2020 IEEE International Conference on Blockchain (Blockchain)
Blockchain-orchestrated machine learning for privacy preserving federated learning
in electronic health data
Jonathan Passerat-Palmbach, Ph.D.
ConsenSys Health
Imperial College London, UK
jonathan.passerat-palmbach@consensyshealth.com
Mike McCoy Justin D. Harris
ConsenSys Health Microsoft Corporation
Thomas Jefferson University, USA Justin.Harris@microsoft.com
mike.mccoy@consensyshealth.com
Heather Leigh Flannery
ConsenSys Health
heather.flannery@consensyshealth.com
Abstract—Machine learning and blockchain technology have
been explored for potential applications in medicine with only
modest success to date. Focus has shifted to exploring the
intersection of these technologies along with other privacy
preserving encryption techniques for better utility. This com-
bination applied to federated learning, which allows remote
execution of function and analysis without the need to move
highly regulated personal health information, seems to be the
key to successful applications of these technologies to rapidly
advance evidence-based medicine. We give a brief history of
these technologies in medicine, outlining some of the challenges
with successful use. We then explore a more detailed combina-
tion of usage with an emphasis on decentralizing or federating
the learning process along with auditability and incentivization
blockchain can allow in the machine learning process. Based
on the cost-benefit analysis of previous efforts, we provide the
framework for an advanced blockchain-orchestrated machine
learning system for privacy preserving federated learning in
medicine and a new utility in health. Six critical elements for
this approach in the future will be:
(a) Data and analytic processes discoverable on secure
public blockchain while retaining privacy of the data and
analytic processes
(b) Value fabricated by generating data/compute matches
that were previously illegal, unethical and infeasible
(c) Compute guarantees provided by federated learning
and advanced cryptography
(d) Privacy guarantees provided by software (e.g., Homo-
morphic Encryption, Secure Multi-Party Computation, ...) and
hardware (e.g., Intel SGX and AMD SEV-SNP) cryptography
(e) Data quality incentivized via tokenized reputation-based
rewards
978-0-7381-0495-9/20/$31.00 ©2020 IEEE 550
DOI 10.1109/Blockchain50366.2020.00080
Authorized licensed use limited to: University of Gothenburg. Downloaded on December 19,2020 at 02:33:33 UTC from IEEE Xplore. Restrictions apply.
Tyler Farnan, M.S.
ConsenSys Health
University of California San Diego, USA
tyler.farnan@consensyshealth.com
Sean T. Manion, Ph.D.
ConsenSys Health
https://orcid.org/0000-0002-8911-1457
Bill Gleim, M.S.
ConsenSys Health
bill.gleim@consensyshealth.com
(f) Discarding of poor data accomplished via model poi-
soning attack prevention techniques
1. Introduction
A number of newly emerging and rapidly advancing
technologies have been maturing in healthcare and life
science applications in recent years. This acceleration has
surged in recent months in response to the SARS-CoV-
2 coronavirus pandemic. These healing edge technologies
include applications of blockchain and distributed ledger
technologies (DLT), artificial intelligence advances partic-
ularly in the area of machine learning, and an array of
encryption and privacy preserving techniques. Much of the
progress in applying these different technologies to health
has moved forward in parallel in the past. Recently there has
been increased interest in aligning these powerful tools to
create new utility that is more than just a sum of the parts.
Our work here is intended to present a novel framework
pushing this integrated edge further, outlining a blockchain-
orchestrated machine learning platform for privacy preserv-
ing federated learning intended to accelerate evidence-based
medicine forward and improve health outcomes while ad-
vancing patient trust in the overall learning health systems.
When machine learning for medicine first began to take
root in the late 1970s and early 1980s large amounts of
data collection and storage were considered critical for any
intelligent system [1]. Early pilots from the late 1980s to
the early 2000s applied the tech to medical fields ranging
from internal medicine [2] and histology [3] all the way to
unexplained phenomena in complementary medicine [4]. In
parallel with the rise in computer use and capabilities in
healthcare over the past two decades, machine learning in
medicine has risen exponentially over that time with a search
for the term “machine learning” in PubMed showing 24 re-
sults in 1999 and growing to 511 in 2009 and 9,341 in 2019.
The applications cross almost every field of medicine with
particular concentration in those fields with large amounts of
data and noise such as genomics [5] and mental health [6].
Despite this widespread use, current challenges ranging from
health privacy regulations, limited access to and quality of
data for training, and lack of health data standards [7] have
limited clinical utility and impact of this technology.
The rapid advance of blockchain and other distributed
ledger technologies has been much more recent, having only
been seriously explored in medicine in the last half decade.
It has been a feverish pace of exploration and innovation
since the United States Department of Health and Human
Services hosted a white paper contest for Blockchain in
Healthcare and Life Sciences in 2016 [8] boosting atten-
tion to many of the possible medical applications including
billing, medical supply chain and internet of things [IoT],
clinical research, electronic health records and more. The
overarching impact this distributed tech can have on trust,
provenance of data, and incentivization of multiple stake-
holders across complex health systems has attracted a lot
of initial interest in many areas [9] but still only modest
advances as a stand alone emerging tech in medicine [10].
In the past few years there has been greater interest in the
synergy that can be achieved from using these technologies
together towards a coordinated goal. Efforts have begun to
look at general use for health data [11] as well as specific
applications relating to IoT, sensors and medical devices
[12]. This includes some applications of an array of privacy
preserving encryption techniques [13].
We organize the following sections of this position paper
as follows: Section 2 reviews the existing works combining
AI and blockchain. We subsequently stress the major risks
and benefits involved when deploying these solutions in a
healthcare context in Section 3. Finally, Section 4 sketches
the main features of a modern utility framework providing
accountability, decentralized governance, and incentives for
AI in healthcare.
2. Current Applications
In this section we will review more closely the works
making a joint use of both blockchain and machine learning
solutions. A broader and systematic review on the conver-
gence of AI and DLTs can be found in [14]. We are focusing
on the work involving the role played by blockchains in
collaborative learning networks.
The most common setting for collaborative learning
networks is federated learning (FL), and in particular the
federated averaging (FA) protocol introduced by Google
[15]. FL ensures that data do not leave the premises of their
owner, only the updates to the global model do. However,
the use of the FA protocol is known not to be robust
to problems of model poisoning, centralization or lack of
incentive. These three shortcomings have been addressed
551
Authorized licensed use limited to: University of Gothenburg. Downloaded on December 19,2020 at 02:33:33 UTC from IEEE Xplore. Restrictions apply.
by works in the literature using blockchain-based strategies
[14].
2.1. Decentralizing the Learning Process
The main source of centralization in FL networks is the
aggregation actor collecting the updates from each of the
participants, in order to combine them and produce a new
version of the model. This actor can be implemented by a
trusted third-party, or via a central actor possessing secure
hardware such as Intel SGX. However, if the central server
fails, all training is stopped. A malicious central server
could also compute global aggregations incorrectly, censor
individual clients’ contributions or otherwise sabotage the
training process in any number of ways.
Blockchains offer the ability to decentralize the coor-
dination process. Among existing literature, [16] maps the
traditional elements of a blockchain to the various stages of
the FL protocol: blocks represent a training round, transac-
tions within each block represent model updates from clients
in that round. With this in place, each client can look up
the model updates in the previous communication round (i.e.
all transactions recorded in the latest block) and perform the
aggregation themselves to get the latest global model.
Similarly, the BAFFLE protocol [17] proposes to elimi-
nate the central aggregator to make the process transparent,
and by doing so prevent some forms of model poisoning.
The authors assume that the global model copy and the
associated computational state can be maintained on a smart
contract. While the approach of chunking models to make
them fit into a transaction and blocks is appealing from
a decentralization point of view, it raises concerns with
regards to the privacy of the updates and the portability
of such a method to public blockchains from a cost and
scalability perspective.
The Ethereum public blockchain is at the heart of the
proposal in [18]. Here the goal is to consider the model a
common good that is collaboratively trained and publicly
available for inference at all times. The costs of using a
public blockchain are here more justified as supported by a
wider community, with the goal to create a public and free
common good.
Finally, ModelChain [19] presents an alternative applica-
tion of blockchain technology to decentralize machine learn-
ing. This work introduces a proof-of-information consensus
algorithm that uses model-level metadata to determine the
highest priority data site to be selected for the next training
round. Unlike the canonical federated averaging protocol,
where each round’s global model is an aggregate of multiple
sites’ training updates, ModelChain describes a sequential
learning protocol, where each round’s global model is the
result of a single site’s training update.
2.2. Auditability and Incentives
Another commonly cited weakness of FL networks is
that data owners have no incentive to participate. An ideal
improvement would be reward participants according to the
value of their data. Kang et al. [20], [21] explore how
a blockchain network could be designed to accommodate
for these constraints. Their blockchain is used to record a
‘reputation’ value for each data owner based on past expe-
riences. They suggest using a scheme such as RONI [22]
or FoolsGold [23] to detect and reject malicious updates,
hereby addressing the model poisoning issue at the same
time. These decisions are recorded on the blockchain and
used to calculate a reputation for each client. Clients are
selected for future training rounds based on their reputation,
and only selected clients receive rewards.
One downside of this protocol is that clients are posi-
tively rewarded for any update that does not get classified
as malicious. Consequently, two clients who make the same
number of updates will always receive the same reward, re-
gardless of the relative quality of their data. This is also true
for clients who would have updates considered as malicious.
Reference [24] introduces a variation by having the miners
perform the aggregation . Other miners perform the same
aggregation and do not accept a block if the aggregation
is calculated incorrectly. This protocol can only work with
private blockchains as it requires modifying the algorithm
computed by miners. It would thus be impossible to deploy
it to an existing public blockchain.
As of today, we are only aware of Substra [25] that can
be considered as production-level framework combining the
benefits of FL and blockchain to record an immutable and
temper-proof audit trail of the actions undertaken as part
of the learning process. Substra is used as the backbone of
an FL consortium in the healthcare industry: MELLODY
(https://www.melloddy.eu/). At the time of writing, Substra
does not offer any mechanism for incentives nor advanced
aggregation mechanisms. It is also limited to private net-
works without adversarial actors as it relies on the non
Byzantine fault tolerant (BFT) consensus mechanism in
Hyperledger Fabric to order transactions.
3. Cost-Benefit
These technologies have the ability to save clinicians
and healthcare providers the time it takes to aggregate data
and images, enhance the privacy of clinical data, increase
the efficiency and effectiveness of administrative tasks for
clinicians and create robustness for data poisoning attacks.
However, those solutions come at the expense of computa-
tional burdens, data uniformity and potentially adding future
bottlenecks for those running federated networks in the
future. There also is an underlying question of bias in data,
users and the experience to platform usability that can be
hindered in this model. FL provides unique solutions to this
challenge.
3.1. Benefits
Aggregation in its current state is a time-consuming
process. When using a solution such as FA, a client can
run aggregation numbers locally, and then the updated local
models can be averaged to form the updated global model
552
Authorized licensed use limited to: University of Gothenburg. Downloaded on December 19,2020 at 02:33:33 UTC from IEEE Xplore. Restrictions apply.
on the coordinating server [26]. Typically this process of
aggregation can take weeks to months to verify and become
optimized for clinical settings. Whereas in this model, the
time saved to access this information can be accomplished
in a number of days by performing local updates, commu-
nicating less frequently with central server addresses, and
automating the process for all permissioned partners.
Privacy is also key in building out FL networks. The goal
is for each actor in this system to learn nothing more than
the information needed to play their role, for example, when
an analyst needs to determine whether a particular metric
exceeds a desired clinical result in order to authorize an
algorithm to end users. With federated learning, that answer
is the only bit of information that would be available to the
analyst. This means neither the training data nor the model
parameters can be compromised, while also giving users
only the output of the desired information and not forgoing
any of the data that was needed for the training.
Every participant in the system can feel assured that no
personal information about themselves and others will be re-
vealed by their participation in the network. Participants will
be able to use this understanding to make informed choices
about how and whether to participate at all, representing
more thoughtful and direct data that will be channeled
through the network.
3.2. Risks
The feasibility of these networks are highly constrained
by the capabilities of the devices that run the algorithms
to perform local training and inferencing. This may not
remain a major barrier to entry as most devices, including
smartphones and IoT, are equipped with GPUs or sufficient
computing hardware to run powerful AI models. Currently it
is limiting to train a network without compromising device
performance and user experience.
Training of supervised models requires distinct, labeled
data which may be difficult to produce without third-party
involvement. Designing data pipelines precisely is key so
that labels are captured in an implicit way.
In federated learning, model convergence time takes
longer in federated setups as compared to the central training
models. There is a challenge with system communication
issues where not all devices participate in the FL process
originally may have connectivity issues, different app usage
patterns, model training times, irregular updates, etc. FL
is optimally used when the size of data and its cost for
aggregation from distributed sources are very high.
The potential to centrally aggregate data and create silos
by large companies for competitive advantage could be an
obstacle to adoption of FL models. Effective data protection
policies and appropriate incentives around data cooperation
can tackle these issues and develop a beneficial ecosystem.
Considerable effort is needed to create FL systems that
protect intellectual property and incentivize widespread use
and adoption.
3.3. Potential Bias
There are machine driven biases and social driven bi-
ases that can affect a machine learning outcome, which
become complex in FL. For machines, results can vary due
to computational bandwidth, amount of time a device is
charged, node storage amounts, and network latency due to
a given geographic region. Whereas socially, if populations
of potential users do not own devices for socio-economic
reasons, they may be underrepresented in the training model,
and subsequently also under- (or un-)represented in model
training and evaluation [26].
It has been observed that biases in the data-generating
process can also drive unfairness in the resulting models
learned from this data [27]. This happens due to a lack of
inclusive design principles. This results in users interacting
with the product that may not express overall satisfaction.
Increasing poor experiences for some groups users in ways
which can be difficult to detect while maintaining privacy
in a federated setting [26].
3.4. Counteracting Bias
Privacy and fairness meet in the context of learning
data representations that are independent of some sensitive
attributes while preserving utility for a task of interest.
Indeed, this objective can be motivated both in terms of
privacy: to transform data so as to hide private attributes,
and fairness: as a way to make models trained on such
representations fair with respect to the attributes, which can
combine to lessen bias representations.
FL presents an opportunity to utilize diverse data sets
by providing efficient training protocols along with privacy
and non-identifiability guarantees for the resulting models.
This means that FL enables training on multi-institutional
data sets in many domains that previously were not possible
to work together due to geographical or social constraints,
resulting in a practical opportunity to leverage larger, more
diverse data sets and explore the generalizability of models
which were previously limited to small populations [26].
More importantly, it provides an opportunity to im-
prove the fairness of these models by combining data
across boundaries which are likely to have been correlated
with sensitive attributes. For instance, attendance at spe-
cific health or educational institutions may be correlated
with individuals’ ethnicity or socioeconomic status. Under-
representation in training data is a proven driver of model
unfairness.
Future FL research can help improve diversity in a
federated training setting, while allowing the fairness of the
resulting model to be increased. This includes learning and
quantifies the interplay between diversity, fairness, privacy,
and performance for optimal diversity in data aggregation.
4. Advanced Framework
We are building foundational utility infrastructure to
enable solutions that emerge from the convergence of feder-
ated machine learning, blockchain technology, and advanced
553
Authorized licensed use limited to: University of Gothenburg. Downloaded on December 19,2020 at 02:33:33 UTC from IEEE Xplore. Restrictions apply.
privacy-preserving cryptography to include the incentivized
tokenization of multiple stakeholders. We believe this utility
will play a critical role in solving a myriad of previously
intractable challenges that pervade our health information
systems and have delayed widespread adoption of these new
technologies so far.
In the previous section we have described federated
learning as a promising method that enables collective in-
sights without centralizing or sharing data, and we have
highlighted reasons why federated learning alone is insuf-
ficient for adoption in the healthcare industry. However,
by examining the integration of federated learning with
blockchain technology and advanced cryptography, one can
begin to observe the potential for complementary solutions
with superior properties rooted in trust, privacy and collabo-
ration. Blockchain technology can enable decentralized co-
ordination and governance of the machine learning develop-
ment life-cycle and incentives to contribute data science re-
sources in cooperative environments. In addition, advanced
cryptography can enable verifiable computation and privacy
preserving techniques that provide more rigorous guarantees
and defense against the security and privacy gaps that the
federated learning protocol alone cannot address.
This utility will support secure, private, and ethical
collaborative machine learning systems across a broad range
of use cases in both enterprise and patient-facing settings. As
an enterprise example, hospitals can collaboratively conduct
population studies of electronic health records to identify
critical disease factors. Such settings will usually be backed
by permissioned blockchain networks. The actors do not
necessarily trust each other and might even be competitors
in some cases. As a result they are willing to possess their
own blockchain node to increase their trust in the network
and are in a position to operate it on their own premises or
on a cloud infrastructure they control.
In patient-facing applications, digital health and preci-
sion medicine products and services can safely scale appli-
cations of smart wearable medical devices for continuous
treatment and wellness monitoring. Patients are less pre-
pared to run their own blockchain nodes compared to large
institutions. Designing an architecture with a permissioned
blockchain at its heart in this setting would not bring any
benefits to the patients, as the node operators would have
a disproportionate amount of power on the decentralized
ledger. Public blockchains/DLTs are thus required when
conceiving patient-facing networks in order to establish trust
in the ledger across all stakeholders. These networks might
not be ready to scale up to a large user base at at present,
yet the ambitious road maps exposed by forefront level 1
projects, as well as the constant progress made in increasing
throughput and reducing network fees via level 2 solutions
lead us to believe public blockchain for AI networks will
become practical in the near future. Ultimately, we aim to
transform the healthcare system to be more trusted, acces-
sible, collaborative and patient-centric.
5. Conclusion
Incentive mechanisms for contributing quality data will
be important in developing decentralized FL applications
that can train on private data. In non-FL systems, people
were incentivized to share data with centralized services
in exchange for storage and improved machine learning
models based on their data. Now with FL, your data is only
stored on your devices and the model gets updated based
on others’ data and your data directly on your device. One
Nash equilibrium in a typical FL setting is for no one to
actually share model updates with others in the network.
To encourage active participation in the network, incentives
for good quality data should be introduced. The quality of
one’s data to the network can be determined in several
ways, more research and simulations should be done to
find incentive mechanisms that benefit contributors while
improving a model’s quality and avoiding bias. This is es-
pecially important in healthcare where a patient’s life can be
saved if a model is able to learn from the experience of other
patients. Using a blockchain to track these incentives and
model contributions is essential for security and persistence.
Six critical elements for this approach in the future will
be:
(a) Data and analytic processes discoverable on secure
public blockchain while retaining privacy of the data and
analytic processes
(b) Value fabricated by generating data/compute matches
that were previously illegal, unethical and infeasible
(c) Compute guarantees provided by federated learning
and advanced cryptography
(d) Privacy guarantees provided by software (e.g., Ho-
momorphic Encryption, Secure Multi-Party Computation,
...) and hardware (e.g., Intel SGX and AMD SEV-SNP)
cryptography
(e) Data quality incentivized via tokenized reputation-
based rewards
(f) Discarding of poor data accomplished via model
poisoning attack prevention techniques
We continue to explore and advance this framework with
public and private partners to iteratively advance the model
leading to a fundamental transformation of learning and
improvements in evidence-based medicine and improved
health outcomes in global healthcare.
Acknowledgments
The authors would like to thank Robert Miller of Con-
senSys Health and Marielle S. Gross, MD, MBE of the
Johns Hopkins Berman Institute of Bioethics for their con-
tribution to the discussion of these concepts.
References
[1] “Ascent of machine learning in medicine,” Nature Materials,
vol. 18, no. 5, pp. 407–407, May 2019. [Online]. Available:
https://doi.org/10.1038/s41563-019-0360-1
554
Authorized licensed use limited to: University of Gothenburg. Downloaded on December 19,2020 at 02:33:33 UTC from IEEE Xplore. Restrictions apply.
[2] K. P. Adlassnig and G. Kolarz, “Representation and semiau-
tomatic acquisition of medical knowledge in CADIAG-1 and
CADIAG-2,” Computers and Biomedical Research, an International
Journal, vol. 19, no. 1, pp. 63–79, Feb. 1986, tex.ids: adlass-
nig representation 1986-1.
[3] P. H. Bartels, J. E. Weber, and L. Duckstein, “Machine learning in
quantitative histopathology,” Analytical and Quantitative Cytology
and Histology, vol. 10, no. 4, pp. 299–306, Aug. 1988, tex.ids:
bartels machine 1988-1.
[4] I. Kononenko, “Machine learning for medical diagnosis: history, state
of the art and perspective,” Artificial Intelligence in Medicine, vol. 23,
no. 1, pp. 89–109, Aug. 2001, tex.ids: kononenko machine 2001-1.
[5] J. Wu and Y. Zhao, “Machine learning technology in the application
of genome analysis: A systematic review,” Gene, vol. 705, pp. 149–
156, Jul. 2019, tex.ids: wu machine 2019-1.
[6] A. B. R. Shatte, D. M. Hutchinson, and S. J. Teague, “Machine learn-
ing in mental health: a scoping review of methods and applications,”
Psychological Medicine, vol. 49, no. 9, pp. 1426–1448, 2019, tex.ids:
shatte machine 2019-1.
[7] Z. Zhang and E. Sejdić, “Radiological images and machine
learning: trends, perspectives, and prospects,” Computers in biology
and medicine, vol. 108, pp. 354–370, May 2019, tex.ids:
zhang radiological 2019-1 tex.pmcid: PMC6531364. [Online].
Available: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6531364/
[8] Use of Blockchain in Health IT and Health-related Research
Challenge. [Online]. Available: https://www.cccinnovationcenter.
com/challenges/block-chain-challenge/view-winners/
[9] S. Abdullah, S. Rothenberg, E. Siegel, and W. Kim, “School of Block-
Review of Blockchain for the Radiologists,” Academic Radiology,
vol. 27, no. 1, pp. 47–57, 2020, tex.ids: abdullah school 2020-1.
[10] H. M. Hussien, S. M. Yasin, S. N. I. Udzir, A. A. Zaidan, and
B. B. Zaidan, “A Systematic Review for Enabling of Develop a
Blockchain Technology in Healthcare Application: Taxonomy, Sub-
stantially Analysis, Motivations, Challenges, Recommendations and
Future Direction,” Journal of Medical Systems, vol. 43, no. 10, p.
320, Sep. 2019, tex.ids: hussien systematic 2019-1.
[11] M. Jones, M. Johnson, M. Shervey, J. T. Dudley, and N. Zimmerman,
“Privacy-Preserving Methods for Feature Engineering Using
Blockchain: Review, Evaluation, and Proof of Concept,” Journal
of Medical Internet Research, vol. 21, no. 8, Aug. 2019, tex.ids:
jones privacy-preserving 2019-1 tex.pmcid: PMC6712958. [Online].
Available: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6712958/
[12] H. Mrabet, S. Belguith, A. Alhomoud, and A. Jemai, “A
Survey of IoT Security Based on a Layered Architecture of
Sensing and Data Analysis,” Sensors, vol. 20, no. 13, p.
3625, Jan. 2020, tex.ids: mrabet survey 2020-1 tex.copyright:
http://creativecommons.org/licenses/by/3.0/. [Online]. Available:
https://www.mdpi.com/1424-8220/20/13/3625
[13] J. Passerat-Palmbach, T. Farnan, R. Miller, M. S. Gross, H. L.
Flannery, and B. Gleim, “A blockchain-orchestrated Federated
Learning architecture for healthcare consortia,” arXiv:1910.12603
[cs], Oct. 2019. [Online]. Available: http://arxiv.org/abs/1910.12603
[14] K. D. Pandl, S. Thiebes, M. Schmidt-Kraepelin, and
A. Sunyaev, “On the Convergence of Artificial Intelligence
and Distributed Ledger Technology: A Scoping Review and
Future Research Agenda,” IEEE Access, vol. 8, pp. 57 075–57 095,
2020, tex.ids: pandl convergence 2020, pandl convergence 2020-1.
[Online]. Available: https://ieeexplore.ieee.org/document/9039606/
[15] H. B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y.
Arcas, “Communication-Efficient Learning of Deep Networks from
Decentralized Data,” arXiv:1602.05629 [cs], Feb. 2017. [Online].
Available: http://arxiv.org/abs/1602.05629
[16] H. Kim, J. Park, M. Bennis, and S.-L. Kim, “Blockchained
On-Device Federated Learning,” arXiv:1808.03949 [cs, math], Jul.
2019. [Online]. Available: http://arxiv.org/abs/1808.03949
[17] P. Ramanan and K. Nakayama, “BAFFLE : Blockchain Based
Aggregator Free Federated Learning,” arXiv:1909.07452 [cs, stat],
May 2020. [Online]. Available: http://arxiv.org/abs/1909.07452
[18] J. D. Harris and B. Waggoner, “Decentralized and Collabora-
tive AI on Blockchain,” in 2019 IEEE International Conference
on Blockchain (Blockchain), Jul. 2019, pp. 368–375, tex.ids: har-
ris decentralized 2019-2.
[19] T.-T. Kuo and L. Ohno-Machado, “Modelchain: Decentralized
privacy-preserving healthcare predictive modeling framework on pri-
vate blockchain networks,” arXiv preprint arXiv:1802.01746, 2018.
[20] J. Kang, Z. Xiong, D. Niyato, S. Xie, and J. Zhang, “Incentive
Mechanism for Reliable Federated Learning: A Joint Optimization
Approach to Combining Reputation and Contract Theory,” IEEE
Internet of Things Journal, vol. 6, no. 6, pp. 10 700–10 714, Dec.
2019.
[21] J. Kang, Z. Xiong, D. Niyato, H. Yu, Y.-C. Liang, and D. I.
Kim, “Incentive Design for Efficient Federated Learning in Mobile
Networks: A Contract Theory Approach,” arXiv:1905.07479 [cs],
Oct. 2019. [Online]. Available: http://arxiv.org/abs/1905.07479
[22] M. Barreno, B. Nelson, A. D. Joseph, and J. D. Tygar,
“The security of machine learning,” Machine Learning, vol. 81,
no. 2, pp. 121–148, Nov. 2010. [Online]. Available: https:
//doi.org/10.1007/s10994-010-5188-5
[23] C. Fung, C. J. M. Yoon, and I. Beschastnikh, “Mitigating Sybils
in Federated Learning Poisoning,” arXiv:1808.04866 [cs, stat], May
2019. [Online]. Available: http://arxiv.org/abs/1808.04866
[24] Y. Zhao, J. Zhao, L. Jiang, R. Tan, and D. Niyato, “Mobile Edge
Computing, Blockchain and Reputation-based Crowdsourcing IoT
Federated Learning: A Secure, Decentralized and Privacy-preserving
System,” arXiv:1906.10893 [cs, eess], Apr. 2020. [Online]. Available:
http://arxiv.org/abs/1906.10893
[25] M. N. Galtier and C. Marini, “Substra: a framework for
privacy-preserving, traceable and collaborative Machine Learning,”
arXiv:1910.11567 [cs], Oct. 2019. [Online]. Available: http:
//arxiv.org/abs/1910.11567
[26] P. Kairouz, H. B. McMahan, B. Avent, A. Bellet, M. Bennis, A. N.
Bhagoji, K. Bonawitz, Z. Charles, G. Cormode, R. Cummings,
R. G. L. D’Oliveira, S. E. Rouayheb, D. Evans, J. Gardner,
Z. Garrett, A. Gascón, B. Ghazi, P. B. Gibbons, M. Gruteser,
Z. Harchaoui, C. He, L. He, Z. Huo, B. Hutchinson, J. Hsu,
M. Jaggi, T. Javidi, G. Joshi, M. Khodak, J. Konečný, A. Korolova,
F. Koushanfar, S. Koyejo, T. Lepoint, Y. Liu, P. Mittal, M. Mohri,
R. Nock, A. Özgür, R. Pagh, M. Raykova, H. Qi, D. Ramage,
R. Raskar, D. Song, W. Song, S. U. Stich, Z. Sun, A. T. Suresh,
F. Tramèr, P. Vepakomma, J. Wang, L. Xiong, Z. Xu, Q. Yang,
F. X. Yu, H. Yu, and S. Zhao, “Advances and Open Problems
in Federated Learning,” arXiv:1912.04977 [cs, stat], Dec. 2019.
[Online]. Available: http://arxiv.org/abs/1912.04977
[27] L. Eckhouse, K. Lum, C. Conti-Cook, and J. Ciccolini, “Layers of
Bias: A Unified Approach for Understanding Problems With Risk
Assessment,” Criminal Justice and Behavior, vol. 46, no. 2, pp. 185–
209, Feb. 2019, tex.ids: eckhouse layers 2018 tex.copyright: 
c 2018
International Association for Correctional and Forensic Psychology.
[Online]. Available: https://doi.org/10.1177/0093854818811379

555

Authorized licensed use limited to: University of Gothenburg. Downloaded on December 19,2020 at 02:33:33 UTC from IEEE Xplore. Restrictions apply.