[Paper Review] Decentralized Differentially Private Segmentation with PATE

Dominik Fay, Jens Sjölund+1 more|arXiv (Cornell University)|Apr 10, 2020

Privacy-Preserving Technologies in Data9 references4 citations

TL;DR

This paper proposes a decentralized, differentially private semantic segmentation framework using Private Aggregation of Teacher Ensembles (PATE) with dimensionality reduction via autoencoders. By compressing segmentation masks into low-dimensional representations before noisy aggregation, the method enables privacy-preserving knowledge distillation without synchronized communication, achieving a Dice score of 0.785 under high privacy (ε=125.94, δ=10⁻²), outperforming noisy Federated Averaging while remaining below the non-private baseline.

ABSTRACT

When it comes to preserving privacy in medical machine learning, two important considerations are (1) keeping data local to the institution and (2) avoiding inference of sensitive information from the trained model. These are often addressed using federated learning and differential privacy, respectively. However, the commonly used Federated Averaging algorithm requires a high degree of synchronization between participating institutions. For this reason, we turn our attention to Private Aggregation of Teacher Ensembles (PATE), where all local models can be trained independently without inter-institutional communication. The purpose of this paper is thus to explore how PATE -- originally designed for classification -- can best be adapted for semantic segmentation. To this end, we build low-dimensional representations of segmentation masks which the student can obtain through low-sensitivity queries to the private aggregator. On the Brain Tumor Segmentation (BraTS 2019) dataset, an Autoencoder-based PATE variant achieves a higher Dice coefficient for the same privacy guarantee than prior work based on noisy Federated Averaging.

Motivation & Objective

• To address the challenge of training accurate, privacy-preserving medical image segmentation models without centralized data sharing.
• To overcome the synchronization bottleneck of federated learning in multi-institutional settings.
• To adapt PATE—originally designed for classification—to semantic segmentation by enabling low-sensitivity aggregation of high-dimensional masks.
• To evaluate and compare dimensionality reduction techniques (PCA, DWT, autoencoders) for privacy-preserving knowledge distillation in segmentation.
• To demonstrate that autoencoder-based PATE achieves better utility-privacy trade-offs than existing decentralized private learning methods on BraTS 2019.

Proposed method

• The method uses a private aggregator that first compresses each teacher model's segmentation prediction into a low-dimensional latent representation using an encoder function $ h_{\text{enc}} $.
• The aggregator computes the mean of the compressed representations across all $ K $ teachers and adds zero-mean Gaussian noise scaled according to Rényi differential privacy bounds.
• The student model is trained on the reconstructed segmentation masks obtained by applying a decoder function $ h_{\text{dec}} $ to the perturbed average representation.
• The encoder and decoder are implemented as a U-Net-like autoencoder with batch normalization, ReLU activations, and sigmoid output, trained with noise injected at the bottleneck to match the test-time distribution.
• Privacy loss is accumulated over multiple aggregations using Rényi differential privacy, with optimal Rényi order $ \alpha $ chosen to minimize noise scale.
• The framework enables fully decentralized training: teachers train independently on local data, and only compressed, perturbed representations are shared with the aggregator.

Experimental results

Research questions

• RQ1 Can dimensionality reduction enable low-sensitivity aggregation of high-dimensional segmentation masks in a PATE-based framework while preserving differential privacy?
• RQ2 Which dimensionality reduction method—PCA, DWT, or autoencoders—yields the best trade-off between reconstruction fidelity and privacy-utility in semantic segmentation?
• RQ3 How does the segmentation performance of the proposed autoencoder-based PATE method compare to noisy Federated Averaging under equivalent privacy guarantees?
• RQ4 What level of privacy (ε) can be achieved with a moderate number of institutions (K) in a decentralized segmentation pipeline?
• RQ5 To what extent does the proposed method close the performance gap between private and non-private segmentation models on medical imaging data?

Key findings

• The autoencoder-based PATE variant achieved a Dice coefficient of 0.785 on the BraTS 2019 test set under a privacy budget of ε=125.94 and δ=10⁻², outperforming noisy Federated Averaging under the same privacy constraints.
• Autoencoders provided superior performance under high compression rates and noise, outperforming PCA and DWT in reconstruction quality and robustness to noise.
• The method achieved a privacy level of ε≈1 for K≥37 institutions, indicating that single-digit ε values are feasible with a moderate number of participating institutions.
• The non-private baseline achieved a Dice score of 0.869, highlighting a substantial performance gap that remains even with high-privacy PATE.
• The proposed framework enables decentralized training without synchronization, as teachers train independently and only compressed, perturbed representations are shared.