Privacy-Preserving Active Learning for precision oncology clinical workflows under multi-jurisdictional compliance

查看原文 / View Original 编辑 / Edit

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

Privacy-Preserving Active Learning for precision oncology clinical workflows under multi-jurisdictional compliance

Introduction: A Discovery Born From Frustration My journey into privacy-preserving active learning began in an unexpected place—a frustrated late-night debugging session while trying to train a tumor classification model on genomic data that I wasn’t legally allowed to move off a hospital’s premises in Heidelberg. I had the compute in my lab, the data existed in another jurisdiction, and GDPR’s Article 44 essentially told me to forget about naive data centralization.

引言：源于挫败感的发现 我进入隐私保护主动学习领域的旅程始于一个意想不到的地方——一次令人沮丧的深夜调试，当时我正试图在海德堡一家医院的基因组数据上训练肿瘤分类模型，而这些数据在法律上是不允许移出医院的。我的实验室有计算能力，但数据存在于另一个司法管辖区，而 GDPR 第 44 条基本上告诉我，别想什么天真的数据集中化了。

While exploring federated learning as a workaround, I stumbled into a deeper realization: the real bottleneck in precision oncology isn’t just moving data—it’s deciding which data to label next when every label costs money, time, and carries regulatory weight. That frustration turned into a two-year exploration of how active learning, differential privacy, and secure multi-party computation could be woven together into something that actually works inside clinical workflows spanning the EU, US, and Singapore.

在探索联邦学习作为变通方案时，我偶然有了更深刻的认识：精准肿瘤学的真正瓶颈不仅仅是数据迁移，而是在每个标签都耗费金钱、时间和监管成本的情况下，决定下一步标注哪些数据。这种挫败感促使我进行了为期两年的探索，研究如何将主动学习、差分隐私和安全多方计算结合起来，使其能够在跨越欧盟、美国和新加坡的临床工作流程中真正发挥作用。

This article is the distillation of what I learned building prototypes, reading papers late into the night, and having uncomfortable conversations with hospital compliance officers who quite rightly didn’t trust my “just trust me” security model. Precision oncology is uniquely demanding here. A single patient’s molecular profile might include whole-genome sequencing, transcriptomic panels, imaging, and longitudinal outcomes—data that is both extraordinarily sensitive and extraordinarily valuable for training models that guide therapy selection.

本文是我在构建原型、深夜阅读论文以及与医院合规官进行尴尬对话后的心得总结，他们非常正确地不信任我那种“相信我就行”的安全模型。精准肿瘤学在此方面有着独特的要求。单个患者的分子图谱可能包括全基因组测序、转录组面板、影像学检查和纵向预后数据——这些数据既极其敏感，又对于训练指导治疗选择的模型极具价值。

Under multi-jurisdictional compliance (GDPR, HIPAA, Singapore’s PDPA, and increasingly China’s PIPL), you cannot simply pool this data. Yet the models need it. Active learning offers a path: instead of labeling everything, we intelligently select the most informative samples to annotate—often reducing labeling budgets by 60–80%. But naive active learning leaks information through the very queries it makes. That’s where the fascinating engineering begins.

在多司法管辖区的合规要求下（GDPR、HIPAA、新加坡的 PDPA，以及日益重要的中国 PIPL），你不能简单地汇集这些数据。然而，模型又需要它们。主动学习提供了一条路径：我们不再标注所有内容，而是智能地选择最具信息量的样本进行标注——这通常能将标注预算减少 60% 到 80%。但天真的主动学习会通过其发出的查询泄露信息。这就是迷人工程学的起点。

Technical Background: The Three Pillars Active learning operates on a simple premise: not all unlabeled samples are equally informative. In a clinical oncology pipeline, you might have 50,000 patients with molecular data but only budget for 500 expert annotations (pathologist time, oncologist review, curated variant interpretation). The question is which 500.

技术背景：三大支柱 主动学习基于一个简单的前提：并非所有未标注样本的信息量都是相等的。在临床肿瘤学流程中，你可能有 5 万名患者的分子数据，但预算仅够支持 500 次专家标注（病理学家时间、肿瘤学家审查、精选变异解读）。问题在于选哪 500 个。

The classic strategies I experimented with:

  • Uncertainty sampling: pick samples where the model is least confident
  • Query-by-committee: pick samples where an ensemble disagrees most
  • Core-set / diversity sampling: pick samples that best represent the unlabeled distribution
  • Expected model change: pick samples that would most alter the model if labeled

我实验过的经典策略包括：

  • 不确定性采样：选择模型最不自信的样本
  • 委员会查询：选择集成模型分歧最大的样本
  • 核心集/多样性采样：选择最能代表未标注分布的样本
  • 预期模型变化：选择如果标注后最能改变模型的样本
import numpy as np
from sklearn.ensemble import RandomForestClassifier

def bald_acquisition(ensemble_probs):
    """ 
    Bayesian Active Learning by Disagreement (BALD).
    ensemble_probs: (n_models, n_samples, n_classes)
    Returns mutual information between predictions and model parameters.
    """
    mean_probs = ensemble_probs.mean(axis=0) # (n_samples, n_classes)
    entropy_of_mean = -np.sum(mean_probs * np.log(mean_probs + 1e-12), axis=1)
    mean_of_entropy = -np.mean(
        np.sum(ensemble_probs * np.log(ensemble_probs + 1e-12), axis=2), axis=0
    )
    return entropy_of_mean - mean_of_entropy # higher = more informative

While exploring BALD for a lung adenocarcinoma subtyping task, I discovered that pure uncertainty sampling tends to over-query ambiguous, borderline cases—which in oncology are often not the clinically actionable ones. A hybrid approach combining uncertainty with diversity (via a k-center greedy selection on embeddings) consistently outperformed either alone in my experiments.

在为肺腺癌亚型任务探索 BALD 时，我发现纯粹的不确定性采样倾向于过度查询那些模棱两可的边缘案例——而在肿瘤学中，这些案例往往不是临床上可操作的。在我的实验中，结合不确定性和多样性（通过嵌入上的 k-中心贪婪选择）的混合方法始终优于单一方法。

Differential Privacy: The Math of Plausible Deniability Differential privacy (DP) gives a formal guarantee: the output of an algorithm is nearly indistinguishable whether or not any single patient’s data was included. The mechanism is elegant—add calibrated noise to the quantity you’re releasing. For a function $f$ with sensitivity $\Delta f$ (the max change in output from adding/removing one record), the Laplace mechanism releases: $M(D) = f(D) + \text{Lap}\left(\frac{\Delta f}{\epsilon}\right)$ where $\epsilon$ is the privacy budget. Smaller $\epsilon$ = more privacy = more noise.

差分隐私：合理推诿的数学 差分隐私 (DP) 提供了一种正式保证：无论是否包含任何单个患者的数据，算法的输出几乎是无法区分的。其机制很优雅——向你发布的数量中添加校准过的噪声。对于具有敏感度 $\Delta f$（添加/删除一条记录导致输出的最大变化）的函数 $f$，拉普拉斯机制发布：$M(D) = f(D) + \text{Lap}\left(\frac{\Delta f}{\epsilon}\right)$，其中 $\epsilon$ 是隐私预算。$\epsilon$ 越小 = 隐私性越强 = 噪声越大。

import numpy as np

def laplace_mechanism(value, sensitivity, epsilon):
    """Release a DP-protected scalar."""
    scale = sensitivity / epsilon
    noise = np.random.laplace(0, scale)
    return value + noise

def dp_histogram(counts, epsilon, max_contribution=1):
    """DP histogram over clinical categories."""
    sensitivity = max_contribution # one patient contributes at most 1
    noisy = counts + np.random.laplace(0, sensitivity / epsilon, size=counts.shape)
    return np.clip(noisy, 0, None)

What took me a while to internalize: DP composes. If you run 100 queries each at $\epsilon=0.1$, you’ve spent $\epsilon=10$ under basic composition—effectively no privacy. This is the central tension in privacy-preserving active learning, because active learning is inherently iterative, and each query is a privacy expenditure. My first prototype leaked catastrophically because I ignored composition. I still cringe thinking about it.

我花了一段时间才内化的一点是：DP 是可组合的。如果你运行 100 次查询，每次 $\epsilon=0.1$，在基本组合下你已经消耗了 $\epsilon=10$——实际上等于没有隐私。这是隐私保护主动学习中的核心矛盾，因为主动学习本质上是迭代的，而每次查询都是一次隐私支出。我的第一个原型因为忽略了组合性而发生了灾难性的泄露。想到这一点，我至今仍感到难堪。

Secure Multi-Party Computation and Federated Learning Federated learning keeps data local and shares only model updates. But naive federated averaging leaks information through gradients—a well-documented attack vector. Secure aggregation (via secret sharing or homomorphic encryption) closes that gap.

安全多方计算与联邦学习 联邦学习将数据保留在本地，仅共享模型更新。但天真的联邦平均算法会通过梯度泄露信息——这是一种有据可查的攻击向量。安全聚合（通过秘密共享或同态加密）弥补了这一差距。

# Sketch: additive secret sharing for secure aggregation
def share_secret(x, n_parties, prime=2**61 - 1):
    """Split x into n additive shares mod prime."""
    shares = [np.random.randint(0, prime, size=x.shape) for _ in range(n_parties - 1)]
    last = (x - sum(shares)) % prime
    return shares + [last]

def reconstruct(shares, prime=2**61 - 1):
    return sum(shares) % prime

示意：用于安全聚合的加性秘密共享

def share_secret(x, n_parties, prime=2**61 - 1): """将 x 分割为 n 个模 prime 的加性份额。""" shares = [np.random.randint(0, prime, size=x.shape) for _ in range(n_parties - 1)] last = (x - sum(shares)) % prime return shares + [last]

def reconstruct(shares, prime=2**61 - 1): return sum(shares) % prime

← 返回新闻列表 / Back to news list