Privacy-Preserving Artificial Intelligence Techniques in Biomedicine

Abstract

Background: Artificial intelligence (AI) has been successfully applied in numerous scientific domains. In biomedicine, AI has already shown tremendous potential, e.g., in the interpretation of next-generation sequencing data and in the design of clinical decision support systems.

Objectives: However, training an AI model on sensitive data raises concerns about the privacy of individual participants. For example, summary statistics of a genome-wide association study can be used to determine the presence or absence of an individual in a given dataset. This considerable privacy risk has led to restrictions in accessing genomic and other biomedical data, which is detrimental for collaborative research and impedes scientific progress. Hence, there has been a substantial effort to develop AI methods that can learn from sensitive data while protecting individuals' privacy.

Method: This paper provides a structured overview of recent advances in privacy-preserving AI techniques in biomedicine. It places the most important state-of-the-art approaches within a unified taxonomy and discusses their strengths, limitations, and open problems.

Conclusion: As the most promising direction, we suggest combining federated machine learning as a more scalable approach with other additional privacy-preserving techniques. This would allow to merge the advantages to provide privacy guarantees in a distributed way for biomedical applications. Nonetheless, more research is necessary as hybrid approaches pose new challenges such as additional network or computation overhead.

Fig. 1

Different privacy-preserving AI techniques: ( A ) homomorphic encryption , where the participants encrypt the private data and share it with a computing party, which computes the aggregated results over the encrypted data from the participants; ( B ) secure multiparty computation in which each participant shares a separate, different secret with each computing party; the computing parties calculate the intermediate results, secretly share them with each other, and aggregate all intermediate results to obtain the final results; ( C ) differential privacy , which ensures the models trained on datasets including and excluding a specific individual look statistically indistinguishable to the adversary; ( D ) federated learning , where each participant downloads the global model from the server, computes the local model given its private data and the global model, and finally sends its local model to the server for aggregation and for updating the global model. ( A ). Homomorphic encryption. ( B ). Secure multiparty computation. ( C ). Differential privacy. ( D ). Federated learning.

Fig. 2

Differentially private deep generative models: The sensitive data holder (e.g., health institutes) train a differentially private generative model locally and share just the trained data generator with the outside world (e.g., researchers). The shared data generator can then be used to produce artificial data with the same characteristics as the sensitive data.

Fig. 3

Comparison radar plots for all ( A ) and each of ( B–H ) the privacy preserving approaches including homomorphic encryption (HE), secure multiparty computation (SMPC), differential privacy (DP), federated learning (FL) and hybrid techniques (FL + DP, FL + HE and FL + SMPC). ( A ) All. ( B ) HE. ( C ) SMPC. ( D ) DP. ( E ) FL. ( F ) FL + DP. ( G ) FL + HE. ( H ) FL + SMPC.