arXiv:2511.20983cs.CVcs.CR2025-11

用轻量同态加密保护医疗图像分类中的隐私,通信量减少30倍。

Privacy-Preserving Federated Vision Transformer Learning Leveraging Lightweight Homomorphic Encryption in Medical AI

  • 用ViT的CLS token替代梯度,加密后传输
  • 通信量仅326KB/轮,攻击者无法重构原始图像
  • 适合医疗多机构协作,兼顾隐私与模型精度

跨医疗机构的协同机器学习可提升诊断准确率,但如HIPAA等隐私法规禁止直接共享患者数据。尽管联邦学习(FL)无需交换原始数据,但传统方法中模型梯度仍易受重建攻击,暴露敏感医疗信息。本文提出一种结合视觉变换器(ViT)与同态加密(HE)的隐私保护联邦学习框架,用于安全的多机构组织学分类。该方法利用ViT的CLS token作为768维紧凑特征表示,采用CKKS同态加密在上传前对这些令牌进行加密。实验表明,加密CLS token相比梯度加密实现30倍通信量降低,同时保障强隐私性。在三客户端肺腺癌组织学分类设置下,原始梯度极易被模型反演攻击(PSNR: 52.26 dB, SSIM: 0.999, NMI: 0.741),近乎完美重建图像;而所提方案有效防止攻击,支持密文直接推理,每轮仅需传输326 KB加密数据。框架在明文域达96.12%全局分类准确率,在密文域达90.02%。

原文摘要 · Abstract (English)

Collaborative machine learning across healthcare institutions promises improved diagnostic accuracy by leveraging diverse datasets, yet privacy regulations such as HIPAA prohibit direct patient data sharing. While federated learning (FL) enables decentralized training without raw data exchange, recent studies show that model gradients in conventional FL remain vulnerable to reconstruction attacks, potentially exposing sensitive medical information. This paper presents a privacy-preserving federated learning framework combining Vision Transformers (ViT) with homomorphic encryption (HE) for secure multi-institutional histopathology classification. The approach leverages the ViT CLS token as a compact 768-dimensional feature representation for secure aggregation, encrypting these tokens using CKKS homomorphic encryption before transmission to the server. We demonstrate that encrypting CLS tokens achieves a 30-fold communication reduction compared to gradient encryption while maintaining strong privacy guarantees. Through evaluation on a three-client federated setup for lung cancer histopathology classification, we show that gradients are highly susceptible to model inversion attacks (PSNR: 52.26 dB, SSIM: 0.999, NMI: 0.741), enabling near-perfect image reconstruction. In contrast, the proposed CLS-protected HE approach prevents such attacks while enabling encrypted inference directly on ciphertexts, requiring only 326 KB of encrypted data transmission per aggregation round. The framework achieves 96.12 percent global classification accuracy in the unencrypted domain and 90.02 percent in the encrypted domain.

联邦学习医疗AI同态加密隐私保护

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。