Reconciling AI Performance and Data Reconstruction Resilience for
  Medical Imaging
Alexander Ziller Tamara T. Mueller Simon Stieger Leonhard Feiner Johannes Brandt Rickmer Braren Daniel Rueckert Georgios Kaissis
Artificial Intelligence (AI) models are vulnerable to information leakage of
their training data, which can be highly sensitive, for example in medical
imaging. Privacy Enhancing Technologies (PETs), such as Differential Privacy
(DP), aim to circumvent these susceptibilities. DP is the strongest possible
protection for training models while bounding the risks of inferring the
inclusion of training samples or reconstructing the original data. DP achieves
this by setting a quantifiable privacy budget. Although a lower budget
decreases the risk of information leakage, it typically also reduces the
performance of such models. This imposes a trade-off between robust performance
and stringent privacy. Additionally, the interpretation of a privacy budget
remains abstract and challenging to contextualize. In this study, we contrast
the performance of AI models at various privacy budgets against both,
theoretical risk bounds and empirical success of reconstruction attacks. We
show that using very large privacy budgets can render reconstruction attacks
impossible, while drops in performance are negligible. We thus conclude that
not using DP -- at all -- is negligent when applying AI models to sensitive
data. We deem those results to lie a foundation for further debates on striking
a balance between privacy risks and model performance.