Privacy-Preserving Personalized Federated Learning (PPP-FL) for Medical Imaging

Md Morshedul Islam; Hossain Shahriar; Alfredo Cuzzocrea

cs.CROct 20, 2026

Privacy-Preserving Personalized Federated Learning (PPP-FL) for Medical Imaging

Authors: Md Morshedul Islam, Hossain Shahriar, Alfredo Cuzzocrea

Abstract

Federated learning (FL) is a distributed machine learning paradigm that reduces transmission costs, mitigates cross-border data sharing restrictions, and enhances privacy by keeping raw data on local devices. Clients in FL systems train local models and share only updates, which are aggregated by a central server. While this setup limits direct data exposure, FL remains vulnerable to privacy attacks. Existing attack and defense strategies have largely been developed for centralized systems, and adapting them to FL introduces new challenges due to its unique architecture and training workflow. In this work, we first propose a model inversion attack on FL systems using Deep Convolutional Generative Adversarial Networks (DCGANs) in the context of large-scale medical imaging. Our method operates under realistic assumptions about the attacker's knowledge and capabilities. We then examine the effect of client-side differential privacy (DP) in mitigating privacy leakage and incorporate personalized FL to improve model performance under DP settings. Experiments on the Brain MRI ND-5 dataset show that DCGAN-based attacks can reconstruct semantically meaningful synthetic images, revealing significant risks to the privacy of training data. Applying DP reduces attack success but introduces an accuracy trade-off, which is further overcome by personalized FL at each client side. We also evaluate how different aggregation algorithms affect both attack vulnerability and defense effectiveness, underscoring the critical role of aggregation strategies. The proposed attack-and-defense framework is model-agnostic and applicable to a wide range of FL-based systems.

Figures & tables

Work	Year	Methodology	Advantages	Limitations
Fredrikson et al. [ 13 ]	2015	Exploiting output confidence scores to reconstruct private attributes.	Demonstrated first attribute inference from model outputs.	Requires access to model confidence.
Hitaj et al. [ 10 ]	2017	GAN-based collaborative learning attack using shared gradients.	First GAN-based model inversion attack.	Not directly applicable to FL settings.
Zhu et al. [ 6 ]	2019	Minimizing gradient discrepancy between dummy and shared gradients.	Works under standard FL gradient-sharing.	Requires access to the raw gradients.
Wang et al. [ 23 ]	2019	GAN-based user-level privacy leakage using multi-task discriminator.	Reconstructs user-specific samples beyond class-level leakage.	Requires adversarial server with client-identity knowledge.
Zhao et al. [ 24 ]	2020	Infers true labels from gradients before image reconstruction.	Removes label ambiguity and converges faster.	Limited to single-image recovery.
Geiping et al. [ 25 ]	2020	Gradient inversion using cosine similarity and total-variation regularization.	Produces high-fidelity images on large datasets.	Depends on the precise gradients.

TABLE I : Summary of representative model inversion attacks.

Fig. 1 : The left panel illustrates how a global model is collaboratively trained across distributed clients without sharing raw data. The right panel shows the DCGAN-based attack, where the generator reconstructs class-specific samples by optimizing latent vectors using feedback obtained from the client-deployed trained global model through loss-based black-box queries.

\mathcal{L}_{\text{reg}}=\lambda\|\boldsymbol{w}_{k}-\boldsymbol{w}_{g}\|^{2}

Algorithm 3 Personalized FL with Regularization

Layer (type)	Output Shape	Param #
Conv2D (Conv1)	(32, H, W)	320
MaxPooling2D (Pool1)	(32, H/2, W/2)	0
Conv2D (Conv2)	(64, H/2, W/2)	18,496
MaxPooling2D (Pool2)	(64, H/4, W/4)	0
Conv2D (Conv3)	(64, H/4, W/4)	36,928
MaxPooling2D (Pool3)	(64, H/8, W/8)	0

TABLE II : The global model in the PPP-FL setup is a CNN with convolutional and fully connected layers.

Panel of Figure 5 — Fig. 2 : Global model accuracy across all four aggregation algorithms of PPP-FL. Non-DP models exceed 90.0% accuracy after 500 epochs, while client-side DP-enabled models converge more slowly and fluctuate, reaching around 70.0% accuracy.

Layer (type)	Output Shape	Activation / Norm
Input (latent vector $z$ )	(1024, 4, 4)	ReLU + InstanceNorm
ConvTranspose2D (4×4, stride=2, pad=1)	(512, 8, 8)	ReLU + InstanceNorm
ConvTranspose2D (4×4, stride=2, pad=1)	(256, 16, 16)	ReLU + InstanceNorm
ConvTranspose2D (4×4, stride=2, pad=1)	(128, 32, 32)	ReLU + InstanceNorm
ConvTranspose2D (4×4, stride=2, pad=1)	(1, 64, 64)	Tanh

TABLE III : DCGAN generator architecture detailing the sequence of layers, their output shapes, and applied functions.

Layer (type)	Output Shape	Activation / Norm
Input Image
$(1,64,64)$	(64, 32, 32)	LeakyReLU (0.2)
Conv2D
(4×4, stride=2)	(128, 16, 16)	LeakyReLU + BatchNorm
Conv2D
(4×4, stride=2)	(256, 8, 8)	LeakyReLU + BatchNorm

TABLE IV : DCGAN discriminator architecture detailing the sequence of layers, output shapes, and applied functions.

Panel of Figure 8 — Fig. 3 : Comparison of grayscale brain MRI images and synthetic images generated by the trained DCGAN generator using auxiliary data.

Panel of Figure 9 — Fig. 4 : The smoothed line represents the mean latent vector loss over epochs, with the shaded region indicating $\pm 0.5$ standard deviation. Under client-side DP, the loss remains consistently higher than the non-DP setting, thereby limiting the DCGAN’s ability to effectively reconstruct class specific images.

Fig. 5 : Comparison of real and DCGAN-generated images. In the non-DP setting, clean feedback enables the generation of accurate class-specific samples. In contrast, client-side DP noise distorts the feedback signal, leading to noticeable degradation in fine-grained tumor features.

Fig. 6 : Boxplot of cosine similarity scores between DCGAN-generated and real MRI images without client-deployed global model feedback, showing limited class-specific alignment.

Panel of Figure 12 — Fig. 7 : Cosine similarity scores using client-deployed global model feedback for (a) non-DP and (b) client-side DP settings. All aggregation algorithms are vulnerable to model inversion attacks in the absence of client-side DP. The use of DP reduces the effectiveness of model inversion attacks.

Panel of Figure 13 — Fig. 8 : Personalization applied to the pre-trained client-deployed global models trained with (a) FedAvg under client-side DP and (b) FedOpt under client-side DP. In both cases, personalization leads to significant improvements in client-level accuracy.

Federated Learning

Federated learning trains shared models across data holders without requiring them to pool their raw data.

See all 951 papers

Aegis: Generative Gradient Masking for Privacy-Preserving Medical Federated Learning
Sep 29, 2026Chaoyu Zhang, Shanghao Shi, Heng Jin +3Privacy-Preserving Federated Learning Model Inversion Attacks
Virginia Tech · Washington University in St. Louis · University of South Florida
Similarity Weighted Aggregation with Global Differential Privacy for Federated Brain Lesion Segmentation
Aug 1, 2026Muhammad Irfan Khan, Eero Lehtonen, Joni Obradovic +4Federated Learning Aggregation Non-IID Federated Learning
Turku University of Applied Sciences, Turku 20520, Finland
Towards Robust Personalized Federated Learning: Vulnerability Assessment and Defense Co-Design
Jun 22, 2026Mingyuan Fan, Cen ChenAdversarial Robustness Transfer-Based Adversarial Attacks
East China Normal University Shanghai, China

Sep 29, 2026J/K move · Enter open · S save

Aegis: Generative Gradient Masking for Privacy-Preserving Medical Federated Learning

Chaoyu Zhang, Shanghao Shi, Heng Jin, Ning Wang+2

Virginia Tech · Washington University in St. Louis · University of South Florida

Privacy-Preserving Federated Learning Model Inversion Attacks Federated Learning

Open paper AskPDF arXiv

Federated learning (FL) has become a foundational paradigm for multi-institutional medical AI, allowing hospitals and research centers to jointly train diagnostic models without exchanging patient records. This privacy promise, however, is increasingly contested: a malicious or honest-but-curious server can launch model inversion attacks (MIAs) that reconstruct private patient images directly from shared model updates, and recent scalable, closed-form attacks penetrate even secure aggregation at clinically realistic batch sizes. Existing defenses face an unsatisfactory dilemma. Gradient-perturbation methods such as differential privacy and pruning trade away the diagnostic accuracy on which clinical reliability depends, while cryptographic protocols add system complexity yet still leave updates exposed to these scalable attacks. We propose Aegis, a principled client-side defense that breaks this dilemma without perturbing patient data or modifying the FL protocol. Our key insight is that the success of every known MIA is fundamentally bounded by the local batch size relative to the model's leakage capacity; once this limit is exceeded, distinct samples collide and reconstructions collapse into indistinguishable mixtures. Aegis turns this universal bottleneck into a defense: each client superimposes onto its real update a masking gradient computed on locally synthesized, task-relevant data, deliberately pushing the effective batch beyond the attack's recovery capacity. We complement the design with theoretical convergence guarantees under standard convex assumptions and evaluate Aegis on MNIST, CIFAR-10, and three MedMNIST modalities (chest X-ray, abdominal CT, colon pathology). Aegis neutralizes three state-of-the-art MIAs while preserving model utility and incurring only modest overhead, offering a practical privacy primitive for medical FL.

Abstract

Federated Learning

Explore similar work

Aegis: Generative Gradient Masking for Privacy-Preserving Medical Federated Learning

Similarity Weighted Aggregation with Global Differential Privacy for Federated Brain Lesion Segmentation

Towards Robust Personalized Federated Learning: Vulnerability Assessment and Defense Co-Design