CoChat
Sign Up
Cited by 1,501Privacy-Preserving Technologies in DataArtificial Intelligence in Healthcare and EducationRadiomics and Machine Learning in Medical Imaging

Secure, privacy-preserving and federated machine learning in medical imaging

Open access
Kaissis, Georgios A., Makowski, Marcus R., Rückert, Daniel, Braren, Rickmer F.·2020·Nature Machine Intelligence
DOI 10.1038/s42256-020-0186-1
Open this paper in CoChat — free accountOpen PDF

Abstract

The broad application of artificial intelligence techniques in medicine is currently hindered by limited dataset availability for algorithm training and validation, due to the absence of standardized electronic medical records, and strict legal and ethical requirements to protect patient privacy. In medical imaging, harmonized data exchange formats such as Digital Imaging and Communication in Medicine and electronic data storage are the standard, partially addressing the first issue, but the requirements for privacy preservation are equally strict. To prevent patient privacy compromise while promoting scientific research on large datasets that aims to improve patient care, the implementation of technical solutions to simultaneously address the demands for data protection and utilization is mandatory. Here we present an overview of current and next-generation methods for federated, secure and privacy-preserving artificial intelligence with a focus on medical imaging applications, alongside potential attack vectors and future prospects in medical imaging and beyond. Medical imaging data is often subject to privacy and intellectual property restrictions. AI techniques can help out by offering tools like federated learning to bridge the gap between personal data protection and data utilisation for research and clinical routine, but these tools need to be secure.

AI snapshot

Written from the paper’s full text.

TL;DR

This review/perspective surveys secure, privacy-preserving, and federated machine learning for medical imaging, mapping attack vectors and technical defenses. It argues that no single method suffices and that federated learning, differential privacy, homomorphic encryption, secure multi-party computation, and hardware enclaves must be combined with governance and further research.

Key findings

  • The paper identifies two main barriers to medical imaging AI: insufficient large, representative datasets and strict legal/ethical privacy rules such as HIPAA and GDPR, with electronic imaging formats like DICOM easing data exchange but not privacy risks.
  • It organizes threats into dataset attacks (re-identification/linkage, dataset reconstruction/attribute inference, tracing/membership inference) and algorithm attacks (adversarial/poisoning, model inversion/reconstruction), noting that de-identification alone is technically insufficient.
  • It reviews privacy-preserving approaches: federated learning distributes training to data holders but requires encryption/secure aggregation; differential privacy adds randomized perturbation with a privacy budget but may harm imaging performance; homomorphic encryption permits computation on encrypted data at a performance cost; secure multi-party computation splits encrypted data across parties but faces communication, availability, and scalability constraints; hardware enclaves offer system-level guarantees.
  • The outlook calls for decentralized/federated infrastructure, efficient cryptographic primitives, research on privacy-utility trade-offs, cryptographic expertise, monitoring for statistical drift, machine unlearning for right-to-be-forgotten, open-source tools, auditable systems, data valuation, and education/public discourse.

Methods

  • Narrative review/perspective, not a systematic review or primary study; it synthesizes current and emerging techniques for secure and privacy-preserving AI with a focus on medical imaging.
  • No dataset, sample, or experimental analysis is reported; the paper discusses attack vectors, technical implementations, benefits, drawbacks, weaknesses, and future directions.
  • Evidence is drawn from cited literature and conceptual examples rather than new experiments or quantitative comparisons.

Limitations

  • Stated: The paper notes limitations of each technique: de-identification can fail against re-identification; federated learning does not by itself guarantee privacy/security and can suffer communication burden, curation difficulty, parameter inference, and unintended memorization; differential privacy can degrade data and its imaging implementation is unclear; homomorphic encryption has computational performance issues; secure multi-party computation requires continuous data transfer/online availability and has reliability/scalability concerns.
  • Stated: The paper says further research is needed before widespread differential privacy in medical imaging and that privacy-utility trade-offs, interpretability in encrypted settings, and drift monitoring remain unresolved.
  • Evident: As a narrative overview, it lacks a systematic search strategy, formal inclusion criteria, and empirical validation; no original quantitative results or comparative benchmarks are presented.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1038/s42256-020-0186-1

Cites

110 of 111 references verified0 citation errors · 1 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

33 of 61 cited sources checked · 16 supported · 0 flagged · accuracy not yet measured

  • Premisecitation
    § Decentralized data and federated machine learning

    It is possible to reconstruct parts of the training data from the algorithm weights themselves on a decentralized node.

    “It is therefore possible to reconstruct parts of the training data from the algorithm weights themselves on a decentralized node [52][53][54] .”
    Quote in the paperSubstantial claim2 of 3 sources checked
    • cites [52] Carlini, N., Liu, C., Erlingsson, Ú., Kos, J. & Song, D. The secret sharer: evaluating and testing unintended memorization in neural networks. In Proc. 28th USENIX Security Symp. 267–284 (USENIX Association, 2019). source

      The Introduction (p. 1) says the authors extract secret sequences from a pretrained language model, supporting the possibility of recovering specific training data. But Related Work and Conclusions (p. 15) distinguishes training-data extraction from access to model parameters and says extraction is difficult even with direct access to them. The paper does not establish reconstruction from weights alone on a decentralized node. (LLM, conf=0.86)

      Experimental — accuracy not yet measured
    • cites [53] Zhang, Y. et al. The secret revealer: generative model-inversion attacks against deep neural networks. Preprint at https://arxiv.org/abs/1911.07135 (2019). source
    • cites [54] Hitaj, B., Ateniese, G. & Perez-Cruz, F. Deep models under the GAN: information leakage from collaborative deep learning. In Proc. 2017 ACM SIGSAC Conf. Computer and Communications Security 603–618 (ACM, 2017). source
    • Rests on an assumption: Neural networks represent a form of memory mechanism, with compressed representations of the training data stored within their weights (unintended memorization).
  • Premisecitation
    § Anonymization, pseudonymization and the risks of re-identification

    Re-identification attacks have been shown to yield high success rates both with tabular data and medical imaging data.

    “Such re-identification attacks 39 have been shown to yield high success rates both with tabular data 40,41 (such as patient records) and medical imaging data 42 .”
    Quote in the paperSubstantial claim2 of 4 sources checked
    • cites [39] El Emam, K., Jonker, E., Arbuckle, L. & Malin, B. A systematic review of re-identification attacks on health data. PLoS ONE 6, e28071 (2011). source
    • cites [40] Narayanan, A. & Shmatikov, V. Robust de-anonymization of large sparse datasets. In 2008 IEEE Symp. Security and Privacy 111–125 (IEEE, 2008). source
    • cites [41] de Montjoye, Y. A., Radaelli, L., Singh, V. K. & Pentland, A. S. Identity and privacy. Unique in the shopping mall: on the reidentifiability of credit card metadata. Science 347, 536–539 (2015). source
    • cites [42] Schwarz, C. G. et al. Identification of anonymous MRI research participants with face-recognition software. New Engl. J. Med. 381, 1684–1686 (2019). source
  • Premisecitation
    § Anonymization, pseudonymization and the risks of re-identification

    Even defacing or skull stripping might not be sufficient for the full de-identification of datasets.

    “Ultimately, even such processing might not be sufficient for the full de-identification of datasets 44 .”
    Quote in the paperSubstantial claim1 of 1 sources checked
    • cites [44] Abramian, D. & Eklund, A. Refacing: reconstructing anonymized facial features using GANs. In 2019 IEEE 16th International Symp. Biomedical Imaging https://doi.org/10.1109/ISBI.2019.8759515 (IEEE, 2019). source

      The Discussion (p. 4) says successful facial reconstructions raise concerns about MRI anonymization, and reports some success reconstructing faces after face removal. This supports the qualified concern about defacing, but the paper does not evaluate skull stripping; it also did not attempt to identify subjects (Discussion, p. 4). (LLM, conf=0.85)

      Experimental — accuracy not yet measured
  • Premisecitation
    § Abstract

    Even the largest current imaging studies in the field include considerably less data than ImageNet or the data used to train algorithmic agents in games or autonomous vehicles.

    “Even the largest current imaging studies in the field 4,5 , demonstrating better-than-human performance in their respective tasks, include considerably less data than, for example, ImageNet 3 , or the amount of data used to train algorithmic agents in the games of Go or StarCraft 16,17 , or autonomous vehicles 18 .”
    Quote in the paperSubstantial claim1 of 5 sources checked
    • cites [4] McKinney, S. M. et al. International evaluation of an AI system for breast cancer screening. Nature 577, 89–94 (2020). source
    • cites [5] Ardila, D. et al. End-to-end lung cancer screening with three-dimensional deep learning on low-dose chest computed tomography. Nat. Med. 25, 954–961 (2019). source
    • cites ImageNet 3

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [16] Silver, D. et al. Mastering the game of Go with deep neural networks and tree search. Nature 529, 484–489 (2016). source
    • cites [17] Vinyals, O. et al. Grandmaster level in StarCraft II using multi-agent reinforcement learning. Nature 575, 350–354 (2019). source
  • Premisecitation
    § homomorphic encryption

    Homomorphic encryption can also be used in federated learning scenarios, with or without additional differential privacy, to securely aggregate encrypted algorithm updates.

    “It can also be used in federated learning scenarios (with or without additional DP 61 ) to securely aggregate encrypted algorithm updates 72 .”
    Quote in the paperNot a substantial claim2 of 2 sources checked
    • cites [61] Kim, J. W., Jang, B. & Yoo, H. Privacy-preserving aggregation of personal health data streams. PLoS ONE 13, e0207639 (2018). source

      The Background: Local differential privacy section describes adding noise to personal data before collection, and the Proposed approach describes reconstructing health-data streams. Searches for homomorphic encryption, federated learning, and encrypted algorithm updates found no passage addressing their use together; the indexed copy provides no page numbers. (LLM, conf=0.77)

      Experimental — accuracy not yet measured
    • cites [72] Li, X., Chen, D., Li, C. & Wang, L. Secure data aggregation with fully homomorphic encryption in large-scale wireless sensor networks. Sensors 15, 15952–15973 (2015). source

      Section 4.4 describes using fully homomorphic encryption to aggregate ciphertexts without decrypting them, supporting the general secure-aggregation point. The paper’s scheme aggregates sensor data in wireless sensor networks; it does not address federated learning, encrypted algorithm updates, or differential privacy. No page numbers are available in our copy. (LLM, conf=0.86)

      Experimental — accuracy not yet measured
  • May combine two claims. 26
  • Classified as probably not a substantial claim. 29

  • May combine two claims.

    Premisecitation
    § Differential privacy

    Tabular data can be easily shuffled, but the perturbation of images can have unpredictable effects, with research demonstrating this type of manipulation both as an attack against algorithms and as a regularization mechanism leading to increased robustness and resilience against inversion attacks.

    “Tabular data can be easily shuffled, but the perturbation of images can have unpredictable effects, with research demonstrating this type of manipulation (for example, adversarial noise) both as an attack against algorithms 65 and a regularization mechanism leading to increased robustness 66 and resilience against inversion attacks.”
    Quote in the paperSubstantial claim1 of 2 sources checked
    • cites [65] Goodfellow, I. J., Shlens, J. & Szegedy, C. Explaining and harnessing adversarial examples. Preprint at https://arxiv.org/abs/1412.6572 (2014). source

      Split into 2 atoms — 1 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

      Experimental — accuracy not yet measured
    • cites [66] You, Z., Ye, J., Li, K., Xu, Z. & Wang, P. Adversarial noise layer: regularize neural network by adding noise. In 2019 IEEE Int. Conf. Image Processing https://doi.org/10.1109/ICIP.2019.8803055 (IEEE, 2019). source

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § Decentralized data and federated machine learning

    Federated learning approaches have arguably become the most widely used next-generation privacy preservation technique, both in industry and medical AI applications.

    “Thus, federated learning approaches have arguably become the most widely used next-generation privacy preservation technique, both in industry 49 and medical AI applications 50 .”
    Quote in the paperNot a substantial claim2 of 2 sources checked
    • cites [49] Konečný, J. et al. Federated learning: strategies for improving communication efficiency. Preprint https://arxiv.org/abs/1610.05492 (2016). source

      The Introduction (p. 1) describes federated learning as a way to train on mobile-app data while keeping it on users’ devices, supporting its relevance to privacy-conscious applications. It presents mobile apps as a motivating example, not evidence that federated learning is the most widely used privacy-preservation technique in industry. The medical-AI portion has a separate citation in the citing sentence. (LLM, conf=0.83)

      Experimental — accuracy not yet measured
    • cites [50] Rieke, N. et al. The future of digital health with federated learning. Preprint at https://arxiv.org/abs/2003.08119 (2020). source

      The Introduction (page not available in our copy) describes federated learning as a way to address data privacy and says it has gained traction in healthcare. The section “Data-Driven Medicine Requires Federated Efforts” gives examples of medical AI use. Neither passage establishes that it is the most widely used next-generation privacy-preservation technique; the separate industry citation is not assessed here. (LLM, conf=0.86)

      Experimental — accuracy not yet measured

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § Differential privacy

    Differential privacy applications to imaging are being actively explored.

    “DP applications to imaging are being actively explored 62 .”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites [62] Mireshghallah, F. et al. A principled approach to learning stochastic representations for privacy in deep neural inference. Preprint at https://arxiv.org/abs/2003.12154 (2020). source

      The Training phase section says differential privacy has generated extensive research and has been applied to deep learning. The Introduction describes the paper’s privacy experiments on images, but those experiments use a mutual-information approach; our copy does not establish that differential privacy applications to imaging are being explored. (LLM, conf=0.82)

      Experimental — accuracy not yet measured

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Interpretationcitation
    § Differential privacy

    Local differential privacy ensures privacy at the source of the data, putting the data owner in control, and is thus well suited to healthcare applications, for instance for federated learning applications in which health data are collected by smartphones or wearable devices.

    “Local DP ensures privacy at the source of the data, putting the data owner in control and is thus well suited to healthcare applications 61 , for instance for federated learning applications in which health data are being collected by smartphones or wearable devices.”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites [61] Kim, J. W., Jang, B. & Yoo, H. Privacy-preserving aggregation of personal health data streams. PLoS ONE 13, e0207639 (2018). source

      Split into 2 atoms — 1 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

      Experimental — accuracy not yet measured

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § Abstract

    Ethical, moral and scientific guidelines (soft law) prescribe respect towards privacy.

    “Ethical, moral and scientific guidelines (soft law 28 ) also prescribe respect towards privacy”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites [28] Jobin, A., Ienca, M. & Vayena, E. The global landscape of AI ethics guidelines. Nat. Mach. Intell. 1, 389–399 (2019). source

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation
    § Differential privacy

    Differential privacy can also be applied to algorithm updates during training, for instance in neural networks via differentially private stochastic gradient descent or private aggregation of teacher ensembles, or during inference time.

    “DP can also be applied to algorithm updates during training, for instance in neural networks via differentially private stochastic gradient descent 59 or private aggregation of teacher ensembles 60 , or during inference time.”
    Quote in the paperNot a substantial claim1 of 2 sources checked
    • cites [59] Rajkumar, A. & Agarwal, S. A differentially private stochastic gradient descent algorithm for multiparty classification. In Proc. Fifteenth Int. Conf. Artificial Intelligence and Statistics 22, 933–941 (PMLR, 2012).
    • cites [60] Papernot, N. et al. Scalable private learning with PATE. In Proc. 6th Int. Conf. Learning Representations (ICLR, 2018). source

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation
    § Differential privacy

    Implementations of differential privacy range from simple random shuffling of the input data to the introduction of noise to the dataset, including Gaussian DP with the benefit of better interpretability.

    “Implementations range from simple random shuffling of the input data 57 to the introduction of noise to the dataset (Gaussian DP 58 with the benefit of better interpretability).”
    Quote in the paperNot a substantial claim1 of 2 sources checked
    • cites [57] Cheu, A., Smith, A., Ullman, J., Zeber, D. & Zhilyaev, M. Distributed differential privacy via shuffling. In Annual Int. Conf. Theory and Applications of Cryptographic Techniques 375–403 (Springer, 2018). source

      The Introduction (p. 3) describes a differentially private model using a shuffler, supporting the shuffling part of the claim. But §3.2 (p. 9) says users first encode their data into messages and the shuffler randomly orders those messages—not the input data itself. The Gaussian DP and interpretability phrase is attached to a different citation, so it is not assessed here. (LLM, conf=0.88)

      Experimental — accuracy not yet measured
    • cites [58] Dong, J., Roth, A. & Su, W. J. Gaussian differential privacy. Preprint at https://arxiv.org/abs/1905.02383 (2019). source

  • May combine two claims.

    Premisecitation
    § Decentralized data and federated machine learning

    Model inversion or reconstruction attacks can cause catastrophic data leakage: images can be reconstructed with impressive accuracy and detail, allowing visualization of the original training data.

    “Such model inversion or reconstruction attacks can cause catastrophic data leakage: it has been shown that images can be reconstructed with impressive accuracy and detail 55 , allowing visualization of the original training data.”
    Quote in the paperSubstantial claim1 of 1 sources checked
    • cites [55] Fredrikson, M., Jha, S. & Ristenpart, T. Model inversion attacks that exploit confidence information and basic countermeasures. In Proc. 22nd ACM SIGSAC Conf. Computer and Communications Security 1322–1333 (ACM, 2015). source

      The Summary and Conclusion report extracting recognizable images of training subjects from facial-recognition models. Section 5.2.2 reports sharp, recognizable features for the best-performing model, but says other reconstructions were faint or blurry; the paper does not establish accurate, detailed recovery of the original training images themselves. (LLM, conf=0.86)

      Experimental — accuracy not yet measured

  • May combine two claims.

    Interpretationcitation
    § Differential privacy

    Differential privacy poses challenges with respect to plausibility testing, explaining the process to patients (data legibility), and escalates the requirement for statistical expertise to ascertain data representativeness.

    “The technique also poses challenges with respect to plausibility testing, explaining the process to patients-that is, data legibility (human-data interaction 63 )-regarding algorithm development and implementation, and escalates the requirement for statistical expertise to ascertain data representativeness 64 .”
    Quote in the paperNot a substantial claim2 of 2 sources checked
    • cites [63] Mortier, R., Haddadi, H., Henderson, T., McAuley, D. & Crowcroft, J. Human-data interaction: the human face of the data-driven society. Preprint at https://arxiv.org/abs/1412.6159 (2014). source
    • cites [64] Garfinkel, S. L., Abowd, J. M. & Powazek, S. Issues encountered deploying differential privacy. In Proc. 2018 Workshop on Privacy in the Electronic Society 133–137 (ACM, 2018). source

      Section 3.3 (p. 4) describes difficulties explaining differential privacy to data users and says its randomness is incompatible with rerunning a mechanism when a result seems unacceptable. Section 3.2 (p. 3) reports a shortage of expertise for developing and verifying implementations. The paper discusses Census data users, not patients, and does not link greater statistical expertise to assessing data representativeness. (LLM, conf=0.85)

      Experimental — accuracy not yet measured

  • May combine two claims.

    Interpretationcitation
    § Abstract

    Electronic patient data management is expensive, and hospitals in underprivileged regions might be unable to afford participation in studies requiring it, potentially perpetuating issues of bias and fairness.

    “Electronic patient data management is expensive 20 , and hospitals in underprivileged regions might be unable to afford participation in studies requiring it, potentially perpetuating the aforementioned issues of bias and fairness.”
    Quote in the paperSubstantial claim1 of 1 sources checked
    • cites [20] Wang, S. J. et al. A cost-benefit analysis of electronic medical records in primary care. Am. J. Med. 114, 397–403 (2003). source

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § Anonymization, pseudonymization and the risks of re-identification

    There is substantial discourse regarding the definition of sufficient or reasonable de-identification related to the objective or technical difficulty of reversing the process.

    “Moreover, there is substantial discourse regarding the definition of 'sufficient/reasonable' de-identification 37 related to the objective/technical difficulty of reversing the process.”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites [37] Taylor, M. J. & Wilson, J. Reasonable expectations of privacy and disclosure of health data. Med. Law Rev. 27, 432–460 (2019). source

      Part III.B discusses whether identifiable patient information is private or confidential, and Part IV.C discusses how reasonable expectations of privacy are assessed. Neither addresses what counts as sufficient de-identification or the technical difficulty of reversing it. Searches for de-identification, re-identification, anonymised data, and reversal found no passage on that point. (LLM, conf=0.75)

      Experimental — accuracy not yet measured

  • May combine two claims.

    Interpretationcitation
    § Anonymization, pseudonymization and the risks of re-identification

    Defacing or skull stripping complicates data handling, increases the probability of errors, and constitutes a manipulation of imaging data that at worst represents an adversarial update to the algorithm, reducing its performance and robustness.

    “This complicates data handling, increasing the probability of errors and constitutes a manipulation of the imaging data, which, at worst, represents an adversarial update to the algorithm 43 , reducing its performance and robustness.”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites [43] Ma, X. et al. Understanding adversarial attacks on deep learning based medical image analysis systems. Pattern Recognit. https://doi.org/10.1016/j.patcog.2020.107332 (2020). source

      Split into 2 atoms — 0 confirmed, 2 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

      Experimental — accuracy not yet measured

  • May combine two claims.

    Premisecitation
    § homomorphic encryption

    Homomorphic encryption has successfully been applied to convolutional neural networks, and its benefits have been demonstrated in a machine learning as a service scenario.

    “Nevertheless, HE has successfully been applied to convolutional neural networks 70 , and its benefits demonstrated in a 'machine learning as a service' scenario 71 , whereby data is sent over the network to be processed on an off-site server (cloud computing).”
    Quote in the paperNot a substantial claim1 of 2 sources checked
    • cites [70] Hesamifard, E., Takabi, H. & Ghasemi, M. CryptoDL: deep neural networks over encrypted data. Preprint at https://arxiv.org/abs/1711.05189 (2017). source
    • cites [71] Dowlin, N. et al. CryptoNets: applying neural networks to encrypted data with high throughput and accuracy. In Proc. 33rd Int. Conf. Machine Learning Vol. 48 201–210 (PMLR, 2016).

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation
    § Secure multi-party computation

    Computational considerations are a concern for SMPC beyond small algorithm sizes, with efficient SMPC implementations of state-of-the-art neural network algorithms currently under active development.

    “computational considerations are a concern beyond small algorithm sizes, with efficient SMPC implementations of state-of-the-art neural network algorithms currently under active development 78 .”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites [78] Kumar, N. et al. CrypTFlow: secure tensorflow inference. In Proc. 41st IEEE Symp. Security and Privacy (IEEE, 2020). source

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingcitation
    § Outlook

    Many accessible, open-source tools such as open-source extensions to deep learning frameworks, implementations of state-of-the-art algorithms and federated learning solutions have recently become available.

    “many of which have recently become available 97,98 .”
    Quote in the paperNot a substantial claim1 of 2 sources checked
    • cites [97] Ryffel, T. et al. A generic framework for privacy preserving deep learning. Preprint at https://arxiv.org/abs/1811.04017 (2018). source

      The Introduction (pp. 1–2) describes a PyTorch-based framework implementing federated learning and privacy-preserving methods, supporting this paper as an example of such a tool. But the Conclusions (p. 4) say its code samples *will be made available* on GitHub; the paper does not establish that they were already available, or that many open-source tools had recently become available. (LLM, conf=0.82)

      Experimental — accuracy not yet measured
    • cites [98] Dahl, M. et al. Private machine learning in TensorFlow using secure computation. Privacy Preserving Machine Learning, NeurIPS 2018 Workshop, Montréal, December 8, 2018. Available at: https://arxiv.org/abs/1810.08130 (2018). source

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § Outlook

    Issues of security and privacy are not limited to medical imaging.

    “However, the issues of security and privacy are not limited to medical imaging 82”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites [82] Qayyum, A., Qadir, J., Bilal, M. & Al-Fuqaha, A. Secure and robust machine learning for healthcare: a survey. Preprint at https://arxiv.org/abs/2001.08103 (2020). source

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § Secure multi-party computation

    Secure multi-party computation has been used in the setting of genetic sequencing and diagnostics without revealing the patient's genome.

    “Notably, SMPC has been used in the setting of genetic sequencing and diagnostics without revealing the patient's genome 75 .”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites [75] Jagadeesh, K. A., Wu, D. J., Birgmeier, J. A., Boneh, D. & Bejerano, G. Deriving genomic diagnoses without revealing patient genomes. Science 357, 692–695 (2017). source

  • May combine two claims.

    Findingcitation
    § Outlook

    Decentralized data storage and federated learning systems have recently demonstrated results in medical imaging and genomics.

    “with results in medical imaging 50,86 and genomics 87 recently demonstrated.”
    Quote in the paperNot a substantial claim2 of 3 sources checked
    • cites [50] Rieke, N. et al. The future of digital health with federated learning. Preprint at https://arxiv.org/abs/2003.08119 (2020). source
    • cites [86] Li, W. et al. Privacy-preserving federated brain tumour segmentation. In Proc. 10th Int. Workshop on Machine Learning in Medical Imaging 133–141 (Springer, 2019). source
    • cites [87] Grishin, D., Obbad, K. & Church, G. M. Data privacy in the age of personal genomics. Nat. Biotechnol. 37, 1115–1117 (2019). source

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation
    § homomorphic encryption

    Several implementations of homomorphic encryption algorithms with varying levels of efficiency exist, and the application of homomorphic encryption represents an efficiency-security trade-off, with computational performance currently the most notable issue.

    “Several implementations of HE algorithms 69 with varying levels of efficiency exist, and the application of HE represents an efficiencysecurity trade-off, with computational performance currently the most notable issue.”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites [69] Acar, A., Aksu, H., Selcuk Uluagac, A. & Conti, M. A survey on homomorphic encryption schemes: theory and implementation. ACM Comput. Surv. 51, 79 (2018). source

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning
    § Secure hardware implementations

    Due to the rising significance of hardware-level deep learning implementations, system-based privacy guarantees (trusted execution environments) built into edge hardware such as mobile phones are likely to become more prevalent.

    “Due to the rising significance of hardware-level deep learning implementations (for example, tensor processing units 80 or machine-learning-specific instruction sets 81 ), it is likely that such system-based privacy guarantees (trusted execution environments) built into edge hardware such as mobile phones will become more prevalent.”
    Quote in the paperNot a substantial claim1 of 2 sources checked
    • cites [80] Cloud TPU. Google https://cloud.google.com/tpu/ (2020).

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [81] Chen, A. Y. et al. An instruction set architecture for machine learning. ACM Trans. Comput. Syst. 36, 9 (2019). source

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationcitation
    § Outlook

    Current research about interpretable private algorithms can alleviate the limited interpretability in the encrypted setting.

    “Current research about interpretable private algorithms 93 can alleviate this issue.”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites [93] Harder, F., Bauer, M. & Park, M. Interpretable and differentially private predictions. In Proc. Thirty-Fourth AAAI Conf. Artificial Intelligence (AAAI, 2020). source

      The Introduction (p. 2) proposes models designed to be both interpretable and privately trained, supporting the general point that private algorithms can address interpretability. But the paper studies differential privacy in classification, not interpretability in an encrypted setting; that application is not established by the cited work. (LLM, conf=0.84)

      Experimental — accuracy not yet measured
    • Rests on an assumption: In radiology, interpretability in the encrypted setting is limited to the evaluation of trained algorithms on new images or inspection of the plain-text input data; intermediate outputs might be obfuscated and hard to interpret.

  • May combine two claims.

    Interpretationreasoning
    § Differential privacy

    Data manipulation in differential privacy can degrade the data, which in an area with access to relatively little data, such as medical imaging research, may prove deleterious to algorithm performance.

    “Data manipulation can degrade the data, which in an area with access to relatively little data, such as medical imaging research, may prove deleterious to algorithm performance.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Interpretationnone given
    § Abstract

    The high complexity of AI in medical imaging and its resulting lack of transparency with respect to stakeholder motives and data usage patterns, alongside facilitated data sharing enabled by electronic imaging data storage, threaten to diminish the importance of individual privacy and relax the grip on personal data.

    “Its high complexity and resulting lack of transparency with respect to stakeholder motives and data usage patterns, alongside the facilitated data sharing enabled by electronic imaging data storage, threaten to diminish the importance of individual privacy and relax the grip on personal data in the name of, at best, scientific development and, at worst, financial interests.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning
    § Anonymization, pseudonymization and the risks of re-identification

    De-identification presents issues if the patient withdraws consent, because it uncouples data governance from data ownership and impedes the right to be forgotten, or if legislation changes.

    “This presents issues in case the patient withdraws their consent, since it uncouples data governance from data ownership (impeding the right to be forgotten, GDPR article 17), or if the legislation changes.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: De-identification techniques are usually employed as a preparation to data transfer or sharing.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given
    § Decentralized data and federated machine learning

    The decentralized nature of the data in federated learning complicates data curation to ascertain the integrity and quality of the results.

    “The decentralized nature of the data complicates data curation to ascertain the integrity and quality of the results.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation
    § Anonymization, pseudonymization and the risks of re-identification

    Different points of view exist in different jurisdictions regarding de-identification, complicating the establishment of international standards.

    “Different points of view exist in different jurisdictions 38 , complicating the establishment of international standards.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [38] General Data Protection Regulation: NHS European Office Position Paper (NHS Confederation, 2012).

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation
    § Abstract

    Both HIPAA and GDPR mandate strict rules regarding the storage and exchange of personally identifiable data and data concerning health, requiring authentication, authorization, accountability and, with GDPR, AI interpretability.

    “Both the United States Health Insurance Portability and Accountability Act (HIPAA) 24 and the European General Data Protection Regulation (GDPR) 25 mandate strict rules regarding the storage and exchange of personally identifiable data and data concerning health, requiring authentication, authorization, accountability and-with GDPR-AI interpretability”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [24] HIPAA. US Department of Health and Human Services https://www.hhs.gov/hipaa/index.html (2020).

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [25] GDPR. Intersoft Consulting https://gdpr-info.eu (2016).

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given
    § Abstract

    To allow medical imaging AI applications to offer clinical decision support suitable for precision medicine, even larger amounts of imaging and clinical data will be required.

    “To allow medical imaging AI applications to offer clinical decision support suitable for precision medicine implementations, even larger amounts of imaging and clinical data will be required.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationreasoning
    § Abstract

    Digital imaging data, easily shareable, permanently storable and remotely accessible in the cloud, has driven the successes of medical imaging AI.

    “Digital imaging data, easily shareable, permanently storable and remotely accessible in the cloud has driven the aforementioned successes of medical imaging AI.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

    Interpretationreasoning
    § Differential privacy

    The specifics of implementing differential privacy in imaging data are unclear.

    “Most importantly, the specifics of implementing DP in imaging data are unclear.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisenone given
    § Differential privacy

    Differential privacy can be applied to the input data (local DP), the computation results (global DP) or the algorithm.

    “DP can be applied to the input data (local DP), the computation results (global DP) or the algorithm.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning
    § Anonymization, pseudonymization and the risks of re-identification

    Pseudonymization poses additional difficulties compared with anonymization because it requires data manipulation, not just data deletion, and safekeeping of the look-up tables for reversing the process.

    “Pseudonymization poses additional difficulties since it requires data manipulation, not just data deletion, and safekeeping of the look-up tables for reversing the process.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning
    § Decentralized data and federated machine learning

    A lack of encryption in federated learning can allow attackers to steal personally identifiable data directly from the nodes or interfere with the communication process.

    “A lack of encryption can allow attackers to steal personally identifiable data directly from the nodes or interfere with the communication process.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § Differential privacy

    Differential privacy offers resistance to re-identification attacks such as linkage or set differencing within a certain scope of interaction with the dataset (privacy budget).

    “DP thus offers resistance to re-identification attacks such as linkage or set differencing within a certain scope of interaction with the dataset (privacy budget 56 ).”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [56] Roth, A. & Dwork, C. The algorithmic foundations of differential privacy. Found. Trends Theoretical Comp. Sci. 9, 211–407 (2013). source

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationnone given
    § Anonymization, pseudonymization and the risks of re-identification

    Technical errors can render de-identification protection ineffective and potentially, for example in case of retaining institution names, an entire dataset identifiable.

    “Furthermore, technical errors can render the protection ineffective and potentially (for example, in case of retaining institution names), an entire dataset identifiable.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationcitation
    § Decentralized data and federated machine learning

    If local algorithms are not encrypted, or the updates are not securely aggregated, data can leak or algorithms can be tampered with, reconstructed or stolen through parameter inference.

    “In case the local algorithms are not encrypted, or the updates aren't securely aggregated, data can leak or algorithms can be tampered with 51 , reconstructed or stolen (parameter inference), which is unacceptable from the viewpoint of intellectual property, patent restrictions or asset protection.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [51] Tomsett, R., Chan, K. & Chakraborty, S. Model poisoning attacks against distributed machine learning systems. Proc. SPIE 11006, 110061D (2019). source

  • Classified as probably not a substantial claim.

    Interpretationnone given
    § Decentralized data and federated machine learning

    The main benefit of federated machine learning is the ability of the data to remain with its owner while still enabling the training of algorithms on the data.

    “Its main benefit is the ability of the data to remain with its owner (retention of sovereignty), while still enabling the training of algorithms on the data.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationcitation
    § Abstract

    Medical imaging datasets often stem from relatively few institutions, geographic regions or patient demographics, and might therefore contain unquantifiable bias due to incompleteness with respect to co-variables such as comorbidities, ethnicity and gender.

    “Furthermore, such datasets often stem from relatively few institutions, geographic regions or patient demographics, and might therefore contain unquantifiable bias due to their incompleteness with respect to co-variables such as comorbidities, ethnicity, gender and so on 19 .”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [19] Obermeyer, Z. & Mullainathan, S. Dissecting racial bias in an algorithm that guides health decisions for 70 million people. In Proc. Conf. Fairness, Accountability, and Transparency 89 (ACM, 2019). source

  • May combine two claims.

    Interpretationreasoning
    § Decentralized data and federated machine learning

    Federated learning offers an infrastructural approach to privacy and security, but further measures are required to expand its privacy-preserving scope.

    “Federated learning thus offers an infrastructural approach to privacy and security, but further measures, highlighted below, are required to expand its privacy-preserving scope.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationreasoning
    § Decentralized data and federated machine learning

    Federated learning is flexible and resolves data governance and ownership issues, but it does not itself guarantee security and privacy unless combined with other methods.

    “While federated learning is flexible and resolves data governance and ownership issues, it does not itself guarantee security and privacy unless combined with other methods described below.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given
    § Decentralized data and federated machine learning

    The communication requirement of federated learning can be burdensome for large machine learning models or data volumes.

    “This communication requirement can be burdensome for large machine learning models or data volumes.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given
    § Abstract

    Secure and privacy-preserving AI offers techniques to help bridge the gap between personal data protection and data utilization for research and clinical routine.

    “The field of secure and privacy-preserving AI offers techniques to help bridge the gap between personal data protection and data utilization for research and clinical routine.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation
    § Anonymization, pseudonymization and the risks of re-identification

    Large-scale re-identification attacks and the sale of re-identified medical records have become a business model for data-mining companies.

    “It has been reported that large-scale re-identification attacks and the sale of re-identified medical records have become a business model for data-mining companies 45 .”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [45] Tanner, A. Our Bodies, Our Data: How Companies Make Billions Selling Our Medical Records (Beacon, 2017).

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisereasoning
    § Secure multi-party computation

    In secure multi-party computation, the computation result can be announced without any party ever having seen the data itself, which can be recovered only by consensus.

    “The computation result can be announced without any party ever having seen the data itself, which can be recovered only by consensus.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationcitation
    § Outlook

    Monitoring and potentially correcting deployed models for temporal instability (statistical drift) can be difficult with encrypted data or algorithms.

    “Deployed models must be monitored and potentially corrected for temporal instability (that is, statistical drift 95 ), which can be difficult with encrypted data or algorithms.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [95] Nelson, K. et al. Evaluating model drift in machine learning algorithms. In 2015 IEEE Symp. Computational Intelligence for Security and Defense Applications https://doi.org/10.1109/CISDA.2015.7208643 (IEEE, 2015). source

  • May combine two claims.

    Interpretationreasoning
    § homomorphic encryption

    Because only certain mathematical operations, such as addition and multiplication, are homomorphic, applying homomorphic encryption to neural networks requires the operations defined within the algorithm to conform to these limitations, and thus standard encryption algorithms like AES cannot be used.

    “Since only certain mathematical operations, such as addition and multiplication, are homomorphic, the application of HE to neural networks requires the operations defined within the algorithm to conform to these limitations and thus standard encryption algorithms like the advanced encryption standard (AES) 68 cannot be used.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [68] Daemen, J. & Rijmen, V. The Design of Rijndael: AES - The Advanced Encryption Standard (Springer, 2013).

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisereasoning
    § Secure multi-party computation

    Research interest in secure multi-party computation has recently risen because it allows for secret sharing in semi-trusted and low-trust environments.

    “The research interest in SMPC has recently risen, since it allows for 'secret sharing' in semi-trusted and low-trust environments.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable). May combine two claims.

    Interpretationreasoning
    § Secure multi-party computation

    Secure multi-party computation can enable the ethically responsible provision of machine learning services while rendering the commercial use of the data itself impossible, or at least under the control of the individual and subject to legal regulation after appropriate ethical debate.

    “It can also enable the ethically responsible provision of machine learning services while rendering the commercial use of the data itself impossible, or at least under the control of the individual, and subject to legal regulation after appropriate ethical debate, similar to the debate about organ donation (single-use accountability).”
    Quote in the paperNot a substantial claim
48 of 48

  • The paper relies on this without support.

    The sum of the world's patient databases probably contains enough data to answer many significant questions.

    “considering that the sum of the world's patient databases probably contains enough data to answer many significant questions”

  • The paper relies on this without support.

    Large cross-sectional population studies based solely on volunteer participation, such as the UK Biobank, cannot fill the gap in data needed for medical imaging AI.

    “Large cross-sectional population studies based solely on volunteer participation, such as the UK Biobank 15 , cannot fill this gap.”

  • The paper relies on this without support.

    Anonymization and pseudonymization are currently the most widely used privacy preservation techniques for medical datasets.

    “Anonymization (the removal of private data from a record) and pseudonymization (replacement of sensitive entries with artificially generated ones while still allowing re-attribution using a look-up table)-collectively de-identification-are currently the most widely used privacy preservation techniques for medical datasets.”

  • The paper relies on this without support.

    De-identification techniques are usually employed as a preparation to data transfer or sharing.

    “Also, de-identification techniques are usually employed as a preparation to data transfer or sharing.”

  • The paper relies on this without support.

    Neural networks represent a form of memory mechanism, with compressed representations of the training data stored within their weights (unintended memorization).

    “Moreover, neural networks represent a form of memory mechanism, with compressed representations of the training data stored within their weights (unintended memorization).”

  • The paper relies on this without support.

    SMPC requires continuous data transfer between parties and continuous online availability of parties.

    “The notable limitations of SMPC are the requirements for continuous data transfer between parties (communication overhead) and for their continuous online availability.”

  • The paper relies on this without support.

    The broad application of AI techniques in medicine is currently hindered by limited dataset availability for algorithm training and validation, due to the absence of standardized electronic medical records, and strict legal and ethical requirements to protect patient privacy.

    “The broad application of artificial intelligence techniques in medicine is currently hindered by limited dataset availability for algorithm training and validation, due to the absence of standardized electronic medical records, and strict legal and ethical requirements to protect patient privacy.”

  • The paper relies on this without support.

    In medical imaging, harmonized data exchange formats such as DICOM and electronic data storage are the standard, partially addressing the first issue, but the requirements for privacy preservation are equally strict.

    “In medical imaging, harmonized data exchange formats such as Digital Imaging and Communication in Medicine and electronic data storage are the standard, partially addressing the first issue, but the requirements for privacy preservation are equally strict.”

  • The paper relies on this without support.

    Encryption provides a theoretical/mathematical privacy guarantee.

    “Encryption provides a theoretical/mathematical privacy guarantee.”

  • The paper relies on this without support.

    As long as data and algorithms are encrypted, they remain unusable unless permission is granted by both parties, yielding a shared governance model.

    “As long as the data and the algorithms are encrypted, they remain unusable unless permission is granted by both parties, yielding a shared governance model.”

  • The paper relies on this without support.

    In radiology, interpretability in the encrypted setting is limited to the evaluation of trained algorithms on new images or inspection of the plain-text input data; intermediate outputs might be obfuscated and hard to interpret.

    “In the field of radiology, for instance, interpretability in the encrypted setting is limited to the evaluation of trained algorithms on new images or inspection of the plain-text input data; however, intermediate outputs might be obfuscated and hard to interpret.”
11 of 11

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Due to privacy restrictions, sharing datasets across individual institutes is infeasible, which further limits the scale of training datasets.

    “Due to privacy restrictions, sharing datasets across individual institutes is infeasible, which further limits the scale of training datasets [25].”

    From Challenges in AI-driven Biomedical Multimodal Data Fusion and Analysis (2025) · cites this paper as [25]

    The Outlook (p. 305) says strict legal and ethical privacy requirements limit the availability of datasets for algorithm training. The Abstract (page not specified) calls patient-data regulation a strong deterrent to multi-institutional trials and describes strict rules for data exchange, but does not say that sharing between institutions is infeasible; that wording overstates the source. (LLM, conf=0.86)

    Experimental — accuracy not yet measured

  • Multiple technical solutions have been proposed and explored to ensure security and privacy while training multimodal AI models, including differential privacy, federated learning, homomorphic encryption and swarm learning.

    “Given the challenges, multiple technical solutions have been proposed and explored to ensure security and privacy while training multimodal AI models, including differential privacy, federated learning, homomorphic encryption and swarm learning 165,166”

    From Multimodal biomedical AI (2022) · cites this paper as [165]

    The sections “Decentralized data and federated machine learning,” “Differential privacy,” and “homomorphic encryption” describe these three approaches to privacy-preserving AI, including protection during training. The paper does not address swarm learning or specifically establish their use for multimodal AI models. It also cautions that federated learning alone does not guarantee security or privacy. (LLM, conf=0.89)

    Experimental — accuracy not yet measured

  • There exist inherent disadvantages in centralized solutions, including increased data traffic and concerns about data ownership, confidentiality, privacy, and security and creating data monopolies that favor data aggregators.

    “There exist inherent disadvantages in centralized solutions, including increased data traffic and concerns about data ownership, confidentiality, privacy, and security and creating data monopolies that favor data aggregators.135”

    From Artificial intelligence in diabetes management: Advancements, opportunities, and challenges (2023) · cites this paper as [135]

    The section ‘Decentralized data and federated machine learning’ says keeping data with its owner addresses governance and ownership concerns, while the discussion of patient-data protection addresses privacy and confidentiality. Our copy does not say centralized solutions create data monopolies favoring aggregators. It also describes burdensome communication as a limitation of decentralized learning, not as increased traffic caused by centralization; no page numbers are available in the indexed passages. (LLM, conf=0.87)

    Experimental — accuracy not yet measured

  • Conventional privacy-preserving transformations often reduce utility in ways that matter clinically, especially when correlations or temporal patterns drive prediction.

    “On the other hand, conventional privacy-preserving transformations often reduce utility in ways that matter clinically, especially when correlations or temporal patterns drive prediction (Zhang and Lin, 2018; Rieke et al., 2020; Kaissis et al., 2020).”

    From CITADEL: a post-quantum secure blockchain framework for privacy-preserving electronic health records with temporally-partitioned federated learning (2026) · cites this paper as Kaissis et al., 2020

    The Differential privacy section says data manipulation can degrade medical-imaging data and may harm algorithm performance; the Outlook also identifies privacy–utility trade-offs. Neither passage establishes that such transformations often reduce clinically relevant utility specifically when correlations or temporal patterns drive prediction. The Outlook’s reference to temporal instability concerns monitoring statistical drift in encrypted models, not loss of predictive temporal patterns. (LLM, conf=0.84)

    Experimental — accuracy not yet measured

  • Privacy protection is another significant challenge in deep learning of biomedical datasets, requiring development and deployment of privacy-preserving deep learning methods.

    “Privacy protection is another significant challenge in the deep learning of biomedical datasets [25], which requires the development and deployment of privacy-preserving deep learning methods.”

    From Challenges in AI-driven Biomedical Multimodal Data Fusion and Analysis (2025) · cites this paper as [25]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Feature re-derivation is assigned to different attack types

    Minor

    The main text equates feature or attribute re-derivation with re-identification, whereas the glossary lists it as a synonym for dataset reconstruction.

  • The HIPAA citation points to a GDPR reference

    Minor

    The text cites reference 24 for HIPAA, but bibliography entry 24 is titled "GDPR."

2 of 2

Cites

Flagged first, then by citations

Research works printed but not linked: 1

  1. Ghorbani, A. & Zou, J. Data Shapley: equitable valuation of data for machine learning. In Proc. 36th Int. Conf. Machine Learning (PMLR, 2019).

Cited by

Sorted by citations

Related

Authors
Kaissis, G. A., Makowski, M. R., Rückert, D., & Braren, R. F.
Affiliations
  • Imperial College London (GB)
  • Technical University of Munich (DE)
Corresponding author
Braren, Rickmer F.
ORCID
Venue
Nature Machine Intelligence
Publisher
Springer Science and Business Media LLC
Published
2020-06-08
Volume
2
Issue
6
Pages
305-311
ISSN
2522-5839 (ISSN-L)
DOI
10.1038/s42256-020-0186-1
OpenAlex
W3033511014
Cited by
1,501
References
94
Citations by year
2026: 337 · 2025: 356 · 2024: 247 · 2023: 202 · 2022: 190 · 2021: 132 · 2020: 18
FWCI
76.10
Type
journal article
Language
en
Open access
Licence
Locations
  • Nature Machine Intelligence (publishedVersion, other-oa)
  • mediaTUM (Technical University of Munich) (submittedVersion, other-oa)
  • mediaTUM – the media and publications repository of the Technical University Munich (Technical University Munich) (submittedVersion)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Health Sciences › Medicine › Health Informatics › Artificial Intelligence in Healthcare and Education
  • Health Sciences › Medicine › Radiology, Nuclear Medicine and Imaging › Radiomics and Machine Learning in Medical Imaging
Keywords
federated learning, privacy-preserving machine learning, secure machine learning, diagnostic imaging, patient privacy, data protection, attack vectors, health data sharing

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-11.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-11.

Cited sources are checked by gpt-6-sol.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review