Aegis: Generative Gradient Masking for Privacy-Preserving Medical Federated Learning

2026-09-29

AI Summary

This study addresses the vulnerability of medical federated learning to model inversion attacks, where existing defenses struggle to balance patient privacy with diagnostic accuracy. To overcome this limitation, this work proposes a client-side generative gradient masking mechanism that innovatively transforms the reconstruction bottleneck of such attacks into a defensive principle. By leveraging synthetic data to enlarge the effective batch size and superimposing synthetic gradients to induce sample collisions, the proposed approach disrupts the adversary's reconstruction capability without requiring modifications to standard communication protocols. Experimental evaluations on MedMNIST and other datasets demonstrate that the method successfully defends against three state-of-the-art attacks. Furthermore, the approach is supported by rigorous theoretical convergence guarantees, achieving minimal computational overhead while preserving high clinical utility.

Abstract

Federated learning (FL) has become a foundational paradigm for multi-institutional medical AI, allowing hospitals and research centers to jointly train diagnostic models without exchanging patient records. This privacy promise, however, is increasingly contested: a malicious or honest-but-curious server can launch model inversion attacks (MIAs) that reconstruct private patient images directly from shared model updates, and recent scalable, closed-form attacks penetrate even secure aggregation at clinically realistic batch sizes. Existing defenses face an unsatisfactory dilemma. Gradient-perturbation methods such as differential privacy and pruning trade away the diagnostic accuracy on which clinical reliability depends, while cryptographic protocols add system complexity yet still leave updates exposed to these scalable attacks. We propose Aegis, a principled client-side defense that breaks this dilemma without perturbing patient data or modifying the FL protocol. Our key insight is that the success of every known MIA is fundamentally bounded by the local batch size relative to the model's leakage capacity; once this limit is exceeded, distinct samples collide and reconstructions collapse into indistinguishable mixtures. Aegis turns this universal bottleneck into a defense: each client superimposes onto its real update a masking gradient computed on locally synthesized, task-relevant data, deliberately pushing the effective batch beyond the attack's recovery capacity. We complement the design with theoretical convergence guarantees under standard convex assumptions and evaluate Aegis on MNIST, CIFAR-10, and three MedMNIST modalities (chest X-ray, abdominal CT, colon pathology). Aegis neutralizes three state-of-the-art MIAs while preserving model utility and incurring only modest overhead, offering a practical privacy primitive for medical FL.

Problem

• Federated Learning
• Model Inversion Attack
• Privacy Preservation
• Medical AI
• Gradient Leakage

Innovation

• Federated Learning
• Model Inversion Attack
• Gradient Masking
• Privacy-Preserving
• Medical AI