---
title: 'BloodMNIST: Biomedical Imaging Benchmark'
url: https://www.emergentmind.com/topics/bloodmnist
type: topic
---

# BloodMNIST: Biomedical Imaging Benchmark

BloodMNIST is a MedMNIST/MedMNIST v2 benchmark used for automated classification of peripheral blood cell images. In the recent literature it serves as a compact experimental substrate for centralized image classification, federated and split learning, differential privacy, secure aggregation, quantum-enhanced recurrent architectures, compact vision transformers, open-set recognition, and machine unlearning. Across these studies, BloodMNIST is consistently treated as an 8-class task with 17,092 samples and small inputs, usually \(28\times 28\), although published implementations differ in channel encoding, split conventions, and preprocessing details [2412.00687][2507.14587][2506.06633][2306.14638].

## 1. Dataset identity and published descriptions

BloodMNIST is described as part of MedMNIST or MedMNIST v2 in multiple studies. Several papers report a total of 17,092 images and eight classes, making it one of the small-scale biomedical benchmarks commonly used for rapid architectural comparison and low-cost experimentation [2412.00687][2507.14587][2306.14638].

Published descriptions are not fully uniform. A privacy-preserving federated-learning study characterizes BloodMNIST as a collection of peripheral-blood cell images comprising 17,092 gray-scale images resized to \(28\times 28\) pixels and spanning eight classes such as CD4\(^+\) T cells, CD8\(^+\) T cells, CD19\(^+\) B cells, CD14\(^+\) monocytes, CD16\(^+\) monocytes, CD56\(^+\) NK cells, regulatory T cells, and memory T cells [2412.00687]. By contrast, a framework-comparison study describes 17,092 color images of peripheral blood cells with eight classes enumerated as Basophil, Eosinophil, Erythroblast, Immature granulocytes, Lymphocyte, Monocyte, Neutrophil, and Platelet [2507.14587]. A few-shot transformer study summarizes the task more generically as \(28\times 28\)-pixel RGB microscope fields of single white-blood-cell crops belonging to eight morphological classes [2602.17929]. This suggests that authors sometimes inherit different label descriptions or channel encodings from different benchmark interfaces or preprocessing pipelines.

Split conventions also vary across studies. One paper reports predefined \(7{:}1{:}2\) splits over the 17,092 images, with 11,959 training samples, approximately 1,712 validation samples, and 3,421 test samples [2507.14587]. A machine-unlearning study gives the same split counts exactly as 11,959 train, 1,712 validation, and 3,421 test [2508.18509]. FeSViBS instead reports a \(70\%/10\%/20\%\) train/validation/test division, following MedMNIST, with the 20% test set held out and shared across all clients in its federated split-learning protocol [2306.14638].

## 2. Data representation, preprocessing, and protocol variation

The most common native representation is \(28\times 28\), but BloodMNIST is also used at \(64\times 64\), \(224\times 224\), and, in one benchmark description, is noted as being available at four resolutions: \(28\times 28\), \(64\times 64\), \(128\times 128\), and \(224\times 224\) [2507.14587]. Resizing to \(224\times 224\) is used when architectures require larger tokenized inputs, such as ViT-B/16 in FeSViBS and the \(224\times 224\) RGB configuration used by HamCls [2306.14638][2603.21377].

Normalization procedures reflect the experimental context. Pixel values are scaled to \([0,1]\) in several studies, including the federated privacy work, the framework-comparison study, and the unlearning study [2412.00687][2507.14587][2508.18509]. FeSViBS applies standard normalization using ImageNet-style mean and standard deviation when using timm’s pretrained ViT-B/16 [2306.14638]. HamCls reports intensity normalization with channel-wise mean and standard deviation at \(224\times 224\) resolution [2603.21377].

Augmentation policies are heterogeneous. Vision-QRWKV applies only resizing to \(28\times 28\), with no further preprocessing, no data augmentation, no dropout, no weight decay, and no learning-rate scheduling [2506.06633]. The framework-comparison study likewise applies no additional augmentation beyond scaling pixels to \([0,1]\) [2507.14587]. By contrast, DMDSC uses random crop with 4-pixel padding, random horizontal flip with probability \(0.5\), and per-channel normalization to zero mean and unit variance in its open-set protocol [2605.00675]. HamCls reports standard 2D augmentations including random horizontal and vertical flips, small rotations, and color jitter [2603.21377]. The unlearning study explicitly analyzes augmentation, comparing NoAug, Default, and Default \(+\) RandAugment, and reports lower Average Gap under stronger augmentation [2508.18509].

Experimental protocols differ as much as preprocessing. ZACH-ViT uses a strict few-shot regime with exactly 50 images per class, five random seeds \((3,5,7,11,13)\), AdamW, batch size 16, learning rate \(1\times 10^{-4}\), and 23 epochs [2602.17929]. DMDSC uses five random open-set trials in which four classes are treated as known and four as unknown at inference [2605.00675]. Federated studies impose explicitly non-IID partitions: a privacy-preserving pipeline simulates 10 or 20 hospitals with each client holding between 45% and 55% of the average number of overall samples and differing class proportions [2412.00687]; FedImpres uses \(N=8\) clients generated by Latent Dirichlet Allocation with \(\alpha\in\{0.01,0.005\}\) [2409.07351]; FeSViBS uses six cross-silo clients with non-IID class distributions [2306.14638].

## 3. Centralized classification and architectural variants

BloodMNIST is widely used to compare model families under tightly controlled settings. The benchmark has supported ResNet-style CNNs, RWKV-based sequence models, compact transformers without positional priors, and Hamiltonian-feature classifiers. The resulting numbers are informative, but direct comparison requires caution because the literature mixes full-data, few-shot, and resized-image protocols.

| Study | Protocol | Reported BloodMNIST result |
|---|---|---|
| Vision-QRWKV [2506.06633] | 30 epochs, Adam, batch 64, \(28\times28\) grayscale | Classical RWKV 91.32%, Quantum RWKV 92.22% |
| Framework comparison [2507.14587] | Same ResNet-inspired CNN across Keras, PyTorch, JAX | \(28\times28\): 0.9442 / 0.9486 / 0.9570 ACC; \(64\times64\): 0.9763 / 0.9822 / 0.9790 ACC |
| ZACH-ViT [2602.17929] | 50-shot/class, 5 seeds, 0.25M parameters | MacroF1 \(=0.600\pm0.071\) |
| HamCls [2603.21377] | \(224\times224\) RGB, MedMNIST splits | ACC 98.85, AUC 99.93 |

Vision-QRWKV flattens \(28\times 28\) inputs into a 1D token sequence, projects tokens to 768 dimensions, and processes them with four stacked RWKV blocks. Its quantum variant replaces the purely classical ChannelMix branch with a hybrid module that adds a 4-qubit variational quantum circuit of depth \(L=2\), simulated with PennyLane’s `default.qubit` backend. On BloodMNIST, the reported test accuracy increases from 91.32% for the classical RWKV baseline to 92.22% for the quantum RWKV model [2506.06633].

The framework-comparison study holds architecture and hyperparameters fixed across TensorFlow/Keras, PyTorch, and JAX. The shared model is a custom ResNet-inspired CNN with six residual blocks, Adam with learning rate \(\lambda=0.001\), batch size 128, and 20 epochs. At \(28\times 28\), JAX achieves the highest reported accuracy, precision, recall, and F1 values among the three frameworks, with accuracy \(0.9570\). At \(64\times 64\), PyTorch slightly exceeds JAX in accuracy, reaching \(0.9822\), while JAX is fastest in inference time at that resolution [2507.14587].

ZACH-ViT studies BloodMNIST as the weak-spatial-structure end of a regime spectrum. It removes both positional embeddings and the \([CLS]\) token, patchifies the input, processes patch embeddings through transformer blocks, and aggregates the final patch representation by global average pooling. Under the paper’s strict few-shot protocol, ZACH-ViT achieves MacroF1 \(=0.600\pm0.071\), exceeding scratch-trained TransMIL at \(0.538\pm0.065\) and Minimal-ViT at \(0.515\pm0.086\). The same study reports that reducing patch size from \(P=16\) to \(P=8\) improves MacroF1 by \(+0.048\) with \(p=0.008\), whereas using \(32\times 32\) patches decreases performance by \(-0.104\) with \(p<0.001\) [2602.17929].

HamCls introduces a different inductive bias. At the bottleneck, it derives position \(q\), momentum \(p\), and energy \(H=\tfrac12|z|^2\) from damped harmonic oscillator dynamics, globally pools these quantities, concatenates them into a 784-dimensional phase-space feature, and classifies with a two-layer MLP. On BloodMNIST, HamCls reports ACC \(98.85\) and AUC \(99.93\), exceeding the paper’s ResNet-50 baseline at ACC \(95.6\) and MedMamba-S at ACC \(98.4\) [2603.21377].

## 4. Federated, split, and privacy-preserving use

BloodMNIST has become a standard small-scale medical benchmark for distributed learning under heterogeneity. The dataset is used to test whether clinically relevant non-IID effects can be managed without centralizing samples and, in some cases, without exposing client updates.

| Method | Distributed setting | Reported BloodMNIST result |
|---|---|---|
| DPResNet + FedAvg + SecAgg\(^+\) [2412.00687] | 10 or 20 simulated hospitals | 97.78% ACC at 10 clients; 96.89% at 20 clients under DP\(^+\)/SecAgg\(^+\) |
| FedImpres [2409.07351] | 8 clients, LDA heterogeneity | 94.2% at \(\alpha=0.01,E=5\); 70.2% at \(\alpha=0.005,E=5\) |
| FeSViBS [2306.14638] | 6 cross-silo clients, non-IID | Balanced accuracy \(0.936\pm0.002\) |

The privacy-preserving federated-learning study uses BloodMNIST to emulate 10 or 20 hospitals with non-IID client partitions. Each client trains a nine-layer DPResNet, a ResNet-9 variant in which max-pooling is removed and all BatchNormalization layers are replaced with GroupNormalization using 32 groups per layer. Local training uses \(E=3\) epochs per round for \(R=50\) global rounds with FedAvg. Privacy is enforced through DP-SGD with clipping norm \(C=7\) and Gaussian noise calibrated to \((\epsilon=6.0,\delta=1.9\times 10^{-4})\)-differential privacy over the full training process. The local step is reported as
\[
g_i^{\text{clipped}}=\frac{g_i}{\max(1,\lVert g_i\rVert_2/C)}, \qquad
\Delta\theta_i^{DP}=g_i^{\text{clipped}}+\mathcal{N}(0,\sigma^2 I),
\]
and the masked updates are aggregated with SecAgg\(^+\), which tolerates client dropouts so long as at least four shares can be reassembled. Test accuracy is 98.76% for the non-private 10-client baseline, 98.11% with secure aggregation only, and 97.78% with both DP and SecAgg\(^+\); the corresponding 20-client figures are 97.77%, 97.01%, and 96.89% [2412.00687].

FedImpres addresses a different pathology of distributed learning: catastrophic forgetting under heterogeneous local updates. After each communication round, the server synthesizes a small federated impression set \(\mathcal{V}\) that captures global model knowledge and each client then optimizes a mixed objective over local data and \(\mathcal{V}\). On BloodMNIST, using eight clients under LDA label imbalance, FedImpres with medical-data initialization reaches 94.2% at \(\alpha=0.01, E=5\), compared with 83.1% for FedAvg, and 70.2% at \(\alpha=0.005, E=5\), compared with 39.0% for FedAvg [2409.07351].

FeSViBS combines split learning and federation around a ViT-B/16 server body. BloodMNIST images are resized from \(28\times 28\) to \(224\times 224\), a ResNet-50-based client head produces 196 patch embeddings of dimension 768, and the server samples an intermediate block index \(l\in\{1,\dots,6\}\), distills the resulting patch tokens into a pseudo-class token, and returns that representation to the client tail. Under non-IID cross-silo partitioning with six clients, FeSViBS achieves balanced accuracy \(0.936\pm0.002\), compared with 0.929\(\pm\)0.001 for FeSTA, 0.903 for MOON, 0.894 for FedAvg, and a centralized upper bound of 0.957 [2306.14638].

These results are not on a single common metric: DPResNet reports test accuracy, FeSViBS reports balanced accuracy, and FedImpres reports classification accuracy under explicit imbalance severities. Even so, BloodMNIST consistently functions as a stress test for non-IID optimization, privacy constraints, and communication-limited model partitioning.

## 5. Open-set recognition and machine unlearning

BloodMNIST is also used for post-training governance tasks in which the objective is not merely to classify known classes but to reject unknown classes or remove the influence of selected training samples.

DMDSC formulates BloodMNIST as an open-set recognition problem. In each of five random trials, four classes are designated known during training and four are held out as unknown at inference. The method employs a Deep Simplex Classifier with class-adaptive margins determined by class frequency:
\[
m_c = m_{\min} + (m_{\max}-m_{\min})(1-p_c).
\]
On BloodMNIST, with ResNet-18 or ResNet-34 style simplex classification and an auxiliary background set of approximately 300K Tiny-ImageNet images, DMDSC reports ACC \(98.4\), AUROC \(91.1\), and OSCR \(90.5\), improving over UCDSC at ACC \(97.7\), AUROC \(89.9\), and OSCR \(88.8\) [2605.00675].

The machine-unlearning study evaluates SalUn on BloodMNIST with a ResNet-18 classifier trained on \(64\times 64\times 3\) images for 200 epochs using learning rate 0.1, batch size 256, and cross-entropy loss. SalUn computes parameter saliency on the forget set \(D_f\), then optimizes an unlearning objective that combines standard cross-entropy on the retained data \(D_r\) with a saliency-weighted penalty anchoring parameters to the original pretrained state. At forgetting rate \(\delta=10\%\), SalUn achieves UA \(0.00\%\), RA \(99.92\%\), TA \(98.89\%\), MIA \(0.17\%\), AG \(0.72\), and RTE 1.1 minutes, compared with retraining at UA \(0.84\%\), RA \(99.80\%\), TA \(98.57\%\), MIA \(1.76\%\), AG \(0.00\), and RTE 22.2 minutes. At \(\delta=50\%\), SalUn reports UA \(0.12\%\), RA \(99.93\%\), TA \(98.77\%\), MIA \(0.45\%\), AG \(1.57\), and RTE 1.3 minutes, versus retraining at UA \(1.37\%\), RA \(100.00\%\), TA \(98.48\%\), MIA \(3.61\%\), AG \(0.00\), and RTE 22.2 minutes [2508.18509].

The same unlearning study further reports that augmentation improves proximity to full retraining. On BloodMNIST, the Average Gap decreases from approximately 0.90 to 0.72 to approximately 0.60 at \(\delta=10\%\) when moving from NoAug to Default to Default \(+\) RandAugment, and from approximately 1.80 to 1.57 to approximately 1.40 at \(\delta=50\%\) [2508.18509]. A plausible implication is that BloodMNIST is sufficiently sensitive to regularization for post-hoc forgetting quality to benefit measurably from augmentation choices.

## 6. Methodological significance and unresolved issues

BloodMNIST occupies a distinctive position in the recent literature because its small image size and modest sample count make it practical for repeated ablation, cross-framework comparison, privacy accounting, and multi-seed evaluation, while its eight-class structure remains nontrivial enough to expose heterogeneity, weak spatial priors, and open-set failure modes. This role is evident in the breadth of reported use: privacy-preserving federated averaging with differential privacy and secure aggregation [2412.00687], synthetic replay for catastrophic-forgetting mitigation [2409.07351], split-federated ViTs with intermediate block sampling [2306.14638], hybrid classical-quantum recurrent models [2506.06633], framework-level systems comparison [2507.14587], few-shot compact transformers with permutation-invariant aggregation [2602.17929], simplex-based open-set recognition [2605.00675], machine unlearning [2508.18509], and Hamiltonian-inductive-bias classifiers [2603.21377].

Several recurring themes emerge. One is regime dependence of inductive bias. ZACH-ViT explicitly argues that BloodMNIST lies at the “very weak” end of a spatial-structure spectrum and reports its strongest advantage there, consistent with a design that removes positional embeddings and the \([CLS]\) token [2602.17929]. Vision-QRWKV similarly argues that BloodMNIST is among the datasets with subtle or noisy visual patterns on which the quantum branch yields its clearest gains [2506.06633]. HamCls, by contrast, attributes performance to complementary pooled representations of content, momentum, and energy derived from oscillator dynamics [2603.21377]. These studies do not share a common protocol, but together they indicate that BloodMNIST is frequently used to test whether morphology-driven classification benefits from architectural choices that de-emphasize rigid spatial priors.

Another theme is governance under distributional and privacy constraints. The DPResNet study identifies extension to larger 3D volumes, reduction of communication overhead on resource-limited edge devices, and improved privacy-accuracy trade-offs through adaptive clipping or advanced noise calibration as open problems [2412.00687]. FedImpres identifies dependence on public or unlabeled initialization data and suggests future integration with personalized federated learning and privacy-preserving impression generation [2409.07351]. FeSViBS reports no privacy analysis against gradient inversion or malicious servers and notes that resizing may alter fine-grained cytology detail [2306.14638]. HamCls does not provide per-class confusion matrices or exact classification hyperparameters such as batch size and epoch count, and DMDSC provides no public BloodMNIST feature visualizations despite reporting qualitative cluster behavior [2603.21377][2605.00675].

A final methodological point concerns reproducibility. Because published BloodMNIST studies differ in channel assumptions, split descriptions, resolution, augmentation policy, and even class naming, results should be compared primarily within matched protocols rather than treated as directly commensurate across papers. This suggests that, for BloodMNIST, benchmark utility depends not only on dataset identity but also on precise reporting of loader configuration, image representation, class ontology, and evaluation regime.

Source: https://www.emergentmind.com/topics/bloodmnist