Differentially Private EEG Feature Anonymization: A Privacy-Utility Case Study in Clinical Neurophysiology

Noman Sadiq; Mohsen Toorani

Source-linked AI summary

Differentially Private EEG Feature Anonymization: A Privacy-Utility Case Study in Clinical Neurophysiology

Noman Sadiq, Mohsen Toorani

arXiv:2609.11777v1Sep 10, 2026cs.CRcs.LGeess.SP

TL;DR

Clinical EEG features can expose sensitive patient information, while conventional anonymization may not prevent inference risks and strong protection may reduce utility. The paper studies subject-level Gaussian and Laplace perturbation of patient-level EEG features across three deployment scenarios, evaluating statistical and downstream utility. DP perturbation can be integrated into EEG workflows, but mechanism choice, calibration, privacy parameters, and dataset limitations strongly affect utility.

Problem
High-dimensional clinical EEG recordings and derived features create privacy risks during reuse and sharing, while anonymization must preserve clinically relevant utility.
Method
The study applies subject-level Gaussian and Laplace perturbations to patient-level EEG-derived feature representations across client-side, centralized server-side, and decentralized local-training scenarios.
Results
DP perturbation can be integrated into EEG processing workflows, but larger perturbations introduced substantial distortion and downstream classification performance was limited in the evaluated small, imbalanced dataset.
Takeaways & Limitations
Practical EEG anonymization requires careful attention to mechanism selection, sensitivity calibration, privacy parameters, and evaluation unit because these choices affect utility.
Takeaways & Limitations
The study does not establish an end-to-end privacy guarantee for preprocessing and does not claim formal full-vector ε-DP guarantees for the implemented Laplace experiments.

Abstract

from arXiv · show

Clinical electroencephalography (EEG) data are valuable for healthcare research and for developing artificial intelligence (AI)-based clinical decision-support systems, but EEG recordings and derived features may contain sensitive patient-specific information. This creates privacy risks when data are reused, analyzed, or shared across clinical and research environments. Conventional anonymization methods are often insufficient for high-dimensional biomedical signals, since removing direct identifiers does not necessarily prevent re-identification, linkage, or inference risks. At the same time, strong privacy protection may distort clinically relevant signal characteristics and reduce data utility. This paper studies subject-level differential privacy for protecting clinical EEG-derived feature representations using Gaussian and Laplace perturbations. The proposed framework considers three deployment scenarios: client-side anonymization, centralized server-side anonymization, and decentralized local training. Following EEG preprocessing and feature extraction, Gaussian and Laplace perturbations are applied to the resulting patient-level EEG feature representations. The Laplace experiments evaluate the implemented noise scales, while the scales required for formal full-vector calibration are derived separately. The effects of both perturbations are assessed using statistical utility measures and a downstream machine-learning-based utility check. The results show that differentially private perturbation can be integrated into EEG processing workflows, but the selected mechanism, privacy parameters, and sensitivity calibration strongly influence data utility. The study highlights the practical privacy-utility trade-off in DP-based EEG feature anonymization and the challenges of preserving downstream utility in small and imbalanced clinical EEG datasets.

1 Introduction

Healthcare data reuse creates a privacy–utility tension that is especially acute for high-dimensional clinical EEG signals. This paper presents a subject-level DP case study using Gaussian and Laplace perturbations across three deployment scenarios and evaluates statistical and downstream utility.

1 Introduction: Healthcare privacy protection must balance patient-data risks against the possibility that excessive protection removes clinically useful information.The paper frames this balance as a central problem in healthcare informatics.
1 Introduction: Subject-level DP is applied to EEG-derived feature representations to address re-identification, linkage, and inference risks in high-dimensional biomedical signals.The approach perturbs extracted patient-level features rather than raw EEG recordings.
1 Introduction: Three multi-hospital deployment scenarios place anonymization and training at the client, centralized server, or decentralized local level.These scenarios represent different locations for protected-feature handling and model training.
1 Introduction: The study compares Gaussian and Laplace perturbations after EEG preprocessing and feature extraction, including separate formal calibration of full-vector Laplace sensitivity.The implemented Laplace scales are evaluated separately from the scales derived for formal calibration.
1 Introduction: The perturbation configurations are assessed using statistical utility measures and a downstream machine-learning utility check.The classification evaluation is intended as a downstream utility assessment rather than the paper’s main objective.
1 Introduction: The study is constrained by small and imbalanced clinical EEG datasets and selected privacy configurations, calibrations, and evaluation procedures.Broader privacy-budget exploration, attack-based testing, and larger-scale benchmarking remain outside the study’s scope.

2 Related Work

Privacy-preserving EEG research spans formal differential privacy, distributed learning, perturbation, and representation-learning approaches. This paper distinguishes itself through a clinical, subject-level DP case study focused on patient-level feature perturbation and its privacy–utility trade-off.

2 Related Work: Prior privacy-preserving EEG research includes formal DP, federated or distributed learning, and representation-learning methods that suppress identity-related information.These directions address privacy through different protected objects and mechanisms.
2 Related Work: Federated EEG approaches can retain raw data locally while perturbing gradients or model parameters before aggregation, unlike this paper’s feature-level perturbation.The comparison concerns model-parameter perturbation versus patient-level EEG-derived feature perturbation.
2 Related Work: Other EEG privacy methods use sample-wise or user-wise perturbations to reduce identity leakage while preserving brain-computer-interface task utility.Representation-learning methods instead separate or suppress identity-related components before decoding.
2 Related Work: Source-free adaptation addresses EEG model transfer without sharing raw source recordings, but it is not itself a differential-privacy mechanism.It represents a broader data-sharing strategy rather than the formal DP framework studied here.
2 Related Work: The paper differs from prior EEG privacy work by applying Gaussian and Laplace DP perturbations to patient-level clinical EEG feature representations.Its evaluation combines statistical utility measures with a downstream machine-learning utility check.
2 Related Work: The paper emphasizes DP noise calibration, patient-level adjacency, sensitivity assumptions, and the resulting privacy–utility trade-off for clinical EEG features.This focus is distinct from methods centered on identity removal or user-wise perturbation.

3 Proposed Scheme

The proposed scheme protects patient-level EEG feature representations with subject-level differential privacy across three multi-hospital deployment scenarios. Its workflows combine EEG preprocessing, feature extraction, perturbation, linkage or local training choices, and utility assessment.

Deployment Scenarios: Three deployment scenarios place anonymization and training differently: client-side, centralized server-side, and decentralized local training.The scenarios differ in where anonymization, aggregation, duplicate detection, and model training occur.
Client-Side Anonymization: Client-side anonymization sends only protected feature representations to the server, while raw EEG data and identifiers remain at each hospital.This provides stronger data minimization because the server does not receive raw or identifiable EEG data.
Centralized Server-Side Anonymization: Centralized server-side anonymization transfers pseudonymized EEG-derived features to a trusted server for aggregation, duplicate detection, differential-privacy anonymization, and model training.Hospitals retain raw identifiers locally and transmit pseudonymized feature data through secure communication channels.
Decentralized Local Training: Decentralized local training keeps raw EEG and extracted features within hospitals, which train local models and share only model-related outputs or updates.The local workflow applies subject-level feature anonymization before model training and evaluates downstream utility by comparing models trained on original and anonymized features.
EEG Processing and DP: The processing workflows preprocess EEG, extract patient-level features, apply subject-level perturbation, and assess intrinsic or downstream utility depending on the scenario.The implementation uses Gaussian and Laplace mechanisms; the Laplace experiments use b_impl = 4.0/ε, whereas formal full-vector calibration requires b_formal = 76.21/ε.

4 Performance Analysis

The evaluation compares statistical distortion and downstream patient-level classification utility for Gaussian and Laplace perturbations. Utility generally improves with larger ϵ, but both mechanisms substantially impair classification in this small, imbalanced case study.

4 Performance Analysis: The performance analysis used one noise realization per privacy configuration and treated classification as a downstream utility check in a small, imbalanced dataset.The reported uncertainty intervals were interpreted descriptively because thresholds were selected using the same cohort.
4.1 Privacy–Utility Assessment of the Gaussian Mechanism: Increasing ϵ reduced Gaussian RMSE and MAE and improved correlation and SNR, but correlation remained low and SNR negative across tested values.These results indicate substantial distortion even under analytic Gaussian calibration, especially at stronger privacy settings.
4.2 Privacy–Utility Assessment of the Laplace Mechanism: Increasing ϵ reduced implemented Laplace perturbation scales and improved correlation and SNR, with larger ϵ preserving more feature structure.The implemented sweep used b_impl = 4.0/ϵ rather than the separately derived full-vector calibration.
4.2 Privacy–Utility Assessment of the Laplace Mechanism: The implemented Laplace perturbation preserved more statistical utility than tested Gaussian configurations as ϵ increased, but this trend did not establish an optimal privacy–utility setting.Higher utility corresponded to smaller perturbation magnitudes in the implemented sweep.
4.3.1 Evaluation on Original EEG Data: The original-feature MLP achieved accuracy 0.706 and balanced accuracy 0.675 under patient-level LOSO validation, exceeding the majority-class balanced accuracy of 0.500.The baseline confusion matrix was TN = 9, FP = 3, FN = 2, and TP = 3.
4.3.2 Evaluation on Gaussian-Perturbed EEG Data: Gaussian-perturbed features produced TN = 0, FP = 12, FN = 0, and TP = 5, yielding recall 1.000 but specificity 0 and no clinically useful class separability.All patients were assigned to the positive class, so the perfect recall did not indicate useful sensitivity.
4.3.3 Evaluation on Laplace-Perturbed EEG Data: Laplace-perturbed features achieved accuracy 0.235, precision 0.214, recall 0.600, specificity 0.083, and balanced accuracy 0.342, remaining weaker than the original baseline.The model produced TN = 1, FP = 11, FN = 2, and TP = 3, indicating many false positives and reduced feature separability.

5 Conclusion

The paper studies subject-level DP for EEG feature representations across client-side, centralized, and decentralized deployment scenarios. It finds that DP can be integrated into EEG workflows, but mechanism choice, calibration, privacy parameters, and evaluation unit strongly affect utility.

5 Conclusion: Subject-level Gaussian and Laplace perturbations were applied to patient-level EEG feature representations across three deployment scenarios and assessed with statistical and machine-learning utility measures.The scenarios were client-side anonymization, centralized server-side anonymization, and decentralized local training.
5 Conclusion: DP-based perturbation can be integrated into EEG processing workflows, but utility depends strongly on the mechanism, sensitivity calibration, privacy parameters, and evaluation unit.Gaussian calibration used implemented L2 sensitivity, while Laplace experiments characterized utility under implemented perturbation magnitudes.

Ethics Statement

The study used anonymized EEG data under institutional ethics and data-protection oversight, with informed-consent exemption granted by the regional ethics committee.

Ethics Statement: Data collection and processing were approved by the Norwegian South-Eastern Regional Ethics Committee and Oslo University Hospital’s data protection officer.The project received an informed-consent exemption, and only anonymized data were made available to the authors.