Secure and robust machine learning for healthcare: A survey
Open accessAbstract
Recent years have witnessed widespread adoption of machine learning (ML)/deep learning (DL) techniques due to their superior performance for a variety of healthcare applications ranging from the prediction of cardiac arrest from one-dimensional heart signals to computer-aided diagnosis (CADx) using multi-dimensional medical images. Notwithstanding the impressive performance of ML/DL, there are still lingering doubts regarding the robustness of ML/DL in healthcare settings (which is traditionally considered quite challenging due to the myriad security and privacy issues involved), especially in light of recent results that have shown that ML/DL are vulnerable to adversarial attacks. In this paper, we present an overview of various application areas in healthcare that leverage such techniques from security and privacy point of view and present associated challenges. In addition, we present potential methods to ensure secure and privacy-preserving ML for healthcare applications. Finally, we provide insight into the current research challenges and promising directions for future research.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
A study published in 2020 explored various notions of robustness in healthcare but did not examine how these concepts varied based on the type of data and predictive model used.
“A study published in 2020 explored various notions of robustness in healthcare but did not examine how these concepts varied based on the type of data and predictive model used46.”
From A scoping review of robustness concepts for machine learning in healthcare (2025) · cites this paper as [46]
Both the 2020 and 2023 studies did not rely on a formalised review methodology.
“Moreover, both studies did not rely on a formalised review methodology.”
From A scoping review of robustness concepts for machine learning in healthcare (2025) · cites this paper as [46]
The Introduction describes this paper as a survey and outlines its contributions and organization, but it does not say whether the authors used a formalized review methodology. I searched our copy for a review protocol, literature-selection criteria, and systematic-review methods; the cited paper also cannot establish the methodology of the separate 2023 study. (LLM, conf=0.72)
Experimental — accuracy not yet measuredContinuous monitoring systems detect when models encounter data outside their training distribution or when performance begins to degrade.
“Continuous monitoring systems detect when models encounter data outside their training distribution or when performance begins to degrade [147,148,149,150,151].”
From Artificial Intelligence in Clinical Oncology: From Productivity Enhancement to Creative Discovery (2025) · cites this paper as [150]
ML systems are not safe, secure, and robust.
“The literature suggests that ML systems are not safe, secure, and robust.”
From Explainable, trustworthy, and ethical machine learning for healthcare: A survey (2022) · cites this paper as [32]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
The citation lists haven’t been fetched yet
References 215 · Cited by 59
Research works printed but not linked: 17
- C. Szegedy et al., "Intriguing properties of neural networks," 2013, arXiv:1312.6199. · arXiv
- A. Shafahi et al., "Poison frogs! Targeted clean-label poisoning attacks on neural networks," in Proc. Adv. Neural Inf. Process. Syst., 2018, pp. 6103-6113.
- A. K. Manrai, G. Bhatia, J. Strymish, I. S. Kohane, and S. H. Jain, "Medicine's uncomfortable relationship with math: Calculating positive predictive value," JAMA Internal Med., vol. 174, no. 6, pp. 991-993, 2014.
- F. Xia and M. Yetisgen-Yildiz, "Clinical corpus annotation: Challenges and strategies," in Proc. 3rd Workshop Building Evaluating Resour. Biomed. Text Mining Conjunction Int. Conf. Lang. Resour. Eval., Istanbul, Turkey, 2012.
- S. T. M. Ataky, J. de Matos, A. d. S. Britto Jr, L. E. Oliveira, and A. L. Koerich, "Data augmentation for histopathological images based on Gaussian-Laplacian pyramid blending," in Proc. IEEE Int. Joint Conf. Neural Netw., Glasgow, U.K., 2020.
- N. Carlini and D. Wagner, "Magnet and 'efficient defenses against adversarial attacks' are not robust to adversarial examples," 2017, arXiv:1711.08478. · arXiv
- S.-K. Kim, C. Y. Yeun, E. Damiani, and N.-W. Lo, "A machine learning framework for biometric authentication using electrocardiogram," IEEE Access, vol. 7, pp. 94 858-94 868, 2019.
- J. Zhang and E. Bareinboim, "Fairness in decision-making-The causal explanation formula," in Proc. 32nd AAAI Conf. Artif. Intell., 2018.
- H. Takabi, E. Hesamifard, and M. Ghasemi, "Privacy preserving multi- party machine learning with homomorphic encryption," in 29th Annu. Conf. Neural Inf. Process. Syst., 2016.
- O. Choudhury et al., "Differential privacy-enabled federated learning for sensitive health data," Workshop Paper at Mach. Learn. Health (ML4H) Workshop at Neural Information Processing Systems (NeurIPS), 2019.
- N. O'Reilly, "Challenges to AI in healthcare," Accessed: Oct. 16, 2019. [Online]. Available: https://crcaustralia.com/media-releases/page/2/
- R. Kunkel, D. L. Quoc, F. Gregor, S. Arnautov, P. Bhatotia, and C. Fetzer, "Tensorscone: A secure tensorflow framework using intel SGX," 2019, arXiv:1902.04413. · arXiv
- G. Tao, S. Ma, Y. Liu, and X. Zhang, "Attacks meet interpretability: Attribute-steered detection of adversarial samples," in Proc. Adv. Neural Inf. Process. Syst., 2018, pp. 7717-7728.
- Y. Song, T. Kim, S. Nowozin, S. Ermon, and N. Kushman, "Pix- eldefend: Leveraging generative models to understand and defend against adversarial examples," in Proc. Int. Conf. Learn. Representat., 2018.
- P. Samangouei, M. Kabkab, and R. Chellappa, "Defense-GAN: Protect- ing classifiers against adversarial attacks using generative models," in Proc. Int. Conf. Learn. Representat., 2018.
- L. Schott, J. Rauber, M. Bethge, and W. Brendel, "Towards the first adversarially robust neural network model on MNIST," in Proc. 7th Int. Conf. Learn. Representat., 2019, pp. 1-17.
- Junaid Qadir is the Director of the IHSAN- ICTD, Human Development, Systems, Big Data Analytics, Networks-Research Lab and the Chairperson of the Electrical Engineer- ing Department, Information Technology Uni- versity (ITU) of Punjab, Lahore, Pakistan. His primary research interests are in the areas of computer systems and networking, applied machine learning, using ICT for development (ICT4D), and engineering education. He has published more than 100 peer-reviewed articles in high-quality research venues with more than 50 impact-factor jour- nal publications in top international research journals, including IEEE Communication Magazine, IEEE JOURNAL ON SELECTED AREAS IN COM- MUNICATION (JSAC), IEEE COMMUNICATIONS SURVEYS AND TUTORIALS (CST), and IEEE TRANSACTIONS ON MOBILE COMPUTING (TMC). He was awarded the highest national teaching award in Pakistan-the Higher Education Commission's (HEC) Best University Teacher Award-for the year 2012-2013. He has been appointed as ACM Distinguished Speaker for a three-year term starting from 2020. He is a Senior Member of ACM.
- Authors
- Qayyum, A., Qadir, J., Bilal, M., & Al-Fuqaha, A.
- Affiliations
- Information Technology University (PK)
- University of the West of England (GB)
- Venue
- IEEE Reviews in Biomedical Engineering
- Published
- 2021
- Volume
- 14
- Pages
- 156-180
- ISSN
- 1937-3333 (ISSN-L)
- 1941-1189
- OpenAlex
- W3001584199
- Cited by
- 59
- References
- 215
- Citations by year
- 2026: 1 · 2025: 5 · 2024: 13 · 2023: 14 · 2022: 11 · 2021: 9 · 2020: 6
- FWCI
- 0.34
- Type
- journal article
- Language
- en
- Open access
- hybrid
- doi.org
- Locations
- IEEE Reviews in Biomedical Engineering (publishedVersion, cc-by)
- PubMed (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- Figshare (submittedVersion, cc-by)
- arXiv (Cornell University)
- Funders
- Qatar National Library
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Health Sciences › Medicine › Health Informatics › Artificial Intelligence in Healthcare and Education
- Keywords
- secure machine learning, privacy-preserving machine learning, adversarial attacks, medical applications, computer-aided diagnosis, medical image analysis, cardiac arrest prediction, medical data privacy
- MeSH terms
- Machine Learning, Confidentiality, Diagnosis, Computer-Assisted, Humans, Electronic Health Records
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
