Assessing privacy leakage in synthetic 3-D PET imaging using transversal GAN

Background and objective: Training computer-vision related algorithms on medical images for disease diagnosis or image segmentation is difficult in large part due to privacy concerns. For this reason, generative image models are highly sought after to facilitate data sharing. However, 3-D generative models are understudied, and investigation of their privacy leakage is needed. Methods: We introduce our 3-D generative model, Transversal GAN (TrGAN), using head & neck PET images which are conditioned on tumor masks as a case study. We define quantitative measures of image fidelity and utility, and propose a novel framework for evaluating privacy-utility trade-off through membership inference attack. These metrics are evaluated in the course of training to identify ideal fidelity, utility and privacy tradeoffs and establish the relationships between these parameters. Results: We show that the discriminator of the TrGAN is vulnerable to attack, and that an attacker can identify which samples were used in training with almost perfect accuracy (AUC = 0.99). We also show that an attacker with access to only the generator cannot reliably classify whether a sample had been used for training (AUC = 0.51). We also propose and demonstrate a general decision procedure for any deep learning based generative model, which allows the user to quantify and evaluate the decision trade-off between downstream utility and privacy protection. Conclusions: TrGAN can generate 3-D medical images that retain important image features and statistical properties of the training data set, with minimal privacy loss as determined by a membership inference attack. Our utility-privacy decision procedure may be beneficial to researchers who wish to share data or lack a sufficient number of large labeled image datasets.