Defending Medical Image Diagnostics against Privacy Attacks using Generative Methods
arXiv:2103.03078
Abstract
Machine learning (ML) models used in medical imaging diagnostics can be vulnerable to a variety of privacy attacks, including membership inference attacks, that lead to violations of regulations governing the use of medical data and threaten to compromise their effective deployment in the clinic. In contrast to most recent work in privacy-aware ML that has been focused on model alteration and post-processing steps, we propose here a novel and complementary scheme that enhances the security of medical data by controlling the data sharing process. We develop and evaluate a privacy defense protocol based on using a generative adversarial network (GAN) that allows a medical data sourcer (e.g. a hospital) to provide an external agent (a modeler) a proxy dataset synthesized from the original images, so that the resulting diagnostic systems made available to model consumers is rendered resilient to privacy attackers. We validate the proposed method on retinal diagnostics AI used for diabetic retinopathy that bears the risk of possibly leaking private information. To incorporate concerns of both privacy advocates and modelers, we introduce a metric to evaluate privacy and utility performance in combination, and demonstrate, using these novel and classical metrics, that our approach, by itself or in conjunction with other defenses, provides state of the art (SOTA) performance for defending against privacy attacks.
arXiv commentAccepted for oral presentation at MICCAI PPML 2021
References in corpus (7)
- Deep Learning with Differential Privacy
- GANs Trained by a Two Time-Scale Update Rule Converge to a Local Nash Equilibrium
- Training Generative Adversarial Networks with Limited Data
- Extracting Training Data from Large Language Models
- Differential Privacy Has Disparate Impact on Model Accuracy
- Is Private Learning Possible with Instance Encoding?
- Privacy-preserving medical image analysis