论文标题
通过差异私人联邦学习来防御重建攻击，以分类异质胸部X射线数据
Defending against Reconstruction Attacks through Differentially Private Federated Learning for Classification of Heterogeneous Chest X-Ray Data
论文作者
论文摘要
隐私法规和异质数据的身体分布通常是医学环境中深度学习模型发展的主要问题。本文评估了针对数据隐私攻击的防御，评估了针对胸部X射线分类的差异私人联合学习的可行性。据我们所知，我们是第一个直接比较差异私有培训对两个不同神经网络架构Densenet121和Resnet50的影响的人。扩展了以前对隐私分析的联合学习环境，我们通过在36个客户中不统计的公共Chexpert和Mendeley Chest X射线数据集分发图像，模拟了一个异质和不平衡的联邦设置。两种非私人基线模型都在接收器操作特征曲线（AUC）下达到了二进制分类任务的$ 0.94 $，以检测医疗发现的存在。我们证明，通过将图像重建攻击应用于来自单个客户的本地模型更新，这两个模型架构都容易受到隐私侵犯的影响。在以后的训练阶段，攻击特别成功。为了减轻隐私漏洞的风险，我们将Rényi差异隐私与高斯噪声机制集成到本地模型培训中。我们评估了模型性能和攻击漏洞的隐私预算$ε\ in $ {1、3、6、10}。 Densenet121实现了最佳的公用事业私人权衡权衡取舍，AUC为$ 0.94 $，$ε$ = 6。与非私人基线相比，单个客户的模型性能略有恶化。在相同的隐私设置中，RESNET50仅达到$ 0.76 $的AUC。对于所有考虑的隐私限制，其性能不如Densenet121的性能，这表明Densenet121体系结构对差异化私有培训更为强大。
Privacy regulations and the physical distribution of heterogeneous data are often primary concerns for the development of deep learning models in a medical context. This paper evaluates the feasibility of differentially private federated learning for chest X-ray classification as a defense against data privacy attacks. To the best of our knowledge, we are the first to directly compare the impact of differentially private training on two different neural network architectures, DenseNet121 and ResNet50. Extending the federated learning environments previously analyzed in terms of privacy, we simulated a heterogeneous and imbalanced federated setting by distributing images from the public CheXpert and Mendeley chest X-ray datasets unevenly among 36 clients. Both non-private baseline models achieved an area under the receiver operating characteristic curve (AUC) of $0.94$ on the binary classification task of detecting the presence of a medical finding. We demonstrate that both model architectures are vulnerable to privacy violation by applying image reconstruction attacks to local model updates from individual clients. The attack was particularly successful during later training stages. To mitigate the risk of privacy breach, we integrated Rényi differential privacy with a Gaussian noise mechanism into local model training. We evaluate model performance and attack vulnerability for privacy budgets $ε\in$ {1, 3, 6, 10}. The DenseNet121 achieved the best utility-privacy trade-off with an AUC of $0.94$ for $ε$ = 6. Model performance deteriorated slightly for individual clients compared to the non-private baseline. The ResNet50 only reached an AUC of $0.76$ in the same privacy setting. Its performance was inferior to that of the DenseNet121 for all considered privacy constraints, suggesting that the DenseNet121 architecture is more robust to differentially private training.
