A quantile-based layer-aware perturbation to defend against model inversion attacks in deep neural networks

Abstract Medical data is very sensitive in nature and most prone to training time and test time attacks. Model inversion attacks are widespread in medical models as the intruder tries to gain access to the crucial medical models. The fetal plane classification involves one of the most sensitive medical data and is the primary step in ultrasound screening. The primary objective of the paper is to explore the impact of model inversion attacks on the fetal ultrasound plane dataset and propose a novel defense strategy to improve the privacy of the medical deep learning model. This paper proposes an enhanced iterative model inversion attack with multiple initialization strategies. Further, a novel framework, AQC-LANA, an adaptive quantile clipping-based defense with layer-intelligent noise allocation is proposed as a defense. This framework avoids the overhead incurred in the fixed gradient clipping method. The enhanced iterative attack and the proposed defense architecture are evaluated using robust metrics and the results indicate improved performance, comparable with the existing methods. The proposed defense provides 33% more privacy protection and 12% reduced feature leakage with a reasonable accuracy trade-off in comparison with DP-SGD.