HideMIA: Hidden Wavelet Mining for Privacy-Enhancing Medical Image Analysis

Authors: xun  lin
yi  yu
zitong  yu
ruohan  meng
jiale  zhou
ajian  liu
yizhong  liu
shuai  wang
wenzhong  tang
zhen  lei
  casia
alex  kot
  hidemia
Venue: acmmm_org_ACMMM_2024_Conference
Published: 2024-03-07 13:31:10

Abstract: Despite the advancements that deep learning has brought to medical image analysis (MIA), protecting the privacy of images remains a challenge. In a client-server MIA framework, especially after deployment, patients' private medical images can be easily captured by attackers from the transmission channel or malicious third-party servers. Previous MIA privacy-enhancing methods, whether based on distortion or homomorphic encryption, expose the fact that the transmitted images are medical images or transform the images into semantic-lacking noise. This tends to alert attackers, thereby falling into a cat-and-mouse game of theft and protection. To address this issue, we propose a covert MIA framework based on deep image hiding, namely HideMIA, which secures medical images by embedding them within natural cover images that are unlikely to raise suspicion. By directly analyzing the hidden medical images in the steganographic domain, HideMIA makes it difficult for attackers to notice the presence of medical images. Specifically, we propose the Mixture-of-Difference-Convolutions (MoDC) and Asymmetric Wavelet Attention (AsyWA) to enable HideMIA to conduct fine-grained analysis on each wavelet sub-band within the steganographic domain, mining features that are specific to medical images. Moreover, to reduce resource consumption on client devices, we design function-aligned knowledge distillation to obtain a lightweight hiding network, namely LightIH. Extensive experiments on six medical datasets demonstrate that our HideMIA achieves superior MIA performance and protective imperceptibility on medical image segmentation and classification.

Main paper: 
 introduction: 
 Deep learning technologies have rapidly advanced in Medical Image Analysis (MIA) and have become an integral part of modern medical diagnostics [19] . These technologies significantly improve the accuracy and efficiency of clinical diagnosis, e.g. early screening for major diseases such as cancer [31] . Despite the impressive performance of deep neural networks, there are increasing concerns about the security issues [30, 39, 49, 50, [56] [57] [58] associated with artificial intelligence. Among these security issues, the protection of patient privacy remains a severe challenge [38] . From a legal and ethical perspective, patients' medical images must be rigorously protected, ensuring the security and privacy of these images during their storage, transmission, and analysis processes Our HideMIA makes the attacker hardly notice the existence of medical images. [18] . Some medical institutions have adopted methods such as data anonymization or pseudonymization [3] to mitigate the risk of data leakage. However, real-world scenarios indicate that these methods are not robust against re-identification attacks [19] . As illustrated in Fig. 1 (a), there is a risk of leakage, especially during the transmission of images from a client to a server [2] . Although techniques like non-homomorphic image encryption can prevent image leakage during transmission (see Fig. 1 (b)), they are not robust to attacks from malicious servers [20] . Once an attacker controls the server by system vulnerabilities or embedded malicious backdoors (as a thirdparty server provider), the decrypted images on the server-side are also at the risk of being captured. Currently, most image privacy enhancement technologies focus on the training phase, for instance, by enabling different institutions to collaboratively train models without the direct exchange of image data through federated learning [11] , or by generating unlearnable examples to prevent unauthorized model training [30] . These methods effectively enhance the privacy protection of training data, yet image protection after the model deployment remains a challenge. Some studies focus on protecting images after deployment through distortion-based [9, 20, 40] methods to modify detailed information of the original images. Although these methods somewhat protect image privacy, attackers can easily notice that the transmitted images are medical images. To further enhance security, recent works propose encoding-based [21, 45] and homomorphicencryption-based [55, 63] methods to protect medical images. However, these methods significantly alter the distribution of the images, easily alerting attackers to the fact that the images are protected by specific techniques, thus falling into a cat-and-mouse game of encryption and decryption. Among these methods, methods based on homomorphic encryption are time-consuming, making them impractical for many real-world applications.Recent progress in deep image hiding (DIH) networks [12, 17, 26] , which are proposed to conceal a secret image within a cover image for covert image transmission, has inspired us to propose a novel framework to perform Hidden Medical Image Analysis (HideMIA) based on DIH. As shown in Fig. 1(c ), HideMIA hides a medical image within a natural photo, allowing for direct MIA in the steganographic domain without the image extraction and decryption on the server-side. However, directly performing MIA in the steganographic domain is challenging because the medicalspecific features within stego images are subtle, and the conspicuous information from the cover images introduces noise to the MIA.Considering that DIH networks tend to hide the information of the secret image in high-frequency parts of the cover images [17] , we design the spectral-aware Mixture-of-Difference-Convolutions (MoDC) and Asymmetric Wavelet Attention (AsyWA) to solve the problems above. These two modules are integrated with HideMIA's server-side MIA network. They can perform band-adaptive analysis on stego images in the steganographic domain (targeting different bands after discrete wavelet transform [14] ). Specifically, within MoDC, inspired by [23, 29, 46, 59] , we introduce various novel pixel difference convolutions to extract features of the hidden medical images in a fine-grained manner. Considering that the content and form of hidden information may vary across different bands, we bring the idea of the Mixture-of-Experts (MoE) [24, 62] to these convolutions, enabling adaptive combinations of these difference convolutions for each frequency band. Meanwhile, we propose interband and inner-band cross-attention with AsyWA to enable a global perception of concealed medical images across spatial and spectral dimensions. Considering that most of the semantic information in the cover belongs to the low-frequency bands, we design an asymmetric interaction constraint for inter-band cross-attention to ensure global perception while preventing cover-specific features in the low-frequency band from hindering the extraction of medicalrelated features in the high-frequency bands.Moreover, existing DIH networks are not resource-friendly for clients with limited computing resources, e.g., medical imaging devices. Therefore, motivated by [33] , we propose the functionaligned knowledge distillation to obtain a lightweight DIH network, namely LightIH. Unlike the feature-aligned knowledge distillations, our function-aligned distillation ensures that the student network learns sensitive features that influence analysis performance and imperceptibility during the distillation process. We employ the widely-used INN-based and spectrum-aware DIH network, HiNet, which is sensitive to manipulations in the steganographic domain [8] , as the teacher network. To the best of our knowledge, this is the first work to develop a lightweight DIH network through knowledge distillation.Our contributions can be summarized as follows:• We propose a privacy-enhancing client-server MIA framework, namely HideMIA, to covertly analyze medical images without raising the suspicions of attackers.• We design MoDC and AsyWA for wavelet-transformed stego images to ensure that HideMIA can accurately perform MIA in the steganographic domain without interference from conspicuous information in the covers.• We develop LightIH, which, through the proposed functionaligned distillation, reduces the resource consumption of the DIH network while enhancing the accuracy of the MIA process.• Extensive experiments on three image segmentation datasets and three image classification datasets demonstrate the effectiveness and imperceptibility of HideMIA. 
related works 2.1 privacy enhancement for medical images: 
 Distortion-based Methods. To prevent threats from transmission channels and malicious servers, privacy-preserving client-server frameworks are proposed for medical image analysis. Kim et al. [22] protect the privacy of medical images in the segmentation pipeline by adding the images sent from the client with reference images. Kim et al. [20] , Packhäuser et al. [40] propose deformation generators to produce pseudo-random non-linear deformation for images from the client, which allows both distortion and recovery of the sensitive information of medical images and segmentation results. These distortion-based methods can defend against reconstruction and re-identification attacks, however, they still let attackers recognize that the transmitted images are medical.Encoding-based and Encryption-based Methods. To further enhance privacy, encoding-based and encryption-based are proposed to change the content distribution of medical images. [21] design an encoder to remove identity-related information from medical images and propose a discriminator to identify ROI. Shiri et al. [45] adopt a learnable auto-encoder that employs convolution operations for the sparse transformation of medical images and adds pseudo-random noise to further obfuscate them. The effectiveness of homomorphic encryption is discussed in [55, 64] to further improve privacy protection for distributed medical image segmentation. Although encoding-based and encryption-based methods achieve better protective performance, these methods alter the image into feature maps or noise that are difficult for humans to understand. This may easily alert attackers and prompt them to design more threatening attacks.Image hiding aims to covertly conceal a secret image within a cover image and enables the extraction of the hidden secret image. Baluja [4] , Hayes, and Danezis [13] are the first to propose DIH networks based on the encoder-decoder structure. Liu et al. [36] improve the encoder based on U-Net and discrete wavelet transformation (DWT) [14] to embed the secret image, further enhancing the reversibility. Recent progress on invertible neural networks (INNs) in various image-to-image tasks [51, 52] has inspired the application of INNs in image hiding. Lu et al. [37] design INN-based image hiding by modeling the embedding and extraction processes as the forward and inverse operations in affine transformations. To enhance reversibility and imperceptibility, Deng et al. [8, 12, 17] input the wavelet-transformed cover image and secret image into an INN-based image hiding network, thereby embedding the secret into the high-frequency components of the cover. Xu et al. [53] propose a conditional normalizing flow to model the distribution of the redundant high-frequency component conditioned on the cover images, enhancing robustness against distortion. 
hidemia 3.1 overall framework: 
 Our HideMIA consists of image hiding network ℋ(⋅, ⋅), medical image analysis network ℳ(⋅), and image recovering networks ℛ(⋅). The image hiding and image recovering networks are deployed on the client-side, while the medical image analysis network operates on the server. Let 𝒙𝑠𝑒𝑐𝑟𝑒𝑡 denote the image captured by medical imaging devices, and 𝒙𝑐𝑜𝑣𝑒𝑟 represent the cover image (which can be any natural image) adopted to conceal 𝒙𝑠𝑒𝑐𝑟𝑒𝑡 within. The process 𝒙𝑠𝑡𝑒𝑔𝑜 = ℋ(𝒙𝑠𝑒𝑐𝑟𝑒𝑡 , 𝒙𝑐𝑜𝑣𝑒𝑟 ) yields a stego image, wherein 𝒙𝑠𝑒𝑐𝑟𝑒𝑡 is embedded into 𝒙𝑐𝑜𝑣𝑒𝑟 . After the concealment, 𝒙𝑠𝑡𝑒𝑔𝑜 is transmitted from the client to the server, where it is directly fed into the MIA network: 𝒙 𝑚𝑖𝑎 = ℳ(𝒙𝑠𝑡𝑒𝑔𝑜 ). The MIA network analyzes the concealed medical image within the steganographic domain. Upon returning 𝒙 𝑚𝑖𝑎 to the client, the recovery network extracts the hidden analysis results as ŷ = ℛ(𝒙 𝑚𝑖𝑎 ). In this pipeline, both 𝒙 𝑚𝑖𝑎 and 𝒙𝑠𝑡𝑒𝑔𝑜 are easily captured by attackers, thus we require 𝒙 𝑚𝑖𝑎 and 𝒙𝑠𝑡𝑒𝑔𝑜 remain visually indistinguishable from 𝒙𝑐𝑜𝑣𝑒𝑟 to ensure covert MIA without raising the attackers' suspicion.We observe that existing MIA methods struggle to conduct precise and covert analysis within the steganographic domain. They often produce numerous false alarms and struggle to maintain visual consistency between 𝒙 𝑚𝑖𝑎 and 𝒙𝑠𝑡𝑒𝑔𝑜 , primarily due to the presence of conspicuous information in the cover image. Consequently, we propose the Mixture-of-Difference-Convolutions (MoDC) and Asymmetric Wavelet Attention (AsyWA) to perform fine-grained and cover-agnostic MIA in the steganographic domain. In our MIA network, 𝒙𝑠𝑡𝑒𝑔𝑜 is decomposed into four wavelet sub-bands usingDWT: 𝒙 𝐿𝐿 𝑠𝑡𝑒𝑔𝑜 , 𝒙 𝐿𝐻 𝑠𝑡𝑒𝑔𝑜 , 𝒙 𝐻 𝐿 𝑠𝑡𝑒𝑔𝑜 , 𝒙 𝐻𝐻 𝑠𝑡𝑒𝑔𝑜 ∈ R 𝐻 2 × 𝑊 2 ×3. These represent low (L) and high (H) frequencies across horizontal and vertical directions, detailing 𝒙𝑠𝑡𝑒𝑔𝑜 's frequency spectrum diversely. We utilize U-Net [44] as the backbone for each sub-network, with the output dimension segmentation heads set to 3. Both MoDC and AsyWA are integrated within each sub-network. The outputs from these sub-networks, namely𝒙 𝐿𝐿 𝑚𝑖𝑎 , 𝒙 𝐿𝐻 𝑚𝑖𝑎 , 𝒙 𝐻 𝐿 𝑚𝑖𝑎 , 𝒙 𝐻𝐻 𝑚𝑖𝑎 ∈ R 𝐻 2 × 𝑊 2 ×3, are combined using Inverse Wavelet Transform (IWT) to compose 𝒙 𝑚𝑖𝑎 , and then returned to the client.Besides, we notice the guidance of original 𝒙 𝐿𝐿 𝑠𝑡𝑒𝑔𝑜 can significantly improve the visual similarity between 𝒙 𝑚𝑖𝑎 and 𝒙𝑠𝑡𝑒𝑔𝑜 , thereby enhancing the HideMIA's imperceptibility. Specifically, since most of the semantic information in the cover, rather than the secret, is distributed within the LL band, we allow the LL subnetwork to learn the residual of 𝒙 𝐿𝐿 𝑠𝑡𝑒𝑔𝑜 as follows: This operation has little impact on MIA performance and significantly improves HideMIA's imperceptibility (even feasibility). In the following sections, we provide detailed descriptions of the proposed MoDC and AsyWA.EQUATIONMixture-of-Difference-Convolutions. To ensure imperceptibility and recoverability, DIH networks tend to conceal different components of the secret image within different frequency bands of the cover images in different manners [25] . This makes the thorough analysis of the concealed information within each band using the same type of convolution operation challenging. Drawing inspiration from Central Difference Convolution (CDC) in detail-required vision tasks (e.g., face anti-spoofing [59] ), we propose four novel directional difference convolution operations, i.e., horizontal, vertical, left diagonal, and right diagonal, to adapt to different bands generated by DWT, accommodating the high-and low-frequency bands in horizontal and vertical orientations.Additionally, inspired by the idea of Mixture-of-Experts (MoE) [32, 62] , we design a novel structure based on the newly introduced directional difference convolution operations, namely MoDC. As shown in Fig. 2(b) , MoDC enables the network to adaptively combine the differential convolution operations that are most apt for each frequency band. Specifically, the vanilla convolution 𝒟 0 and the aforementioned five difference convolutions, i.e., 𝒟 1 (central), 𝒟 2 (horizontal), 𝒟 3 (vertical), 𝒟 4 (left diagonal), and 𝒟 5 (right diagonal), can be described as follows:EQUATIONwhere ℛ = {(1,1), (0,1), ⋯, (-1,0), (-1,-1)} is the local respective field of the trainable 3×3 vanilla convolution kernel 𝑤, and 𝑟𝑥 , 𝑟𝑦 denote the current position of the kernel conducting on 𝒙 𝑖𝑛 and 𝒙𝑜𝑢𝑡 . The Gate Multi-Layer Perception (MLP) [48] in Fig. 2 is composed of a sequence of layers: pooling, linear, GELU activation, another linear, and finally Softmax. Gate MLP receives the input feature 𝑥 𝑖𝑛 and outputs the weights 𝛿 ∈ R 5 of five difference convolutions. MoDC then selects 𝑃 = top 𝑘 (𝛿) kernels for activation and normalize their weights. This step is designed to prevent kernels that are not suitable for covert information analysis in the current band.Only the most appropriate difference kernels are conducted on the input features 𝒙 𝑖𝑛 . Subsequently, the outputs of the activated difference convolutions are weighted by their corresponding weights 𝛿 𝑖 , summed, and then subtracted from the output of the vanilla convolution kernel 𝒟 0 , completing the spectrum-aware difference convolution. MoDC is formulated as follows:EQUATIONwhere 𝜆 is used to trade-off between the intensity of vanilla convolution and difference convolutions.Asymmetric Wavelet Attention. As mentioned above, different components of medical images are concealed in varying forms within different frequency bands of the cover image. Therefore, enabling inter-band interactions to acquire a band-wise global perception of the concealed medical images is important. Previous works [12, 17] on DIH validate that the secret image is primarily concealed within the high-frequency parts of an image, e.g. within the non-LL bands in wavelet-transformed images. Consequently, during inter-band interactions, the semantic information within the low-frequency band can easily interfere with the fine-grained analysis of other bands.To solve this problem, we propose the AsyWA, which allows inter-band cross-attention [6] among the features of different frequency bands, achieving global-spectrum perception. Bidirectional feature interactions are permitted among the high-frequency bands (i.e., LH, HL, and HH), but the LL band can only receive cues from the high-frequency bands. AsyWA prevents the cover-specific semantic features mined from the low-frequency spectrum during MIA from misleading the extraction of the medical-specific finegrained information. Additionally, considering the significance of spatial correlations between patches within the same band, we also integrate inner-band attention within AsyWA. Both our interpatch and inner-band attention mechanisms are implemented based on multi-head attention [35] . AsyWA with inter-and inner-band attention can be formulated as follows:L2 Loss × 4 × 4 × 4 × 4 3 1 2 ℋ 1 ℋ 1 ℋ 2 ℋ 2 ℋ 3 ℋ 3 ℋ 4 ℋ 4 DWT DWT 3 1 2 × 4 × 4 × 4 × 4 ℛ 4 ℛ 3 ℛ 2 ℛ 1 ℛ 4 ℛ 3 ℛ 2 ℛ 1 L2 Loss ℳ IWT MIA LossEQUATIONEQUATIONEQUATIONwhere 𝐵 = {𝐿𝐿, 𝐻𝐿, 𝐿𝐻, 𝐻𝐻 } denotes the band set of DWT, 𝐻 = {𝐻𝐿, 𝐿𝐻, 𝐻𝐻 } represents the high-frequency band set, 𝑑 denotes the number of pixels in the input feature, 𝑄, 𝐾,𝑉 are the linear projections corresponding to the query, key, and value, respectively.To make the ℋ and ℛ resource-friendly for clients, we perform knowledge distillation [60] on the state-of-the-art (SOTA) DIH network, HiNet [17] , to obtain a lightweight network, namely LightIH. Please note that HiNet also integrates DWT to improve stego imperceptibility. Existing feature distillation methods for vision tasks commonly [10] use distance such as L2 to align the features at corresponding stages between the student and teacher networks [27] . However, within the HideMIA framework, which includes multiple parts, i.e., ℳ, ℋ, and ℛ, changing the intermediate features in different directions by the same L2 distance at early stages can lead to big differences in the final predictions [34] .To this end, we propose a function-aligned distillation strategy, where we encourage feature alignment solely from the perspective of DIH and MIA performance. This means that the features or outputs from corresponding stages of the teacher and student networks, once fed into the latter part of the same network, should yield closely similar results. Our function-aligned distillation encourages the student to focus more on the sensitive directions concluded by the teacher that significantly impact HideMIA's performance, rather than overly emphasizing the replication of the teacher's intermediate outputs. To ensure HideMIA possesses better MIA capabilities and imperceptibility, we combine the distillation loss, visual consistency loss, and MIA loss to supervise LightIH.As illustrated in Fig. 3 , we adopt the pretrained HiNet (16 layers) as the teacher network. Our student network LightIH consists of 4 INN layers (a quarter of HiNet). We conduct the function-aligned distillation across all phases of HideMIA (hiding, MIA, and recovery). Specifically, both the teacher and student networks are divided into four stages. In the teacher network, each stage consists of 4 INNs, denoted as ℋ 𝑡 𝑖 for hiding and ℛ 𝑡 𝑖 for recovery, while in the student network, each stage includes only one INN (ℋ 𝑠 𝑖 and ℛ 𝑠 𝑖 ). Given that the two DIH backbone are INN-based, the convolution layer weights (𝜙 𝑖 , 𝜌 𝑖 , and 𝜂 𝑖 ) in ℋ 𝑖 and ℛ 𝑖 are shared. As shown in Figs. 3(b)-(c ), only the sequence and operations applied to the inputs differ. Taking the hiding stage as an example, we feed the middle output from the student's ℋ 𝑠 𝑖 into the teacher's ℋ 𝑡 𝑖+1 and pass it through the subsequent blocks of the teacher to obtain 𝒙 𝑡 𝑖 𝑠𝑡𝑒𝑔𝑜 . As formulated in Fig. 3 (a) and Eq. ( 7), these stego images and 𝒙 𝑠 𝑠𝑡𝑒𝑔𝑜 are then supervised with the teacher network's original output 𝒙 𝑡 𝑠𝑡𝑒𝑔𝑜 to guide the function alignment of image hiding.Similarly, after passing through the MIA network, we use a comparable function-aligned supervision (see Eq. ( 7)). In the recovery ); if 𝑗 ≤ 𝑒 1 then # Stage 1: optimizing ℳ ℒ 𝑡𝑜𝑡𝑎𝑙 ← 𝛽 1 ⋅ ℒ 𝑚𝑖𝑎 ( ŷ𝑡 , 𝒚) + 𝛽 2 ⋅ ℒ 𝑝𝑒𝑟𝑐𝑒𝑝𝑡 (𝒙 𝑡 𝑚𝑖𝑎 , 𝒙 𝑐𝑜𝑣𝑒𝑟 ) 𝜃 ℳ ← 𝜃 ℳ -ℓ 1 𝑟 ⋅ ∇ 𝜃 ℳ ℒ 𝑡𝑜𝑡𝑎𝑙 else if 𝑗 ≥ 𝑒 1 then # Stage 2: using ℋ 𝑡 and ℛ 𝑡 to distill ℋ 𝑠 and ℛ 𝑠 𝒙 𝑠 𝑠𝑡𝑒𝑔𝑜 , {𝒙 𝑡 𝑖 𝑠𝑡𝑒𝑔𝑜 } 3 𝑖=1 ← ℋ 𝑠 (𝒙 𝑐𝑜𝑣𝑒𝑟 , 𝒙 𝑠𝑒𝑐𝑟𝑒𝑡 , ℋ 𝑡 ); 𝒙 𝑠 𝑚𝑖𝑎 , {𝒙 𝑡 𝑖 𝑚𝑖𝑎 } 3 𝑖=1 ← ℳ(𝒙 𝑠 𝑠𝑡𝑒𝑔𝑜 , {𝒙 𝑡 𝑖 𝑠𝑡𝑒𝑔𝑜 } 3 𝑖=1 ); ŷ𝑠 , { ŷ𝑡 𝑖 } 3 𝑖=1 ← ℛ 𝑠 (𝒙 𝑠 𝑚𝑖𝑎 , {𝒙 𝑡 𝑖 𝑠𝑡𝑒𝑔𝑜 } 3 𝑖=1 , ℛ 𝑡 ); ℒ ℎ𝑖𝑑𝑒 𝑑𝑖𝑠𝑡 ← ℓ 2 (𝒙 𝑠 𝑠𝑡𝑒𝑔𝑜 , 𝒙 𝑡 𝑠𝑡𝑒𝑔𝑜 ) + ∑ 3 𝑖=1 ℓ 2 (𝒙 𝑡 𝑖 𝑠𝑡𝑒𝑔𝑜 , 𝒙 𝑡 𝑠𝑡𝑒𝑔𝑜 ) ℒ 𝑚𝑖𝑎 𝑑𝑖𝑠𝑡 ← ℓ 2 (𝒙 𝑠 𝑚𝑖𝑎 , 𝒙 𝑡 𝑚𝑖𝑎 ) + ∑ 3 𝑖=1 ℓ 2 (𝒙 𝑡 𝑖 𝑚𝑖𝑎 , 𝒙 𝑡 𝑚𝑖𝑎 ) ℒ 𝑟𝑒𝑐𝑜𝑣𝑒𝑟 𝑑𝑖𝑠𝑡 ← ℒ 𝑚𝑖𝑎 ( ŷ𝑠 , 𝒚) + ∑ 3 𝑖=1 ℒ 𝑚𝑖𝑎 ( ŷ𝑡 𝑖 , 𝒚) 𝜃 ℋ 𝑠 ← 𝜃 ℋ 𝑠 -ℓ 2 𝑟 ⋅ ∇ 𝜃 ℋ 𝑠 (𝛽 1 ⋅ ℒ ℎ𝑖𝑑𝑒 𝑑𝑖𝑠𝑡 + 𝛽 2 ⋅ ℒ 𝑚𝑖𝑎 𝑑𝑖𝑠𝑡 ) 𝜃 ℛ 𝑠 ← 𝜃 ℛ 𝑠 -ℓ 2 𝑟 ⋅ ∇ 𝜃 ℛ 𝑠 (𝛽 3 ⋅ ℒ 𝑟𝑒𝑐𝑜𝑣𝑒𝑟 𝑑𝑖𝑠𝑡 ) if 𝑒 2 ≤ 𝑗 ≤ 𝑒 3 then # Stage 3: optimizing ℳ, ℋ 𝑠 , and ℛ 𝑠 𝜃 ℋ 𝑠 ← 𝜃 ℋ 𝑠 -ℓ 3 𝑟 ⋅ ∇ 𝜃 ℋ 𝑠 (𝛽 1 ⋅ ℒ ℎ𝑖𝑑𝑒 𝑑𝑖𝑠𝑡 + 𝛽 2 ⋅ ℒ 𝑚𝑖𝑎 𝑑𝑖𝑠𝑡 ) 𝜃 ℳ ← 𝜃 ℳ -ℓ 3 𝑟 ⋅ ∇ 𝜃 ℳ (𝛽 2 ⋅ ℒ 𝑚𝑖𝑎 𝑑𝑖𝑠𝑡 + 𝛽 3 ⋅ ℒ 𝑟𝑒𝑐𝑜𝑣𝑒𝑟 𝑑𝑖𝑠𝑡 ) 𝜃 ℛ 𝑠 ← 𝜃 ℛ 𝑠 -ℓ 3 𝑟 ⋅ ∇ 𝜃 ℛ 𝑠 (𝛽 3 ⋅ ℒ 𝑟𝑒𝑐𝑜𝑣𝑒𝑟 𝑑𝑖𝑠𝑡 ) end end end endphase, to maximize the MIA performance while distilling, we directly use the MIA label 𝒚 for supervision. This approach aims to ensure that the student network not only mimics the teacher's functionality closely but also enhances its capability for medical image analysis through direct guidance from the true labels.EQUATIONwhere 𝛼 1 , 𝛼 2 , 𝛼 3 are used to trade-off among these loss functions.We use a multi-stage training strategy to train HideMIA (see Algorithm 1). In the first stage, we freeze the pretrained DIH network and train the MIA network with ℒ 𝑡𝑜𝑡𝑎𝑙 . In the second stage, we freeze the pretrained DIH network and MIA network to prune the LightIH with ℒ 𝑑𝑖𝑠𝑡 . Finally, we use ℒ 𝑡𝑜𝑡𝑎𝑙 to supervise the finetuning of the whole HideMIA, i.e., MIA network and LightIH. Note that ℒ 𝑑𝑖𝑐𝑒 is not included for the classification task.EQUATIONwhere 𝛽 1 , 𝛽 2 are used to trade-off between ℒ 𝑚𝑖𝑎 and ℒ𝑝𝑒𝑟𝑐𝑒𝑝𝑡 . 
experimental setup: 
 Datasets. For comprehensive comparisons, we use six widely used MIA datasets, including three segmentation datasets and three classification datasets. It should be noted that all selected datasets are acquired with different imaging devices and capture distinct subjects. These datasets are BUSI (breast ultrasound tumor segmentation with 612 images) [1] , Kvasir-SEG (endoscopic polyp segmentation with 1,000 images) [16] , ChildDental (tooth X-ray image segmentation with 2,489 images) [5, 15] , SIPaKMed [42] (pathological cervical cell classification with 1,510 images), DermaMNIST [54] (dermatoscopic skin lesion classification with 10,015 images), and ChestCT [41] (chest computed tomography image classification with 1,000 images). For all experiments in this work, we follow the official splitting configuration of the datasets. For those without an official configuration (BUSI, Kvasir-SEG, and SIPaKMed), we randomly divide the data into training and testing sets at a ratio of 8:2. We randomly sample 512 images of MS COCO [28] as the cover image dataset. There is no overlap between the training cover images and testing cover images.Competing Methods. To the best of our knowledge, no method is proposed to perform MIA in the steganographic domain. To ensure a comprehensive and fair comparison, we select three widely used DIH methods (i.e., DeepStega [4] , HiDDeN [65] , and HiNet [17] ) and four famous or SOTA medical image segmentation networks, i.e., U-Net [44] , TransUNet [7] , XNet [61] , and CMUNeXt [47] . Then we pair each DIH method with each segmentation network, forming twelve competing methods. For classification tasks, we also employ a pair of "segmentation network + DIH network" for comparison. This is due to the architecture of our HideMIA, where the MIA network is designed with an encoder-decoder structure. Employing segmentation networks, which also use this encoder-decoder structure, rather than encoder-only structured classification networks, allows fairer comparisons.Evaluation Metrics. Dice Similarity Coefficient (DSC) and Average Surface Distance (ASD) are adopted for medical image segmentation tasks [43] . The medical image classification performance is evaluated by Accuracy (Acc) and Area Under receiver operating characteristic Curve (AUC). We calculate the average Peak Signal-to-Noise Ratio (PSNR) and Structural Similarity Index (SSIM) between 𝒙 𝑚𝑖𝑎 and 𝒙𝑐𝑜𝑣𝑒𝑟 to assess the imperceptibility. We randomly sample five cover images to calculate the mean values of these metrics.Implementation Details. The size of the images is standardized to 224×224. We use the Adam optimizer with learning ratesℓ 1 𝑟 , ℓ 2 𝑟 , ℓ 3 𝑟 of 5×10 -4 , 1×10 -4, 1×10 -5 , respectively. The batch size is 8. During training, all cover images 𝒙𝑠𝑡𝑒𝑔𝑜 are randomly selected. In the loss functions, i.e., Eqs. ( 7)-( 8), the weights 𝛼 1 , 𝛼 2 , 𝛼 3 , 𝛽 1 , and 𝛽 2 are respectively set to 800, 800, 4, 1, and 200. We set 𝜆 of MoDC shown in Eq. (3) to 0.5. For the secret images, 𝒙𝑠𝑒𝑐𝑟𝑒𝑡 , hiding is performed across three channels, and recovery for 𝒙𝑟𝑒𝑠 is also conducted across three channels. During segmentation, the recovered 𝒙𝑟𝑒𝑠 has its three channels averaged followed by a sigmoid activation to obtain the final binary map. For classification tasks, a classification head is appended after the recovered results to obtain the predictions. Segmentation and Classification Results. As shown in Table 1 and Fig. 4 , HideMIA achieves the highest segmentation and classification performance across three datasets compared to other covert MIA methods, respectively. On average, its segmentation performance surpasses that of the second-place CMUNeXt + HiNet by 11.09% in DSC and is lower by 3.07 in ASD. When compared to the vanilla framework (without privacy-enhancing) utilizing U-Net, HideMIA's average performance only shows a slight decrease of 1.57% in DSC, while ASD increases by 0.57. Meanwhile, its classification performance surpasses that of the second-place XNet + DeepStega by 11.60% in Acc and 5.98% in AUC. When compared to the vanilla framework (without privacy-enhancing) utilizing U-Net, HideMIA's average performance only shows a slight decrease of 1.87% in Acc and 2.74% in AUC. This indicates HideMIA's effectiveness in maintaining high MIA performance (both for segmentation and classification) while enhancing privacy protection. We note that XNet is also based on wavelet transforms, similar to HideMIA, underperforms due to its lack of adaptive analysis across different bands, unlike HideMIA. Additionally, despite TransUNet, XNet, and CMUNeXt having incremental designs over U-Net, their performance does not improve across all datasets. This inconsistency can be attributed to the fact that their incremental designs are not effective in the steganographic domain. slightly more than DeepStega and HiDDeN. However, due to our function-aligned distillation strategy, LightIH significantly outperforms DeepStega and HiDDeN in image hiding performance, with a substantial advantage in MIA performance as well. In real-world scenarios, a PSNR over 40 is already very difficult for human eyes to distinguish. Therefore, trading off a slight decrease in imperceptibility for reduced resource consumption and improved MIA performance compared to the teacher network, HiNet, is worthwhile. Besides, we also notice that aligning features directly is not as effective as aligning the DIH and MIA functions in a multi-stage framework like HideMIA. 
conclusion: 
 We propose a covert client-server MIA framework that effectively defends against attacks from both the transmission channel and malicious third-party servers. HideMIA is less likely to arouse suspicion among attackers compared to existing privacy-enhancing MIA methods. Comprehensive experiments demonstrate that within HideMIA, our proposed MoDC and AsyWA enable more effective covert analysis directly in the steganographic domain. Additionally, our LightIH obtained by function-aligned knowledge distillation facilitates the deployment of a lightweight DIH network on the client side, making HideMIA more practical. HideMIA achieves the SOTA MIA performance and imperceptibility in medical image segmentation and image classification. It also brings insight into fine-grained analysis in the steganographic domain. However, as this is the first work to protect the client-server MIA framework through image hiding, there are some limitations that we hope to address in the future: (1) Better imperceptibility. As illustrated in Tables 2 and 7 , the imperceptibility of 𝒙 𝑚𝑖𝑎 is lower than that of 𝒙𝑠𝑡𝑒𝑔𝑜 . After processing through the MIA network, there are usually some stripe-like artifacts (see Fig. 4 ). Eliminating these artifacts would make attackers more difficult to detect. (2) Lossless MIA. Compared to non-privacy-enhancing frameworks, there is still a gap in MIA performance, indicating that the distortion introduced by DIH brings side effects. Designing a nearly lossless covert MIA framework is worth exploring. 
 
 Appendix:  


Decision: Two reviewers are positive and one reviewer is slightly negative towards this work. As membership inference attack is a bit beyond the scope of this work, the discussions on this type of attack can be given in authors' future work. But the authors are recommended to proofread the paper for the final version.

Reviews: review: paper_summary: paper_summary: This paper proposes a framework for medical image steganalysis, HideMIA, which proposes Mixture-of-Difference-Convolutions (MoDC) and Asymmetric Wavelet Attention (AsyWA), enabling HideMIA to perform analysis on each wavelet subband in the steganographic domain. Perform fine-grained analysis to mine carrier image-independent and medical image-specific features. Moreover, in order to reduce the resource consumption of HideMIA on the client device, this paper designs functionally aligned knowledge distillation to obtain a lightweight image hiding network, namely Light IH. This paper is the first work to hide medical images and directly perform medical image analysis on the hidden images. It is also the first work to apply knowledge distillation to develop a lightweight deep image hiding network.
strength_weakness: strength_weakness: 1. The paper has a high degree of novelty. It applies deep image hiding technology to medical image hiding and analysis for the first time, and will develop a lightweight deep image hiding network through knowledge distillation.
2. In Section 3 of the paper, the specific structure of the proposed HideMIA framework is described clearly, and the technical details (such as network structure and training methods) of the proposed MoDC and AsyWA are also very clear.
3. The paper conducts a detailed experimental evaluation, and conducts comparative experiments and ablation experiments on six data sets. The model selection and design for comparison are more reasonable and sufficient, and the display and analysis of the experimental results are also relatively clear, such as the image of Fig4 result.
limitations: limitations: There are some minor problems in the presentation details of the paper, such as an error in the reference to Figure 3 in Section 3.3.
paper_summary: paper_summary: The idea is to use image steganography in training medical image models. Authors suggest a technique called HideMIA (deep image hiding), where medical images can be hidden inside any natural cover image, which makes it difficult for intermediaries to understand that model under training. HideMIA consists of an image hiding network, medical image analysis network (MIA), and image recovering network.
The image hiding and image recovering networks are deployed on the client side, while the medical image analysis network operates on the server.

Note:  Abstract is clear and readable. There is scope for improvement in last 2 sentences with specifics of comparison on how the proposed method is superior with at least one rubric.
strength_weakness: strength_weakness: 1. Novelty: The paper addresses a significant challenge in MIA by proposing a covert framework for protecting medical image privacy.

2. Theoretical Approach: Innovative techniques like Mixture-of-Difference-Convolutions (MoDC) and Asymmetric Wavelet Attention (AsyWA) and Function-Aligned Distillation are introduced, enhancing security while minimizing detection risk.

3. Technical correctness: Paper presents detailed mathematical equations which are well described and formatted, including the algorithms mentioned in the paper.

4. Evaluation: Comprehensive experiments on six datasets demonstrate superior performance of HideMIA in both segmentation and classification tasks, surpassing existing methods. Ablation study is conducted in detail.
limitations: limitations: 1. Model is likely to underperform with training techniques used in Federated learning as they may be more robust and secure. No such comparison is found in paper with alternative methods that may outperform. At least the limited scope assumption should be mentioned.

2. Though discussion section provides limitation and the future scope, specifics are missing and some of the assumptions in synthetic medical cover images itself is contradictory to the purpose of the solution in the paper.

3. Training Process (3.4 section) needs to be expanded to gain more clarity on the steps involved.

4. Comparison of the results (4.2 section) needs to me more detailed for better understating and readability.
paper_summary: paper_summary: This paper introduces a covert Medical Image Analysis (MIA) framework based on deep image hiding, namely HideMIA, where the Mixture-of-Difference-Convolutions (MoDC) and Asymmetric Wavelet Attention (AsyWA) are proposed to enable HideMIA to conduct fine-grained analysis on each wavelet sub-band within the steganographic domain, mining features that are irrelevant to the cover and specific to medical images.
strength_weakness: strength_weakness: 1. The proposed method is effective to a certain extent and the paper is well-written, which makes it easier to understand the methodology proposed by the authors.
2. The experimental design is reasonable and convincing. Ablation experiments are conducted specifically targeting the innovative points.
limitations: limitations: 1. It is well known that the stego images in the steganographic domain can resist steanalyzers. However, it seems from Figure 1 that the authors did not consider this.
2. For the proposed HideMIA, it can resist the member inference attacks? If possible, what is the underlying cause?
3. As far as I know, the data format of medical images is different from that of natural images in practice. Therefore, did the author consider a customized network design for data loading?
4. How to determine the weight value of each sub-loss item in Equation 7?
5. In the comparison results, the author needs to consider how the adopted image hiding strategy will affect the recognition accuracy.
6. Please recheck the manuscript, where there are some grammatical errors.