Obfuscation Algorithm for Privacy-Preserving Deep Learning-Based Medical Image Analysis

Abstract

Deep learning (DL)-based algorithms have demonstrated remarkable results in potentially improving the performance and the efficiency of healthcare applications. Since the data typically needs to leave the healthcare facility for performing model training and inference, e.g., in a cloud based solution, privacy concerns have been raised. As a result, the demand for privacy-preserving techniques that enable DL model training and inference on secured data has significantly grown. We propose an image obfuscation algorithm that combines a variational autoencoder (VAE) with random non-bijective pixel intensity mapping to protect the content of medical images, which are subsequently employed in the development of DL-based solutions. A binary classifier is trained on secured coronary angiographic frames to evaluate the utility of obfuscated images in the context of model training. Two possible attack configurations are considered to assess the security level against artificial intelligence (AI)-based reconstruction attempts. Similarity metrics are employed to quantify the security against human perception (structural similarity index measure and peak signal-to-noise-ratio). Furthermore, expert readers performed a visual assessment to determine to what extent the reconstructed images are protected against human perception. The proposed algorithm successfully enables DL model training on obfuscated images with no significant computational overhead while ensuring protection against human eye perception and AI-based reconstruction attacks. Regardless of the threat actor’s prior knowledge of the target content, the coronary vessels cannot be entirely recovered through an AI-based attack. Although a drop in accuracy can be observed when the classifier is trained on obfuscated images, the performance is deemed satisfactory in the context of a privacy–accuracy trade-off.

Privacy-Preserving Medical Image Classification through Deep Learning and Matrix Decomposition

“…A particularity of the architecture is the use of local normalization layers [16] to increase the robustness of the model to image alteration. More details regarding the dataset, the architecture and the training process are described in [15].…”

“…A U-net [17] architecture is employed for reconstruction. The model and the datasets are described in detail in [15].…”

“…The study proved that non-bijectivity increased security without significantly impacting classification performance. Then, we combined the encoding of a variational autoencoder with the non-bijective shuffling to increase both the accuracy and the privacy [15].…”

Privacy-Preserving and Explainable AI in Industrial Applications

“…During inference, the same encryption or obfuscation method would be employed to ensure that the AI model is not fed with out-of-distribution data. A possible technical solution was recently published for a healthcare application [44], which could be similarly applied in the industrial domain for the casting application. Therein, an image obfuscation algorithm was proposed that combines a variational autoencoder with random non-bijective pixel intensity mapping to protect the content of medical images, which are subsequently employed in the development of DL-based solutions.…”

Privacy Preserving Image Encryption with Optimal Deep Transfer Learning Based Accident Severity Classification Model

“…The privacy protection of images frequently depends on methods such as privacy encryption, k-anonymity, and access control. Several perceptual encrypted techniques were modelled to generate images without visual data according to the visual data-protection system, but data theory-related encryption (AES and RSA) creates ciphertext [ 5 ]. Perceptual encryption intended at generating images without visual data on plain images based on a visual data-protection system as visual data involves private data such as personally identifiable information, time, and place [ 6 ].…”