# P3SGD: Patient Privacy Preserving SGD for Regularizing Deep CNNs in Pathological Image Classification

arXiv: https://arxiv.org/abs/1905.12883 · HTML: https://mlsanity.com/paper/1905.12883/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 30 May 2019.

## Built on by (most cited first, 14 of 14)

- [A Study of Face Obfuscation in ImageNet](https://mlsanity.com/paper/2103.06191/) (2021)
- [Do Gradient Inversion Attacks Make Federated Learning Unsafe?](https://mlsanity.com/paper/2202.06924/) (2022)
- [DPNAS: Neural Architecture Search for Deep Learning with Differential Privacy](https://mlsanity.com/paper/2110.08557/) (2021)
- [From Challenges and Pitfalls to Recommendations and Opportunities: Implementing Federated Learning in Healthcare](https://mlsanity.com/paper/2409.09727/) (2024)
- [Recent Advances of Differential Privacy in Centralized Deep Learning: A Systematic Survey](https://mlsanity.com/paper/2309.16398/) (2023)
- [Analysis of Privacy Leakage in Federated Large Language Models](https://mlsanity.com/paper/2403.04784/) (2024)
- [Differential privacy for medical deep learning: methods, tradeoffs, and deployment implications](https://mlsanity.com/paper/2506.00660/) (2025)
- [Generalization Bounds for Stochastic Gradient Langevin Dynamics: A Unified View via Information Leakage Analysis](https://mlsanity.com/paper/2112.08439/) (2021)
- [DPSNN: A Differentially Private Spiking Neural Network with Temporal Enhanced Pooling](https://mlsanity.com/paper/2205.12718/) (2022)
- [A Lightweight Privacy-Preserving Scheme Using Label-based Pixel Block Mixing for Image Classification in Deep Learning](https://mlsanity.com/paper/2105.08876/) (2021)
- [Contextualize differential privacy in image database: a lightweight image differential privacy approach based on principle component analysis inverse](https://mlsanity.com/paper/2202.08309/) (2022)
- [Differential Privacy May Have a Potential Optimization Effect on Some Swarm Intelligence Algorithms besides Privacy-preserving](https://mlsanity.com/paper/2306.17370/) (2023)
- [Deep Learning with Data Privacy via Residual Perturbation](https://mlsanity.com/paper/2408.05723/) (2024)
- [Privacy in Image Datasets: A Case Study on Pregnancy Ultrasounds](https://mlsanity.com/paper/2602.07149/) (2026)

## Abstract (arXiv)

Recently, deep convolutional neural networks (CNNs) have achieved great success in pathological image classification. However, due to the limited number of labeled pathological images, there are still two challenges to be addressed: (1) overfitting: the performance of a CNN model is undermined by the overfitting due to its huge amounts of parameters and the insufficiency of labeled training data. (2) privacy leakage: the model trained using a conventional method may involuntarily reveal the private information of the patients in the training dataset. The smaller the dataset, the worse the privacy leakage. To tackle the above two challenges, we introduce a novel stochastic gradient descent (SGD) scheme, named patient privacy preserving SGD (P3SGD), which performs the model update of the SGD in the patient level via a large-step update built upon each patient's data. Specifically, to protect privacy and regularize the CNN model, we propose to inject the well-designed noise into the updates. Moreover, we equip our P3SGD with an elaborated strategy to adaptively control the scale of the injected noise. To validate the effectiveness of P3SGD, we perform extensive experiments on a real-world clinical dataset and quantitatively demonstrate the superior ability of P3SGD in reducing the risk of overfitting. We also provide a rigorous analysis of the privacy cost under differential privacy. Additionally, we find that the models trained with P3SGD are resistant to the model-inversion attack compared with those trained using non-private SGD.