Self-supervised low-rank decomposition medical image privacy protection method and system based on differential privacy

Abstract

The application provides a self-supervised low-rank decomposition medical image privacy protection method and system based on differential privacy. The method comprises: a pre-training stage, including: pre-training a feature extraction network based on a label-free public medical image dataset to obtain pre-training parameters; a fine-tuning stage, including: constructing an image classification network, including: low-ranking the feature extraction network to obtain a low-rank layer; freezing the pre-training parameters of the feature extraction network to obtain a frozen layer; connecting the low-rank layer and the frozen layer as two parallel feature extraction branches, connecting a classification layer after the feature extraction branches to obtain the image classification network; training the image classification network based on a labeled sensitive medical image dataset using a DP-SGD method; wherein, during the training process, the parameters of the frozen layer remain unchanged; a test stage, including: inputting a medical image to be analyzed into the trained image classification network to obtain an image classification result.

Description

Technical Field

[0001] This invention relates to the field of image privacy protection technology, and in particular to a self-supervised low-rank decomposition method and system for medical image privacy protection based on differential privacy. Background Technology

[0002] Deep learning models developed for various medical tasks have achieved great success in clinical imaging diagnosis, drug discovery, and protein prediction. Medical data is sensitive information owned by individuals and should be protected. However, attackers can currently obtain sensitive training data from published deep learning models through methods such as member inference attacks and model inversion attacks. Therefore, it is crucial to develop high-performance medical models while maintaining patient privacy.

[0003] Differential privacy is the gold standard for protecting sensitive data in deep learning. By injecting noise into the model training process, it prevents adversaries from identifying sensitive data about specific patients. Currently, a common approach is to add noise to the gradient, thus protecting data privacy without manipulating the original data. However, simply applying differential privacy to medical classification tasks fails to achieve a satisfactory trade-off between privacy and practicality. This is because, firstly, professionally labeled medical training samples are extremely costly, often limited in number and class-imbalanced; secondly, a high-performing medical model often needs to balance usability and practicality, leading to complex model modules and structures. This necessitates adding significant amounts of differential privacy noise to protect patient data, but as the model size increases, the "curse of dimensionality" causes a rapid decline in performance with increasing noise levels.

[0004] In recent years, researchers have proposed several methods using low-rank decomposition to improve model performance. Ansuini et al. experimentally verified the existence of "intrinsic dimensionality" in overparameterized models, meaning that features extracted from the model are independent of model complexity or dataset size. Vogels et al. proposed Power SGD to compress gradients and reduce communication overhead in parallel training. Yu et al. used a reparameterization method to apply a low-rank approximation of the gradient carrier matrix using SVD decomposition to alleviate the large communication overhead problem of differential privacy models. To prevent privacy leakage, they also used low-rank historical gradient updates instead of the current gradient. Zheng et al. performed PCA dimensionality reduction on the gradients of the auxiliary dataset and injected differential privacy noise into both the dimensionality-reduced gradients of the pre-training dataset and the resulting gradients, thereby protecting the data.

[0005] However, while these low-rank methods reduce communication costs and do not introduce additional privacy risks, they often introduce a large number of extra processing steps during training, reducing the training speed of the model. Therefore, how to provide a deep learning method that offers better protection and faster training speed using sensitive medical images has become a pressing technical problem to be solved in this field. Summary of the Invention

[0006] To address the issues of insufficient and imbalanced labeled samples and slow training speed of existing low-rank differential privacy models, this invention provides a self-supervised low-rank decomposition method and system for protecting medical image privacy based on differential privacy.

[0007] On one hand, this invention provides a self-supervised low-rank decomposition method for medical image privacy protection based on differential privacy, comprising:

[0008] The pre-training phase includes:

[0009] Collect an unlabeled publicly available medical image dataset, and pre-train a feature extraction network based on the unlabeled publicly available medical image dataset to obtain pre-training parameters; the pre-training parameters include model parameters and medical image enhancement representations.

[0010] The fine-tuning phase includes:

[0011] The process of constructing an image classification network includes: reducing the rank of the feature extraction network to obtain a low-rank layer; freezing the pre-trained parameters of the feature extraction network to obtain a frozen layer; and using the low-rank layer and the frozen layer as two parallel feature extraction branches, connecting them to a classification layer to obtain the image classification network.

[0012] A labeled sensitive medical image dataset is collected, and the image classification network is trained using the DP-SGD method based on the labeled sensitive medical image dataset; wherein, during the training process, the parameters of the frozen layer are kept unchanged;

[0013] The testing phase includes:

[0014] The medical images to be analyzed are input into a trained image classification network to obtain the image classification results.

[0015] Furthermore, the pre-training phase specifically includes:

[0016] Data augmentation methods are used to process the collected unlabeled public medical image dataset to obtain augmented and negative samples to expand the unlabeled public medical image dataset;

[0017] Based on the expanded dataset, the feature extraction network was pre-trained using the MoCo self-supervised method.

[0018] Furthermore, the feature extraction network is downranked to obtain a low-rank layer, specifically including:

[0019] For all convolutional layers C in the feature extraction network m×n×k×k Using convolutional layers L m×r×k×k and convolutional layer R r×n×k×k Replacement is performed; where the convolutional layers C, L, and R have the same structure, m and n are the input and output dimensions of the convolutional layer, respectively, and k is the kernel size.

[0020] Furthermore, in the fine-tuning stage, training the image classification network using the DP-SGD method specifically includes:

[0021] For each labeled sensitive medical image sample, after forward propagation through a low-rank layer, the gradient of each sample is calculated, the gradient of each sample is then clipped, and finally the gradients of all samples are summed to obtain the total gradient.

[0022] Based on the total gradient, aggregate the gradients of all samples in each batch, and add differential privacy noise to the aggregated gradient to obtain a new gradient to protect the samples.

[0023] Furthermore, in the fine-tuning stage, the cross-entropy loss function is used as the loss function;

[0024] Correspondingly, during the t-th iteration of training, the total gradient g is calculated using formula (1). t :

[0025]

[0026] Where L is the cross-entropy loss function, θ t For model parameters, x i ,y i These represent the sample and its corresponding label, respectively. clip represents the clipping function, and N represents the total number of samples in the labeled sensitive medical image dataset.

[0027] The new gradient is calculated using formula (2).

[0028]

[0029] Where n is the number of samples in each batch. Let σ be the Gaussian noise, C be the clipping norm, and σ be the amplitude of the Gaussian noise.

[0030] Furthermore, the ResNet18 network was used as the feature extraction network.

[0031] On the other hand, the present invention provides a self-supervised low-rank decomposition medical image privacy protection system based on differential privacy, comprising:

[0032] The pre-training module is used to pre-train the feature extraction network based on the collected unlabeled public medical image dataset to obtain pre-training parameters; the pre-training parameters include model parameters and medical image enhancement representations.

[0033] A fine-tuning module is used to reduce the rank of the feature extraction network to obtain a low-rank layer; freeze the pre-training parameters of the feature extraction network to obtain a frozen layer; use the low-rank layer and the frozen layer as two parallel feature extraction branches, and connect them to a classification layer to obtain an image classification network; and train the image classification network using the DP-SGD method based on the collected labeled sensitive medical image dataset; wherein, during the training process, the parameters of the frozen layer remain unchanged.

[0034] The classification module is used to input the medical images to be analyzed into a trained image classification network to obtain the image classification results.

[0035] The beneficial effects of this invention are:

[0036] The medical image privacy protection method of the present invention employs self-supervised learning to divide the entire training process of the image classification model into a pre-training stage and a fine-tuning stage, thereby enabling the model to train faster and alleviating its dependence on labeled sensitive medical image data samples to a certain extent. At the same time, by combining the low-rank decomposition method and the differential privacy method in the fine-tuning stage, the privacy of sensitive medical data is protected, the curse of dimensionality problem is solved, and the impact of differential privacy noise on model performance is reduced.

[0037] Experimental results on three public datasets demonstrate that this invention achieves better performance with the same level of privacy protection. Furthermore, compared to other DP fine-tuning methods, the performance gap between the model in this invention and non-DP models is smaller. Compared to other low-rank DP methods, the model in this invention exhibits better performance and faster training speed, enabling the application of differential privacy theory to larger-scale models and more diverse medical scenarios. Attached Figure Description

[0038] Figure 1 This is one of the flowcharts illustrating a self-supervised low-rank decomposition method for protecting medical image privacy based on differential privacy, provided in an embodiment of the present invention.

[0039] Figure 2 This is a second schematic flowchart of a self-supervised low-rank decomposition medical image privacy protection method based on differential privacy, provided as an embodiment of the present invention.

[0040] Figure 3 This is a schematic diagram of a downstream differential privacy low-rank decomposition model provided in an embodiment of the present invention;

[0041] Figure 4 A schematic diagram of the structure of a self-supervised low-rank decomposition medical image privacy protection system based on differential privacy provided in an embodiment of the present invention;

[0042] Figure 5 Performance diagrams of the model on various datasets under a given privacy budget, provided for embodiments of the present invention: (a) RSNA; (b) Covid-QU-mini; (c) Chest X-ray 15k;

[0043] Figure 6 The following are schematic diagrams illustrating the performance of the models provided in the embodiments of the present invention in multi-class classification scenarios: (a) Non-DP LoRA; (b) DP-SSLoRA;

[0044] Figure 7 Schematic diagram of the generalization ability of the model provided in the embodiments of the present invention under few sample conditions: (a) RSNA; (b) Covid-QU-mini; (c) Chest X-ray 15k. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of the embodiments of this invention will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0046] Example 1

[0047] This invention provides a self-supervised low-rank decomposition method for protecting medical image privacy based on differential privacy, including a training phase and a testing phase; wherein the training phase further includes a pre-training phase and a fine-tuning phase.

[0048] Combination Figure 1 and Figure 2 As shown, the specific steps are as follows:

[0049] The pre-training phase includes:

[0050] Collect an unlabeled publicly available medical image dataset, and pre-train a feature extraction network based on the unlabeled publicly available medical image dataset to obtain pre-training parameters; the pre-training parameters include model parameters and medical image enhancement representations.

[0051] Specifically, to further improve the feature extraction capability of the feature extraction network, the following steps may be further included: processing the collected unlabeled public medical image dataset using data augmentation methods to obtain augmented samples and negative samples to expand the unlabeled public medical image dataset. In this embodiment, the data augmentation method may include random cropping, image size scaling, etc.

[0052] Correspondingly, the feature extraction network is pre-trained based on the expanded dataset. In this embodiment, the MoCo self-supervised method is selected to guide the iterative training of the feature extraction network through a contrastive loss function, enabling the feature extraction network to extract more fine-grained features from the samples. The specific formula for the contrastive loss function is as follows:

[0053]

[0054] Where q represents a positive sample; τ is a temperature function used to adjust the weights of positive and negative sample pairs throughout the training process. i For the current negative sample, k + K represents the overall negative sample queue, and K is the number of samples in the training dataset.

[0055] The fine-tuning phase includes:

[0056] Constructing an image classification network includes: reducing the rank of the feature extraction network to obtain a low-rank layer; freezing the pre-trained parameters of the feature extraction network to obtain a frozen layer; and using the low-rank layer and the frozen layer as two parallel feature extraction branches, connecting them to a classification layer to obtain the image classification network.

[0057] Specifically, the feature extraction network is downranked to obtain low-rank layers, which specifically includes: for all convolutional layers C in the feature extraction network... m×n×k×k Using convolutional layers L m×r×k×k and convolutional layer R r×n×k×k Replacement is performed; where the convolutional layers C, L, and R have the same structure, m and n are the input and output dimensions of the convolutional layer, respectively, and k is the kernel size.

[0058] A labeled sensitive medical image dataset is collected, and the image classification network is trained using the DP-SGD method based on the labeled sensitive medical image dataset; wherein, during the training process, the parameters of the frozen layer are kept unchanged;

[0059] Specifically, taking a convolutional layer C as an example, assuming the original weight matrix of convolutional layer C is W0, and the weight matrices of the replaced convolutional layers L and R are A and B respectively, then the low-rank weight matrix W′ is:

[0060] W′←W0+AB

[0061] During training, the pre-trained weights W0 are frozen and do not receive gradient updates, while the weight parameters in A and B are trainable.

[0062] During the forward propagation process, for each sample x i The output of the low-rank decomposition in the original layer l can be calculated as follows:

[0063]

[0064] Taking the t-th iteration of training as an example, the training process using the DP-SGD method is as follows: For each labeled sensitive medical image sample, after forward propagation through a low-rank layer, the gradient of each sample is calculated, and then the samples are cropped to limit the sensitivity of individual samples. Finally, the gradients are summed to obtain the total gradient g. t ;

[0065] In this embodiment of the invention, the loss function is the cross-entropy loss function, and the above process can be expressed by the following formula:

[0066]

[0067] Where L is the cross-entropy loss function, θ t For model parameters, x i ,y i These represent the sample and its corresponding label, respectively. clip represents the clipping function, and N represents the total number of samples in the labeled sensitive medical image dataset.

[0068] During backpropagation, the gradients of all samples in each batch are aggregated, and differential privacy noise is added to protect the training samples by changing the probability distribution of the model gradients. The specific function is as follows:

[0069]

[0070] Where n is the number of samples in each batch. The noise is Gaussian, where C represents the clipping norm and σ represents the amplitude of the Gaussian noise.

[0071] The testing phase includes:

[0072] The medical images to be analyzed are input into a trained image classification network to obtain the image classification results.

[0073] The medical image privacy protection method proposed in this invention employs self-supervised learning to divide the entire training process of the image classification model into a pre-training stage and a fine-tuning stage, enabling the model to train faster and alleviating its dependence on labeled sensitive medical image data to a certain extent. Simultaneously, by combining low-rank decomposition and differential privacy methods in the fine-tuning stage, the privacy of sensitive medical data is protected, the curse of dimensionality is solved, and the impact of differential privacy noise on model performance is reduced.

[0074] Example 2

[0075] Based on the above embodiment 1, in this embodiment of the invention, the ResNet18 network is selected as the feature extraction network, such as... Figure 3 As shown, all convolutional layers in the ResNet18 network are de-ranked; taking the Conv364×64 convolutional layer as an example, it is replaced with the Conv364×r and Conv3r×64 convolutional layers; where "3" represents the kernel size, "64" before it represents the input dimension size, and "64" after it represents the output dimension size.

[0076] In practical applications, a large batch size can hinder model training. Therefore, in this embodiment, a mini-batch is introduced, and it is assumed that the number of samples in a single mini-batch is N. mini Based on the above formulas (1) and (2), the privacy protection process of convolutional layer L is as shown in formulas (3) and (4), and the privacy protection process of convolutional layer R is as shown in formulas (5) and (6).

[0077]

[0078]

[0079]

[0080]

[0081] Where, x i Let g represent the i-th labeled sensitive medical image sample, A represent the weight matrix of convolutional layer L, and B represent the weight matrix of convolutional layer R; A (x i ) represents the gradient of each sample in convolutional layer L; g B (x i ) represents the gradient of each sample in the convolutional layer R; C represents the clipping norm, N mini σ represents the number of samples contained in a single mini-batch; I represents the magnitude of the Gaussian noise; and I represents the indicator function, which takes the value of 1 if Gaussian noise is added, and 0 otherwise. Indicates Gaussian noise; This represents the clipping gradient per sample in convolutional layer L. This represents the clipping gradient for each sample in the convolutional layer R; N represents the gradient noise added to the convolutional layer L. mini The gradient of each sample is averaged, and then Gaussian noise is added to the gradient. N represents the gradient noise added to the convolutional layer R. mini The gradient of each sample is averaged, and then Gaussian noise is added to the gradient.

[0082] The gradients of each convolutional layer L and convolutional layer R are calculated according to the above formulas (3) to (6), and the gradient direction propagation process is performed on all layers of the image classification network in sequence, and then the next round of iteration is carried out.

[0083] Throughout the entire training process described above, the model parameters of the frozen layers remain unchanged. Meanwhile, during the update process, noise is injected into the gradients of all trainable layers (i.e., low-rank layers and classification layers), ensuring that no patient privacy information from the sensitive medical image data used for training is leaked.

[0084] Example 3

[0085] Corresponding to the above methods, embodiments of the present invention also provide a self-supervised low-rank decomposition medical image privacy protection system based on differential privacy, such as... Figure 4 As shown, it includes: a pre-training module 401, a fine-tuning module 402, and a classification module 403;

[0086] The pre-training module 401 is used to pre-train the feature extraction network based on the collected unlabeled public medical image dataset to obtain pre-training parameters; the pre-training parameters include model parameters and medical image enhancement representations; the fine-tuning module 402 is used to reduce the rank of the feature extraction network to obtain a low-rank layer; freeze the pre-training parameters of the feature extraction network to obtain a frozen layer; the low-rank layer and the frozen layer are used as two parallel feature extraction branches, and a classification layer is connected after the feature extraction branches to obtain an image classification network; and the image classification network is trained using the DP-SGD method based on the collected labeled sensitive medical image dataset; wherein, during the training process, the parameters of the frozen layer are kept unchanged; the classification module 403 is used to input the medical image to be analyzed into the trained image classification network to obtain the image classification result.

[0087] It should be noted that the embodiments of the present invention are for implementing the above method embodiments, and their specific functions can be referred to the above method embodiments, which will not be repeated here.

[0088] Example 4

[0089] To verify the effectiveness of the method, experiments were conducted on different tasks across multiple datasets. The experimental results are as follows:

[0090] Table 1. AUC results of each model with noise multiplier = 1 and rank r = 5 on the three datasets.

[0091]

[0092] As shown in Table 1, DP-SSLoRA (hereinafter referred to as "this invention") has an AUC of 0.9605 on the RSNA dataset, which is 3.23% higher than DP-FT (0.9598) and DP-LP (0.9282). Similar results were observed on the Chest X-Ray15K dataset. On the COVID-QU-mini dataset, the performance of this invention (0.9861) is only slightly lower than DP-FT (0.9929), but still higher than DP-LP (0.9856).

[0093] Comparing DP and non-DP models, this invention exhibits the smallest performance degradation after injecting DP noise compared to the original non-DP model. This result demonstrates that using low-rank decomposition helps mitigate the impact of noise on model performance.

[0094] It's worth noting that the Chest X-Ray 15K dataset is highly imbalanced, with a positive-to-negative sample ratio of 1:8 in the training set. DP-LP models perform poorly on this dataset, while this invention achieves the best results. This is because shallow models are more susceptible to the imbalance in the dataset and tend to favor the majority class during classification. However, as the model depth increases, it gains a deeper understanding of the data and generates a better classification hyperplane, which allows this invention to outperform DP-LP and match DP-FT.

[0095] Experimental results comparing this invention with other differential privacy low-rank decomposition methods show that the number of trainable parameters in this invention is 0.179M, while the number of trainable parameters in RGP is only 0.017M, which is only 1 / 10 of the number in this invention's model (the number of parameters in this invention's model is 1 / 62 of that in DP-Full tuning). However, this invention is more than three times faster than RGP. This is because RGP requires decomposing the gradient of the carrier matrix, a process that consumes significant computational resources and increases computation time. In performance comparisons, this invention's model outperforms RGP on all three datasets. This is because this invention works through a two-stage process, allowing the model to learn general features of similar domains from pre-trained weights and task-specific features from downstream training tasks, which improves generalization ability while maintaining the model's practicality.

[0096] Combination Figure 5 We quantitatively investigated the impact of DP noise on model utility. We evaluated the utility of our invention on the RSNA, Chest X-ray, and COVID-QU-mini datasets under different privacy budgets of epsilon (2, 4, 6, 8, 10, and ∞). Experiments show that the smaller the epsilon, the higher the level of privacy protection of the model. Conversely, as the epsilon increases, the Gaussian noise required for privacy protection decreases, thereby improving model performance. For example, on the RSNA dataset, the AUC of the non-DP baseline is 0.982. Even with epsilon = 2, the AUC of our invention reaches 0.943 (-0.039). This indicates that the DP-SSLoRA model maintains its performance even under strict privacy protection. Similar trends were observed on the Chest X-ray and COVID-QU-mini datasets.

[0097] These results demonstrate that the model of this invention can effectively reduce the impact of DP noise on model performance while still providing a high level of privacy protection, which has been proven in different datasets and epsilon values.

[0098] exist Figure 6 To evaluate the performance of this invention in complex real-world medical environments, we experimented with its performance in multi-class classification tasks and few-shot scenarios. Using the Covid-QU dataset (four-class classification), we compared our invention with a non-DP baseline in multi-class scenarios. Even with the addition of DP noise leading to a performance degradation, our invention still achieved satisfactory results, demonstrating its ability to identify key feature information.

[0099] like Figure 7 As shown, we conducted experiments using varying amounts of labeled training data to validate the model's capabilities in small-sample challenges. Through random sampling, we trained the model using 1%, 10%, 25%, 50%, and 100% subsample sets of the training set used to train the original RSNA dataset. It can be observed that when the training sample size is only 1%, the model's performance drops significantly due to the limited sample size preventing convergence. However, when trained with half the sample size (50%), the model achieves performance close to that of the model trained with 100% of the data. Similar experimental results were also observed on the Covid-QU-mini and Chest X-ray 15k datasets. The experimental results demonstrate that the model exhibits strong performance even when trained with a limited number of samples.

[0100] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A self-supervised low-rank decomposition method for medical image privacy protection based on differential privacy, characterized in that, include: The pre-training phase includes: Collect an unlabeled publicly available medical image dataset, and pre-train a feature extraction network based on the unlabeled publicly available medical image dataset to obtain pre-training parameters; the pre-training parameters include model parameters and medical image enhancement representations. The fine-tuning phase includes: Constructing an image classification network includes: reducing the rank of the feature extraction network to obtain a low-rank layer; freezing the pre-trained parameters of the feature extraction network to obtain a frozen layer; using the low-rank layer and the frozen layer as two parallel feature extraction branches, and connecting them to a classification layer to obtain the image classification network; specifically, reducing the rank of the feature extraction network to obtain a low-rank layer includes: For all convolutional layers in the feature extraction network Using convolutional layers and convolutional layers Replacement is performed; among which, convolutional layers , , The structures are the same, where m and n are the input and output dimensions of the convolutional layer, respectively, and k is the kernel size. A labeled sensitive medical image dataset is collected, and the image classification network is trained using the DP-SGD method based on the labeled sensitive medical image dataset; wherein, during the training process, the parameters of the frozen layer are kept unchanged; the training of the image classification network using the DP-SGD method specifically includes: For each labeled sensitive medical image sample, after forward propagation through a low-rank layer, the gradient of each sample is calculated, the gradient of each sample is then clipped, and finally the gradients of all samples are summed to obtain the total gradient. Based on the total gradient, aggregate the gradients of all samples in each batch, and add differential privacy noise to the aggregated gradient to obtain a new gradient to protect the samples; The testing phase includes: The medical images to be analyzed are input into a trained image classification network to obtain the image classification results.

2. The self-supervised low-rank decomposition medical image privacy protection method based on differential privacy according to claim 1, characterized in that, The pre-training phase specifically includes: Data augmentation methods are used to process the collected unlabeled public medical image dataset to obtain augmented and negative samples to expand the unlabeled public medical image dataset; Based on the expanded dataset, the feature extraction network was pre-trained using the MoCo self-supervised method.

3. The self-supervised low-rank decomposition medical image privacy protection method based on differential privacy according to claim 1, characterized in that, During the fine-tuning phase, the cross-entropy loss function is used as the loss function. Correspondingly, during the t-th iteration of training, the total gradient is calculated using formula (1). : （1） in, Let cross-entropy be the loss function. For model parameters, These represent the sample and its corresponding label, respectively. represents the cropping function, and N represents the total number of samples in the labeled sensitive medical image dataset; The new gradient is calculated using formula (2). : （2） in, The number of samples in each batch. It is Gaussian noise. The amplitude of the Gaussian noise. This is the clipping norm.

4. The self-supervised low-rank decomposition medical image privacy protection method based on differential privacy according to any one of claims 1 to 3, characterized in that, The ResNet18 network was used as the feature extraction network.

5. A self-supervised low-rank decomposition medical image privacy protection system based on differential privacy, characterized in that, include: The pre-training module is used to pre-train the feature extraction network based on the collected unlabeled public medical image dataset to obtain pre-training parameters; The pre-training parameters include model parameters and medical image enhancement representations; A fine-tuning module is used to reduce the rank of the feature extraction network to obtain a low-rank layer; freeze the pre-training parameters of the feature extraction network to obtain a frozen layer; use the low-rank layer and the frozen layer as two parallel feature extraction branches, and connect them to a classification layer to obtain an image classification network; and train the image classification network using the DP-SGD method based on the collected labeled sensitive medical image dataset; wherein, during the training process, the parameters of the frozen layer remain unchanged. The feature extraction network is downranked to obtain a low-rank layer, which specifically includes: For all convolutional layers in the feature extraction network Using convolutional layers and convolutional layers Replacement is performed; among which, convolutional layers , , The structures are the same, where m and n are the input and output dimensions of the convolutional layer, respectively, and k is the kernel size. Training the image classification network using the DP-SGD method specifically includes: For each labeled sensitive medical image sample, after forward propagation through a low-rank layer, the gradient of each sample is calculated, the gradient of each sample is then clipped, and finally the gradients of all samples are summed to obtain the total gradient. Based on the total gradient, aggregate the gradients of all samples in each batch, and add differential privacy noise to the aggregated gradient to obtain a new gradient to protect the samples; The classification module is used to input the medical images to be analyzed into a trained image classification network to obtain the image classification results.

Images