PaperlayerView exact revision on arXiv

Source-linked AI summary

Secure and Robust Machine Learning for Healthcare: A Survey

Adnan Qayyum, Junaid Qadir, Muhammad Bilal, Ala Al-Fuqaha

arXiv:2001.08103v1cs.LGeess.IVstat.ML

TL;DR

ML/DL has substantial potential in healthcare, but its robustness is uncertain because healthcare systems face security, privacy, adversarial, and ethical challenges. This paper surveys healthcare applications and pipeline vulnerabilities, reviews potential secure and privacy-preserving methods, and identifies open research problems. It concludes that secure and robust clinical deployment requires addressing these challenges while continuing investigation of unresolved issues.

  • Problem

    Healthcare ML/DL systems face security, privacy, adversarial, poisoning, and ethical vulnerabilities that constrain robust use in clinical and life-critical settings.

  • Method

    The paper surveys healthcare applications, formulates the ML pipeline to identify vulnerabilities, and reviews potential secure and privacy-preserving ML solutions.

  • Results

    The survey presents application-specific challenges, potential defenses including differential privacy and data-modification methods, and domain-adaptation approaches relevant to medical imaging.

  • Takeaways & Limitations

    Secure and privacy-preserving ML for healthcare requires attention to vulnerabilities across the pipeline and continued investigation of open research problems.

Abstract

from arXiv · show

Recent years have witnessed widespread adoption of machine learning (ML)/deep learning (DL) techniques due to their superior performance for a variety of healthcare applications ranging from the prediction of cardiac arrest from one-dimensional heart signals to computer-aided diagnosis (CADx) using multi-dimensional medical images. Notwithstanding the impressive performance of ML/DL, there are still lingering doubts regarding the robustness of ML/DL in healthcare settings (which is traditionally considered quite challenging due to the myriad security and privacy issues involved), especially in light of recent results that have shown that ML/DL are vulnerable to adversarial attacks. In this paper, we present an overview of various application areas in healthcare that leverage such techniques from security and privacy point of view and present associated challenges. In addition, we present potential methods to ensure secure and privacy-preserving ML for healthcare applications. Finally, we provide insight into the current research challenges and promising directions for future research.

I. INTRODUCTION

ML/DL methods are increasingly applied across healthcare, including clinical diagnosis and predictive systems, but their security and robustness remain concerns because these models can be vulnerable to adversarial and other attacks. The paper surveys healthcare applications, identifies vulnerabilities across the ML pipeline, and discusses potential secure, privacy-preserving solutions and open research issues.

  • Healthcare applications: ML/DL models are beginning to influence healthcare, where they support applications such as clinical diagnosis and predictive healthcare systems.Reported applications include heart-disease prediction using clustering and hepatitis prediction using principal component analysis.
  • Healthcare applications: Deep-learning models have achieved human-level performance in clinical pathology, radiology, ophthalmology, and dermatology, supporting computer-aided diagnosis systems.Some studies reported that these models outperform human physicians on average, and an FDA-approved medical-image diagnosis system was described as requiring no human intervention.
  • Healthcare applications: ML/DL healthcare systems can produce accurate predictive outcomes and support human-centered and remote healthcare services when combined with cloud, edge, mobile, and big-data technologies.The passage specifically notes potential benefits for rural and low-income areas.
  • Security and robustness: Despite strong performance, ML/DL models are vulnerable to carefully crafted adversarial examples, data poisoning, and model poisoning, while the robustness of defenses remains questionable.These concerns are especially consequential for healthcare, which is identified as a life-critical application domain.
  • Paper scope and contributions: The paper surveys healthcare applications and formulates the ML pipeline to identify vulnerabilities, security and privacy challenges, potential solutions, and open research problems.Its contributions include reviewing applications, mapping vulnerabilities to pipeline stages, and discussing robust ML techniques for healthcare.

2) Supervised Learning:

Healthcare ML uses supervised and related learning approaches across heterogeneous clinical data, including records, imaging, and multimodal repositories, but performance can degrade on future data. Medical imaging applications span enhancement, detection, classification, segmentation, reconstruction, registration, and retrieval.

  • Supervised learning maps labeled inputs to outputs, supporting classification and regression tasks such as lung-disease classification and organ recognition.
  • Semi-supervised learning combines labeled and unlabeled samples and is useful when healthcare lacks sufficient labeled training data.
  • Healthcare ML draws on heterogeneous sources, including genomics, medical data, social media, and environmental data, for prognosis, diagnosis, treatment, and clinical workflow applications.
  • EHR-based models for mortality and length-of-stay prediction showed degraded performance when trained on historical data and tested on unseen future data.
  • Medical image analysis applies ML to modalities such as MRI, CT, ultrasound, and PET for extracting anatomical and functional information.
  • Medical imaging pipelines include enhancement, detection, classification, segmentation, reconstruction, registration, and retrieval, with DL models used for denoising, cancer detection, organ classification, and image reconstruction.

3) Applications of ML in Treatment:

ML applications in treatment and clinical workflows support image interpretation, real-time monitoring, disease prediction, computer-aided diagnosis, reinforcement learning, clinical time-series modeling, clinical NLP, and speech or audio processing.

  • Applications of ML in Treatment: Real-time monitoring collects wearable, smartphone, or IoT data, sends it to the cloud for ML/DL analysis, and returns outcomes for action.
  • Applications of ML in Treatment: ML supports disease prediction and diagnosis from medical data, including cardiovascular risk prediction, where reported studies found improved prediction efficacy.
  • Applications of ML in Treatment: CADe and CADx systems use ML/DL, computer vision, and image processing for automatic medical-image interpretation to assist radiologists.
  • Applications of ML in Treatment: Clinical reinforcement learning learns policies for decisions in uncertain environments and can support diagnosis and treatment for patients with distinct characteristics.
  • Applications of ML in Treatment: Clinical time-series models address tasks including ICU intervention prediction, traumatic-brain-injury mortality prediction, and estimation of cerebrovascular indicators.
  • Applications of ML in Treatment: Clinical NLP and speech or audio processing target information extraction, transcription, report generation, patient-state assessment, clinician efficiency, and productivity.

III. SECURE, PRIVATE, AND ROBUST ML FOR HEALTHCARE: CHALLENGES

Secure and robust healthcare ML faces vulnerabilities across data-driven clinical-care stages, from data collection and annotation to dataset quality. These challenges include noise, workforce limitations, ambiguous or improper labels, imbalance, scarcity, bias, and missing values.

  • Training clinical ML/DL models requires large, labor-intensive collections of EHRs, medical images, reports, and other healthcare data that may contain vulnerabilities.
  • Instrumental and environmental disturbances can introduce artifacts into healthcare data, with motion in multishot MRI increasing the risk of misdiagnosis.
  • Healthcare organizations may lack personnel with the statistical, computational, and clinical expertise needed to develop, maintain, and use ML/DL systems effectively.
  • Supervised healthcare ML depends on abundant clinician-labeled data, while ambiguous ground truth and disagreement among experts can complicate diagnosis and expose annotation influence.
  • Improper annotation can undermine life-critical applications because coarse labels may fail to represent rare, fine-grained, or hidden clinical strata.
  • Healthcare datasets may be small, imbalanced, biased, and sparse; missing values and observations significantly affect ML/DL performance.

3) Vulnerabilities in Model Training:

Healthcare ML/DL systems face vulnerabilities across training, deployment, testing, and security threat dimensions, making robustness and integrity important for critical applications.

  • Model Training: Training vulnerabilities include improper or incomplete training, privacy breaches, model poisoning, and model stealing.
  • Importance: These vulnerabilities can hinder deployment in security-critical and life-critical applications, including healthcare, so system security and integrity are paramount.
  • Deployment: Deployment vulnerabilities include distribution shifts, incomplete data, and the need to consider fairness and accountability in human-centric clinical decisions.Models trained in one imaging-center domain may degrade significantly when deployed on different-domain images.
  • Testing: Testing vulnerabilities involve misinterpretation and false-positive or false-negative outcomes linked to inefficient training or incomplete inference data.
  • Security Threat Taxonomy: ML security threats span influence attacks, security violations, and attack specificity, forming the taxonomy shown in Figure 5.Influence attacks may be causative or exploratory; security violations concern availability, integrity, and privacy; attacks may be targeted or indiscriminate.

2) Adversarial Machine Learning (ML):

Adversarial machine learning exposes healthcare systems to attacks during training and inference, while clinical studies also identify risks from unintentional patient heterogeneity and intentional manipulation.

  • Adversarial Attacks: Adversarial attacks add carefully crafted, often unnoticeable perturbations to inputs to evade ML/DL system integrity.
  • Attack Types: Poisoning attacks manipulate training data, whereas evasion attacks manipulate test data during inference to compromise model integrity.The survey identifies poisoning-attack detection as critical for robust healthcare ML and cites a hypothyroid-diagnosis example.
  • Healthcare-Specific Risks: Healthcare research introduced adversarial patients, showing that patients with identical predictive features can have significantly different individual treatment effects.
  • Healthcare-Specific Risks: White-box and black-box attacks have been demonstrated against fundoscopy, dermoscopy, and chest X-ray clinical applications.
  • Healthcare-Specific Risks: Clinical-trial adversaries may gain incentives to attack as computer-aided diagnosis and decision-support systems become more prevalent.

3) Ethical Challenges:

Healthcare ML faces ethical, causal, regulatory, data, interoperability, and distribution-shift challenges that constrain reliable deployment in realistic clinical settings.

  • Ethical Challenges: Ethical ML healthcare applications require understanding target populations, sociological aspects, and potential effects of data collection on patient well-being and dignity.
  • Causality: Causal reasoning is needed for treatment-counterfactual questions, while black-box DL models primarily exploit correlations without causal links.
  • Causality: Causal-effect estimation can support fairer predictions, because fairness in decision making can be enforced through causal reasoning.
  • Regulation: Clinical ML/DL integration requires regulatory guidelines covering both medical systems and their deployment in clinical environments.
  • Data Challenges: Healthcare data are often small in research collections relative to heterogeneous, large-scale multimodal data generated across institutions.
  • Data Challenges: Subjectivity, redundancy, and bias in collected data can reproduce undesirable historical hospital practices in algorithmic outcomes.
  • Interoperability: Interoperability is needed because precise clinical conclusions may require exchanging imaging and other patient EMR data across healthcare systems.
  • Distribution Shifts: Distribution shifts arise across institutions, devices, protocols, and parameter choices, causing models trained on public databases to underperform in clinical environments.

9) Updating Hospital Infrastructure is Hard:

Proprietary, siloed hospital IT systems make software updates costly and slow, while secure ML approaches include cryptographic computation, secret sharing, secure processors, and differential privacy.

  • Updating Hospital Infrastructure is Hard: Hospital IT systems are mostly proprietary and siloed, making software revision, fixing, and updating costly and time-consuming.The survey notes that many hospitals still used ICD-9 in 2013 despite ICD-10 having been released in 1990.
  • Privacy Preservation: Privacy-preserving ML seeks to prevent training and inference from revealing additional information about patients beyond what is permitted.
  • Privacy Preservation: Anonymization alone may not prevent privacy breaches because meaningful information can still be inferred from anonymized data.
  • Cryptographic Approaches: Secure two-party computation distributes private data across two non-colluding servers that jointly train ML models.
  • Cryptographic Approaches: Cryptographic approaches support encrypted multi-party ML using homomorphic encryption, secret sharing, garbled circuits, and secure processors.
  • Approach Taxonomy: Figure 6 presents a taxonomy of approaches for secure, private, and robust ML.
  • Differential Privacy: Differential privacy protects private data by adding perturbations and offers group privacy, composability, and robustness to auxiliary information.

2) Differential Privacy:

The survey presents defenses against adversarial attacks as methods that modify models or use auxiliary models, while emphasizing diverse strategies for improving robustness.

  • Modifying Model: Defensive distillation transfers knowledge from a larger model to a smaller one and adapts this strategy to defend against adversarial attacks.
  • Modifying Model: Network verification checks whether inputs satisfy specified properties while restraining adversarial examples, including methods using ReLU activations and SMT.
  • Modifying Model: Gradient regularization reduces output sensitivity to input changes, but increases training complexity by a factor of two.
  • Modifying Model: Classifier robustifying develops classifiers designed to resist adversarial attacks, including hybrid models combining DNNs with Gaussian processes and RBF kernels.
  • Modifying Model: Interpretability-based defenses explain model outcomes to detect adversarial examples, while masking methods introduce noise into logits to deafen low-distortion attacks.

2) Modifying Data:

The survey groups adversarial defenses into modifying data, modifying models, and adding auxiliary models, with data-oriented methods transforming inputs, features, or training data.

  • Modifying Data: Adversarial retraining augments the training set with adversarial examples so ML/DL models learn to withstand such inputs.
  • Modifying Data: Input reconstruction cleans adversarial noise and transforms adversarial examples into legitimate inputs before inference.
  • Modifying Data: Feature squeezing reduces the feature space available to adversaries through spatial smoothing and reduced color bit depth.
  • Modifying Data: Feature masking sets weights of sensitive neurons to zero using a masking layer placed before the softmax classification layer.
  • Modifying Data: Manifold projection and generative models clean adversarial perturbations before passing reconstructed samples to the original model.
  • Adding Auxiliary Model(s): Auxiliary defenses include binary adversarial detectors, sequential or parallel ensembles, and generative models such as Defense-GAN.

D. Solutions to Address Distribution Shifts

The survey discusses transfer learning and domain adaptation as approaches for handling distribution shifts, alongside responsible practices for evaluating, monitoring, and deploying healthcare ML systems.

  • Solutions to Address Distribution Shifts: Transfer learning fine-tunes a model trained on a larger dataset for a smaller application-specific dataset to transfer knowledge across domains.
  • Solutions to Address Distribution Shifts: Domain adaptation explicitly accounts for different source and target distributions and is useful for medical imaging tasks including MRI segmentation and chest X-ray classification.
  • Solutions to Address Distribution Shifts: Domain adaptation may be supervised, unsupervised, semi-supervised, or self-supervised depending on target labels and the supervision strategy.
  • Responsible AI Practices: Responsible AI practices include human-centered design, context-appropriate evaluation metrics, raw-data examination, and understanding model and dataset limitations.
  • Responsible AI Practices: Repeated testing and continuous monitoring with updating are recommended for identifying issues, input drift, and problems in realistic deployment settings.

2) Responsible ML for Healthcare:

Responsible ML for healthcare requires careful problem selection, evaluation, ethical consideration, deployment, and interdisciplinary collaboration, supported by tools for secure and privacy-preserving learning.

  • Responsible ML for Healthcare: Healthcare ML development should address problem selection, usefulness, ethics, rigorous evaluation, reporting, responsible deployment, and market introduction.
  • Responsible ML for Healthcare: Interdisciplinary teams can include stakeholders from multiple domains, supporting responsible ML development across healthcare contexts.
  • Secure ML Tools: TensorFlow Federated enables distributed training of a shared model without sharing clients’ local data.
  • Secure ML Tools: PySyft supports differential privacy, federated learning, multiparty computation, and homomorphic encryption across major ML frameworks.
  • Secure ML Tools: PyGrid provides a peer-to-peer platform for collectively training ML models, while SyferText targets privacy-preserving natural-language processing.
  • Open Research Issues: Modern ML/DL models often operate as complex black boxes, creating an interpretability problem for healthcare applications.

B. Machine Learning on the Edge

Secure and robust healthcare ML requires addressing distributed data, annotation burdens, fairness, accountability, and the limits of purely data-driven analysis. The survey organizes these vulnerabilities and discusses privacy-preserving solutions and open research problems.

  • Manual annotation and validation of medical data are time-consuming and costly, motivating approaches such as active learning and richer automated annotation.
  • Phenotyping integrates multiple data sources, while NLP and recurrent deep models extract information from unstructured clinical notes to support data annotation.
  • Healthcare data is distributed across hospital departments and institutions, challenging the assumption that complete training and validation datasets are centrally accessible.
  • Biases in training data can undermine fairness and accountability, properties that are especially important for life-critical healthcare predictions.
  • Data-driven healthcare studies should be combined with hypothesis-driven or model-based methods, rigorous experiments, clinical interpretation, external validation, and provenance awareness.
  • The survey formulates the healthcare ML pipeline, identifies vulnerabilities, discusses secure and privacy-preserving solutions, and highlights open research problems.
Loading 2001.08103v1…