Shadow defense against gradient inversion attack in federated learning | JoVE Visualize

Area of Science:

Artificial Intelligence
Machine Learning
Medical Imaging

Background:

Federated learning (FL) enables collaborative model training without sharing sensitive patient data, crucial for healthcare privacy.
Gradient inversion attacks (GIAs) pose a significant threat by reconstructing training data from model updates, compromising patient confidentiality.
Current defenses against GIAs often lack specificity, leading to either over-protection that degrades model accuracy or insufficient protection.

Purpose of the Study:

To develop a novel federated learning defense framework that enhances privacy against gradient inversion attacks.
To improve the specificity of privacy protection by identifying and targeting sensitive image regions.
To mitigate privacy leakage while minimizing the impact on model performance and accuracy.

Main Methods:

Implementation of a federated learning framework incorporating a shadow model with interpretability.
Development of a sample-specific noise injection strategy based on identified sensitive image areas.
Extensive experimentation on medical imaging datasets (ChestXRay, EyePACS) and diverse medical image types.

Main Results:

The proposed defense strategy demonstrated significant improvements in privacy protection, with discrepancies of 3.73 in PSNR and 0.2 in SSIM on ChestXRay, and 2.78 in PSNR and 0.166 in SSIM on EyePACS.
Adverse effects on model performance were minimized, showing less than 1% F1 reduction compared to state-of-the-art methods.
Consistent defense improvements were observed for Federated Averaging (FedAvg), exceeding 1.5% in LPIPS and SSIM across various GIA types.

Conclusions:

The developed framework offers a targeted and effective defense against gradient inversion attacks in federated learning for medical imaging.
The interpretability-driven approach successfully balances privacy preservation with model utility, outperforming existing methods.
The framework demonstrates generalization across different medical image types and provides robust protection against various GIA threats.