利用轻量级同态加密实现隐私保护的联邦视觉变换器学习用于医疗AI
Privacy-Preserving Federated Vision Transformer Learning Leveraging Lightweight Homomorphic Encryption in Medical AI
AI总结：
本文提出一种结合视觉变换器与轻量级同态加密的隐私保护联邦学习框架，通过加密CLS标记实现医疗AI中的安全多机构病理学分类，显著降低通信开销并增强隐私保护。
摘要：
跨医疗机构的协同机器学习有望通过利用多样化数据集提高诊断准确性，但HIPAA等隐私法规禁止直接共享患者数据。虽然联邦学习（FL）允许在不交换原始数据的情况下进行去中心化训练，但最近的研究表明，传统FL中的模型梯度仍易受重建攻击，可能暴露敏感的医疗信息。本文提出了一种结合视觉变换器（ViT）和同态加密（HE）的隐私保护联邦学习框架，用于安全的多机构病理学分类。该方法利用ViT的CLS标记作为紧凑的768维特征表示进行安全聚合，在传输到服务器前使用CKKS同态加密加密这些标记。我们证明，加密CLS标记相比梯度加密实现了30倍的通信减少，同时保持强隐私保障。通过在三个客户端联邦设置上评估肺癌症病理学分类，我们发现梯度高度易受模型逆向攻击（PSNR：52.26 dB，SSIM：0.999，NMI：0.741），能够实现近乎完美的图像重建。相比之下，所提出的CLS保护HE方法防止了此类攻击，同时允许在密文上直接进行加密推理，仅需每个聚合轮次传输326 KB的加密数据。该框架在未加密领域实现了96.12%的全局分类准确率，在加密领域实现了90.02%的准确率。
英文摘要：
Collaborative machine learning across healthcare institutions promises improved diagnostic accuracy by leveraging diverse datasets, yet privacy regulations such as HIPAA prohibit direct patient data sharing. While federated learning (FL) enables decentralized training without raw data exchange, recent studies show that model gradients in conventional FL remain vulnerable to reconstruction attacks, potentially exposing sensitive medical information. This paper presents a privacy-preserving federated learning framework combining Vision Transformers (ViT) with homomorphic encryption (HE) for secure multi-institutional histopathology classification. The approach leverages the ViT CLS token as a compact 768-dimensional feature representation for secure aggregation, encrypting these tokens using CKKS homomorphic encryption before transmission to the server. We demonstrate that encrypting CLS tokens achieves a 30-fold communication reduction compared to gradient encryption while maintaining strong privacy guarantees. Through evaluation on a three-client federated setup for lung cancer histopathology classification, we show that gradients are highly susceptible to model inversion attacks (PSNR: 52.26 dB, SSIM: 0.999, NMI: 0.741), enabling near-perfect image reconstruction. In contrast, the proposed CLS-protected HE approach prevents such attacks while enabling encrypted inference directly on ciphertexts, requiring only 326 KB of encrypted data transmission per aggregation round. The framework achieves 96.12 percent global classification accuracy in the unencrypted domain and 90.02 percent in the encrypted domain.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
