gms | German Medical Science

Data protection and patient privacy belong to the core objectives of modern data-driven medical applications. Especially, the Machine Learning (ML) approaches that rely heavily on large datasets pose a risk to these aims. In recent years, many threats to ML-based applications have been identified [1]. This work aims at summarising the possible attacks and presenting preliminary ideas of supplementary security mechanisms for the deployment of ML-based medical applications in the cloud.

In a previous publication, we have already discussed a privacy-preserving collaborative training mechanism [2]. For that reason, the present work focuses exclusively on the protection approaches for the inference phase. On the one hand, attacks can be classified as evasion or adversarial, impersonation and inversion [1]. On the other hand, they can be classified as white-box and black-box attacks [3].

In medical applications, adversarial attacks may target diagnostic or billing models to deliberately make them suggest wrong outputs. These results can be used by attackers to blackmail or defraud the associated medical institutions [4]. Impersonation attacks mostly affect identification systems like biometric patient classifiers. An example of the reconstruction of biometric patient profiles collected by wearable devices was described by Garcia-Ceja et al. [5]. Inversion attacks can be considered as a supergroup of the impersonation attacks. These attacks aim at extracting information about the training dataset that were not meant for publication [6].

White-box attacks have access to the learned parameters and topologies of the targeted ML models. However, black-box attackers can only use queries and corresponding outputs of the models. Even black-box attacks pose a significant risk to the training data privacy [5], [7]. Hence, it is important to ensure that deployed ML models are secured against these attacks.

Cloud-based computing frameworks such as GAIA-X partially enable the secure deployment of trained models [8]. GAIA-X offers a sovereign GDPR compliant cloud infrastructure. In contrast to self-hosted servers, cloud infrastructures provide several advantages such as improved access control, security monitoring etc. However, they alone cannot ensure data protection and privacy, as black-box attacks can overcome their security mechanisms. For that reason, Alves et al. proposed a countermeasure that modifies certain outputs of the ML models [7]. Based on this approach we identified further requirements for the implementation of an application-dependent gatekeeping mechanism which supplements the security mechanisms of cloud infrastructures. It must modify certain outputs of a model in addition to controlling incoming query streams to counter the often-underestimated risk of inversion attacks. For the analysis of the incoming data our approach presented in [9] is suitable.

This preliminary work summarises types of attacks on deployed ML models and some countermeasures. To ensure data protection and privacy in universally accessible ML solutions for medical applications, it is necessary to develop a gatekeeping mechanism, which builds upon the ideas described in [7], [9], on top of the available cloud computing infrastructure. Our future research focuses on the opportunities of GDPR compliant cloud solutions for securely deploying medical ML models after training instead of adhering to poorly scalable and less secure private servers.

The authors declare that they have no competing interests.

The authors declare that an ethics committee vote is not required.