arXiv:2403.17755 · v2
DataCook: Exploring Anti-Adversarial Fingerprints for Healthcare Data Usage Control
摘要
Purpose: Healthcare AI increasingly relies on high-quality datasets, yet medical data are scarce, costly to curate, and tightly regulated in terms of data access. More critically, once medical data are leaked or accessed without authorization, data owners have limited means to prevent such data from being used to train and deploy downstream models. To address this gap, we propose DataCook, a deployment-stage usage-control framework based on anti-adversarial fingerprints. Materials and Methods: Specifically, DataCook transforms raw samples through a private cooking procedure that embeds anti-adversarial fingerprints. Models trained on the cooked data retain strong utility when evaluated on similarly cooked inputs, while their performance on raw inputs is reduced, making downstream model utility dependent on access to the private cooking function. We evaluate DataCook on 2D, 3D, and high-resolution medical images, as well as structured healthcare tabular data, across multiple model architectures and adaptive attack settings. Results: Across the evaluated settings, DataCook generally preserves authorized model utility while reducing performance on unauthorized raw inputs. The authorization-dependent behavior is observed across multiple medical imaging settings, model architectures, and adaptive attack conditions, supporting the feasibility of the proposed deployment-stage usage-control mechanism. Conclusion: These results demonstrate the feasibility of authorization-dependent model use at deployment, while the effectiveness of the current framework remains dependent on the specific task and evaluation metric.
作者备注：27 pages, 5 figures, 21 tables. Accepted for publication in Meta-Radiology. Substantially revised version with an updated title, author list, experimental evaluations, and appendices