pith. sign in

arxiv: 2606.21763 · v1 · pith:FOURIYCTnew · submitted 2026-06-19 · 💻 cs.CV · cs.CR

From Gradient Clipping to Structural Refinement: Improving DPSGD for Medical Image Segmentation

Shiva Parsarad , Parth Shandilya , Isabel Wagner This is my paper

Pith reviewed 2026-06-26 14:11 UTC · model grok-4.3

classification 💻 cs.CV cs.CR
keywords differential privacyDPSGDmedical image segmentationgradient clippingmorphological refinementprivacy-preserving machine learningmulti-class segmentation
0
0 comments X

The pith

Combining DPSGD clipping with morphological refinement improves medical image segmentation quality under privacy constraints.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper evaluates several DPSGD clipping variants on binary and multi-class medical segmentation tasks and finds that prior assumptions about their gradient behavior do not always hold. It shows that adding a morphological refinement step after training recovers segmentation accuracy that would otherwise be lost to privacy noise. An adaptive DP-Morph version is introduced that tailors the refinement to individual classes. A reader would care because medical segmentation models trained on private patient scans lose practical value when standard differential privacy is applied.

Core claim

The paper demonstrates that combining clipping strategies with morphological refinement improves segmentation quality under privacy constraints. It further proposes an adaptive DP-Morph variant that captures class-specific structures and enhances performance in multi-class settings, after showing that gradient alignment assumptions for methods such as PSAC do not consistently hold in segmentation.

What carries the argument

Morphological refinement applied after DPSGD training, including the adaptive DP-Morph variant that adjusts operations according to class-specific structures.

If this is right

  • Segmentation masks become more accurate in both binary and multi-class medical tasks when morphological refinement follows any of the tested DPSGD clipping methods.
  • The adaptive DP-Morph variant improves results specifically in multi-class problems by handling differing class structures.
  • Gradient alignment analysis reveals that assumptions valid for image classification do not transfer directly to segmentation.
  • Utility loss from privacy noise can be partially offset without changing the training procedure itself.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same post-processing pattern could be tested on other dense prediction tasks where privacy noise blurs fine boundaries.
  • If the refinement step truly adds no privacy cost, it might allow practitioners to use tighter privacy budgets while still meeting clinical accuracy thresholds.
  • Extending the adaptive logic to capture spatial context beyond simple morphology could be a direct next step.

Load-bearing premise

The morphological refinement step can be applied after private training without introducing new privacy leaks or invalidating the differential privacy guarantees of the DPSGD variants.

What would settle it

A membership inference or data reconstruction attack that succeeds more often against the morphologically refined model than against the unrefined DPSGD model would show that privacy is no longer preserved.

Figures

Figures reproduced from arXiv: 2606.21763 by Isabel Wagner, Parth Shandilya, Shiva Parsarad.

Figure 1
Figure 1. Figure 1: Example medical segmentation inputs and corresponding ground-truth [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Heatmaps of UNet performance under flat clipping for different learning [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Comparison of clipping strategies on the Duke dataset for UNet++ and [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Comparison of clipping strategies on the UMN dataset for UNet++ and [PITH_FULL_IMAGE:figures/full_fig_p011_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Comparison of clipping strategies on the Covid-19 dataset for UNet++ [PITH_FULL_IMAGE:figures/full_fig_p012_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Visual results of clipping strategies. The top block shows a COVID-19 [PITH_FULL_IMAGE:figures/full_fig_p012_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Gradient cosine similarity distributions under DP training ( [PITH_FULL_IMAGE:figures/full_fig_p013_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Comparison of training time between different models and clipping strate [PITH_FULL_IMAGE:figures/full_fig_p014_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Protection provided by clipping strategies against global loss attack [PITH_FULL_IMAGE:figures/full_fig_p014_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Effect of morphological refinement on segmentation predictions. Each [PITH_FULL_IMAGE:figures/full_fig_p015_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: Segmentation performance of adaptive morphology (v1-v3) compared [PITH_FULL_IMAGE:figures/full_fig_p016_11.png] view at source ↗
Figure 12
Figure 12. Figure 12: Layer-wise policy evolution during training (first row), and Layer-wise [PITH_FULL_IMAGE:figures/full_fig_p016_12.png] view at source ↗
read the original abstract

Medical image segmentation is widely used for disease detection but relies on sensitive data, raising privacy concerns as trained models can leak information. Differential privacy, typically implemented via Differential Private Stochastic Gradient Descent (DPSGD), provides a solution, though at the cost of reduced utility. Recent DPSGD variants, including Automatic clipping (Auto-S), Normalised SGD with perturbation (NSGD), and Per-sample adaptive clipping (PSAC), have shown promise in image classification, but their behavior in medical segmentation remains underexplored. We evaluate these methods across binary and multi-class tasks and analyze gradient alignment, showing that prior assumptions, particularly for PSAC, do not consistently hold. We further demonstrate that combining clipping strategies with morphological refinement improves segmentation quality under privacy constraints. Finally, we propose an adaptive DP-Morph variant that captures class-specific structures and enhances performance in multi-class settings.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 0 minor

Summary. The paper evaluates DPSGD variants (Auto-S, NSGD, PSAC) on binary and multi-class medical image segmentation, analyzes gradient alignment (finding prior PSAC assumptions do not hold consistently), shows that combining clipping with morphological refinement improves segmentation quality under privacy constraints, and proposes an adaptive DP-Morph variant that captures class-specific structures for multi-class settings.

Significance. If the end-to-end differential privacy guarantees are rigorously established for the refinement steps, the work could offer practical utility gains for privacy-preserving medical segmentation without sacrificing formal privacy, extending DPSGD techniques from classification to a high-stakes domain.

major comments (2)
  1. [Abstract] Abstract: the central claim that 'combining clipping strategies with morphological refinement improves segmentation quality under privacy constraints' and that 'adaptive DP-Morph ... enhances performance in multi-class settings' is load-bearing, yet the text provides no sensitivity analysis or privacy accounting for the adaptive variant when class-specific morphological parameters are derived from the training set; if these parameters are estimated without additional noise, the (ε,δ) guarantee does not follow from the DPSGD analysis alone.
  2. [Abstract] The weakest assumption (morphological refinement as pure post-processing) is not verified experimentally; no ablation or theorem shows that adaptive DP-Morph preserves the original privacy budget when structures are learned from private data.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for highlighting the need for rigorous end-to-end privacy accounting on the adaptive DP-Morph variant. We address each major comment below and will revise the manuscript accordingly.

read point-by-point responses

  1. Referee: [Abstract] Abstract: the central claim that 'combining clipping strategies with morphological refinement improves segmentation quality under privacy constraints' and that 'adaptive DP-Morph ... enhances performance in multi-class settings' is load-bearing, yet the text provides no sensitivity analysis or privacy accounting for the adaptive variant when class-specific morphological parameters are derived from the training set; if these parameters are estimated without additional noise, the (ε,δ) guarantee does not follow from the DPSGD analysis alone.

    Authors: We agree that the current manuscript lacks an explicit sensitivity analysis and privacy composition for the class-specific morphological parameters when they are estimated from the private training set. The adaptive DP-Morph variant selects per-class structuring elements directly from training data statistics, which constitutes an additional data-dependent step. In the revision we will add a dedicated privacy analysis section that either (a) treats parameter estimation as a separate DP mechanism with its own noise calibration or (b) fixes the parameters on a public validation split and reports the resulting composed (ε,δ) budget. This will make the end-to-end guarantee explicit rather than relying solely on the DPSGD analysis. revision: yes

  2. Referee: [Abstract] The weakest assumption (morphological refinement as pure post-processing) is not verified experimentally; no ablation or theorem shows that adaptive DP-Morph preserves the original privacy budget when structures are learned from private data.

    Authors: The manuscript currently presents morphological refinement as a deterministic post-processing operation applied to model outputs. While the standard post-processing property of DP would preserve the guarantee if the structuring elements were fixed independently of the private data, the adaptive variant learns those elements from the training set. We acknowledge that this assumption is not experimentally verified or formally stated. In the revision we will (i) add an ablation that compares performance when parameters are estimated with and without additional privacy noise, and (ii) include a short composition theorem clarifying the total privacy loss. If the parameters must be learned privately, we will adjust the reported privacy budgets accordingly. revision: yes

Circularity Check

0 steps flagged

No circularity; no derivations or self-referential reductions present

full rationale

The abstract and context describe empirical evaluation of DPSGD clipping variants plus a proposed morphological refinement step, with no equations, parameter fits, or derivation chains shown. No load-bearing claims reduce to self-definition, fitted inputs renamed as predictions, or self-citation chains. The privacy-accounting concern raised by the skeptic is a correctness issue, not circularity. This matches the default expectation of score 0-2 for papers without detectable circular structure.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

Abstract supplies no information on free parameters, axioms, or invented entities.

pith-pipeline@v0.9.1-grok · 5681 in / 953 out tokens · 29116 ms · 2026-06-26T14:11:09.329865+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

32 extracted references · 11 canonical work pages

  1. [1]

    Covid-19 ct segmentation dataset.https://medicalsegmentation.com/covid19/ (2020), accessed: 2026

    2020

  2. [2]

    In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security

    Abadi, M., Chu, A., Goodfellow, I., McMahan, H.B., Mironov, I., Talwar, K., Zhang, L.: Deep Learning with Differential Privacy. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. pp. 308–

    2016

  3. [3]

    ACM, Vienna, Austria (Oct 2016)

    2016

  4. [4]

    In: Thirty-Seventh Conference on Neural Information Processing Systems (Nov 2023)

    Bu, Z., Wang, Y.X., Zha, S., Karypis, G.: Automatic Clipping: Differentially Pri- vate Deep Learning Made Easier and Stronger. In: Thirty-Seventh Conference on Neural Information Processing Systems (Nov 2023)

    2023

  5. [5]

    Biomedical optics express6(4), 1172–1194 (2015)

    Chiu, S.J., Allingham, M.J., Mettu, P.S., Cousins, S.W., Izatt, J.A., Farsiu, S.: Kernel regression based segmentation of optical coherence tomography images with diabetic macular edema. Biomedical optics express6(4), 1172–1194 (2015)

    2015

  6. [6]

    In: Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security

    Chobola, T., Usynin, D., Kaissis, G.: Membership inference attacks against seman- tic segmentation models. In: Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security. p. 43–53. AISec ’23, Association for Computing Machin- ery, New York, NY, USA (2023).https://doi.org/10.1145/3605764.3623906

    work page doi:10.1145/3605764.3623906 2023

  7. [7]

    IEEE Transactions on Medical Imaging39(8), 2626–2637 (Aug 2020).https://doi.org/ 10.1109/TMI.2020.2996645

    Fan, D.P., Zhou, T., Ji, G.P., Zhou, Y., Chen, G., Fu, H., Shen, J., Shao, L.: Inf- Net: Automatic COVID-19 Lung Infection Segmentation From CT Images. IEEE Transactions on Medical Imaging39(8), 2626–2637 (Aug 2020).https://doi.org/ 10.1109/TMI.2020.2996645

    work page doi:10.1109/tmi.2020.2996645 2020

  8. [8]

    Engineering Applications of Artificial Intelligence137, 109047 (2024)

    Ghosh, S., Das, S.: Multi-scale morphology-aided deep medical image segmenta- tion. Engineering Applications of Artificial Intelligence137, 109047 (2024)

    2024

  9. [9]

    In: Proceedings of the 33rd International Conference on Neural Information Processing Systems, pp

    Hu, X., Fuxin, L., Samaras, D., Chen, C.: Topology-preserving deep image segmen- tation. In: Proceedings of the 33rd International Conference on Neural Information Processing Systems, pp. 5657–5668. No. 508, Curran Associates Inc., Red Hook, NY, USA (Dec 2019)

    2019

  10. [10]

    International Jour- nal of Advances in Intelligent Informatics11(2), 275–291 (May 2025).https: //doi.org/10.26555/ijain.v11i2.1529

    Ismail, A.R., Azlan, F.F., Noormaizan, K.A., Afiqa, N., Nisa, S.Q., Ghazali, A.B., Pranolo, A., Saifullah, S.: Privacy-Preserving U-Net Variants with pseudo- labeling for radiolucent lesion segmentation in dental CBCT. International Jour- nal of Advances in Intelligent Informatics11(2), 275–291 (May 2025).https: //doi.org/10.26555/ijain.v11i2.1529

    work page doi:10.26555/ijain.v11i2.1529 2025

  11. [11]

    Journal of Medical Signals & Sensors 3(1), 45 (2013).https://doi.org/10.4103/2228-7477.114321

    Kafieh, R., Rabbani, H., Kermani, S.: A Review of Algorithms for Segmentation of Optical Coherence Tomography from Retina. Journal of Medical Signals & Sensors 3(1), 45 (2013).https://doi.org/10.4103/2228-7477.114321

    work page doi:10.4103/2228-7477.114321 2013

  12. [12]

    arXiv preprint arXiv:2207.02376 (2022)

    Li, R., Wang, X., Huang, G., Yang, W., Zhang, K., Gu, X., Tran, S.N., Garg, S., Alty, J., Bai, Q.: A comprehensive review on deep supervision: Theories and applications. arXiv preprint arXiv:2207.02376 (2022)

    arXiv 2022

  13. [13]

    Annals of Data Science pp

    Liu, W., Zhang, Y., Yang, H., Meng, Q.: A Survey on Differential Privacy for Medical Data Analysis. Annals of Data Science pp. 1–15 (Jun 2023).https:// doi.org/10.1007/s40745-023-00475-3

    work page doi:10.1007/s40745-023-00475-3 2023

  14. [14]

    Computerized Medical Imaging and Graphics94, 101988 (2021)

    Ma, D., Lu, D., Chen, S., Heisler, M., Dabiri, S., Lee, S., Lee, H., Ding, G.W., Sarunic, M.V., Beg, M.F.: Lf-unet – a novel anatomical-aware dual-branch cas- caded deep neural network for segmentation of retinal layers and fluid from optical coherence tomography images. Computerized Medical Imaging and Graphics94, 101988 (2021)

    2021

  15. [15]

    Nature Communications15(1), 654 (Jan 2024).https://doi.org/10

    Ma, J., He, Y., Li, F., Han, L., You, C., Wang, B.: Segment anything in medical images. Nature Communications15(1), 654 (Jan 2024).https://doi.org/10. 1038/s41467-024-44824-z 18 Shiva Parsarad, Parth Shandilya and Isabel Wagner

    2024

  16. [16]

    NPJ Digital Medicine9, 93 (Jan 2026)

    Mohammadi, M., Vejdanihemmat, M., Lotfinia, M., Rusu, M., Truhn, D., Maier, A., Tayebi Arasteh, S.: Differential privacy for medical deep learning: Methods, tradeoffs, and deployment implications. NPJ Digital Medicine9, 93 (Jan 2026). https://doi.org/10.1038/s41746-025-02280-z

    work page doi:10.1038/s41746-025-02280-z 2026

  17. [17]

    In: Proceedings of the 18th ACM Work- shop on Artificial Intelligence and Security

    Parsarad, S., Yousefzadeh-Asl-Miandoab, E., Kafieh, R., Tozun, P., Ciorba, F.M., Wagner, I.: DP-Morph: Improving the Privacy-Utility-Performance Trade-off for Differentially Private OCT Segmentation. In: Proceedings of the 18th ACM Work- shop on Artificial Intelligence and Security. pp. 264–275. ACM, Taipei , Taiwan (Oct 2025).https://doi.org/10.1145/3733...

    work page doi:10.1145/3733799.3762984 2025

  18. [18]

    Parsarad, Shiva and Wagner, Isabel: Differentially private medi- cal image segmentation code.https://gitlab.com/dmi-pet-public/ parsarad2026medicalsegmentationprivay(2026), gitLab repository, accessed: 2026

    2026

  19. [19]

    In: Computer Vision–ACCV2018Workshops:14thAsianConferenceonComputerVision,Perth, Australia, December 2–6, 2018, Revised Selected Papers 14

    Pekala, M., Joshi, N., Liu, T.A., Bressler, N.M., Cabrera DeBuc, D., Burlina, P.: Oct segmentation via deep learning: A review of recent work. In: Computer Vision–ACCV2018Workshops:14thAsianConferenceonComputerVision,Perth, Australia, December 2–6, 2018, Revised Selected Papers 14. pp. 316–322. Springer (2019)

    2018

  20. [20]

    IEEE Transactions on Biomedical Engineering (2017)

    Rashno, A., Koozekanani, D.D., Drayna, P.M., Nazari, B., Sadri, S., Rabbani, H., Parhi, K.K.: Fully-automated segmentation of fluid/cyst regions in optical coher- ence tomography images with diabetic macular edema using neutrosophic sets and graph algorithms. IEEE Transactions on Biomedical Engineering (2017)

    2017

  21. [21]

    In: Medical Image Computing and Computer-Assisted Intervention–MICCAI 2015: 18th International Conference, Munich, Germany, Oc- tober 5-9, 2015, Proceedings, Part III 18

    Ronneberger, O., Fischer, P., Brox, T.: U-net: Convolutional networks for biomed- ical image segmentation. In: Medical Image Computing and Computer-Assisted Intervention–MICCAI 2015: 18th International Conference, Munich, Germany, Oc- tober 5-9, 2015, Proceedings, Part III 18. pp. 234–241. Springer (2015)

    2015

  22. [22]

    Metrics for evaluaƟng 3D medical image segmentaƟon: analysis, selecƟon, and tool

    Taha, A.A., Hanbury, A.: Metrics for evaluating 3D medical image segmentation: Analysis, selection, and tool. BMC Medical Imaging15(1), 29 (Aug 2015).https: //doi.org/10.1186/s12880-015-0068-x

    work page doi:10.1186/s12880-015-0068-x 2015

  23. [23]

    Tang, H., Huang, C., Lin, S.Y., Qian, Z., Fan, W.: Shape-aware organ segmentation by predicting signed distance maps (Apr 2022)

    2022

  24. [24]

    Viedma, I.A., Alonso-Caneiro, D., Read, S.A., Collins, M.J.: Oct retinal and choroidallayerinstancesegmentationusingmaskr-cnn.Sensors22(5), 2016(2022)

    2016

  25. [25]

    Xia,T.,Shen,S.,Yao,S.,Fu,X.,Xu,K.,Xu,X.,Fu,X.:Differentiallyprivatelearn- ing with per-sample adaptive clipping. In: Proceedings of the Thirty-Seventh AAAI Conference on Artificial Intelligence and Thirty-Fifth Conference on Innovative Applications of Artificial Intelligence and Thirteenth Symposium on Educational Advances in Artificial Intelligence. AAAI...

    work page doi:10.1609/aaai.v37i9.26242 2023

  26. [26]

    Yang, X., Zhang, H., Chen, W., Liu, T.Y.: Normalized/Clipped SGD with Per- turbation for Differentially Private Non-Convex Optimization (Jun 2022).https: //doi.org/10.48550/arXiv.2206.13033

    work page doi:10.48550/arxiv.2206.13033 2022

  27. [27]

    In: NeurIPS 2021 Workshop Privacy in Machine Learning (Nov 2021)

    Yousefpour, A., Shilov, I., Sablayrolles, A., Testuggine, D., Prasad, K., Malek, M., Nguyen, J., Ghosh, S., Bharadwaj, A., Zhao, J., Cormode, G., Mironov, I.: Opacus: User-Friendly Differential Privacy Library in PyTorch. In: NeurIPS 2021 Workshop Privacy in Machine Learning (Nov 2021)

    2021

  28. [28]

    Zhou, Z., Rahman Siddiquee, M.M., Tajbakhsh, N., Liang, J.: Unet++: A nested u-net architecture for medical image segmentation. In: Deep Learning in Medical Image Analysis and Multimodal Learning for Clinical Decision Support: 4th In- ternational Workshop, DLMIA 2018, and 8th International Workshop, ML-CDS Improving DPSGD For Medical Image Segmentation 19...

    2018

  29. [29]

    In: Wallach, H., Larochelle, H., Beygelzimer, A., d'Alché-Buc, F., Fox, E., Garnett, R

    Zhu, L., Liu, Z., Han, S.: Deep leakage from gradients. In: Wallach, H., Larochelle, H., Beygelzimer, A., d'Alché-Buc, F., Fox, E., Garnett, R. (eds.) Advances in Neu- ral Information Processing Systems. vol. 32. Curran Associates, Inc. (2019)

    2019

  30. [30]

    Nature Machine Intelligence6(7), 764–774 (2024)

    Ziller, A., Mueller, T.T., Stieger, S., Feiner, L.F., Brandt, J., Braren, R., Rueckert, D., Kaissis, G.: Reconciling privacy and accuracy in ai for medical imaging. Nature Machine Intelligence6(7), 764–774 (2024)

    2024

  31. [31]

    Scientific Reports11(1), 13524 (Jun 2021).https://doi.org/10.1038/s41598-021-93030-0

    Ziller, A., Usynin, D., Braren, R., Makowski, M., Rueckert, D., Kaissis, G.: Medical imaging deep learning with differential privacy. Scientific Reports11(1), 13524 (Jun 2021).https://doi.org/10.1038/s41598-021-93030-0

    work page doi:10.1038/s41598-021-93030-0 2021

  32. [32]

    Zou, K.H., Warfield, S.K., Bharatha, A., Tempany, C.M., Kaus, M.R., Haker, S.J., Wells III, W.M., Jolesz, F.A., Kikinis, R.: Statistical validation of image segmen- tation quality based on a spatial overlap index1: scientific reports. Academic radi- ology11(2), 178–189 (2004) Appendix Additional figures illustrating the evolution of estimated layer thickn...

    arXiv 2004