# Differentially private federated deep learning for multi-site medical image
segmentation

Alexander Ziller
Institute for Artificial Intelligence and Informatics in Medicine, Technical
University of Munich, Munich, Germany
Institute of Diagnostic and Interventional Radiology, Technical University of
Munich, Munich, Germany
OpenMinedDmitrii Usynin
Department of Computing, Imperial College London, London, United Kingdom
Institute for Artificial Intelligence and Informatics in Medicine, Technical
University of Munich, Munich, Germany
Institute of Diagnostic and Interventional Radiology, Technical University of
Munich, Munich, Germany
OpenMined Nicolas W. Remerscheid
Institute for Artificial Intelligence and Informatics in Medicine, Technical
University of Munich, Munich, Germany
OpenMined Moritz Knolle
Institute for Artificial Intelligence and Informatics in Medicine, Technical
University of Munich, Munich, Germany
Institute of Diagnostic and Interventional Radiology, Technical University of
Munich, Munich, Germany Marcus Makowski
Institute of Diagnostic and Interventional Radiology, Technical University of
Munich, Munich, Germany Rickmer Braren
Institute of Diagnostic and Interventional Radiology, Technical University of
Munich, Munich, Germany Daniel Rueckert
Institute for Artificial Intelligence and Informatics in Medicine, Technical
University of Munich, Munich, Germany
Department of Computing, Imperial College London, London, United Kingdom
Georgios Kaissis
Institute for Artificial Intelligence and Informatics in Medicine, Technical
University of Munich, Munich, Germany
Institute of Diagnostic and Interventional Radiology, Technical University of
Munich, Munich, Germany
Department of Computing, Imperial College London, London, United Kingdom
OpenMined

###### Abstract

Collaborative machine learning techniques such as federated learning (FL)
enable the training of models on effectively larger datasets without data
transfer. Recent initiatives have demonstrated that segmentation models
trained with FL can achieve performance similar to locally trained models.
However, FL is not a fully privacy-preserving technique and privacy-centred
attacks can disclose confidential patient data. Thus, supplementing FL with
privacy-enhancing technologies (PTs) such as differential privacy (DP) is a
requirement for clinical applications in a multi-institutional setting. The
application of PTs to FL in medical imaging and the trade-offs between privacy
guarantees and model utility, the ramifications on training performance and
the susceptibility of the final models to attacks have not yet been
conclusively investigated. Here we demonstrate the first application of
differentially private gradient descent-based FL on the task of semantic
segmentation in computed tomography. We find that high segmentation
performance is possible under strong privacy guarantees with an acceptable
training time penalty. We furthermore demonstrate the first successful
gradient-based model inversion attack on a semantic segmentation model and
show that the application of DP prevents it from divulging sensitive image
features. Our code is available at https://github.com/TUM-
AIMED/PrivateSegmentation.

Keywords: Privacy-preserving, Differential Privacy, Federated Learning,
Semantic Segmentation

##  1 Introduction

Training effective machine learning (ML) models in medical imaging is a data-
driven problem, where model utility is typically directly dependent on the
quantity and quality of data available during training. In recent works
Sheller et al. (2019, 2020), federated learning (FL) has been proposed to
allow the utilisation of multi-site clinical datasets to enable and encourage
collaboration between data owners, obtaining larger pools of high quality,
diverse and representative data while avoiding direct data sharing. While FL
circumvents centralised data pooling, it is not a privacy-enhancing technology
(PT), as it does not provide the federation with any formal notion of privacy
in regards to the patient data they are holding. This can leave the model
vulnerable to catastrophic privacy breaches through attacks such as model
inversion (Zhu and Han, 2020; Zhao et al., 2020; Geiping et al., 2020) or
membership inference (Shokri et al., 2017) during model training by malicious
parties inside or outside the federation. It is therefore imperative that
collaborative learning does not just benefit the utility of the model through
a richer data pool, but also provides formal privacy guarantees to the
participating parties, for example through the utilisation of PTs such as
differential privacy (DP) or encrypted algorithm training. However, the
application of PTs often comes at the cost of decreased model utility
(privacy-accuracy-trade-off), e.g. due to the addition of noise to the
training process (Bagdasaryan and Shmatikov, 2019). Minimising this trade-off
is a complex, yet fundamental process, and has so far not been conclusively
investigated in the area of medical imaging.
In the present work, we perform federated medical image segmentation under
image-level differential privacy guarantees. Through detailed experiments, we
demonstrate that the appropriate choice of architecture and training technique
can enable excellent model performance despite rigorous privacy guarantees
while minimising network overhead and computational demands.

##  2 Background and Related Work

We use the term Federated Learning (FL, (Konečnỳ et al., 2016)) to denote a
collaborative learning protocol in which a number of parties (nodes/workers)
jointly train a neural network. Training occurs in rounds during which the
central server sends the model to the nodes, local training occurs for a
number of iterations, whereupon the updated models are aggregated by Federated
(Gradient) Averaging (McMahan et al., 2017). We assume a cross-silo topology,
based on a small number of centres with relatively large datasets. Moreover,
we assume homogeneous node compute resources and constant node availability.
We use the following definition of Differential Privacy (DP) by (Dwork et al.,
2014): For some randomised algorithm (=mechanism) M, all subsets of its image
$S$, sensitive dataset $D$ and its neighbouring dataset $D^{\prime}$, whereby
$D$ and $D^{\prime}$ differ by at most one record, we say that M is
$(\epsilon,\delta)$-differentially private (DP) if, for a (typically small)
constant $\epsilon$ and $0\leq\delta<1$:

$Pr(\mathit{M(D)=x})\leq e^{\epsilon}Pr(\mathit{M(D^{\prime})=x})+\delta,x\in
S.$

The probability $Pr$ is taken over the randomness of the algorithm $M$. DP is,
therefore, an attribute of an algorithm that makes it approximately
equivariant to exclusion or inclusion of a data point. It quantifies an
individuals contribution to the final outcome of the computation. When the
difference between the contributions of multiple participants is minimal, it
is not possible to reliably determine the presence or the absence of an
individual.

Sheller and colleagues have demonstrated the utilisation of FL in the context
of brain tumour segmentation (Sheller et al., 2019, 2020). However, neither
work utilises PTs to provide privacy guarantees to the included patients. Li
et al. (Li et al., 2019) also showcase brain tumour segmentation using FL. The
Sparse Vector Technique utilised in the study however only provides privacy
guarantees to the model’s parameters and not to the dataset records, which is
not a meaningful notion of privacy. In comparison, DP-SGD, utilised in our
study, provides the guarantees to each individual patient, providing the
federation with an a pragmatic, information-theoretic privacy-preserving
solution instead. Fay et al. (Fay et al., 2020) utilise the Private
Aggregation of Teacher Ensembles for brain tumour segmentation. This technique
was originally developed for classification tasks and imposes strong
assumptions on the learning process. Consequently authors could not
demonstrate reasonable privacy guarantees in their study while still
experiencing a steep utility penalty. Yang et al. (Yang et al., 2021) utilised
FL for COVID-19 lesion segmentation in computed tomography (CT) but did not
employ PTs. Lastly, Sarma et al. (Sarma et al., 2021) demonstrate FL
segmentation of prostate volumes in magnetic resonance imaging (MRI), but also
did not employ any PTs.

###  2.1 Contributions

As witnessed from the survey of previous works above, although several studies
have dealt with the topic of FL for medical image segmentation, our work is,
to our best knowledge, the first to utilise differentially private stochastic
gradient descent (DP-SGD) in addition to FL in order to provide both stringent
image-level privacy guarantees and maintain high model utility in the setting
of medical image segmentation. We summarise our main contributions below:

  * •

We present an in-depth study on the application of DP to medical image
segmentation by successfully training several segmentation model architectures
in the federated setting. Contrary to the previous works, our implementation
of differentially private training provides strict, provable guarantees with
respect to each individual image, which allows the federation to obtain a
meaningful measure of privacy.

  * •

Our models trained with FL achieve comparable segmentation performance to
centrally trained models while suffering only mild privacy-utility trade-offs.

  * •

We demonstrate the first successful model inversion attack on semantic
segmentation architectures, leading to the full reconstruction of input images
for certain models. We thus provide evidence that, despite prevailing
literature opinion, FL in itself is an insufficient technique for protecting
patient privacy. We then empirically show that -consistent with its
theoretical privacy guarantees- the addition of DP to model training
completely thwarts such privacy-centred attacks.

##  3 Methods

###  3.1 Federated Training

For FL experimentation, we simulated a scenario in which three hospitals
(=workers/nodes) are collaboratively training the neural network coordinated
by a central server. For this, we split the dataset randomly by patient onto
the three servers maintaining an equal number of patients per server. We
conducted all experimentation using the PriMIA framework (Kaissis et al.,
2021), a generic open-source software package for privacy-preserving and
federated deep learning on medical imaging, which we adapted to semantic
medical image segmentation.

###  3.2 Differentially Private Training

For deep neural network training, we utilised DP-stochastic gradient descent
(DP-SGD) (Abadi et al., 2016) which extends DP guarantees to gradient-based
optimisation by clipping the $L_{2}$-norm of the per-sample gradients of each
minibatch to a specific value and adding Gaussian noise of predetermined
magnitude to the averaged minibatch gradients before performing an
optimisation step. We utilise the Rényi Differential Privacy Accountant
(Mironov et al., 2019), an extension of the moments accountant technique by
Abadi et al. for the privacy analysis of this algorithm, i.e. the calculation
of privacy loss at each individual site in terms of $\epsilon$. We note that
the reported privacy guarantees are record-level, and not patient-level
guarantees. Moreover, we regarded all datasets used as public for the purposes
of experimentation such as hyperparameter searches. DP training was performed
under three privacy regimes, shown in Table 1. In the following, we will refer
to these as low, medium and high privacy regimes. Finally, we note that the
utilisation of Batch Normalisation layers is incompatible with DP training, as
the running statistics of the layers are maintained non-privately. Hence, we
deactivated the running statistics collection for Batch Normalisation layers,
effectively converting them to Instance/Channel Normalisation Layers (Dai and
Heckel, 2019) which are DP-compatible.

(Hyper-)parameter | Low | Medium | High
---|---|---|---
Noise Multiplier | $0.8$ | $1.0$ | $1.5$
$L_{2}$ Clipping Norm | $1.0$ | $0.5$ | $0.1$
$\delta$ ($\times 10^{-5}$) | $1.0$ | $1.0$ | $1.0$
$\epsilon$ local | $5.98$ | $3.58$ | $1.82$
$\epsilon$ federated | $11.5$ | $7.08$ | $3.54$
Table 1: Definition of privacy regimes used in the study. The Noise Multiplier
and $L_{2}$ Clipping Norm are hyperparameters of the DP-SGD algorithm.
$\delta$ and $\epsilon$ are record-level guarantees for the local model and
per-site record-level guarantees for the federated models. $\epsilon$ also
designates the privacy budget, i.e. the privacy loss at which model training
is aborted.

###  3.3 Gradient-based Model Inversion

In order to empirically verify whether reconstruction of training data by an
Honest-but-Curious (HbC) adversary with white-box model access (Evans et al.,
2017) that participates in the training protocol is possible, we performed a
model inversion attack utilising the gradients shared during Federated
Averaging. We employ an approach similar to the Deep Leakage from Gradients
(DLG) (Zhu and Han, 2020; Zhao et al., 2020; Geiping et al., 2020) attack to
infer the data that generated the update. The attack relies on approximating
the input image through a gradient descent-based perturbation of a randomly
initialised noise matrix, based on a differentiable similarity metric to the
gradient captured during model training. Unlike the original attack, designed
for an image reconstruction in a classification context given a model update
and the corresponding label, we provided the gradient update and a
segmentation mask, which are used to reconstruct the input. We observed that
the use of a segmentation mask of the victim by the adversary greatly improves
the results of the reconstruction. In cases of more complex models, the attack
was not successful without access to the segmentation mask, which we consider
a limitation of this method.

###  3.4 Model Architectures

All experiments were carried out using U-Net-like architectures (Ronneberger
et al., 2015) with modifications detailed in (Yakubovskiy, 2020), introducing
newer architectures as backbones to the encoder portion of the U-Net. Since
network input/output overhead is a critical bottleneck for federated learning,
we focused on architectures which provide a good balance between network size
and performance on established benchmarks. Hence, we included MobileNet V2
(Sandler et al., 2018) and ResNet-18 (He et al., 2016) as backbones. Moreover,
we considered MoNet (Knolle et al., 2020), a novel lightweight U-Net-like
architecture with extremely few parameters specifically optimised for FL.
Lastly, for comparability to the original U-Net, we utilised an eleven-layer
VGG architecture with Batch Normalisation (Simonyan and Zisserman, 2014)
(VGG11 BN). An overview of the number of parameters (i.e. model size) and
Multiply/Accumulate operations (MACs) can be found in Table 2. We note that
MoNet relies on large receptive field dilated (atrous) convolutions which
introduce a substantial number of operations despite the small network size.
Moreover, the MobileNet-V2 architecture is optimised for CPU performance
(Orsic et al., 2019). We therefore carried out timing experiments both on CPU
and GPU (compare Table 4).

| MoNet | U-Net | U-Net | U-Net
---|---|---|---|---
|  | (MobileNet V2) | (ResNet-18) | (VGG11 BN)
Parameters | 390k | 6.63M | 14.32M | 18.26M
MACs | 6.11G | 3.37G | 5.32G | 14.45G
Table 2: Number of parameters and Multiply/Accumulate operations for a single
forward pass (MACs) of the architectures used in the study. Parameter counts
in 32-bit floating point units. k: $\times 10^{3}$, M: $\times 10^{6}$, G:
$\times 10^{9}$. Bold denotes the lowest number of parameters or MACs,
correspondingly.

###  3.5 Hyperparameter Optimisation

We performed hyperparameter optimisation on non-private baseline models in a
decentralised manner over the entire federation to obtain suitable values for
the learning rate, beta parameters for the Adam optimiser, as well as
translation, rotation and scale values for image augmentation. This
corresponds to local hyperparameter optimisation prior to DP training to avoid
repeated dataset interaction which would consume the privacy budget. For FL,
the synchronisation rate, number of different image augmentations as well as
whether or not the model parameters were weighted by the number of samples on
the worker during aggregation were additionally optimised. The settings found
through optimisation were used to train the corresponding models with DP.

##  4 Experiments

All models were trained and evaluated on the MSD Liver segmentation task
(Simpson et al., 2019). The dataset was split into a 63% training set, 7%
validation set and 30% held-out testing set. All architectures were pre-
trained on a pancreatic CT segmentation dataset from our institution to
improve convergence speed and offer equal starting conditions to all models.

###  4.1 Segmentation results

Model evaluation results on the test set are listed in Table 3. We observed
that models trained with FL are able to achieve performance on-par with
locally trained models. In line with previous results (Abadi et al., 2016),
all models witnessed performance deterioration due to the utilisation of DP.
Surprisingly, we found the performance penalty to be especially high on the
ResNet-18 architecture, which did not converge at all in the FL setting with
DP. Moreover, we consistently found the VGG-11 BN architecture to perform
best. This finding suggests that a high parameter count alone is not the sole
determinant of performance deterioration due to DP as suggested in previous
work (Papernot et al., 2019). Instead, both the collaborative training setting
and the architecture itself seem to contribute to this phenomenon. However,
these findings await detailed future analysis. Moreover, the high variance of
the per-image Dice score distributions for ResNet-18 and MobileNet V2
backbones suggest a disparate effect of DP on different images (see Figure 1),
with the MoNet and VGG-11 BN architectures maintaining a more consistent
performance in the privately trained local setting. Exemplary segmentation
results are shown in Figure 2.

Federated | Privacy | MoNet | U-Net | U-Net | U-Net
---|---|---|---|---|---
|  |  | (MobileNet V2) | (ResNet-18) | (VGG11 BN)
| None | 93.41 | 95.41 | 94.67 | 95.98
| Low | 86.66 | 87.61 | 82.20 | 92.85
| Medium | 87.72 | 88.22 | 84.36 | 92.63
| High | 87.22 | 87.04 | 83.66 | 92.00
✓ | None | 94.48 | 94.13 | 94.56 | 95.08
✓ | Low | 82.10 | 87.81 | DNC | 90.93
✓ | Medium | 83.25 | 88.76 | DNC | 90.67
✓ | High | 82.75 | 88.14 | DNC | 90.27
Table 3: Dice scores [%] of models trained locally and with FL under different
privacy regimes. We note that ResNet-18 did not achieve convergence under FL
and DP (DNC). Bold signifies the highest score in the category. Figure 1:
Kernel density estimation plots with inner box plots of Dice scores of the
models trained locally (top) and federated (bottom) under different privacy
regimes.  Figure 2: Exemplary segmentation results of the VGG11 BN U-Net
architecture, trained in the local non-private setting vs. the FL high privacy
regime.

In Table 4, we compare the time required per epoch of training for the various
models. We found the optimised, widely-used architectures to train more
efficiently. In comparison, MoNet trades off computational efficiency for a
much smaller size to alleviate network input/output constraints.

Device | Federated | MoNet | U-Net | U-Net | U-Net
---|---|---|---|---|---
|  |  | (MobileNet V2) | (ResNet-18) | (VGG11 BN)
CPU |  | $4186.50\pm 13.53$ | $769.76\pm 1.68$ | $\mathbf{708.50\pm 0.80}$ | $959.13\pm 0.43$
CPU | ✓ | $4281.64\pm 8.85$ | $1200.32\pm 32.96$ | $\mathbf{892.62\pm 12.34}$ | $1114.57\pm 7.56$
GPU |  | $92.84\pm 0.62$ | $43.51\pm 0.32$ | $\mathbf{37.46\pm 0.36}$ | $60.73\pm 0.66$
GPU | ✓ | $\mathbf{175.11\pm 1.61}$ | $458.30\pm 29.66$ | $190.82\pm 5.22$ | $192.80\pm 7.59$
Table 4: Mean and standard deviation [s] for one epoch with equal settings for
all models. CPU: Central Processing Unit. GPU: Graphics Processing Unit

###  4.2 Model Inversion Attack

In this study we employ a novel gradient-based model inversion attack based on
the works of Geiping et al. Geiping et al. (2020). In our setting the
adversary starts with a randomly initialised
$<\mbox{{image}},\mbox{{segmentation mask}}>$ pair and a captured model
update. The optimisation task that is executed by the adversary involves
perturbing the image to such extent that it (along with a corresponding
segmentation mask) produces a gradient update similar to the one that the
adversary captured. We utilise a cosine similarity as the cost function in
this optimisation process. The procedure is repeated until either the loss
starts diverging or the final iteration is reached.

We note that for our method the attacker is assumed to have access to a
segmentation mask that corresponds to the sensitive image. We consider this to
be a limitation of our approach and note that for smaller networks,
utilisation of randomly initialised segmentation mask can provide the
adversary with a suitable reconstruction result. However, for the purposes of
medical imaging, larger models, such as VGG-11 or MoNet require a segmentation
mask in order to allow the attacker model to converge and to produce an
acceptable reconstruction result.

Gradient-based model inversion attacks were performed in two settings:
initially, gradients captured from FL training without DP were attacked. We
then evaluated the attacks on the same architectures with the addition of DP.
As presented in Figure 3, non-private models sharing unprotected updates
during training risk their data being reconstructed in full. In comparison,
models trained with the addition of DP yield no usable information to the
inversion attack regardless of architecture. In general, architectural
complexity seems to inhibit attack success to a greater degree than shown in
previous work on classification (Geiping et al., 2020).

Figure 3: Gradient based reconstructions on the models used in the study. Top
row: unprotected models. Bottom row: models with DP (Noise Multiplier 2.0,
$L_{2}$ clipping norm 0.5).

##  5 Discussion and Conclusion

To the best of our knowledge, this is the first work to demonstrate DP-SGD-
based collaborative model training in the context of semantic medical image
segmentation. Our main conclusion is that the provision of rigorous privacy
guarantees is possible in the FL setting while maintaining high model utility.
One area that we highlight as a promising research direction is an
investigation into the relationship between privacy-oriented modes of training
and the selection of an optimal model architecture. We found that larger model
architectures can be more robust to noise addition, whereas lightweight models
can be advantageous in non-private FL settings. This highlights a promising
research area that considers the application of privacy-preserving mechanisms
in task-specific deployments in order to better tailor defense mechanisms to
learning tasks with optimal utility preservation. Additionally, we outline a
requirement for investigations into the field of pragmatic applications of DP,
in order to allow privately trained models to be interpretable by machine
learning researchers and facilitate the widespread utilisation of private
collaborative model training. Our novel model inversion attack in the
unprotected FL setting resulted in a catastrophic privacy breach, while only
utilising a segmentation mask and a shared model update. This highlights that
FL alone is an insufficient privacy preservation mechanism in collaborative
learning and should be regarded as a method for preservation of data
ownership/governance which facilitates controlled data access. As our method
requires possession of a segmentation mask by the adversary, future work will
include a natural relaxation of this requirement and the study of robust,
scalable model inversion attacks. We note that similarly to other model
inversion implementations, supporting large batches of images is a non-trivial
task, therefore we also outline this area as a potential future work
direction. We expect that our work will stimulate further research on privacy-
preserving machine learning, essential to large scale, multi-site medical
imaging analysis, in order to allow collaborative model training while
mitigating associated privacy risks.

Acknowledgments

Georgios Kaissis received funding from the Technical University of Munich,
School of Medicine Clinician Scientist Programme (KKF), project reference H14.
Dmitrii Usynin received funding from the Technical University of Munich/
Imperial College London Joint Academy for Doctoral Studies. This research was
supported by the UK Research and Innovation London Medical Imaging &
Artificial Intelligence Centre for Value Based Healthcare. The funders played
no role in the design of the study, the preparation of the manuscript or the
decision to publish. The liver segmentation dataset is described and provided
available at https://arxiv.org/pdf/1902.09063.

Ethical Standards

The work follows appropriate ethical standards in conducting research and
writing the manuscript, following all applicable laws and regulations
regarding treatment of animals or human subjects.

Conflicts of Interest

Authors declare no conflicts of interest.

## References

  * Abadi et al. (2016) Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang.  Deep learning with differential privacy.  In _Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security_ , pages 308–318, 2016.
  * Bagdasaryan and Shmatikov (2019) Eugene Bagdasaryan and Vitaly Shmatikov.  Differential Privacy Has Disparate Impact on Model Accuracy.  _arXiv preprint arXiv:1905.12101_ , 2019.
  * Dai and Heckel (2019) Zhenwei Dai and Reinhard Heckel.  Channel normalization in convolutional neural network avoids vanishing gradients, 2019.
  * Dwork et al. (2014) Cynthia Dwork, Aaron Roth, et al.  The algorithmic foundations of differential privacy.  _Foundations and Trends in Theoretical Computer Science_ , 9(3-4):211–407, 2014.
  * Evans et al. (2017) David Evans, Vladimir Kolesnikov, and Mike Rosulek.  A pragmatic introduction to secure multi-party computation.  _Foundations and Trends® in Privacy and Security_ , 2(2-3), 2017.
  * Fay et al. (2020) Dominik Fay, Jens Sjölund, and Tobias J Oechtering.  Decentralized differentially private segmentation with pate.  _arXiv preprint arXiv:2004.06567_ , 2020.
  * Geiping et al. (2020) Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller.  Inverting gradients–how easy is it to break privacy in federated learning?  _arXiv preprint arXiv:2003.14053_ , 2020.
  * He et al. (2016) Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.  Deep residual learning for image recognition.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , pages 770–778, 2016.
  * Kaissis et al. (2021) Georgios Kaissis, Alexander Ziller, Jonathan Passerat-Palmbach, Théo Ryffel, Dmitrii Usynin, Andrew Trask, Ionésio Lima, Jason Mancuso, Friederike Jungmann, Marc-Matthias Steinborn, Andreas Saleh, Marcus Makowski, Daniel Rueckert, and Rickmer Braren.  End-to-end privacy preserving deep learning on multi-institutional medical imaging.  _Nature Machine Intelligence_ , May 2021.  ISSN 2522-5839.  doi: 10.1038/s42256-021-00337-8.  URL https://doi.org/10.1038/s42256-021-00337-8.
  * Knolle et al. (2020) Moritz Knolle, Georgios Kaissis, Friederike Jungmann, Sebastian Ziegelmayer, Daniel Sasse, Marcus Makowski, Daniel Rueckert, and Rickmer Braren.  Efficient, high-performance pancreatic segmentation using multi-scale feature extraction.  _arXiv preprint arXiv:2009.00872_ , 2020.
  * Konečnỳ et al. (2016) Jakub Konečnỳ, H Brendan McMahan, Felix X Yu, Peter Richtárik, Ananda Theertha Suresh, and Dave Bacon.  Federated learning: Strategies for improving communication efficiency.  _arXiv preprint arXiv:1610.05492_ , 2016.
  * Li et al. (2019) Wenqi Li, Fausto Milletarì, Daguang Xu, Nicola Rieke, Jonny Hancox, Wentao Zhu, Maximilian Baust, Yan Cheng, Sébastien Ourselin, M Jorge Cardoso, et al.  Privacy-preserving federated brain tumour segmentation.  In _International Workshop on Machine Learning in Medical Imaging_ , pages 133–141. Springer, 2019.
  * McMahan et al. (2017) Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas.  Communication-efficient learning of deep networks from decentralized data.  In _Artificial Intelligence and Statistics_ , pages 1273–1282. PMLR, 2017.
  * Mironov et al. (2019) Ilya Mironov, Kunal Talwar, and Li Zhang.  Rényi differential privacy of the sampled gaussian mechanism.  _arXiv preprint arXiv:1908.10530_ , 2019.
  * Orsic et al. (2019) Marin Orsic, Ivan Kreso, Petra Bevandic, and Sinisa Segvic.  In defense of pre-trained imagenet architectures for real-time semantic segmentation of road-driving images.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 12607–12616, 2019.
  * Papernot et al. (2019) Nicolas Papernot, Steve Chien, Shuang Song, Abhradeep Thakurta, and Ulfar Erlingsson.  Making the shoe fit: Architectures, initializations, and tuning for learning with privacy.  2019\.
  * Ronneberger et al. (2015) Olaf Ronneberger, Philipp Fischer, and Thomas Brox.  U-net: Convolutional networks for biomedical image segmentation.  In _International Conference on Medical image computing and computer-assisted intervention_ , pages 234–241. Springer, 2015.
  * Sandler et al. (2018) Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, and Liang-Chieh Chen.  Mobilenetv2: Inverted residuals and linear bottlenecks.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , pages 4510–4520, 2018.
  * Sarma et al. (2021) Karthik V Sarma, Stephanie Harmon, Thomas Sanford, Holger R Roth, Ziyue Xu, Jesse Tetreault, Daguang Xu, Mona G Flores, Alex G Raman, Rushikesh Kulkarni, Bradford J Wood, Peter L Choyke, Alan M Priester, Leonard S Marks, Steven S Raman, Dieter Enzmann, Baris Turkbey, William Speier, and Corey W Arnold.  Federated learning improves site performance in multicenter deep learning without data sharing.  _Journal of the American Medical Informatics Association_ , February 2021.  doi: 10.1093/jamia/ocaa341.  URL https://doi.org/10.1093/jamia/ocaa341.
  * Sheller et al. (2019) Micah J. Sheller, G. Anthony Reina, Brandon Edwards, Jason Martin, and Spyridon Bakas.  Multi-institutional deep learning modeling without sharing patient data: A feasibility study on brain tumor segmentation.  In _Brainlesion: Glioma, Multiple Sclerosis, Stroke and Traumatic Brain Injuries_ , pages 92–104. Springer International Publishing, 2019\.  doi: 10.1007/978-3-030-11723-8“˙9.  URL https://doi.org/10.1007/978-3-030-11723-8_9.
  * Sheller et al. (2020) Micah J. Sheller, Brandon Edwards, G. Anthony Reina, Jason Martin, Sarthak Pati, Aikaterini Kotrotsou, Mikhail Milchenko, Weilin Xu, Daniel Marcus, Rivka R. Colen, and Spyridon Bakas.  Federated learning in medicine: facilitating multi-institutional collaborations without sharing patient data.  _Scientific Reports_ , 10(1), July 2020.  doi: 10.1038/s41598-020-69250-1.  URL https://doi.org/10.1038/s41598-020-69250-1.
  * Shokri et al. (2017) Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov.  Membership inference attacks against machine learning models.  In _2017 IEEE Symposium on Security and Privacy (SP)_ , pages 3–18. IEEE, 2017.
  * Simonyan and Zisserman (2014) Karen Simonyan and Andrew Zisserman.  Very deep convolutional networks for large-scale image recognition.  _arXiv preprint arXiv:1409.1556_ , 2014.
  * Simpson et al. (2019) Amber L Simpson, Michela Antonelli, Spyridon Bakas, Michel Bilello, Keyvan Farahani, Bram Van Ginneken, Annette Kopp-Schneider, Bennett A Landman, Geert Litjens, Bjoern Menze, et al.  A large annotated medical image dataset for the development and evaluation of segmentation algorithms.  _arXiv preprint arXiv:1902.09063_ , 2019.
  * Yakubovskiy (2020) Pavel Yakubovskiy.  Segmentation models pytorch.  https://github.com/qubvel/segmentation_models.pytorch, 2020.
  * Yang et al. (2021) Dong Yang, Ziyue Xu, Wenqi Li, Andriy Myronenko, Holger R. Roth, Stephanie Harmon, Sheng Xu, Baris Turkbey, Evrim Turkbey, Xiaosong Wang, Wentao Zhu, Gianpaolo Carrafiello, Francesca Patella, Maurizio Cariati, Hirofumi Obinata, Hitoshi Mori, Kaku Tamura, Peng An, Bradford J. Wood, and Daguang Xu.  Federated semi-supervised learning for COVID region segmentation in chest CT using multi-national data from china, italy, japan.  _Medical Image Analysis_ , 70:101992, May 2021.  doi: 10.1016/j.media.2021.101992.  URL https://doi.org/10.1016/j.media.2021.101992.
  * Zhao et al. (2020) Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen.  idlg: Improved deep leakage from gradients.  _arXiv preprint arXiv:2001.02610_ , 2020.
  * Zhu and Han (2020) Ligeng Zhu and Song Han.  Deep leakage from gradients.  In _Federated Learning_ , pages 17–31. Springer, 2020.

Remainder omitted in this sample.


# Optical taxonomic signal

Frank A. Greco Research Service (151B), VA Bedford Healthcare System, Bedford,
MA 01730, USA Email<EMAIL_ADDRESS>
###### Abstract

Scattering of light by biological tissue has hindered applications of
spectroscopy to medical diagnosis. We describe here a combination of feature
selection techniques and several discriminant statistics that may mitigate
this problem. In the particular case of spectroscopy, a useful feature should
have linewidth, which in practice means that the discriminant statistic should
have significant values on several contiguous pixels of the detector. We also
suggest a definition for optical taxonomic signal as a measure of how
efficacious a particular combination may be and how much other variables such
as source-detector separation and fiber width may affect discrimination.

##  1 Introduction

Although the application of optical spectroscopy to tissue specimens for
medical diagnosis has great potential in theory, the practical results to-date
have been disappointing. One significant reason for this frustration is the
scattering of light by biological tissues, which obscures much of the
spectroscopic information[10].

Figure 1. Nature of data and discriminant statistics. There is a one-to-one
association between wavelengths (nm) and pixel or bin number on the detector.
Pixel number (px) is easier to work with for data analysis. The data shown are
synthetic and illustrate that at each wavelength there are numerical values
assigned to every member of both groups. The t-statistic (two-tailed here) can
serve as a measure of directed distance between the two groups; the p-value is
calculated for the t-statistic. The fraction-product (fp) will be discussed
more fully below. Briefly, an algorithm estimates a cutoff (indicated by the
caret) to separate the two groups; the fraction of each group correctly
classified is determined; the product of these two fractions measures the
separation of the two groups. Regardless of which discriminant statistic is
used, the process creates a new “spectrum” with a value of the statistic at
each pixel indicating the “distance” between the two classes.

We recently reported that near-infrared reflectance spectroscopy of the human
head in vivo can distinguish subjects with Alzheimer’s disease from
controls[7]. To achieve this result, we employed pattern recognition
techniques to search for regions of the spectra that best distinguished the
two classes. It is doubtful that we could have succeeded in classifying the
subjects without the use of pattern recognition. The purpose of this paper is
to review the pattern recognition techniques used and to combine them into a
new concept: optical taxonomic signal.

Concerning the nature of the data to be treated, we consider optical spectra
acquired from two classes of individuals: disease and non-disease (or class A
and class B). Most spectrometers today have digital detectors, and it is
easiest to think of each wavelength as associated with a pixel or bin on the
detector (Figure 1).

In general, the problem of how to select the best features for classification
has no methodical solutions[5], and the performance of any procedure may vary
with the nature of the data set[1]. However, a spectroscopic feature should,
in addition to distinguishing the two classes, also have linewidth. In the
context of digital detectors, this means that an effective discriminant
feature should occur over several contiguous pixels. Therefore, there are two
mathematically independent properties which we will combine to call optical
taxonomic signal: the ability to separate the two classes and its occurrence
at effective levels over contiguous pixels. The ability to separate the two
classes will be described by a discriminant statistic, which we will treat as
a random variable (variate) on the sample space. A more precise, mathematical
definition is given in section 5.

Two applications of the concept of optical taxonomic signal will be discussed:
feature selection algorithms to identify spectral regions that are candidate
classifiers and its use as a measure to assess how the information in an
optical signal may vary with other factors. For example, in our published data
we reported that the same two optical features classified subjects at both 25
and 30 mm source-detector separations[7]; the ability to quantify how optical
taxonomic signal varies with source-detector separation will facilitate the
design of experiments and clinical devices. When the context concerns feature
selection, we will always assume that each data point can be associated with
one of the classes; the discussion will be limited to issues prior to
implementing a diagnostic method.

##  2 Desiderata of a discriminant statistic

It is easier to think about a variable that correlates positively with the
attribute to be quantified. The absolute value of the t-statistic corresponds
with the usual notion of distance between two populations; however, it is not
easy to develop intuition about t-values in different settings. The associated
p-value is more intuitive, but smaller values correspond to greater
“distances” between the two classes. This can be mitigated by considering the
ratio of the p-value and a reference value, e.g., 0.05/p, as a discriminant
statistic.

Concerning the importance of the assumptions that underlie the t-statistic,
the common use of terminology from machine learning can cause some confusion.
When models with adaptive parameters are used[1], the data are divided into
two sets: one for optimizing parameters (training set), the other for
confirming the model (test set)[11]. In this case, feature selection may be
combined with parameter optimization. When there are no parameters to
optimize, selection of features should nonetheless be carried out in one
subset and their efficacy confirmed in another[4]. We have suggested the terms
“discovery” and “test” sets in this case[7]. Using our suggested terminology,
we may state that for the discovery set, there is less concern about whether
the underlying assumptions for drawing inferences from the discriminant
statistic are met; the use is heuristic. It is in the test set that concern
for validity of the assumptions is appropriate. This question is most
important when the number of subjects is small, which is often the case in
medical research.

##  3 The fraction-product as a novel discriminant statistic

Figure 2. Graphical construction of fraction-product. By plotting the
cumulative distribution functions of the two groups, the medians are found by
the intersection (squares) of each point set with a horizontal line through
the ordinate value 0.5. The perpendicular bisector of the two medians cuts
each point set into two subsets and determines the fraction of group A (red
circles) correctly classified and the fraction of group B (blue triangles)
mis-classified. To show connection to Figure 1, the data are plotted on a line
across the bottom of the graph.

This approach grew out of attempts to quantify the intuitive notion of
separating the disease and non-disease groups[6]. Here we will develop enough
understanding to compare the fraction-product with other discriminant
statistics.

Figure 2 above illustrates graphically the algorithm to compute the fraction
product. At each pixel, the cumulative distribution functions for each group
is plotted against the value of the variate. The median value for each class
(A and B) and the average of the two medians (c) are determined. If, say, the
median of B is greater than the median of A, then label every subject with a
value greater than c as B and every subject with a value less than c as A.
Then compute the fractions correctly ($f$) and incorrectly ($\bar{f}$)
labelled for each class.

If a cut-off perfectly classifies one group (say B), then $f_{B}~{}=~{}1$. If
a cut-off gives no information about one group (say A), then $f_{A}~{}=~{}0.5$
and $\bar{f}_{A}~{}=~{}0.5$. The fraction product is $f_{A}f_{B}$ and ranges
from 0.25 (no separation of the two groups) to 1.0 (complete separation).
Figure 1 above illustrates three cases of the fraction-product. It is
important to note that these parameters refer to the cumulative distribution
functions and are independent of the number of subjects in each group. For the
purpose of feature selection, we would focus on those pixels (wavelengths)
associated with fraction-products that are near 1.0.

To give a sense of what the fraction product quantifies, Figure 3 below
sketches the event space of choosing one subject from group A and one subject
from group B. The fraction-product is the probability that both are correctly
classified with the cutoff determined by the algorithm. This viewpoint helps
to distinguish the fraction-product from the similar concept of the area under
the curve using the receiver operating characteristic; that area is the
probability that one subject chosen randomly from group A and one subject
similarly chosen from group B will be ordered in the same manner as the two
classes are overall[3]. The fraction-product also differs from receiver
operating characteristic analysis because only the order of the data is
considered.

By mathematical symmetry, $\bar{f}_{A}\bar{f}_{B}$ could also chosen and
minimized. Although similar in principle to the ”probability of error”, the
small values involved when the features effectively separate the two groups
make its use impractical.

Figure 3. Probabilistic model for fraction-product.

##  4 Assessment of linewidth.

The general approach to quantifying the taxonomic value of linewidth is
straightforward when the p-value is used as the discriminant statistic. If a
cut-off is chosen so that p-values less than 0.05 indicates significant
taxonomic signal, then $0.05^{n}$ is an upper bound to the probability that
significant p-values occur by chance on n contiguous pixels. If the
t-statistic is used to compute the p-values, then in principle a two-tailed
test should be used until the first of a set of significant p-values is
reached and a one-tailed test used for each subsequent p-value. The reason for
this is that the first significant value may correspond to group A having
greater numerical values than group B or vice versa. Subsequent t-tests are
performed under the hypothesis that this order remains the same. As will
appear, this distinction does not lead in practice to different
interpretations of the data.

As mentioned above, it is convenient when the measure correlates positively
with the magnitude of the attribute. In the case of linewidth, this entails
that the discriminant measure be greater than or equal to 1.0 on each pixel so
that the product increases with the number of contiguous pixels for which the
statistic has a significant value. Table 1 collects several such discriminant
statistics that have proved their utility. Clearly the p-value will be the
most general; however, when comparing data collected under exactly the same
circumstances, we have found the fraction-product to be more useful[7].

Discriminant statistic | Comment
---|---
t / 1.96 | Two-tailed
t / 1.65 | One-tailed
0.05 / p | Conventional value for
| statistical significance
fp / 0.25 | Fraction-product with random
| as reference
Table 1. Four discriminant statistics that have been found to be useful
because taxonomically significant values are greater than 1.

In the context of feature selection, if the computed p-value is small enough,
then simply counting the number of contiguous pixels may suffice. For example,
if p-values less than 0.01 occur on three contiguous pixels, the odds of that
happening by chance are on the order of $10^{-6}$. Thus three successive
p-values may mark a region of the spectrum as being a candidate classifier
regardless of how many other contiguous pixels also indicate effective
discrimination. Furthermore, selecting contiguous pixels may also serve in
lieu of a Bonferroni correction for the thousands of pixels contained in
current detectors.

##  5 Definition of optical taxonomic signal.

Let s be a discriminant statistic such as those listed in Table 1 computed on
optical spectra such as described in Figure 1. Let $s_{i}$ be a set of values
on n contiguous pixels beginning on pixel number j. Then the optical taxonomic
signal, $\varsigma$ , is defined as

$\varsigma(j,n)=k~{}log\left(\prod_{i=j}^{i=n}s_{i}\right)$ (1)

The reason for the logarithm in this definition is simply to linearize what
would otherwise be an exponential function. Although the logarithm could have
any base, it is likely that Euler’s number e will be the most used, and k is a
constant to accommodate any change of base. This measure will apply only to
the designated region of the spectrum. Most importantly, it will allow
comparison of the amount of taxonomic signal in the same region collected
under different experimental conditions such as source-detector separation,
lamp intensity or fiber diameter. In the context of feature selection, the
region would be defined by the set of $s_{i}$ that exceed the cut-off for
discriminant significance. The taxonomic signal could be useful in more
rapidly eliminating the less effective candidate features.

###  5.1 Optical taxonomic signal to compare the same spectral region under
different conditions.

Here j and n remain constant, the variation in the $s_{i}$ being attributed to
the physical variable studied. If the t-statistic is used to determine the
p-value, it follows that the one-tailed/two-tailed question becomes irrelevant
because the two optical taxonomic signals are related by a factor of
$0.05^{n}$, which does not change with the physical variable. This issue does
not arise for the fraction-product, although the p-values must be determined
by simulations matching the numbers of subjects and pixels.

###  5.2 Optical taxonomic signal for feature selection

Because the utility of the features selected succeeds or fails by the test in
untouched data, choices in the discovery set become matters of judgment. A
simple way to proceed is to examine the “spectrum” of the discriminant
statistic and focus on those regions of greatest value. The discussion in 4 of
the one- vs two-tailed t-test used the two-tailed test for the first pixel
with significant signal to establish order of the two groups; throughout the
remaining region of significant discrimination the one-tailed test is better
suited. It can be argued that physically the linewidth extends beyond the
pixels with significant signal; as a matter of fact, we have always observed
pixels adjacent to regions of significant signal that nonetheless preserve the
order of group means. If these adjacent pixels set the order, then all the
pixels with significant optical taxonomic signal can be evaluated by the one-
tailed t-test. Using a one-tailed test improves the evaluation of Bonferroni-
type corrections.

##  6 Discussion

Our published results concerned the question of whether near-infrared
reflectance spectroscopy could become a diagnostic method for Alzheimer’s
disease [7]. It is well-recognized that it is difficult to replicate
measurements made using tissue optics in which adaptive parameters are used to
compute the result[9]; the reason for this is believed to be that the standard
ways to describe the specifications of optical instruments do not capture all
the variables that contribute to determining those parameters[9]. Our goal to
discover features that effectively separated Alzheimer’s disease from control
without weighting added another requirement to what would be considered as an
effective discriminant. This is where pattern recognition techniques proved
invaluable. These techniques enabled the complete separation of Alzheimer’s
patients from controls using only two, unweighted optical features.

The definition of optical taxonomic signal bears a superficial similarity to
some of the equations of information theory developed at Bell Laboratories,
especially those of Nyquist[8]. Recently, Carcassi and colleagues[2] have
revisited the concept of Shannon entropy and suggested that “variability” best
captures the intuition. Future work will explore this theoretical relationship
and the utility of optical taxonomic signal in practical applications.

## Acknowledgements

The author thanks Dr. J.C. Huetter for discussions of the fraction product and
Drs. E. Hanlon and S. Shirk for criticizing the manuscript. This work was
generally supported by the Office of Research and Development of the Veterans
Health Administration; all opinions are the author’s alone.

## References

  * [1] Christopher M. Bishop  “Pattern Recognition and Machine Learning (Information Science and Statistics)”  Springer-Verlag, 2006
  * [2] Gabriele Carcassi, Christine A. Aidala and Julian Barbour  “Variability as a better characterization of Shannon entropy”  In _Eur J Phys_ 42.4, 2021  URL: arXiv:1912.02012
  * [3] Tom Fawcett  “An introduction to ROC analysis”  In _Pattern Recognition Letters_ 27.8, 2006, pp. 861–874  DOI: https://doi.org/10.1016/j.patrec.2005.10.010
  * [4] Dmitrij Frishman, Pawel Smialowski and Stefan Kramer  “Pitfalls of supervised feature selection”  In _Bioinformatics_ 26.3, 2009, pp. 440–443  DOI: 10.1093/bioinformatics/btp621
  * [5] K.S. Fu  “Sequential Methods in Pattern Recognition and Machine Learning”  New York: Academic Press, Inc, 1968
  * [6] F.. Greco and E.. Hanlon  “EVALUATION OF BRAIN TISSUE AND MATERIAL BASED ON A FRACTION-PRODUCT AND OPTICAL SPECTROSCOPY”  In _US Patent and Trademark Office_ US-20230175955-A1.US-20230175955-A1, 2023, pp. 1–46  DOI: https://image-ppubs.uspto.gov/dirsearch-public/print/downloadPdf/20230175955
  * [7] F.. Greco, A.. McKee, N.. Kowall and E.. Hanlon  “Near-Infrared Optical Spectroscopy In Vivo Distinguishes Subjects with Alzheimer’s Disease from Age-Matched Controls”  In _J Alzheimers Dis_ 82.2, 2021, pp. 791–802  DOI: 10.3233/jad-201021
  * [8] H. Nyquist  “Certain Factors Affecting Telegraph Speed1”  In _Bell System Technical Journal_ 3.2, 1924, pp. 324–346  DOI: https://doi.org/10.1002/j.1538-7305.1924.tb01361.x
  * [9] A. Pifferi et al.  “Performance assessment of photon migration instruments: the MEDPHOT protocol”  In _Appl Opt_ 44.11, 2005, pp. 2104–14
  * [10] R. Richards-Kortum and E. Sevick-Muraca  “Quantitative optical spectroscopy for tissue diagnosis”  In _Annu Rev Phys Chem_ 47, 1996, pp. 555–606  DOI: 10.1146/annurev.physchem.47.1.555
  * [11] Y. Saeys, I. Inza and P. Larrañaga  “A review of feature selection techniques in bioinformatics”  In _Bioinformatics_ 23.19, 2007, pp. 2507–17  DOI: 10.1093/bioinformatics/btm344