In previous EOSC-SIESTA posts, we introduced Federated Learning (FL) as a privacy-preserving approach that allows several data owners to train a shared model without directly sharing their raw datasets. We also presented how this concept is being brought into the project through the Federated Learning service available within the EOSC-SIESTA Dashboard, designed to support distributed training workflows in secure environments.
Building on this context, a new publication linked to EOSC-SIESTA explores how privacy protection can be further improved in federated learning settings, showcasing a particular use case working with sensitive medical imaging data.
Federated Learning is especially relevant in domains such as healthcare, where datasets are often distributed across different institutions and cannot be easily centralized due to privacy, legal and ethical constraints. In this type of scenario, a central server coordinates the training process by aggregating the models trained locally by each client, while the original data remain under the control of each data owner.
The paper focuses on the use of Differential Privacy (DP), a technique that adds noise to protect sensitive information. While DP can help reduce privacy risks, it may also affect the convergence and accuracy of the global model. Because naturally, protecting data and keeping models useful at the same time has to be a balancing act.
To address this challenge, the authors propose a metric privacy inspired noise calibration strategy under a global DP setting. Rather than enforcing metric privacy as a formal guarantee, the study uses it as a design principle to guide how noise is added by the server, with the aim of reducing its negative impact on model performance.
The approach is evaluated in a medical imaging use case using open data, comparing vanilla Federated Learning, standard global Differential Privacy and the proposed metric aware noise calibration strategy. The study analyses six aggregation strategies and simulates different scenarios, including both homogeneous and non .i.d. clients.
The paper also introduces a Client Inference Attack (CIA) scenario, where a semi honest client tries to determine whether another client participated in the training process. The results show that the proposed metric aware strategy improves accuracy compared with standard DP across all analyzed scenarios, while achieving a comparable level of protection against CIA.
This work has been performed by EOSC-SIESTA project coordinator IFCA-CSIC in collaboration with researchers from INRIA Saclay-École Polytechnique (LIX) and Technische Universiteit Delft (TU Delft). For EOSC-SIESTA, this work reinforces the project’s commitment to enabling secure, privacy preserving analysis of sensitive data through trusted cloud based environments, privacy aware services and practical tools for researchers.