223 | 189
1.0–1.2 | 6 | 9 | 0.67 |  | 115 | 77
1.2–1.4 | 2 | 2 | 1.00 |  | 47 | 47
1.4–1.6 | 4 | 4 | 1.00 |  | 27 | 27
1.6–1.8 | – | – | – |  | 12 | 12
1.8–2.0 | – | – | – |  | 8 | 8
2.0–2.6 | – | – | – |  | 6 | 6
2.6–2.8 | – | – | – |  | 1 | 1
sum |  |  |  |  |  | 1346

Figure 1: Number of sources as a function of the separations of the pair of
GLIMPSE point source and GBPS source in our observing sample.

Figure 2: Spectra of the 95 GHz methanol masers detected in the survey. The
dashed lines represent the Gaussian fitting of each maser feature, the bold-
solid line mark the sum of the Gaussian fitting of all maser feature.

Fig. 2.— Continued.

Fig. 2.— Continued.

Fig. 2.— Continued.

Figure 3: Comparison of the spectra of 95 GHz methanol maser emission in the
11 sources which have been detected in both the PMO 13.7-m survey (this work)
marked with black lines and the EGO-based Mopra survey by Chen et al. (2011)
marked with red lines. A color version of this figure is available in the
online journal.

Figure 4: Color-color diagrams of GLIMPSE point sources associated with and
without class I methanol maser detections in the survey. Filled and open
circles represent the sources with and without class I methanol maser
detections, respectively. The sources associated with EGOs (15 in total) are
enclosed by red triangles. The solid lines overlaid in [3.6]-[4.5] vs.
[5.8]-[8.0] diagram construct the regions occupied by various evolutionary-
stage (Stages I, II and III) YSOs according to the models of Robitaille et al.
(2006). The hatched region in the color-color plot is the region where models
of all evolutionary stages can be present. Note that the Stage II area in the
color-color plot is hatched to show that most models in this region are Stage
II models, however Stage I models can also be found within this area. The
reddening vectors in each panel show an extinction of Av=20, assuming the
Indebetouw et al. (2005) extinction law. A color version of this figure is
available in the online journal.

Figure 5: Left: logarithm of the 95 GHz class I methanol maser luminosity
versus GLIMPSE point source luminosity at 4.5 $\mu$m band; Right: color-color
diagram of [3.6]-log(Sm) versus [3.6]-[4.5] which combines the GLIMPSE point
sources and class I methanol maser emission. The line in each panel marks the
best fit to the corresponding distribution.

Figure 6: Logarithm of the 95 GHz class I methanol maser luminosity as a
function of the gas mass (left panel) and H2 volume density (right panel) of
the associated 1.1 mm BGPS sources. The line in each panel marks the best fit
from the linear regression analysis to the corresponding distribution.

Figure 7: Logarithm of the integrated flux density of the 95 GHz class I
methanol maser as a function of the beam-averaged H2 column density of the
BGPS source. The line marks the best fit from the linear regression analysis
to the distribution.

Figure 8: Number of sources as functions of the BGPS beam-averaged H2 column
density (left), integrated flux density of the BGPS source (middle) and BGPS
source radius (right) for the two groups with and without class I methanol
maser detections. For distributions in each BGPS property, the upper and lower
panels correspond to the BGPS sources with and without class I methanol maser
detections. The mean of each distribution is marked by the vertical dashed
line in the corresponding distribution.

Figure 9: Number of sources as functions of the BGPS beam-averaged H2 column
density (left) and BGPS integrated flux density (right) for the two subsamples
based on which class of methanol masers they are associated with. For
distributions in each BGPS property, the upper and lower panels correspond to
the BGPS sources associated with only class I methanol masers and associated
with both class I and II methanol masers, respectively. The mean of each
distribution is marked by the vertical dashed line in the corresponding
distribution.

Figure 10: Detection rates of class I methanol masers with 4.5 $\mu$m
magnitude (left panel) and [3.6]-[4.5] color (right panel) of the GLIMPSE
point sources. For each mid-IR property, the upper panel shows the histogram
distributions of number of total sample sources and detected class I methanol
maser sources marked with open bars and diagonal bars, respectively, and the
lower panel shows the corresponding detection rate of class I methanol maser
in each statistical bin.

Figure 11: As Figure 10, but for detection rates of class I methanol maser
with the BGPS properties of the beam-averaged H2 column density (left),
integrated flux density (right).

Figure 12: Left panel: Logarithm of the integrated flux densities versus beam-
averaged H2 column density of BGPS sources with and without class I methanol
maser detections (marked by red circles and blue triangles, respectively) in
our current survey sample, the class I methanol maser locating region is
enclosed by the red lines. Right panel: As Left panel, but for all cataloged
BGPS sources. (A color version of this figure is available in the online
journal.)


Jin R. and Li, X.

Backdoor Attack and Defense in Federated Generative Adversarial Network-based Medical Image Synthesis

1]Ruinan Jin
2]Xiaoxiao Lifn1cor1
[cor1]Corresponding author: Xiaoxiao Li<EMAIL_ADDRESS>
[1]Computer Science Department, The University of British Columbia, BC, V6T 1Z4, Canada
[2]Electrical and Computer Engineering Department, The University of British Columbia, BC, V6T 1Z4, Canada

Deep Learning-based image synthesis techniques have been applied in healthcare research for generating medical images to support open research and augment medical datasets. Training generative adversarial neural networks (GANs) usually require large amounts of training data. Federated learning (FL) provides a way of training a central model using distributed data while keeping raw data locally. However, given that the FL server cannot access the raw data, it is vulnerable to backdoor attacks, an adversarial by poisoning training data. Most backdoor attack strategies focus on classification models and centralized domains. It is still an open question if the existing backdoor attacks can affect GAN training and, if so, how to defend against the attack in the FL setting. In this work, we investigate the overlooked issue of backdoor attacks in federated GANs (FedGANs). The success of this attack is subsequently determined to be the result of some local discriminators overfitting the poisoned data and corrupting the local GAN equilibrium, which then further contaminates other clients when averaging the generator's parameters and yields high generator loss. Therefore, we proposed , an efficient and effective way of defending against the backdoor attack in the FL setting, which allows the server to detect the client's adversarial behavior based on their losses and block the malicious clients. Our extensive experiments on two medical datasets with different modalities demonstrate the backdoor attack on FedGANs can result in synthetic images with low fidelity. After detecting and suppressing the detected malicious clients using the proposed defense strategy, we show that FedGANs can synthesize high-quality medical datasets (with labels) for data augmentation to improve classification models' performance.

Generative Adversarial NetworksFederated LearningBackdoor Attack

§ PRELIMINARIES AND RELATED WORK

§.§ Conditional Generative Adversarial Networks

GAN was first been proposed in [Goodfellow et al., 2014] as an unsupervised generative algorithm, where two deep neural networks, discriminator and generator are training against each other to optimize minmax objective function Eq. <ref>.

\begin{equation}
\label{eq:ganloss}
\min_{G}\max_{D}\mathbb{E}_{x\sim p_{\text{data}}(x)}[\log{D(x)}] +  \mathbb{E}_{z\sim p_{\text{z}}(z)}[\log{(1 - D(G(z)))}],
\end{equation}

where $G$ and $D$ are generator and discrimnator, $x$ is the training data, and $z$ is a random noise vector sampled from a predefined distribution $p_z.$ GAN has been used to generate medical image datasets for data augmentation and data sharing for open research as healthcare institutions are regulated to release their collected private data [Chen et al., 2022, Lin et al., 2022].

Later, [Mirza and Osindero, 2014] implemented the conditional GAN, turning GAN to be supervised learning algorithm, where both the discriminator and the generator take an extra auxiliary label so that GAN generates images conditional on the given label according to updated objective function Eq. <ref>.

\begin{equation}
\label{eq:cganloss1}
\min_{G}\max_{D}\mathbb{E}_{x\sim p_{\text{data}}(x)}[\log{D(x|c)}] +  \mathbb{E}_{z\sim p_{\text{z}}(z)}[ \log{(1-D(G(z|c)))}],
\end{equation}

where we add class label $c$ as the conditional term compared to Eq. <ref>. Generating synthetic medical data using conditional GAN is gain more practical values in healthcare scenarios, because medical data is usually labeled and this label makes it meaningful for diagnostic purposes, e.g., for classifying if certain patient has the disease [Frangi et al., 2018], and for data augmentation [Chen et al., 2022].

§.§ Federated Learning

Training DL models usually requires a large amount of training data. However, collecting data is challenging in the field of healthcare because healthcare providers, governments, and related medical organizations must pay particular attention to the patient's privacy and guarantee the proper use of their collected data [Price and Cohen, 2019]. In this case, limited data in local healthcare institutions is usually
biased and unilateral [Wang et al., 2020], which in turn impede the AI-assisted diagnostic technology in healthcare [Van Panhuis et al., 2014].

FL has been proposed as a promising strategy to facilitate collaboration among several institutions (, medical centers distributed from different geographical locations) to train a global DL model [Konečnỳ et al., 2016]. Given the important role of FL plays in leveraging medical data from distributed locations and the practical usage of DL-based synthetic models in medicine, combining them together will help facilitate advancement in medicine. Previous studies try to establish the FedGAN [Rasouli et al., 2020] and explored its robustness in terms of the differential privacy [Augenstein et al., 2019].

In addition, Byzantine-Robust FL is a key challenge in FL deployment, as the clients are barely controllable and typically viewed as an open system. Literature has shown that FL is vulnerable to multiple kinds of adversaries [Bouacida and Mohapatra, 2021, Liu et al., 2022]. Example vulnerabilities includes model poisoning attacks [Bhagoji et al., 2019], gradient inversion attacks [Huang et al., 2021], inference attacks [Ying et al., 2020], backdoor attacks [Li et al., 2022], etc.

§.§ Backdoor Attack

In this section, we begin by introducing the general concept of a backdoor attack. Next, we delve into the specific details of backdoor attacks in FL and backdoor attacks in generative models.

General conceptThe backdoor attackers aim to embed a backdoor, also known as trigger, in the training data in order to corrupt the performance of the Deep Neural Network. Given it involves poisoning data, it belongs to the fields of data poisoning attacks, which has been widely explored in multiple machine learning fields, including Support Vector Machines, Statistical Machine Learning, and DL [Biggio et al., 2012, Nelson et al., 2008]. In DL, current studies mainly explore poisoning attacks in centralized classification models, where a hidden trigger is pasted on some of the training data with wrong labels. The attacker activates it during the testing time so that the classification model produces a lower testing accuracy for images with triggers [Saha et al., 2020]. This attack strategy takes advantage of the tendency that the deep neural network is more likely to learn the pattern of the backdoor instead of the actual image [Li et al., 2022].

Backdoor attack in FL
Due to the distributed nature of FL, the server has little control on the client side. Namely, FL is even more vulnerable to backdoor and poisoning attacks. Existing studies have explored such attacks in classification models from various perspectives. [Bagdasaryan et al., 2020] proposed to use apply model replacement as a means to introduce backdoored functionality into the global model within FL. [Fang et al., 2020] introduced the initial concept of local model poisoning attacks targeting the Byzantine robustness of FL. [Wang et al., 2020] introduced a novel concept of an edge-case backdoor, which manipulates a model to misclassify seemingly straightforward inputs that are highly unlikely to be part of the training or test data. [Sun et al., 2019] conducts a thorough investigation of backdoor attacks and defense strategies in FL classification models

Backdoor attack on GAN
The existing backdoor attack has been focusing on classification models. Despite this, the applicability of backdoor attacks against GANs is underexplored, especially in the field of medicine. This is due to the fact that backdoor attacks against GANs are more complex, since the input for GANs is a noise vector, while the output is a generated-new-mage. Backdoor in FL for classification models was initially introduced by  [Bagdasaryan et al., 2020], where a constrain-and-scale technique is applied to amplify the malicious gradient of clients. In the study, the local clients are flexible to employ local training procedures. However, this scenario is unlikely to happen in the medical circumstances, given the organizer of the FL can enforce the proper training procedure on reliable hardware to prevent malicious clients from taking adversarial actions [Pillutla et al., 2019]. In contrast to the previous backdoor federated classification study, we assume that there is a reliable FL pipeline that each client follows the provided training rules to calculate and update the correct parameters without modifying them, thereby performing the given training process in accordance with the instructions given by the trusted server (the organizer of the FL in reality). Then we investigate how backdoor attack can affect GAN for data synthesis in this FL setting.

§.§ Defending Backdoor Attack

There are a variety of defense strategies for backdoor attacks ranging from data level to model level but with a focus on the classification models in centralized training. Data level defenses mainly include two perspectives: 1) Detect the trigger pattern and either eliminate it from the data or add a trigger blocker to decrease the contribution of the backdoor during training the DL model [Doan et al., 2020]. 2) Perform a series of data argumentation (e.g., shrinking, flipping) before feeding the data into the model [Qiu et al., 2021, Villarreal-Vasquez and Bhargava, 2020]. This is because the transitional backdoor attack is sensitive to the pattern of the trigger and the location of the backdoor patch [Li et al., 2021].

There are more model-level defense strategies: 1) Reconstructing attacked model strategy. This strategy aims to retrain the trained attacker model with some benign samples to alleviate the backdoor attacks. 2) Synthesis trigger defencing strategy. It attempts to perform outlier detection on the DL models by reconstructing either the specific trigger [Wang et al., 2019, Harikumar et al., 2020] or the trigger distribution [Zhu et al., 2020, Guo et al., 2020]. 3) Diagnosing attacked model through meta-classifier. This method applies certain pre-trained classifiers to identify the potentially infected models and prevent deploying them [Kolouri et al., 2020, Zheng et al., 2021]. 4) Unlearning the infected model. The unlearning strategy first detects the malicious behavior and then defends against the backdoor attack by performing reverse learning through utilizing the implicit hypergradient [Zeng et al., 2021] or modifying the loss function [Li et al., 2021]. 5) Robust aggregation. This strategy is specifically tailored for FL. It involves meticulous adjustments of the server aggregation learning rate, taking into account client updates on a per-dimension and per-round basis [Pillutla et al., 2019]. 6) Adversarial distillation. This defense strategy is also designed for classification tasks in FL. It employs a GAN on the server side to acquire a distillation dataset. Subsequently, knowledge distillation is applied, utilizing a clean model as the teacher to educate the server model and remove the backdoored neurons from the malicious model [Zhu et al., 2023]. 7) Trigger inverse engineering. This is a provable technique that is proposed specifically for backdoor attacks under FL classification models [Zhang et al., 2022].

It requires the benign clients to apply trigger inversion techniques in the training time to construct an augmented dataset that consists of poisoned images with clean labels. This serves as model hardening and reduces the prediction confidence of backdoored sample. The inference step then takes advantage of this prediction confidence to perform classification tasks.

Moreover, the comprehensive backdoor attack surveys can be found in [Li et al., 2022] and  [Guo et al., 2022].

Unfortunately, most of the above defense strategies do not fit the FedGAN settings, either due to the server cannot access the local private data, or the training of GAN-based generative models does not behave the same as the classification models.

§ ACKNOWLEDGMENTS

This work is supported in part by the Natural Sciences and Engineering Research Council of Canada (NSERC), Public Safety Canada (NS-5001-22170), and NVIDIA Hardware Award. We thank Chun-Yin Huang and Nan Wang for their kind instruction to Ruinan Jin and assistance with implementation.

[Augenstein et al., 2019]
authorAugenstein, S., authorMcMahan, H.B.,
authorRamage, D., authorRamaswamy, S.,
authorKairouz, P., authorChen, M.,
authorMathews, R., et al., year2019.
titleGenerative models for effective ml on private,
decentralized datasets.
journalarXiv preprint arXiv:1911.06679 .

[Bagdasaryan et al., 2020]
authorBagdasaryan, E., authorVeit, A.,
authorHua, Y., authorEstrin, D.,
authorShmatikov, V., year2020.
titleHow to backdoor federated learning, in:
booktitleInternational Conference on Artificial Intelligence and
Statistics, organizationPMLR. pp. pages2938–2948.

[Bhagoji et al., 2019]
authorBhagoji, A.N., authorChakraborty, S.,
authorMittal, P., authorCalo, S.,
titleAnalyzing federated learning through an adversarial
lens, in: booktitleInternational Conference on Machine Learning,
organizationPMLR. pp. pages634–643.

[Biggio et al., 2012]
authorBiggio, B., authorNelson, B.,
authorLaskov, P., year2012.
titlePoisoning attacks against support vector machines.
journalarXiv preprint arXiv:1206.6389 .

[Borgnia et al., 2021]
authorBorgnia, E., authorCherepanova, V.,
authorFowl, L., authorGhiasi, A.,
authorGeiping, J., authorGoldblum, M.,
authorGoldstein, T., authorGupta, A.,
titleStrong data augmentation sanitizes poisoning and
backdoor attacks without an accuracy tradeoff, in:
booktitleICASSP 2021-2021 IEEE International Conference on
Acoustics, Speech and Signal Processing (ICASSP),
organizationIEEE. pp. pages3855–3859.

[Bouacida and Mohapatra, 2021]
authorBouacida, N., authorMohapatra, P.,
titleVulnerabilities in federated learning.
journalIEEE Access volume9,

[Buczak et al., 2010]
authorBuczak, A.L., authorBabin, S.,
authorMoniz, L., year2010.
titleData-driven approach for creating synthetic
electronic medical records.
journalBMC medical informatics and decision making
volume10, pages1–28.

[Cao et al., 2020]
authorCao, X., authorFang, M., authorLiu,
J., authorGong, N.Z., year2020.
titleFltrust: Byzantine-robust federated learning via
trust bootstrapping.
journalarXiv preprint arXiv:2012.13995 .

[Chang et al., 2020]
authorChang, Q., authorQu, H., authorZhang,
Y., authorSabuncu, M., authorChen, C.,
authorZhang, T., authorMetaxas, D.N.,
titleSynthetic learning: Learn from distributed
asynchronized discriminator gan without sharing medical image data, in:
booktitleProceedings of the IEEE/CVF Conference on Computer Vision
and Pattern Recognition, pp. pages13856–13866.

[Chen et al., 2021]
authorChen, R.J., et al., year2021.
titleSynthetic data in machine learning for medicine and
journalNature Biomedical Engineering volume5,

[Chen et al., 2017]
authorChen, X., authorLiu, C., authorLi,
B., authorLu, K., authorSong, D.,
titleTargeted backdoor attacks on deep learning systems
using data poisoning.
journalarXiv preprint arXiv:1712.05526 .

[Chen et al., 2022]
authorChen, Y., authorYang, X.H., authorWei,
Z., authorHeidari, A.A., authorZheng, N.,
authorLi, Z., authorChen, H., authorHu,
H., authorZhou, Q., authorGuan, Q.,
titleGenerative adversarial networks in medical image
augmentation: a review.
journalComputers in Biology and Medicine ,

[Codella et al., 2018]
authorCodella, N.C., authorGutman, D.,
authorCelebi, M.E., authorHelba, B.,
authorMarchetti, M.A., authorDusza, S.W.,
authorKalloo, A., authorLiopyris, K.,
authorMishra, N., authorKittler, H., et al.,
titleSkin lesion analysis toward melanoma detection: A
challenge at the 2017 international symposium on biomedical imaging (isbi),
hosted by the international skin imaging collaboration (isic), in:
booktitle2018 IEEE 15th international symposium on biomedical
imaging (ISBI 2018), organizationIEEE. pp.

[Doan et al., 2020]
authorDoan, B.G., authorAbbasnejad, E.,
authorRanasinghe, D.C., year2020.
titleFebruus: Input purification defense against trojan
attacks on deep neural network systems, in: booktitleAnnual
Computer Security Applications Conference, pp. pages897–912.

[Dube and Gallagher, 2013]
authorDube, K., authorGallagher, T.,
titleApproach and method for generating realistic
synthetic electronic healthcare records for secondary use, in:
booktitleInternational Symposium on Foundations of Health
Informatics Engineering and Systems, organizationSpringer. pp.

[Fang et al., 2020]
authorFang, M., authorCao, X., authorJia,
J., authorGong, N., year2020.
titleLocal model poisoning attacks to
$\{$Byzantine-Robust$\}$ federated learning, in: booktitle29th
USENIX Security Symposium (USENIX Security 20), pp.

[Feng et al., 2022]
authorFeng, Y., authorMa, B., authorZhang,
J., authorZhao, S., authorXia, Y.,
authorTao, D., year2022.
titleFiba: Frequency-injection based backdoor attack in
medical image analysis, in: booktitleProceedings of the IEEE/CVF
Conference on Computer Vision and Pattern Recognition, pp.

[Frangi et al., 2018]
authorFrangi, A.F., authorTsaftaris, S.A.,
authorPrince, J.L., year2018.
titleSimulation and synthesis in medical imaging.
journalIEEE transactions on medical imaging
volume37, pages673–679.

[Goodfellow et al., 2014]
authorGoodfellow, I., authorPouget-Abadie, J.,
authorMirza, M., authorXu, B.,
authorWarde-Farley, D., authorOzair, S.,
authorCourville, A., authorBengio, Y.,
titleGenerative adversarial nets.
journalAdvances in neural information processing systems

[Guo et al., 2021]
authorGuo, W., authorTondi, B., authorBarni,
M., year2021.
titleAn overview of backdoor attacks against deep neural
networks and possible defences.
journalarXiv preprint arXiv:2111.08429 .

[Guo et al., 2022]
authorGuo, W., authorTondi, B., authorBarni,
M., year2022.
titleAn overview of backdoor attacks against deep neural
networks and possible defences.
journalIEEE Open Journal of Signal Processing .

[Guo et al., 2020]
authorGuo, W., authorWang, L., authorXu,
Y., authorXing, X., authorDu, M.,
authorSong, D., year2020.
titleTowards inspecting and eliminating trojan backdoors
in deep neural networks, in: booktitle2020 IEEE International
Conference on Data Mining (ICDM), organizationIEEE. pp.

[Harikumar et al., 2020]
authorHarikumar, H., authorLe, V.,
authorRana, S., authorBhattacharya, S.,
authorGupta, S., authorVenkatesh, S.,
titleScalable backdoor detection in neural networks, in:
booktitleJoint European Conference on Machine Learning and
Knowledge Discovery in Databases, organizationSpringer. pp.

[Huang et al., 2017]
authorHuang, G., authorLiu, Z., authorVan
Der Maaten, L., authorWeinberger, K.Q., year2017.
titleDensely connected convolutional networks, in:
booktitleProceedings of the IEEE conference on computer vision and
pattern recognition, pp. pages4700–4708.

[Huang et al., 2021]
authorHuang, Y., authorGupta, S.,
authorSong, Z., authorLi, K., authorArora,
S., year2021.
titleEvaluating gradient inversion attacks and defenses in
federated learning.
journalAdvances in Neural Information Processing Systems
volume34, pages7232–7241.

[Jin and Li, 2022]
authorJin, R., authorLi, X., year2022.
titleBackdoor attack is a devil in federated gan-based
medical image synthesis, in: booktitleInternational Workshop on
Simulation and Synthesis in Medical Imaging,
organizationSpringer. pp. pages154–165.

[Karras et al., 2020]
authorKarras, T., authorAittala, M.,
authorHellsten, J., authorLaine, S.,
authorLehtinen, J., authorAila, T.,
titleTraining generative adversarial networks with limited
journalAdvances in Neural Information Processing Systems
volume33, pages12104–12114.

[Kermany et al., 2018]
authorKermany, D.S., authorGoldbaum, M.,
authorCai, W., authorValentim, C.C.,
authorLiang, H., authorBaxter, S.L.,
authorMcKeown, A., authorYang, G.,
authorWu, X., authorYan, F., et al.,
titleIdentifying medical diagnoses and treatable diseases
by image-based deep learning.
journalCell volume172,

[Kirkpatrick et al., 2017]
authorKirkpatrick, J., authorPascanu, R.,
authorRabinowitz, N., authorVeness, J.,
authorDesjardins, G., authorRusu, A.A.,
authorMilan, K., authorQuan, J.,
authorRamalho, T., authorGrabska-Barwinska, A.,
et al., year2017.
titleOvercoming catastrophic forgetting in neural
journalProceedings of the national academy of sciences
volume114, pages3521–3526.

[Kolouri et al., 2020]
authorKolouri, S., authorSaha, A.,
authorPirsiavash, H., authorHoffmann, H.,
titleUniversal litmus patterns: Revealing backdoor attacks
in cnns, in: booktitleProceedings of the IEEE/CVF Conference on
Computer Vision and Pattern Recognition, pp. pages301–310.

[Konečnỳ et al., 2016]
authorKonečnỳ, J., authorMcMahan, H.B.,
authorYu, F.X., authorRichtárik, P.,
authorSuresh, A.T., authorBacon, D.,
titleFederated learning: Strategies for improving
communication efficiency.
journalarXiv preprint arXiv:1610.05492 .

[Li et al., 2022]
authorLi, Y., authorJiang, Y., authorLi,
Z., authorXia, S.T., year2022.
titleBackdoor learning: A survey.
journalIEEE Transactions on Neural Networks and Learning
Systems .

[Li et al., 2021]
authorLi, Y., authorLyu, X., authorKoren,
N., authorLyu, L., authorLi, B.,
authorMa, X., year2021a.
titleAnti-backdoor learning: Training clean models on
poisoned data.
journalAdvances in Neural Information Processing Systems
volume34, pages14900–14912.

[Li et al., 2021]
authorLi, Y., authorZhai, T., authorJiang,
Y., authorLi, Z., authorXia, S.T.,
titleBackdoor attack in the physical world.
journalarXiv preprint arXiv:2104.02361 .

[Li et al., 2020]
authorLi, Y., authorZhai, T., authorWu, B.,
authorJiang, Y., authorLi, Z., authorXia,
S., year2020.
titleRethinking the trigger of backdoor attack.
journalarXiv preprint arXiv:2004.04692 .

[Lin et al., 2022]
authorLin, Y., authorWang, Z., authorCheng,
K.T., authorChen, H., year2022.
titleInsmix: Towards realistic generative data
augmentation for nuclei instance segmentation.
journalarXiv preprint arXiv:2206.15134 .

[Liu et al., 2008]
authorLiu, F.T., authorTing, K.M.,
authorZhou, Z.H., year2008.
titleIsolation forest, in: booktitle2008
eighth ieee international conference on data mining,
organizationIEEE. pp. pages413–422.

[Liu et al., 2022]
authorLiu, X., authorLi, W., authorYuan,
Y., year2022.
titleIntervention & interaction federated abnormality
detection with noisy clients, in: booktitleInternational
Conference on Medical Image Computing and Computer-Assisted Intervention,
organizationSpringer. pp. pages309–319.

[Liu et al., 2020]
authorLiu, Y., authorMa, X., authorBailey,
J., authorLu, F., year2020.
titleReflection backdoor: A natural backdoor attack on
deep neural networks, in: booktitleEuropean Conference on
Computer Vision, organizationSpringer. pp.

[Liu et al., 2017]
authorLiu, Y., authorXie, Y.,
authorSrivastava, A., year2017.
titleNeural trojans, in: booktitle2017 IEEE
International Conference on Computer Design (ICCD),
organizationIEEE. pp. pages45–48.

[Malin et al., 2013]
authorMalin, B.A., authorEmam, K.E.,
authorO'Keefe, C.M., year2013.
titleBiomedical data privacy: problems, perspectives, and
recent advances.
journalJournal of the American medical informatics
association volume20, pages2–6.

[McMahan et al., 2017]
authorMcMahan, B., authorMoore, E.,
authorRamage, D., authorHampson, S.,
authory Arcas, B.A., year2017.
titleCommunication-efficient learning of deep networks
from decentralized data, in: booktitleArtificial intelligence and
statistics, organizationPMLR. pp. pages1273–1282.

[Mirza and Osindero, 2014]
authorMirza, M., authorOsindero, S.,
titleConditional generative adversarial nets.
journalarXiv preprint arXiv:1411.1784 .

[Nelson et al., 2008]
authorNelson, B., authorBarreno, M.,
authorChi, F.J., authorJoseph, A.D.,
authorRubinstein, B.I., authorSaini, U.,
authorSutton, C., authorTygar, J.D.,
authorXia, K., year2008.
titleExploiting machine learning to subvert your spam
journalLEET volume8, pages9.

[Ozdayi et al., 2021]
authorOzdayi, M.S., authorKantarcioglu, M.,
authorGel, Y.R., year2021.
titleDefending against backdoors in federated learning
with robust learning rate, in: booktitleProceedings of the AAAI
Conference on Artificial Intelligence, pp. pages9268–9276.

[Pillutla et al., 2019]
authorPillutla, K., authorKakade, S.M.,
authorHarchaoui, Z., year2019.
titleRobust aggregation for federated learning.
journalarXiv preprint arXiv:1912.13445 .

[Pogorelov et al., 2017]
authorPogorelov, K., authorRandel, K.R.,
authorGriwodz, C., authorEskeland, S.L.,
authorde Lange, T., authorJohansen, D.,
authorSpampinato, C., authorDang-Nguyen, D.T.,
authorLux, M., authorSchmidt, P.T., et al.,
titleKvasir: A multi-class image dataset for computer
aided gastrointestinal disease detection, in:
booktitleProceedings of the 8th ACM on Multimedia Systems
Conference, pp. pages164–169.

[Price and Cohen, 2019]
authorPrice, W.N., authorCohen, I.G.,
titlePrivacy in the age of medical big data.
journalNature medicine volume25,

[Qiu et al., 2021]
authorQiu, H., authorZeng, Y., authorGuo,
S., authorZhang, T., authorQiu, M.,
authorThuraisingham, B., year2021.
titleDeepsweep: An evaluation framework for mitigating dnn
backdoor attacks using data augmentation, in:
booktitleProceedings of the 2021 ACM Asia Conference on Computer
and Communications Security, pp. pages363–377.

[Radford et al., 2015]
authorRadford, A., authorMetz, L.,
authorChintala, S., year2015.
titleUnsupervised representation learning with deep
convolutional generative adversarial networks.
journalarXiv preprint arXiv:1511.06434 .

[Rasouli et al., 2020]
authorRasouli, M., authorSun, T.,
authorRajagopal, R., year2020.
titleFedgan: Federated generative adversarial networks for
distributed data.
journalarXiv preprint arXiv:2006.07228 .

[Rawat et al., 2021]
authorRawat, A., authorLevacher, K.,
authorSinn, M., year2021.
titleThe devil is in the gan: Defending deep generative
models against backdoor attacks.
journalarXiv preprint arXiv:2108.01644 .

[Rieke et al., 2020]
authorRieke, N., authorHancox, J., authorLi,
W., authorMilletari, F., authorRoth, H.R.,
authorAlbarqouni, S., authorBakas, S.,
authorGaltier, M.N., authorLandman, B.A.,
authorMaier-Hein, K., et al., year2020.
titleThe future of digital health with federated
journalNPJ digital medicine volume3,

[Saha et al., 2020]
authorSaha, A., authorSubramanya, A.,
authorPirsiavash, H., year2020.
titleHidden trigger backdoor attacks, in:
booktitleProceedings of the AAAI conference on artificial
intelligence, pp. pages11957–11965.

[Salem et al., 2020]
authorSalem, A., authorSautter, Y.,
authorBackes, M., authorHumbert, M.,
authorZhang, Y., year2020.
titleBaaan: Backdoor attacks against autoencoder and
gan-based machine learning models.
journalarXiv preprint arXiv:2010.03007 .

[Scherer et al., 2020]
authorScherer, J., authorNolden, M.,
authorKleesiek, J., authorMetzger, J.,
authorKades, K., authorSchneider, V.,
authorBach, M., authorSedlaczek, O.,
authorBucher, A.M., authorVogl, T.J., et al.,
titleJoint imaging platform for federated clinical data
journalJCO clinical cancer informatics
volume4, pages1027–1038.

[Shorten and Khoshgoftaar, 2019]
authorShorten, C., authorKhoshgoftaar, T.M.,
titleA survey on image data augmentation for deep
journalJournal of big data volume6,

[Song et al., 2021]
authorSong, Y., authorSohl-Dickstein, J.,
authorKingma, D.P., authorKumar, A.,
authorErmon, S., authorPoole, B.,
titleScore-based generative modeling through stochastic
differential equations.
journalThe International Conference on Learning
Representations .

[Sun et al., 2021]
authorSun, G., authorCong, Y., authorDong,
J., authorWang, Q., authorLyu, L.,
authorLiu, J., year2021.
titleData poisoning attacks on federated machine
journalIEEE Internet of Things Journal
volume9, pages11365–11375.

[Sun et al., 2019]
authorSun, Z., authorKairouz, P.,
authorSuresh, A.T., authorMcMahan, H.B.,
titleCan you really backdoor federated learning?
journalarXiv preprint arXiv:1911.07963 .

[Teramoto et al., 2020]
authorTeramoto, A., authorTsukamoto, T.,
authorYamada, A., authorKiriyama, Y.,
authorImaizumi, K., authorSaito, K.,
authorFujita, H., year2020.
titleDeep learning approach to classification of lung
cytological images: Two-step training using actual and synthesized images by
progressive growing of generative adversarial networks.
journalPloS one volume15,

[Tolpegin et al., 2020]
authorTolpegin, V., authorTruex, S.,
authorGursoy, M.E., authorLiu, L.,
titleData poisoning attacks against federated learning
systems, in: booktitleComputer Security–ESORICS 2020: 25th
European Symposium on Research in Computer Security, ESORICS 2020, Guildford,
UK, September 14–18, 2020, Proceedings, Part I 25,
organizationSpringer. pp. pages480–501.

[Usynin et al., 2022]
authorUsynin, D., authorKlause, H.,
authorPaetzold, J.C., authorRueckert, D.,
authorKaissis, G., year2022.
titleCan collaborative learning be private, robust and
scalable?, in: booktitleInternational Workshop on Distributed,
Collaborative, and Federated Learning, Workshop on Affordable Healthcare and
AI for Resource Diverse Global Health, organizationSpringer. pp.

[Van Panhuis et al., 2014]
authorVan Panhuis, W.G., authorPaul, P.,
authorEmerson, C., authorGrefenstette, J.,
authorWilder, R., authorHerbst, A.J.,
authorHeymann, D., authorBurke, D.S.,
titleA systematic review of barriers to data sharing in
public health.
journalBMC public health volume14,

[Villarreal-Vasquez and Bhargava, 2020]
authorVillarreal-Vasquez, M., authorBhargava, B.,
titleConfoc: Content-focus protection against trojan
attacks on neural networks.
journalarXiv preprint arXiv:2007.00711 .

[Wang et al., 2019]
authorWang, B., authorYao, Y., authorShan,
S., authorLi, H., authorViswanath, B.,
authorZheng, H., authorZhao, B.Y.,
titleNeural cleanse: Identifying and mitigating backdoor
attacks in neural networks, in: booktitle2019 IEEE Symposium on
Security and Privacy (SP), organizationIEEE. pp.

[Wang et al., 2020]
authorWang, H., authorSreenivasan, K.,
authorRajput, S., authorVishwakarma, H.,
authorAgarwal, S., authorSohn, J.y.,
authorLee, K., authorPapailiopoulos, D.,
titleAttack of the tails: Yes, you really can backdoor
federated learning.
journalAdvances in Neural Information Processing Systems
volume33, pages16070–16084.

[Wang et al., 2020]
authorWang, H., authorYurochkin, M.,
authorSun, Y., authorPapailiopoulos, D.,
authorKhazaeni, Y., year2020b.
titleFederated learning with matched averaging.
journalarXiv preprint arXiv:2002.06440 .

[Wang et al., 2020]
authorWang, Z., authorChen, J., authorHoi,
S.C., year2020c.
titleDeep learning for image super-resolution: A survey.
journalIEEE transactions on pattern analysis and machine
intelligence volume43, pages3365–3387.

[Woodland et al., 2022]
authorWoodland, M., authorWood, J.,
authorAnderson, B.M., authorKundu, S.,
authorLin, E., authorKoay, E.,
authorOdisio, B., authorChung, C.,
authorKang, H.C., authorVenkatesan, A.M., et al.,
titleEvaluating the performance of stylegan2-ada on
medical images, in: booktitleInternational Workshop on Simulation
and Synthesis in Medical Imaging, organizationSpringer. pp.

[Xu et al., 2021]
authorXu, X., authorWang, Q., authorLi, H.,
authorBorisov, N., authorGunter, C.A.,
authorLi, B., year2021.
titleDetecting ai trojans using meta neural analysis, in:
booktitle2021 IEEE Symposium on Security and Privacy (SP),
organizationIEEE. pp. pages103–120.

[Xue et al., 2022]
authorXue, C., authorYu, L., authorChen,
P., authorDou, Q., authorHeng, P.A.,
titleRobust medical image classification from noisy
labeled data with global and local representation guided co-training.
journalIEEE Transactions on Medical Imaging
volume41, pages1371–1382.

[Ying et al., 2020]
authorYing, Z., authorZhang, Y., authorLiu,
X., year2020.
titlePrivacy-preserving in defending against membership
inference attacks, in: booktitleProceedings of the 2020 Workshop
on Privacy-Preserving Machine Learning in Practice, pp.

[Yu et al., 2021]
authorYu, S., authorZhang, S., authorWang,
B., authorDun, H., authorXu, L.,
authorHuang, X., authorShi, E.,
authorFeng, X., year2021.
titleGenerative adversarial network based data
augmentation to improve cervical cell classification model.
journalMath. Biosci. Eng volume18,

[Zeng et al., 2021]
authorZeng, Y., authorChen, S., authorPark,
W., authorMao, Z.M., authorJin, M.,
authorJia, R., year2021a.
titleAdversarial unlearning of backdoors via implicit
journalarXiv preprint arXiv:2110.03735 .

[Zeng et al., 2021]
authorZeng, Y., authorPark, W., authorMao,
Z.M., authorJia, R., year2021b.
titleRethinking the backdoor attacks' triggers: A
frequency perspective, in: booktitleProceedings of the IEEE/CVF
International Conference on Computer Vision, pp.

[Zhang et al., 2022]
authorZhang, K., authorTao, G., authorXu,
Q., authorCheng, S., authorAn, S.,
authorLiu, Y., authorFeng, S., authorShen,
G., authorChen, P.Y., authorMa, S., et al.,
titleFlip: A provable defense framework for backdoor
mitigation in federated learning.
journalarXiv preprint arXiv:2210.12873 .

[Zhang et al., 2018]
authorZhang, R., authorIsola, P.,
authorEfros, A.A., authorShechtman, E.,
authorWang, O., year2018.
titleThe unreasonable effectiveness of deep features as a
perceptual metric, in: booktitleProceedings of the IEEE
conference on computer vision and pattern recognition, pp.

[Zheng et al., 2021]
authorZheng, S., authorZhang, Y.,
authorWagner, H., authorGoswami, M.,
authorChen, C., year2021.
titleTopological detection of trojaned neural networks.
journalAdvances in Neural Information Processing Systems
volume34, pages17258–17272.

[Zhu et al., 2023]
authorZhu, C., authorZhang, J., authorSun,
X., authorChen, B., authorMeng, W.,
titleAdfl: Defending backdoor attacks in federated
learning via adversarial distillation.
journalComputers & Security , pages103366.

[Zhu et al., 2020]
authorZhu, L., authorNing, R., authorWang,
C., authorXin, C., authorWu, H.,
titleGangsweep: Sweep out neural backdoors by gan, in:
booktitleProceedings of the 28th ACM International Conference on
Multimedia, pp. pages3173–3181.

§.§ Responses to Reviewer’s Comments

§.§ Responses to Reviewer # 1

Comment 1.1The FedDetect depends on the assumption that the poisoning images can easily overfit discriminating the trigger. Will this assumption always holds? We could relatively easy to train on a poisoned dataset with another GAN, which generate reversed labeled images. Such poison dataset could have similar distribution of the original dataset, and not easily overfit discriminating the trigger.

Response 1.1When we stated the assumption in our submitted manuscript, we focused on the backdoor images with explicit triggers integrated into the training images. This focus was based on the prevalent existence of unintentional triggers commonly found in medical images, as depicted in Figure 2 of our revised submission. During our experiments, we observed the success of our attack through the degradation of both image fidelity and utility.

We thank reviewer 1 for raising this interesting scenario for the backdoor data. We tested this scenario and found that on the datasets used in this study, we consistently observed overfitting in various settings. Specifically, we model a strong attack by flipping the labels for the malicious client.  We launched experiments with a total number of clients ranging from 4, 6, 8 to 10 on the ISIC dataset. All clients randomly sampled an equal number of data points. One client is randomly chosen to be the malicious client for call cases. Except for the attacking strategy, all hyper-parameters and optimizers are kept the same as in the original paper. We examine the proportion of each local discriminator's ability to correctly classify fake images as fake. In this context, an overfitting discriminator is anticipated to demonstrate a greater capability in distinguishing fake images from real ones, resulting in a higher proportion of fake images correctly classified as fake. The results are shown in Fig 1. For better visualization, we smooth the proportion curve by running the average with a window size of 20. As shown,

§.§ Training Details for Diagnostic Model

The hyper-parameters investigated while training the classification models. Both the ISIC and the ChestX are trained over 20 epochs.

Hyper-parameter     Range Investigated

Seed     [1,2,3,4,5]

#Real Sampled     [1,10,20,50,100,200,500]

Poison Size     [16,32,64]

Batch Size     [32]

Average Classification Accuracy (ISIC)

1     10     20     50     100     200     500

All Real $\uparrow$     0.50     0.53     0.50     0.54     0.60     0.72     0.75

Vanilla $\uparrow$     0.73     0.74     0.75     0.76     0.77     0.79     0.79

Attack 16 $\uparrow$     0.73     0.72     0.72     0.72     0.73     0.74     0.75

Attack 32 $\uparrow$     0.62     0.65     0.63     0.66     0.67     0.69     0.70

Attack 64 $\uparrow$     0.66     0.67     0.66     0.69     0.69     0.70     0.73

Defense 16 $\uparrow$     0.73     0.73     0.73     0.73     0.75     0.76     0.78

Defense 32 $\uparrow$     0.76     0.75     0.76     0.76     0.76     0.77     0.78

Defense 64 $\uparrow$     0.66     0.68     0.69     0.70     0.74     0.76     0.80

§.§ Model Structure

For image generation with GAN, we apply styleGAN-ADA generator structure. Its detailed structure can be found here [Karras et al., 2020]. For the discriminator, we apply the DCgan's architecture, which is outlined in the table below.

Layer     Details

1     Conv2D(channels, featues, 4, 2, 1), LeakyReLU

2     Conv2D(featues, featues*2, 4, 2, 1), BN,  LeakyReLU

3     Conv2D(featues*2, featues*4, 4, 2, 1), BN,  LeakyReLU

4     Conv2D(featues*4, featues*8, 4, 2, 1), BN,  LeakyReLU

5     Conv2D(featues*8, featues*16, 4, 2, 1), BN,  LeakyReLU

6     Conv2D(featues*16, featues*32, 4, 2, 1), BN,  LeakyReLU

7     Conv2D(featues*32, 1, 4, 2, 0),  Sigmoid