CANAL: Channel-Aware Noise Allocation for Differentially Private Feature Distillation in Medical Image Segmentation

Armaghan Butt; Shuya Feng; Qing Tian

cs.CVSep 7, 2026

CANAL: Channel-Aware Noise Allocation for Differentially Private Feature Distillation in Medical Image Segmentation

Authors: Armaghan Butt, Shuya Feng, Qing Tian

Organizations: Department of Computer Science, University of Alabama at Birmingham Birmingham, AL, USA

Abstract

Medical image segmentation needs diverse training data, but hospitals hold complementary scans they cannot share for privacy and regulatory reasons. Knowledge distillation can bridge this gap by exporting learned feature representations instead of images, but those representations still encode patient-specific anatomy and remain vulnerable to membership-inference and feature-inversion attacks. Adding calibrated Gaussian noise restores a differential-privacy guarantee, yet three issues have been overlooked. First, prior DP feature-distillation pipelines re-sample noise at every student iteration, so each patient image is released many times and the privacy cost composes over those releases, growing by orders of magnitude. We present a sample-once-per-image release, realized by a single precomputation pass, under which each patient contributes one release. Second, uniform noise is wasteful because channels differ in task importance. Using task-gradient energy as the importance measure, we derive CANAL, a closed-form water-filling allocation that gives important channels proportionally less noise, and prove it strictly minimizes importance-weighted distortion at a fixed budget. Third, the clipping caps and importance scores that drive the allocation are themselves data-dependent, so releasing them in the clear silently breaks the guarantee. We give a DP-honest budget split that charges each to the privacy budget, so the reported epsilon is the true epsilon. Across three medical segmentation benchmarks spanning dermoscopy, colonoscopy, and ultrasound, CANAL retains more task-relevant signal than uniform noise at the same privacy budget.

Figures & tables

Figure 1: CANAL multi-hospital private feature distillation. Each hospital trains a teacher on its private scans. Shared non-private query images are passed once through each frozen teacher, and each teacher’s bottleneck is per-channel clipped and normalized. The per-channel average across the $K$ teachers is then perturbed once by CANAL’s channel-aware noise, with less important channels (by task-gradient energy) receiving more noise. The resulting noisy aggregate is the distillation target that the student, trained on the same query images, matches with a feature loss ( $L_{\mathrm{feat}}$ ) alongside its segmentation loss ( $L_{\mathrm{seg}}$ ). The dashed region marks the trusted aggregator, which forms the average and adds the noise before anything is released ( Sec. 3.6 ). Raw scans never leave a site, and each image’s features are released once under an $(\varepsilon,\delta)$ -DP guarantee.

Dataset	Method	$\varepsilon{=}1$	$\varepsilon{=}2$	$\varepsilon{=}4$	$\varepsilon{=}8$
Kvasir-SEG	uniform	69.40	73.08	74.20	73.71
Kvasir-SEG	CANAL	70.81	73.56	75.22	74.98
BUSI	uniform	59.77	63.00	65.55	66.20
BUSI	CANAL	61.42	64.27	66.59	67.01
ISIC 2018	uniform	82.75	83.75	84.58	83.94
ISIC 2018	CANAL	83.14	84.17	84.79	84.52

Table 1: CANAL vs. uniform across datasets and

\varepsilon

(

K{=}3

, Dice (%), both approaches share the same seed for each case, better method per dataset in bold ).

Panel of Figure 2 — Figure 2: Qualitative segmentation under DP feature release. Example validation cases (top to bottom: Kvasir-SEG, BUSI, ISIC 2018) at $\varepsilon{=}2$ , $K{=}3$ . Across all three modalities, CANAL (right column) recovers a substantially more accurate lesion/polyp boundary than uniform noise (third column) at the same privacy budget.

	MI-AUC ( $\to 0.5$ )		Inversion SSIM $\downarrow$
Mechanism	$\varepsilon{=}2$	$\varepsilon{=}8$	$\varepsilon{=}2$	$\varepsilon{=}8$
No noise ( $\varepsilon{=}\infty$ )	1.000	1.000	0.651	0.651
Uniform feature noise	0.500	0.494	0.039	0.030
CANAL (ours)	0.499	0.495	0.037	0.029

Table 2: Privacy-attack resistance of the released features. Membership-inference AUC (closer to

0.5

is more private) and feature-inversion SSIM (

\downarrow

). ISIC,

K{=}3

, top-

10\%

channels, over

5

seeds.

Differential Privacy

Differential privacy limits how much an algorithm’s outputs can reveal about any one person’s data, with formal guarantees.

See all 278 papers

Mar 1, 2026

Differential privacy representation geometry for medical image analysis

Differential privacy (DP)'s effect in medical imaging is typically evaluated only through end-to-end performance, leaving the mechanism of privacy-induced utility loss unclear. We introduce Differential Privacy Representation Geometry for Medical Imaging (DP-RGMI), a framework that interprets DP as a structured transformation of representation space and decomposes performance degradation into encoder geometry and task-head utilization. Geometry is quantified by representation displacement from initialization and spectral effective dimension, while utilization is measured as the gap between linear-probe and end-to-end utility. Across over 594,000 images from four chest X-ray datasets and multiple pretrained initializations, we show that DP is consistently associated with a utilization gap even when linear separability is largely preserved. At the same time, displacement and spectral dimension exhibit non-monotonic, initialization- and dataset-dependent reshaping, indicating that DP alters representation anisotropy rather than uniformly collapsing features. Correlation analysis reveals that the association between end-to-end performance and utilization is robust across datasets but can vary by initialization, while geometric quantities capture additional prior- and dataset-conditioned variation. These findings position DP-RGMI as a reproducible framework for diagnosing privacy-induced failure modes and informing privacy model selection.

Soroosh Tayebi Arasteh, Marziyeh Mohammadi, Sven Nebelung +1

Lab for AI in Medicine, RWTH Aachen University, Aachen, Germany · Department of Diagnostic and Interventional Radiology, University Hospital RWTH Aachen, Aachen, Germany · INDA Institute, RWTH Aachen University, Aachen, Germany

Neural Representation Geometry Healthcare Privacy-Preserving ML Differential Privacy Medical Image Representation Learning

Ask PDF

Jun 19, 2026

From Gradient Clipping to Structural Refinement: Improving DPSGD for Medical Image Segmentation

Medical image segmentation is widely used for disease detection but relies on sensitive data, raising privacy concerns as trained models can leak information. Differential privacy, typically implemented via Differential Private Stochastic Gradient Descent (DPSGD), provides a solution, though at the cost of reduced utility. Recent DPSGD variants, including Automatic clipping (Auto-S), Normalised SGD with perturbation (NSGD), and Per-sample adaptive clipping (PSAC), have shown promise in image classification, but their behavior in medical segmentation remains underexplored. We evaluate these methods across binary and multi-class tasks and analyze gradient alignment, showing that prior assumptions, particularly for PSAC, do not consistently hold. We further demonstrate that combining clipping strategies with morphological refinement improves segmentation quality under privacy constraints. Finally, we propose an adaptive DP-Morph variant that captures class-specific structures and enhances performance in multi-class settings.

Shiva Parsarad, Parth Shandilya, Isabel Wagner

University of Basel

Differentially Private Stochastic Gradient Descent Medical Image Segmentation Differential Privacy

Ask PDF

Jan 27, 2026

The pretraining domain outweighs the training objective in setting the privacy-utility trade-off of differentially private medical image analysis

Differential privacy limits how much each training image can influence a medical imaging model but lowers its diagnostic accuracy. Pretrained weights reduce this loss. It is unknown whether the pretraining objective or domain improves accuracy more. Here we train chest radiograph classifiers under differential privacy from five starting points on 591,884 radiographs from five datasets. We show that supervised pretraining on chest radiographs ranks first in 24 of 25 combinations of dataset and privacy setting. Measured by the area under the receiver operating characteristic curve, its lead over supervised pretraining on natural images is 2.6% without privacy and 15.3% at the strictest budget. From that starting point, changing the domain improves this area 2.2 to 3.7 times more than changing the objective. Private pretraining on chest radiographs lowers this area by about 5% under privacy but outperforms the three starting points without patient data at the strictest budget. Under privacy, supervised chest radiograph pretraining leads in the worst-performing demographic subgroup.

Soroosh Tayebi Arasteh, Mina Farajiamiri, Mahshad Lotfinia +7

Lab for AI in Medicine, RWTH Aachen University, Aachen, Germany · Department of Diagnostic and Interventional Radiology, University Hospital RWTH Aachen, Aachen, Germany · Department of Urology, Stanford University, Stanford, CA, USA +5

Privacy-Utility Tradeoff Medical Image Classification Differential Privacy Domain-Adaptive Pretraining

Ask PDF

Abstract

Differential Privacy

Explore similar work

Differential privacy representation geometry for medical image analysis

From Gradient Clipping to Structural Refinement: Improving DPSGD for Medical Image Segmentation

The pretraining domain outweighs the training objective in setting the privacy-utility trade-off of differentially private medical image analysis