Privacy Audits for Clinical Large Language Models

Scalable privacy risk assessment of medical data processed by large language models

This paper empirically evaluates ChatGPT 3.5 and 4.0 using over 23,000 real user-generated medical queries, assessing their susceptibility to privacy breaches through quasi-identifiers such as age, location, phone number and national registration number and proposes a scalable privacy evaluation model that combines k-anonymity, l-diversity, t-closeness, entropy, re-identification risk and delta-disclosure.

Making Clinical Language Models Auditable: Concept-Guided Fine-Tuning for Robust Prediction

Clinical language models can achieve strong in-hospital accuracy yet fail under deployment shifts because they exploit note-specific artifacts (e.g., templates, separators, boilerplate) that do not reflect patient state. We propose CAST (Concept-guided Artifact Suppression Tuning), an SAE-based framework for auditable clinical text classification. CAST uses Sparse Autoencoders to expose sparse, human-auditable features from intermediate Transformer activations, labels SAE latents with an LLM-assisted interpretation pipeline and ICD-10 retrieval constraints, suppresses verified artifact latents via residual subtraction during fine-tuning, and provides post-hoc per-concept attributions for auditing model decisions. On MIMIC-IV discharge-note mortality prediction, CAST improves over its corresponding fine-tuned encoder baselines and remains competitive with strong LLM baselines, while producing a feature-level audit trail of the clinical concepts that support each prediction and the artifact concepts suppressed during training.

Do Open-Weight LLMs Respect Minimum-Necessary Access in Text-to-SQL? An Automated Audit on EHR Benchmarks

Large language models are increasingly deployed as natural-language interfaces to clinical databases, yet their evaluation has focused almost exclusively on query correctness rather than access minimality. Data-protection frameworks such as HIPAA §164.502(b) and the GDPR data-minimisation principle require that personal data be accessed only to the extent necessary for the immediate purpose. This paper presents the first empirical audit of open-weight LLMs on this access-scope dimension, using the EHRSQL 2024 benchmark over MIMIC-IV. We measure deviations from minimum-necessary access via three static metrics computable without executing queries: Sensitive Column Exposure (SCE), Table Over-Join Rate (TOJ), and Aggregate Identifier Exposure (AIE). Unlike prior work on adversarial attacks, we study default model behaviour under ordinary, benign queries—the over-reach we document requires no attacker and is present from the first interaction. Among twelve open-weight models, a non-trivial fraction fail a basic SQL-generation viability threshold; among nine viable models, SQL-specialised training paradoxically increases over-reach while domain-adapted medical variants achieve the lowest exposure. Schema redaction largely eliminates column-level exposure but increases table-level over-reach for most models. Random in-context demonstrations produce statistically significant over-reach regressions in specific models; BM25-based retrieval resolves most of these failures, though a residual aggregate-identifier exposure risk persists for one model family.

Improving Clinical Note De-identification via Post-NER Verification and Candidate Expansion

Privacy Leakage in Federated Learning in Radiology Reports: A Comparative Evaluation of Tokenizer-Driven Privacy Risks

Federated learning (FL) enables multi-institutional training on clinical text without sharing raw data, but gradient inversion can reconstruct sensitive information from shared model updates. The extent of this leakage for radiology reports, and the role of tokenizer design, remains unclear. We quantify gradient-based text reconstruction in FL and compare privacy risk across three tokenizers with the model architecture held fixed. Six FL clients trained a GPT-2-style transformer (sequence length 32) on public radiology corpora (368,751 diagnostic reports, 98,206 discharge summaries, 1,500 MIMIC-CXR free-text reports) using the GPT-2, RadBERT, and LLaMA-2 tokenizers at batch sizes of 64, 128, and 256. Assuming an active malicious server that modifies the shared architecture before distribution, we applied analytic gradient inversion and measured reconstruction fidelity over five runs. Exact sentence reconstruction ranged from 31% to 44% across tokenizers (30.6-43.5% across the 27 tokenizer x dataset x batch-size cells). At batch size 64 on the Discharge dataset, accuracy was 42.1% (GPT-2), 42.3% (RadBERT), and 39.4% (LLaMA-2), decreasing to 37.3%, 37.2%, and 34.3% at batch size 256. S-BLEU declined as batch size grew (GPT-2: 0.44 to 0.33; RadBERT: 0.48 to 0.35). RadBERT yielded the highest reconstruction fidelity and recovered the most clinical terms (18.1% of a 1,440-term reference vocabulary, vs 12.5% for GPT-2 and 9.4% for LLaMA-2), yet no tokenizer prevented leakage. Substantial portions of report text are therefore recoverable from FL gradients even at larger batch sizes and with domain-specific tokenizers. Tokenizer design influences leakage severity and is a privacy-relevant decision, not only a utility one; safeguards such as secure aggregation and differential privacy are likely necessary to meet HIPAA and GDPR requirements for FL in radiology NLP.

Future Querying: Can LLMs Serve as Implicit Medical World Models?

This work introduces future querying, a paradigm that probes whether large language models can function as implicit medical world models by evaluating their ability to answer time-indexed clinical queries about a patient's future, and shows that small, locally fine-tuned open-weight models can match or approach larger proprietary systems, making the framework suitable for privacy-preserving, on-premise deployment.