Fig. 1: Comparison of a worst-case and a realistic threat model.
From: Reconciling privacy and accuracy in AI for medical imaging
a, Adversaries can have various capabilities depending on the setting. b, The combination of the adversary’s capabilities defines the threat model. In a worst-case analysis, they have all capabilities. However, access to the database is a pessimistic, practically irrelevant scenario. c, The necessary privacy protection depends on the threat model. In a worst-case threat model, the adversary only needs to match the model and gradient to an image in the database. In a practically more relevant scenario, the image must be reconstructed from the model and gradient. Here, much less privacy protection is necessary. d, The more stringent the privacy protection is chosen, the higher the impacts on the model performance are. Thus, if a realistic threat model is considered appropriate, models can perform better.
