# Privacy-Preserving Transfer Learning Framework for Kidney Disease Detection
## 4 The Proposed Framework  
This paper introduces a novel and comprehensive framework that offers the dual capability of kidney disease detection and privacy protection. The identification of kidney disease is achieved by the use of transfer learning methods, namely Xception, ResNet50, InceptionResnetV2, MobileNet, VGG19, InceptionV3, and DenseNet201, with fine-tuning. These methods are robust algorithms extensively employed for image classification tasks. Furthermore, the differential privacy paradigm is used to ensure data privacy. Differential privacy can be implemented at several stages of any deep learning system [41]. The proposed framework applies differential privacy to the gradients. Therefore, a differentially private Adam (DP-Adam) optimizer is used in the proposed framework, which is indicated in Figure 10.  
Gradient perturbation via differential privacy ensures privacy by releasing a noisy gradient at each iteration while yet allowing for post-processing of data [8]. Developing an optimization algorithm that satisfies differential privacy is based on a differentially private stochastic gradient descent in which differential privacy is applied in the gradient computation phase. In [42], it is emphasized that traditional gradient computation is performed according to the Equation (9), in which \(g\), \(m^{\prime}\), \(\mathcal{L}\), \(x_{i}\), and \(\theta_{t}\) indicate gradients, number of elements in mini-batch, loss function, element in mini-batch, and position, respectively:  
\[g=\frac{1}{m^{\prime}}\sum_{i=1}^{m^{\prime}}\
abla_{\theta}\mathcal{L}(x_{i},\theta_{t}) \tag{9}\]  
In addition, the update rules in Adam optimizer are given in detail in [42]. After the calculation of gradients, bounded gradients \(\overline{g}\) are computed to ensure the gradients are bounded by C:  
\[\overline{g}=\frac{g}{max\left(1,\frac{\|g\|_{2}}{\text{C}}\right)} \tag{10}\]  
Now, it is time to calculate noisy gradients by adding noise picked from a distribution mechanism:  
\[\widetilde{g}=\overline{g}+z \tag{11}\]  
Figure 10: The proposed framework. Figure 9: CT examples for cyst, stone, normal, and tumor. In Equation (11), z indicates a vector of random variables. Finally, the noisy gradient \(\stackrel{{\sim}}{{g}}\) satisfies differential privacy. In this framework, input image is preprocessed and then transfer learning algorithms are applied for feature extraction. Then the features are flattened, and dense layers which consist of neural networks are applied for the classification task. Dense layers consist of three layers containing 64, 32, and 4 neurons with ReLU and Softmax activators. The DP-Adam optimizer algorithm optimizes the parameters of the neural networks by respecting privacy. Then training and validation loss are compared and then this process iterates for N epochs. Finally, the outputs are obtained. Some details about the proposed framework shown in Figure 10 are given below:  
1. Image input: the input image is read for processing;
2. Image preprocessing: the read image is firstly resized to 100 \(\times\) 100, normalized, and then split for 70% training and 30% testing;
3. Feature extraction: the features of the images are extracted by using a transfer learning algorithm;
4. Flattening: the extracted features are flattened to a one-dimensional array;
5. Creation of dense layers: three dense layers are used to create a neural network architecture with the number of neurons--64, 32, and 4. ReLU activator is used in the first two layers, and SoftMax activator is employed for the last layer;
6. Compiling model: the model is compiled in order to fit the model;
7. Differentially private optimizer: the optimizer is made differentially private in order to provide privacy;
8. Loss comparison: training and validation loss are compared;
9. Iteration: in order to optimize the model weights, the process is iterated;
10. Output: the classification results are obtained.