Direction
04
Privacy-Preserving Machine Learning
We develop machine learning methods that enable learning from sensitive clinical data while limiting what models, updates, and released data reveal about individual patients. Our work spans federated and encrypted learning, differential privacy, and anonymization, and studies their privacy-utility trade-offs across institutions, modalities, and patient populations.
Federated and collaborative learning
The training moves to the hospitals and the images stay where they were acquired. We measure what that costs against central training, and we extend it to institutions whose datasets are annotated for different findings.
Medical Image Analysis, 2024
Federated learning still sends weight updates to an aggregation server, and an untrusted server can attack those updates by model inversion or membership inference. Encrypting the weights and updating the model in the encrypted space removes that route. The encrypted federation exceeded locally trained models and matched the centrally trained models, so the cryptographic guarantee did not reduce accuracy.
INTERSPEECH 2023
Federated learning across 3 languages and 3 institutions exceeded every locally trained model without moving any data, and came close to centralized training.
Scientific Reports, 2023
Across 610,000 chest radiographs from 5 institutions, large local datasets gained little from federation and sometimes lost accuracy, while small ones improved markedly. On-domain performance followed the size of the training data and off-domain performance followed its diversity, and federated models trained across diverse external institutions beat locally trained ones off-domain everywhere. So the mechanism behind federation is data diversity and not data volume.
Scientific Reports, 2023
Public chest radiograph datasets are annotated for different findings, so conventional federated learning can use only the uniformly labeled images and discards the rest of the annotation. This paper extends the federated process to train one model across datasets whose label sets disagree. Across 695,000 chest radiographs from 5 institutions, each with its own label set, flexible federation outperformed conventional federated training.
Differential privacy
A formal privacy guarantee on a trained model costs accuracy, and the standing question is how much and for whom. We measure that cost on imaging and on speech, on external institutions as well as the training ones, and we check what it does to subgroup performance.
npj Digital Medicine, 2026
A scoping review of differential privacy in medical deep learning, covering 74 studies published through March 2025 in centralized and federated settings. It reports what privacy does to accuracy, how rarely fairness is evaluated, and how inconsistently privacy parameters are reported.
Radiology: Artificial Intelligence, 2024
The standing objection to differential privacy is that it costs too much accuracy, and that loss is measured on data from the training institutions. On radiographs from institutions that the model never saw, private domain transfer matched non-private domain transfer even at strong privacy, and subgroup AUC differences remained below 1 percentage point almost everywhere.
Communications Medicine, 2024
At clinically relevant scale, private training lowered accuracy without systematically widening the performance differences between age, sex, and comorbidity subgroups, though difficult diagnoses and subgroups took a stronger hit.
npj Artificial Intelligence, 2025
Private training reduced accuracy by at most 3.85% on pathological speech, even at high privacy levels. Without privacy, the same models revealed identifiable speech under gradient inversion, and differential privacy blocked the attack.
Anonymization
A speech recording contains the speaker's identity alongside the clinical signal, so releasing it means removing the first and keeping the second. We measure how identifiable pathological speech is to begin with, and what anonymization leaves of the diagnostic information.
Communications Medicine, 2024
Anonymization reduces speaker identifiability while leaving the clinical utility of the recording intact, and the effect differs by disorder. Dysarthria, dysphonia, cleft lip and palate, and dysglossia each behave differently under the same anonymization, so no single method fits every condition.
npj Digital Public Health, 2026
A speech recording contains identity, health status, demographic cues, linguistic content, and acoustic biomarkers together, so no single method protects it. Protecting it takes several layers together, meaning anonymization, differential privacy, decentralized learning, governance, and evaluation under deployment conditions.
Scientific Reports, 2023
Public pathological speech corpora carry a re-identification risk that nobody had measured. Automatic speaker verification over more than 3,800 test subjects reached a mean equal error rate of 0.89%, so pathological speech is at higher risk of a privacy breach than healthy speech. Adults with dysphonia were the most re-identifiable, dysarthria came out comparable to healthy speakers, and in children the recording environment decided re-identifiability.