Defending against Reconstruction Attacks through Differentially Private Federated Learning for Classification of...

Area of Science:

• Medical Imaging
• Artificial Intelligence
• Data Privacy

Background:

• Federated learning (FL) and deep learning (DL) face challenges with data privacy and distribution in medical contexts.
• Existing FL privacy studies often lack direct comparison of DL architectures in heterogeneous settings.

Purpose of the Study:

• To evaluate the feasibility of differentially private federated learning for chest X-ray classification.
• To compare the impact of differential privacy on DenseNet121 and ResNet50 architectures.
• To assess vulnerability to data privacy attacks and mitigation strategies.

Main Methods:

• Simulated a heterogeneous, imbalanced federated setting with 36 clients using CheXpert and Mendeley datasets.
• Applied Rényi differential privacy with Gaussian noise to local model training.
• Evaluated model performance (AUC) and attack vulnerability for privacy budgets ε∈{1,3,6,10}.

Main Results:

• Non-private models achieved an AUC of 0.94 for binary classification.
• Image reconstruction attacks successfully breached privacy on local model updates, especially late in training.
• DenseNet121 achieved the best utility-privacy trade-off (AUC 0.94 at ε=6), outperforming ResNet50 (AUC 0.76 at ε=6).

Conclusions:

• Federated learning with differential privacy is feasible for chest X-ray classification.
• DenseNet121 demonstrates superior robustness and a better utility-privacy trade-off compared to ResNet50 in private FL settings.
• Model performance slightly decreased for individual clients but maintained high utility with appropriate privacy budgets.