NeuraCrypt: Hiding Private Health Data via Random Neural Networks for Public Training

Abstract

Balancing the needs of data privacy and predictive utility is a central challenge for machine learning in healthcare. In particular, privacy concerns have led to a dearth of public datasets, complicated the construction of multi-hospital cohorts and limited the utilization of external machine learning resources. To remedy this, new methods are required to enable data owners, such as hospitals, to share their datasets publicly, while preserving both patient privacy and modeling utility. We propose NeuraCrypt 2 , a private encoding scheme based on random deep neural networks. NeuraCrypt encodes raw patient data using a randomly constructed neural network known only to the data-owner, and publishes both the encoded data and associated labels publicly. From a theoretical perspective, we demonstrate that sampling from a sufficiently rich family of encoding functions offers a welldefined and meaningful notion of privacy against a computationally unbounded adversary with full knowledge of the underlying data-distribution. We propose to approximate this family of encoding functions through random deep neural networks. Empirically, we demonstrate the robustness of our encoding to a suite of adversarial attacks and show that NeuraCrypt achieves competitive accuracy to non-private baselines on a variety of x-ray tasks. Moreover, we demonstrate that multiple hospitals, using independent private encoders, can collaborate to train improved x-ray models. Finally, we release a challenge dataset 3 to encourage the development of new attacks on NeuraCrypt. * Equal contribution 2 github.com/yala/NeuraCrypt 3 github.com/yala/NeuraCrypt-Challenge Preprint. Under review.

Privacy-Preserving Image Classification Using ConvMixer with Adaptative Permutation Matrix and Block-Wise Scrambled Image Encryption

“…Generally, privacy-preserving machine learning considers privacy in the whole machine learning pipeline, i.e., the (1) privacy of datasets, (2) privacy of models, and (3) privacy of models' outputs [6]. To address privacy, there are various methods such as cryptographic methods [18][19][20], federated learning [7,21,22], differential privacy [23][24][25], image encoding methods [13,14,[26][27][28]. As we focus on the privacy of datasets for image classification tasks, we review learnable image encryption, image encoding methods, and isotropic networks that can be used to classify visually protected images in the following subsections.…”

“…However, it has been proved that visual information can be reconstructed from the encoded images by an attack method in [30]. Recently, random neural network methods, such as NeuraCrypt [28], have been proposed with Vision Transformer (ViT) [31] to encode images, but the security of this method is risky since the encoded images and plain images can be matched correctly by an algorithm in [32].…”

Privacy-Preserving Image Classification Using Isotropic Network

“…However, it was demonstrated that InstaHide-encoded images can be reconstructed [12]. Similarly, NeuraCrypt encodes images by using a random neural network with positional encoding [11]. However, an attack on NeuraCrypt was also released to match encoded images and plain ones completely (NeuraCrypt Challenge 1) [13].…”

“…Therefore, the number of parameters will be increased if the number of blocks in an image is increased. In the same line of research, other lightweight encoding schemes such as [9]- [11] have also been put forward. Lightweight encoding schemes have security concerns as described in [12], [13].…”