Pith. sign in

REVIEW 3 major objections 6 minor 48 references

Image disguising keeps useful accuracy for medical classification but badly hurts dense segmentation; RMT is the best practical trade-off, and medical images resist the regression attacks that partly work on natural photos.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Image disguising preserves medical classification utility but degrades dense segmentation; RMT balances utility, efficiency, and attack resistance better than AES or NeuraCrypt.

T0 review reviewed 2026-07-13 challenge →

load-bearing objection Solid empirical bake-off: image disguising works better for medical classification than segmentation, RMT is the practical pick, and known-pair regression is weaker on these medical images than on MNIST/CIFAR. the 3 major comments →

arxiv 2607.08867 v1 pith:VPZPVIYF submitted 2026-07-09 cs.CV cs.LG

Secure-by-Disguise: A Systematic Evaluation of Image Disguising for Confidential Medical Image Modeling

Jason Rojas , Jiajie He , Yash Patel , Yuechun Gu , Zeyun Yu , Keke Chen This is my paper
classification cs.CV cs.LG
keywords image disguisingprivacy-preserving machine learningmedical image analysisconfidential medical AIRandomized Multidimensional Transformationsemantic segmentationreconstruction attackscloud computing
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Cloud training of medical deep learning models requires a way to hide patient images without wrecking the models or paying cryptographic costs. This paper gives the first head-to-head evaluation of image disguising—transforms that make images visually unintelligible yet still trainable by ordinary networks—on real medical classification and segmentation tasks. Across four public datasets, the methods largely preserve image-level diagnostic performance while causing large drops in pixel-level mask quality. Randomized Multidimensional Transformation (RMT) emerges as the clear practical winner on utility, speed, and resistance to known-pair reconstruction; AES-style block encryption largely destroys usefulness. Attacks that recover partial structure on low-resolution natural images largely fail on these medical images. The result is concrete guidance: current disguising is already a workable PET for cloud-based screening and classification, but not yet for tasks that need precise spatial structure.

Core claim

Image disguising behaves differently on image-level versus pixel-level medical AI: it preserves practical utility for classification while causing substantial degradation for dense semantic segmentation. Among the evaluated methods, RMT consistently offers the best balance of predictive performance, computational efficiency, and resistance to reconstruction attacks, whereas AES-based disguising severely damages utility. Regression-based known-pair attacks that were partly effective on natural-image benchmarks become considerably less effective on realistic medical images.

What carries the argument

A unified evaluation framework that runs DisguisedNets (block-wise RMT and AES transforms, with matching mask transforms for segmentation) and NeuraCrypt on four medical datasets under one protocol measuring F1/Dice utility, preprocessing and training cost, block-size and noise sensitivity, and known-pair linear-regression reconstruction via a pretrained DNN examiner.

Load-bearing premise

The four public datasets and the honest-but-curious cloud plus known-pair regression attack are taken as enough to judge suitability of image disguising for confidential medical AI in general.

What would settle it

Apply the same RMT/AES pipeline to CT or MRI organ/tumor segmentation and show Dice near the original-image baseline, or recover clinically usable anatomy from RMT images with a modern generative reconstructor under the strong known-pair setting.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Cloud-based medical image classification and screening can already use RMT-style disguising with modest utility loss and only lightweight preprocessing.
  • Dense clinical tasks that need accurate spatial localization (lesion contouring, organ segmentation, radiation planning) currently require other PETs or on-premises training.
  • Security conclusions drawn only from MNIST/CIFAR-style benchmarks overstate reconstruction risk for realistic medical images under the tested attack.
  • RMT performance is stable across moderate block sizes and noise levels, so extensive parameter tuning is unnecessary for deployment.
  • Future medical PETs must be evaluated separately on classification and dense prediction rather than assumed to transfer from natural-image results.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The medical-image hardness of reconstruction may be specific to linear regression; diffusion or generative attackers could still succeed and should be tested next.
  • The same classification-versus-segmentation split is likely to appear for other PETs (local DP, secure aggregation) when they are applied to medical imaging.
  • Hospitals that only need image-level triage could deploy RMT today, while those needing pixel masks should keep data local until structure-preserving disguises exist.
  • The released evaluation suite itself can serve as a standing benchmark for any new image-level PET that claims medical applicability.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper presents a unified empirical evaluation of image disguising as a privacy-enhancing technology for confidential medical AI. It re-implements DisguisedNets (RMT and AES block transforms) and NeuraCrypt under a common protocol on four public medical datasets spanning classification (Breast histopathology, MData wound) and dense semantic segmentation (CVC-ClinicDB, Wound Patch). Under an honest-but-curious cloud threat model, the authors measure predictive utility (macro F1 / Dice), preprocessing and training efficiency, RMT parameter sensitivity, and resistance to known-pair regression reconstruction attacks. The central findings are that current disguising methods preserve substantially more utility for image-level classification than for pixel-level segmentation, that RMT offers the best observed balance of utility, efficiency, and attack resistance while AES severely degrades utility, and that regression attacks previously partially effective on natural-image benchmarks are considerably less successful on these medical images. Code and the evaluation framework are released.

Significance. If the reported patterns hold, the work supplies the first systematic, multi-task evidence that image disguising is a practical PET for cloud-based medical image classification/screening but is currently inadequate for dense clinical segmentation. That task-dependent distinction is clinically actionable and was not established by prior natural-image-only studies. Strengths include a reproducible open-source framework, stratified five-fold CV with confidence intervals, multi-architecture coverage (CNNs, U-Net/UNet++, ViT), ablations on block size and noise, quantitative plus visual attack results, and explicit scoping of limitations (modalities and stronger generative adversaries). The contribution is primarily evaluative rather than algorithmic, but the bake-off and design guidance are useful for the medical PET community.

major comments (3)
  1. The abstract, introduction, and conclusion repeatedly frame the work as assessing suitability of image disguising for confidential medical AI in general, yet §3.4.1 and Table 1 cover only histopathology, clinical wound photography, colonoscopy, and DFU patches. CT, MRI, ultrasound, and 3D volumes are absent. §5.4 correctly lists these as future work, but the broad claim language should be tightened to the evaluated modalities and 2D tasks so that readers do not over-generalize the classification-vs-segmentation conclusion.
  2. Privacy claims rest almost entirely on the known-pair linear regression attack of §4.4.3 (and the original DisguisedNets threat model in §3.2). The paper shows this attack is weak on the medical images, which is a useful negative result, but modern generative/diffusion reconstructors are not evaluated. Because the manuscript already flags this gap in §5.4, the abstract and conclusion should more carefully qualify “resistance to reconstruction attacks” as resistance under the tested regression adversary rather than as a general security guarantee.
  3. Segmentation utility results (§4.2, Fig. 5) show large absolute drops (e.g., CVC Dice from ~0.92 to ~0.48 under RMT). The paper correctly concludes that current methods are inadequate for dense tasks, but it does not report whether any RMT configuration (block size / noise from the §4.4 ablations) recovers clinically usable Dice, nor does it provide a simple non-disguising spatial-preserving baseline (e.g., global encryption of features only). Without that, the claim that spatial disruption is the root cause remains plausible but not fully isolated.
minor comments (6)
  1. §3.3: “blocktization” appears to be a typo for “blockization” or “blocking.”
  2. Figures 6–7 and 12–13 would benefit from larger panels or higher-resolution insets; the qualitative reconstruction claims are important and currently hard to inspect in print.
  3. Table 1 lists “Breast (PEM)” without expanding PEM or citing the exact public source; a one-line provenance note would improve reproducibility.
  4. §4.1 states AES F1 scores approach random prediction on Breast but “less performance degradation” on MData; reporting the chance baseline explicitly for the 6-class MData task would make the comparison clearer.
  5. NeuraCrypt is evaluated only with its original ViT; a short note on whether the confidential embeddings could be paired with a CNN decoder for segmentation would clarify the architecture confound when comparing to U-Net results.
  6. Minor consistency: abstract says “four datasets involving classification and semantic segmentation” while the body cleanly separates two classification and two segmentation sets—fine, but keep the wording parallel.

Circularity Check

1 steps flagged

Empirical bake-off on public medical datasets with standard metrics; self-citation of DisguisedNets supplies the methods under test but does not force the reported utility/privacy outcomes.

specific steps
  1. self citation load bearing [Section 2.2 / 3.3 (DisguisedNets citation [23])]
    "DisguisedNets [23] combines block-wise permutation with Randomized Multidimensional Transformation (RMT) or AES-based transformations... We focus on two representative image disguising frameworks. DisguisedNets[23] transforms images through (1) blocktization and optional block-level permutation, followed by (2) block-level transformation, which contains two transformation strategies: RMT and AES."

    Authors of the present paper overlap with [23]; the methods under evaluation are imported from that prior work. This is ordinary self-citation of the technique being re-tested, not a load-bearing uniqueness claim or closed loop that forces the medical classification/segmentation/attack results, which are independently measured on new data.

full rationale

The paper is a systematic empirical evaluation, not a first-principles derivation. Predictive utility (macro F1, Dice), efficiency, and attack resistance are measured on four external public datasets via five-fold cross-validation, ImageNet-pretrained CNNs/U-Nets, and a released code base. DisguisedNets/RMT/AES and NeuraCrypt are taken as given methods (with overlapping authorship on the former) and re-run under a unified protocol; the central claims (classification utility largely preserved, segmentation degraded, RMT best balance, regression attacks weaker on medical images) are outcomes of those held-out experiments, not identities or fits that redefine the targets. No self-definitional equations, fitted-input-as-prediction, uniqueness theorems, or ansatz smuggling appear. The single self-citation is background for the techniques being evaluated and is not load-bearing for the medical-specific findings, which stand or fall on the new measurements. Score 1 reflects only that minor, non-circular self-reference.

Axiom & Free-Parameter Ledger

4 free parameters · 5 axioms · 1 invented entities

As an empirical systems evaluation, the paper rests mainly on standard ML and threat-model assumptions rather than fitted physical constants or new ontological entities. Load-bearing choices are the honest-but-curious outsourcing model, the decision that mask geometry should follow image geometry for segmentation, the use of DNN examiners as leakage proxies, and experimental hyperparameters (block size, noise, architectures). No new particle-like entity is introduced; the 'unified evaluation framework' is a methodology, not an independent physical object.

free parameters (4)
  • RMT block size
    Chosen experimentally (e.g., 2×2 to 64×64); main comparisons use 4×4 and 32×32 without noise. Downstream utility, especially segmentation, depends on this choice.
  • RMT additive noise level
    Optional noise (levels up to 256) is swept; claimed robustness depends on these hand-chosen operating points.
  • Training hyperparameters
    Adam lr=1e-4, weight decay 1e-4, batch size 8, 100 epochs, ImageNet init, fixed augmentations. Utility comparisons assume these settings are adequate and fair across methods.
  • Known-pair leakage count K
    Attack strength is reported over K leaked pairs (1–100); conclusions about medical-image resistance depend on this experimental range and the 2×2 most-favorable attacker setting.
axioms (5)
  • domain assumption Cloud is honest-but-curious: correctly trains/infers but may try to recover patient images from disguised data, process, or model.
    Section 3.2 threat model; excludes client compromise, poisoning, and channel attacks from scope.
  • domain assumption For segmentation, applying the same geometry-changing transform to masks preserves a valid pixel-wise learning problem under disguising.
    Section 3.1 defines ỹ_i = T_y(y_i; k) whenever image geometry changes.
  • domain assumption Higher pretrained DNN examiner performance on reconstructed images indicates greater privacy leakage.
    Sections 3.4.4 and 4.4.3 use F1/Dice of examiners as the quantitative privacy metric.
  • ad hoc to paper Representative methods DisguisedNets (RMT/AES) and NeuraCrypt adequately stand in for the image-disguising PET class under study.
    Section 3.3 selects two frameworks as representative; broader PET space is not exhaustively sampled.
  • standard math Standard supervised deep learning metrics (macro F1, Dice) and five-fold CV are sufficient to judge clinical-task utility preservation.
    Section 3.4.4 evaluation metrics; no clinical reader study or calibration analysis.
invented entities (1)
  • Unified evaluation framework for medical image disguising no independent evidence
    purpose: Common protocol to compare utility, efficiency, parameter sensitivity, and reconstruction robustness across classification and segmentation.
    Methodological construct of the paper; useful but not an independently evidenced physical or cryptographic primitive beyond the experiments themselves.

reviewed 2026-07-13 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Secure-by-Disguise: A Systematic Evaluation of Image Disguising for Confidential Medical Image Modeling." pith.science (2026). https://pith.science/paper/VPZPVIYF

@misc{pith2026260708867,
  author       = {Pith},
  title        = {Pith review of: Secure-by-Disguise: A Systematic Evaluation of Image Disguising for Confidential Medical Image Modeling},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VPZPVIYF}},
  note         = {Machine review of arXiv:2607.08867}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Cloud-based deep learning enables large-scale medical image analysis but raises significant privacy concerns when sensitive patient images are outsourced for model development. Image disguising has recently emerged as a promising privacy-enhancing technology (PET) that transforms images into visually unintelligible representations while preserving information for downstream learning. We established a unified framework to evaluate representative methods, DisguisedNets and NeuraCrypt, across four datasets involving classification and semantic segmentation tasks. Our analysis assessed predictive utility, efficiency, and robustness against reconstruction attacks. Results showed that image disguising performance varies significantly between tasks; while methods preserved utility for medical image classification, they caused substantial degradation in dense semantic segmentation. Specifically, Randomized Multidimensional Transformation (RMT) offered the optimal balance of performance and security, whereas AES-based disguising severely impacted utility. Furthermore, regression-based reconstruction attacks effective on natural images proved considerably less successful on realistic medical images. These findings provide a systematic assessment of PET suitability for confidential medical AI applications.

Figures

Figures reproduced from arXiv: 2607.08867 by Jason Rojas, Jiajie He, Keke Chen, Yash Patel, Yuechun Gu, Zeyun Yu.

Figure 1
Figure 1. Figure 1: Image disguising framework for outsourced medical image analysis. Medical [PITH_FULL_IMAGE:figures/full_fig_p008_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Examples of block-wise RMT transformations on Breast and CVC datasets. [PITH_FULL_IMAGE:figures/full_fig_p010_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Examples of AES-transformed images from the MData and Wound Patch [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Comparison of Mean F1 scores across different methods grouped by model architecture for both datasets. Error bars denote confidence intervals. 14 [PITH_FULL_IMAGE:figures/full_fig_p014_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Comparison of Mean Dice coefficients across different privacy methods grouped [PITH_FULL_IMAGE:figures/full_fig_p016_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Visual comparison of dense semantic segmentation results on the CVC dataset [PITH_FULL_IMAGE:figures/full_fig_p017_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Visual comparison of dense semantic segmentation results on the Wound-Patch [PITH_FULL_IMAGE:figures/full_fig_p018_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Training and validation loss trajectories for the Breast classifier: panel (a) [PITH_FULL_IMAGE:figures/full_fig_p020_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Comparative analysis of Random Matrix Transformation (RMT) block size [PITH_FULL_IMAGE:figures/full_fig_p022_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Downstream task parameters under RMT: comparative impact of varying noise [PITH_FULL_IMAGE:figures/full_fig_p023_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: Resilience comparison of RMT image disguising against known-pair regression [PITH_FULL_IMAGE:figures/full_fig_p025_11.png] view at source ↗
Figure 12
Figure 12. Figure 12: Visual comparison of known-pair regression attack reconstruction fidelity at [PITH_FULL_IMAGE:figures/full_fig_p025_12.png] view at source ↗
Figure 13
Figure 13. Figure 13: Visual comparison of known-pair regression attack reconstruction fidelity at [PITH_FULL_IMAGE:figures/full_fig_p026_13.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

48 extracted references · 9 canonical work pages

  1. [1]

    Litjens, T

    G. Litjens, T. Kooi, B. E. Bejnordi, A. A. A. Setio, F. Ciompi, M. Ghafoorian, J. A. W. M. van der Laak, B. van Ginneken, C. I. Sánchez, A survey on deep learning in medical image analysis, Medical Image Analysis 42 (2017) 60–88.doi:10.1016/j.media.2017.07.005

    doi:10.1016/j.media.2017.07.005 2017

  2. [2]

    Hosny, C

    A. Hosny, C. t. Parmar, J. Quackenbush, L. H. Schwartz, H. J. W. L. Aerts, Artificial intelligence in radiology, Nature Reviews Cancer 18 (8) (2018) 500–510.doi:10.1038/s41568-018-0016-5. 30

    work page doi:10.1038/s41568-018-0016-5 2018

  3. [3]

    Miotto, F

    R. Miotto, F. Wang, S. Wang, X. Jiang, J. T. Dudley, Deep learning for healthcare: review, opportunities and challenges, Briefings in Bioinfor- matics 19 (6) (2018) 1236–1246.doi:10.1093/bib/bbx044

    doi:10.1093/bib/bbx044 2018

  4. [4]

    Esteva, A

    A. Esteva, A. Robicquet, B. Ramsundar, et al., A guide to deep learning in healthcare, Nature Medicine 25 (1) (2019) 24–29

    2019

  5. [5]

    L. Cai, J. Gao, D. Zhao, A review of the application of deep learning in medical image classification and segmentation, Annals of Translational Medicine 8 (11) (2020). URLhttps://atm.amegroups.org/article/view/36944

    2020

  6. [6]

    E. J. Topol, High-performance medicine: The convergence of human and artificial intelligence, Nature Medicine 25 (1) (2019) 44–56

    2019

  7. [7]

    C. J. Kelly, A. Karthikesalingam, M. Suleyman, G. Corrado, D. King, Key challenges for delivering clinical impact with artificial intelligence, Nature Biomedical Engineering 3 (1) (2019) 44–54

    2019

  8. [8]

    Wiens, S

    J. Wiens, S. Saria, M. Sendak, et al., Do no harm: a roadmap for responsible machine learning for health care, Nature Medicine 25 (9) (2019) 1337–1340

    2019

  9. [9]

    Voigt, A

    P. Voigt, A. v. d. Bussche, The EU General Data Protection Regulation (GDPR): A Practical Guide, 1st Edition, Springer Publishing Company, Incorporated, 2017

    2017

  10. [10]

    DHHS, Summary of the hipaa privacy rule, https://www.hhs.gov/hipaa/for-professionals/privacy/laws- regulations/ (last accessed, March 2025)

    2025

  11. [11]

    G. C. Kagadis, C. Kloukinas, K. Moore, J. Philbin, P. Papadimitroulas, C. Alexakos, P. G. Nagy, D. Visvikis, W. R. Hendee, Cloud computing in medical imaging, Medical Physics 40 (7) (2013) 070901.doi:10. 1118/1.4811272

    2013

  12. [12]

    M. A. Knolle, M. J. Menten, F. Jungmann, F. Meissen, B. Glocker, D. Rueckert, G. Kaissis, Disparate privacy risks from medical ai, Nature (2026).doi:10.1038/s41586-026-10688-0. URLhttps://doi.org/10.1038/s41586-026-10688-0 31

    work page doi:10.1038/s41586-026-10688-0 2026

  13. [13]

    Kaissis, M

    G. Kaissis, M. R. Makowski, D. Rückert, R. F. Braren, Secure, privacy- preserving and federated machine learning in medical imaging, Nature Machine Intelligence 2 (6) (2020) 305–311

    2020

  14. [14]

    National Institute of Standards and Technology, Privacy-enhancing cryptography, nIST Privacy Engineering Program (2023)

    2023

  15. [15]

    rep., European Union Agency for Cybersecurity (ENISA) (2022)

    Privacy enhancing technologies: Evolution and state of the art, Tech. rep., European Union Agency for Cybersecurity (ENISA) (2022)

    2022

  16. [16]

    Chillotti, N

    I. Chillotti, N. Gama, M. Georgieva, M. Izabachène, TFHE: fast fully homomorphic encryption over the torus, J. Cryptology 33 (1) (2020) 34–91.doi:10.1007/s00145-019-09319-x. URLhttps://doi.org/10.1007/s00145-019-09319-x

    doi:10.1007/s00145-019-09319-x 2020

  17. [17]

    Mugunthan, A

    V. Mugunthan, A. Polychroniadou, Smpai: Secure multi-party compu- tation for federated learning, in: NeurIPS, 2019

    2019

  18. [18]

    B. C. M. Fung, K. Wang, R. Chen, P. S. Yu, Privacy-preserving data publishing: A survey of recent developments, ACM Computing Survey 42 (2010) 14:1–14:53

    2010

  19. [19]

    Eliazar, J

    A. Eliazar, J. T. Brown, S. Cinamon, M. Kantarcioglu, B. Malin, Re-identification risk for common privacy preserving patient matching strategies when shared with de-identified demographics., J Am Med In- form Assoc 33 (2) (2026) 336–346.doi:10.1093/jamia/ocaf183

    work page doi:10.1093/jamia/ocaf183 2026

  20. [20]

    Dwork, Differential privacy, in: International Colloquium on Au- tomata, Languages andProgramming, Springer, 2006, pp

    C. Dwork, Differential privacy, in: International Colloquium on Au- tomata, Languages andProgramming, Springer, 2006, pp. 1–12

    2006

  21. [21]

    J. He, Y. Gu, K. Chen, RecPS: Measuring privacy risk of participating in recommender systems modeling, in: ACM Conference on Recommender Systems (RecSys), 2025

    2025

  22. [22]

    Ficek, W

    J. Ficek, W. Wang, H. Chen, G. Dagne, E. Daley, Differential privacy in health research: A scoping review., J Am Med Inform Assoc 28 (10) (2021) 2269–2276.doi:10.1093/jamia/ocab135

    work page doi:10.1093/jamia/ocab135 2021

  23. [23]

    K. Chen, Y. Gu, S. Sharma, Disguisednets: Secure image outsourcing for confidential model training in clouds, ACM Trans. Internet Technol. 23 (3) (aug 2023).doi:10.1145/3609506. URLhttps://doi.org/10.1145/3609506 32

    work page doi:10.1145/3609506 2023

  24. [24]

    A. Yala, H. Esfahanizadeh, R. G. L. D’Oliveira, K. R. Duffy, M. Ghobadi, T. S. Jaakkola, V. Vaikuntanathan, R. Barzilay, M. Mé- dard, Neuracrypt: Hiding private health data via random neural net- works for public training, CoRR abs/2106.02484 (2021).arXiv:2106. 02484. URLhttps://arxiv.org/abs/2106.02484

    Pith/arXiv arXiv 2021

  25. [25]

    Dosovitskiy, L

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, N. Houlsby, An image is worth 16x16 words: Transformers for image recognition at scale, in: International Conference on Learning Representations, 2021

    2021

  26. [26]

    M. H. Hesamian, W. Jia, X. He, P. Kennedy, Deep learning techniques for medical image segmentation: achievements and challenges, Journal of Digital Imaging 32 (4) (2019) 582–596

    2019

  27. [27]

    Minaee, Y

    S. Minaee, Y. Boykov, F. Porikli, A. Plaza, N. Kehtarnavaz, D. Ter- zopoulos, Image segmentation using deep learning: a survey, IEEE TPAMI 44 (7) (2022) 3523–3542

    2022

  28. [28]

    Gilad-Bachrach, N

    R. Gilad-Bachrach, N. Dowlin, K. Laine, K. Lauter, M. Naehrig, J. Wernsing, Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy, in: M. F. Balcan, K. Q. Weinberger (Eds.), Proceedings of The 33rd International Conference on Machine Learning, Vol. 48 of Proceedings of Machine Learning Research, 2016, pp. 201–210

    2016

  29. [29]

    Mohassel, Y

    P. Mohassel, Y. Zhang, SecureML: A system for scalable privacy- preserving machine learning, in: 2017 IEEE Symposium on Security and Privacy (SP), 2017, pp. 19–38

    2017

  30. [30]

    Abadi, A

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Tal- war, L.Zhang, Deeplearningwithdifferentialprivacy, in: Proceedingsof the 2016 ACM SIGSAC Conference on Computer and Communications Security, 2016

    2016

  31. [31]

    T. Wang, X. Zhang, J. Feng, X. Yang, A comprehensive survey on local differential privacy toward data statistics and analysis, Sensors 20 (24) 33 (2020) 7030.doi:10.3390/s20247030. URLhttps://doi.org/10.3390/s20247030

    work page doi:10.3390/s20247030 2020

  32. [32]

    Q. Yang, Y. Liu, T. Chen, Y. Tong, Federated machine learning: Con- cept and applications, ACM Transactions on Intelligent Systems and Technology 10 (2) (2019)

    2019

  33. [33]

    M. J. Sheller, G. A. Reina, B. Edwards, J. Martin, S. Bakas, Feder- ated learning in medicine: Facilitating multi-institutional collaborations without sharing patient data, Scientific Reports 10 (1) (2020) 12598

    2020

  34. [34]

    Ryan, et al., Federated learning for medical artificial intelligence: A systematic review and future directions, Artificial Intelligence in Medicine (2024)

    P. Ryan, et al., Federated learning for medical artificial intelligence: A systematic review and future directions, Artificial Intelligence in Medicine (2024)

    2024

  35. [35]

    L. Zhu, Z. Liu, S. Han, Deep leakage from gradients, in: Advances in Neural Information Processing Systems, Vol. 32, Curran Associates, Inc., 2019. URLhttps://proceedings.neurips.cc/paper_files/paper/2019/ file/60a6c4002cc7b29142def8871531281a-Paper.pdf

    2019

  36. [36]

    Geiping, H

    J. Geiping, H. Bauermeister, H. Dröge, M. Moeller, Inverting gradients – how easy is it to break privacy in federated learning?, in: Advances in Neural Information Processing Systems, 2020

    2020

  37. [37]

    H. Hu, Z. Salcic, L. Sun, G. Dobbie, P. S. Yu, X. Zhang, Membership inference attacks on machine learning: A survey, ACM Comput. Surv. 54 (11s) (Sep. 2022). URLhttps://doi.org/10.1145/3523273

    doi:10.1145/3523273 2022

  38. [38]

    N. Haim, G. Vardi, G. Yehudai, O. Shamir, M. Irani, Reconstructing training data from trained neural networks, in: S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, A. Oh (Eds.), Advances in Neural Information Processing Systems, Vol. 35, Curran Associates, Inc., 2022, pp. 22911–22924. URLhttps://proceedings.neurips.cc/paper_files/paper/2022/ file/9...

    arXiv 2022

  39. [39]

    Patricio, J

    C. Patricio, J. C. Neves, L. F. Teixeira, Explainable deep learning meth- ods in medical image classification: A survey, ACM Comput. Surv. 34 56 (4) (Oct. 2023).doi:10.1145/3625287. URLhttps://doi.org/10.1145/3625287

    work page doi:10.1145/3625287 2023

  40. [40]

    Selvakumar, B

    S. Selvakumar, B. Senthilkumar, A privacy preserving machine learning framework for medical image analysis using quantized fully connected neural networks with tfhe based inference, Scientific Reports 15 (1) (2025) 27880.doi:10.1038/s41598-025-07622-1. URLhttps://doi.org/10.1038/s41598-025-07622-1

    work page doi:10.1038/s41598-025-07622-1 2025

  41. [41]

    K. KC, K. Devkota, K. S. Karki, A. Acharya, Privacy preserving medical image classification and steganography using deep learning architecture: a pipeline, in: 2025 IEEE Conference on Artificial Intelligence (CAI), 2025, pp. 1–5.doi:10.1109/CAI64502.2025.00233

    doi:10.1109/cai64502.2025.00233 2025

  42. [42]

    Z. Wang, H. Chi, Y. Li, Y. Zhang, S. Jiang, X. Du, M. Guizani, Hybrid makes better: Privacy-preserving medical image classification based on federated learning, in: GLOBECOM 2024 - 2024 IEEE Global Communications Conference, 2024, pp. 2816–2821.doi:10. 1109/GLOBECOM52923.2024.10901764

    arXiv 2024

  43. [43]

    Y. Gao, Y. Jiang, Y. Peng, F. Yuan, X. Zhang, J. Wang, Medical image segmentation: A comprehensive review of deep learning-based methods., Tomography 11 (5) (Apr 2025).doi:10.3390/tomography11050052

    doi:10.3390/tomography11050052 2025

  44. [44]

    Skorupko, F

    G. Skorupko, F. Avgoustidis, C. Martin-Isla, L. Garrucho, D. A. Kessler, E. R. Pujadas, O. Diaz, M. Bobowicz, K. Gwozdziewicz, X. Bargallo, P. Jarusevicius, R. Osuala, K. Kushibar, K. Lekadir, Federated nnu-net for privacy-preserving medical image segmentation, Scientific Reports 15 (1) (2025) 38312.doi:10.1038/s41598-025-22239-0. URLhttps://doi.org/10.10...

    work page doi:10.1038/s41598-025-22239-0 2025

  45. [45]

    S. Bian, W. Jiang, T. Sato, Privacy-preserving medical image seg- mentation via hybrid trusted execution environment, in: 2021 58th ACM/IEEE Design Automation Conference (DAC), 2021, pp. 1347– 1350.doi:10.1109/DAC18074.2021.9586198

    doi:10.1109/dac18074.2021.9586198 2021

  46. [46]

    A. L. Simpson, M. Antonelli, S. Bakas, et al., A large annotated med- ical image dataset for the development and evaluation of segmentation algorithms, arXiv preprint arXiv:1902.09063 (2019). 35

    Pith/arXiv arXiv 1902

  47. [47]

    Carlini, S

    N. Carlini, S. Deng, S. Garg, S. Jha, S. Mahloujifar, M. Mahmoody, S. Song, A. Thakurta, F. Tramèr, Is private learning possible with in- stance encoding?, in: IEEE Symposium on Security and Privacy (S&P), 2021

    2021

  48. [48]

    F. j. Milletari, N. Navab, S.-A. Ahmadi, V-net: Fully convolutional neural networks for volumetric medical image segmentation, in: 2016 fourth international conference on 3D vision (3DV), IEEE, 2016, pp. 565–571. 36

    2016

This paper was first reviewed by grok-4.5 on July 13, 2026.