Medical imaging deep learning with differential privacy

Abstract

The successful training of deep learning models for diagnostic deployment in medical imaging applications requires large volumes of data. Such data cannot be procured without consideration for patient privacy, mandated both by legal regulations and ethical requirements of the medical profession. Differential privacy (DP) enables the provision of information-theoretic privacy guarantees to patients and can be implemented in the setting of deep neural network training through the differentially private stochastic gradient descent (DP-SGD) algorithm. We here present deepee, a free-and-open-source framework for differentially private deep learning for use with the PyTorch deep learning framework. Our framework is based on parallelised execution of neural network operations to obtain and modify the per-sample gradients. The process is efficiently abstracted via a data structure maintaining shared memory references to neural network weights to maintain memory efficiency. We furthermore offer specialised data loading procedures and privacy budget accounting based on the Gaussian Differential Privacy framework, as well as automated modification of the user-supplied neural network architectures to ensure DP-conformity of its layers. We benchmark our framework’s computational performance against other open-source DP frameworks and evaluate its application on the paediatric pneumonia dataset, an image classification task and on the Medical Segmentation Decathlon Liver dataset in the task of medical image segmentation. We find that neural network training with rigorous privacy guarantees is possible while maintaining acceptable classification performance and excellent segmentation performance. Our framework compares favourably to related work with respect to memory consumption and computational performance. Our work presents an open-source software framework for differentially private deep learning, which we demonstrate in medical imaging analysis tasks. It serves to further the utilisation of privacy-enhancing techniques in medicine and beyond in order to assist researchers and practitioners in addressing the numerous outstanding challenges towards their widespread implementation.

Do Gradient Inversion Attacks Make Federated Learning Unsafe?

“…Other, more sophisticated methods like the sparse vector technique (SVT) combine the addition of noise with value clipping and/or removal of parts of the data [24]. DP has been successfully integrated into the training of deep neural networks [25]- [27] and used for FL applications [15], [28]- [31]. DP can make strong guarantees about the theoretical effectiveness of protecting against individual privacy loss but is difficult to tune to keep the model accuracy at an acceptable level [32].…”

Challenges for machine learning in clinical translation of big data imaging studies

“…Therefore, to prevent the possibility of inferring personal characteristics from the data, further techniques need to be employed, such as differential privacy (Dwork and Roth, 2014). Differential privacy techniques work by injecting a controlled amount of statistical noise to obscure the data contributions from individuals in the dataset (Dwork and Roth, 2014), and has been applied to medical imaging (Ziller et al, 2021). This is performed while ensuring that the model still gains insight into the overall population, and thus provides predictions that are accurate enough to be useful.…”

Federated learning and differential privacy for medical image analysis

“…Past works have noted the potential solution DP provides for machine learning in the healthcare domain. Kaissis et al 1 surveyed privacy-preservation techniques to be used in conjunction with machine learning, which were then implemented for classifying chest X-rays and segmenting CT scans 24 , 25 . In histopathology, Lu et al 13 reported DP guarantees for a neural network classifier trained with FL, following Li et al 26 .…”