Human-centered AI for Medical Imaging

Daniel Rueckert, FREng, FMedSci, FIEEE
Alexander von Humboldt Professor of AI for Medicine and Healthcare
School of Medicine and Informatics, TU Munich, Germany
andBiomedical Image Analysis Group
Department of Computing, Imperial College London, UK

AI/ML in Medicine

AI/ML in Medicine: There is a lot of hype

AI/ML in Medical Imaging• Out of 64 AI/ML based, FDA approved medical devices andalgorithms, 30 (46.9%) for focus on radiology

Value proposition
Level of diagnostic support

AI in Medical Imaging: Opportunities

Diagnosis and Prediction
Computer-aided decision
support systems
Screening and Monitoring
Analysis of shape and texture,
Radiomics

Quantification of Imaging Biomarkers

Detection, Localisation,
Segmentation

Semantic Image Interpretation

Denoising, Superresolution, Image fusion

Image Enhancement

Accelerated imaging

Image Acquisition and Reconstruction

Learning to reconstruct cardiac MRI

K-space
Full sampling(slow)

25% sampling(4-fold
acceleration)

Signal spacelearning-based
reconstruction

e.g. compressedsensingDeep learning for image reconstruction

Convolution + RELU

Transposed convolution

Max pooling

Softmax

Skip layers

Deep learning for image reconstruction

Schlemper et al. IEEE TMI 2017

Deep learning for image reconstruction

Schlemper et al. IEEE TMI 2017

Deep learning for image reconstruction

Schlemper et al. IEEE TMI 2017

Magnitude reconstruction (6-fold)(a) 6x Undersampled(b) Deep learning reconstruction(c) Ground Truth

Schlemper et al. IEEE TMI 2017

Magnitude reconstruction (11-fold)(a) 11x Undersampled(b) Deep learning reconstruction(c) Ground Truth

Schlemper et al. IEEE TMI 2017

AI-enabled image super-resolution• Acquisition of cardiac MRI typicallyconsists of 2D multi-slice data due to– constraints on SNR– breath-hold time
– total acquisition time

• This leads to thick slice data (thickness
8-10 mm per slice)

Slice I
Slice II
Slice IIIAI-enabled image super-resolution+
Convolution + RELU
Max poolingTransposed convolution
Softmax
Skip layers

AI-enabled image super-resolution

O. Oktay et al. IEEE TMI 2018

Application to fetal MR imaging

Fetal example:
1. Long acquisition times
2. Fetal motion andmaternal breathing

fast single-shot techniques
are 2D acquisitions thatfreeze the motion in time
but ...

Application to fetal MR imaging

Application to fetal MR imaging

Application to fetal MR imaging

Reconstruction using registrationand super-resolution imaging

Murgasova et al., MEDIA, 2012
Kainz et al., IEEE TMI 2015
Alansary et al., IEEE TMI 2017

AI-enabled image recognition• Potential applications:– Guidance: Assist inexperienced sonographers– Convenience: Automatically make a check list ofvisited planes– Reproducibility: Reduce variability between
operators

Fetal brain standard planes
a: Transventricular planeb: Transthalamic planec: Transcerebellar plane

Image from UltrasoundObstet Gynecol, 29: 109-116

AI-enabled image recognition:
Automatic Scan Plane Detection

Abdominal View
Confidence: 98%

Lips View
Confidence: 96%

Goal: Do this in real-time on images straight from US machine

Automatic Standard Scan
Plane Detection: Attention models

Schlemper et al. MedIA 2019

Automatic Standard Scan
Plane Detection: Attention models

Schlemper et al. MedIA 2019

Automatic Standard Scan
Plane Detection in 3D

Using reinforcement learning and artificial agents

Y. Li et al. MICCAI 2018

AI-enabled image segmentation

Bai et al., JCMR 2018

AI-enabled image segmentationSA, basal

SA, mid-ventricularLA, 2 chamber

LA, 4 chamberSA, apicalBai et al., JCMR 2018

Large-scale population analysis• In 2014, UK Biobank began the process of inviting back
100,000 of the original volunteers for brain, heart and body
imaging.
• Imaging is done across several dedicated centres in the UKUK Biobank: Imaging

Lifestyle+

Genetics

Clinicalrecords

CMR images using an automated machine learning-based analysis pipeline, built upon previously proposed cardiac andaortic image segmentation methods using convolutional neural networks24, 25 . The pipeline evaluates comprehensive imaging
phenotypes for the heart and aorta, including global phenotypes of the four cardiac chambers and two aortic sections: the left
ventricle (LV), right ventricle (RV), left atrium (LA), right atrium (RA), ascending aorta (AAo) and descending aorta (DAo), as
well as regional phenotypes of the LV myocardial wall thickness and strain. We report associations of the cardiac and aortic
imaging phenotypes with sex, age and traditional cardiovascular risk factors. We then conducted a first large, population-based
phenome-wide association study to relate the cardiac and aortic phenotypes to non-imaging phenotypes. We discovered a wide
range of highly significant associations with life style, early-life factors, mental health and cognitive function of the participants.

Large-scale population analysis

W. Bai et al., Nature Medicine, 2020
Figure 1. Automated CMR image analysis pipeline. a) LV and RV volumes are derived from short-axis image
segmentation. b, c) LA and RA volumes are derived from on long-axis image segmentation (b: 4 chamber view; c: 2 chamberview). d) AAo and DAo cross-sectional areas are derived from aortic image segmentation. e) Myocardial wall thickness ismeasured using the distance between LV endocardial contour (red) and epicardial contour (green). f) Three short-axis image

Cardiac IDPs from 26,893 subjects
Associations with sex and age

W. Bai et al., Nature Medicine, 2020

Phenome-wide association study

ARTICLES
https://doi.org/10.1038/s41591-020-1009-y

A population-based phenome-wide association
study of cardiac and aortic structure and function
Wenjia Bai! !1,2ᅒ, Hideaki Suzuki2,3,4, Jian Huang! !5,6, Catherine Francis7, Shuo Wang! !1,
Giacomo Tarroni8,9, Florian Guitton! !1, Nay Aung10, Kenneth Fung! !10, Steffen E. Petersen! !10,
Stefan K. Piechnik11, Stefan Neubauer11, Evangelos Evangelou5,12, Abbas Dehghan5,6,
Declan P. O’Regan! !13, Martin R. Wilkins! !7, Yike Guo1, Paul M. Matthews2,6,14 and Daniel Rueckert! !8,14
Differences in cardiac and aortic structure and function are associated with cardiovascular diseases and a wide range of othertypes of disease. Here we analyzed cardiovascular magnetic resonance images from a population-based study, the UK Biobank,using an automated machine-learning-based analysis pipeline. We report a comprehensive range of structural and functional
phenotypes for the heart and aorta across 26,893 participants, and explore how these phenotypes vary according to sex, age
and major cardiovascular risk factors. We extended this analysis with a phenome-wide association study, in which we tested
for correlations of a wide range of non-imaging phenotypes of the participants with imaging phenotypes. We further explored
the associations of imaging phenotypes with early-life factors, mental health and cognitive function using both observational
analysis and Mendelian randomization. Our study illustrates how population-based cardiac and aortic imaging phenotypes canbe used to better define cardiovascular disease risks as well as heart–brain health interactions, highlighting new opportunities
for studying disease mechanisms and developing image-based biomarkers.

Cardiac and aortic structure and function are associated withcardiovascular diseases (CVDs)1,2 and a wide range of othertypes of disease3–6. Quantitative phenotypes derived fromcardiovascular magnetic resonance (CMR) images enable us toassess cardiac and aortic structure and function in a non-invasive
way, and provide important biomarkers for the determination ofpathological states in CVDs. For example, the left ventricular ejection fraction (LVEF) is an important clinical biomarker for the
diagnosis and treatment of heart failure1. The left ventricular myocardial mass (LVM) is widely used for classifying hypertrophy andpredicting risks of cardiovascular events7. Although CMR imaging phenotypes clearly play an important role in disease researchand diagnosis, extraction of these phenotypes demands substantial
involvement of experienced image analysts. This has become a limiting factor for applying CMR in large-scale studies and exploiting
imaging phenotypes at a population level.
Large-scale imaging studies potentially provide a wealth of
information for investigating disease risk factors and discovering
early-stage image-based biomarkers. Recent large-scale imaging
studies collecting CMR images include the Framingham Heart Study(offspring cohort comprised 1,114 participants)8, MESA (5,004 participants)9, DETERMINE (655 participants)10, Dallas Heart Project(2,921 participants)11 and UK Digital Heart Project (~2,000 participants)12, to name a few. They have illustrated the potential infor-

UK Biobank is a population-based prospective study for investigating the risk factors for common adult diseases in middle and oldage13–16. It recruited 500,000 women and men, initially aged 40–69
years old, between 2006 and 2010 for long-term follow-up, fromwhom extensive sociodemographic, lifestyle and health-related
information was serially collected, along with a range of physicalmeasurements and a growing range of genetic and biomarker data.
Currently, UK Biobank is in the process of acquiring comprehensive
multi-modal images of different organ systems from 100,000 participants using a highly standardized protocol, including magnetic
resonance (MR) scans of the heart, brain and abdomen, ultrasoundscans of carotid arteries, whole-body dual-energy X-ray absorptiometry (DXA) scans of bones and joints, retinal photographs andoptical coherence tomography (OCT) images14. These will add
additional imaging phenotypes for understanding the determinantsof diseases.
Deriving quantitative imaging phenotypes at this scale presents
a major challenge. Recently, an image analysis pipeline has beendeveloped for UK Biobank brain MR images, which has generated
approximately 4,350 imaging phenotypes of brain structure andfunction for 10,000 participants17. The derived brain imaging phenotypes, along with the breadth of lifestyle and health informationcollected by UK Biobank, provide a valuable resource for studying the influence of aging and the progression of neuropathology,

W. Bai et al., Nature Medicine, 2020

AI for decision support:
Survival prediction

Bello et al. Nature Machine Intelligence 2019

AI for decision support:
Survival prediction

Bello et al. Nature Machine Intelligence 2019

AI has the potential to revolutionize medicine andhealthcare

But what are the challenges?

Lack of sufficient data: Bias and fairness
RES EARCHRESEARCH ARTICLE◥

that rely on past data to build a predictor of

future health care needs.
Obermeyer et al., Science 2019
Our dataset describes one such typical algo-

ECONOMICS

Dissecting racial bias in an algorithm used to manage
the health of populations
Ziad Obermeyer1,2*, Brian Powers3, Christine Vogeli4, Sendhil Mullainathan5*†There is growing concern that algorithms
may reproduce racial and gender disparities via the people building them or
through the data used to train them (1–3).
Empirical work is increasingly lending
support to these concerns. For example, job
search ads for highly paid positions are lesslikely to be presented to women (4), searches
for distinctively Black-sounding names are
more likely to trigger ads for arrest records(5), and image searches for professions suchas CEO produce fewer images of women (6).
Facial recognition systems increasingly usedin law enforcement perform worse on recognizing faces of women and Black individuals(7, 8), and natural language processing algorithms encode language in gendered ways (9).
Empirical investigations of algorithmic bias,
though, have been hindered by a key constraint:
Algorithms deployed on large scales are typically
proprietary, making it difficult for independent researchers to dissect them. Instead, re-researcher-created algorithms (10–13). Without an algorithm’s training data, objective function, and prediction methodology, we can only
guess as to the actual mechanisms for theimportant algorithmic disparities that arise.
In this study, we exploit a rich dataset thatprovides insight into a live, scaled algorithm
deployed nationwide today. It is one of thelargest and most typical examples of a classof commercial risk-prediction tools that, by
industry estimates, are applied to roughly
200 million people in the United States eachyear. Large health systems and payers rely on
this algorithm to target patients for “high-riskcare management” programs. These programs
seek to improve the care of patients withcomplex health needs by providing additional
resources, including greater attention fromtrained providers, to help ensure that care iswell coordinated. Most health systems use
these programs as the cornerstone of population health management efforts, and they

Data and analytic strategy

Working with a large academic hospital, we
identified all primary care patients enrolled
in risk-based contracts from 2013 to 2015. Our

Downloaded from http://science.sciencemag.org/ on June 20, 2021

Health systems rely on commercial prediction algorithms to identify and help patients with complex
health needs. We show that a widely used algorithm, typical of this industry-wide approach andaffecting millions of patients, exhibits significant racial bias: At a given risk score, Black patientsare considerably sicker than White patients, as evidenced by signs of uncontrolled illnesses.
Remedying this disparity would increase the percentage of Black patients receiving additional
help from 17.7 to 46.5%. The bias arises because the algorithm predicts health care costs rather thanillness, but unequal access to care means that we spend less money caring for Black patients thanfor White patients. Thus, despite health care cost appearing to be an effective proxy for healthby some measures of predictive accuracy, large racial biases arise. We suggest that the choice of
convenient, seemingly effective proxies for ground truth can be an important source of algorithmic
bias in many contexts.

rithm. It contains both the algorithm’s predictions as well as the data needed to understandits inner workings: that is, the underlying ingredients used to form the algorithm (data,
objective function, etc.) and links to a rich
set of outcome data. Because we have theinputs, outputs, and eventual outcomes, ourdata allow us a rare opportunity to quantify
racial disparities in algorithms and isolate themechanisms by which they arise. It should beemphasized that this algorithm is not unique.
Rather, it is emblematic of a generalized approach to risk prediction in the health sector, widely adopted by a range of for- andnon-profit medical centers and governmental
agencies (21).
Our analysis has implications beyond what
we learn about this particular algorithm. First,
the specific problem solved by this algorithm
has analogies in many other sectors: The predicted risk of some future outcome (in ourcase, health care needs) is widely used to target policy interventions under the assumptionthat the treatment effect is monotonic in that
risk, and the methods used to build the algorithm are standard. Mechanisms of bias uncovered in this study likely operate elsewhere.
Second, even beyond our particular finding,
we hope that this exercise illustrates the importance, and the large opportunity, of studying algorithmic bias in health care, not justas a model system but also in its own right. By
any standard—e.g., number of lives affected,
life-and-death consequences of the decision—
health is one of the most important and widespread social sectors in which algorithms are
already used at scale today, unbeknownst
to many.

Lack of sufficient data: Variability• How to deal with variability?
– Population variability (normal vs pathologies)– Image acquisition variability (e.g. due to scanner differences)

Data during training

Data during deployment

Lack of sufficient data: Variability• How to deal with variability?
– Population variability (normal vs pathologies)– Image acquisition variability (e.g. due to scanner differences)Stress

Rest

Cine

LGE

Different hardware

CTMR

Lack of sufficient data: Domain shift
Source (S)Domain:Target (T)Task:
Given:

Learn:

Target (T)Domain:Task:
Here:
Domain Shift:

m
o
D

a in

S

t
h if

!

Source (S)Lack of sufficient data: How to address?
4

C. Chen et al.
Data augmentation

Learning domain invariant features

Segmentation loss

Scanner A

C. Chen et al. MICCAI 2020, 2021, 2022

Discriminator loss~

Scanner B
K. Kamnitsas et al. IPMI 2017

Gaussiandistribution
Training
image

Spatially-variable
blendingKL
divergence~

Network weights re-sampled ineach iteration

Image withnew appearance

Augmented image

Fig. 1: A) the original use of MixStyle as feature augmentation-based
regularizaC. Ouyang et al., IEEE TMI in press
tion method with a standard encoder-decoder structure. B) MixStyle applied toregularize a dual-branch network with an auxiliary image decoder D i attached
for image reconstruction. C) We propose to apply MixStyle in the auxiliary decoder D to generate stylized images for feature-to-input space data augmen-

Prediction

Privacy-preserving AI/ML
Access to large datasets during training is critical …
… but how do we ensure privacy?

Federated learning

HospitalA

HospitalB

HospitalCFederated learning

HospitalA

HospitalB

HospitalCFederated learning

HospitalA

HospitalB

HospitalCBut federated learning is not enough!
Privacy-Centred attacks:

Utility-Centred attacks:• Attempt to disclose information
participants did not consent todisclosing• Examples include:• Attempt to subvert the protocol
and alter the utility of the model• Examples include:• Membership– Crafting malicious data or updates• Sensitive attributes– Hidden collateral tasks– etc.

• Training records• Reconstruction• etc.

b

But federated learning is not enough!
ARTICLESabc

Original
Original

NATURE MACHINE INTELLIGENCE
Model
Inversion
DP–/SecAgg–

DP+/SecAgg+

underline th
been discuss
privacy guar
federation m
gradient-bas
lizing SMPC
ties, even in
The DP secu
deviations) w
age, especial
ing (for examsuch as age
inference rev
either party.
Compareing on key-b
network trai
complexity odue to func
tions, comming factor fo
an SMPC prbuilding upo
SecureNN29
a single roun
more commcially whenwith high lat
public web as
we confirm tsets: secure i
FSS protocol
zation over S
honest-but-c

Discussion
on privacy-enhancing
techniques. The inclusion of
Original
Model Inversioncmethods offering provable privacy and security guarantees in the
FL process is a crucial step towards the widespread implementationof privacy-preserving AI technologies8. The successful reconstruction of images from unprotected models in our attack experiments
underline the risks of such attacks to patient privacy, which has also
been discussed in previous work6,39. DP training provides objective
privacy guarantees in case of attacks against the model both by confederation members and during inference and is not limited to thegradient-based inversion attack we use in our example. SecAgg utilizingd SMPC only discloses the aggregate model update to the parties, even in case up to n − 1 out of n parties collude to reveal data.
The DP secure aggregation of dataset statistics (means and standard
deviations) we propose can protect FL participants from data leakage, especially when non-imaging data is included in model building (for example clinical records, in which the means of features
such as age represent sensitive information). Finally, encrypted
inference reveals no information about the data or the model toeither party.
Compared with fully homomorphic encryption protocols40 relyFig.key-based
5 | Overviewcryptography,of the gradient-based
attacks against
PriMIAing onwhose privacy
implementation
for neural
using
the
MedNISTdatasetinavarietyof
scenarios.
Theoriginal
image isComparison
network training and inferenceis et
impededby thecomputational
Kaissisal.
NatureMachineIntelligence,2021
shown (original)
alongside thereconstruction
from a modeltrainedduce PPML
complexityof the encryption
processand the results
performancedecreasesecure approximation
aggregation or DPfor(DP–/SecAgg–)
well as a modelent a front-e
due without
to function
for exampleasactivation
functrained
with
DP
and
SecAgg(DP+/SecAgg+).
In
every
case,thethe limitattack
DP, SecAgg
tions, communication overhead has traditionally been
reveals
confidential
information
about
the
patient
when
the
model
is
trained26
bit.ly/3pl5dD
ing factor for SMPC. In our recent work, we introduced AriaNN ,withoutprotocol
privacy-enhancing
techniques.
Breast sharing
MRI revealing
28
encryption f
an SMPCleveraging
functiona,secret(FSS)absence
and
of
the
right
breast,likelydue
tooperative
removaldue
tobreastcancer.
b,25
inference cap
building upon SPDZ . It represents an alternative to protocols like

Bring privacy-preserving machine learning to clinicalroutineARTICLES
https://doi.org/10.1038/s42256-021-00337-8

End-to-end privacy preserving deep learning on
multi-institutional medical imaging
Georgios Kaissis! !1,2,3,4,13, Alexander Ziller! !1,2,4,13, Jonathan Passerat-Palmbach3,4,5, Théo Ryffel! !4,6,7,
Dmitrii Usynin! !1,2,3,4, Andrew Trask4,8, Ionésio Lima Jr4,9, Jason Mancuso4,10, Friederike Jungmann1,
Marc-Matthias Steinborn! !11, Andreas Saleh11, Marcus Makowski1, Daniel Rueckert2,3 andRickmer Braren! !1,12 ✉Using large, multi-national datasets for high-performance medical imaging AI systems requires innovation in privacy-preserving
machine learning so models can train on sensitive data without requiring data transfer. Here we present PriMIA(Privacy-preserving Medical Image Analysis), a free, open-source software framework for differentially private, securely
aggregated federated learning and encrypted inference on medical imaging data. We test PriMIA using a real-life case study inwhich an expert-level deep convolutional neural network classifies paediatric chest X-rays; the resulting model’s classification
performance is on par with locally, non-securely trained models. We theoretically and empirically evaluate our framework’s performance and privacy guarantees, and demonstrate that the protections provided prevent the reconstruction of usable data by
a gradient-based model inversion attack. Finally, we successfully employ the trained model in an end-to-end encrypted remote
inference scenario using secure multi-party computation to prevent the disclosure of the data and the model.

Privacy-preserving machine learning:
Differential privacy

Figure from https://www.nist.gov/blogs/cybersecurity-insights/differential-privacy-privacy-preserving-data-analysis-introduction-ourPrivacy-preserving machine learning:
Differential privacy

Figure from https://www.nist.gov/blogs/cybersecurity-insights/differential-privacy-privacy-preserving-data-analysis-introduction-ourPrivacy-preserving machine learning:
Differentially private stochastic gradient descent• Algorithm:
1. Compute gradients for eachindividual sample (they represent
independent clients)
2. Clip the calculated gradients toobtain a known sensitivity
3. Add the noise scaled by thesensitivity from step 2
4. Perform the gradient descent step

Abadi, Martin, et al. "Deep learning with differential privacy." Proceedings of the 2016
ACM SIGSAC conference on computer and communications security. 2016.

b

Privacy-preserving machine learning:
Adding differential privacy
ARTICLESabc

Original
Original

NATURE MACHINE INTELLIGENCE
Model
DP-/SecAggInversion
DP–/SecAgg–

DP+/SecAgg_
DP+/SecAgg+

underline th
been discuss
privacy guar
federation m
gradient-bas
lizing SMPC
ties, even in
The DP secu
deviations) w
age, especial
ing (for examsuch as age
inference rev
either party.
Compareing on key-b
network trai
complexity odue to func
tions, comming factor fo
an SMPC prbuilding upo
SecureNN29
a single roun
more commcially whenwith high lat
public web as
we confirm tsets: secure i
FSS protocol
zation over S
honest-but-c

Discussion
on privacy-enhancing
techniques. TheDP+/SecAgg_
inclusion of
Original
Model
DP-/SecAggInversioncmethods offering provable privacy and security guarantees in the
FL process is a crucial step towards the widespread implementationof privacy-preserving AI technologies8. The successful reconstruction of images from unprotected models in our attack experiments
underline the risks of such attacks to patient privacy, which has also
been discussed in previous work6,39. DP training provides objective
privacy guarantees in case of attacks against the model both by confederation members and during inference and is not limited to thegradient-based inversion attack we use in our example. SecAgg utilizingd SMPC only discloses the aggregate model update to the parties, even in case up to n − 1 out of n parties collude to reveal data.
The DP secure aggregation of dataset statistics (means and standard
deviations) we propose can protect FL participants from data leakage, especially when non-imaging data is included in model building (for example clinical records, in which the means of features
such as age represent sensitive information). Finally, encrypted
inference reveals no information about the data or the model toeither party.
Compared with fully homomorphic encryption protocols40 relyFig.key-based
5 | Overviewcryptography,of the gradient-based
attacks against
PriMIAing onwhose privacy
implementation
for neural
using
the
MedNISTdatasetinavarietyof
scenarios.
Theoriginal
image isComparison
network training and inferenceis et
impededby thecomputational
Kaissisal.
NatureMachineIntelligence,2021
shown (original)
alongside thereconstruction
from a modeltrainedduce PPML
complexityof the encryption
processand the results
performancedecreasesecure approximation
aggregation or DPfor(DP–/SecAgg–)
well as a modelent a front-e
due without
to function
for exampleasactivation
functrained
with
DP
and
SecAgg(DP+/SecAgg+).
In
every
case,thethe limitattack
DP, SecAgg
tions, communication overhead has traditionally been
reveals
confidential
information
about
the
patient
when
the
model
is
trained26
bit.ly/3pl5dD
ing factor for SMPC. In our recent work, we introduced AriaNN ,withoutprotocol
privacy-enhancing
techniques.
Breast sharing
MRI revealing
28
encryption f
an SMPCleveraging
functiona,secret(FSS)absence
and
of
the
right
breast,likelydue
tooperative
removaldue
tobreastcancer.
b,25
inference cap
building upon SPDZ . It represents an alternative to protocols likeb

Privacy-preserving machine learning:
Adding differential privacy
ARTICLESabc

Original
Original

NATURE MACHINE INTELLIGENCE
Model
DP-/SecAggInversion
DP–/SecAgg–

DP+/SecAgg_
with DP
DP+/SecAgg+

underline th
been discuss
privacy guar
federation m
gradient-bas
lizing SMPC
ties, even in
The DP secu
deviations) w
age, especial
ing (for examsuch as age
inference rev
either party.
Compareing on key-b
network trai
complexity odue to func
tions, comming factor fo
an SMPC prbuilding upo
SecureNN29
a single roun
more commcially whenwith high lat
public web as
we confirm tsets: secure i
FSS protocol
zation over S
honest-but-c

Discussion
on privacy-enhancing
techniques. TheDP+/SecAgg_
inclusion
Original
Model
DP-/SecAggInversion
with DPofcmethods offering provable privacy and security guarantees in the
FL process is a crucial step towards the widespread implementationof privacy-preserving AI technologies8. The successful reconstruction of images from unprotected models in our attack experiments
underline the risks of such attacks to patient privacy, which has also
been discussed in previous work6,39. DP training provides objective
privacy guarantees in case of attacks against the model both by confederation members and during inference and is not limited to thegradient-based inversion attack we use in our example. SecAgg utilizingd SMPC only discloses the aggregate model update to the parties, even in case up to n − 1 out of n parties collude to reveal data.
The DP secure aggregation of dataset statistics (means and standard
deviations) we propose can protect FL participants from data leakage, especially when non-imaging data is included in model building (for example clinical records, in which the means of features
such as age represent sensitive information). Finally, encrypted
inference reveals no information about the data or the model toeither party.
Compared with fully homomorphic encryption protocols40 relyFig.key-based
5 | Overviewcryptography,of the gradient-based
attacks against
PriMIAing onwhose privacy
implementation
for neural
using
the
MedNISTdatasetinavarietyof
scenarios.
Theoriginal
image isComparison
network training and inferenceis et
impededby thecomputational
Kaissisal.
NatureMachineIntelligence,2021
shown (original)
alongside thereconstruction
from a modeltrainedduce PPML
complexityof the encryption
processand the results
performancedecreasesecure approximation
aggregation or DPfor(DP–/SecAgg–)
well as a modelent a front-e
due without
to function
for exampleasactivation
functrained
with
DP
and
SecAgg(DP+/SecAgg+).
In
every
case,thethe limitattack
DP, SecAgg
tions, communication overhead has traditionally been
reveals
confidential
information
about
the
patient
when
the
model
is
trained26
bit.ly/3pl5dD
ing factor for SMPC. In our recent work, we introduced AriaNN ,withoutprotocol
privacy-enhancing
techniques.
Breast sharing
MRI revealing
28
encryption f
an SMPCleveraging
functiona,secret(FSS)absence
and
of
the
right
breast,likelydue
tooperative
removaldue
tobreastcancer.
b,25
inference cap
building upon SPDZ . It represents an alternative to protocols like

What’s next?

Traditional medical imaging

Acquisition

Reconstruction

AnalysisInterpretation! Serial process with no interaction between different components of imaging pipeline! Limited ability for adjustment of upstream imaging pipeline based on downstream
requirements! Stages of imaging pipeline not optimized for clinical endpoint

AI-enabled medical imaging

Acquisition

Reconstruction

Analysisü Close coupling of acquisition, reconstruction, analysis and interpretation
ü Feedback and interaction between components of imaging pipelineü Optimization of whole imaging pipeline with respect to clinical endpoint

Interpretation

AI-enabled medical imaging“They should stop training radiologists now.”
Geoffrey Hinton (godfather of deep learning) in 2017
"To the question, will AI replace radiologists, I
say the answer is no…”“… but radiologists who do AI will replace
radiologists who don’t."
Curtis Langlotz in 2017

AI-enabled medical imaging

Acquisition?
Do we need images at all?

Diagnosis

Acknowledgements

Acknowledgements
Lab for AI in Medicine @https://aim-lab.io/@

https://biomedia.doc.ic.ac.uk/