4 ms·

The point is to prevent data leaking. Since medical data is quite sensitive, giving someone the data--even another researcher--requires a great deal of trust. H

The point is to prevent data leaking. Since medical data is quite sensitive, giving someone the data--even another researcher--requires a great deal of trust. Homomorphic encryption makes it easier. I have a friend who works with individual-level Census data that is similarly sensitive. Getting cleared to use the data required a lengthy training and vetting period, and when she wants to actually access it to do an analysis she has to go to a secure room at another university. She's not allowed to bring any of her own electronics in, only pen and paper. The analysis script and anything derived from the data (analysis script output) is cleared by a Census Bureau employee before it leaves the room, to make sure it's not leaking any personal information.

onychomys 5y ago
There are some really goofy laws about moving medical data around. My lab is involved in a couple of large projects that involve researchers at other hospitals, and we're not allowed by law to send the data from these grants directly to our partners. Instead, we push things up to a google bucket, and then the other hospitals pull down from that bucket. I have no idea why that's the way things are done, but it's true for more than one of our grants, so there's obviously some sort of systemic thing going on with it.
pintxo 5y ago
As far as my understanding goes, federation already solves the problem of data leaking, doesn't it? I mean, that's what you are describing, the data does not leave it's source, you (the algorithm) have to move to the data not the other way around. That's exactly as I understand federation: the (original) data never leaves the home organization. But because everyone uses the same data model + algorithms (and those are choosen to enable combination of the output from each federated processing site) the results can be combined into a single outcome. So, if data leaking is already solved for by keeping the data locally, why would I employ HE? Unless maybe the participants should not be able to look into the algorithms itself?
- CrazyStat 5y ago
  No, federation alone doesn't solve the problem. This is addressed in the third paragraph of the paper; the TLDR is that federated processing might still leak personal information: > The adoption of FA in the medical sector, despite its potential, has been slower than expected. This is in large part due to the unresolved privacy issues of FA, related to the sharing of model updates or partial data aggregates in cleartext. Indeed, despite patient-level data not being transferred between the institutions engaging in FA, it has been shown that the model updates (or partial aggregates) themselves can, under certain circumstances, leak sensitive personal information about the underlying individuals, thus leading to re-identification, membership inference, and feature reconstruction. Our work focuses on overcoming this key limitation of existing FA approaches.

onychomys 5y ago

There are some really goofy laws about moving medical data around. My lab is involved in a couple of large projects that involve researchers at other hospitals, and we're not allowed by law to send the data from these grants directly to our partners. Instead, we push things up to a google bucket, and then the other hospitals pull down from that bucket. I have no idea why that's the way things are done, but it's true for more than one of our grants, so there's obviously some sort of systemic thing going on with it.

pintxo 5y ago

As far as my understanding goes, federation already solves the problem of data leaking, doesn't it? I mean, that's what you are describing, the data does not leave it's source, you (the algorithm) have to move to the data not the other way around. That's exactly as I understand federation: the (original) data never leaves the home organization. But because everyone uses the same data model + algorithms (and those are choosen to enable combination of the output from each federated processing site) the results can be combined into a single outcome. So, if data leaking is already solved for by keeping the data locally, why would I employ HE? Unless maybe the participants should not be able to look into the algorithms itself?

CrazyStat 5y ago
No, federation alone doesn't solve the problem. This is addressed in the third paragraph of the paper; the TLDR is that federated processing might still leak personal information: > The adoption of FA in the medical sector, despite its potential, has been slower than expected. This is in large part due to the unresolved privacy issues of FA, related to the sharing of model updates or partial data aggregates in cleartext. Indeed, despite patient-level data not being transferred between the institutions engaging in FA, it has been shown that the model updates (or partial aggregates) themselves can, under certain circumstances, leak sensitive personal information about the underlying individuals, thus leading to re-identification, membership inference, and feature reconstruction. Our work focuses on overcoming this key limitation of existing FA approaches.