Differentially private federated deep learning for multi-site medical image segmentation

Abstract

Collaborative machine learning techniques such as federated learning (FL) enable the training of models on effectively larger datasets without data transfer. Recent initiatives have demonstrated that segmentation models trained with FL can achieve performance similar to locally trained models. However, FL is not a fully privacy-preserving technique and privacy-centred attacks can disclose confidential patient data. Thus, supplementing FL with privacy-enhancing technologies (PETs) such as differential privacy (DP) is a requirement for clinical applications in a multi-institutional setting. The application of PETs to FL in medical imaging and the trade-offs between privacy guarantees and model utility, the ramifications on training performance and the susceptibility of the final models to attacks have not yet been conclusively investigated. Here we demonstrate the first application of differentially private gradient descent-based FL on the task of semantic segmentation in computed tomography. We find that high segmentation performance is possible under strong privacy guarantees with an acceptable training time penalty. We furthermore demonstrate the first successful gradient-based model inversion attack on a semantic segmentation model and show that the application of DP prevents it from divulging sensitive image features. Our code is available at https://github.com/TUM-AIMED/PrivateSegmentation.

Quantum oscillations in an impurity-band Anderson insulator

“…(10) is valid for the model studied here (of two parabolic bands). Other models -with three bands, or with non-parabolic band dispersion -can give very different sizes of B BI 0 for the same γ [54].…”

Federated learning for medical imaging radiology

“…The Differentially Private Gradient Descent (DPGD) approach for semantic segmentation in CT images extends Differential Privacy (DP) guarantees to gradient-based optimisation by clipping gradients using the L2 norms of each minibatch. 24 The optimisation step is then performed after adding Gaussian noise to the averaged minibatch gradients. Despite minor privacy-utility trade-offs, differentially private stochastic gradient descent (DP-SGD) totally defeats privacy-centred attacks, while large-sized models have been shown to be more resilient to model inversion attacks than smaller ones.…”