Privacy, Please: Safeguarding Medical Data in Imaging AI Using Differential Privacy Techniques

See also the article by Tayebi Arasteh et al in this issue.

Abhinav Suri, MPH, is a medical student at the David Geffen School of Medicine at the University of California Los Angeles and a Medical Research Scholars Program fellow at the National Institutes of Health. His research focuses on the intersection between artificial intelligence and radiology for opportunistic screening of diseases. He is a member of the trainee editorial board of Radiology: Artificial Intelligence and has authored a book titled Practical AI for Healthcare Professionals.

Ronald M. Summers, MD, PhD, is a tenured senior investigator and staff radiologist in the Radiology and Imaging Sciences Department at the National Institutes of Health Clinical Center in Bethesda, Maryland. His research interests include thoracic and abdominal imaging, large radiology image databases, and artificial intelligence. He is a member of the editorial boards of the Journal of Medical Imaging, Radiology: Artificial Intelligence, and Academic Radiology and a past member of the editorial board of Radiology.

Throughout the current artificial intelligence (AI) spring in radiology research, one maxim has remained consistent: Data are key. AI algorithms, whether they’re classifying radiographs, segmenting lesions, or predicting medical events, typically require extensive datasets for effective training (1). This is particularly true for models designed to maintain accuracy despite variations in scanner types, patient demographics, and imaging practices—a challenge known as domain shift (2). To mitigate these issues, it’s common to use diverse, multi-institutional datasets in training these algorithms.

However, a critical question arises: Are these data being handled with the necessary rigor in terms of privacy? In health care, where training images can contain sensitive patient information, this concern is paramount. When using images from multiple institutions, it’s essential to remove all identifiers, both in Digital Imaging and Communications in Medicine (DICOM) headers and those embedded within the image data. Advances have been made in privacy-preserving techniques, such as algorithms that remove patient identifiers from the pixel data of DICOM images (3). Yet, these images may still inadvertently reveal identifying details through unique anatomic features or medical devices.

To address these privacy concerns, some approaches focus on training and evaluating models without sharing the underlying image data between institutions. Instead, only the model itself is transmitted. However, this method isn’t foolproof, as the learned model parameters and weights potentially can be used to reconstruct the training images with high fidelity (4). Popular approaches to distributing training models across multiple sites, such as federated learning, are susceptible to this attack because model weights are shared across the individual sites (5). However, there is a solution in the realm of security research termed differential privacy (DP).

DP is a mathematical framework designed to formalize and implement privacy. DP aims to provide information about groups without compromising individual data points (6). To illustrate what DP actually means in practice, let’s consider the example of a program that provides information about the average age of a group of patients in a ward. Before a patient “Bob” is admitted, the average age of the nine patients in the ward is 50.0 years. After Bob is admitted, the average age of the ward is 51.0 years. We can use some simple math to figure out that Bob is 60 years old ([51 · 10] − [50 · 9] = 60), only by knowing the average ages before and after Bob is admitted, as well as the initial number of patients in the ward. We can say that this algorithm is not differentially private because we will know the exact details of the new patient in the ward. To make the algorithm differentially private, we can implement a simple strategy: Before calculating the average, add a small (but random) number to everyone’s age. This strategy will add some degree of inaccuracy and randomness to our average calculation, but we won’t be able to calculate Bob’s exact age when added to the dataset by using a single query, although we may be able to get a rough distribution of ages if doing multiple queries.

The same notion of DP extends to the realm of deep learning and AI. If we know of the results of a model (eg, a model that predicts cancer from imaging data) evaluated on a patient “X” before and after X is added to the training set of the model, we can determine the cancer status of X. To illustrate this example further: Consider a model M to predict cancer that has not been trained on patient X. When given patient X to evaluate, it predicts a probability of cancer of 0.51. Patient X is then added to the training set to make model M′. Model M′ now outputs a probability of cancer of 0.81 on patient X. We can say, with a relative degree of certainty, that patient X had cancer because the jump in probability of model M versus M′ when evaluated on patient X was so high. To prevent the release of information about patient X, we can inject randomness into our model, but at the cost of reducing accuracy.

DP techniques recently have begun to be applied to the world of medical imaging analysis. In 2013, Song et al (7) outlined how to integrate DP into stochastic gradient descent, the primary method by which early image classifiers were trained. They did so by integrating a small degree of randomness into the process by which an AI model updates its parameters while learning on training data. This technique was then implemented in TensorFlow and (later) PyTorch, the most popular libraries to aid the development of AI programs. Several results using DP in AI were published in the realm of computer science, but relatively few made their way into medical imaging analysis. In 2021, Ziller et al (8) reported creating AI that used DP to detect pneumonia and segment organs in CT images. As predicted, they showed that there was a significant decrease in model performance with the addition of DP in training compared with the non–DP-trained AI models; for example, area under the receiver operating characteristic curve (AUC) decreased to 0.848 from 0.960 upon addition of a DP training strategy. It is evident that these performance degradations can yield changes in diagnostic accuracy. DP techniques can exacerbate biases in data and yield worse accuracy for underrepresented populations and outcomes, increasing unfairness in AI (9).

In this issue of Radiology: Artificial Intelligence, Tayebi Arasteh and colleagues (10) approach the integration of DP in a different manner. Instead of comparing DP performance versus baseline model performance on single-institutional data, they aim to see how the baseline and DP models compare when evaluated on out-of-distribution data, that is, data from another institution. To achieve this goal, they used 590 000 chest radiographs from five separate institutions to train (on one institution) and evaluate (on the remaining four institutions) the performance of a baseline model (ResNet9) versus the baseline with DP training at the task of classifying cardiomegaly, pleural effusion, pneumonia, atelectasis, and healthy samples on chest radiographs.

The authors found that performance was similar for both baseline and DP models when evaluated on data outside the institution used to train the model (all P ≥ .12, AUC degradation ranging from 0.07 to 0.18 on average). They further showed that the performance of the baseline model versus the DP model does not change based on condition, sex, or age group (0 to <40, 40 to <70, and 70–100 years old). The authors propose the key explanation that training with a DP strategy introduces an element of randomness into the training process, thus mitigating overfitting and promoting generalizability to other datasets.

The authors replicated their results on two more network architectures (ResNet18 and EfficientNet B0) and provided computational resource analysis that showed the DP variants of the baseline models took up to 10 times longer to train. In terms of future directions for research, the authors propose working toward the application of DP to three-dimensional imaging classification and segmentation tasks, as well as changing the domain application to histologic slide analysis.

The integration of DP in medical AI presents a promising yet challenging frontier. The findings from Tayebi Arasteh and colleagues provide valuable insights into the application of DP in a multi-institutional context, highlighting its potential to maintain model efficacy (when evaluated across institutions) while safeguarding patient privacy. As AI continues to evolve in the realm of health care, balancing the dual imperatives of privacy and performance will remain a key area of focus, necessitating ongoing research and innovative solutions.