[Paper Review] AnomiGAN: Generative adversarial networks for anonymizing private medical data

Ho Bae, Dahuin Jung+1 more|arXiv (Cornell University)|Jan 31, 2019

Privacy-Preserving Technologies in Data28 references4 citations

TL;DR

AnomiGAN is a generative adversarial network framework that anonymizes private medical data by training a generator to produce synthetic data indistinguishable from real data while preserving utility for downstream prediction tasks. It achieves stronger prediction performance than differential privacy under equivalent privacy guarantees, demonstrating a favorable trade-off between privacy and model accuracy.

ABSTRACT

Typical personal medical data contains sensitive information about individuals. Storing or sharing the personal medical data is thus often risky. For example, a short DNA sequence can provide information that can not only identify an individual, but also his or her relatives. Nonetheless, most countries and researchers agree on the necessity of collecting personal medical data. This stems from the fact that medical data, including genomic data, are an indispensable resource for further research and development regarding disease prevention and treatment. To prevent personal medical data from being misused, techniques to reliably preserve sensitive information should be developed for real world application. In this paper, we propose a framework called anonymized generative adversarial networks (AnomiGAN), to improve the maintenance of privacy of personal medical data, while also maintaining high prediction performance. We compared our method to state-of-the-art techniques and observed that our method preserves the same level of privacy as differential privacy (DP), but had better prediction results. We also observed that there is a trade-off between privacy and performance results depending on the degree of preservation of the original data. Here, we provide a mathematical overview of our proposed model and demonstrate its validation using UCI machine learning repository datasets in order to highlight its utility in practice. Experimentally, our approach delivers a better performance compared to that of the DP approach.

Motivation & Objective

• To address the challenge of sharing sensitive medical data, especially genomic information, without compromising individual privacy.
• To develop a privacy-preserving data anonymization method that maintains high utility for machine learning models.
• To outperform existing methods, such as differential privacy, in both privacy protection and predictive performance.
• To provide a scalable, deep learning-based alternative to statistical or cryptographic anonymization techniques.
• To enable secure data sharing in online medical services and machine learning as a service (MLaaS) platforms.

Proposed method

• AnomiGAN employs a conditional GAN architecture where a generator learns to map random noise to anonymized medical data, conditioned on a target classifier.
• The discriminator is replaced with a pre-trained target classifier, which guides the generator to produce data that maintains high predictive performance.
• A privacy regularization term is introduced via a privacy parameter λₑ, which controls the trade-off between data utility and privacy by modulating the Euclidean distance between original and generated data.
• The model uses layer-wise variance injection during training to enhance robustness and improve generalization across different data distributions.
• The training objective combines reconstruction loss, adversarial loss, and a privacy-aware regularization term to balance fidelity, privacy, and utility.
• The framework is trained end-to-end using a combined loss function that optimizes for both data similarity and classifier performance.

Experimental results

Research questions

• RQ1 Can a GAN-based framework effectively anonymize private medical data while preserving its utility for downstream machine learning tasks?
• RQ2 How does the performance of AnomiGAN compare to differential privacy in terms of prediction accuracy and AUC under equivalent privacy constraints?
• RQ3 What is the impact of varying the privacy parameter λₑ on the trade-off between data utility and privacy protection?
• RQ4 Does layer-wise variance injection improve the robustness and generalization of the anonymized data?
• RQ5 Can the proposed method be applied to real-world medical datasets without requiring assumptions about the background population?

Key findings

• AnomiGAN achieves comparable privacy guarantees to differential privacy but with significantly better prediction accuracy and AUC on both the breast cancer and chronic kidney disease datasets.
• As the privacy parameter λₑ increases, the correlation between original and anonymized data remains strong, indicating high data fidelity.
• The average accuracy and AUC of the downstream classifier remain stable or improve as λₑ increases, demonstrating robustness to privacy constraints.
• Layer-wise variance injection has a limited but measurable effect on correlation, with minimal degradation in accuracy and AUC, suggesting stable performance across network layers.
• Training time for AnomiGAN is efficient, taking less than 2 hours for the breast cancer dataset and under 1 hour for the chronic kidney disease dataset with optimal hyperparameters.
• The method outperforms differential privacy in both privacy-utility trade-off and predictive performance, making it a viable alternative for real-world medical data sharing.