Privacy-preserving federated learning: Strengthening data protection and secure collaboration in healthcare

Machine learning (ML) has been an integral part of large-scale data analysis in healthcare research and is being used for tasks such as disease classification, pattern recognition, or synthetic data generation. ML models learn the values of numerous parameters that allow them to capture patterns and relationships within a training dataset. It is essential to validate medical ML models in multi-centre studies, which test their performance on a diverse and heterogeneous patient population, proving a good generalisability and the absence of biases. However, due to its sensitive nature, sharing and centrally aggregating medical data is strictly regulated, for instance under the European General Data Protection Regulation (GDPR). It often requires complex pseudonymisation or anonymisation steps, which introduce a procedural overhead and may require removing relevant patient information in favour of privacy preservation. Federated learning (FL) addresses the challenge of sensitive data sharing by decentralising the training step of ML models, thereby removing the need to transmit data off-site. Training is organised in a client-server architecture, where data owners take on the role of clients, and a so-called parameter server is responsible for maintaining the latest global model, facilitating the training procedure, and aggregating local training progress. In multiple training rounds, the clients receive the model from the parameter server and train it on their local data, thereby tuning the model parameters. These alterations to the model are then transmitted back to the parameter server, where parameter updates from multiple clients are averaged and applied to the global model. Therefore, sensitive data never leaves the site where it was collected. While the FL approach protects data privacy to some extent, it also introduces new vulnerabilities as a consequence of the client-server architecture where information is transferred over the internet. It was shown that an analysis of the model weight information sent by data owners can allow inferences about the underlying training data. Therefore, truly secure FL algorithms must include additional defensive mechanisms to prevent these kinds of attacks. In this thesis, we investigate two aspects of FL: how to protect the FL participants’ data privacy against a malicious server and how to protect the model’s performance against malicious training participants. First, we focus on differential privacy (DP) as a privacy-preserving technique which relies on the addition of noise into the ML model at the time of training, thereby obfuscating the impact any one data record or FL participant has on the model. We show and discuss the risk of reconstruction attacks, which rebuild training data from model parameter information, and highlight the effectiveness of DP against them, using lung illness detection from chest X-ray images as an example. Then, having established the need for adopting DP, we analyse the negative impact this technique can have on the model performance. Specifically, we consider a small group of data owners who possess small, non-independent and non-identically distributed datasets and assess the fairness of the trained model in terms of its utility for each training participant. The field of application for this part of the thesis is the prediction of complications after visceral surgery. Finally, we present a method for reducing the negative impact of DP on the utility of variational autoencoder models used for synthetic data generation. Aside from securing data privacy, reaching a well-performing model after training is essential to a successful FL application. Therefore, we considered the risk of encountering a poisoning attack targeted at reducing the model utility, where malicious participants submit model parameters specifically designed to reduce the model performance. Here, we introduce a novel, fully decentralised FL method that does not rely on a central parameter server for facilitating the training and aggregating the participants‘ model weights. Instead, we propose to use decentralised ledger technologies to synchronise the joint training effort and store training progress. We show that our approach inherently protects benign training contributors from being affected by certain poisoning attacks from malicious actors. In summary, this thesis highlights the necessity of defensive measures when FL is being applied in practice, especially in areas with highly sensitive data such as healthcare. We introduce several analyses and methods for FL with DP and fully decentralised FL, paving the way for future research on privacy-preserving and secure FL.