CoChat
Sign Up
Cited by 172Privacy-Preserving Technologies in DataArtificial Intelligence in Healthcare and EducationPatient Dignity and Privacy

Medical imaging deep learning with differential privacy

Open access
Ziller, Alexander, Usynin, Dmitrii, Braren, Rickmer, Makowski, Marcus, Rueckert, Daniel, Kaissis, Georgios·2021·Scientific Reports
DOI 10.1038/s41598-021-93030-0PMC PMC8242021
Open this paper in CoChat — free accountOpen PDF

Abstract

The successful training of deep learning models for diagnostic deployment in medical imaging applications requires large volumes of data. Such data cannot be procured without consideration for patient privacy, mandated both by legal regulations and ethical requirements of the medical profession. Differential privacy (DP) enables the provision of information-theoretic privacy guarantees to patients and can be implemented in the setting of deep neural network training through the differentially private stochastic gradient descent (DP-SGD) algorithm. We here present deepee, a free-and-open-source framework for differentially private deep learning for use with the PyTorch deep learning framework. Our framework is based on parallelised execution of neural network operations to obtain and modify the per-sample gradients. The process is efficiently abstracted via a data structure maintaining shared memory references to neural network weights to maintain memory efficiency. We furthermore offer specialised data loading procedures and privacy budget accounting based on the Gaussian Differential Privacy framework, as well as automated modification of the user-supplied neural network architectures to ensure DP-conformity of its layers. We benchmark our framework’s computational performance against other open-source DP frameworks and evaluate its application on the paediatric pneumonia dataset, an image classification task and on the Medical Segmentation Decathlon Liver dataset in the task of medical image segmentation. We find that neural network training with rigorous privacy guarantees is possible while maintaining acceptable classification performance and excellent segmentation performance. Our framework compares favourably to related work with respect to memory consumption and computational performance. Our work presents an open-source software framework for differentially private deep learning, which we demonstrate in medical imaging analysis tasks. It serves to further the utilisation of privacy-enhancing techniques in medicine and beyond in order to assist researchers and practitioners in addressing the numerous outstanding challenges towards their widespread implementation.

AI snapshot

Written from the paper’s full text.

TL;DR

The paper presents deepee, an open-source PyTorch framework for differentially private deep learning via DP-SGD, using parallelised per-sample gradient computation and Gaussian Differential Privacy accounting. It demonstrates that private medical image classification and segmentation are feasible, with segmentation retaining near non-private performance under strong privacy guarantees while classification shows a larger privacy-utility trade-off.

Key findings

  • On paediatric chest radiography binary classification, the private model achieved mean ROC-AUC 0.848 [0.814–0.881] versus 0.960 [0.946–0.971] non-private; relaxed privacy improved private ROC-AUC to 0.882 [0.868–0.899] but still underperformed non-private training.
  • Privacy accounting was tighter with GDP than RDP: strict private classification used ε = 0.52 (GDP) versus 0.64 (RDP), and relaxed private classification used ε = 2.69 (GDP) versus 2.81 (RDP).
  • On MSD Liver semantic segmentation, private and non-private models performed nearly identically: mean Dice 0.943 [0.941–0.945] private versus 0.950 [0.948–0.951] non-private, with private training at ε = 0.12 (GDP) or 0.35 (RDP).
  • Computational benchmarks showed deepee was faster than Opacus and Pyvacy in segmentation (70.89 s vs 78.47 s vs 97.89 s for 25 batches of 32), but slower than Opacus in classification (38.82 s vs 16.39 s vs Pyvacy 73.11 s); deepee used less memory than Opacus in both tasks but more than Pyvacy.

Methods

  • The framework implements DP-SGD by creating one shared-weight copy of the neural network per minibatch sample and performing parallelised forward/backward passes to obtain per-sample gradients, with gradient clipping, calibrated Gaussian noise, cryptographically secure random noise generation, automatic architecture modification, and GDP privacy accounting.
  • Classification used the Paediatric Pneumonia dataset reformulated as binary classification: 5163 training images split into 4389 training and 774 validation, plus 624 test images; segmentation used the Medical Segmentation Decathlon Liver dataset split into 5184 training, 640 validation, and 2560 held-out test images, reformulated as binary liver-tissue segmentation.
  • Models were VGG-11 with Batch Normalisation running statistics disabled for classification and a modified U-Net with VGG-11 backbone for segmentation; analyses used DeLong tests for ROC-AUC comparisons, Student’s t-tests for continuous comparisons, and Bonferroni correction for three-way comparisons.

Limitations

  • The paper states that its examples simplify real-life use-cases, and that the segmentation case-study provides image-level rather than patient-level privacy guarantees, whereas real deployment would require patient-level guarantees.
  • The paper states that PATE could improve classification privacy-utility trade-offs but may not generalise well to other tasks such as segmentation and assumes a publicly available dataset that cannot be reliably expected in sensitive medical settings.
  • Evident from the text: private classification still significantly underperformed non-private training even under relaxed privacy, and computational performance was mixed, with Opacus significantly faster in classification; benchmarks were limited to two medical imaging tasks and specific architectures.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1038/s41598-021-93030-0

Cites

43 of 43 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 36 cited sources checked · 0 supported · 0 flagged

  • Findingreasoning

    deepee implements DP-SGD in a memory-efficient and parallelised manner by increasing the efficiency of per-sample-gradient calculation compared to serial processing.

    “deepee implements the DP-SGD algorithm in a memory-efficient and parallelised manner by increasing the efficiency of the per-sample-gradient calculation step drastically compared to serial processing.”
    Quote in the paperSubstantial claim
  • Findingcitation

    deepee is a free-and-open-source framework for differentially private deep learning for use with PyTorch.

    “We here present deepee, a free-and-open-source framework for differentially private deep learning for use with the PyTorch deep learning framework.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [15] Paszke, A. et al. Pytorch: An imperative style, high-performance deep learning library. In Advances in Neural Information Processing Systems 32 (eds Wallach, H. et al.) 8024–8035 (Curran Associates, Inc., 2019).

      Not checked in the free run.

  • Findingown data

    In semantic liver tissue segmentation, the privately and non-privately trained models produced nearly identical results: mean Dice 0.943 (range 0.941 to 0.945) and 0.950 (range 0.948 to 0.951, N = 5), respectively.

    “In the semantic liver tissue segmentation task, the non-privately and privately trained models produced nearly identical results: The mean Dice coefficient achieved by the privately and the non-privately trained models was 0.943 (range 0.941 to 0.945), and 0.950 (range 0.948 to 0.951, N = 5), respectively.”
    Quote in the paperSubstantial claim
  • Findingown data

    deepee required significantly less memory than Opacus in both the classification and segmentation settings.

    “Our framework required significantly less memory than Opacus in both the classification and segmentation setting (Student’s t-test ).”
    Quote in the paperSubstantial claim
  • Findingown data

    Semantic segmentation was possible under very strong privacy notions with unexpectedly strong performance.

    “Semantic segmentation was possible under very strong privacy notions with unexpectedly strong performance.”
    Quote in the paperSubstantial claim
  • May combine two claims. 28
  • The quote only partly states this claim. 3
  • Classified as probably not a substantial claim. 23

  • May combine two claims.

    Findingnone given

    deepee offers specialised data loading procedures and privacy budget accounting based on Gaussian Differential Privacy, and automated modification of user-supplied neural network architectures to ensure DP-conformity of layers.

    “We furthermore offer specialised data loading procedures and privacy budget accounting based on the Gaussian Differential Privacy framework, as well as automated modification of the user-supplied neural network architectures to ensure DP-conformity of its layers.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    deepee compares favourably to related work with respect to memory consumption and computational performance.

    “Our framework compares favourably to related work with respect to memory consumption and computational performance.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingreasoning

    deepee's parallelised execution creates one zero-memory-cost reference to network weights per sample in the minibatch and performs a simultaneous forward and backward pass.

    “This occurs by creating one zero-memory-cost reference to the network’s weights for each sample in the minibatch, then performing a simultaneous (parallelised) forward and backward pass.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingnone given

    Pyvacy, while requiring less memory, was significantly slower per batch compared to deepee in the transposed convolution U-Net benchmark.

    “Pyvacy, while requiring less memory (), again was significantly slower per batch compared to deepee ().”
    Quote in the paperNot a substantial claim

  • The quote only partly states this claim.

    Findingown data

    Opacus significantly outperformed deepee and Pyvacy in the classification task.

    “Opacus significantly outperformed our framework () and Pyvacy () in the classification task.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    The process is entirely generic and can be used for any arbitrary neural network architecture without the requirement for user interaction.

    “Lastly, the process is entirely generic and can be used for any arbitrary neural network architecture without the requirement for user interaction.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    deepee's computational performance and memory consumption are comparable to state-of-the-art frameworks without requiring user-side modifications.

    “We found our technique’s computational performance and memory consumption to be comparable to state-of-the-art frameworks without a requirement for user-side modifications.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingreasoning

    Memory only needs to be allocated once for the neural network weights because all copies share the same weights.

    “Moreover, memory only needs be allocated once for the neural network weights (as all copies share the same weights).”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    Pyvacy suffers from drastically diminished computational performance due to serial processing, but requires significantly less memory than both other frameworks because it only caches a single sample's gradients at a time.

    “Pyvacy, due to serial processing of the individual samples in each minibatch suffers from a drastically diminished computational performance, however requires significantly less memory than both other frameworks as a result of only needing to cache a single sample’s gradients at a time (Student’s t-test , all N = 6 repetitions).”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingreasoning

    The parallelised execution model is computationally efficient as it is performed in parallel over the minibatch leveraging multi-threaded execution on the GPU.

    “This approach has several benefits: It is computationally efficient as it is performed in parallel over the minibatch leveraging multi-threaded execution on e.g. the graphics processing unit (GPU).”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingnone given

    Our main technical contribution is the introduction of a parallelised execution model for the DP-SGD algorithm within the PyTorch framework, which enables both fast performance and efficient memory utilisation.

    “Our main technical contribution is the introduction of a parallelised execution model for the DP-SGD algorithm within the PyTorch framework, which enables both fast performance and efficient memory utilisation.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    GDP accounting yielded a privacy budget of 0.52 at a noise multiplier of 3.0 and a clipping norm of 1.0, a tighter result than 0.62 from RDP analysis.

    “GDP accounting yielded a privacy budget () of 0.52 at a noise multiplier of 3.0 and an clipping norm of 1.0, a tighter result than 0.62, which would have resulted from the utilisation of RDP analysis ().”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingnone given

    deepee implements state-of-the-art tools for production-level DP-SGD application including cryptographically secure random noise generation, automatic architecture modifications, and privacy budgeting based on Gaussian Differential Privacy.

    “We implement state-of-the-art tools for production-level DP-SGD application including cryptographically secure random noise generation, automatic architecture modifications and privacy budgeting based on the Gaussian Differential Privacy (GDP) framework which offers a tight analysis of privacy consumed.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    The classification model achieved a mean ROC-AUC of 0.848 (range 0.814 to 0.881) in the private setting and 0.960 (range 0.946 to 0.971) in the non-private setting.

    “The classification model achieved a mean receiver-operator characteristic area-under-the-curve (ROC-AUC) of 0.848 (range 0.814 to 0.881) in the private setting and of 0.960 (range 0.946 to 0.971) in the non-private setting (DeLong-test , ).”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingreasoning

    Our technique is compatible by default with any neural network operation including transformer architectures or transposed convolutions, contrary to frameworks relying on a priori specification of per-sample gradient calculations such as Opacus.

    “In addition, our technique-contrary to frameworks relying on the a priori specification of per-sample gradient calculations such as Opacus- is compatible by default with any neural network operation including (but not limited to) transformer architectures or transposed convolutions, as seen above.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingnone given

    Opacus is incompatible with transposed convolutions and could not be assessed in the U-Net benchmark.

    “The Opacus framework is incompatible with transposed convolutions and could thus not be assessed.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingnone given

    deepee exposes standardised application programming interfaces, is highly compatible with PyTorch, and automatically enforces details to ensure formal correctness of DP-SGD algorithm application.

    “it exposes standardised application programming interfaces, is highly compatible with the PyTorch deep learning framework and automatically enforces the relevant details to ensure the formal correctness of the DP-SGD algorithm application.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingreasoning

    deepee's technical implementation of DP-SGD based on parallelised execution makes the framework universally compatible with any neural network layer while enabling substantial performance improvements.

    “We present a technical implementation of the DP-SGD algorithm based on parallelised execution, which makes our framework universally compatible with any neural network layer while enabling substantial performance improvements.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationreasoning

    deepee's process introduces no additional assumptions about network architecture and thus allows application of DP-SGD to any neural network architecture.

    “This process introduces no additional assumptions about the network’s architecture and thus allows the application of the DP-SGD algorithm to any neural network architecture.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Study design and conductnone given

    deepee is designed to guarantee formal correctness of the DP-SGD procedure by removing Batch Normalisation layers, employing cryptographically secure random noise, and automatic privacy budgeting.

    “The framework furthermore is designed to guarantee the formal correctness of the DP-SGD procedure by e.g. removing Batch Normalisation layers from the architecture, employing cryptographically secure random noise and automatic privacy budgeting.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Premisecitation

    Differential privacy enables information-theoretic privacy guarantees to patients and can be implemented in deep neural network training through differentially private stochastic gradient descent (DP-SGD).

    “Differential privacy (DP) enables the provision of information-theoretic privacy guarantees to patients and can be implemented in the setting of deep neural network training through the differentially private stochastic gradient descent (DP-SGD) algorithm.”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [11] Dwork, C. & Roth, A. The algorithmic foundations of differential privacy. Found. Trends Theor. Comput. Sci. 9, 211–407. https://doi.org/10.1561/0400000042 (2013). source

      Not checked in the free run.

    • cites [12] Abadi, M. et al. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, 308–318 (2016). source

      Not checked in the free run.

  • May combine two claims.

    Interpretationown data

    Neural network training with rigorous privacy guarantees is possible while maintaining acceptable classification performance and excellent segmentation performance.

    “We find that neural network training with rigorous privacy guarantees is possible while maintaining acceptable classification performance and excellent segmentation performance.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The achieved privacy budgets (epsilon 0.52 and 0.12) constitute rigorous or strict privacy guarantees.
    • Rests on an assumption: The observed ROC-AUC and Dice values correspond to acceptable classification performance and excellent segmentation performance.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    Opacus's privacy analysis is based on Rényi DP, whose guarantees are not as tight as Gaussian DP.

    “At the time of writing, the framework’s privacy analysis is still based on Rényi DP (RDP)17, whose guarantees are not as tight as Gaussian DP (GDP).”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [16] Opacus PyTorch library. Available from https://opacus.ai

      Not checked in the free run.

    • cites [17] Mironov, I. Rényi differential privacy. In 2017 IEEE 30th Computer Security Foundations Symposium (CSF), 263–275 (IEEE, 2017). source

      Not checked in the free run.

  • Classified as probably not a substantial claim. May combine two claims.

    Interpretationnone given

    Our framework's focus is to provide a generic framework for DP-SGD and the examples presented represent a simplification of real-life use-cases intended to illustrate its utilisation in medical imaging.

    “Our framework’s focus is to provide a generic framework for DP-SGD and the examples presented represent a simplification of real-life use-cases intended to illustrate its utilisation in medical imaging.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Pyvacy implements a generic version of DP-SGD based on serial execution.

    “The Pyvacy18 framework implements a generic version of DP-SGD based on serial execution.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [18] Waites, C. Pyvacy: Towards Practical Differential Privacy for Deep Learning (Georgia Tech Library, 2019). https://github.com/ChrisWaites/pyvacy.

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S2 (checkable).

    Interpretationnone given

    The framework is well-suited to privacy-sensitive tasks such as medical imaging analysis.

    “It is well-suited to privacy-sensitive tasks such as medical imaging analysis.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation

    Pyvacy's serial execution is highly computationally inefficient, rendering it impractical for production-level use.

    “Despite its broad compatibility, this implementation is highly computationally inefficient, rendering it impractical for production-level use.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [18] Waites, C. Pyvacy: Towards Practical Differential Privacy for Deep Learning (Georgia Tech Library, 2019). https://github.com/ChrisWaites/pyvacy.

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S2 (checkable).

    Interpretationcitation

    Addressing the privacy-utility trade-off and enabling widespread real-world utilisation of privacy-preserving ML in medical imaging and beyond requires the introduction of robust software tools suitable for implementation within widely-used deep learning libraries and implementing current best practices.

    “Addressing this trade-off14 and ultimately enabling the widespread real-world utilisation of privacy-preserving ML in medical imaging and beyond requires the introduction of robust software tools, suitable for implementation within widely-used deep learning libraries and implementing current best practices.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [14] Papernot, N., Chien, S., Song, S. & Thakurta, A. & Erlingsson, U. Architectures, initializations, and tuning for learning with privacy, making the shoe fit (2020).

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    DP techniques purpose-designed for high performance in classification, such as PATE, could yield improved privacy-utility trade-offs in the classification use-case compared to DP-SGD.

    “Moreover, DP techniques purpose-designed for high performance in classification, such as PATE34 could yield improved privacy-utility trade-offs in the classification use-case compared to DP-SGD, however at the cost of not generalising well to other tasks such as segmentation28 and an additional assumption of a publicly available dataset that cannot be reliably expected in a sensitive setting, such”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [34] Papernot, N. et al. Scalable private learning with pate. arXiv preprint arXiv:1802.08908 (2018).

      Not checked in the free run.

    • Rests on an assumption: PATE requires an additional assumption of a publicly available dataset that cannot be reliably expected in a sensitive setting such as medical imaging.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Study design and conductnone given

    Every occurrence of an image from the same patient, regardless of whether it was augmented or not, was counted against the total privacy expenditure.

    “Every occurence of an image from the same patient, regardless whether it was augmented or not, was counted against the total privacy expenditure.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning

    A tight privacy analysis allows training the models for a longer time before the privacy budget is exhausted, enabling higher task-specific performance and therefore a better diagnostic prediction.

    “A tight privacy analysis allows training the models for a longer time before the privacy budget is exhausted, enabling higher task-specific performance and therefore, a better diagnostic prediction.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationreasoning

    Differentially private model training stands as the only formal mechanism for privacy protection, able to shield models from feature reconstruction, model inversion, and membership inference attacks.

    “Differentially private model training therefore stands as the only formal mechanism for privacy protection, able to shield models from feature reconstruction, model inversion and membership inference attacks6,25.”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [6] Geiping, J., Bauermeister, H., Dröge, H. & Moeller, M. Inverting gradients—How easy is it to break privacy in federated learning? arXiv preprint arXiv:2003.14053 (2020).

      Not checked in the free run.

    • cites [25] Shokri, R., Stronati, M., Song, C. & Shmatikov, V. Membership inference attacks against machine learning models. In 2017 IEEE Symposium on Security and Privacy (SP), 3–18 (IEEE, 2017). source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    A line of work complementary to ours (Subramani et al., 2020) utilises just-in-time compilation and vectorised execution to increase DP-SGD performance within a different machine learning framework.

    “This disparity is discussed in20, a line of work complementary to ours, whose authors utilise just-in-time compilation and vectorised execution to increase DP-SGD performance, albeit within a different machine learning framework.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [20] Subramani, P., Vadivelu, N. & Kamath, G. Enabling fast differentially private SGD via just-in-time compilation and vectorization. arXiv preprint arXiv:2010.09063 (2020).

      Not checked in the free run.

  • May combine two claims.

    Interpretationreasoning

    Step (2) of the DP-SGD algorithm (calculating per-sample gradients) is the most time-consuming subroutine, as automatic differentiation systems are not designed with per-sample gradient computation in mind.

    “In practice, step (2) of the above-mentioned procedure is the most time-consuming subroutine of the algorithm, as automatic differentiation systems are not designed with per-sample gradient computation in mind.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    Pyvacy lacks cryptographically secure random number generation and utility functions for automatic neural network architecture modification.

    “The framework also lacks cryptographically secure random number generation and utility functions for automatic neural network architecture modification.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [18] Waites, C. Pyvacy: Towards Practical Differential Privacy for Deep Learning (Georgia Tech Library, 2019). https://github.com/ChrisWaites/pyvacy.

      Not checked in the free run.

  • May combine two claims.

    Premisecitation

    Recent work demonstrates that DP can reduce susceptibility of models to back-door attacks, attributable to increased robustness from regularising properties of noise addition.

    “recent work demonstrates that DP can reduce the susceptibility of models to other adversarial interference such as back-door attacks26, which can be attributed to the increased robustness of DP models imparted through the regularising properties of noise addition27.”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [26] Lecuyer, M., Atlidakis, V., Geambasu, R., Hsu, D. & Jana, S. Certified robustness to adversarial examples with differential privacy. In 2019 IEEE Symposium on Security and Privacy (SP), 656–672 (IEEE, 2019). source

      Not checked in the free run.

    • cites [27] Dwork, C. et al. Generalization in adaptive data analysis and holdout reuse. arXiv preprint arXiv:1506.02629 (2015).

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    The requirement to calculate per-sample gradients in current DP-SGD frameworks stems from the inherent design philosophy of reverse-mode automatic differentiation systems, which are focused on efficiently obtaining gradients for minibatches but not for individual samples.

    “After all, the requirement to calculate per-sample gradients in current DP-SGD frameworks stems from the inherent design philosophy of reverse-mode automatic differentiation systems, which are focused on efficiently obtaining gradients for minibatches but not for individual samples.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationreasoning

    Because medical imaging datasets are complex, highly sensitive and typically small, each individual in the dataset experiences a relatively higher privacy loss.

    “As datasets are complex, highly sensitive and typically small, each individual in the dataset experiences a relatively higher privacy loss.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    A similar technique to ours, based on serial execution instead of a parallelised forward pass and only demonstrated for convolutional neural networks, is presented in Rochette et al. (2019).

    “A similar technique to ours, albeit based on serial execution instead of a parallelised forward pass and only demonstrated for convolutional neural networks, is presented in36, reportedly going back to (unpublished) work by Goodfellow et al.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [36] Rochette, G., Manoel, A. & Tramel, E. W. Efficient per-example gradient computations in convolutional neural networks. arXiv preprint arXiv:1912.06015 (2019).

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S2 (checkable).

    Interpretationreasoning

    Solutions based on information-theoretic privacy measures are required to provide comprehensive and quantifiable guarantees to involved parties.

    “Thus, solutions based on information-theoretic privacy measures are required to provide comprehensive and quantifiable guarantees to the involved parties.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Opacus provides an implementation of DP-SGD based on temporarily caching intermediate backpropagation results, enabling very high performance for specific layer types.

    “The Opacus framework16 provides an implementation of the DP-SGD algorithm based on temporarily caching intermediate backpropagation results. This enables very high performance for specific deep neural network layer types.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [16] Opacus PyTorch library. Available from https://opacus.ai

      Not checked in the free run.

  • Classified as probably not a substantial claim.

    Study design and conductnone given

    Strict patient independence was enforced between the training/validation sets and the test set.

    “We split the available data into a training set (n = 5184), a validation set (n = 640) and a held-out test set (n = 2560), mindful to enforce strict patient independence between the training/validation sets and the test set.”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim.

    Study design and conductreasoning

    The collection of running statistics of Batch Normalisation layers was disabled for both non-private and DP training to satisfy the assumptions essential for DP training.

    “However, in order to satisfy the assumptions essential for DP training, the collection of running statistics of Batch Normalisation layers was disabled for both non-private and DP training.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). The quote only partly states this claim.

    Study design and conductcitation

    Areas under the ROC-curve were compared using the DeLong-test as described in Molodianovitch et al. (2006).

    “Areas under the ROC-curve were compared using the DeLong-test as described in42.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [42] Molodianovitch, K., Faraggi, D. & Reiser, B. Comparing the areas under two correlated ROC curves: Parametric and non-parametric approaches. Biometr. J. 48, 745–757. https://doi.org/10.1002/bimj.200610223 (2006). source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims. The quote only partly states this claim.

    Study design and conductnone given

    Bonferroni's correction was used for three-way comparisons with the adjusted statistical significance threshold set to .

    “Bonferroni’s correction was used for three-way comparisons with the adjusted statistical significance threshold set to .”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Study design and conductnone given

    All benchmarks were conducted in triplicate to ensure stability between runs and repeated on two operating systems (total N = 6 runs).

    “All benchmarks were conducted in triplicate to ensure stability between runs and repeated on two operating systems, macOS 11.2.3 and GNU Linux on the 5.4.0-72 kernel (total N = 6 runs).”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Study design and conductnone given

    Continuous variables were compared using the Student's t-test.

    “Continuous variables were compared using the Student’s t-test.”
    Quote in the paperNot a substantial claim
47 of 47

  • The paper relies on this without support.

    The achieved privacy budgets (epsilon 0.52 and 0.12) constitute rigorous or strict privacy guarantees.

    “We find that neural network training with rigorous privacy guarantees is possible while maintaining acceptable classification performance and excellent segmentation performance.”
    “indicating that the provision of strict privacy guarantees was possible in this setting without a notable trade-off in model performance.”

  • The paper relies on this without support.

    The observed ROC-AUC and Dice values correspond to acceptable classification performance and excellent segmentation performance.

    “We find that neural network training with rigorous privacy guarantees is possible while maintaining acceptable classification performance and excellent segmentation performance.”

  • The paper relies on this without support.

    The two medical imaging tasks (paediatric pneumonia classification and liver segmentation) are representative of real-world medical image processing.

    “The two applications presented provide evidence for the usefulness of our DP-SGD algorithm in real-world medical image processing.”

  • The authors state this as an assumption.

    No previous work reports ε-values for medical image classification.

    “No previous work—to our knowledge—reports -values for medical image classification.”

  • The paper relies on this without support.

    Gaussian Differential Privacy improves the outlook on the spent privacy budget compared to previous frameworks.

    “Our work utilises Gaussian Differential Privacy, a recently introduced DP formulation which—through a tight characterisation of the sub-sampled Gaussian noise mechanism utilised in DP-SGD—improves the outlook on the spent privacy budget compared to previous frameworks.”

  • The paper relies on this without support.

    PATE requires an additional assumption of a publicly available dataset that cannot be reliably expected in a sensitive setting such as medical imaging.

    “an additional assumption of a publicly available dataset that cannot be reliably expected in a sensitive setting, such as medical imaging.”
6 of 6

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Conflicting RDP privacy budget for private classification

    Minor

    The classification results state that RDP accounting gives 0.62, but Table 1 reports 0.64 for the same private model.

1 of 1

Cites

Flagged first, then by citations

Cited by

Sorted by citations

Related

Authors
Ziller, A., Usynin, D., Braren, R., Makowski, M., Rueckert, D., & Kaissis, G.
Affiliations
  • TUM Klinikum (DE)
  • Imperial College London (GB)
Corresponding author
Kaissis, Georgios
ORCID
Venue
Scientific Reports
Publisher
Springer Science and Business Media LLC
Published
2021-06-29
Volume
11
Issue
1
Pages
13524-13524
ISSN
2045-2322 (ISSN-L)
DOI
10.1038/s41598-021-93030-0
PMC
PMC8242021
OpenAlex
W3176741412
Semantic Scholar
e9a6ebb6382e1a1a4ae967699d70ced030361044
Cited by
172
References
43
Citations by year
2026: 29 · 2025: 53 · 2024: 36 · 2023: 23 · 2022: 25 · 2021: 6
FWCI
7.92
Type
journal article
Language
en
Open access
Licence
Locations
  • Scientific Reports (publishedVersion, cc-by)
  • PubMed Central (publishedVersion, cc-by)
  • PubMed (publishedVersion)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
  • mediaTUM (Technical University of Munich) (submittedVersion)
  • mediaTUM – the media and publications repository of the Technical University Munich (Technical University Munich) (submittedVersion, other-oa)
  • Spiral (Imperial College London) (submittedVersion, cc-by)
Funders
  • Technical University Munich/Imperial College London Joint Academy of Doctoral Studies
  • UK Research and Innovation London Medical Imaging & Artificial Intelligence Centre for Value Based Healthcare
  • Klinikum rechts der Isar der Technischen Universität München
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Health Sciences › Medicine › Health Informatics › Artificial Intelligence in Healthcare and Education
  • Health Sciences › Medicine › Public Health, Environmental and Occupational Health › Patient Dignity and Privacy
Keywords
differential privacy, diagnostic imaging, DP-SGD, privacy-preserving deep learning, open source software framework, PyTorch, memory efficiency, Gaussian differential privacy, medical image segmentation, image classification, pediatric pneumonia, liver segmentation, patient privacy

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-09.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-09.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review