Secure, privacy-preserving and federated machine learning in medical imaging

Abstract

rtificial intelligence (AI) methods have the potential to revolutionize the domain of medicine, as witnessed, for example, in medical imaging, where the application of computer vision techniques, traditional machine learning 1,2 and-more recently-deep neural networks have achieved remarkable successes. This progress can be ascribed to the release of large, curated corpora of images (ImageNet 3 perhaps being the best known), giving rise to performant pre-trained algorithms that facilitate transfer learning and led to increasing publications both in oncology-with applications in tumour detection 4,5 , genomic characterization 6,7 , tumour subtyping 8,9 , grading prediction 10 , outcome risk assessment 11 or risk of relapse quantification 12 -and non-oncologic applications, such as chest X-ray analysis 13 and retinal fundus imaging 14 .To allow medical imaging AI applications to offer clinical decision support suitable for precision medicine implementations, even larger amounts of imaging and clinical data will be required. Large cross-sectional population studies based solely on volunteer participation, such as the UK Biobank 15 , cannot fill this gap. Even the largest current imaging studies in the field 4,5 , demonstrating better-than-human performance in their respective tasks, include considerably less data than, for example, ImageNet 3 , or the amount of data used to train algorithmic agents in the games of Go or StarCraft 16,17 , or autonomous vehicles 18 . Furthermore, such datasets often stem from relatively few institutions, geographic regions or patient demographics, and might therefore contain unquantifiable bias due to their incompleteness with respect to co-variables such as comorbidities, ethnicity, gender and so on 19 .However, considering that the sum of the world's patient databases probably contains enough data to answer many significant questions, it becomes clear that the inability to access and leverage this data poses a significant barrier to AI applications in this field.The lack of standardized, electronic patient records is one reason. Electronic patient data management is expensive 20 , and hospitals in underprivileged regions might be unable to afford participation in studies requiring it, potentially perpetuating the aforementioned issues of bias and fairness. In the medical imaging field, electronic data management is the standard: Digital Imaging and Communications in Medicine (DICOM) 21 is the universally adopted imaging data format, and electronic file storage is the near-global standard of care. Even where non-digital formats are still in use, the archival nature of, for instance, film radiography allows post hoc digitization, seen, for example, in the CBIS-DDSM dataset 22 , consisting of digitized film breast radiographs. Digital imaging data, easily shareable, permanently storable and remotely accessible in the cloud has driven the aforementioned successes of medical imaging AI.The second issue representing a stark deterrent from multi-institutional/multi-national AI trials 23 is ...

Universal adversarial attacks on deep neural networks for medical image classification

“…Several methods for adversarial attacks on black-box DNNs, which estimate adversarial perturbations using only model outputs (e.g., confidence scores), have been proposed [31][32][33]. The development and operation of secure, privacy-preserving, and federated DNNs are required in medical imaging [6].…”

“…Complex classifiers, including DNNs, can potentially cause catastrophic harm to society because they are often difficult to interpret [5]. More importantly, DNNs have a number of security concerns [6]; specifically, DNNs are known to be vulnerable to adversarial examples [7,8], which are input images that cause misclassifications by DNNs and typically generated by adding specific, imperceptible perturbations to original input images that have been correctly classified using DNNs. The existence of adversarial examples questions the generalization ability of DNNs, reduces model interpretability, and limits the applications of deep learning in safety-and security-critical environments [9]; in particular, the adversarial examples cause not only misdiagnosis, but also various social disturbances [10].…”

Swarm Learning as a privacy-preserving machine learning approach for disease classification

“…AI-based solutions intrinsically rely on appropriate algorithms 25 , but even more so on large enough datasets for training purposes 26 . Since the domain of medicine is inherently decentralized, the volume of data available locally is often insufficient to train reliable classifiers [27][28][29] .…”

“…As a consequence, centralization of data, for example via cloud solutions, has been one model to address the local limitations [30][31][32] . While beneficial from an AI-perspective, centralized solutions were shown to have other inherent hurdles, including increased data traffic of large medical data, data ownership, privacy and security concerns when ownership is disconnected from access and usage curation and thereby creating data monopolies favoring data aggregators 26 . Consequently, solutions to the challenges of central data models in AI -particular when dealing with medical data -must be effective, with high accuracy and efficiency, privacy-and ethics-preserving, secure, and fault-tolerant by design [33][34][35][36] .…”

“…Consequently, solutions to the challenges of central data models in AI -particular when dealing with medical data -must be effective, with high accuracy and efficiency, privacy-and ethics-preserving, secure, and fault-tolerant by design [33][34][35][36] . Federated AI has been introduced to address some of these aspects 26,[37][38][39] . While data are kept locally (at the edge) and privacy issues are addressed 40,41 , the model parameters in federated AI are still handled by central custodians who as the intermediaries concentrate power of the learning to themselves.…”