Verified Extraction is introduced, an auditing framework that distinguishes identifiers attributable to fine-tuning data from spurious or prior-driven outputs and quantifies recoverable leakage under explicit query budgets.
This paper empirically evaluates ChatGPT 3.5 and 4.0 using over 23,000 real user-generated medical queries, assessing their susceptibility to privacy breaches through quasi-identifiers such as age, location, phone number and national registration number and proposes a scalable privacy evaluation model that combines k-anonymity, l-diversity, t-closeness, entropy, re-identification risk and delta-disclosure.
Foad Jalali, Mehran Alidoost Nia· Journal of Supercomputing· 0 citations
Clinical language models can achieve strong in-hospital accuracy yet fail under deployment shifts because they exploit note-specific artifacts (e.g., templates, separators, boilerplate) that do not reflect patient state. We propose CAST (Concept-guided Artifact Suppression Tuning), an SAE-based framework for auditable clinical text classification. CAST uses Sparse Autoencoders to expose sparse, human-auditable features from intermediate Transformer activations, labels SAE latents with an LLM-assisted interpretation pipeline and ICD-10 retrieval constraints, suppresses verified artifact latents via residual subtraction during fine-tuning, and provides post-hoc per-concept attributions for auditing model decisions. On MIMIC-IV discharge-note mortality prediction, CAST improves over its corresponding fine-tuned encoder baselines and remains competitive with strong LLM baselines, while producing a feature-level audit trail of the clinical concepts that support each prediction and the artifact concepts suppressed during training.
Large language models are increasingly deployed as natural-language interfaces to clinical databases, yet their evaluation has focused almost exclusively on query correctness rather than access minimality. Data-protection frameworks such as HIPAA §164.502(b) and the GDPR data-minimisation principle require that personal data be accessed only to the extent necessary for the immediate purpose. This paper presents the first empirical audit of open-weight LLMs on this access-scope dimension, using the EHRSQL 2024 benchmark over MIMIC-IV. We measure deviations from minimum-necessary access via three static metrics computable without executing queries: Sensitive Column Exposure (SCE), Table Over-Join Rate (TOJ), and Aggregate Identifier Exposure (AIE). Unlike prior work on adversarial attacks, we study default model behaviour under ordinary, benign queries—the over-reach we document requires no attacker and is present from the first interaction. Among twelve open-weight models, a non-trivial fraction fail a basic SQL-generation viability threshold; among nine viable models, SQL-specialised training paradoxically increases over-reach while domain-adapted medical variants achieve the lowest exposure. Schema redaction largely eliminates column-level exposure but increases table-level over-reach for most models. Random in-context demonstrations produce statistically significant over-reach regressions in specific models; BM25-based retrieval resolves most of these failures, though a residual aggregate-identifier exposure risk persists for one model family.
Alberto Ballesteros-Rodríguez, Lino González-García, Miguel-Ángel Sicilia et al.· Electronics· 0 citations
—De-identification of clinical notes is critical for protecting patient privacy, yet existing approaches often struggle under real-world variation and provide limited support for auditing and error analysis. By examining the outputs of NER-based systems, we observe three recurring failure modes: false positives, false negatives, and fragmented entity spans. The latter can simultaneously introduce both error types under exact-match evaluation. We present a transparent, locally deployable de-identification framework that augments NER-based extraction with two refinement stages: a Verification loop to correct candidate entities and a Candidate Expansion loop to recover missed protected health information (PHI). Beyond improving extraction quality, the system generates structured artifacts for human review, including fine-grained error attribution, audit-ready spreadsheet exports, and an interactive analytical dashboard for cross-configuration comparison, enabling systematic inspection and iterative refinement of de-identification results. We evaluate the framework on the i2b2 2014 benchmark, a MIMIC-IV radiology subset, and a synthetic dataset simulating distribution shift. Results show substantial robustness gains under variation, increasing entity-level F1 from 61.52% to 87.78% and reducing the false-negative rate from 29.75% to 11.59% on the synthetic dataset, while maintaining competitive performance on benchmark data. These findings highlight the value of combining post-NER refinement with transparency-oriented evaluation infrastructure for reliable clinical de-identification.
Ze Zhou, Ruo-Qian Zhang, Zhicheng Jiao et al.· IEEE/ACM International Confe...· 0 citations
Federated learning (FL) enables multi-institutional training on clinical text without sharing raw data, but gradient inversion can reconstruct sensitive information from shared model updates. The extent of this leakage for radiology reports, and the role of tokenizer design, remains unclear. We quantify gradient-based text reconstruction in FL and compare privacy risk across three tokenizers with the model architecture held fixed. Six FL clients trained a GPT-2-style transformer (sequence length 32) on public radiology corpora (368,751 diagnostic reports, 98,206 discharge summaries, 1,500 MIMIC-CXR free-text reports) using the GPT-2, RadBERT, and LLaMA-2 tokenizers at batch sizes of 64, 128, and 256. Assuming an active malicious server that modifies the shared architecture before distribution, we applied analytic gradient inversion and measured reconstruction fidelity over five runs. Exact sentence reconstruction ranged from 31% to 44% across tokenizers (30.6-43.5% across the 27 tokenizer x dataset x batch-size cells). At batch size 64 on the Discharge dataset, accuracy was 42.1% (GPT-2), 42.3% (RadBERT), and 39.4% (LLaMA-2), decreasing to 37.3%, 37.2%, and 34.3% at batch size 256. S-BLEU declined as batch size grew (GPT-2: 0.44 to 0.33; RadBERT: 0.48 to 0.35). RadBERT yielded the highest reconstruction fidelity and recovered the most clinical terms (18.1% of a 1,440-term reference vocabulary, vs 12.5% for GPT-2 and 9.4% for LLaMA-2), yet no tokenizer prevented leakage. Substantial portions of report text are therefore recoverable from FL gradients even at larger batch sizes and with domain-specific tokenizers. Tokenizer design influences leakage severity and is a privacy-relevant decision, not only a utility one; safeguards such as secure aggregation and differential privacy are likely necessary to meet HIPAA and GDPR requirements for FL in radiology NLP.
Santhosh Parampottupadam, Andrés Martínez, D. Bounias et al.· 0 citations
This work introduces future querying, a paradigm that probes whether large language models can function as implicit medical world models by evaluating their ability to answer time-indexed clinical queries about a patient's future, and shows that small, locally fine-tuned open-weight models can match or approach larger proprietary systems, making the framework suitable for privacy-preserving, on-premise deployment.
Siri Willems, James Butterworth, L. Goetschalckx et al.· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
