发表机构
University of Alabama at Birmingham（阿拉巴马大学伯明翰分校）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
针对医学图像分割中差分隐私特征蒸馏的噪声分配问题，提出基于任务梯度能量的闭式注水分配方法CANAL，实现每图像单次发布与诚实预算分割，在三个基准上优于均匀噪声。
AI 中文摘要
医学图像分割需要多样化的训练数据，但医院持有互补的扫描数据，由于隐私和监管原因无法共享。知识蒸馏可以通过导出学习到的特征表示而非图像来弥合这一差距，但这些表示仍然编码了患者特定的解剖结构，并且容易受到成员推断和特征反演攻击。添加校准的高斯噪声可以恢复差分隐私保证，但三个问题被忽视了。首先，先前的DP特征蒸馏流程在每个学生迭代时重新采样噪声，因此每个患者图像被多次发布，隐私成本在这些发布上组合，增长数量级。我们提出了一种每图像仅采样一次的发布方式，通过单次预计算过程实现，在此方式下每个患者贡献一次发布。其次，均匀噪声是浪费的，因为信道在任务重要性上有所不同。使用任务梯度能量作为重要性度量，我们推导出CANAL，一种闭式注水分配，给予重要信道成比例更少的噪声，并证明它在固定预算下严格最小化重要性加权失真。第三，驱动分配的裁剪上限和重要性分数本身是数据依赖的，因此以明文形式发布它们会悄然破坏保证。我们给出了一种DP诚实的预算分割，将每个部分计入隐私预算，因此报告的ε是真实的ε。在涵盖皮肤镜、结肠镜和超声的三个医学分割基准上，CANAL在相同隐私预算下比均匀噪声保留了更多任务相关信号。
英文摘要
Medical image segmentation needs diverse training data, but hospitals hold complementary scans they cannot share for privacy and regulatory reasons. Knowledge distillation can bridge this gap by exporting learned feature representations instead of images, but those representations still encode patient-specific anatomy and remain vulnerable to membership-inference and feature-inversion attacks. Adding calibrated Gaussian noise restores a differential-privacy guarantee, yet three issues have been overlooked. First, prior DP feature-distillation pipelines re-sample noise at every student iteration, so each patient image is released many times and the privacy cost composes over those releases, growing by orders of magnitude. We present a sample-once-per-image release, realized by a single precomputation pass, under which each patient contributes one release. Second, uniform noise is wasteful because channels differ in task importance. Using task-gradient energy as the importance measure, we derive CANAL, a closed-form water-filling allocation that gives important channels proportionally less noise, and prove it strictly minimizes importance-weighted distortion at a fixed budget. Third, the clipping caps and importance scores that drive the allocation are themselves data-dependent, so releasing them in the clear silently breaks the guarantee. We give a DP-honest budget split that charges each to the privacy budget, so the reported epsilon is the true epsilon. Across three medical segmentation benchmarks spanning dermoscopy, colonoscopy, and ultrasound, CANAL retains more task-relevant signal than uniform noise at the same privacy budget.
