Exploring the Relationship Between Model Prediction Uncertainty and Gradient Inversion Attack Vulnerability for Federated Learning-Based Diabetic Retinopathy Grade Classification

Diabetic retinopathy (DR) is the main cause of visual impairment for the international working-age population. Federated machine learning models trained for DR grade classification using smartphone-based fundus imaging (SBFI) have the potential to enable equitable access for autonomous DR screening services while helping to protect patient data privacy. However, gradient inversion attacks have been shown to be able to reconstruct SBFI data from federated parameter gradient updates, posing a serious threat to patient data privacy. Therefore, it is critical that the gradient inversion attack mechanism is thoroughly understood so that robust defense strategies can be developed to alleviate potential privacy threats. The purpose of this work was to investigate whether it is possible to use estimates of model prediction uncertainty computed using the Bayesian Active Learning by Disagreement (BALD) score metric to identify specific images in an SBFI dataset, which are especially vulnerable to being reconstructed by gradient inversion attacks. Therefore, Spearman’s rank correlation coefficients were calculated to examine the relationship between BALD scores and several metrics measuring the gradient inversion attack reconstruction quality. Experimental results based on 46 images from the Fine-Grained Annotated Diabetic Retinopathy (FGADR) dataset demonstrate that there is a statistically significant moderate negative correlation (rho = -0.629) between BALD score and peak signal-to-noise ratio (PSNR), implying that images with lower BALD scores may be more vulnerable to gradient inversion attacks.