Deep learning has attracted broad interest in healthcare and medical
communities. However, there has been little research into the privacy issues
created by deep networks trained for medical applications. Recently developed
inference attack algorithms indicate that images and text records can be
reconstructed by malicious parties that have the ability to query deep
networks. This gives rise to the concern that medical images and electronic
health records containing sensitive patient information are vulnerable to these
attacks. This paper aims to attract interest from researchers in the medical
deep learning community to this important problem. We evaluate two prominent
inference attack models, namely, attribute inference attack and model inversion
attack. We show that they can reconstruct real-world medical images and
clinical reports with high fidelity. We then investigate how to protect
patients' privacy using defense mechanisms, such as label perturbation and
model perturbation. We provide a comparison of attack results between the
original and the medical deep learning models with defenses. The experimental
evaluations show that our proposed defense approaches can effectively reduce
the potential privacy leakage of medical deep learning from the inference
attacks.

本文研究了深度神经网络在医疗应用中存在的隐私问题，发现攻击者可以利用属性推理攻击和模型反演攻击重建真实医学图像和临床记录，提出使用标签扰动和模型扰动等防御机制有效保护患者隐私。实验结果证明，我们的防御策略可以有效地减少医疗深度学习的隐私泄露风险。