Differential privacy preserved federated learning for prognostic modeling in COVID‐19 patients using large multi‐institutional chest CT dataset

Abstract Background Notwithstanding the encouraging results of previous studies reporting on the efficiency of deep learning (DL) in COVID‐19 prognostication, clinical adoption of the developed methodology still needs to be improved. To overcome this limitation, we set out to predict the prognosis of a large multi‐institutional cohort of patients with COVID‐19 using a DL‐based model. Purpose This study aimed to evaluate the performance of deep privacy‐preserving federated learning (DPFL) in predicting COVID‐19 outcomes using chest CT images. Methods After applying inclusion and exclusion criteria, 3055 patients from 19 centers, including 1599 alive and 1456 deceased, were enrolled in this study. Data from all centers were split (randomly with stratification respective to each center and class) into a training/validation set (70%/10%) and a hold‐out test set (20%). For the DL model, feature extraction was performed on 2D slices, and averaging was performed at the final layer to construct a 3D model for each scan. The DensNet model was used for feature extraction. The model was developed using centralized and FL approaches. For FL, we employed DPFL approaches. Membership inference attack was also evaluated in the FL strategy. For model evaluation, different metrics were reported in the hold‐out test sets. In addition, models trained in two scenarios, centralized and FL, were compared using the DeLong test for statistical differences. Results The centralized model achieved an accuracy of 0.76, while the DPFL model had an accuracy of 0.75. Both the centralized and DPFL models achieved a specificity of 0.77. The centralized model achieved a sensitivity of 0.74, while the DPFL model had a sensitivity of 0.73. A mean AUC of 0.82 and 0.81 with 95% confidence intervals of (95% CI: 0.79–0.85) and (95% CI: 0.77–0.84) were achieved by the centralized model and the DPFL model, respectively. The DeLong test did not prove statistically significant differences between the two models ( p ‐value = 0.98). The AUC values for the inference attacks fluctuate between 0.49 and 0.51, with an average of 0.50 ± 0.003 and 95% CI for the mean AUC of 0.500 to 0.501. Conclusion The performance of the proposed model was comparable to centralized models while operating on large and heterogeneous multi‐institutional datasets. In addition, the model was resistant to inference attacks, ensuring the privacy of shared data during the training process.