Evaluation of Inference Attack Models for Deep Learning on Medical Data
  Deep learning has attracted broad interest in healthcare and medical
communities. However, there has been little research into the privacy issues
created by deep networks trained for medical applications. Recently developed
inference attack algorithms indicate that images and text records can be
reconstructed by malicious parties that have the ability to query deep
networks. This gives rise to the concern that medical images and electronic
health records containing sensitive patient information are vulnerable to these
attacks. This paper aims to attract interest from researchers in the medical
deep learning community to this important problem. We evaluate two prominent
inference attack models, namely, attribute inference attack and model inversion
attack. We show that they can reconstruct real-world medical images and
clinical reports with high fidelity. We then investigate how to protect
patients' privacy using defense mechanisms, such as label perturbation and
model perturbation. We provide a comparison of attack results between the
original and the medical deep learning models with defenses. The experimental
evaluations show that our proposed defense approaches can effectively reduce
the potential privacy leakage of medical deep learning from the inference
attacks.
