CoChat
Sign Up
PreprintCited by 464Privacy-Preserving Technologies in DataAI in cancer detectionArtificial Intelligence in Healthcare and Education

Federated Learning and Differential Privacy for Medical Image Analysis

Open access
Adnan, Mohammed, Kalra, Shivam, Cresswell, Jesse C., Taylor, Graham W., Tizhoosh, Hamid·2021·Scientific Reports
DOI 10.21203/rs.3.rs-1005694/v1PMC PMC8816913

Preprint — published as 10.1038/s41598-022-05539-7 · Paper page

Open this paper in CoChat — free accountOpen PDF

Abstract

The artificial intelligence revolution has been spurred forward by the availability of large-scale datasets. In contrast, the paucity of large-scale medical datasets hinders the application of machine learning in healthcare. The lack of publicly available multi-centric and diverse datasets mainly stems from confidentiality and privacy concerns around sharing medical data. To demonstrate a feasible path forward in medical image imaging, we conduct a case study of applying a differentially private federated learning framework for analysis of histopathology images, the largest and perhaps most complex medical images. We study the effects of IID and non-IID distributions along with the number of healthcare providers, i.e., hospitals and clinics, and the individual dataset sizes, using The Cancer Genome Atlas (TCGA) dataset, a public repository, to simulate a distributed environment. We empirically compare the performance of private, distributed training to conventional training and demonstrate that distributed training can achieve similar performance with strong privacy guarantees. We also study the effect of different source domains for histopathology images by evaluating the performance using external validation. Our work indicates that differentially private federated learning is a viable and reliable framework for the collaborative development of machine learning models in medical image analysis.

AI snapshot

Written from the paper’s full text.

TL;DR

The paper studies differentially private federated learning (DP-FL) for histopathology image analysis, using FedAvg, DP-SGD, and a multiple-instance learning model on TCGA lung cancer whole-slide images. It reports that FL outperforms non-collaborative training and approaches centralized performance, while achieving a privacy bound of ε = 2.90 at δ = 0.0001 in a simulated real-world hospital setting.

Key findings

  • In simulated IID and non-IID experiments, FedAvg outperformed non-collaborative local training across 16 settings. For example, with IID data and n = 4 clients, FL achieved 0.824 ± 0.02 accuracy versus 0.731 ± 0.03 without FL and 0.848 ± 0.02 centralized; with non-IID data and n = 8, FL achieved 0.823 ± 0.05 versus 0.561 ± 0.08 without FL.
  • Performance degraded as the number of clients increased: IID n = 32 gave FL accuracy 0.641 ± 0.09, and non-IID n = 32 gave 0.550 ± 0.20, compared with centralized 0.848 ± 0.02.
  • In the real-world hospital simulation, DP-FL achieved ε = 2.90 at δ = 0.0001, with test accuracy 0.823 ± 0.01 and external accuracy 0.707 ± 0.01. Non-collaborative training ranged from 0.648–0.709 on test and 0.556–0.701 on external data; combined centralized training reached 0.839 ± 0.01 test and 0.768 ± 0.003 external.
  • DP hyperparameter ablation showed, for example, gradient clipping 1.0 with noise multiplier 6.0 gave ε = 2.34, test accuracy 0.832, and external accuracy 0.737; clipping 1.0 with noise multiplier 2.0 gave ε = 10.01, test accuracy 0.782, and external accuracy 0.748.

Methods

  • The proposed local pipeline transforms whole-slide images into mosaics via patch selection (removing non-tissue regions, clustering tissue patches, and randomly selecting about 10% within each cluster), extracts features with a pre-trained DenseNet, and classifies bags using a MEM attention-based multiple-instance learning model. Local models are trained with DP-SGD and centrally aggregated with FedAvg.
  • Data were 2580 H&E-stained TCGA lung cancer WSIs (~2 TB), split into 1806 training and 774 testing WSIs for LUAD vs LUSC classification. Experiment 1 simulated clients with IID and non-IID distributions while varying n = 4, 8, 16, and 32. Experiment 2 used seven TCGA hospitals: four as FL clients (267, 211, 207, and 199 images) and three as external validation sources (223, 110, and 52 images), with each client’s data split 80:20 for training and internal testing.
  • Analyses compared FL, non-collaborative, and centralized training. Experiment 1 used SGD with learning rate 0.01, local epoch 1, and 250 communication rounds. Experiment 2 used DP-SGD with epochs = 180, training set size = 705, batch size = 32, gradient clipping norm = 1.0, Gaussian noise standard deviation = 4.0, 32 microbatches, and learning rate 2 × 10−5; privacy was computed with a Rényi DP accountant.

Limitations

  • The paper does not include a dedicated limitations section. Evident from the text: Experiment 1 uses simulated/fabricated clients from TCGA rather than real hospitals, and Experiment 2 uses only four client hospitals and three external hospitals from TCGA, limited to LUAD vs LUSC lung cancer classification.
  • External validation accuracy decreased due to distribution shifts for both FL and centralized training, and the MEM model was sensitive to DP-SGD hyperparameters.
  • The reported privacy guarantee is specific to the chosen DP-SGD configuration and setting (ε = 2.90 at δ = 0.0001); the text does not establish how it generalizes to other datasets, tasks, or hospital distributions.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.21203/rs.3.rs-1005694/v1

Cites

34 of 34 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 26 cited sources checked · 0 supported · 0 flagged

  • Findingown data

    Using federated learning with additional privacy preservation techniques can improve the performance of histopathology image analysis compared to training without collaboration.

    “We also show that using federated learning with additional privacy preservation techniques can improve the performance of histopathology image analysis compared to training without collaboration and quantitatively measure the privacy using Rényi Differential Privacy Accountant 4 .”
    • Also stated in: another passage · hedged
      “Furthermore, we provide a privacy analysis of the method through the differential privacy framework, suggesting that FL can outperform non-collaborative training while maintaining a strong privacy guarantee.”
    Quote in the paperSubstantial claim
  • Findingown data

    Private, distributed training can achieve similar performance to conventional training with strong privacy guarantees.

    “We empirically compare the performance of private, distributed training to conventional training and demonstrate that distributed training can achieve similar performance with strong privacy guarantees.”
    Quote in the paperSubstantial claim
  • Findingown data

    Differentially private federated learning (DP-FL) training achieves a privacy guarantee of ε = 2.90 at δ = 0.0001.

    “FL training achieves strong privacy bounds (ε = 2.90 at δ = 0.0001)”
    • Also stated in: another passage · plain
      “achieving privacy parameter ε = 2.90 for δ = 0.0001.”
    Quote in the paperSubstantial claim
  • Findingown data

    DP-FL training achieves comparable performance to centralized training.

    “comparable to centralized training”
    • Also stated in: another passage · plain
      “FedAvg achieves comparable performance to centralized training without explicitly sharing private data with strong privacy guarantees.”
    • Also stated in: another passage · plain
      “Private federated learning achieves a comparable result compared to conventional centralized training”
    Quote in the paperSubstantial claim
  • Findingown data

    As the total dataset is divided into smaller partitions for more clients, both client and server model performances deteriorate.

    “As the total dataset is divided into smaller partitions for more clients, both client and server model performances deteriorate.”
    Quote in the paperNot a substantial claim
  • May combine two claims. 8
  • The quote only partly states this claim. 1
  • Classified as probably not a substantial claim. 19

  • May combine two claims.

    Findingown data

    FL achieves superior performance for both IID and non-IID distributions of data compared to non-collaborative training.

    “FL achieves superior performance for both IID and non-IID distributions of data compared to non-collaborative training.”
    • Also stated in: another passage · plain
      “In each of the experiments, the server model trained using FedAvg outperformed the models trained using local client datasets, showing the advantage of collaboration.”
    Quote in the paperSubstantial claim

  • The quote only partly states this claim.

    Findingown data

    DP-FL training achieves better performance than non-collaborative training.

    “with better performance than non-collaborative training”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim.

    Premisecitation

    DP-SGD can be used in the context of training a machine learning model by clipping the norm of gradients to bound them, then adding noise.

    “This method can be used in the context of training a machine learning model by clipping the norm of gradients to bound them, then adding noise, a process called differentially private stochastic gradient descent (DP-SGD) 22 .”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [22] Abadi, M. et al. Deep learning with differential privacy. in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (2016). 10.1145/2976749.2978318. source

      Not checked in the free run.

  • May combine two claims.

    Premisecitation

    Updated model parameters sent from clients to a centralized server can contain private information, such that even individual data points can be reconstructed.

    “Updated model parameters are still sent from the clients to a centralized server, and these can contain private information 16 , such that even individual data points can be reconstructed 17 .”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [16] Bhowmick, A., Duchi, J., Freudiger, J., Kapoor, G. & Rogers, R. Protection against reconstruction and its applications in private federated learning. arXiv preprint arXiv:1812.00984 (2018).

      Not checked in the free run.

    • cites [17] Melis, L., Song, C., De Cristofaro, E. & Shmatikov, V. Exploiting unintended feature leakage in collaborative learning. in 2019 IEEE Symposium on Security and Privacy (SP), 691–706 (IEEE, 2019). source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    The simplest way to create a DP-mechanism is by adding Gaussian noise to the outcomes of a deterministic function with bounded sensitivity.

    “The simplest way to create a DP-mechanism is by adding Gaussian noise to the outcomes of a deterministic function with bounded sensitivity 21 .”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [21] Dwork, C., Kenthapadi, K., McSherry, F., Mironov, I. & Naor, M. Our data, ourselves: privacy via distributed noise generation. in Advances in Cryptology (EUROCRYPT 2006), vol. 4004 of Lecture Notes in Computer Science, 486–503 (Springer Verlag, 2006). https://www.microsoft.com/en-us/research/publication/our-data-ourselves-privacy-via-distributed-noise-generation/. Accessed 11 Nov 2021. source

      Not checked in the free run.

  • Classified as probably not a substantial claim.

    Premisecitation

    In histopathology, Lu et al. reported DP guarantees for a neural network classifier trained with federated learning, following Li et al.

    “In histopathology, Lu et al. 13 reported DP guarantees for a neural network classifier trained with FL, following Li et al. 26 .”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [13] Lu, M. Y. et al. Federated learning for computational pathology on gigapixel whole slide images. arXiv preprint arXiv:2009.10190 (2020). PMC9340569 34911013

      Not checked in the free run.

    • cites [26] Li X Multi-site fMRI analysis using privacy-preserving federated learning and domain adaptation: ABIDE results Med. Image Anal. 2020 65 101765 10.1016/j.media.2020.101765 32679533 PMC7569477 source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    McMahan et al. applied DP-SGD at scale to federated learning.

    “McMahan et al. 23 applied this at scale to FL.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [23] McMahan, H. B., Ramage, D., Talwar, K. & Zhang, L. Learning differentially private recurrent language models. in International Conference on Learning Representations (2018).

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    Permutation invariant operators for MIL were introduced by Tomczak et al. and successfully applied to digital pathology images.

    “Permutation invariant operators for MIL were introduced by Tomczak et al. 28 and successfully applied to digital pathology images.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [28] Tomczak, J. M., Ilse, M. & Welling, M. Deep learning with permutation-invariant operator for multi-instance histopathology classification. in Workshop on Bayesian Deep Learning at 31st Conference on Neural Information Processing Systems (2017). http://arxiv.org/abs/1712.00310.

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S2 (checkable).

    Interpretationreasoning

    It is important to study the effect of non-IID data on the performance of federated learning, specifically FedAvg.

    “Since real-world data is not necessarily IID, it is important to study the effect of non-IID data on the performance of FL, specifically FedAvg.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Real-world data is not necessarily IID.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Study design and conductown data

    The study evaluates performance using external validation to study the effect of different source domains for histopathology images.

    “We also study the effect of different source domains for histopathology images by evaluating the performance using external validation.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Study design and conductown data

    The study used available attributes in TCGA to divide the dataset across tissue origin site (hospital) and created four client datasets.

    “We used the available attributes in TCGA to divide the dataset across the tissue origin site (hospital) and created four client datasets as shown in Table 2.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    Isle et al. used MIL for digital pathology and introduced a different variety of MIL pooling functions.

    “Isle et al. 29 used MIL for digital pathology and introduced a different variety of MIL pooling functions, while Sudarshan et al. 30 used MIL for histopathological breast cancer image classification.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [29] Ilse, M., Tomczak, J. & Welling, M. Attention-based deep multiple instance learning. in International conference on machine learning, 2127–2136 (PMLR, 2018).

      Not checked in the free run.

  • May combine two claims.

    Interpretationown data

    FL can be effectively used in clinical settings to ensure data privacy with no significant degradation in performance.

    “This demonstrates that FL could be effectively used in clinical settings to ensure data privacy with no significant degradation in performance.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Centralized training on the combined training datasets gives an upper bound on what could be achieved in the absence of privacy regulations.

  • Classified as probably not a substantial claim.

    Premisenone given

    Federated learning allows training models without explicitly sharing patient data.

    “Federated learning allows training models without explicitly sharing patient data”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim.

    Premisenone given

    Differential privacy supplements federated learning with quantitative bounds on the amount of privacy provided.

    “Differential privacy supplements this with quantitative bounds on the amount of privacy provided.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning

    Multiple instance learning is a natural candidate for learning to classify whole-slide images which must be broken into smaller representations due to size limitations.

    “MIL is thus a natural candidate for learning to classify WSIs which must be broken into smaller representations due to size limitations.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Sudarshan et al. used MIL for histopathological breast cancer image classification.

    “Isle et al. 29 used MIL for digital pathology and introduced a different variety of MIL pooling functions, while Sudarshan et al. 30 used MIL for histopathological breast cancer image classification.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [30] Sudharshan P Multiple instance learning for histopathological breast cancer image classification Expert Syst. Appl. 2019 117 103 111 10.1016/j.eswa.2018.09.049 source

      Not checked in the free run.

  • Classified as probably not a substantial claim.

    Study design and conductnone given

    The MEM model was locally trained through DP-SGD to provide quantitative privacy bounds.

    “The MEM model is locally trained through DP-SGD to provide quantitative privacy bounds, and the local MEM models are centrally aggregated through FedAvg.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationown data

    Federated learning can be used for medical image analysis in a real-world setting without explicitly sharing data, while achieving similar performance to centralized training with data sharing.

    “Therefore, we experimentally demonstrate the Federated Learning can be used for medical image analysis in real-world setting without explicitly sharing data, while achieving similar performance to centralized training with data sharing.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Centralized training on the combined training datasets gives an upper bound on what could be achieved in the absence of privacy regulations.

  • Probably not a substantial claim: may not pass S2 (checkable).

    Premisecitation

    An automated classification of LUAD and LUSC is a crucial step to assist pathologists for more informed diagnoses.

    “An automated classification of these two main sub-types of NSCLC is a crucial step to assist pathologists for more informed diagnoses 37,38 .”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [37] Zappa C Mousa SA Non-small cell lung cancer: Current treatment and future advances Transl. Lung Cancer Res. 2016 5 288 10.21037/tlcr.2016.06.07 27413711 PMC4931124 source

      Not checked in the free run.

    • cites [38] Graham, S., Muhammad, S., Talha, Q., Navid Alemi K., Syed Ali K., & Nasir, R. Classification of lung cancer histology images using patch-level summary statistics. in Medical Imaging: Digital Pathology, vol. 10581, 1058119 (International Society for Optics and Photonics, 2018).

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    Lung adenocarcinoma and lung squamous cell carcinoma are two main subtypes of non-small cell lung cancer that account for 65-70% of all lung cancers.

    “Lung Adenocarcinoma (LUAD) and Lung Squamous Cell Carcinoma (LUSC) are two main sub-types of non-small cell lung cancer (NSCLC) that account for 65-70% of all lung cancers 37 .”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [37] Zappa C Mousa SA Non-small cell lung cancer: Current treatment and future advances Transl. Lung Cancer Res. 2016 5 288 10.21037/tlcr.2016.06.07 27413711 PMC4931124 source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Tu et al. showed that graph neural networks can be used for MIL, where each instance acts as a node in a graph.

    “Tu et al. 31 showed that GNNs can be used for MIL, where each instance acts as a node in a graph.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [31] Tu, M., Huang, J., He, X. & Zhou, B. Multiple instance learning with graph neural networks. in ICML 2019 Workshop on Learning and Reasoning with Graph-Structured Representations (2019). http://arxiv.org/abs/1906.04881.

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    Adnan et al. demonstrated an application of graph convolution neural networks to MIL in digital pathology and achieved state of the art accuracy on a lung sub cancer classification task.

    “Adnan et al. 32 demonstrated an application of graph convolution neural networks to MIL in digital pathology and achieved state of the art accuracy on a lung sub cancer classification task.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [32] Adnan, M., Kalra, S. & Tizhoosh, H. R. Representation learning of histopathology images using graph neural networks. in 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), 4254–4261 (2020). source

      Not checked in the free run.

  • Classified as probably not a substantial claim.

    Study design and conductown data

    The study uses lung cancer images from The Cancer Genome Atlas to construct a simulated environment of several institutions to validate the approach.

    “Finally, we use lung cancer images from The Cancer Genome Atlas (TCGA) dataset 5 to construct a simulated environment of several institutions to validate our approach.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [5] Weinstein JN The cancer genome atlas pan-cancer analysis project Nat. Genet. 2013 45 1113 1120 10.1038/ng.2764 24071849 PMC3919969 source

      Not checked in the free run.

24 of 24

  • The paper relies on this without support.

    The lack of publicly available multi-centric and diverse medical datasets mainly stems from confidentiality and privacy concerns around sharing medical data.

    “The lack of publicly available multi-centric and diverse datasets mainly stems from confidentiality and privacy concerns around sharing medical data.”

  • The paper relies on this without support.

    Medical images may contain confidential and sensitive information about patients that often cannot be shared outside the institutions of their origin, especially when complete de-identification cannot be guaranteed.

    “Medical images may contain confidential and sensitive information about patients that often cannot be shared outside the institutions of their origin, especially when complete de-identification cannot be guaranteed.”

  • The paper relies on this without support.

    Deep learning models are data-intensive, often requiring millions of training examples to learn effectively.

    “However, deep learning models are data-intensive, i.e., they often require millions of training examples to learn effectively.”

  • The paper relies on this without support.

    The European General Data Protection Regulation and the United States Health Insurance Portability and Accountability Act enforce guidelines and regulations for storing and exchanging personally identifiable data and health data.

    “The European General Data Protection Regulation (GDPR) and the United States Health Insurance Portability and Accountability Act (HIPAA) enforce guidelines and regulations for storing and exchanging personally identifiable data and health data.”

  • The paper relies on this without support.

    Most hospitals have diverse imaging methods and devices, so images from a group of hospitals will be markedly different, and machine learning methods risk overfitting to non-semantic differences between them.

    “Since most hospitals have diverse imaging methods and devices, images from a group of hospitals will be markedly different, and machine learning methods risk overfitting to non-semantic differences between them.”

  • The paper relies on this without support.

    Models trained using federated learning can suffer from serious performance drops when applied to images from previously unseen hospitals.

    “Models trained using FL can suffer from serious performance drops when applied to images from previously unseen hospitals.”

  • The paper relies on this without support.

    FedAvg is most commonly used because of its scalability to large datasets and comparable performance to other federated learning algorithms.

    “FedAvg is most commonly used because of its scalability to large datasets and comparable performance to other FL algorithms.”

  • The paper relies on this without support.

    Neural network weights do not have bounded sensitivity.

    “Their treatment involved adding Gaussian noise to trained model weights, however, neural networks weights do not have bounded sensitivity making their DP guarantee vacuous.”

  • The paper relies on this without support.

    Real-world data is not necessarily IID.

    “Since real-world data is not necessarily IID, it is important to study the effect of non-IID data on the performance of FL, specifically FedAvg.”

  • The paper relies on this without support.

    There is a vast reserve of knowledge in mass archives of clinical data held by hospitals which remains mostly untapped due to many confidentiality and privacy concerns.

    “There is a vast reserve of knowledge in mass archives of clinical data held by hospitals which remains mostly untapped due to many confidentiality and privacy concerns.”

  • The paper relies on this without support.

    Histopathology images can differ greatly depending on the staining and imaging protocols of the source hospital.

    “Histopathology images can differ greatly, among others depending on the staining and imaging protocols of the source hospital.”

  • The paper relies on this without support.

    Centralized training on the combined training datasets gives an upper bound on what could be achieved in the absence of privacy regulations.

    “For comparison, we train a single model on the combined (centralized) training datasets which gives an upper bound on what could be achieved in the absence of privacy regulations.”
12 of 12

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Differentially private training algorithms mitigate information leakage from both collaborator model updates and global consensus aggregated models.

    “Differentially private training algorithms62–64 allow for mitigation of information leakage from both the collaborator model updates and the global consensus aggregated models.”

    From Federated learning enables big data for rare cancer boundary detection (2022) · cites this paper as [64]

  • Differential privacy used with federated learning in a distributed environment to train multiple instance learning models to classify medical images achieved comparable performance to conventional centralized training.

    “Similarly, DP is used to provide privacy guarantees when FL is used in a distributed environment to train multiple instance learning models to classify medical images [32]. The results showed that the distributed federated training with privacy guarantees achieved comparable performance to the conventional centralized training approach.”

    From A Review of Privacy Enhancement Methods for Federated Learning in Healthcare Systems (2023) · cites this paper as [32]

  • Adnan et al.'s model achieved acceptable performance while decentralized data configuration was applied.

    “They demonstrated that their model achieved acceptable performance while decentralized data configuration applied.”

    From A systematic review on federated learning in medical image analysis (2023) · cites this paper as [28]

  • Adnan et al. [28] proposed a FL-oriented lung cancer detection model.

    “A FL oriented lung cancer detection model has been proposed by Adnan et al. [28].”

    From A systematic review on federated learning in medical image analysis (2023) · cites this paper as [28]

  • Adnan et al. [28] used lung tissue images to classify cancer in a privacy-guaranteed ML model.

    “Adnan et al. [28] used tissue image data, more specifically they proposed a privacy guaranteed ML model where lung tissue images were considered to classify cancer.”

    From A systematic review on federated learning in medical image analysis (2023) · cites this paper as [28]

Cites

Flagged first, then by citations

Research works printed but not linked: 8

  1. [6]McMahan, B., Moore, E., Ramage, D., Hampson, S. & y Arcas, B. A. (eds.) Communication-efficient learning of deep networks from decentralized data. in Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, PMLR 54:1273–1282, 2017.
  2. [7]Li, X., Huang, K., Yang, W., Wang, S. & Zhang, Z. On the Convergence of FedAvg on Non-IID Data. in International Conference on Learning Representations (2020). https://openreview.net/forum?id=HJxNAnVtDS. Accessed 11 Nov 2021.
  3. [8]Yurochkin, M., Mayank, A., Soumya, G., Kristjan, G., Nghia, H., & Yasaman, K. Bayesian nonparametric federated learning of neural networks. in International Conference on Machine Learning, 7252–7261. (PMLR, 2019).
  4. [10]Pillutla, K., Kakade, S. M. & Harchaoui, Z. Robust Aggregation for Federated Learning. arXiv:1912.13445 [cs, stat] (2019). http://arxiv.org/abs/1912.13445. ArXiv: 1912.13445. · arXiv
  5. [23]McMahan, H. B., Ramage, D., Talwar, K. & Zhang, L. Learning differentially private recurrent language models. in International Conference on Learning Representations (2018).
  6. [29]Ilse, M., Tomczak, J. & Welling, M. Attention-based deep multiple instance learning. in International conference on machine learning, 2127–2136 (PMLR, 2018).
  7. [38]Graham, S., Muhammad, S., Talha, Q., Navid Alemi K., Syed Ali K., & Nasir, R. Classification of lung cancer histology images using patch-level summary statistics. in Medical Imaging: Digital Pathology, vol. 10581, 1058119 (International Society for Optics and Photonics, 2018).
  8. [40]Subramani, P., Vadivelu, N. & Kamath, G. Enabling fast differentially private sgd via just-in-time compilation and vectorization. Diagn. Pathol. (2020, under review).

Cited by

Sorted by citations

Related

Authors
Adnan, M., Kalra, S., Cresswell, J. C., Taylor, G. W., & Tizhoosh, H.
Affiliations
  • University of Waterloo (CA)
  • MaRS (CA)
  • Mayo Clinic (US)
Corresponding author
Tizhoosh, Hamid
ORCID
Venue
Scientific Reports
Publisher
Springer Science and Business Media LLC
Published
2021-11-09
Volume
12
Issue
1
Pages
1953-1953
ISSN
2045-2322 (ISSN-L)
DOI
10.21203/rs.3.rs-1005694/v1
PMC
PMC8816913
OpenAlex
W4226082367
Cited by
464
References
34
Citations by year
2026: 95 · 2025: 147 · 2024: 111 · 2023: 88 · 2022: 23
FWCI
30.36
Type
journal article
Language
en
Open access
Licence
Locations
  • Scientific Reports (publishedVersion, cc-by)
  • Research Square (acceptedVersion, cc-by)
  • PubMed Central (publishedVersion, cc-by)
  • PubMed (publishedVersion)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
Funders
  • Compute Canada
  • Government of Ontario
  • Natural Sciences and Engineering Research Council of Canada
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Physical Sciences › Computer Science › Artificial Intelligence › AI in cancer detection
  • Health Sciences › Medicine › Health Informatics › Artificial Intelligence in Healthcare and Education
Keywords
federated learning, differential privacy, medical image analysis, histopathological images, privacy-preserving machine learning, non-IID data, TCGA, external validation, distributed training

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-05.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-05.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review