mlsanityData to 7 Oct 2026

Reconciling AI Performance and Data Reconstruction Resilience for Medical Imaging

arXiv 2312.04590 ↗First posted 5 Dec 2023cs.CR cs.AI cs.CVcited by 1

Not on the map. Why?

Abstract (arXiv)

Artificial Intelligence (AI) models are vulnerable to information leakage of their training data, which can be highly sensitive, for example in medical imaging. Privacy Enhancing Technologies (PETs), such as Differential Privacy (DP), aim to circumvent these susceptibilities. DP is the strongest possible protection for training models while bounding the risks of inferring the inclusion of training samples or reconstructing the original data. DP achieves this by setting a quantifiable privacy budget. Although a lower budget decreases the risk of information leakage, it typically also reduces the performance of such models. This imposes a trade-off between robust performance and stringent privacy. Additionally, the interpretation of a privacy budget remains abstract and challenging to contextualize. In this study, we contrast the performance of AI models at various privacy budgets against both, theoretical risk bounds and empirical success of reconstruction attacks. We show that using very large privacy budgets can render reconstruction attacks impossible, while drops in performance are negligible. We thus conclude that not using DP -- at all -- is negligent when applying AI models to sensitive data. We deem those results to lie a foundation for further debates on striking a balance between privacy risks and model performance.

Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 27 of its 51 references that are in the map. First posted on arXiv 5 Dec 2023.

Builds on

27 of 51 references.

References · 27

  1. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,604
  2. 2022Large Language Models Encode Clinical Knowledgecited by 1,807
  3. 20163D U-Net: Learning Dense Volumetric Segmentation from Sparse Annotationcited by 1,471
  4. 2023Extracting Training Data from Diffusion Modelscited by 723
  5. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 707
  6. 2021The Medical Segmentation Decathloncited by 620
  7. 2019A large annotated medical image dataset for the development and evaluation of segmentation algorithmscited by 371
  8. 2021See through Gradients: Image Batch Recovery via GradInversioncited by 320
  9. 2019Differential Privacy Has Disparate Impact on Model Accuracycited by 316
  10. 2022Unlocking High-Accuracy Differentially Private Image Classification through Scalecited by 218
  11. 2022Reconstructing Training Data with Informed Adversariescited by 143
  12. 2022Reconstructing Training Data from Trained Neural Networkscited by 129
15 more
  1. 2021When the Curious Abandon Honesty: Federated Learning Is Not Privatecited by 126
  2. 2021Robbing the Fed: Directly Obtaining Private Data in Federated Learning with Modified Modelscited by 106
  3. 2022Position: Considerations for Differentially Private Learning with Large-Scale Public Pretrainingcited by 86
  4. 2022Variational Model Inversion Attackscited by 75
  5. 2022TAN Without a Burn: Scaling Laws of DP-SGDcited by 51
  6. 2023Bounding Training Data Reconstruction in DP-SGDcited by 42
  7. 2022Defending against Reconstruction Attacks with R'enyi Differential Privacycited by 30
  8. 2022Differentially private training of residual networks with scale normalisationcited by 26
  9. 2019Towards Formalizing the GDPR's Notion of Singling Outcited by 25
  10. 2023Deconstructing Data Reconstruction: Multiclass, Weight Decay and General Lossescited by 24
  11. 2023Unlocking Accuracy and Fairness in Differentially Private Image Classificationcited by 16
  12. 2023Bounding data reconstruction attacks with the hypothesis testing interpretation of differential privacycited by 14
  13. 2023TMI! Finetuned Models Leak Private Information from their Pretraining Datacited by 13
  14. 2022Attacks on Deidentification's Defensescited by 10
  15. 2022Defending against Reconstruction Attacks through Differentially Private Federated Learning for Classification of Heterogeneous Chest X-Ray Datacited by 8

Built on by

Cited by year

Citing papers per year: 2024: 1.

1 paper.

  1. 2024Visual Privacy Auditing with Diffusion Modelscited by 1