Source-linked AI summary
Privacy-preserving Federated Brain Tumour Segmentation
Wenqi Li, Fausto Milletarì, Daguang Xu, Nicola Rieke, Jonny Hancox, Wentao Zhu, Maximilian Baust, Yan Cheng, Sébastien Ourselin, M. Jorge Cardoso, Andrew Feng
TL;DR
Privacy constraints make centralised medical-image training difficult, while federated updates can still leak local examples. The paper evaluates privacy-preserving federated brain-tumour segmentation on BraTS and finds a performance–privacy-cost trade-off, with conservative privacy-cost allocation.
Problem
Medical imaging requires diverse training data, but privacy regulations impede centralised collection and federated updates remain vulnerable to model-inversion leakage.
Method
The paper implements federated brain-tumour segmentation using selective parameter updates, gradient clipping, and the sparse vector technique for differential privacy.
Results
Privacy protection trades off against model performance; sharing 40% of the full model can produce an almost negligible performance decrease without differential privacy.
Takeaways & Limitations
Privacy-preserving federated learning is feasible for brain tumour segmentation while retaining comparable segmentation performance without sharing clients’ data.
Takeaways & Limitations
The strong differential-privacy guarantee uses conservative privacy-cost allocation, and differentially private SGD remains future work.
Abstract
from arXiv · showhide
Due to medical data privacy regulations, it is often infeasible to collect and share patient data in a centralised data lake. This poses challenges for training machine learning algorithms, such as deep convolutional networks, which often require large numbers of diverse training examples. Federated learning sidesteps this difficulty by bringing code to the patient data owners and only sharing intermediate model training updates among them. Although a high-accuracy model could be achieved by appropriately aggregating these model updates, the model shared could indirectly leak the local training examples. In this paper, we investigate the feasibility of applying differential-privacy techniques to protect the patient data in a federated learning setup. We implement and evaluate practical federated learning systems for brain tumour segmentation on the BraTS dataset. The experimental results show that there is a trade-off between model performance and privacy protection costs.
1 Introduction
Medical imaging models need diverse data, but privacy regulations and reconstruction risks limit centralised sharing. The paper evaluates federated learning and privacy-preserving techniques for brain tumour segmentation.
- Motivation: Medical DNNs depend on large, diverse training datasets that may be unavailable at a single institution.Low pathology incidence and limited patient numbers constrain institutional datasets.
- Federated learning: Federated learning trains models collaboratively without sharing patient data, exchanging local model weights or updates instead.Clients train locally, while a server aggregates their contributions into a global model.
- Study scope: The federated setup studied 242 training subjects distributed across 13 participating clients.The figure depicts the system and client distribution.
- Privacy challenge: Model inversion can reconstruct training examples from federated updates, leaving federated learning vulnerable to indirect privacy leakage.Noise injection is presented as a countermeasure that limits the granularity of shared information.
- Study scope: The study implements and evaluates practical privacy-preserving federated systems for brain tumour segmentation on BraTS 2018.It examines federated averaging with momentum-based optimisation, imbalanced nodes, and the sparse vector technique.
2 Method
The method combines client-server federated averaging with local optimisation and client-side privacy protection. Clients share model differences after local training, while selective sharing, clipping, and noisy sparse-vector release limit information leakage.
- Federated architecture: A central server distributes a global DNN, coordinates client SGD updates, and aggregates their contributions using federated averaging.The architecture separates client-side training, server-side aggregation, and client-side privacy preservation.
- Client training: At each round, clients initialise from global parameters, run local SGD, and share the model difference after N (local) iterations.The uploaded update is privacy-processed before transmission.
- Client training: Adam-based local training re-initialises each client’s momentum variables at the beginning of every federated round.The design uses shared global parameters as the starting point for each round.
- Privacy-preserving module: Selective parameter sharing uploads only update components exceeding a threshold and clips values to the fixed range [−γ, γ].Gradient clipping is also used as a regulariser to prevent over-fitting; γ can be selected using public validation data.
- Privacy-preserving module: SVT adds Laplace noise to thresholding and released answers, then clips accepted updates before sharing them.The procedure releases a target fraction of components and provides (ε1 + ε2 + ε3)-differential privacy.
- Server aggregation: Server aggregation weights client contributions by their numbers of local iterations because clients may train at different speeds.Reducing communication overhead using sparse partial updates is left for future work.
3 Experiments
Experiments use heterogeneous, institution-partitioned BraTS data to evaluate federated segmentation and privacy-preserving updates. The setup compares global-model performance under controlled training and privacy parameters.
- Data preparation: The BraTS 2018 data contain multi-parametric MRI scans from 285 subjects with voxel-level annotations for three tumour regions.Each subject has four MRI modalities: T1, contrast-enhanced T1, T2, and T2-FLAIR.
- Data preparation: The dataset is split into 242 training subjects and 43 held-out test subjects across 13 institution-specific federated clients.Institutional equipment and imaging protocols create heterogeneous image feature distributions.
- Federated model setup: The federated model uses a segmentation backbone with soft Dice loss, Adam optimisation, 300 rounds, and two local epochs per round.A data-centralised baseline is trained for 600 epochs.
- Federated model setup: The segmentation model has about 1.2×10^6 parameters, and one training iteration takes 0.85 s on an NVIDIA Tesla V100 GPU.These measurements describe the computational scale of the experiments.
- Evaluation: Performance is measured by mean-class Dice score across three tumour regions and all held-out test subjects.For federated systems, evaluation uses the global model shared with clients.
- Privacy-preserving setup: Privacy experiments vary the shared model fraction q and clipping value γ, while differential-privacy experiments vary q, ε1, and ε3.The setup fixes γ to 10−4, sensitivity s to 2γ, and ε2 according to the specified privacy relation.
4 Results
Federated learning achieved comparable segmentation performance to centralised training without sharing client data, while practical aggregation and sharing choices shaped convergence, performance, and privacy costs.
- Federated versus data-centralised training: Federated learning achieved comparable segmentation performance to data-centralised training without sharing clients’ data.Centralised training converged at about 300 epochs, whereas FL converged at about 600 epochs.
- Federated versus data-centralised training: The FL training time was determined by the slowest client, taking 65.45 seconds per epoch plus small communication overheads.The slowest client had N = 77 subjects.
- Momentum restarting and weighted averaging: Weighted averaging outperformed simple model averaging and handled imbalanced numbers of iterations across clients.Restarting client momentum at each federated round outperformed other momentum treatments.
- Partial model sharing: Sharing larger model proportions generally improved performance, while sharing 40% caused an almost negligible decrease and did not affect convergence speed.Gradient clipping sometimes improved performance, but its value required careful tuning.
- Differential privacy: Differential privacy introduced a trade-off between protection and model performance.Under the same DP setup, sharing 10% of the model performed better than sharing 40% because fewer shared variables reduced overall privacy costs.
5 Conclusion
The paper proposes privacy-preserving federated learning for brain tumour segmentation and evaluates privacy-utility trade-offs. It reports strong differential privacy guarantees but identifies conservative privacy-cost allocation as a limitation.
- The paper proposes and evaluates a federated learning system for brain tumour segmentation with emphasis on preserving patient data privacy.
- The study examines segmentation performance while varying privacy parameters, including partial-model percentage, ε1, and ε3.
- Strong differential privacy guarantees are provided, but the privacy-cost allocation is conservative.The authors identify differentially private SGD for medical image analysis as future work.