Secure, privacy-preserving and federated machine learning in medical imaging

In the paper

“Tabular data can be easily shuffled, but the perturbation of images can have unpredictable effects, with research demonstrating this type of manipulation (for example, adversarial noise) both as an attack against algorithms 65 and a regularization mechanism leading to increased robustness 66 and resilience against inversion attacks.”

What the sources say

• Partly supported

  Split into 2 atoms — 1 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

  cites [65] Goodfellow, I. J., Shlens, J. & Szegedy, C. Explaining and harnessing adversarial examples. Preprint at https://arxiv.org/abs/1412.6572 (2014). sourceExperimental — accuracy not yet measured
• ?Not checked — no full text of the sourcecites [66] You, Z., Ye, J., Li, K., Xu, Z. & Wang, P. Adversarial noise layer: regularize neural network by adding noise. In 2019 IEEE Int. Conf. Image Processing https://doi.org/10.1109/ICIP.2019.8803055 (IEEE, 2019). source

In the paper

“Thus, federated learning approaches have arguably become the most widely used next-generation privacy preservation technique, both in industry 49 and medical AI applications 50 .”

What the sources say

• Partly supported

  The Introduction (p. 1) describes federated learning as a way to train on mobile-app data while keeping it on users’ devices, supporting its relevance to privacy-conscious applications. It presents mobile apps as a motivating example, not evidence that federated learning is the most widely used privacy-preservation technique in industry. The medical-AI portion has a separate citation in the citing sentence. (LLM, conf=0.83)

  cites [49] Konečný, J. et al. Federated learning: strategies for improving communication efficiency. Preprint https://arxiv.org/abs/1610.05492 (2016). sourceExperimental — accuracy not yet measured
• Partly supported

  The Introduction (page not available in our copy) describes federated learning as a way to address data privacy and says it has gained traction in healthcare. The section “Data-Driven Medicine Requires Federated Efforts” gives examples of medical AI use. Neither passage establishes that it is the most widely used next-generation privacy-preservation technique; the separate industry citation is not assessed here. (LLM, conf=0.86)

  cites [50] Rieke, N. et al. The future of digital health with federated learning. Preprint at https://arxiv.org/abs/2003.08119 (2020). sourceExperimental — accuracy not yet measured

In the paper

“DP applications to imaging are being actively explored 62 .”

What the sources say

• Partly supported

  The Training phase section says differential privacy has generated extensive research and has been applied to deep learning. The Introduction describes the paper’s privacy experiments on images, but those experiments use a mutual-information approach; our copy does not establish that differential privacy applications to imaging are being explored. (LLM, conf=0.82)

  cites [62] Mireshghallah, F. et al. A principled approach to learning stochastic representations for privacy in deep neural inference. Preprint at https://arxiv.org/abs/2003.12154 (2020). sourceExperimental — accuracy not yet measured

In the paper

“Local DP ensures privacy at the source of the data, putting the data owner in control and is thus well suited to healthcare applications 61 , for instance for federated learning applications in which health data are being collected by smartphones or wearable devices.”

What the sources say

• Partly supported

  Split into 2 atoms — 1 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

  cites [61] Kim, J. W., Jang, B. & Yoo, H. Privacy-preserving aggregation of personal health data streams. PLoS ONE 13, e0207639 (2018). sourceExperimental — accuracy not yet measured

In the paper

“Ethical, moral and scientific guidelines (soft law 28 ) also prescribe respect towards privacy”

What the sources say

• Supported

  The Privacy section describes privacy as a value to uphold and a right to protect in AI ethics guidance. The Discussion identifies privacy as a principle promoted across the soft-law efforts the paper analyzes. No page numbers are available in our copy. (LLM, conf=0.92)

  cites [28] Jobin, A., Ienca, M. & Vayena, E. The global landscape of AI ethics guidelines. Nat. Mach. Intell. 1, 389–399 (2019). source

In the paper

“DP can also be applied to algorithm updates during training, for instance in neural networks via differentially private stochastic gradient descent 59 or private aggregation of teacher ensembles 60 , or during inference time.”

What the sources say

• ?Not checked — no full text of the sourcecites [59] Rajkumar, A. & Agarwal, S. A differentially private stochastic gradient descent algorithm for multiparty classification. In Proc. Fifteenth Int. Conf. Artificial Intelligence and Statistics 22, 933–941 (PMLR, 2012).
• Supported

  The citation to this paper is attached to “private aggregation of teacher ensembles,” not to the separate examples of private SGD or inference-time privacy. The Introduction (p. 1) identifies PATE by that name and explains how private aggregate answers from teacher models supervise a student model's training. (LLM, conf=0.94)

  cites [60] Papernot, N. et al. Scalable private learning with PATE. In Proc. 6th Int. Conf. Learning Representations (ICLR, 2018). source

In the paper

“Implementations range from simple random shuffling of the input data 57 to the introduction of noise to the dataset (Gaussian DP 58 with the benefit of better interpretability).”

What the sources say

• Partly supported

  The Introduction (p. 3) describes a differentially private model using a shuffler, supporting the shuffling part of the claim. But §3.2 (p. 9) says users first encode their data into messages and the shuffler randomly orders those messages—not the input data itself. The Gaussian DP and interpretability phrase is attached to a different citation, so it is not assessed here. (LLM, conf=0.88)

  cites [57] Cheu, A., Smith, A., Ullman, J., Zeber, D. & Zhilyaev, M. Distributed differential privacy via shuffling. In Annual Int. Conf. Theory and Applications of Cryptographic Techniques 375–403 (Springer, 2018). sourceExperimental — accuracy not yet measured
• ?Not checked — no full text of the sourcecites [58] Dong, J., Roth, A. & Su, W. J. Gaussian differential privacy. Preprint at https://arxiv.org/abs/1905.02383 (2019). source

In the paper

“Such model inversion or reconstruction attacks can cause catastrophic data leakage: it has been shown that images can be reconstructed with impressive accuracy and detail 55 , allowing visualization of the original training data.”

What the sources say

• Partly supported

  The Summary and Conclusion report extracting recognizable images of training subjects from facial-recognition models. Section 5.2.2 reports sharp, recognizable features for the best-performing model, but says other reconstructions were faint or blurry; the paper does not establish accurate, detailed recovery of the original training images themselves. (LLM, conf=0.86)

  cites [55] Fredrikson, M., Jha, S. & Ristenpart, T. Model inversion attacks that exploit confidence information and basic countermeasures. In Proc. 22nd ACM SIGSAC Conf. Computer and Communications Security 1322–1333 (ACM, 2015). sourceExperimental — accuracy not yet measured

In the paper

“The technique also poses challenges with respect to plausibility testing, explaining the process to patients-that is, data legibility (human-data interaction 63 )-regarding algorithm development and implementation, and escalates the requirement for statistical expertise to ascertain data representativeness 64 .”

What the sources say

• Supported

  Citation 63 is attached to “data legibility (human-data interaction),” not to the later claim about statistical expertise. Section 2.2 (p. 4) defines legibility as making data and analytics algorithms comprehensible to the people they concern; Section 3 (p. 5) likewise says data-processing practices must be understandable to those affected. (LLM, conf=0.93)

  cites [63] Mortier, R., Haddadi, H., Henderson, T., McAuley, D. & Crowcroft, J. Human-data interaction: the human face of the data-driven society. Preprint at https://arxiv.org/abs/1412.6159 (2014). source
• Partly supported

  Section 3.3 (p. 4) describes difficulties explaining differential privacy to data users and says its randomness is incompatible with rerunning a mechanism when a result seems unacceptable. Section 3.2 (p. 3) reports a shortage of expertise for developing and verifying implementations. The paper discusses Census data users, not patients, and does not link greater statistical expertise to assessing data representativeness. (LLM, conf=0.85)

  cites [64] Garfinkel, S. L., Abowd, J. M. & Powazek, S. Issues encountered deploying differential privacy. In Proc. 2018 Workshop on Privacy in the Electronic Society 133–137 (ACM, 2018). sourceExperimental — accuracy not yet measured

In the paper

“Electronic patient data management is expensive 20 , and hospitals in underprivileged regions might be unable to afford participation in studies requiring it, potentially perpetuating the aforementioned issues of bias and fairness.”

What the sources say

• Supported

  The citation is attached to the statement that electronic patient data management is expensive, not to the subsequent possibility about study participation and fairness. The Costs section (p. 2) details software, hardware, implementation, and ongoing support expenses for electronic medical records; the introduction (p. 1) also identifies implementation cost as a barrier to use. (LLM, conf=0.91)

  cites [20] Wang, S. J. et al. A cost-benefit analysis of electronic medical records in primary care. Am. J. Med. 114, 397–403 (2003). source

In the paper

“Moreover, there is substantial discourse regarding the definition of 'sufficient/reasonable' de-identification 37 related to the objective/technical difficulty of reversing the process.”

What the sources say

• ?Could not verify

  Part III.B discusses whether identifiable patient information is private or confidential, and Part IV.C discusses how reasonable expectations of privacy are assessed. Neither addresses what counts as sufficient de-identification or the technical difficulty of reversing it. Searches for de-identification, re-identification, anonymised data, and reversal found no passage on that point. (LLM, conf=0.75)

  cites [37] Taylor, M. J. & Wilson, J. Reasonable expectations of privacy and disclosure of health data. Med. Law Rev. 27, 432–460 (2019). sourceExperimental — accuracy not yet measured

In the paper

“This complicates data handling, increasing the probability of errors and constitutes a manipulation of the imaging data, which, at worst, represents an adversarial update to the algorithm 43 , reducing its performance and robustness.”

What the sources say

• Partly supported

  Split into 2 atoms — 0 confirmed, 2 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

  cites [43] Ma, X. et al. Understanding adversarial attacks on deep learning based medical image analysis systems. Pattern Recognit. https://doi.org/10.1016/j.patcog.2020.107332 (2020). sourceExperimental — accuracy not yet measured

In the paper

“Nevertheless, HE has successfully been applied to convolutional neural networks 70 , and its benefits demonstrated in a 'machine learning as a service' scenario 71 , whereby data is sent over the network to be processed on an off-site server (cloud computing).”

What the sources say

• Supported

  The citation to CryptoDL is attached to the claim that homomorphic encryption has been applied to convolutional neural networks. The Abstract (p. 1) says the authors implemented CNNs over encrypted data and measured their performance. The machine-learning-as-a-service claim has a separate citation and is not attributed to this paper here. (LLM, conf=0.94)

  cites [70] Hesamifard, E., Takabi, H. & Ghasemi, M. CryptoDL: deep neural networks over encrypted data. Preprint at https://arxiv.org/abs/1711.05189 (2017). source
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [71] Dowlin, N. et al. CryptoNets: applying neural networks to encrypted data with high throughput and accuracy. In Proc. 33rd Int. Conf. Machine Learning Vol. 48 201–210 (PMLR, 2016).

In the paper

“computational considerations are a concern beyond small algorithm sizes, with efficient SMPC implementations of state-of-the-art neural network algorithms currently under active development 78 .”

What the sources say

• Supported

  The Results section says prior secure-inference work was limited to small networks and reports CrypTFlow's efficient inference on much larger ImageNet-scale networks. The Comparison with prior work and Related Work sections likewise contrast tiny earlier benchmarks with large DNNs and describe ongoing efforts to compile DNNs to MPC protocols. (LLM, conf=0.91)

  cites [78] Kumar, N. et al. CrypTFlow: secure tensorflow inference. In Proc. 41st IEEE Symp. Security and Privacy (IEEE, 2020). source

In the paper

“many of which have recently become available 97,98 .”

What the sources say

• Partly supported

  The Introduction (pp. 1–2) describes a PyTorch-based framework implementing federated learning and privacy-preserving methods, supporting this paper as an example of such a tool. But the Conclusions (p. 4) say its code samples *will be made available* on GitHub; the paper does not establish that they were already available, or that many open-source tools had recently become available. (LLM, conf=0.82)

  cites [97] Ryffel, T. et al. A generic framework for privacy preserving deep learning. Preprint at https://arxiv.org/abs/1811.04017 (2018). sourceExperimental — accuracy not yet measured
• ?Not checked — no full text of the sourcecites [98] Dahl, M. et al. Private machine learning in TensorFlow using secure computation. Privacy Preserving Machine Learning, NeurIPS 2018 Workshop, Montréal, December 8, 2018. Available at: https://arxiv.org/abs/1810.08130 (2018). source

In the paper

“However, the issues of security and privacy are not limited to medical imaging 82”

What the sources say

• Supported

  The paper’s “Privacy Challenges” section discusses privacy risks in patient data and biometric healthcare systems, including face and fingerprint recognition and medical IoT devices. Its “Security Threats” section also describes attacks on healthcare biometric systems. These are healthcare applications beyond medical imaging. (LLM, conf=0.94)

  cites [82] Qayyum, A., Qadir, J., Bilal, M. & Al-Fuqaha, A. Secure and robust machine learning for healthcare: a survey. Preprint at https://arxiv.org/abs/2001.08103 (2020). source

In the paper

“Notably, SMPC has been used in the setting of genetic sequencing and diagnostics without revealing the patient's genome 75 .”

What the sources say

• Supported

  The Abstract describes using secure multiparty computation to identify causal variants in patients while keeping up to 99.7% of participants’ sensitive genomic information private. The “Secure multiparty computation” section explains that the protocol evaluates functions without revealing participants’ inputs. This supports the claim about genomic diagnostics without revealing a patient’s genome. (LLM, conf=0.91)

  cites [75] Jagadeesh, K. A., Wu, D. J., Birgmeier, J. A., Boneh, D. & Bejerano, G. Deriving genomic diagnoses without revealing patient genomes. Science 357, 692–695 (2017). source

In the paper

“with results in medical imaging 50,86 and genomics 87 recently demonstrated.”

What the sources say

• Supported

  The Data-Driven Medicine Requires Federated Efforts section describes decentralised medical-imaging research and reports results from federated mammogram models. In the citing sentence, this source supports the medical-imaging clause; the genomics clause has a separate citation (87). (LLM, conf=0.91)

  cites [50] Rieke, N. et al. The future of digital health with federated learning. Preprint at https://arxiv.org/abs/2003.08119 (2020). source
• Supported

  The citation to this paper is attached to the medical-imaging results, not the separately cited genomics results. The Results section (‘Federated vs. data-centralised training’) reports comparable brain-tumour segmentation performance without sharing clients’ data, supporting the attributed claim. (LLM, conf=0.93)

  cites [86] Li, W. et al. Privacy-preserving federated brain tumour segmentation. In Proc. 10th Int. Workshop on Machine Learning in Medical Imaging 133–141 (Springer, 2019). source
• ?Not checked — no full text of the sourcecites [87] Grishin, D., Obbad, K. & Church, G. M. Data privacy in the age of personal genomics. Nat. Biotechnol. 37, 1115–1117 (2019). source

In the paper

“Several implementations of HE algorithms 69 with varying levels of efficiency exist, and the application of HE represents an efficiencysecurity trade-off, with computational performance currently the most notable issue.”

What the sources say

• Supported

  Split into 2 atoms — 2 confirmed, 0 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

  cites [69] Acar, A., Aksu, H., Selcuk Uluagac, A. & Conti, M. A survey on homomorphic encryption schemes: theory and implementation. ACM Comput. Surv. 51, 79 (2018). source

In the paper

“Due to the rising significance of hardware-level deep learning implementations (for example, tensor processing units 80 or machine-learning-specific instruction sets 81 ), it is likely that such system-based privacy guarantees (trusted execution environments) built into edge hardware such as mobile phones will become more prevalent.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [80] Cloud TPU. Google https://cloud.google.com/tpu/ (2020).
• Supported

  Citation 81 is attached to “machine-learning-specific instruction sets” as an example of hardware-level deep learning implementation. The paper’s Introduction describes its proposed Cambricon instruction set architecture for neural-network accelerators, so it supports that identification. The sentence’s prediction about trusted execution environments is not attributed to this citation. (LLM, conf=0.92)

  cites [81] Chen, A. Y. et al. An instruction set architecture for machine learning. ACM Trans. Comput. Syst. 36, 9 (2019). source

In the paper

“Current research about interpretable private algorithms 93 can alleviate this issue.”

What the sources say

• Partly supported

  The Introduction (p. 2) proposes models designed to be both interpretable and privately trained, supporting the general point that private algorithms can address interpretability. But the paper studies differential privacy in classification, not interpretability in an encrypted setting; that application is not established by the cited work. (LLM, conf=0.84)

  cites [93] Harder, F., Bauer, M. & Park, M. Interpretable and differentially private predictions. In Proc. Thirty-Fourth AAAI Conf. Artificial Intelligence (AAAI, 2020). sourceExperimental — accuracy not yet measured

In the paper

“Data manipulation can degrade the data, which in an area with access to relatively little data, such as medical imaging research, may prove deleterious to algorithm performance.”

In the paper

“Its high complexity and resulting lack of transparency with respect to stakeholder motives and data usage patterns, alongside the facilitated data sharing enabled by electronic imaging data storage, threaten to diminish the importance of individual privacy and relax the grip on personal data in the name of, at best, scientific development and, at worst, financial interests.”

In the paper

“This presents issues in case the patient withdraws their consent, since it uncouples data governance from data ownership (impeding the right to be forgotten, GDPR article 17), or if the legislation changes.”

In the paper

“The decentralized nature of the data complicates data curation to ascertain the integrity and quality of the results.”

In the paper

“Different points of view exist in different jurisdictions 38 , complicating the establishment of international standards.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [38] General Data Protection Regulation: NHS European Office Position Paper (NHS Confederation, 2012).

In the paper

“Both the United States Health Insurance Portability and Accountability Act (HIPAA) 24 and the European General Data Protection Regulation (GDPR) 25 mandate strict rules regarding the storage and exchange of personally identifiable data and data concerning health, requiring authentication, authorization, accountability and-with GDPR-AI interpretability”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [24] HIPAA. US Department of Health and Human Services https://www.hhs.gov/hipaa/index.html (2020).
• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [25] GDPR. Intersoft Consulting https://gdpr-info.eu (2016).

In the paper

“To allow medical imaging AI applications to offer clinical decision support suitable for precision medicine implementations, even larger amounts of imaging and clinical data will be required.”

In the paper

“Digital imaging data, easily shareable, permanently storable and remotely accessible in the cloud has driven the aforementioned successes of medical imaging AI.”

In the paper

“Most importantly, the specifics of implementing DP in imaging data are unclear.”

In the paper

“DP can be applied to the input data (local DP), the computation results (global DP) or the algorithm.”

In the paper

“Pseudonymization poses additional difficulties since it requires data manipulation, not just data deletion, and safekeeping of the look-up tables for reversing the process.”

In the paper

“A lack of encryption can allow attackers to steal personally identifiable data directly from the nodes or interfere with the communication process.”

In the paper

“DP thus offers resistance to re-identification attacks such as linkage or set differencing within a certain scope of interaction with the dataset (privacy budget 56 ).”

What the sources say

• ?Not checked — no full text of the sourcecites [56] Roth, A. & Dwork, C. The algorithmic foundations of differential privacy. Found. Trends Theoretical Comp. Sci. 9, 211–407 (2013). source

In the paper

“Furthermore, technical errors can render the protection ineffective and potentially (for example, in case of retaining institution names), an entire dataset identifiable.”

In the paper

“In case the local algorithms are not encrypted, or the updates aren't securely aggregated, data can leak or algorithms can be tampered with 51 , reconstructed or stolen (parameter inference), which is unacceptable from the viewpoint of intellectual property, patent restrictions or asset protection.”

What the sources say

• ?Not checked — no full text of the sourcecites [51] Tomsett, R., Chan, K. & Chakraborty, S. Model poisoning attacks against distributed machine learning systems. Proc. SPIE 11006, 110061D (2019). source

In the paper

“Its main benefit is the ability of the data to remain with its owner (retention of sovereignty), while still enabling the training of algorithms on the data.”

In the paper

“Furthermore, such datasets often stem from relatively few institutions, geographic regions or patient demographics, and might therefore contain unquantifiable bias due to their incompleteness with respect to co-variables such as comorbidities, ethnicity, gender and so on 19 .”

What the sources say

• ?Not checked — no full text of the sourcecites [19] Obermeyer, Z. & Mullainathan, S. Dissecting racial bias in an algorithm that guides health decisions for 70 million people. In Proc. Conf. Fairness, Accountability, and Transparency 89 (ACM, 2019). source

In the paper

“Federated learning thus offers an infrastructural approach to privacy and security, but further measures, highlighted below, are required to expand its privacy-preserving scope.”

In the paper

“While federated learning is flexible and resolves data governance and ownership issues, it does not itself guarantee security and privacy unless combined with other methods described below.”

In the paper

“This communication requirement can be burdensome for large machine learning models or data volumes.”

In the paper

“The field of secure and privacy-preserving AI offers techniques to help bridge the gap between personal data protection and data utilization for research and clinical routine.”

In the paper

“It has been reported that large-scale re-identification attacks and the sale of re-identified medical records have become a business model for data-mining companies 45 .”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [45] Tanner, A. Our Bodies, Our Data: How Companies Make Billions Selling Our Medical Records (Beacon, 2017).

In the paper

“The computation result can be announced without any party ever having seen the data itself, which can be recovered only by consensus.”

In the paper

“Deployed models must be monitored and potentially corrected for temporal instability (that is, statistical drift 95 ), which can be difficult with encrypted data or algorithms.”

What the sources say

• ?Not checked — no full text of the sourcecites [95] Nelson, K. et al. Evaluating model drift in machine learning algorithms. In 2015 IEEE Symp. Computational Intelligence for Security and Defense Applications https://doi.org/10.1109/CISDA.2015.7208643 (IEEE, 2015). source

In the paper

“Since only certain mathematical operations, such as addition and multiplication, are homomorphic, the application of HE to neural networks requires the operations defined within the algorithm to conform to these limitations and thus standard encryption algorithms like the advanced encryption standard (AES) 68 cannot be used.”

What the sources say

• ?Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  cites [68] Daemen, J. & Rijmen, V. The Design of Rijndael: AES - The Advanced Encryption Standard (Springer, 2013).

In the paper

“The research interest in SMPC has recently risen, since it allows for 'secret sharing' in semi-trusted and low-trust environments.”

In the paper

“It can also enable the ethically responsible provision of machine learning services while rendering the commercial use of the data itself impossible, or at least under the control of the individual, and subject to legal regulation after appropriate ethical debate, similar to the debate about organ donation (single-use accountability).”