BloodMNIST: Biomedical Imaging Benchmark

• BloodMNIST is a biomedical imaging benchmark comprising 17,092 blood cell images across 8 classes, typically resized to 28x28 pixels.
• It supports centralized, federated, and split learning protocols, with studies exploring different resolutions, normalization, and augmentation strategies.
• Key research themes include quantum-enhanced models, open-set recognition, and machine unlearning, highlighting trade-offs between accuracy, privacy, and reproducibility.

BloodMNIST is a MedMNIST/MedMNIST v2 benchmark used for automated classification of peripheral blood cell images. In the recent literature it serves as a compact experimental substrate for centralized image classification, federated and split learning, differential privacy, secure aggregation, quantum-enhanced recurrent architectures, compact vision transformers, open-set recognition, and machine unlearning. Across these studies, BloodMNIST is consistently treated as an 8-class task with 17,092 samples and small inputs, usually $28\times 28$, although published implementations differ in channel encoding, split conventions, and preprocessing details (Fares et al., 2024, Bećirović et al., 19 Jul 2025, Chen, 7 Jun 2025, Almalik et al., 2023).

1. Dataset identity and published descriptions

BloodMNIST is described as part of MedMNIST or MedMNIST v2 in multiple studies. Several papers report a total of 17,092 images and eight classes, making it one of the small-scale biomedical benchmarks commonly used for rapid architectural comparison and low-cost experimentation (Fares et al., 2024, Bećirović et al., 19 Jul 2025, Almalik et al., 2023).

Published descriptions are not fully uniform. A privacy-preserving federated-learning study characterizes BloodMNIST as a collection of peripheral-blood cell images comprising 17,092 gray-scale images resized to $28\times 28$ pixels and spanning eight classes such as CD4$^+$ T cells, CD8$^+$ T cells, CD19$^+$ B cells, CD14$^+$ monocytes, CD16$^+$ monocytes, CD56$^+$ NK cells, regulatory T cells, and memory T cells (Fares et al., 2024). By contrast, a framework-comparison study describes 17,092 color images of peripheral blood cells with eight classes enumerated as Basophil, Eosinophil, Erythroblast, Immature granulocytes, Lymphocyte, Monocyte, Neutrophil, and Platelet (Bećirović et al., 19 Jul 2025). A few-shot transformer study summarizes the task more generically as $28\times 28$-pixel RGB microscope fields of single white-blood-cell crops belonging to eight morphological classes (Angelakis, 20 Feb 2026). This suggests that authors sometimes inherit different label descriptions or channel encodings from different benchmark interfaces or preprocessing pipelines.

Split conventions also vary across studies. One paper reports predefined $7{:}1{:}2$ splits over the 17,092 images, with 11,959 training samples, approximately 1,712 validation samples, and 3,421 test samples (Bećirović et al., 19 Jul 2025). A machine-unlearning study gives the same split counts exactly as 11,959 train, 1,712 validation, and 3,421 test (Falcao et al., 25 Aug 2025). FeSViBS instead reports a $28\times 28$0 train/validation/test division, following MedMNIST, with the 20% test set held out and shared across all clients in its federated split-learning protocol (Almalik et al., 2023).

2. Data representation, preprocessing, and protocol variation

The most common native representation is $28\times 28$1, but BloodMNIST is also used at $28\times 28$2, $28\times 28$3, and, in one benchmark description, is noted as being available at four resolutions: $28\times 28$4, $28\times 28$5, $28\times 28$6, and $28\times 28$7 (Bećirović et al., 19 Jul 2025). Resizing to $28\times 28$8 is used when architectures require larger tokenized inputs, such as ViT-B/16 in FeSViBS and the $28\times 28$9 RGB configuration used by HamCls (Almalik et al., 2023, Mabrok, 22 Mar 2026).

Normalization procedures reflect the experimental context. Pixel values are scaled to $^+$0 in several studies, including the federated privacy work, the framework-comparison study, and the unlearning study (Fares et al., 2024, Bećirović et al., 19 Jul 2025, Falcao et al., 25 Aug 2025). FeSViBS applies standard normalization using ImageNet-style mean and standard deviation when using timm’s pretrained ViT-B/16 (Almalik et al., 2023). HamCls reports intensity normalization with channel-wise mean and standard deviation at $^+$1 resolution (Mabrok, 22 Mar 2026).

Augmentation policies are heterogeneous. Vision-QRWKV applies only resizing to $^+$2, with no further preprocessing, no data augmentation, no dropout, no weight decay, and no learning-rate scheduling (Chen, 7 Jun 2025). The framework-comparison study likewise applies no additional augmentation beyond scaling pixels to $^+$3 (Bećirović et al., 19 Jul 2025). By contrast, DMDSC uses random crop with 4-pixel padding, random horizontal flip with probability $^+$4, and per-channel normalization to zero mean and unit variance in its open-set protocol (Vishal et al., 1 May 2026). HamCls reports standard 2D augmentations including random horizontal and vertical flips, small rotations, and color jitter (Mabrok, 22 Mar 2026). The unlearning study explicitly analyzes augmentation, comparing NoAug, Default, and Default $^+$5 RandAugment, and reports lower Average Gap under stronger augmentation (Falcao et al., 25 Aug 2025).

Experimental protocols differ as much as preprocessing. ZACH-ViT uses a strict few-shot regime with exactly 50 images per class, five random seeds $^+$6, AdamW, batch size 16, learning rate $^+$7, and 23 epochs (Angelakis, 20 Feb 2026). DMDSC uses five random open-set trials in which four classes are treated as known and four as unknown at inference (Vishal et al., 1 May 2026). Federated studies impose explicitly non-IID partitions: a privacy-preserving pipeline simulates 10 or 20 hospitals with each client holding between 45% and 55% of the average number of overall samples and differing class proportions (Fares et al., 2024); FedImpres uses $^+$8 clients generated by Latent Dirichlet Allocation with $^+$9 (Arya et al., 2024); FeSViBS uses six cross-silo clients with non-IID class distributions (Almalik et al., 2023).

3. Centralized classification and architectural variants

BloodMNIST is widely used to compare model families under tightly controlled settings. The benchmark has supported ResNet-style CNNs, RWKV-based sequence models, compact transformers without positional priors, and Hamiltonian-feature classifiers. The resulting numbers are informative, but direct comparison requires caution because the literature mixes full-data, few-shot, and resized-image protocols.

Study	Protocol	Reported BloodMNIST result
Vision-QRWKV (Chen, 7 Jun 2025)	30 epochs, Adam, batch 64, $^+$0 grayscale	Classical RWKV 91.32%, Quantum RWKV 92.22%
Framework comparison (Bećirović et al., 19 Jul 2025)	Same ResNet-inspired CNN across Keras, PyTorch, JAX	$^+$1: 0.9442 / 0.9486 / 0.9570 ACC; $^+$2: 0.9763 / 0.9822 / 0.9790 ACC
ZACH-ViT (Angelakis, 20 Feb 2026)	50-shot/class, 5 seeds, 0.25M parameters	MacroF1 $^+$3
HamCls (Mabrok, 22 Mar 2026)	$^+$4 RGB, MedMNIST splits	ACC 98.85, AUC 99.93

Vision-QRWKV flattens $^+$5 inputs into a 1D token sequence, projects tokens to 768 dimensions, and processes them with four stacked RWKV blocks. Its quantum variant replaces the purely classical ChannelMix branch with a hybrid module that adds a 4-qubit variational quantum circuit of depth $^+$6, simulated with PennyLane’s default.qubit backend. On BloodMNIST, the reported test accuracy increases from 91.32% for the classical RWKV baseline to 92.22% for the quantum RWKV model (Chen, 7 Jun 2025).

The framework-comparison study holds architecture and hyperparameters fixed across TensorFlow/Keras, PyTorch, and JAX. The shared model is a custom ResNet-inspired CNN with six residual blocks, Adam with learning rate $^+$7, batch size 128, and 20 epochs. At $^+$8, JAX achieves the highest reported accuracy, precision, recall, and F1 values among the three frameworks, with accuracy $^+$9. At $^+$0, PyTorch slightly exceeds JAX in accuracy, reaching $^+$1, while JAX is fastest in inference time at that resolution (Bećirović et al., 19 Jul 2025).

ZACH-ViT studies BloodMNIST as the weak-spatial-structure end of a regime spectrum. It removes both positional embeddings and the $^+$2 token, patchifies the input, processes patch embeddings through transformer blocks, and aggregates the final patch representation by global average pooling. Under the paper’s strict few-shot protocol, ZACH-ViT achieves MacroF1 $^+$3, exceeding scratch-trained TransMIL at $^+$4 and Minimal-ViT at $^+$5. The same study reports that reducing patch size from $^+$6 to $^+$7 improves MacroF1 by $^+$8 with $^+$9, whereas using $^+$0 patches decreases performance by $^+$1 with $^+$2 (Angelakis, 20 Feb 2026).

HamCls introduces a different inductive bias. At the bottleneck, it derives position $^+$3, momentum $^+$4, and energy $^+$5 from damped harmonic oscillator dynamics, globally pools these quantities, concatenates them into a 784-dimensional phase-space feature, and classifies with a two-layer MLP. On BloodMNIST, HamCls reports ACC $^+$6 and AUC $^+$7, exceeding the paper’s ResNet-50 baseline at ACC $^+$8 and MedMamba-S at ACC $^+$9 (Mabrok, 22 Mar 2026).

4. Federated, split, and privacy-preserving use

BloodMNIST has become a standard small-scale medical benchmark for distributed learning under heterogeneity. The dataset is used to test whether clinically relevant non-IID effects can be managed without centralizing samples and, in some cases, without exposing client updates.

Method	Distributed setting	Reported BloodMNIST result
DPResNet + FedAvg + SecAgg$^+$0 (Fares et al., 2024)	10 or 20 simulated hospitals	97.78% ACC at 10 clients; 96.89% at 20 clients under DP$^+$1/SecAgg$^+$2
FedImpres (Arya et al., 2024)	8 clients, LDA heterogeneity	94.2% at $^+$3; 70.2% at $^+$4
FeSViBS (Almalik et al., 2023)	6 cross-silo clients, non-IID	Balanced accuracy $^+$5

The privacy-preserving federated-learning study uses BloodMNIST to emulate 10 or 20 hospitals with non-IID client partitions. Each client trains a nine-layer DPResNet, a ResNet-9 variant in which max-pooling is removed and all BatchNormalization layers are replaced with GroupNormalization using 32 groups per layer. Local training uses $^+$6 epochs per round for $^+$7 global rounds with FedAvg. Privacy is enforced through DP-SGD with clipping norm $^+$8 and Gaussian noise calibrated to $^+$9-differential privacy over the full training process. The local step is reported as

$^+$0

and the masked updates are aggregated with SecAgg$^+$1, which tolerates client dropouts so long as at least four shares can be reassembled. Test accuracy is 98.76% for the non-private 10-client baseline, 98.11% with secure aggregation only, and 97.78% with both DP and SecAgg$^+$2; the corresponding 20-client figures are 97.77%, 97.01%, and 96.89% (Fares et al., 2024).

FedImpres addresses a different pathology of distributed learning: catastrophic forgetting under heterogeneous local updates. After each communication round, the server synthesizes a small federated impression set $^+$3 that captures global model knowledge and each client then optimizes a mixed objective over local data and $^+$4. On BloodMNIST, using eight clients under LDA label imbalance, FedImpres with medical-data initialization reaches 94.2% at $^+$5, compared with 83.1% for FedAvg, and 70.2% at $^+$6, compared with 39.0% for FedAvg (Arya et al., 2024).

FeSViBS combines split learning and federation around a ViT-B/16 server body. BloodMNIST images are resized from $^+$7 to $^+$8, a ResNet-50-based client head produces 196 patch embeddings of dimension 768, and the server samples an intermediate block index $^+$9, distills the resulting patch tokens into a pseudo-class token, and returns that representation to the client tail. Under non-IID cross-silo partitioning with six clients, FeSViBS achieves balanced accuracy $28\times 28$0, compared with 0.929$28\times 28$10.001 for FeSTA, 0.903 for MOON, 0.894 for FedAvg, and a centralized upper bound of 0.957 (Almalik et al., 2023).

These results are not on a single common metric: DPResNet reports test accuracy, FeSViBS reports balanced accuracy, and FedImpres reports classification accuracy under explicit imbalance severities. Even so, BloodMNIST consistently functions as a stress test for non-IID optimization, privacy constraints, and communication-limited model partitioning.

5. Open-set recognition and machine unlearning

BloodMNIST is also used for post-training governance tasks in which the objective is not merely to classify known classes but to reject unknown classes or remove the influence of selected training samples.

DMDSC formulates BloodMNIST as an open-set recognition problem. In each of five random trials, four classes are designated known during training and four are held out as unknown at inference. The method employs a Deep Simplex Classifier with class-adaptive margins determined by class frequency: $28\times 28$2 On BloodMNIST, with ResNet-18 or ResNet-34 style simplex classification and an auxiliary background set of approximately 300K Tiny-ImageNet images, DMDSC reports ACC $28\times 28$3, AUROC $28\times 28$4, and OSCR $28\times 28$5, improving over UCDSC at ACC $28\times 28$6, AUROC $28\times 28$7, and OSCR $28\times 28$8 (Vishal et al., 1 May 2026).

The machine-unlearning study evaluates SalUn on BloodMNIST with a ResNet-18 classifier trained on $28\times 28$9 images for 200 epochs using learning rate 0.1, batch size 256, and cross-entropy loss. SalUn computes parameter saliency on the forget set $7{:}1{:}2$0, then optimizes an unlearning objective that combines standard cross-entropy on the retained data $7{:}1{:}2$1 with a saliency-weighted penalty anchoring parameters to the original pretrained state. At forgetting rate $7{:}1{:}2$2, SalUn achieves UA $7{:}1{:}2$3, RA $7{:}1{:}2$4, TA $7{:}1{:}2$5, MIA $7{:}1{:}2$6, AG $7{:}1{:}2$7, and RTE 1.1 minutes, compared with retraining at UA $7{:}1{:}2$8, RA $7{:}1{:}2$9, TA $28\times 28$00, MIA $28\times 28$01, AG $28\times 28$02, and RTE 22.2 minutes. At $28\times 28$03, SalUn reports UA $28\times 28$04, RA $28\times 28$05, TA $28\times 28$06, MIA $28\times 28$07, AG $28\times 28$08, and RTE 1.3 minutes, versus retraining at UA $28\times 28$09, RA $28\times 28$10, TA $28\times 28$11, MIA $28\times 28$12, AG $28\times 28$13, and RTE 22.2 minutes (Falcao et al., 25 Aug 2025).

The same unlearning study further reports that augmentation improves proximity to full retraining. On BloodMNIST, the Average Gap decreases from approximately 0.90 to 0.72 to approximately 0.60 at $28\times 28$14 when moving from NoAug to Default to Default $28\times 28$15 RandAugment, and from approximately 1.80 to 1.57 to approximately 1.40 at $28\times 28$16 (Falcao et al., 25 Aug 2025). A plausible implication is that BloodMNIST is sufficiently sensitive to regularization for post-hoc forgetting quality to benefit measurably from augmentation choices.

6. Methodological significance and unresolved issues

BloodMNIST occupies a distinctive position in the recent literature because its small image size and modest sample count make it practical for repeated ablation, cross-framework comparison, privacy accounting, and multi-seed evaluation, while its eight-class structure remains nontrivial enough to expose heterogeneity, weak spatial priors, and open-set failure modes. This role is evident in the breadth of reported use: privacy-preserving federated averaging with differential privacy and secure aggregation (Fares et al., 2024), synthetic replay for catastrophic-forgetting mitigation (Arya et al., 2024), split-federated ViTs with intermediate block sampling (Almalik et al., 2023), hybrid classical-quantum recurrent models (Chen, 7 Jun 2025), framework-level systems comparison (Bećirović et al., 19 Jul 2025), few-shot compact transformers with permutation-invariant aggregation (Angelakis, 20 Feb 2026), simplex-based open-set recognition (Vishal et al., 1 May 2026), machine unlearning (Falcao et al., 25 Aug 2025), and Hamiltonian-inductive-bias classifiers (Mabrok, 22 Mar 2026).

Several recurring themes emerge. One is regime dependence of inductive bias. ZACH-ViT explicitly argues that BloodMNIST lies at the “very weak” end of a spatial-structure spectrum and reports its strongest advantage there, consistent with a design that removes positional embeddings and the $28\times 28$17 token (Angelakis, 20 Feb 2026). Vision-QRWKV similarly argues that BloodMNIST is among the datasets with subtle or noisy visual patterns on which the quantum branch yields its clearest gains (Chen, 7 Jun 2025). HamCls, by contrast, attributes performance to complementary pooled representations of content, momentum, and energy derived from oscillator dynamics (Mabrok, 22 Mar 2026). These studies do not share a common protocol, but together they indicate that BloodMNIST is frequently used to test whether morphology-driven classification benefits from architectural choices that de-emphasize rigid spatial priors.

Another theme is governance under distributional and privacy constraints. The DPResNet study identifies extension to larger 3D volumes, reduction of communication overhead on resource-limited edge devices, and improved privacy-accuracy trade-offs through adaptive clipping or advanced noise calibration as open problems (Fares et al., 2024). FedImpres identifies dependence on public or unlabeled initialization data and suggests future integration with personalized federated learning and privacy-preserving impression generation (Arya et al., 2024). FeSViBS reports no privacy analysis against gradient inversion or malicious servers and notes that resizing may alter fine-grained cytology detail (Almalik et al., 2023). HamCls does not provide per-class confusion matrices or exact classification hyperparameters such as batch size and epoch count, and DMDSC provides no public BloodMNIST feature visualizations despite reporting qualitative cluster behavior (Mabrok, 22 Mar 2026, Vishal et al., 1 May 2026).

A final methodological point concerns reproducibility. Because published BloodMNIST studies differ in channel assumptions, split descriptions, resolution, augmentation policy, and even class naming, results should be compared primarily within matched protocols rather than treated as directly commensurate across papers. This suggests that, for BloodMNIST, benchmark utility depends not only on dataset identity but also on precise reporting of loader configuration, image representation, class ontology, and evaluation regime.