Federated learning for preserving data privacy in collaborative healthcare research

Dataset preparation

Individual healthcare centers, even those within the same healthcare network using the same electronic medical record system, have varying schemas of storing data that were created to support the various clinical workflows specific to each site. Therefore, mapping data to a common data model (CDM) is a prerequisite for any inter-institutional project. CDMs define guidelines for consistent organization of data through standardized vocabularies, naming, and indexing methods. To maximize reproducibility and interoperability, we suggest the mapping be done to a well-established and widely adopted CDM such as The National Patient-Centered Clinical Research Network (PCORnet) or the Observational Medical Outcomes Partnership (OMOP) instead of a proprietary, project-specific format. Under these circumstances, federated learning datasets can contain nearly any multi-modal data type that can be parsed by deep learning models. For projects with few variables and little ambiguity regarding variable semantics, a project specific CDM shared among participating institutions may allow for more rapid development, which is why it was selected for COVID-19 chest radiograph project that used nine unambiguous variables, but this comes at the cost of slowing its adoption to other centers due to the need to create project specific datasets.

In order to develop and/or execute a model, various preprocessing steps are needed to organize the necessary data elements (e.g. variable selection, resampling), convert them to the required types (e.g. concept extraction, one-hot encoding, tokenization), and perform any required standardization steps (e.g. outlier removal, normalization, imputation). Variable selection is a crucial step in any project but is paramount in any multicenter project to ensure that each variable is available, consistently populated, and easily accessible across all institutions. For the COVID-19 chest radiograph project, we used age, sex, race, ethnicity, COVID-19 status (positive/negative), intensive care unit admission (yes/no), requirement for mechanical ventilation (yes/no), hospital mortality (yes/no), and admission chest radiograph images. In addition to simplicity, these variables have the added advantages that they contain none of the 18 HIPPA identifiers that permitted the sharing of the data for performance comparisons between centralized and distributed learning methods, without a data use agreement, and facilitated expedited IRB approval (within 8 days of submission). By starting with a CDM, these preprocessing steps were readily shared between sites to further ensure reproducibility.

Model development

The selection of model type in federated learning is primarily dependent on the prediction/classification task, however; gradient based learning models, such as neural networks are commonly used due to the ability to easily aggregate gradients between individual centers. In the COVID-19 chest radiograph project, we used a DenseNet (convolutional neural network) model pretrained on ImageNet with rectified linear activation functions, a range of layers in each pooling block (6, 12, 24, and 16), and a growth rate of 32 (adding 32 filters for each layer), which was later tuned for COVID-19 detection using federated learning.

Once a model type is determined, then the federated learning algorithm can be selected. This is the algorithm responsible for coordinating the training process through aggregating knowledge from each site (often in the form of coefficients/gradients) and distributing model updates. Independent and identically distributed (iid) datasets can utilize a popular algorithm FedAvg that is fast and efficient, but often performs poorly when center-to-center data is heterogenous.^4–6 To address this issue, several other personalized federated learning algorithms (e.g. FedAMP, FedBN, FedProx) were created to address the data heterogeneity issue, by tailoring updates by weighting contributions from more similar models/datasets to the target model more than dissimilar ones.

In the COVID-19 chest radiograph project, in the first experiments, local model training and testing was performed at one site—the largest site, which included 45,513 patients, 3997 of whom were COVID positive. The local model had an internal AUROC of 0.94 and AUPRC of 0.85, but during testing on two separate external validation datasets, AUROC fell to 0.56 and 0.67, and AUPRC fell to 0.57 and 0.60. Next, the single-institution model was compared with federated learning models. We found the FedAvg to perform well when testing on data from centers that contributed the greatest proportions of the training data, and FedBN (in which all weights are shared and aggregated except from batch normalization layers) outperformed FedAMP (in which each local model has a dedicated global model) and FedProx (which adds a proximal term to the objective of the local update) in addressing data heterogeneity on real-world imaging data. On two external validation datasets, FedAmp had AUROC 0.71 and 0.62, FedBN had AUROC 0.78 and 0.70, and FedProx had AUROC 0.78 and 0.67. In particular, FedBN maintained reasonably strong predictive performance when testing on data from centers with proportionately smaller training sample sizes, while other federated learning algorithms, especially FedAvg, performed poorly when testing on data from centers with small training samples. We performed experiments using each of these algorithms to better understand their effects on predictive performance.

Predictive performance improvement with federated learning

Artificial intelligence algorithms are data driven, learning from examples; thus, in many cases, providing more examples facilitates greater learning. One of the primary mechanisms by which having more examples improves learning is greater representation of rare cases. If a rare constellation of variables has a rare association with the outcome of interest and there are few examples of this phenomenon in the training data, then it is unlikely that the algorithm will learn to detect those constellations of variables and associate them with the outcome in the validation and test sets. With more total examples, the algorithm has additional opportunities to learn those rare associations and make accurate predictions when confronted with similar circumstances in the future.

Another one of the major explanations to the improvement of models in the context of federated learning is related to the growing complexity of AI models and under training. With greatly improved access to high performance computing platforms, it is now feasible to create models with millions or even billions of parameters that require a tremendous number of training samples in order to achieve their maximum potential.

One might reasonably hypothesize that a local model that trains and tests exclusively on local data would learn associations between inputs and outcomes with greater accuracy than a model that trains and tests on heterogeneous data from other centers that have different patients, different healthcare providers, and different healthcare delivery modes and protocols, but the opposite is often true. In some cases, federated learning models perform better on local datasets than similar models using local data exclusively. ³ Presumably, this is because federated models learn more accurate representations from a greater number of instances, especially rare instances that are underrepresented in small datasets. In an investigation using chest radiographs to diagnose COVID-19 on a federated learning platform, we found that the area under the receiver operating characteristic curve improved by 3% and area under the precision-recall curve improved by 8% compared with local model training. Such observations are likely attributable to the enhanced ability of federated learning models to learn from more examples, even if those examples are heterogeneous and different than those in local datasets. To solve the heterogeneity problem, we recommend using a CDM at each institution to map each contributing dataset to a well-established and widely adopted CDM such as The National Patient-Centered Clinical Research Network (PCORnet) or the Observational Medical Outcomes Partnership (OMOP).

Privacy leakage in federated learning

Although the sharing of knowledge in the form of model gradients or coefficients is far more secure than the sharing of the underlying data, there is a small, but limited risk posed by malicious actors performing what are known as privacy attacks. Privacy attacks can be categorized on a spectrum from “white box” (an adversary has full access to the model and/or dataset from which the training data was drawn) to “black box” (no knowledge of model (architecture nor parameters) or training data). Although most artificial intelligence models are vulnerable to such attacks, federated learning increases the opportunity for such attacks due to multiple centers having “white box” access to the model and the communication of gradients between local institutions and the coordinating center which could be intercepted.

Patient-level privacy leaks occur through membership inference attacks (i.e. adversaries infer whether a given patient or set of patients belong to the training data)^7,8 and reconstruction attacks (i.e. adversaries reconstruct input from model output).^9–11 Privacy attacks can be mitigated through introduction of stochastic noise (e.g. differential privacy), rounding, k-anonymity, and/or l-diversity, however; all of these strategies have some impact on utility.

Intentionally rounding or embedding noise into input data, the model itself, or model outputs are common methods of increasing privacy. ¹² Although models can internally account for the introduction of the noise, their performance will decrease in proportion to the amount of additional privacy protection provided by the modification. The binning of input data to achieve k-anonymity and/or l-diversity is another common method of protecting privacy such as grouping age into deciles (0–9 years, 10–19 years, 20–29 years) which can also be helpful in preserving privacy. Depending on the bin width and the relationship between the binned variables, there may be a lesser tradeoff between performance and privacy for this method compared to rounding or the addition of noise. Lastly, the encryption of updates between the local and central model is a method of reducing the vulnerability of such attacks without compromising performance.

It is important to remember that in order for these types of attacks to be successful they require a large amount of external information (e.g. information on specific patients to test against, access to the data source where the training data was procured from, knowledge of model architecture/parameters) and the ability to query the model thousands to millions of times. Lastly, the information that an adversary can possibly extract from such an attack is limited to whatever information was fed into the model, which is highly unlikely to contain hard identifiers such as birthdate, social security number, dates of service, medical record number, full name, etc., thus, even with a lot of external information about individuals, it can be nearly impossible to re-identify a particular patient or group of patients. To further minimize the threat of adversarial attacks, data privacy can be protected at the point of data collection via clustering-based anonymization. ¹³

Hardware and software considerations for computational and space complexity

One of the advantages of federated learning is distributing the training burden in terms of computing resources amongst all the participating sites. Recreating the same computing environment in different locations and/or operating systems can be difficult even with package managers such as anaconda, thus we recommend the use of virtualized container environments, such as docker, that allow identical software stacks to run on any computing platform that supports docker technology. Furthermore, if cloud computing resources are used, such as Google Cloud Platform (GCP), Amazon Web Services (AWS), or Microsoft Azure, we recommended selecting one cloud provider to simplify the process of getting each site up and running and communicating with the coordinating center. For the COVID-19 chest radiograph project we used AWS instances equipped with single or multiple V100 GPUs (the p3 instance family), containerized using Docker, with the NGC Clara Train v4.0 as the base image.