Development of Privacy-preserving Deep Learning Model with Homomorphic Encryption: A Technical Feasibility Study in Kidney CT Imaging.

Abstract

Purpose To evaluate the technical feasibility of implementing homomorphic encryption in deep learning models for privacy-preserving CT image analysis of kidney masses. Materials and Methods A privacy-preserving deep learning system was developed through three sequential technical phases: a reference convolutional neural network (CNN) model (Ref-CNN) based on ResNet architecture, modification for encryption compatibility (Approx-CNN) by replacing rectified linear unit with polynomial approximation and max-pooling with average-pooling, and implementation of fully homomorphic encryption (HE-CNN). The Cheon-Kim-Kim-Song encryption scheme was used for its capability to perform arithmetic operations on encrypted real numbers. Using 12 446 CT images from a public dataset (3709 images of renal cysts, 5077 images of normal kidneys, and 2283 images of kidney tumors), authors evaluated model performance using area under the receiver operating characteristic curve (AUC) and area under the precision-recall curve (AUPRC). Results All models demonstrated high diagnostic accuracy, with AUC ranging from 0.89 to 0.99 and AUPRC from 0.67 to 0.99. The diagnostic performance trade-off was minimal from Ref-CNN to Approx-CNN (AUC, 0.99-0.97 for normal category), with no evidence of differences between models. However, encryption substantially increased storage and computational demands: A 256 × 256-pixel image expanded from 65 KB to 32 MB, requiring 50 minutes for central processing unit inference but only 90 seconds with graphics processing unit acceleration. Conclusion This technical development demonstrates that privacy-preserving deep learning inference using homomorphic encryption is feasible for classifying kidney masses on CT images, achieving diagnostic performance similar to that of nonencrypted models while maintaining data privacy through end-to-end encryption. <b>Keywords:</b> Privacy-preserving AI, Homomorphic Encryption, Kidney Cancer <i>Supplemental material is available for this article.</i> © RSNA 2025. See also commentary by Busch and Adams in this issue.