# Privacy-preserving Artificial Intelligence Techniques in Biomedicine

Reihaneh Torkzadehmahani  Chair of Experimental Bioinformatics, Technical
University of Munich, Freising, Germany  Reza Nasirigerdeh  Chair of
Experimental Bioinformatics, Technical University of Munich, Freising, Germany
David B. Blumenthal  Chair of Experimental Bioinformatics, Technical
University of Munich, Freising, Germany  Tim Kacprowski  Chair of Experimental
Bioinformatics, Technical University of Munich, Freising, Germany  Division of
Data Science in Biomedicine, Peter L. Reichertz Institute for Medical
Informatics of TU Braunschweig and Hannover Medical School, Braunschweig,
Germany  Markus List  Chair of Experimental Bioinformatics, Technical
University of Munich, Freising, Germany  Julian Matschinske  Chair of
Experimental Bioinformatics, Technical University of Munich, Freising, Germany
Julian Späth  Chair of Experimental Bioinformatics, Technical University of
Munich, Freising, Germany  Nina Kerstin Wenke  Chair of Experimental
Bioinformatics, Technical University of Munich, Freising, Germany  Béla Bihari
Gnome Design SRL, Sfântu Gheorghe, Romania  Tobias Frisch  Institute of
Mathematics and Computer Science, University of Southern Denmark, Odense,
Denmark  Anne Hartebrodt  Institute of Mathematics and Computer Science,
University of Southern Denmark, Odense, Denmark  Anne-Christin Hauschild
Department of Mathematics and Computer Science, Philipps-University of
Marburg, Marburg, Germany  Dominik Heider  Department of Mathematics and
Computer Science, Philipps-University of Marburg, Marburg, Germany  Andreas
Holzinger  Institute for Medical Informatics/Statistics, Medical University
Graz, Graz, Austria  Walter Hötzendorfer  Research Institute AG & Co KG,
Vienna, Austria  Markus Kastelitz  Research Institute AG & Co KG, Vienna,
Austria  Rudolf Mayer  SBA Research Gemeinnützige GmbH, Vienna, Austria
Cristian Nogales  Department of Pharmacology and Personalised Medicine, MeHNS,
FHML, Maastricht University, Maastricht, the Netherlands  Anastasia
Pustozerova  SBA Research Gemeinnützige GmbH, Vienna, Austria  Richard Röttger
Institute of Mathematics and Computer Science, University of Southern Denmark,
Odense, Denmark  Harald H.H.W. Schmidt  Department of Pharmacology and
Personalised Medicine, MeHNS, FHML, Maastricht University, Maastricht, the
Netherlands  Ameli Schwalber  Concentris Research Management GmbH,
Fürstenfeldbruck, Germany  Christof Tschohl  Research Institute AG & Co KG,
Vienna, Austria  Andrea Wohner  Concentris Research Management GmbH,
Fürstenfeldbruck, Germany  Jan Baumbach  Chair of Experimental Bioinformatics,
Technical University of Munich, Freising, Germany  Institute of Mathematics
and Computer Science, University of Southern Denmark, Odense, Denmark

## Abstract

Artificial intelligence (AI) has been successfully applied in numerous
scientific domains. In biomedicine, AI has already shown tremendous potential,
e.g. in the interpretation of next-generation sequencing data and in the
design of clinical decision support systems. However, training an AI model on
sensitive data raises concerns about the privacy of individual participants.
For example, summary statistics of a genome-wide association study can be used
to determine the presence or absence of an individual in a given dataset. This
considerable privacy risk has led to restrictions in accessing genomic and
other biomedical data, which is detrimental for collaborative research and
impedes scientific progress. Hence, there has been a substantial effort to
develop AI methods that can learn from sensitive data while protecting
individuals’ privacy. This paper provides a structured overview of recent
advances in privacy-preserving AI techniques in biomedicine. It places the
most important state-of-the-art approaches within a unified taxonomy and
discusses their strengths, limitations, and open problems. As the most
promising direction, we suggest combining federated machine learning as a more
scalable approach with other additional privacy preserving techniques. This
would allow to merge the advantages to provide privacy guarantees in a
distributed way for biomedical applications. Nonetheless, more research is
necessary as hybrid approaches pose new challenges such as additional network
or computation overhead.

## Introduction

Artificial intelligence (AI) strives to emulate human mind and to solve
complex tasks by learning from available data. For many complex tasks, AI
already surpasses humans in terms of accuracy, speed and cost. Recently, the
rapid adoption of AI and its subfields, specifically machine learning and deep
learning, has led to substantial progress in applications such as autonomous
driving [1], text translation [2] and voice assistance [3]. At the same time,
AI is becoming essential in biomedicine, where big data in healthcare
necessitates techniques that help scientists to gain understanding from it
[4].

Success stories such as acquiring the compressed representation of drug-like
molecules [5], modeling the hierarchical structure and function of a cell [6]
and translating magnetic resonance images to computed tomography [7] using
deep learning models illustrate the remarkable performance of these AI
approaches. AI has not only achieved remarkable success in analyzing genomic
and biomedical data [8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18], but has also
surpassed humans in applications such as sepsis prediction [19], malignancy
detection on mammography [20] and mitosis detection in breast cancer [21].

Despite these AI-fueled advancements, important privacy concerns have been
raised regarding the individuals who contribute to the datasets. While taking
care of the confidentiality of sensitive biological data is crucial [22],
several studies showed that AI techniques often do not maintain data privacy
[23, 24, 25, 26]. For example, attacks known as membership inference can be
used to infer an individual’s membership by querying over the dataset [27] or
the trained model [23], or by having access to certain statistics about the
dataset [28, 29, 30]. Homer et al. [28] showed that under some assumptions, an
adversary (an attacker who attempts to invade data privacy) can use the
statistics published as the results of genome-wide association studies (GWAS)
to find out if an individual was a part of the study. Another example of this
kind of attack was demonstrated by attacks on Genomics Beacons [31, 27], in
which an adversary could determine the presence of an individual in the
dataset by simply querying the presence of a particular allele. Moreover, the
attacker could identify the relatives of those individuals and obtain
sensitive disease information [30]. Besides targeting the training dataset, an
adversary may attack a fully-trained AI model to extract individual-level
membership by training an adversarial inference model that learns the
behaviour of the target model [23].

As a result of the aforementioned studies, health research centers such as the
National Institutes of Health (NIH) as well as hospitals have restricted
access to the pseudonymized data [32, 33, 22]. Furthermore, data privacy laws
such as those enforced by the Health Insurance Portability and Accountability
Act (HIPAA), and the Family Educational Rights and Privacy Act (FERPA) in the
US as well as the EU General Data Protection Regulation (GDPR) restrict the
use of sensitive data [34, 35]. Consequently, getting access to these datasets
requires a lengthy approval process, which significantly impedes collaborative
research. Therefore, both industry and academia urgently need to apply
privacy-preserving techniques to respect individual privacy and comply with
these laws.

This paper provides a systematic overview over various recently proposed
privacy-preserving AI techniques in biomedicine, which facilitate the
collaboration between health research institutes. Several efforts exist to
tackle the privacy concerns in several domains, some of which have been
examined in a couple of surveys [36, 37, 38]. Aziz et al. [36] investigated
previous studies which employed differential privacy and cryptographic
techniques for human genomic data. Kaissis et al.[38] briefly reviewed
federated learning, differential privacy and cryptographic techniques applied
in medical imaging. Xu et al. [37] surveyed general solutions to challenges in
federated learning including communication efficiency, optimization, as well
as privacy and discussed possible applications including a few examples in
healthcare. Compared to [36] and [38], this paper covers a broader set of
privacy preserving techniques including federated learning and hybrid
approaches. In contrast to [37] we additionally discuss cryptographic
techniques and differential privacy approaches and their applications in
biomedicine. Moreover, this survey covers a wider range of studies that
employed different privacy-preserving techniques in genomics and biomedicine
and compares the approaches using different criteria such as privacy, accuracy
and efficiency.

(a) ) Homomorphic encryption

(b) ) Secure multiparty computation

(c) ) Differential privacy

(d) ) Federated learning

Figure 1: Different privacy-preserving AI techniques: (a) homomorphic
encryption, where the participants encrypt the private data and share it with
a computing party, which computes the aggregated results over the encrypted
data from the participants; (b) secure multiparty computation in which each
participant shares a separate, different secret with each computing party; the
computing parties calculate the intermediate results, secretly share them with
each other, and aggregate all intermediate results to obtain the final
results; (c) differential privacy, which ensures the models trained on
datasets including and excluding a specific individual look statistically
indistinguishable to the adversary; (d) federated learning, where each
participant downloads the global model from the server, computes the local
model given its private data and the global model, and finally sends its local
model to the server for aggregation and for updating the global model.

The presented approaches are divided into four categories: cryptographic
techniques, differential privacy, federated learning, and hybrid approaches.
First, we describe how cryptographic techniques — in particular, homomorphic
encryption (HE) and secure multiparty computation (SMPC) — ensure secrecy of
sensitive data by carrying out computations on encrypted/anonymous biological
data. Next, we illustrate the differential privacy approach and its capability
in quantifying individuals’ privacy in published summary statistics of, for
instance, GWAS data and deep learning models trained on clinical data. Then,
we elaborate on federated learning, which allows health institutes to train
AIs locally and to share only selected parameters without sensitive data with
a coordinator, who aggregates them and builds a global model. Following that,
we discuss hybrid approaches which enhance data privacy by combining federated
learning with other privacy-preserving techniques. We elaborate on the
strengths and drawbacks of each approach as well as its applications in
biomedicine. More importantly, we provide a comparison among the approaches
with respect to different criteria such as computational and communication
efficiency, accuracy, and privacy. Finally, we discuss the most realistic
approaches from a practical viewpoint and provide a list of open problems and
challenges that remain for the adoption of these techniques in real-world
biomedical applications.

Our review of privacy-preserving AI techniques in biomedicine yields the
following main insights: First, cryptographic techniques such as HE and SMPC,
which follow the paradigm of “bring data to computation“, are not
computationally efficient and do not scale well to large biomedical datasets.
Second, federated learning follows the paradigm of “bring computation to data“
is a more scalable approach. However, its network communication efficiency is
still an open problem and it does not provide privacy guarantees. Third,
hybrid approaches that combine cryptographic techniques or differential
privacy with federated learning are the most promising privacy-preserving AI
techniques for biomedical applications, because they promise to combine the
scalability of federated learning with the privacy guarantees of cryptographic
techniques or differential privacy.

## Cryptographic Techniques

In biomedicine and GWAS in particular, cryptographic techniques have been used
to collaboratively compute result statistics while preserving data privacy
[39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52]. These cryptographic
approaches are based on HE [53] or SMPC [54]. HE-based approaches share three
steps (Figure 1a):

  1. 1.

Participants (e.g. hospitals or medical centers) encrypt their private data
and send the encrypted data to a computing party.

  2. 2.

The computing party calculates the statistics over the encrypted data and
shares the statistics (which are encrypted) with the participants.

  3. 3.

The participants access the results by decrypting them.

In SMPC, there are multiple participants as well as a couple of computing
parties which perform computations on secret shares from the participants.
Given $M$ participants and $N$ computing parties, SMPC-based approaches follow
three steps (Figure 1b):

  1. 1.

Each participant sends a separate and different secret to each of the $N$
computing parties.

  2. 2.

Each computing party computes the intermediate results on the $M$ secret
shares from the participants and shares the intermediate results with the
other $N-1$ computing parties.

  3. 3.

Each computing party aggregates the intermediate results from all computing
parties including itself to calculate the final (global) results. In the end,
the final results computed by all computing parties are the same and can be
shared by the participants.

To clarify the concepts of secret sharing [55] and multi-party computation,
consider a scenario with two participants $P_{1}$ and $P_{2}$ and two
computing parties $C_{1}$ and $C_{2}$ [56]. $P_{1}$ and $P_{2}$ possess the
private data $X$ and $Y$, respectively. The aim is to compute $X+Y$, where
neither $P_{1}$ nor $P_{2}$ reveals its data to the computing parties. To this
end, $P_{1}$ and $P_{2}$ generate random numbers $R_{X}$ and $R_{Y}$,
respectively; $P_{1}$ reveals $R_{X}$ to $C_{1}$ and $(X-R_{X})$ to $C_{2}$;
likewise, $P2$ shares $R_{Y}$ with $C_{1}$ and $(Y-R_{Y})$ with $C_{2}$;
$R_{X}$, $R_{Y}$, $(X-R_{X})$ and $(Y-R_{Y})$ are secret shares. $C_{1}$
computes $(R_{X}+R_{Y})$ and sends it to $C_{2}$ and $C_{2}$ calculates
$(X-R_{X})+(Y-R_{Y})$ and reveals it to $C_{1}$. Both $C_{1}$ and $C_{2}$ add
the result they computed to the result each obtained from the other computing
party. The sum is in fact $(X+Y)$, which can be shared with $P_{1}$ and
$P_{2}$.

Notice that to preserve data privacy, the computing parties $C_{1}$ and
$C_{2}$ must be non-colluding. That is, $C_{1}$ must not send $R_{X}$ and
$R_{Y}$ to $C_{2}$ and $C_{2}$ must not share $(X-R_{X})$ and $(Y-R_{Y})$ with
$C_{1}$. Otherwise, the computing parties can compute $X$ and $Y$, revealing
the participants’ data. In general, in a SMPC with $N$ computing parties, data
privacy is protected as long as at most $N-1$ computing parties collude with
each other. The larger $N$, the stronger the privacy but the higher the
communication overhead and processing time.

Most studies use HE or SMPC to develop secure, privacy-aware algorithms
applicable to GWAS data. Kim et al. [42] and Lu et al. [44] implemented a
secure $\chi^{2}$ test and Lauter et al. [43] developed privacy-preserving
versions of common statistical tests in GWAS, such as the Pearson goodness of
fit test, tests for linkage disequilibrium, and the Cochran Armitage trend
test using HE. Kim et al. [57] and Morshed et al. [58] presented a HE-based
secure logistic and linear regression algorithms for GWAS data, respectively.
Zhang et al. [48], Constable et al. [47], and Kamm et al. [46] developed a
SMPC-based secure $\chi^{2}$ test. Shi et al. [59] implemented a privacy-
preserving logistic regression and Bloom [60] proposed a secure linear
regression based on SMPC for GWAS data. Cho et al. [39] introduced a SMPC-
based framework to facilitate quality control and population stratification
correction for large-scale GWAS and argued that their framework is scalable to
one million individuals and half million single nucleotide polymorphisms
(SNPs).

There are also other types of encryption techniques such as somewhat
homomorphic encryption (SWHE) [53], which are employed to address privacy
issues in genomic applications such as outsourcing genomic data computation to
the cloud, and are not the main focus of this review. For more details, we
refer to the comprehensive review by Mittos et al. [61].

Despite the promises of HE/SMPC-based privacy-preserving algorithms (Table 1),
the road for the wide adoption of HE/SMPC-based algorithms in genomics and
biomedicine is long [62]. The major limitations of HE are few supported
operations and computational overhead [63]. HE supports only addition and
multiplication operations, and as a result, developing complex AI models with
non-linear operations such as deep neural networks (DNNs) using HE is very
challenging. Moreover, HE incurs remarkable computational overhead since it
performs operations on encrypted data. Although SMPC is more efficient than HE
from a computational perspective, it still suffers from high computational
overhead [64], which comes from processing secret shares from a large number
of participants or large amount of data by a few number of computing parties.

Table 1: Literature for cryptographic techniques and differential privacy in genomics and biomedicine. HE: homomorphic encryption, SMPC: secure multiparty computation, DP: differential privacy Authors | Year | Privacy Technique | Model | Application
---|---|---|---|---
Kim et al. [42] | 2015 | HE |  $\chi^{2}$ statistics minor allele frequency Hamming Distance Edit distance |  genetic associations DNA comparison
Lu et al. [44] | 2015 | HE |  $\chi^{2}$ statistics $D^{\prime}$ measure |  genetic associations
Lauter et al. [43] | 2014 | HE |  $D^{\prime}$ and $r^{2}$ measures Pearson goodness-of-fit expectation maximization Cochran-Armitage | genetic associations
Kim et al. [57] | 2018 | HE | logistic regression | medical decision making
Morshed et al. [58] | 2018 | HE | linear regression | medical decision making
Kamm et al. [46] | 2013 | SMPC | $\chi^{2}$ statistics | genetic associations
Constable et al. [47] Zhang et al. [48] |  2015 2015 | SMPC |  $\chi^{2}$ statistics minor allele frequency | genetic associations
Shi et al. [59] | 2016 | SMPC | logistic regression | genetic associations
Bloom [60] | 2019 | SMPC | linear regression | genetic associations
Cho et al. [39] | 2018 | SMPC |  quality control population stratification | genetic associations
Johnson et al. [65] | 2013 | DP |  distance-score mechanism p-value and $\chi^{2}$ statistics | querying genomics databases
Cho et al. [66] | 2020 | DP |  truncated $\alpha$ -geometric mechanism | querying biomedical databases
Aziz et al. [67] | 2017 | DP |  eliminating random positions biased random response | querying genomics databases
Han et al. [68] Yu et al. [69] |  2019 2014 | DP | logistic regression | genetic associations
Honkela et al. [70] | 2018 | DP | bayesian linear regression | drug sensitivity prediction
Simmons et al. [71] | 2016 | DP |  EIGENSTRAT linear mixed model | genetic associations
Simmons et al. [72] | 2016 | DP | nearest neighbor optimization | genetic associations
Fienberg et al. [73] Uhlerop et al. [74] Yu et al. [75] Wang et al. [76] |  2011 2013 2014 2014 | DP |  statistics such as p-value, $\chi^{2}$ and contingency table | genetic associations
Abay et al. [77] | 2018 | DP | deep autoencoder | generating artificial biomedical data
Beaulieu et al. [78] | 2019 | DP | GAN | simulating SPRINT trial
Jordon et al. [79] | 2018 | DP | GAN | generating artificial biomedical data

## Differential Privacy

One of the state-of-the-art concepts for eliminating and quantifying the
chance of information leakage is differential privacy [80, 81, 82].
Differential privacy is a mathematical model that encapsulates the idea of
injecting enough randomness or noise to sensitive data to camouflage the
contribution of each single individual. This is achieved by inserting
uncertainty into the learning process so that even a strong adversary with
arbitrary auxiliary information about the data will still be uncertain in
identifying any of the individuals in the dataset. This has become standard in
data protection and has been effectively deployed by Google [83] and Apple
[84] as well as agencies such as the United States Census Bureau. Furthermore,
it has drawn the attention of researchers in privacy-sensitive fields such as
biomedicine and healthcare [65, 85, 73, 74, 75, 86, 87, 88, 69, 70, 68, 72,
71, 76, 89, 67, 73].

Differential privacy ensures that the model we train does not overfit the
sensitive data of a particular user. The model trained on a dataset containing
information of a specific individual should be statistically indistinguishable
from a model trained without the individual (Figure 1c). As an example, assume
that a patient would like to give consent to his/her doctor to include his/her
personal health record in a biomedical dataset to study the coordination
between age and cardiovascular disease. Differential privacy provides a
mathematical guarantee which captures the privacy risk associated with the
patient’s participation in the study and explains to what extent the analyst
or the potential adversary can learn about that particular individual in the
dataset.

Formally, a randomized algorithm (an algorithm that has randomness in its
logic and whose output can vary even on a fixed input)
$\mathit{A:D^{n}\xrightarrow{}Y}$ is ($\epsilon$, $\delta$)-differentially
private if for all subsets $\mathit{y\subseteq Y}$ and for all adjacent
datasets $D,D^{\prime}\in D^{n}$ that differ in at most one record the
following inequality holds:

$Pr[A(D)\in y]\leq e^{\epsilon}Pr[A(D^{\prime})\in y]+\delta$

Here, $\epsilon$ and $\delta$ are privacy loss parameters where lower values
imply stronger privacy guarantees. $\delta$ is an exceedingly small value
(e.g. ${10}^{-5}$) indicating the probability of an uncontrolled breach, where
the algorithm produces a specific output only in the presence of a specific
individual and not otherwise. $\epsilon$ represents the worst case privacy
breach in the absence of any such rare breach. If you assume $\delta=0$, you
will have a pure ($\epsilon$)-differentially private algorithm, while if you
consider $\delta>0$ to approximate the case in which pure differential privacy
is broken, you will have an approximate ($\epsilon$, $\delta$)-differentially
private algorithm.

Two important properties of differential privacy are composability [90] and
resilience to post-processing. Composability means that combining multiple
differentially private algorithms yields another differentially private
algorithm. More precisely, if you combine $k$ ($\epsilon$,
$\delta$)-differentially private algorithms, the composed algorithm is at
least ($k\epsilon$, $k\delta$)-differentially private. Differential privacy
also assures resistance to post-processing theorem which states passing the
output of an ($\epsilon$, $\delta$)-differentially private algorithm to any
arbitrary randomized algorithm will still uphold the ($\epsilon$,
$\delta$)-differential privacy guarantee.

The community efforts to ensure the privacy of sensitive genomic and
biomedical data using differential privacy can be grouped into four categories
according to the problem they address (Table 1):

  1. 1.

Approaches to querying biomedical and genomics databases [65, 89, 67, 66].

  2. 2.

Statistical and AI modeling techniques in genomics and biomedicine [70, 88,
69, 68, 72, 71].

  3. 3.

Data release, i.e., releasing summary statistics of a GWAS such as $p$-values
and $\chi^{2}$ contingency tables [73, 74, 75, 76].

  4. 4.

Training privacy-preserving generative models [77, 78, 79].

Studies in the first category proposed solutions to reduce the privacy risks
of genomics databases such as GWAS databases and genomics beacon service [91].
The Beacon Network [31] is an online web service developed by the Global
Alliance for Genomics and Health (GA4GH) through which the users can query the
data provided by owners or research institutes, ask about the presence of a
genetic variant in the database, and get a YES/NO as response. Studies have
shown that an attacker can detect membership in the Beacon or GWAS by querying
these databases multiple times and asking different questions [27, 92, 93,
94]. Very recently, Cho et al. [66] proposed a theoretical differential
privacy mechanism to maximize the utility of count query in biomedical systems
while guaranteeing data privacy. Johnson et al. [65] developed a
differentially private query-answering framework. With this framework an
analyst can retrieve statistical properties such as the correlation between
SNPs and get an almost accurate answer while the GWAS dataset is protected
against privacy risks. In anoher study, Aziz et al. [67] proposed two
algorithms to make the Beacon’s response inaccurate by controlling a bias
variable. These algorithms decide when to answer the query
correctly/incorrectly according to specific conditions in the bias variable so
that it gets harder for the attacker to succeed.

Some of the efforts in the second category addressed the privacy concerns in
GWAS by introducing differentially private logistic regression to identify
associations between SNPs and diseases [68] or associations among multiple
SNPs [69]. Honkela et al. [70] improve drug sensitivity prediction by
effectively employing differential privacy for Bayesian linear regression.
Moreover, Simmons et al. [71] presented a differentially private EIGENSTRAT
(PrivSTRAT) [95] and linear mixed model (PrivLMM) [96] to correct for
population stratification. In another paper, Simmons et al. [72] tackled the
problem of finding significant SNPs by modeling it as an optimization problem.
Solving this problem provides a differentially private estimate of the
neighbor distance for all SNPs so that high scoring SNPs can be found.

The third category focused on releasing summary statistics such as $p$-values,
$\chi^{2}$ contingency tables, and minor allele frequencies in a
differentially private fashion. The common approach in these studies is to add
Laplacian noise to the true value of the statistics, so that sharing the
perturbed statistics preserves privacy of the individuals. They vary in the
sensitivity of the algorithms (that is, the maximum change on the output of an
algorithm in presence or absence of a specific data point) and hence require
different amounts of injected noise [73, 74, 76].

The forth category proposed novel privacy-protecting methods to generate
synthetic healthcare data leveraging differentially private generative models
(Figure 2). Deep generative models, such as generative adversarial networks
(GANs) [97], can be trained on sensitive genomics and biomedical data to
capture its properties and generate artificial data with similar
characteristics as the original data.  Figure 2: Differentially private deep
generative models: The sensitive data holder (e.g. health institutes) train a
differentially private generative model locally and share just the trained
data generator with the outside world (e.g. researchers). The shared data
generator can then be used to produce artificial data with the same
characteristics as the sensitive data.

Abay et al. [77] presented a differentially private deep generative model, DP-
SYN, a generative autoencoder that splits the input data into multiple
partitions, then learns and simulates the representation of each partition
while maintaining the privacy of input data. They assessed the performance of
DP-SYN on sensitive datasets of breast cancer and diabetes. Beaulieu et al.
[78] trained an auxiliary classifier GAN (AC-GAN) in a differentially private
manner to simulate the participants of the SPRINT trial (Systolic Blood
Pressure Trial), so that the clinical data can be shared while respecting
participants’ privacy. In another approach, Jordon et al. [79] introduced a
differentially private GAN, PATE-GAN, and evaluated the quality of synthetic
data on Meta-Analysis Global Group in Chronic Heart Failure (MAGGIC) and the
United Network for Organ Transplantation (UNOS) datasets.

Despite the aforementioned achievements in adopting differential privacy in
the field, several challenges remain to be addressed. Although differential
privacy involves less network communication, memory usage and time complexity
compared to cryptographic techniques, it still struggles with giving highly
accurate results within a reasonable privacy budget, namely, intended
$\epsilon$ and $\delta$, on large-scale datasets such as genomics datasets
[98, 36]. In more details, since genomic datasets are huge, the sensitivity of
the applied algorithms on these datasets is large. Hence, the amount of
distortion required for anonymization increases significantly, sometimes to
the extent that the results will not be meaningful anymore [99]. Therefore, to
make differential privacy more practical in the field, balancing a trade off
between privacy and utility demands more attention than it has received [88,
86, 87, 76].

## Federated Learning

Federated learning [100] is a type of distributed learning where multiple
clients (e.g. hospitals) collaboratively learn a model under the coordination
of a central server while preserving the privacy of their data. Instead of
sharing its private data with the server or the other clients, each client
extracts knowledge (that is, model parameters) from its data and transfers it
to the server for aggregation (Figure 1d).

Federated learning is an iterative process in which each iteration consists of
the following steps [101]:

  1. 1.

The server chooses a set of clients to participate in the current iteration of
the model.

  2. 2.

The selected clients obtain the current model from the server.

  3. 3.

Each selected client computes the local parameters using the current model and
its private data (e.g., runs gradient descent algorithm initialized by the
current model on its local data to obtain the local gradient updates).

  4. 4.

The server collects the local parameters from the selected clients and
aggregates them to update the current model.

The data of the clients can be considered as a table, where rows represent
samples (e.g., individuals) and columns represent features or labels (e.g.,
age, case vs. control). We refer to the set of samples, features, and labels
of the data as sample space, feature space, and label space, respectively.
Federated learning can be categorized into three types based on the
distribution characteristics of the clients’ data:

  * •

Horizontal (sample-based) federated learning [102]: Data from different
clients shares similar feature space but is very different in sample space. As
an example, consider two hospitals in two different cities which collected
similar information such as age, gender, and blood pressure about the
individuals. In this case, the feature spaces are similar; but because the
individuals who participated in the hospitals’ data collections are from
different cities, their intersection is most probably very small, and the
sample spaces are hence very different.

  * •

Vertical (feature-based) federated learning [102] : Clients’ data is similar
in sample space but very different in feature space. For example, two
hospitals with different expertise in the same city might collect different
information (different feature space) from almost the same individuals
(similar sample space).

  * •

Hybrid federated learning: Both feature space and sample space are different
in the data from the clients. For example, consider a medical center with
expertise in brain image analysis located in New York and a research center
with expertise in protein research based in Berlin. Their data is completely
different (image vs. protein data) and disjoint groups of individuals
participated in the data collection of each center.

To illustrate the concept of federated learning, consider a scenario with two
hospitals $A$ and $B$. $A$ and $B$ possess lists $X$ and $Y$, containing the
age of their cancer patients, respectively. A simple federated mean algorithm
to compute the average age of cancer patients in both hospitals without
revealing the real values of $X$ and $Y$ works as follows: For the sake of
brevity, we assume that both hospitals are selected in the first step and that
the current global model parameters (average age) in the second step are zero
(see federated learning steps).

  * •

Hospital $A$ computes the average age ($M_{X}$) and number of its cancer
patients ($N_{X}$). Hospital $B$ does the same, resulting in $M_{Y}$, $N_{Y}$.
Here, $X$ and $Y$ are private data while $M_{X}$, $N_{X}$, $M_{Y}$, $N_{Y}$
are the parameters extracted from the private data.

  * •

The server obtains the values of local model parameters from the hospitals and
computes the global mean as follows:

$M_{G}=\frac{M_{X}\times N_{X}+M_{Y}\times N_{Y}}{N_{X}+N_{Y}}$

The emerging demand for federated learning gave rise to a wealth of both
simulation [103, 104] and production-oriented [105, 106] open source
frameworks. Additionally, there are AI platforms whose goal is to apply
federated learning to real-world healthcare settings [107, 108]. In the
following, we survey studies on federated AI techniques in biomedicine and
healthcare (Table 2). Recent studies in this regard mainly focused on
horizontal federated learning and there are a few vertical or hybrid federated
learning algorithms applicable to genomic and biomedical data.

A number of the studies provided solutions for the lack of sufficient data due
to the the privacy challenges in the medical imaging domain [109, 110, 111,
112, 113, 114, 108]. For instance, Sheller et al. developed a supervised DNN
in a federated way for semantic segmentation of brain Gliomas from magnetic
resonance imaging scans [109]. Chang et al. [114] simulated a distributed DNN
in which multiple participants collaboratively update model weights using
training heuristics such as single weight transfer and cyclical weight
transfer (CWT). They evaluated this distributed model using image
classification tasks on medical image datasets such as mammography and retinal
fundus image collections, which were evenly distributed among the
participants. Balachandar et al. [113] optimized CWT for cases where the
datasets are unevenly distributed across participants. They assessed their
optimization methods on simulated diabetic retinopathy detection and chest
radiograph classification.

Federated Cox regression, linear regression, logistic regression as well as
chi-square test have been developed for sensitive biomedical data that is
vertically or horizontally distributed [115, 116, 117, 118, 119, 120].
VERTICOX [115] is a vertical federated Cox regression model for survival
analysis, which employs the alternating direction method of multiplier (ADMM)
framework [121] and is evaluated on acquired immunodeficiency syndrome (AIDS)
and breast cancer survival datasets. Similarly, WebDISCO [116] presents a
federated Cox regression model but for horizontally distributed survival data.
The grid binary logistic regression (GLORE) [117] and the expectation
propagation logistic regression (EXPLORER) [118] implemented a horizontally
federated logistic regression for GWAS data. Unlike GLORE, EXPLORER supports
asynchronous communication and online learning functionality so that the
system can continue collaborating in case a participant is absent or if
communication is interrupted. Li _et al._ presented VERTIGO [119], a vertical
grid logistic regression algorithm designed for vertically distributed
biological datasets such as breast cancer genome and myocardial infarction
data. Nasirigerdeh et al. [120] developed a horizontally federated tool set
for GWAS, called sPLINK, which supports chi-square test, linear regression,
and logistic regression. Notably, federated results from sPLINK on distributed
datasets are the same as those from aggregated analysis conducted with PLINK
[122]. Moreover, they showed that sPLINK is robust against heterogeneous
(imbalanced) data distributions across clients and does not lose its accuracy
in such scenarios.

There are also studies that combine federated learning with other traditional
AI modeling techniques such as ensemble learning, support vector machines
(SVMs) and principle component analysis (PCA) [123, 124, 125, 126, 127].
Brisimi et al. [123] presented a federated soft-margin support vector machine
(sSVM) for distributed electronic health records. Huang et al. [124]
introduced LoAdaBoost, a federated adaptive boosting method for learning
biomedical data such as intensive care unit data from distinct hospitals [128]
while Liu et al. [125] trained a federated autonomous deep learner to this
end. There have also been a couple of attempts at incorporating federated
learning into multi-task learning and transfer learning in general [129, 130,
131]. However, to the best of our knowledge, FedHealth [126] is the only
federated transfer learning framework specifically designed for healthcare
applications. It enables users to train personalized models for their wearable
healthcare devices by aggregating the data from different organizations
without compromising privacy.

Table 2: Summary of federated learning (FL) and hybrid approaches in genomics and biomedicine Authors | Year | Privacy Technique | Model | Application
---|---|---|---|---
Sheller et al. [109] | 2018 | FL | DNN | medical image segmentation
Chang et al. [114] Balachandar et al. [113] |  2018 2020 | FL |  single weight transfer cyclical weight transfer | medical image classification
Nasirigerdeh et al. [120] | 2020 | FL |  linear regression chi-square logistic regression | genetic associations
Wu et al. [117] Wang et al. [118] Li et al. [119] |  2012 2013 2016 | FL | logistic regression | genetic associations
Dai et al. [115] Lu et al. [116] |  2020 2015 | FL | cox regression | survival analysis
Brisimi et al. [123] | 2018 | FL | support vector machine | classifying electrical health records
Huang et al. [124] | 2018 | FL | adaptive boosting ensemble | classifying medical data
Liu et al. [125] | 2018 | FL | autonomous deep learning | classifying medical data
Chen et al. [126] | 2019 | FL | transfer learning | training wearable healthcare devices
Li et al. [132] | 2019 | FL+DP | DNN | medical image segmentation
Li et al. [133] | 2020 | FL+DP | domain adoption | medical image pattern recognition
Choudhury et al. [134] | 2019 | FL+DP |  perceptron neural network support vector machine logistic regression | classifying electronic health records
Constable et al. [47] | 2015 | FL+SMPC |  statistical analysis (e.g. $\chi^{2}$ statistics) | genetic associations
Lee et al. [135] | 2018 | FL+HE | context-specific hashing | learning patient similarity
Kim et al. [136] | 2019 | FL+DP+HE | logistic regression | classifying medical data

One of the major challenges for adopting federated learning in large scale
genomics and biomedical applications is the significant network communication
overhead, especially for complex AI models such as DNNs that contain millions
of model parameters and require thousands of iterations to converge. A rich
body of literature exists to tackle this challenge, known as communication-
efficient federated learning [137, 138, 139, 140].

Another challenge in federated learning is the possible accuracy loss from the
aggregation process if the data distribution across the clients is
heterogeneous (i.e. not independent and identically distributed (IID)). More
specifically, federated learning can deal with non-IID data while preserving
the model accuracy if the learning model is simple such as ordinary least
squares (OLS) linear regression (sPLINK [120]). However, when it comes to
learning complex models such as DNNs, the global model might not converge on
non-IID data across the clients. Zhao et al. [141] showed that simple
averaging of the model parameters in the server significantly diminishes the
accuracy of a convolutional neural network model in highly skewed non-IID
settings. Developing the aggregation strategies which are robust against non-
IID scenarios is still an open and interesting problem in federated learning.

Finally, federated learning is based on the assumption that the centralized
server is honest and not compromised, which is not necessarily the case in
real applications. To relax this assumption, differential privacy or
cryptographic techniques can be leveraged in federated learning, which is
covered in the next section. For further reading on future directions of
federated learning in general, we refer the reader to comprehensive surveys
[142, 101, 143].

## Hybrid Privacy-preserving Techniques

The hybrid techniques combine federated learning with the other paradigms
(cryptographic techniques and differential privacy) to enhance privacy or
provide privacy guarantees (Table 2). Federated learning preserves privacy to
some extent because it does not require the health institutes to share the
patients’ data with the central server. However, the model parameters that
participants share with the server might be abused to reveal the underlying
private data if the coordinator is compromised [144]. To handle this issue,
the participants can leverage differential privacy and add noise to the model
parameters before sending them to the server (FL+DP) [145, 132, 133, 146, 147]
or they employ HE (FL+HE)[148, 149, 52], SMPC (FL+SMPC) or both DP and HE
(FL+DP+HE) [136, 94, 150] to securely share the parameters with the server
[135, 47].

In the genomic and biomedical field, several hybrid approaches have been
presented recently. Li et al. [132] presented a federated deep learning
framework for magnetic resonance brain image segmentation in which the client
side provides differential privacy guarantees on selecting and sharing the
local gradient weights with the server for imbalanced data. A recent study
[133] extracted neural patterns from brain functional magnetic resonance
images by developing a privacy-preserving pipeline that analyzes image data of
patients having different psychiatric disorders using federated domain
adaption methods. Choudhury et al. [134] developed a federated differential
privacy mechanism for gradient-based classification on electronic health
records.

There are also some studies that incorporate federate learning with
cryptographic techniques. For instance, Constable et al. [47] implemented a
privacy-protecting structure for federated statistical analysis such as
$\chi^{2}$ statistics on GWAS while maintaining privacy using SMPC. In a
slightly different approach, Lee et al. [135] presented a privacy-preserving
platform for learning patient similarity in multiple hospitals using a
context-specific hashing approach which employs homomorphic encryption to
limit the privacy leakage. Moreover, Kim et al. [136] presented a privacy-
preserving federated logistic regression algorithm for horizontally
distributed diabetes and intensive care unit datasets. In this approach, the
logistic regression ensures privacy by making the aggregated weights
differentially private and encrypting the local weights using homomorphic
encryption.

Incorporating HE, SMPC, and differential privacy into federated learning
brings about enhanced privacy but it combines the limitations of the
approaches, too. FL+HE puts much more computational overhead on the server,
since it requires to perform aggregation on the encrypted model parameters
from the clients. The network communication overhead is exacerbated in
FL+SMPC, because clients need to securely share the model parameters with
multiple computing parties instead of one. FL+DP might result in inaccurate
models because of adding noise to the model parameters in the clients.

Table 3: Comparison among the privacy-preserving techniques including homomorphic encryption (HE), secure multiparty computation (SMPC), federated learning (FL), differential privacy (DP) and the hybrid approaches (FL+DP, FL+HE and FL+SMPC); The generic ranking (lowest =1 to highest = 6) is used for comparison purposes such that having a higher score for a criteria, represents better performance. | HE | SMPC | DP | FL | FL+DP | FL+HE | FL+SMPC
---|---|---|---|---|---|---|---
Accuracy | 2 | 6 | 1 | 5 | 3 | 4 | 5
Computational efficiency | 1 | 2 | NA | 6 | 5 | 3 | 4
Network communication efficiency | 5 | 4 | NA | 3 | 3 | 2 | 1
Privacy of exchanged traffic | 4 | 3 | NA | 1 | 2 | 4 | 3
Exchanging low sensitive traffic | ✗ | ✗ | NA | ✓ | ✓ | ✓ | ✓
Privacy guarantee | ✗ | ✗ | ✓ | ✗ | ✓ | ✗ | ✗

## Comparison

We compare the privacy-preserving techniques (HE, SMPC, differential privacy,
federated learning, and the hybrid approaches) using various performance and
privacy criteria such as computational/communication efficiency, accuracy,
privacy guarantee, exchanging sensitive traffic through network and privacy of
exchanged traffic (Table 3 and Figure 3). We employ a generic ranking (lowest
=1 to highest = 6) [36] for all comparison criteria except for privacy
guarantee and exchanging sensitive traffic through network, which are binary
criteria. This comparison is made under the assumption of applying a complex
model (e.g. DNN with a huge number of model parameters) on a large sensitive
genomics datatset distributed across dozens of clients in IID configuration.
Additionally, there are a few computing parties in SMPC (practical
configuration).

Computational efficiency is an indicator of the extra computational overhead
an approach incurs to preserve the privacy. According to Table 3 and Figure 3,
federated learning is best from this perspective because it follows the
paradigm of “bringing computation to data“, distributing computational
overhead among the clients. HE and SMPC are based on the paradigm of moving
data to computation. In HE, encryption of the whole private data in the
clients and carrying out computation on encrypted data by the computing party
cause a huge amount of overhead. In SMPC, a couple of computing parties
process the secret shares from dozens of clients, incurring considerable
computational overhead. Among the hybrid approaches, FL+DP has the best
computational efficiency given the lower overhead of the two approaches
whereas FL+HE has the highest overhead because aggregation process on
encrypted parameters is computationally expensive.

Network communication efficiency indicates how efficient an approach utilizes
the network bandwidth. The less data traffic is exchanged in the network, the
more communication-efficient is the approach. Federated learning is the least
efficient approach from the communication aspect since exchanging a large
number of model parameter values between the clients and the server generates
a huge amount of network traffic. Notice that network bandwidth usage of
federated learning is independent of the clients’ data because federated
learning does not move data to computation but depends on the model complexity
(i.e. the number of model parameters). The next approach in this regard is
SMPC, where not only each participant sends a large traffic (almost as big as
its data) to each computing party but also each computing party exchanges
intermediate results (which might be large) with the other computing parties
through the network. The network overhead of homomorphic encryption comes from
sharing the encrypted data of the clients (as big as the data itself) with the
computing party, which is small compared to network traffic generated by
federated learning and SMPC. The best approach is differential privacy with no
network overhead. Accordingly, FL+DP and FL+SMPC are the best and worst among
the hybrid approaches from communication efficiency viewpoint, respectively.

Accuracy of the model in a privacy-preserving approach is a crucial factor in
whether to adopt the approach. In the assumed configuration, SMPC and
federated learning are the most accurate approaches incurring little accuracy
loss in the final model. Next is homomorphic encryption whose accuracy loss is
due to approximating the non-linear operations using addition and
multiplication (e.g. least squares approximation [57]). The worst approach is
differential privacy where the added noise can considerably affect the model
accuracy. In the hybrid approaches, FL+SMPC is the best and FL+DP is the worst
considering the accuracy of SMPC and differential privacy approaches.

The rest of the comparison measures are privacy-related. The traffic
transferred from the clients (participants) to the server (computing parties)
is highly sensitive if it carries the private data of the clients. The less
sensitive the exchanged traffic is, the more robust the approach is from the
privacy perspective. HE and SMPC send the encrypted and anonymous form of the
clients’ private data to the server, respectively. Federated learning and
hybrid approaches share only the model parameters with the server. In HE, if
the server has the key to decrypt the traffic from the clients, the whole
private data of the clients will be revealed. The same holds if the computing
parties in SMPC collude with each other. This might or might not be the case
for the other approaches (e.g. federated learning) depending on the exchanged
model parameters and whether they can be abused to infer the underlying
private data.

(a) ) All

(b) ) HE

(c) ) SMPC

(d) ) DP

(e) ) FL

(f) ) FL+DP

(g) ) FL+HE

(h) ) FL+SMPC

Figure 3: Comparison radar plots for all (a) and each of (b-h) the privacy
preserving approaches including homomorphic encryption (HE), Secure multiparty
computation (SMPC), differential privacy (DP), federated learning (FL) and
hybrid techniques (FL+DP, FL+HE and FL+SMPC)

Privacy of the exchanged traffic indicates how much the traffic is kept
private from the server. In HE/SMPC, the data is encrypted/anonymized first
and then shared with the server, which is reasonable since it is the clients’
private data. In federated learning, the traffic (model parameters) is
directly shared with the server assuming that it does not reveal any details
regarding individual samples in the data. The aim of the hybrid approaches is
to hide the real values of the model parameters from the server to minimize
the possibility of inference attacks using the model parameters. FL+HE is the
best among the hybrid approaches from this viewpoint.

Privacy guarantee is a metric which quantifies the degree to which the privacy
of the clients’ data can be preserved. Differential privacy and the
corresponding hybrid approach (FL+DP) are the only approaches providing a
privacy guarantee, whereas all other approaches can only protect the privacy
under a set of certain assumptions. HE assumes that the server does not have
the decryption key; The underlying assumption in SMPC is that the computing
parties do not collude with each other; federated learning supposes that the
model parameters do not give any detail about a sample in the clients’ data.

## Discussion and Open Problems

From a practical point of view, homomorphic encryption and SMPC that follow
the paradigm of “move data to computation“ do not scale as the number of
clients or data size in clients become large. This is because they put the
computational burden on a single or a few computing parties. Federated
learning, on the other hand, distributes the computation across the clients
(aggregation on the server is not computationally heavy) but the communication
overhead between the server and clients is the major challenge to scalability
of federated learning. The hybrid approaches inherit this issue and it is
exacerbated in FL+SMPC. Combining homomorphic encryption with federated
learning (FL+HE) adds another obstacle (computational overhead) to scalability
of federated learning. There is a growing body of literature on communication-
efficient approaches to federated learning that can dramatically improve the
scalability of federated learning and make it suitable for large-scale
applications including those in biomedicine.

Given that federated learning is the most realistic approach from a
scalability viewpoint, it can be used as a standalone approach as long as
inferring the clients’ data from the model parameters is practically
impossible. Otherwise, it should be combined with differential privacy to
avoid possible inference attacks and exposure of clients’ private data and to
provide privacy guarantee. The accuracy of the model will be satisfactory in
federated learning but it might be deteriorated in FL+DP. A realistic trade-
off needs to be considered depending on the application of interest.

Moreover, differential privacy can have many practical applications in
biomedicine as a standalone approach. It works very well for low-sensitivity
queries such as counting queries (e.g number of patients with a specific
disease) on genomic databases and their generalizations (e.g. histograms)
since the presence or absence of an individual changes the query’s response by
at most one. Moreover, it can be employed to release summary statistics of
GWAS such as $\chi^{2}$ and p-values in a differentially private manner while
keeping the accuracy acceptable. A novel promising research direction is to
incorporate differential privacy in deep generative models to generate
synthetic genomic and biomedical data.

Future studies can investigate how to reach a compromise between scalability,
privacy, and accuracy in real-world settings. The communication overhead of
federated learning is still an open problem since although state-of-the-art
approaches considerably reduce the network overhead, they adversely affect the
accuracy of the model. Hence, novel approaches are required to preserve the
accuracy, which is of great importance in biomedicine, while making federated
learning communication-efficient.

Adopting federated learning in non-IID settings, where genomic and biomedical
datasets across different hospitals/medical centers are heterogeneous, is
another important challenge to address. This is because typical aggregation
procedures such as simple averaging do not work well for these settings,
yielding inaccurate models. Hence, new aggregation procedures are required to
tackle non-IID scenarios. Moreover, current communication-efficient approaches
which were developed for an IID setting might not be applicable to
heterogeneous scenarios. Consequently, new techniques are needed to reduce
network overhead in these settings, while keeping the model accuracy
satisfactory.

Combining differential privacy with federated learning to enhance privacy and
to provide a privacy guarantee is still a challenging issue in the field. It
becomes even more challenging for healthcare applications, where accuracy of
the model is of crucial importance. Moreover, the concept of privacy guarantee
in differential privacy has been defined for local settings. In distributed
scenarios, a dataset might be employed multiple times to train different
models with various privacy budgets. Therefore, a new formulation of privacy
guarantee should be proposed for distributed settings.

## Conclusions

For AI techniques to succeed, big biomedical data needs to be available and
accessible. However, the more AI models are trained on sensitive biological
data, the more the awareness about the privacy issues increases, which, in
turn, necessitate strategies for shielding the data [62]. Hence, privacy-
enhancing techniques are crucial to allow AI to benefit from the sensitive
biological data.

Cryptographic techniques, differential privacy and federated learning can be
considered as the prime strategies for protecting personal data privacy. These
emerging techniques are based on either securing sensitive data, perturbing it
or not moving it off site. In particular, cryptographic techniques securely
share the data with a single (HE) or multiple computing parties (SMPC),
differential privacy adds noise to sensitive data and quantifies privacy loss
accordingly, while federated learning enables collaborative learning under
orchestration of a centralized server without moving the private data outside
local environments.

All of these techniques have their own strengths and limitations. HE and SMPC
are more communication efficient compared to federated learning but they are
computationally expensive since they move data to computation and put the
computational burden on a server or a few computing parties. Federated
learning, on the other hand, distributes computation across the clients but
suffers from high network communication overhead. Differential privacy is an
efficient approach from a computational and a communication perspective but it
introduces accuracy loss by adding noise to data or model parameters. Hybrid
approaches are studied to combine the advantages or to overcome the
disadvantages of the individual techniques. We argued that federated learning
as a standalone approach or in combination with differential privacy is the
most realistic approach to be adopted in biomedicine. We discussed the open
problems and challenges in this regard including the balance of communication
efficiency and model accuracy in non-IID settings, and need for a new notion
of privacy guarantee for distributed biomedical datasets.

Incorporating privacy into the analysis of genomic and biomedical data is
still an open challenge, yet preliminary accomplishments are promising to
bring practical privacy even closer to real-world settings. Future research
should investigate how to achieve a trade-off between scalability, privacy,
and accuracy in real biomedical applications.

## Acknowledgements

This work has received funding from the European Union’s Horizon2020 research
and innovation program under grant agreement nr. 826078 (FeatureCloud). The
work of JB, HS and TK was also supported by Horizon2020 project REPO-TRIAL
(nr. 777111). ML, TK, and JB have further been supported by BMBF project
Sys_CARE (01ZX1908A). ML and JB were also supported by BMBF project SYMBOD
(01ZX1910D). JB’s contribution was also supported by his VILLUM Young
Investigator grant (nr. 13154).This paper reflects only the authors’ view and
the Commission is not responsible for any use that may be made of the
information it contains. Figure 1 and Figure 2 have been created with
BioRender.com.

## References

  * [1] Wilko Schwarting, Javier Alonso-Mora and Daniela Rus  “Planning and Decision-Making for Autonomous Vehicles”  In _Annual Review of Control, Robotics, and Autonomous Systems_ 1.1 Annual Reviews, 2018, pp. 187–210
  * [2] Jonas Gehring et al.  “Convolutional sequence to sequence learning”  In _Proceedings of the 34th International Conference on Machine Learning-Volume 70_ , 2017, pp. 1243–1252  JMLR. org
  * [3] Wayne Xiong et al.  “The Microsoft 2017 conversational speech recognition system”  In _2018 IEEE international conference on acoustics, speech and signal processing (ICASSP)_ , 2018, pp. 5934–5938  IEEE
  * [4] Andreas Holzinger, Peter Kieseberg, Edgar Weippl and A Min Tjoa  “Current Advances, Trends and Challenges of Machine Learning and Knowledge Extraction: From Machine Learning to Explainable AI”  In _Springer Lecture Notes in Computer Science LNCS 11015_ Cham: Springer, 2018, pp. 1–8
  * [5] Rafael Gómez-Bombarelli et al.  “Automatic chemical design using a data-driven continuous representation of molecules”  In _ACS central science_ 4.2 ACS Publications, 2018, pp. 268–276
  * [6] Jianzhu Ma et al.  “Using deep learning to model the hierarchical structure and function of a cell”  In _Nature methods_ 15.4 Nature Publishing Group, 2018, pp. 290
  * [7] Dong Nie et al.  “Medical image synthesis with deep convolutional adversarial networks”  In _IEEE Transactions on Biomedical Engineering_ 65.12 IEEE, 2018, pp. 2720–2730
  * [8] Ahmed Hosny et al.  “Artificial intelligence in radiology”  In _Nature Reviews Cancer_ 18.8 Nature Publishing Group, 2018, pp. 500–510
  * [9] Andrew L Beam and Isaac S Kohane  “Big data and machine learning in health care”  In _Jama_ 319.13 American Medical Association, 2018, pp. 1317–1318
  * [10] Kun-Hsing Yu, Andrew L Beam and Isaac S Kohane  “Artificial intelligence in healthcare”  In _Nature biomedical engineering_ 2.10 Nature Publishing Group UK, 2018, pp. 719–731
  * [11] K Yu Michael et al.  “Visible machine learning for biomedicine”  In _Cell_ 173.7 Elsevier, 2018, pp. 1562–1565
  * [12] Hongming Chen et al.  “The rise of deep learning in drug discovery”  In _Drug discovery today_ 23.6 Elsevier, 2018, pp. 1241–1250
  * [13] Michael Wainberg, Daniele Merico, Andrew Delong and Brendan J Frey  “Deep learning in biomedicine”  In _Nature biotechnology_ 36.9 Nature Publishing Group, 2018, pp. 829–838
  * [14] Seonwoo Min, Byunghan Lee and Sungroh Yoon  “Deep learning in bioinformatics”  In _Briefings in bioinformatics_ 18.5 Oxford University Press, 2017, pp. 851–869
  * [15] Geert Litjens et al.  “A survey on deep learning in medical image analysis”  In _Medical image analysis_ 42 Elsevier, 2017, pp. 60–88
  * [16] Dinggang Shen, Guorong Wu and Heung-Il Suk  “Deep learning in medical image analysis”  In _Annual review of biomedical engineering_ 19 Annual Reviews, 2017, pp. 221–248
  * [17] Fei Jiang et al.  “Artificial intelligence in healthcare: past, present and future”  In _Stroke and vascular neurology_ 2.4 BMJ Specialist Journals, 2017, pp. 230–243
  * [18] Maxwell W Libbrecht and William Stafford Noble  “Machine learning applications in genetics and genomics”  In _Nature Reviews Genetics_ 16.6 Nature Publishing Group, 2015, pp. 321–332
  * [19] Shamim Nemati et al.  “An interpretable machine learning model for accurate prediction of sepsis in the ICU.”  In _Critical care medicine_ 46.4, 2018, pp. 547–553
  * [20] Philip Teare et al.  “Malignancy detection on mammography using dual deep convolutional neural networks and genetically discovered false color input enhancement”  In _Journal of digital imaging_ 30.4 Springer, 2017, pp. 499–505
  * [21] Mitko Veta et al.  “Assessment of algorithms for mitosis detection in breast cancer histopathology images”  In _Medical image analysis_ 20.1 Elsevier, 2015, pp. 237–248
  * [22] Muhammad Naveed et al.  “Privacy in the genomic era”  In _ACM Computing Surveys (CSUR)_ 48.1 ACM New York, NY, USA, 2015, pp. 1–44
  * [23] Reza Shokri, Marco Stronati, Congzheng Song and Vitaly Shmatikov  “Membership inference attacks against machine learning models”  In _2017 IEEE Symposium on Security and Privacy (SP)_ , 2017, pp. 3–18  IEEE
  * [24] Nicolas Papernot, Patrick McDaniel, Arunesh Sinha and Michael P Wellman  “SoK: Security and privacy in machine learning”  In _2018 IEEE European Symposium on Security and Privacy (EuroS &P)_, 2018, pp. 399–414  IEEE
  * [25] Chiyuan Zhang et al.  “Understanding deep learning requires rethinking generalization”  In _Proceedings of the International Conference on Learning Representations (ICLR)_ , 2017
  * [26] Yuheng Zhang et al.  “The secret revealer: generative model-inversion attacks against deep neural networks”  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , 2020, pp. 253–261
  * [27] Suyash S Shringarpure and Carlos D Bustamante  “Privacy risks from genomic data-sharing beacons”  In _The American Journal of Human Genetics_ 97.5 Elsevier, 2015, pp. 631–646
  * [28] Nils Homer et al.  “Resolving individuals contributing trace amounts of DNA to highly complex mixtures using high-density SNP genotyping microarrays”  In _PLoS genetics_ 4.8 Public Library of Science, 2008
  * [29] Arif Harmanci and Mark Gerstein  “Analysis of sensitive information leakage in functional genomics signal profiles through genomic deletions”  In _Nature communications_ 9.1 Nature Publishing Group, 2018, pp. 1–10
  * [30] Rui Wang et al.  “Learning your identity and disease from research papers: information leaks in genome wide association study”  In _Proceedings of the 16th ACM conference on Computer and communications security_ , 2009, pp. 534–544
  * [31] Global Alliance Genomics and Health*  “A federated ecosystem for sharing genomic, clinical data”  In _Science_ 352.6291 American Association for the Advancement of Science, 2016, pp. 1278–1280  URL: https://beacon-network.org
  * [32] Elias A Zerhouni and Elizabeth G Nabel  “Protecting aggregate genomic data”  In _Science_ 322.5898 American Association for the Advancement of Science, 2008, pp. 44–44
  * [33] Yaniv Erlich and Arvind Narayanan  “Routes for breaching and protecting genetic privacy”  In _Nature Reviews Genetics_ 15.6 Nature Publishing Group, 2014, pp. 409–421
  * [34] “General Data Protection Regulation(GDPR)”, https://gdpr-info.eu/, 2020
  * [35] Aloni Cohen and Kobbi Nissim  “Towards formalizing the GDPR’s notion of singling out”  In _Proceedings of the National Academy of Sciences_ National Acad Sciences, 2020
  * [36] Md Momin Al Aziz et al.  “Privacy-preserving techniques of genomic data—a survey”  In _Briefings in bioinformatics_ 20.3 Oxford University Press, 2019, pp. 887–895
  * [37] Jie Xu and Fei Wang  “Federated Learning for Healthcare Informatics”  In _arXiv preprint arXiv:1911.06270_ , 2019
  * [38] Georgios A. Kaissis, Marcus R. Makowski, Daniel Rückert and Rickmer F. Braren  “Secure, privacy-preserving and federated machine learning in medical imaging”  In _Nature Machine Intelligence_ Springer ScienceBusiness Media LLC, 2020
  * [39] Hyunghoon Cho, David J Wu and Bonnie Berger  “Secure genome-wide association analysis using multiparty computation”  In _Nature biotechnology_ 36.6 Nature Publishing Group, 2018, pp. 547–551
  * [40] Charlotte Bonte et al.  “Towards practical privacy-preserving genome-wide association study”  In _BMC bioinformatics_ 19.1 BioMed Central, 2018, pp. 1–12
  * [41] Karthik A Jagadeesh et al.  “Keeping patient phenotypes and genotypes private while seeking disease diagnoses”  In _bioRxiv_ Cold Spring Harbor Laboratory, 2019, pp. 746230
  * [42] Miran Kim and Kristin Lauter  “Private genome analysis through homomorphic encryption”  In _BMC medical informatics and decision making_ 15.S5, 2015, pp. S3  Springer
  * [43] Kristin Lauter, Adriana López-Alt and Michael Naehrig  “Private computation on encrypted genomic data”  In _International Conference on Cryptology and Information Security in Latin America_ , 2014, pp. 3–27  Springer
  * [44] Wen-Jie Lu, Yoshiji Yamada and Jun Sakuma  “Privacy-preserving genome-wide association studies on cloud environment using fully homomorphic encryption”  In _BMC medical informatics and decision making_ 15.S5, 2015, pp. S1  Springer
  * [45] Yuchen Zhang et al.  “Foresee: Fully outsourced secure genome study based on homomorphic encryption”  In _BMC medical informatics and decision making_ 15.S5, 2015, pp. S5  Springer
  * [46] Liina Kamm, Dan Bogdanov, Sven Laur and Jaak Vilo  “A new way to protect privacy in large-scale genome-wide association studies”  In _Bioinformatics_ 29.7 Oxford University Press, 2013, pp. 886–893
  * [47] Scott D Constable et al.  “Privacy-preserving GWAS analysis on federated genomic datasets”  In _BMC medical informatics and decision making_ 15.S5, 2015, pp. S2  Springer
  * [48] Yihua Zhang, Marina Blanton and Ghada Almashaqbeh  “Secure distributed genome analysis for GWAS and sequence comparison computation”  In _BMC medical informatics and decision making_ 15.5, 2015, pp. S4  BioMed Central
  * [49] Payman Mohassel and Yupeng Zhang  “Secureml: A system for scalable privacy-preserving machine learning”  In _2017 IEEE Symposium on Security and Privacy (SP)_ , 2017, pp. 19–38  IEEE
  * [50] Feng Chen et al.  “Princess: Privacy-protecting rare disease international network collaboration via encryption through software guard extensions”  In _Bioinformatics_ 33.6 Oxford University Press, 2017, pp. 871–878
  * [51] Zahidul Hasan, Md Safiur Rahman Mahdi and Noman Mohammed  “Secure count query on encrypted genomic data: A survey”  In _IEEE Internet Computing_ 22.2 IEEE, 2018, pp. 71–82
  * [52] Md Nazmus Sadat et al.  “Safety: secure gwas in federated environment through a hybrid solution”  In _IEEE/ACM transactions on computational biology and bioinformatics_ 16.1 IEEE, 2018, pp. 93–102
  * [53] Craig Gentry  “Fully homomorphic encryption using ideal lattices”  In _Proceedings of the forty-first annual ACM symposium on Theory of computing_ , 2009, pp. 169–178
  * [54] Ronald Cramer, Ivan Bjerre Damgård and Jesper Buus Nielsen  “Secure multiparty computation”  Cambridge University Press, 2015
  * [55] Adi Shamir  “How to share a secret”  In _Communications of the ACM_ 22.11 ACm New York, NY, USA, 1979, pp. 612–613
  * [56] Karthik A Jagadeesh et al.  “Keeping patient phenotypes and genotypes private while seeking disease diagnoses”  In _bioRxiv_ Cold Spring Harbor Laboratory, 2019, pp. 746230
  * [57] Miran Kim et al.  “Secure logistic regression based on homomorphic encryption: Design and evaluation”  In _JMIR medical informatics_ 6.2 JMIR Publications Inc., Toronto, Canada, 2018, pp. e19
  * [58] Toufique Morshed, Dima Alhadidi and Noman Mohammed  “Parallel linear regression on encrypted data”  In _2018 16th Annual Conference on Privacy, Security and Trust (PST)_ , 2018, pp. 1–5  IEEE
  * [59] Haoyi Shi et al.  “Secure multi-pArty computation grid LOgistic REgression (SMAC-GLORE)”  In _BMC medical informatics and decision making_ 16.3 Springer, 2016, pp. 89
  * [60] Jonathan M Bloom  “Secure multi-party linear regression at plaintext speed”  In _arXiv preprint arXiv:1901.09531_ , 2019
  * [61] Alexandros Mittos, Bradley Malin and Emiliano De Cristofaro  “Systematizing genome privacy research: A privacy-enhancing technologies perspective”  In _Proceedings on Privacy Enhancing Technologies_ 2019.1 Sciendo, 2019, pp. 87–107
  * [62] Bonnie Berger and Hyunghoon Cho  “Emerging technologies towards enhancing privacy in genomic data sharing”  In _BioMed Central_ , 2019
  * [63] Diego Chialva and Ann Dooms  “Conditionals in homomorphic encryption and machine learning applications”  In _arXiv preprint arXiv:1810.12380_ , 2018
  * [64] Andreea B Alexandru and George J Pappas  “Secure Multi-party Computation for Cloud-Based Control”  In _Privacy in Dynamical Systems_ Springer, pp. 179
  * [65] Aaron Johnson and Vitaly Shmatikov  “Privacy-preserving data exploration in genome-wide association studies”  In _Proceedings of the 19th ACM SIGKDD international conference on Knowledge discovery and data mining_ , 2013, pp. 1079–1087
  * [66] Hyunghoon Cho, Sean Simmons, Ryan Kim and Bonnie Berger  “Privacy-preserving biomedical database queries with optimal privacy-utility trade-offs”  In _Cell Systems_ Elsevier, 2020
  * [67] Md Momin Al Aziz, Reza Ghasemi, Md Waliullah and Noman Mohammed  “Aftermath of bustamante attack on genomic beacon service”  In _BMC medical genomics_ 10.2 BioMed Central, 2017, pp. 43
  * [68] Ziwei Han, Laifeng Lu and Hai Liu  “A Differential Privacy Preserving Approach for Logistic Regression in Genome-Wide Association Studies”  In _2019 International Conference on Networking and Network Applications (NaNA)_ , 2019, pp. 181–185  IEEE
  * [69] Fei Yu, Michal Rybar, Caroline Uhler and Stephen E Fienberg  “Differentially-private logistic regression for detecting multiple-SNP association in GWAS databases”  In _International Conference on Privacy in Statistical Databases_ , 2014, pp. 170–184  Springer
  * [70] Antti Honkela et al.  “Efficient differentially private learning improves drug sensitivity prediction”  In _Biology direct_ 13.1 Springer, 2018, pp. 1
  * [71] Sean Simmons, Cenk Sahinalp and Bonnie Berger  “Enabling privacy-preserving GWASs in heterogeneous human populations”  In _Cell systems_ 3.1 Elsevier, 2016, pp. 54–61
  * [72] Sean Simmons and Bonnie Berger  “Realizing privacy preserving genome-wide association studies”  In _Bioinformatics_ 32.9 Oxford University Press, 2016, pp. 1293–1300
  * [73] Stephen E Fienberg, Aleksandra Slavkovic and Caroline Uhler  “Privacy preserving GWAS data sharing”  In _2011 IEEE 11th International Conference on Data Mining Workshops_ , 2011, pp. 628–635  IEEE
  * [74] Caroline Uhlerop, Aleksandra Slavković and Stephen E Fienberg  “Privacy-preserving data sharing for genome-wide association studies”  In _The Journal of privacy and confidentiality_ 5.1 NIH Public Access, 2013, pp. 137
  * [75] Fei Yu and Zhanglong Ji  “Scalable privacy-preserving data sharing methodology for genome-wide association studies: an application to iDASH healthcare privacy protection challenge”  In _BMC medical informatics and decision making_ 14.1 BioMed Central, 2014, pp. S3
  * [76] Shuang Wang, Noman Mohammed and Rui Chen  “Differentially private genome data dissemination through top-down specialization”  In _BMC medical informatics and decision making_ 14.1 BioMed Central, 2014, pp. S2
  * [77] Nazmiye Ceren Abay et al.  “Privacy preserving synthetic data release using deep learning”  In _Joint European Conference on Machine Learning and Knowledge Discovery in Databases_ , 2018, pp. 510–526  Springer
  * [78] Brett K Beaulieu-Jones et al.  “Privacy-preserving generative deep neural networks support clinical data sharing”  In _Circulation: Cardiovascular Quality and Outcomes_ 12.7 Am Heart Assoc, 2019, pp. e005122
  * [79] James Jordon, Jinsung Yoon and Mihaela Schaar  “PATE-GAN: Generating Synthetic Data with Differential Privacy Guarantees”, 2018
  * [80] Cynthia Dwork, Frank McSherry, Kobbi Nissim and Adam Smith  “Calibrating noise to sensitivity in private data analysis”  In _Journal of Privacy and Confidentiality_ 7.3, 2016, pp. 17–51
  * [81] Cynthia Dwork et al.  “Our data, ourselves: Privacy via distributed noise generation”  In _Annual International Conference on the Theory and Applications of Cryptographic Techniques_ , 2006, pp. 486–503  Springer
  * [82] Kobbi Nissim et al.  “Differential privacy: A primer for a non-technical audience”  In _Privacy Law Scholars Conf_ , 2017
  * [83] Úlfar Erlingsson, Vasyl Pihur and Aleksandra Korolova  “Rappor: Randomized aggregatable privacy-preserving ordinal response”  In _Proceedings of the 2014 ACM SIGSAC conference on computer and communications security_ , 2014, pp. 1054–1067
  * [84] Abhradeep Guha Thakurta et al.  “Learning new words” US Patent 9,594,741  Google Patents, 2017
  * [85] Brett K Beaulieu-Jones, William Yuan, Samuel G Finlayson and Zhiwei Steven Wu  “Privacy-preserving distributed deep learning for clinical data”  In _arXiv preprint arXiv:1812.01484_ , 2018
  * [86] Ziwei Han, Hai Liu and Zhenqiang Wu  “A Differential Privacy Preserving Framework with Nash Equilibrium in Genome-Wide Association studies”  In _2018 International Conference on Networking and Network Applications (NaNA)_ , 2018, pp. 91–96  IEEE
  * [87] Florian Tramèr, Zhicong Huang, Jean-Pierre Hubaux and Erman Ayday  “Differential privacy with bounded priors: reconciling utility and privacy in genome-wide association studies”  In _Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security_ , 2015, pp. 1286–1297
  * [88] Duy Vu and Aleksandra Slavkovic  “Differential privacy for clinical trial data: Preliminary evaluations”  In _2009 IEEE International Conference on Data Mining Workshops_ , 2009, pp. 138–143  IEEE
  * [89] Zhiyu Wan, Yevgeniy Vorobeychik, Murat Kantarcioglu and Bradley Malin  “Controlling the signal: Practical privacy protection of genomic data sharing through Beacon services”  In _BMC medical genomics_ 10.2 BioMed Central, 2017, pp. 39
  * [90] Peter Kairouz, Sewoong Oh and Pramod Viswanath  “The composition theorem for differential privacy”  In _IEEE Transactions on Information Theory_ 63.6 IEEE, 2017, pp. 4037–4049
  * [91] Marc Fiume et al.  “Federated discovery and sharing of genomic data using Beacons”  In _Nature biotechnology_ 37.3 Nature Publishing Group, 2019, pp. 220–224
  * [92] Jean Louis Raisaro et al.  “Protecting privacy and security of genomic data in I2B2 with homomorphic encryption and differential privacy”  In _IEEE/ACM transactions on computational biology and bioinformatics_ 15.5 IEEE, 2018, pp. 1413–1426
  * [93] Moritz Hardt, Katrina Ligett and Frank McSherry  “A simple and practical algorithm for differentially private data release”  In _Advances in Neural Information Processing Systems_ , 2012, pp. 2339–2347
  * [94] Jean Louis Raisaro et al.  “M ed C o: Enabling Secure and Privacy-Preserving Exploration of Distributed Clinical and Genomic Data”  In _IEEE/ACM transactions on computational biology and bioinformatics_ 16.4 IEEE, 2018, pp. 1328–1341
  * [95] Alkes L Price et al.  “Principal components analysis corrects for stratification in genome-wide association studies”  In _Nature genetics_ 38.8 Nature Publishing Group, 2006, pp. 904–909
  * [96] Jian Yang et al.  “Advantages and pitfalls in the application of mixed-model association methods”  In _Nature genetics_ 46.2 Nature Publishing Group, 2014, pp. 100
  * [97] Ian Goodfellow et al.  “Generative adversarial nets”  In _Advances in neural information processing systems_ , 2014, pp. 2672–2680
  * [98] Shuang Wang et al.  “Genome privacy: challenges, technical approaches to mitigate risk, and ethical considerations in the United States”  In _Annals of the New York Academy of Sciences_ 1387.1 NIH Public Access, 2017, pp. 73
  * [99] Peter Kieseberg et al.  “Protecting Anonymity in Data-Driven Biomedical Science”  In _Interactive Knowledge Discovery and Data Mining in Biomedical Informatics, Lecture Notes in Computer Science, LNCS 8401_ Berlin Heidelberg: Springer, 2014, pp. 301–316
  * [100] H Brendan McMahan, Eider Moore, Daniel Ramage and Seth Hampson  “Communication-efficient learning of deep networks from decentralized data”  In _arXiv preprint arXiv:1602.05629_ , 2016
  * [101] Peter Kairouz et al.  “Advances and open problems in federated learning”  In _arXiv preprint arXiv:1912.04977_ , 2019
  * [102] Qiang Yang, Yang Liu, Tianjian Chen and Yongxin Tong  “Federated machine learning: Concept and applications”  In _ACM Transactions on Intelligent Systems and Technology (TIST)_ 10.2 ACM New York, NY, USA, 2019, pp. 1–19
  * [103] The TFF Authors  “TensorFlow Federated”, 2019  URL: https://www.tensorflow.org/federated
  * [104] Theo Ryffel et al.  “A generic framework for privacy preserving deep learning”  In _arXiv preprint arXiv:1811.04017_ , 2018
  * [105] The FATE Authors  “Federated AI technology enabler”, 2019  URL: https://www.fedai.org/
  * [106] The PaddleFL Authors  “PaddleFL”, 2019  URL: https://github.com/PaddlePaddle/PaddleFL
  * [107] The FeatureCloud Authors  “FeatureCloud”, 2019  URL: https://featurecloud.eu/
  * [108] The Clara Training Framework Authors  “NVIDIA Clara”, 2019  URL: https://developer.nvidia.com/clara
  * [109] Micah J Sheller et al.  “Multi-institutional deep learning modeling without sharing patient data: A feasibility study on brain tumor segmentation”  In _International MICCAI Brainlesion Workshop_ , 2018, pp. 92–104  Springer
  * [110] Praneeth Vepakomma, Otkrist Gupta, Tristan Swedish and Ramesh Raskar  “Split learning for health: Distributed deep learning without sharing raw patient data”  In _arXiv preprint arXiv:1812.00564_ , 2018
  * [111] Praneeth Vepakomma, Otkrist Gupta, Abhimanyu Dubey and Ramesh Raskar  “Reducing leakage in distributed deep learning for sensitive health data”  In _arXiv preprint arXiv:1812.00564_ , 2019
  * [112] Maarten G Poirot et al.  “Split Learning for collaborative deep learning in healthcare”  In _arXiv preprint arXiv:1912.12115_ , 2019
  * [113] Niranjan Balachandar, Ken Chang, Jayashree Kalpathy-Cramer and Daniel L Rubin  “Accounting for data variability in multi-institutional distributed deep learning for medical imaging”  In _Journal of the American Medical Informatics Association_ , 2020
  * [114] Ken Chang et al.  “Distributed deep learning networks among institutions for medical imaging”  In _Journal of the American Medical Informatics Association_ 25.8 Oxford University Press, 2018, pp. 945–954
  * [115] Wenrui Dai et al.  “VERTICOX: Vertically Distributed Cox Proportional Hazards Model Using the Alternating Direction Method of Multipliers”  In _IEEE Transactions on Knowledge and Data Engineering_ IEEE, 2020
  * [116] Chia-Lun Lu et al.  “WebDISCO: a web service for distributed cox model learning without patient-level data sharing”  In _Journal of the American Medical Informatics Association_ 22.6 Oxford University Press, 2015, pp. 1212–1219
  * [117] Yuan Wu, Xiaoqian Jiang, Jihoon Kim and Lucila Ohno-Machado  “Grid Binary LOgistic REgression (GLORE): building shared models without sharing data”  In _Journal of the American Medical Informatics Association_ 19.5 BMJ Group, 2012, pp. 758–764
  * [118] Shuang Wang et al.  “EXpectation Propagation LOgistic REgRession (EXPLORER): distributed privacy-preserving online model learning”  In _Journal of biomedical informatics_ 46.3 Elsevier, 2013, pp. 480–496
  * [119] Yong Li et al.  “Vertical grid logistic regression (vertigo)”  In _Journal of the American Medical Informatics Association_ 23.3 Oxford University Press, 2016, pp. 570–579
  * [120] Reza Nasirigerdeh et al.  “sPLINK: A Federated, Privacy-Preserving Tool as a Robust Alternative to Meta-Analysis in Genome-Wide Association Studies”  Cold Spring Harbor Laboratory, 2020  URL: https://www.exbio.wzw.tum.de/splink/
  * [121] Daniel Gabay  “Chapter ix applications of the method of multipliers to variational inequalities”  In _Studies in mathematics and its applications_ 15 Elsevier, 1983, pp. 299–331
  * [122] Shaun Purcell et al.  “PLINK: a tool set for whole-genome association and population-based linkage analyses”  In _The American journal of human genetics_ 81.3 Elsevier, 2007, pp. 559–575
  * [123] Theodora S Brisimi et al.  “Federated learning of predictive models from federated electronic health records”  In _International journal of medical informatics_ 112 Elsevier, 2018, pp. 59–67
  * [124] Li Huang et al.  “Loadaboost: Loss-based adaboost federated machine learning on medical data”  In _arXiv preprint arXiv:1811.12629_ , 2018
  * [125] Dianbo Liu, Timothy Miller, Raheel Sayeed and Kenneth D Mandl  “Fadl: Federated-autonomous deep learning for distributed electronic health record”  In _arXiv preprint arXiv:1811.11400_ , 2018
  * [126] Yiqiang Chen et al.  “FedHealth: A Federated Transfer Learning Framework for Wearable Healthcare”  In _arXiv preprint arXiv:1907.09173_ , 2019
  * [127] Santiago Silva et al.  “Federated learning in distributed medical databases: Meta-analysis of large-scale subcortical brain data”  In _2019 IEEE 16th International Symposium on Biomedical Imaging (ISBI 2019)_ , 2019, pp. 270–274  IEEE
  * [128] Tom J Pollard et al.  “The eICU Collaborative Research Database, a freely available multi-center database for critical care research”  In _Scientific data_ 5 Nature Publishing Group, 2018, pp. 180178
  * [129] Virginia Smith, Chao-Kai Chiang, Maziar Sanjabi and Ameet S Talwalkar  “Federated multi-task learning”  In _Advances in Neural Information Processing Systems_ , 2017, pp. 4424–4434
  * [130] Luca Corinzia and Joachim M Buhmann  “Variational federated multi-task learning”  In _arXiv preprint arXiv:1906.06268_ , 2019
  * [131] Yang Liu, Tianjian Chen and Qiang Yang  “Secure federated transfer learning”  In _arXiv preprint arXiv:1812.03337_ , 2018
  * [132] Wenqi Li et al.  “Privacy-preserving Federated Brain Tumour Segmentation”  In _International Workshop on Machine Learning in Medical Imaging_ , 2019, pp. 133–141  Springer
  * [133] Xiaoxiao Li et al.  “Multi-site fMRI Analysis Using Privacy-preserving Federated Learning and Domain Adaptation: ABIDE Results”  In _arXiv preprint arXiv:2001.05647_ , 2020
  * [134] Olivia Choudhury et al.  “Differential Privacy-enabled Federated Learning for Sensitive Health Data”  In _arXiv preprint arXiv:1910.02578_ , 2019
  * [135] Junghye Lee et al.  “Privacy-preserving patient similarity learning in a federated environment: development and analysis”  In _JMIR medical informatics_ 6.2 JMIR Publications Inc., Toronto, Canada, 2018, pp. e20
  * [136] Miran Kim, Junghye Lee, Lucila Ohno-Machado and Xiaoqian Jiang  “Secure and Differentially Private Logistic Regression for Horizontally Distributed Data”  In _IEEE Transactions on Information Forensics and Security_ 15 IEEE, 2019, pp. 695–710
  * [137] Suyog Gupta, Ankur Agrawal, Kailash Gopalakrishnan and Pritish Narayanan  “Deep learning with limited numerical precision”  In _International Conference on Machine Learning_ , 2015, pp. 1737–1746
  * [138] Alham Fikri Aji and Kenneth Heafield  “Sparse Communication for Distributed Gradient Descent”  In _Proceedings of the 2017 Conference on Empirical Methods in Natural Language Processing_ , 2017, pp. 440–445
  * [139] H Brendan McMahan, Eider Moore, Daniel Ramage and Seth Hampson  “Communication-efficient learning of deep networks from decentralized data”  In _arXiv preprint arXiv:1602.05629_ , 2016
  * [140] Zhenheng Tang et al.  “Communication-Efficient Distributed Deep Learning: A Comprehensive Survey”  In _arXiv preprint arXiv:2003.06307_ , 2020
  * [141] Yue Zhao et al.  “Federated learning with non-iid data”  In _arXiv preprint arXiv:1806.00582_ , 2018
  * [142] Qinbin Li, Zeyi Wen and Bingsheng He  “Federated learning systems: Vision, hype and reality for data privacy and protection”  In _arXiv preprint arXiv:1907.09693_ , 2019
  * [143] Nicola Rieke et al.  “The Future of Digital Health with Federated Learning”  In _arXiv preprint arXiv:2003.08119_ , 2020
  * [144] Luca Melis, Congzheng Song, Emiliano De Cristofaro and Vitaly Shmatikov  “Exploiting unintended feature leakage in collaborative learning”  In _2019 IEEE Symposium on Security and Privacy (SP)_ , 2019, pp. 691–706  IEEE
  * [145] Robin C Geyer, Tassilo Klein and Moin Nabi  “Differentially private federated learning: A client level perspective”  In _arXiv preprint arXiv:1712.07557_ , 2017
  * [146] Stacey Truex et al.  “A hybrid approach to privacy-preserving federated learning”  In _Proceedings of the 12th ACM Workshop on Artificial Intelligence and Security_ , 2019, pp. 1–11
  * [147] Kang Wei et al.  “Federated learning with differential privacy: Algorithms and performance analysis”  In _IEEE Transactions on Information Forensics and Security_ IEEE, 2020
  * [148] Stephen Hardy et al.  “Private federated learning on vertically partitioned data via entity resolution and additively homomorphic encryption”  In _arXiv preprint arXiv:1711.10677_ , 2017
  * [149] Chengliang Zhang et al.  “BatchCrypt: Efficient Homomorphic Encryption for Cross-Silo Federated Learning”  In _2020 $\\{$USENIX$\\}$ Annual Technical Conference ($\\{$USENIX$\\}$$\\{$ATC$\\}$ 20)_, 2020, pp. 493–506
  * [150] David Froelicher et al.  “UnLynx: A decentralized system for privacy-conscious data sharing”  In _Proceedings on Privacy Enhancing Technologies_ 2017.4 Sciendo, 2017, pp. 232–250