Privacy and performance joint testing method and system for medical image model release

Abstract

The application provides a privacy and performance joint test method and system for medical image model release, relates to the technical field of medical artificial intelligence and data privacy and security, and the method is used for obtaining model parameters, differential privacy configuration, patient index and test set; same subject training samples are aggregated into privacy unit data based on the patient index, and a member leakage score matrix is obtained by calling the model parameter operation; the matrix is subjected to aggregation processing to generate an aggregated statistic with a confidence interval, a privacy leakage risk index is calculated through inference attack, a protection effectiveness quantitative value is calculated in combination with the privacy configuration, a performance loss quantitative value is generated based on the test set, and finally, release access strategy identification is output and a joint test audit report is generated through gate logic matching according to the two quantitative values. The application solves the problems that single sample test cannot reflect patient-level risk, lacks privacy and performance joint verification, and is not suitable for data non-out-domain.

Description

Technical Field

[0001] This invention relates to the fields of medical artificial intelligence and data privacy and security technology, and in particular to a method and system for joint testing of privacy and performance for medical image model release. Background Technology

[0002] With the rapid development of medical artificial intelligence technology, medical image models, including specialized task models, pathology or imaging-based models, and multimodal large models, are playing an increasingly important role in disease diagnosis, lesion segmentation, molecular state prediction, and prognostic assessment. These models typically rely on massive amounts of real patient medical images, such as whole-section pathology images, radiographic slide sequences, fundus images, and their associated clinical labels, for training. Because this training data is closely related to the patient's actual disease state, physiological structure, and molecular detection results, it constitutes highly sensitive medical privacy data.

[0003] After completing model training, medical institutions or development companies often need to release model parameter weights, provide model inference interfaces, or fine-tune them for downstream tasks. However, after the model is released, malicious attackers can input specific probe data into the model to analyze information such as the model's confidence level, loss value, intermediate representation differences, or output gradients, thereby performing member inference attacks. This type of attack can reverse engineer whether data from a specific patient or case was used to train the model. If the determination is successful, it will cause serious leakage of training data member privacy.

[0004] To mitigate such privacy risks, Differential Privacy (DP) techniques are often introduced during model training to limit the impact of individual samples on the model through noise injection and gradient clipping. However, existing privacy and performance evaluation techniques for medical image models have the following significant drawbacks: First, existing privacy attack and assessment methods typically use a single data instance, such as a single image patch or a single 2D slice, as the test unit. However, this is severely out of touch with the subject-examination-image-local sample hierarchy unique to medical images. In ethical reviews, the true subject of privacy protection is the patient. Single-sample membership inference tests cannot accurately reflect the attacker's ability to leak real patient-level privacy after aggregating information from multiple samples of the same patient, easily leading to a serious underestimation of the actual risk of leakage.

[0005] Secondly, simply relying on the theoretical privacy budget during differential privacy training is insufficient to prove that the model can be securely released. Existing methods lack means to jointly verify the theoretical budget with the risk of attacks based on real-world experience, and also lack a quantitative mechanism to find a balance between model usability, i.e., task performance loss, and privacy security.

[0006] Finally, due to the high sensitivity of medical data, traditional centralized upload testing platforms are not suitable for hospital environments. Current technology lacks a systematic approach that can integrate privacy assessment, performance evaluation, and publication access mechanisms into a closed loop within a local environment where data does not leave the domain. Summary of the Invention

[0007] To address the aforementioned shortcomings in existing technologies, this invention provides a joint testing method and system for privacy and performance of medical image models. This solves the problems of existing medical image model privacy assessment methods, such as single-sample testing failing to reflect the risk of real-world patient-level data leakage, lack of joint verification of model privacy security and performance degradation, and incompatibility with the requirement that medical data not leave the domain.

[0008] To achieve the aforementioned objectives, the technical solution adopted by this invention is: a joint testing method for privacy and performance in medical image model publishing, comprising: S1: Obtain the parameters of the medical image model to be published, differential privacy configuration data, patient-level index files, and a test set containing medical image features; S2: Based on the hash mapping relationship of the patient-level index file, aggregate multiple discrete medical image training samples belonging to the same real physical subject and transform them into subject-level privacy unit data containing structured correspondence. Call the parameters of the medical image model to be published to extract features and perform operations on each training sample in the subject-level privacy unit data to obtain the member leakage score matrix representing each training sample. S3: Use a preset aggregation function to process the member leakage score matrix within the same subject-level privacy unit to obtain subject-level aggregation statistics with confidence intervals. Input the subject-level aggregation statistics into a preset member inference attack function to calculate the probability distribution and obtain the corresponding privacy leakage risk index parameters. S4: Calculate the correlation deviation between the privacy leakage risk indicator parameters and the differential privacy configuration data to obtain a quantitative value of the effectiveness of differential privacy protection; and calculate the task error based on the prediction results of the test set under the parameters of the medical image model to be released, generating a quantitative value of performance loss. S5: Based on the differential privacy protection effectiveness quantification value and performance loss quantification value, Boolean matching is performed using the preset joint verification gating logic to obtain the corresponding model release admission policy identifier, and a joint test audit report encapsulating the current running status and corresponding hash index data is generated to complete the privacy and performance joint test.

[0009] Further, step S2 includes: Based on the hash mapping relationship of the patient-level index file, the position identifiers of discrete medical image training samples at different data granularities are extracted, and multiple discrete medical image training samples belonging to the same real physical subject are aggregated and transformed into subject-level privacy unit data containing structured correspondence. The parameters of the medical image model to be published are called to extract and operate on the features of each training sample in the subject-level privacy unit data. The prediction confidence and embedded feature similarity of each training sample in the internal response of the model are recorded and numerically mapped to obtain the member leakage score matrix representing each training sample.

[0010] Furthermore, the expression for the member leakage score is: ; in, This indicates the first privacy unit data in the subject-level privacy unit. The first subject The member leakage score corresponding to each training sample This represents the preset total number of data augmentation operations performed on a single training sample, and , and Representing the augmentation count index and , and These represent the first image obtained based on preset image transformation rules. species and first Data augmentation functions, This represents the first privacy unit data in the subject-level privacy unit data. Features of each training sample This represents the encoder network extraction function extracted from the parameters of the medical image model to be published after removing the classification head. This represents the embedding feature similarity function obtained based on the cosine distance algorithm.

[0011] Further, step S3 includes: The member leakage score matrix is ​​subjected to feature screening using a preset aggregation function. The scores that meet the preset high quantile condition are extracted from the member leakage score matrix. The variance of the extracted scores is estimated and bias is corrected based on the preset inter-sample correlation coefficient to obtain the subject-level aggregate statistics with confidence intervals. The subject-level aggregated statistics with confidence intervals are input into the preset membership inference attack function. The preset membership inference attack function is used to compare the standardized deviation of the subject-level aggregated statistics with confidence intervals with the non-member reference distribution. When it is confirmed that the deviation is greater than the preset risk threshold and the width of the confidence interval is less than the preset width constraint, the probability distribution is calculated to obtain the corresponding privacy leakage risk index parameters.

[0012] Furthermore, the expression for the standardized deviation is: ; ; ; in, This represents the standardized deviation of the subject-level aggregate statistic with confidence intervals from the non-member reference distribution. This represents the initial value of the subject-level aggregate statistic obtained by calculating the arithmetic mean of the extracted scores. This represents the expected value of the non-member reference distribution extracted and calculated based on the non-member patient reference set. This represents the standard error of the subject-level aggregate statistic after bias correction. This represents the standard error of the non-member distribution extracted based on the non-member patient reference set. This represents the within-group sample standard deviation calculated based on the extracted scores. Indicates the number of valid samples after correction. This represents the absolute number of score values ​​that meet the preset high quantile criteria within the same subject-level privacy unit. This represents the preset inter-sample correlation coefficient, which is calculated based on the Pearson correlation coefficient extracted from the features of multiple historical adjacent slice images of the same patient.

[0013] Further, step S5 includes: The differential privacy protection effectiveness quantification value and the performance loss quantification value are input into the preset joint verification gating logic for Boolean matching. The differential privacy protection effectiveness quantification value is compared with the preset first allow threshold, and the performance loss quantification value is compared with the preset second allow threshold. The Boolean matching results are combined to make a judgment and obtain the release condition. Based on the issued conditions, the corresponding model release admission policy identifier is obtained. The main hash identifier and the corresponding sample path hash value are extracted from the local storage system. Combined with the state record of the Boolean matching process, they are encoded to generate a joint test audit report encapsulating the current running status and the corresponding hash index data, thus completing the joint privacy and performance test.

[0014] This invention discloses a privacy and performance joint testing system for medical image model publishing, comprising: The acquisition module is used to acquire the parameters of the medical image model to be published, differential privacy configuration data, patient-level index files, and test sets containing medical image features; The feature extraction module is used to aggregate multiple discrete medical image training samples belonging to the same real physical subject and transform them into subject-level privacy unit data containing structured correspondences based on the hash mapping relationship of the patient-level index file. It calls the parameters of the medical image model to be published to perform feature extraction and operation on each training sample in the subject-level privacy unit data to obtain the member leakage score matrix representing each training sample. The calculation module is used to process the member leakage score matrix within the same subject-level privacy unit using a preset aggregation function to obtain subject-level aggregate statistics with confidence intervals. The subject-level aggregate statistics are then input into a preset member inference attack function to calculate the probability distribution and obtain the corresponding privacy leakage risk index parameters. The quantification module is used to calculate the correlation deviation between privacy leakage risk indicator parameters and differential privacy configuration data to obtain a quantitative value of the effectiveness of differential privacy protection; and to calculate the task error based on the prediction results of the test set under the parameters of the medical image model to be released, generating a quantitative value of performance loss. The generation module is used to perform Boolean matching based on the differential privacy protection effectiveness quantification value and performance loss quantification value, using preset joint verification gating logic to obtain the corresponding model release admission policy identifier, and generate a joint test audit report encapsulating the current running status and corresponding hash index data, thus completing the joint privacy and performance test.

[0015] This invention provides a joint privacy and performance testing method for medical image model publishing, which has the following beneficial effects: First, by acquiring patient-level index files, multiple discrete medical image training samples belonging to the same real physical subject, such as multiple slices belonging to the same case, are associated and constructed into subject-level privacy units. This mechanism changes the blind spot of existing technologies that only conduct isolated testing based on a single sample, fundamentally aligning with the patient as the real privacy protection entity in ethical review, and ensuring complete consistency between the evaluation object and the actual subject at risk of leakage.

[0016] Second, in addition to calculating the membership leakage score for each sample, multiple scores within the same subject-level privacy unit are aggregated into a subject-level aggregated statistic, and membership inference attacks are performed based on the uncertainty estimation of this statistic. This multi-instance calibration aggregation method can effectively filter out noise in the underlying samples and capture small but high-confidence leakage signals caused by the superposition of a large number of related samples, making the calculated privacy leakage risk index parameters more consistent with real attack scenarios.

[0017] Third, privacy and performance are no longer viewed in isolation. Instead, the effectiveness of differential privacy protection is determined by combining privacy leakage risk indicators with differential privacy configuration, and the performance loss indicators of the model on the target task are calculated simultaneously. Based on these two quantitative results, model release admission recommendations are generated. This mechanism provides model developers with clear decision-making basis, preventing situations where a model is absolutely safe but has no clinical use, or has excellent performance but illegally leaks data.

[0018] Fourth, the entire testing process is completed in a local computing environment, and the original sensitive medical images do not need to be uploaded to a third-party platform. At the same time, an audit report containing verification information, such as hash indexes and status records, is generated at the end of the test, providing ethics committees and data regulatory authorities with an immutable chain of evidence for model release due diligence, which greatly reduces the cost of compliance review. Attached Figure Description

[0019] This specification will be further described by way of exemplary embodiments, which will be described in detail with reference to the accompanying drawings. These embodiments are not limiting; in these embodiments, the same reference numerals denote the same structures, wherein: Figure 1 This is an exemplary flowchart illustrating a privacy and performance joint testing method for medical image models, as shown in some embodiments of this specification. Figure 2 This is a schematic diagram of a privacy and performance joint testing system for medical image models, as shown in some embodiments of this specification. Detailed Implementation

[0020] The specific embodiments of the present invention are described below to enable those skilled in the art to understand the present invention. However, it should be understood that the present invention is not limited to the scope of the specific embodiments. For those skilled in the art, various changes are obvious as long as they are within the spirit and scope of the present invention as defined and determined by the appended claims. All inventions utilizing the concept of the present invention are protected.

[0021] Example 1 Figure 1 This is an exemplary flowchart illustrating a privacy and performance joint testing method for medical image models, as shown in some embodiments of this specification. Figure 1 As shown, the process includes the following steps. In some embodiments, the process may be executed by a processor.

[0022] S1: Obtain the parameters of the medical image model to be published, differential privacy configuration data, patient-level index files, and a test set containing medical image features.

[0023] The parameters of a medical image model to be released refer to the specific set of values ​​contained in the underlying neural network structure, which is trained locally by the medical model developer or data holder and is ready to be delivered as weights, provide inference interfaces, or undergo secondary fine-tuning. For example, these parameters may include the weight bias of the self-attention layer in a pathology model, the array of convolutional kernel parameters for medical image classification, or the connection weights between encoder and decoder nodes in a multimodal model, and other core data structures.

[0024] In some embodiments, the processor can obtain the parameters of the medical image model to be published by calling the read instruction of the local file system. Specifically, the processor locates the pre-specified model storage path, reads the checkpoint file or weight dictionary stored in a specific serialization format, deserializes and loads it into memory space, and parses out the tensor matrix and bias terms corresponding to each network layer, thereby obtaining the parameters of the medical image model to be published.

[0025] Differential privacy configuration data refers to a set of rule-based constraint parameters introduced during the training or fine-tuning phase of a medical image model to limit the influence of individual data subjects on the model's training results. For example, this configuration data may include the overall privacy budget, the allowed probability of privacy breach failure, the Gaussian noise factor injected at each gradient update, the upper limit of the pruning threshold set for backpropagation gradients, and the specific methods and network layer records used by privacy accountants to calculate privacy consumption.

[0026] In some embodiments, the processor can obtain differential privacy configuration data by parsing the configuration file or logs associated with model training. Specifically, the processor reads an external script file containing training hyperparameters, extracts pre-set privacy-related fields such as gradient clipping threshold, noise scaling, and training epochs through key-value pair matching, formats them into a standard configuration structure, and thus obtains the differential privacy configuration data.

[0027] A patient-level index file is a data table structure that does not contain real identity information but records the affiliation and association between medical image training data samples and their corresponding physical source entities. For example, the index file may include de-identified patient identification hash values, case hash values ​​that distinguish different batches of visits for the same patient, image hash values ​​representing specific whole-slice images or scan examinations, and local sample numbers that identify specific image blocks or slices used in training.

[0028] In some embodiments, the processor can obtain a patient-level index file by mapping and reorganizing the original data information table after anonymization of the medical institution. Specifically, the processor reads a structured database containing original patient identifiers and sample paths, uses a one-way hash function combined with a random key to irreversibly encrypt the original patient identifiers, and binds the encrypted identifiers with the corresponding sample paths or numbers row by row in a relational data table to obtain the patient-level index file.

[0029] A test set refers to a pre-defined group of data units used to examine the privacy leakage risks and task performance of a model to be released. For example, this set may include two main parts: one part is an audit dataset of member patients who have explicitly participated in the underlying training of the model to be released, and the other part is a reference dataset of non-member patients who have not participated in the training but whose distribution is similar to that of member patients in terms of disease type, image modality, and acquisition device characteristics. It also includes a performance evaluation dataset with real medical annotations to evaluate the model's accuracy, recall, or retrieval precision.

[0030] In some embodiments, the processor can obtain the test set by performing stratified sampling and label matching procedures. Specifically, the processor randomly selects a certain proportion of known training patient samples from the local database as a member subset, and then selects an equal number of patient samples from the database not used for training that are highly matched with the aforementioned member subset in terms of clinical diagnostic distribution, scanner model, and staining batch as a non-member subset. These samples are then combined with the independently reserved performance test sample set, and the data format is encapsulated to obtain the test set.

[0031] S2: Based on the hash mapping relationship of the patient-level index file, aggregate multiple discrete medical image training samples belonging to the same real physical subject and transform them into subject-level privacy unit data containing structured correspondence. Call the parameters of the medical image model to be published to perform feature extraction and operation on each training sample in the subject-level privacy unit data to obtain the member leakage score matrix representing each training sample.

[0032] A hash mapping relationship refers to a deterministic link established using cryptographic hash algorithms in a patient-level index file, connecting an anonymized abstract identifier to a specific data entity. For example, such a relationship can include an associated record pointing from a hash string representing a patient to the MRI image numbers of all different time periods belonging to that patient, or a one-to-many network pointing from the hash value of a specific pathological whole-slice image to the coordinates or file paths of thousands of underlying micro-image patches cut from that image.

[0033] In some embodiments, the processor can obtain the hash mapping relationship by performing index parsing and inverted index construction operations. Specifically, the processor reads the structured file containing hash identifiers and sample information row by row, extracts the de-identified main hash field as the primary key, and builds a corresponding empty list in memory. Then, it traverses all data rows and appends the underlying sample numbers or paths belonging to the same primary key to the corresponding primary key list one by one, forming a structured dictionary format to obtain the hash mapping relationship.

[0034] The real physical subject refers to the objectively existing human patient or medical experiment subject corresponding to the medical image data. For example, this subject may include a specific patient undergoing a CT scan in a hospital to screen for lung nodules, or a specific donor participating in a prospective study of a rare disease and donating pathological tissue sections and corresponding clinical follow-up reports. It is the most core and fundamental object unit in the ethical review of medical privacy protection, and all local data samples are derived from it.

[0035] In some embodiments, the processor can obtain an abstract representation of the real physical entity by tracing and merging the upper-level attribution tags carried by the underlying discrete data upwards. Specifically, when reading the metadata of each discrete medical image training sample, the processor extracts the encrypted identification code used to mark the source object, and classifies all discrete samples carrying the same encrypted identification code into a logically independent set of entities, thereby constructing and obtaining an aggregated data object corresponding to the real physical entity in the computational space.

[0036] Discrete medical image training samples refer to the smallest indivisible low-level medical data units that are actually input into the model to be published for forward propagation or parameter updates. For example, such samples may include a tiny pixel block with fixed length and width cut out from a high-resolution digital pathology whole slice image, a single-layer two-dimensional tomographic slice from a three-dimensional MRI image sequence, a single retinal image taken by a fundus camera, or a small descriptive text fragment extracted from a long radiology diagnostic report.

[0037] In some embodiments, the processor can obtain discrete medical image training samples by performing image segmentation or sequence decomposition preprocessing procedures. Specifically, the processor reads large-size original medical image files or volume data, uses a preset sliding window mechanism or three-dimensional coordinate segmentation logic to segment the original image into local regions of fixed size, discards invalid regions with excessive background proportions, and saves the pixel matrix of the retained local regions as independent files or data stream nodes, thereby obtaining the discrete medical image training samples.

[0038] Subject-level privacy unit data refers to a structured data set formed by binding the underlying data contributed by the same patient or subject under multimodal or multi-temporal conditions. For example, this data may include a high-dimensional pathological slide feature vector sequence corresponding to the same subject, a continuous medical image hierarchical data matrix with temporal correlation, or a set of image and text multimodal features associated with the same case identifier. In essence, it is an overall evaluation unit that aggregates all discrete information belonging to the same real physical subject at the logical level.

[0039] In some embodiments, the processor can obtain subject-level privacy unit data by parsing the acquired patient-level index file. Specifically, the processor extracts the de-identified subject hash identifier and the corresponding sample path hash value from the patient-level index file. Based on the unique correspondence of the subject hash identifier, it retrieves and extracts discrete medical image training sample features with the same subject hash identifier from the local storage system. These discrete features are then dimensionality-reduced or concatenated to obtain the subject-level privacy unit data.

[0040] A member leakage score matrix is ​​a multidimensional data array consisting of multiple values, each of which quantifies the probability that the corresponding underlying training sample has participated in model training or the degree to which it is remembered by the model. For example, this matrix may include the set of cross-entropy loss values ​​generated by the model during inference for dozens of pathological image patches under a patient's name, or the set of high similarity values ​​between the underlying embedded feature vectors output by the model for the same image after various image enhancement transformations with different parameters.

[0041] In some embodiments, the processor can obtain the member leakage score matrix by observing and recording the forward inference state of the test samples in the model. Specifically, the processor inputs multiple discrete samples contained in the subject-level privacy unit data into the medical image model to be published one by one, records the predicted probability of each sample at the end of the model, calculates its deviation loss from the true label, or extracts the activation state response of a specific intermediate layer, and fills these recorded values ​​into a blank array of a preset dimension according to the sample affiliation order, thereby obtaining the member leakage score matrix.

[0042] In some embodiments, for a general-type medical image model to be published, the calculation expression for the internal elements of the member leakage score matrix representing each training sample is as follows: ; in, This indicates the first [number] in the subject-level privacy unit data. The first subject The score values ​​corresponding to each discrete medical image training sample. This represents the parameters of the medical image model to be published. Indicates the first Features of discrete medical image training samples This indicates a predefined member leakage score extraction function that matches the model type, such as a prediction confidence extraction function or a prediction error calculation function.

[0043] In some embodiments, the processor can extract the location identifiers of discrete medical image training samples at different data granularities based on the hash mapping relationship of the patient-level index file, aggregate multiple discrete medical image training samples belonging to the same real physical subject and transform them into subject-level privacy unit data containing structured correspondences; call the parameters of the medical image model to be published to perform feature extraction and operation on each training sample in the subject-level privacy unit data, record any one of the prediction confidence and embedded feature similarity of each training sample's response within the model, and perform numerical mapping on it to obtain the member leakage score matrix representing each training sample.

[0044] Location identifiers are strings of information used to precisely locate the storage address of specific discrete medical image training samples or their relative coordinate position in the original large image within a large storage system. For example, the identifier may include an absolute or relative file path directory on a local server's hard drive, a unique row number index representing a specific slice record in a database table, or a record of the pixel offset of the upper left corner of a pathological image block on the X and Y axes in the coordinate system of the original full-slice high-resolution image.

[0045] In some embodiments, the processor can obtain the location identifier by reading an externally input data list or traversing a file system directory. Specifically, the processor opens the patient-level index file, parses the sample description field defined therein, extracts the path string or coordinate tuple data bound to each sample record, converts it into a Uniform Resource Locator (URL) format that can be directly accessed by the operating system or database, and stores it in a query list in memory, thereby obtaining the location identifier.

[0046] In some embodiments, the expression for the member leakage score is: ; in, This indicates the first privacy unit data in the subject-level privacy unit. The first subject The member leakage score corresponding to each training sample This represents the preset total number of data augmentation operations performed on a single training sample, and , and These represent the augmentation count index and , and These represent the first image obtained based on preset image transformation rules. species and first Data augmentation functions, This represents the first privacy unit data in the subject-level privacy unit data. Features of each training sample This represents the encoder network extraction function extracted from the parameters of the medical image model to be published after removing the classification head. This represents the embedding feature similarity function obtained based on the cosine distance algorithm.

[0047] Prediction confidence refers to the subjective, deterministic probability measure assigned to the various diagnostic or classification results output by a medical image model after receiving input samples. For example, this confidence can include a decimal value representing the probability of malignancy output by a binary classification model used to distinguish between benign and malignant tumors after processing a certain slice feature, or the maximum value in the normalized probability distribution vector representing the current sample belonging to various possible disease categories, obtained by a multi-classification model after processing with a Softmax function following a fully connected layer.

[0048] In some embodiments, the processor can obtain the prediction confidence by capturing the terminal output of the model's forward propagation network. Specifically, the processor inputs the pixel matrix or feature tensor of discrete medical image training samples into the model, waits for the model to complete the forward inference calculation, intercepts the raw logic output of the last layer of the classification head network, uses a specific activation function to map the logic value to a probability range of zero to one, extracts the maximum value or the target class value, and thus obtains the prediction confidence.

[0049] Embedded feature similarity refers to the spatial distance or correlation between the high-dimensional hidden layer representation vectors extracted by the model from different versions of the same medical image sample after undergoing different forms of slight perturbation or data transformation. For example, this similarity can include the cosine angle between two dense floating-point vectors of hundreds of dimensions output by a fundus image after random cropping and color jittering, the reciprocal of the Euclidean distance, or the inner product calculation result. A higher value indicates that the model's feature extraction is more stable.

[0050] In some embodiments, the processor can obtain the embedding feature similarity by performing data augmentation comparison and distance measurement algorithms. Specifically, the processor generates at least two augmented samples with morphological differences for the same discrete sample using preset image transformation rules, and inputs them into the feature extraction layer of the encoder network to be published, which has its classification head stripped, to obtain two corresponding high-dimensional feature vectors. The cosine distance between these two vectors is calculated and a numerical mapping transformation is performed to obtain the embedding feature similarity.

[0051] S3: Use a preset aggregation function to process the member leakage score matrix within the same subject-level privacy unit to obtain subject-level aggregate statistics with confidence intervals. Input the subject-level aggregate statistics into a preset member inference attack function to calculate the probability distribution and obtain the corresponding privacy leakage risk index parameters.

[0052] An aggregation function is a mathematical processing logic rule that transforms multiple discrete values ​​belonging to the same group into a single representative statistic that comprehensively reflects the overall characteristics of that group. For example, such a function may include the logic of sorting the leakage scores of all slides under the same patient name from largest to smallest, extracting the top K highest scores and calculating their arithmetic mean, i.e., the Top-K mean; or the logic of removing the highest and lowest extreme values ​​and then truncating the mean; or the logic of weighted summation that assigns different weights to different sample scores according to the importance of the lesion region and then sums them.

[0053] In some embodiments, the processor can obtain the aggregation function by loading a locally pre-compiled code logic module. Specifically, the processor reads the field settings for the risk aggregation method in the test configuration file, and instantiates the corresponding processing class in the system code library or calls the corresponding script subroutine according to the set parameters. The subroutine embeds a sequence of instructions for receiving array input, performing sorting, slicing, averaging, and other specific numerical transformation processes. The aggregation function is obtained by loading the subroutine into the runtime memory.

[0054] Subject-level aggregation statistics refer to numerical values ​​that, after specific aggregation logic processing, can reflect the overall strength of all samples contributed by a specific patient or subject and remembered by the model. For example, this statistic may include the average of the ten highest scores among one hundred pathological image blocks from a patient, or the quantiles of these scores arranged by size at the 90th percentile. It eliminates a large number of low-scoring interferences that may belong to meaningless background images, highlighting a set of high-risk local signals that may lead to privacy breaches.

[0055] In some embodiments, the processor can obtain subject-level aggregate statistics by performing filtering and calculation operations on discrete scores within the same group. Specifically, the processor obtains a member leakage score matrix generated by operations on discrete samples belonging to the same real physical subject, calls a preset aggregation logic module to sort the data in the matrix in descending order, filters out a subset of scores that meet preset conditions, such as quantity requirements or threshold requirements, performs an arithmetic mean or other preset dimensionality reduction operations on the data in the subset, and then obtains the subject-level aggregate statistics.

[0056] In some embodiments, when processing the member leakage score matrix within the same subject-level privacy unit using a preset aggregation function, the expression for the obtained subject-level aggregated statistics is as follows: ; in, Indicates the first The central measure of the subject-level aggregate statistics with confidence intervals for each subject, i.e., the initial value of the mean. This represents the subject-level privacy unit data set of the subject. This represents the score within the set. Represents a sorting and extraction of the previous sorting. The dimensionality reduction screening rule for the highest score value This indicates the preset absolute number of elements to be extracted.

[0057] In some embodiments, when calculating the uncertainty of the subject-level aggregate statistics, the corresponding confidence interval expression is: ; in, This indicates the range of confidence intervals corresponding to the subject-level aggregate statistics with confidence intervals. This represents the initial value of the subject-level aggregate statistics obtained by calculating the extracted scores, and is consistent with the above. Equivalent This represents the standard error of the subject-level aggregate statistic after bias correction. This represents the confidence level constant coefficient that is pre-defined and associated with the significance level.

[0058] A member inference attack function refers to a method that simulates the behavior of an external malicious attacker, attempting to reverse-engineer a decision-making rule or classification model based on data features fed back by the model, to determine whether a specific data object was used to train the model. For example, this function could include a simple threshold comparator with a clearly defined decision boundary, or a logistic regression classifier or a small random forest network structure that takes features such as subject-level aggregate statistics, standard error, and confidence interval width as input, and is trained to output member / non-member probability labels.

[0059] In some embodiments, the processor can obtain the member inference attack function by reading a preset threshold or loading pre-trained classifier weights. Specifically, depending on the test configuration options, the processor either extracts fixed decision threshold rules from the configuration file and converts them into comparison instruction blocks, or reads a binary classification machine learning model parameter file pre-trained using historical feature data of some members and non-members from local storage and initializes it in the computing environment, thereby forming a callable decision engine to obtain the member inference attack function.

[0060] In some embodiments, when the member inference attack function performs probability distribution and identifier classification based on threshold comparison rules, its judgment expression is: ; in, This represents the binary identifier state of the corresponding output, indicating whether the subject is a real training member. It is one of the specific forms of privacy leakage risk indicator parameters. This represents the standardized deviation of the subject-level aggregate statistic with confidence intervals from the non-member reference distribution. This indicates the preset first allowance threshold. This indicates a conditional indicator function that outputs state 1 when the internal condition is true, and outputs state 0 otherwise.

[0061] Privacy leakage risk metrics are a series of statistical values ​​used to macroscopically quantify the severity of a model's tendency to leak information when subjected to probe tests on training data after one or more rounds of simulated inference attacks. For example, these parameters may include the area under the operating characteristic curve that distinguishes between members and non-members, the recall rate of true members successfully identified while controlling for a very low false positive rate (e.g., 1%), and the absolute number of patients who leaked information and met the conditions of high confidence and extremely narrow confidence intervals.

[0062] In some embodiments, the processor can obtain privacy leakage risk index parameters by cross-statistically analyzing the output of the attack function and the real source labels. Specifically, the processor collects the decision probability or Boolean classification results of the member inference attack function for all test set objects, compares them one by one with the real member identity labels recorded in the patient-level index file, calculates the confusion matrix elements such as true positives and false positives in the classification results, and uses these basic elements to perform curve fitting and ratio calculation to obtain the privacy leakage risk index parameters.

[0063] In some embodiments, the processor can use a preset aggregation function to perform feature filtering on the member leakage score matrix, extract the scores that meet the preset high quantile condition from the member leakage score matrix, perform variance estimation and bias correction on the extracted scores based on the preset inter-sample correlation coefficient, and obtain a subject-level aggregated statistic with confidence intervals; input the subject-level aggregated statistic with confidence intervals into a preset member inference attack function, and use the preset member inference attack function to compare the standardized deviation of the subject-level aggregated statistic with confidence intervals with the non-member reference distribution; when it is confirmed that the deviation is greater than a preset risk threshold and the confidence interval width is less than a preset width constraint, perform probability distribution calculation to obtain the corresponding privacy leakage risk index parameters.

[0064] The score value refers to the specific numerical measure reflecting the privacy risk tendency of a single medical image training sample, extracted when the member leakage score matrix is ​​sent into the aggregation processing flow. For example, this value may include an extremely small prediction error value generated by the model when predicting a tiny slice containing a specific rare cell morphology, or a cosine similarity scalar close to one calculated by comparing the deep features corresponding to the slice with the reference features. It is the smallest building block for subsequent statistical analysis of patient-level risk.

[0065] In some embodiments, the processor can obtain the score value by executing unpacking or extraction instructions on the member leakage score matrix. Specifically, the processor sequentially reads the member leakage score matrix stored in memory, locates each individual data unit in the matrix according to the row and column indices, extracts the floating-point or fixed-point data type from it, and temporarily pairs and stores it with its corresponding original discrete medical image training sample identifier in the computation cache, thereby obtaining the score value.

[0066] The inter-sample correlation coefficient is a statistical variable used to measure the degree of interdependence and mutual influence among multiple different training samples contributing to the same physical subject in the model representation space or leakage score. For example, this coefficient can include the Pearson correlation coefficient calculated between two adjacent image patches from the same whole-section pathological image due to the presence of similar tissue structures. A higher value indicates that the information provided by the two samples overlaps more and cannot be considered as two completely independent sources of evidence of privacy leakage.

[0067] In some embodiments, the processor can obtain the inter-sample correlation coefficient by analyzing the fluctuation covariance of homologous historical sample sequences. Specifically, the processor extracts multiple adjacent medical image feature or preliminary leak score sequences belonging to the same patient subject from a non-member reference set or historical data, calculates the covariance of these sequences fluctuating around their respective means, and normalizes them by dividing by the product of their respective standard deviations to obtain a scalar result characterizing the degree of linear correlation between variables, thereby obtaining the inter-sample correlation coefficient.

[0068] Standardized deviation refers to the degree to which an individual patient's aggregated statistic deviates from the average level of the benchmark reference group, eliminating the statistical fluctuations caused by intra-group differences and sample size. For example, this deviation can include a Z-score obtained by subtracting the average leakage score of a large number of non-member patients from the aggregated leakage score of a member patient, and then dividing by the square root of the sum of the squared standard errors of the two. It intuitively reflects the degree of anomalous prominence of the patient's data relative to the non-training population.

[0069] In some embodiments, the processor can obtain the standardized deviation by performing joint deviation calculation on the aggregated statistics and the reference distribution. Specifically, the processor reads the initial value of the subject-level aggregated statistics of the object under test, subtracts the reference expected value calculated based on the non-member reference set, and obtains the absolute deviation; then it obtains the standard error of the object under test and the standard error of the reference distribution after inter-sample correlation correction, calculates the square root of the sum of the squares of these two as the comprehensive fluctuation benchmark, divides the absolute deviation by the benchmark, and thus obtains the standardized deviation.

[0070] In some embodiments, the expression for the standardized deviation is: ; ; ; in, This represents the standardized deviation of the subject-level aggregate statistic with confidence intervals from the non-member reference distribution. This represents the initial value of the subject-level aggregate statistic obtained by calculating the arithmetic mean of the extracted scores. This represents the expected value of the non-member reference distribution extracted and calculated based on the non-member patient reference set. This represents the standard error of the subject-level aggregate statistic after bias correction. This represents the standard error of the non-member distribution extracted based on the non-member patient reference set. This represents the within-group sample standard deviation calculated based on the extracted scores. Indicates the number of valid samples after correction. This represents the absolute number of score values ​​within the same subject-level privacy unit that meet the preset high quantile criteria. This represents the preset inter-sample correlation coefficient, which is calculated based on the Pearson correlation coefficient extracted from the features of multiple historical adjacent slice images of the same patient.

[0071] S4: Calculate the correlation deviation between the privacy leakage risk indicator parameters and the differential privacy configuration data to obtain a quantitative value of the effectiveness of differential privacy protection; and calculate the task error based on the prediction results of the test set under the parameters of the medical image model to be released, generating a quantitative value of performance loss.

[0072] The correlation deviation refers to the relative change or attenuation of the privacy leakage risk exposed by the model before and after implementing differential privacy protection mechanisms. For example, this deviation can include the absolute difference between the number of high-risk member leaks tested under the unnoised baseline model and the number of leaks of the same metric tested under the candidate model trained with the current differential privacy configuration, or the percentage of this absolute difference relative to the number of leaks in the baseline model, used to measure the actual strength of the current configuration in intercepting attacks.

[0073] In some embodiments, the processor can obtain the correlation deviation by comparing risk output records under different privacy settings. Specifically, the processor retrieves the privacy leakage risk index parameters calculated by the medical image model to be published under the current differential privacy configuration, and the corresponding risk parameters calculated under a preset or historically stored non-differential privacy baseline state. It performs an arithmetic subtraction operation to obtain the numerical difference between the two sets of parameters, and uses division to calculate the relative proportion of the difference to the baseline parameter, thereby obtaining the correlation deviation.

[0074] The differential privacy protection effectiveness quantification value refers to a specific score or evaluation conclusion code used to ultimately calibrate the attack inference capabilities of model defense members after integrating theoretical configurations and empirical test results. For example, this quantification value may include a percentage value indicating that the risk reduction has reached the expected target, or a status code characterized as "highly effective" or a numerical grade "A" derived by combining the minimal theoretical budget consumed in the privacy accounting log with the actual unobserved high-confidence attack success cases.

[0075] In some embodiments, the processor can obtain a quantitative value for the effectiveness of differential privacy protection by combining theoretical privacy consumption with empirical bias to perform a comprehensive judgment. Specifically, the processor extracts the calculated correlation deviation value, reads the theoretical budget consumption amount recorded in the differential privacy configuration data, calls the built-in evaluation mapping function, and assigns a specific floating-point number or level label representing the degree of security when the correlation deviation proves that the risk reduction ratio is higher than a preset standard and the theoretical budget is within the security limit, thereby obtaining the quantitative value for the effectiveness of differential privacy protection.

[0076] In some embodiments, the expression for calculating the quantification value of differential privacy protection effectiveness is as follows: ; in, This represents the quantification value of the effectiveness of the differential privacy protection. This represents the baseline value of the historical privacy leakage risk indicator parameter calculated under the baseline model retrieved locally without the differential privacy configuration loaded. This represents the privacy leakage risk index parameter calculated in real time after applying the differential privacy configuration data.

[0077] The prediction result refers to the judgment information that the model calculates and outputs based on its own network weights after receiving a task performance test sample, which reflects the medical attributes of the sample. For example, the result may include a binary black and white mask image that marks the boundary of the lesion output by a tumor segmentation model, a floating-point number that represents the probability of the existence of a certain gene mutation output by a molecular state prediction model, or a natural language report text fragment automatically generated by a medical image and text multimodal model based on radiological images to describe the condition of lung texture lesions.

[0078] In some embodiments, the processor can obtain prediction results by guiding test data through the model's forward computation network. Specifically, the processor reads medical image data or multimodal data used to evaluate performance from the test set, converts it into tensors that conform to the model input format, feeds it into the computation nodes of the medical image model to be published for layer-by-layer transmission and nonlinear transformation, collects the final logical value, classification probability matrix, or character sequence vector generated by decoding from the model's terminal nodes, and then obtains the prediction result.

[0079] Task error refers to the gap or measure of error between the predicted information generated by the model and the actual clinical facts labeled by expert physicians. For example, this error may include the proportion of non-overlapping pixels calculated from the tumor area segmented by the model and the region labeled by the gold standard of actual pathology, the false negative statistic caused by the model misclassifying malignant samples as benign, or the root mean square difference between the survival time predicted by the model and the actual clinical follow-up survival time of patients.

[0080] In some embodiments, the processor can obtain the task error by calculating the distance or comparing the overlap between the predicted output and the standard ground truth. Specifically, the processor reads the recorded model prediction results into memory, extracts real doctor label data that strictly corresponds to the test samples from the test set, calls the preset task loss function logic, and performs element-by-element comparison and summarization operations on the predicted result tensor and the real label tensor to obtain the task error.

[0081] The performance loss quantification value refers to a specific numerical measure of the decrease in model accuracy in core medical tasks such as diagnosis, segmentation, or prediction caused by the introduction of interference mechanisms such as differential privacy noise injection or gradient pruning. For example, this quantification value can include the relative proportion that the accuracy of the model to be released after applying differential privacy decreases by 5% compared to the internal non-differential privacy ideal model, or the absolute difference of 0.08 points in the harmonic mean of recall and precision in multi-class tasks due to privacy protection.

[0082] In some embodiments, the processor can obtain a quantified value of performance loss by performing a performance benchmark comparison calculation. Specifically, the processor retrieves the task error summary index calculated by the model to be released on the task performance test set, and at the same time reads the ideal task index of the internal benchmark model stored locally on the same test set. The processor then performs a standardization calculation by subtracting or dividing the error index of the current model to be released from the corresponding index of the ideal model, and obtains a specific relative or absolute value representing the degree of accuracy degradation, thereby obtaining the quantified value of performance loss.

[0083] In some embodiments, the expression for calculating the quantified performance loss value is as follows: ; in, The performance loss is quantified using a relative loss rate. This represents the ideal task error baseline value calculated using the prediction results of the historical baseline model under the stated test set. This represents the current task error calculated based on the prediction results of the current medical image model parameters to be published under the test set.

[0084] S5: Based on the differential privacy protection effectiveness quantification value and performance loss quantification value, Boolean matching is performed using the preset joint verification gating logic to obtain the corresponding model release admission policy identifier, and a joint test audit report encapsulating the current running status and corresponding hash index data is generated to complete the privacy and performance joint test.

[0085] Joint validation gating logic refers to a set of pre-defined automated decision-making conditions used to simultaneously balance model security and usability, thereby determining whether a model can be legally and compliantly released externally. For example, this logic may include a complex logic system composed of judgment statements: only when differential privacy protection is deemed effective, and the resulting decrease in medical diagnostic accuracy is less than a pre-set business tolerance limit, will the system allow the opening of the model interface or the provision of weight download links, executing a judgment instruction tree.

[0086] In some embodiments, the processor can assemble federated verification gating logic by parsing a local policy configuration file or receiving external regulatory instructions. Specifically, the processor reads a system configuration file containing release approval rules, extracts configuration statements representing security entry thresholds and performance degradation tolerance limits, converts these statements into a set of computer-executable Boolean operators, and constructs the corresponding conditional judgment flow control structure in memory to obtain the federated verification gating logic.

[0087] Model release admission policy identifiers refer to the status instruction codes or suggestion categories output by the system after gating logic adjudication, used to guide downstream systems or operators in performing specific release actions. For example, an identifier may include a green "allow" code that allows direct export of all network weights, a yellow "restrict" code that indicates excessive performance loss requiring fine-tuning of the differential privacy adapter, or a red "reject" code text sequence that explicitly prohibits release and destroys the weight files to be released locally.

[0088] In some embodiments, the processor can obtain the model release admission policy identifier by mapping the final Boolean matching state of the joint verification gating logic. Specifically, the processor captures the true or false state value generated at the end of the gating logic process, substitutes the specific judgment interval into which the differential privacy protection effectiveness quantification value and performance loss quantification value fall, finds the policy string or state number corresponding to the judgment interval, extracts it as the final decision result of the process, and thus obtains the model release admission policy identifier.

[0089] A joint test audit report is a structured, immutable credential document generated before a model is released externally. It contains supporting documentation for all testing processes and is intended for submission to ethics committees or data regulatory bodies for review. For example, the report may include the fingerprint hash of the model to be released, the hash of the data index used in testing, differential privacy consumption records, privacy risk metrics results, performance evaluation forms, and an encrypted data package with the review system's timestamp and digital signature.

[0090] In some embodiments, the processor can obtain a joint test audit report by encapsulating and cryptographically signing the test process context information. Specifically, the processor collects all log texts, hash identifiers, various risk and performance indicator values, and the final policy identifier generated in the preceding steps in memory. It then fills these data into structured document nodes according to a preset report template. Subsequently, it calls the local private key certificate to perform digital encryption and timestamp coding operations on the entire document structure to generate an irreversible signature, thereby obtaining the joint test audit report.

[0091] In some embodiments, the processor can input the differential privacy protection effectiveness quantification value and the performance loss quantification value into a preset joint verification gating logic for Boolean matching. The differential privacy protection effectiveness quantification value is compared with a preset first allow threshold, and the performance loss quantification value is compared with a preset second allow threshold. The Boolean matching result is used to determine the issuance conditions. Based on the issuance conditions, the corresponding model release admission policy identifier is obtained. The main hash identifier and the corresponding sample path hash value in the local storage system are extracted and combined with the state record of the Boolean matching process for encoding. A joint test audit report encapsulating the current running state and the corresponding hash index data is generated to complete the privacy and performance joint test.

[0092] The first clearance threshold refers to the baseline numerical standard set for the privacy and security of the model, used in the gating logic to determine whether privacy protection meets the standards. For example, this threshold may include a hard upper limit stipulated by regulatory authorities that the AUC value of member inference attacks must not exceed 0.55%, or a tolerance scale value that the real member recall rate must be lower than 5% under a false positive rate constraint of 1%. Once the risk indicator exceeds the value, it is considered that there is an unacceptable risk of data leakage.

[0093] In some embodiments, the processor can obtain the first access threshold by reading the system's global security settings or receiving input instructions from authorized personnel. Specifically, the processor listens for user interface input events on the audit management terminal, captures the security limit value entered by an administrator with approval authority, or, in a no-intervention mode, directly reads the encrypted security configuration file preset in the local system environment, extracts the numerical constants defined in the corresponding privacy risk control fields, and loads them into the comparison register of the gating module to obtain the first access threshold.

[0094] The second release threshold refers to the performance baseline or degradation tolerance limit set for the model's usability in its primary medical tasks, ensuring that the released model still has clinical value. For example, this threshold may include the maximum allowable decrease in lung nodule detection accuracy due to privacy protection measures stipulated by medical institutions, which must not exceed 3%, or the minimum absolute pass standard that the overall F1 score for pathology slide classification tasks must remain above 0.85 after adding noise.

[0095] In some embodiments, the processor can obtain the second approval threshold by reading the model performance baseline file or the business requirements specification. Specifically, the processor reads the structured data of the project requirement document corresponding to the medical task, extracts the minimum acceptable index constant set by the clinical department for the model, or reads the log file of the performance of the previous generation of released models, calculates a relative tolerance value according to a certain ratio, and stores it in a specific parameter bit of the runtime environment, thereby obtaining the second approval threshold.

[0096] The issuance condition refers to a final binary judgment fact or combinational logic state, calculated by gating logic, describing whether the comprehensive judgment result of the current model's various indicators fully meets the external approval requirements. For example, this condition may include a triggering prerequisite logic state that allows model parameters to be written to the external interface only when both the system simultaneously confirms that the effectiveness of differential privacy protection exceeds the first approval threshold and the assessment confirms that the performance loss indicator is lower than the second approval threshold.

[0097] In some embodiments, the processor can obtain the release condition by performing a Boolean AND operation and a state convergence operation. Specifically, the processor reads a first Boolean value corresponding to the privacy security comparison result and a second Boolean value corresponding to the performance availability comparison result, respectively, and sends these two Boolean values ​​into the system's logic gates for joint evaluation to obtain the final Boolean combination result variable indicating whether all release conditions are met, thereby obtaining the release condition.

[0098] A subject hash identifier is a fixed-length string of meaningless random characters generated using cryptographic methods to represent a unique physical subject without exposing private information such as the real patient's name, ID number, or hospital number. For example, this identifier could include a hexadecimal ciphertext string obtained by encrypting a patient's real internal electronic medical record ID using a secure hash algorithm combined with a secret random salt value. This string is used to uniquely index all of the patient's data within the system.

[0099] In some embodiments, the processor can obtain the subject hash identifier by executing a keyed one-way hash encryption algorithm. Specifically, the processor extracts the original patient unique identification code in plaintext format from the medical information system database, extracts the encrypted random string for the current period from the security key store, concatenates the two strings, and feeds them into a specific cryptographic hash function for digest calculation. The resulting irreversible long string digest is then saved as the primary key value, thereby obtaining the subject hash identifier.

[0100] A sample path hash value is an encrypted character code used to hide the actual storage location of medical image samples on the institution's local server hard drive, while also serving as a unique fingerprint to verify data integrity. For example, the hash value may include a string of random characters obtained by hashing the absolute directory path string of a medical digital image communication file on the local system. This allows external reviewers to verify whether the sample has been tampered with when receiving the report, without knowing the file organization structure of the hospital server.

[0101] In some embodiments, the processor can obtain the sample path hash value by performing a digest operation on the location string of the underlying discrete data. Specifically, when reading each discrete medical image training sample, the processor extracts its operating system-level file absolute path or Uniform Resource Locator string, inputs it into a preset message digest algorithm engine, calculates a hash fingerprint string of the corresponding length, associates it with the main hash identifier and stores it in a temporary index structure, thereby obtaining the sample path hash value.

[0102] In the formulas and parameters involved in the above embodiments, some preset constant parameters used to control calculation accuracy and risk tolerance have specific optimized value ranges. Specifically, for the preset total number of augmentations in the data augmentation consistency calculation... To achieve a balance between computational overhead and feature stability, its value is preferably a positive integer in the range of [2, 10]. For the absolute number of samples K extracted in the aggregation function, the value of this constant needs to be considered in conjunction with the total sample size of a single subject. Preferably, K is a positive integer between [5, 50], or is set to represent the percentage of the total sample size of the subject. The dynamic integer; for the confidence level constant coefficient involved in uncertainty estimation. This typically corresponds to a 95% or 99% confidence level, and its value is fixed, selected from 1.96 or 2.58; for decision threshold parameters used in member inference attacks, such as the first allow threshold... To strictly control the false alarm rate, such as keeping it below one percent, the optimal value range is set within the real number interval [2.0, 3.5], ensuring that a high-confidence leak flag is only output when the standardized deviation is extremely significant. The specific values ​​of these constant parameters can be adaptively modified in the local configuration file according to the specific requirements of the medical institution regarding computational resource limitations and the rigor of ethical review.

[0103] Example 2 Figure 2 This is a schematic diagram of a privacy and performance joint testing system for medical image models, as shown in some embodiments of this specification.

[0104] In some embodiments, the privacy and performance joint testing system for medical image model release may include an acquisition module for acquiring parameters of the medical image model to be released, differential privacy configuration data, patient-level index files, and a test set containing medical image features; a feature extraction module for aggregating multiple discrete medical image training samples belonging to the same real physical subject according to the hash mapping relationship of the patient-level index file and converting them into subject-level privacy unit data containing structured correspondences, calling the parameters of the medical image model to be released to perform feature extraction and calculation on each training sample in the subject-level privacy unit data to obtain a member leakage score matrix representing each training sample; and a calculation module for processing the member leakage score matrix within the same subject-level privacy unit using a preset aggregation function to obtain... The process involves several steps: First, a subject-level aggregated statistic with confidence intervals is input into a preset member inference attack function to calculate its probability distribution, yielding corresponding privacy leakage risk indicator parameters. A quantification module calculates the correlation deviation between the privacy leakage risk indicator parameters and the differential privacy configuration data, obtaining a quantified value for the effectiveness of differential privacy protection. Then, based on the prediction results of the test set under the parameters of the medical image model to be released, the task error is calculated, generating a quantified value for performance loss. Finally, a generation module performs Boolean matching based on the quantified value for differential privacy protection effectiveness and the quantified value for performance loss using preset joint verification gating logic, obtaining the corresponding model release admission policy identifier and generating a joint test audit report encapsulating the current running status and corresponding hash index data, thus completing the joint privacy and performance testing.

[0105] In some embodiments, a privacy and performance joint testing system for medical image model release can be used to execute a privacy and performance joint testing method for medical image model release, including: S1: acquiring parameters of the medical image model to be released, differential privacy configuration data, patient-level index files, and a test set containing medical image features; S2: based on the hash mapping relationship of the patient-level index files, aggregating multiple discrete medical image training samples belonging to the same real physical subject and converting them into subject-level privacy unit data containing structured correspondences, calling the parameters of the medical image model to be released to perform feature extraction and calculation on each training sample in the subject-level privacy unit data, and obtaining a member leakage score matrix representing each training sample; S3: processing the same subject-level privacy unit using a preset aggregation function. S4: Calculate the correlation deviation between the privacy leakage risk index parameters and the differential privacy configuration data to obtain the quantitative value of differential privacy protection effectiveness; and calculate the task error based on the prediction results of the test set under the parameters of the medical image model to be released, generating the quantitative value of performance loss; S5: Based on the quantitative value of differential privacy protection effectiveness and the quantitative value of performance loss, use the preset joint verification gating logic to perform Boolean matching to obtain the corresponding model release admission policy identifier, and generate a joint test audit report encapsulating the current running status and corresponding hash index data, completing the privacy and performance joint test.

[0106] In some embodiments of this specification, the processor utilizes a privacy and performance joint testing system for medical image model publishing to execute a privacy and performance joint testing method for medical image model publishing. This approach allows the entire testing process to be completed in a local computing environment, eliminating the need to upload original sensitive medical images to a third-party platform. Simultaneously, at the end of the test, an audit report containing verification information, such as hash indexes and status records, is generated, providing ethics committees and data regulatory authorities with an immutable chain of evidence demonstrating due diligence in model publishing, significantly reducing the cost of compliance review.

Claims

1. A joint testing method for privacy and performance of medical image model releases, characterized in that, include: S1: Obtain the parameters of the medical image model to be published, differential privacy configuration data, patient-level index files, and a test set containing medical image features; S2: Based on the hash mapping relationship of the patient-level index file, aggregate multiple discrete medical image training samples belonging to the same real physical subject and transform them into subject-level privacy unit data containing structured correspondence. Call the parameters of the medical image model to be published to extract features and perform operations on each training sample in the subject-level privacy unit data to obtain the member leakage score matrix representing each training sample. S3: Use a preset aggregation function to process the member leakage score matrix within the same subject-level privacy unit to obtain subject-level aggregation statistics with confidence intervals. Input the subject-level aggregation statistics into a preset member inference attack function to calculate the probability distribution and obtain the corresponding privacy leakage risk index parameters. S4: Calculate the correlation deviation between the privacy leakage risk indicator parameters and the differential privacy configuration data to obtain a quantitative value of the effectiveness of differential privacy protection; The task error is calculated based on the prediction results of the test set under the parameters of the medical image model to be released, and a quantitative value of performance loss is generated. S5: Based on the differential privacy protection effectiveness quantification value and performance loss quantification value, Boolean matching is performed using the preset joint verification gating logic to obtain the corresponding model release admission policy identifier, and a joint test audit report encapsulating the current running status and corresponding hash index data is generated to complete the privacy and performance joint test.

2. The privacy and performance joint testing method for medical image model publishing according to claim 1, characterized in that, Step S2 includes: Based on the hash mapping relationship of the patient-level index file, the position identifiers of discrete medical image training samples at different data granularities are extracted, and multiple discrete medical image training samples belonging to the same real physical subject are aggregated and transformed into subject-level privacy unit data containing structured correspondence. The parameters of the medical image model to be published are called to extract and operate on the features of each training sample in the subject-level privacy unit data. The prediction confidence and embedded feature similarity of each training sample in the internal response of the model are recorded and numerically mapped to obtain the member leakage score matrix representing each training sample.

3. The privacy and performance joint testing method for medical image model publishing according to claim 2, characterized in that, The expression for the member leakage score is: ； in, This indicates the first privacy unit data in the subject-level privacy unit. The first subject The member leakage score corresponding to each training sample This represents the preset total number of data augmentation operations performed on a single training sample, and , and These represent the augmentation count index and , and These represent the first image obtained based on preset image transformation rules. species and first Data augmentation functions, This represents the first privacy unit data in the subject-level privacy unit data. Features of each training sample This represents the encoder network extraction function extracted from the parameters of the medical image model to be published after removing the classification head. This represents the embedding feature similarity function obtained based on the cosine distance algorithm.

4. The privacy and performance joint testing method for medical image model publishing according to claim 1, characterized in that, Step S3 includes: The member leakage score matrix is ​​subjected to feature screening using a preset aggregation function. The scores that meet the preset high quantile condition are extracted from the member leakage score matrix. The variance of the extracted scores is estimated and bias is corrected based on the preset inter-sample correlation coefficient to obtain the subject-level aggregate statistics with confidence intervals. The subject-level aggregated statistics with confidence intervals are input into the preset membership inference attack function. The preset membership inference attack function is used to compare the standardized deviation of the subject-level aggregated statistics with confidence intervals with the non-member reference distribution. When it is confirmed that the deviation is greater than the preset risk threshold and the confidence interval width is less than the preset width constraint, the probability distribution is calculated to obtain the corresponding privacy leakage risk index parameters.

5. The privacy and performance joint testing method for medical image model publishing according to claim 4, characterized in that, The expression for the standardized deviation is: ； ； ； in, This represents the standardized deviation of the subject-level aggregate statistic with confidence intervals from the non-member reference distribution. This represents the initial value of the subject-level aggregate statistic obtained by calculating the arithmetic mean of the extracted scores. This represents the expected value of the non-member reference distribution extracted and calculated based on the non-member patient reference set. This represents the standard error of the subject-level aggregate statistic after bias correction. This represents the standard error of the non-member distribution extracted based on the non-member patient reference set. This represents the within-group sample standard deviation calculated based on the extracted scores. Indicates the number of valid samples after correction. This represents the absolute number of score values ​​within the same subject-level privacy unit that meet the preset high quantile criteria. This represents the preset inter-sample correlation coefficient, which is calculated based on the Pearson correlation coefficient extracted from the features of multiple historical adjacent slice images of the same patient.

6. The privacy and performance joint testing method for medical image model publishing according to claim 1, characterized in that, Step S5 includes: The differential privacy protection effectiveness quantification value and the performance loss quantification value are input into the preset joint verification gating logic for Boolean matching. The differential privacy protection effectiveness quantification value is compared with the preset first allow threshold, and the performance loss quantification value is compared with the preset second allow threshold. The Boolean matching results are combined to make a judgment and obtain the release condition. Based on the issued conditions, the corresponding model release admission policy identifier is obtained. The main hash identifier and the corresponding sample path hash value are extracted from the local storage system. Combined with the state record of the Boolean matching process, they are encoded to generate a joint test audit report encapsulating the current running status and the corresponding hash index data, thus completing the joint privacy and performance test.

7. A privacy and performance joint testing system for medical image model publishing, used to execute the privacy and performance joint testing method for medical image model publishing as described in any one of claims 1 to 6, characterized in that, include: The acquisition module is used to acquire the parameters of the medical image model to be published, differential privacy configuration data, patient-level index files, and test sets containing medical image features; The feature extraction module is used to aggregate multiple discrete medical image training samples belonging to the same real physical subject and transform them into subject-level privacy unit data containing structured correspondences based on the hash mapping relationship of the patient-level index file. It calls the parameters of the medical image model to be published to perform feature extraction and operation on each training sample in the subject-level privacy unit data to obtain the member leakage score matrix representing each training sample. The calculation module is used to process the member leakage score matrix within the same subject-level privacy unit using a preset aggregation function to obtain subject-level aggregate statistics with confidence intervals. The subject-level aggregate statistics are then input into a preset member inference attack function to calculate the probability distribution and obtain the corresponding privacy leakage risk index parameters. The quantification module is used to calculate the correlation deviation between privacy leakage risk indicator parameters and differential privacy configuration data, and obtain a quantitative value of the effectiveness of differential privacy protection. The task error is calculated based on the prediction results of the test set under the parameters of the medical image model to be released, and a quantitative value of performance loss is generated. The generation module is used to perform Boolean matching based on the differential privacy protection effectiveness quantification value and performance loss quantification value, using preset joint verification gating logic to obtain the corresponding model release admission policy identifier, and generate a joint test audit report encapsulating the current running status and corresponding hash index data, thus completing the joint privacy and performance test.

Images