Privacy Leakage in Federated Learning in Radiology Reports: A Comparative Evaluation of Tokenizer-Driven Privacy Risks

2026-07-15 · Source: Computation and Language · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Medical Devices & Health Technology · Depth: Expert, quick

Summary

A study quantifies privacy leakage in federated learning (FL) applied to radiology reports, specifically evaluating the role of tokenizer design. Six FL clients trained a GPT-2-style transformer on public radiology corpora, including 368,751 diagnostic reports and 98,206 discharge summaries, using GPT-2, RadBERT, and LLaMA-2 tokenizers at batch sizes of 64, 128, and 256. The research found that exact sentence reconstruction from FL gradients ranged from 31% to 44% across tokenizers, with RadBERT yielding the highest reconstruction fidelity (42.3% at batch size 64) and recovering the most clinical terms (18.1%). Despite using domain-specific tokenizers and larger batch sizes, substantial portions of report text were recoverable, indicating that tokenizer design significantly influences leakage severity but does not prevent it.

Key takeaway

For NLP Engineers or AI Security Engineers deploying federated learning on clinical text, particularly radiology reports, you must recognize that gradient inversion poses a substantial privacy risk. Even with domain-specific tokenizers like RadBERT, exact sentence reconstruction can exceed 40%. You should prioritize implementing robust safeguards such as secure aggregation and differential privacy to meet HIPAA and GDPR compliance, as tokenizer choice alone is insufficient to prevent sensitive data leakage.

Key insights

Federated learning gradients in radiology reports allow substantial text reconstruction, with tokenizer choice influencing leakage severity.

Principles

• Gradient inversion can reconstruct sensitive data from FL updates.
• Tokenizer design impacts FL privacy leakage severity.
• Domain-specific tokenizers do not prevent FL data leakage.

Method

Quantified gradient-based text reconstruction in FL by comparing GPT-2, RadBERT, and LLaMA-2 tokenizers on a GPT-2-style transformer across public radiology corpora (368,751 diagnostic reports, 98,206 discharge summaries, 1,500 MIMIC-CXR free-text reports).

In practice

• Evaluate tokenizer privacy implications alongside utility.
• Implement secure aggregation in FL for clinical text.
• Apply differential privacy to meet HIPAA/GDPR in FL.

Topics

• Federated Learning
• Privacy Leakage
• Radiology Reports
• Tokenizer Design
• Gradient Inversion
• HIPAA
• GDPR

Best for: CTO, VP of Engineering/Data, Director of AI/ML, AI Scientist, AI Security Engineer, NLP Engineer

Related on AIssential

• Privacy-Preserving Text Sanitization for Distributed Agents Collaboration via Disentangled Representations — Privacy leakage in multi-agent text collaboration extends beyond explicit identifiers to stylistic patterns, necessitating disentangled sanitization.
• MIT scientists investigate memorization risk in the age of clinical AI — AI models trained on EHRs can memorize patient data, necessitating rigorous testing to prevent privacy breaches.
• No More Guessing: a Verifiable Gradient Inversion Attack in Federated Learning — VGIA offers verifiable gradient inversion for tabular data, ensuring exact record reconstruction with certified correctness.
• PSyGenTAB: A Privacy-Preserving Framework for Synthetic Clinical Tabular Data Generation via Constrained Optimization — PSyGenTAB balances privacy and utility in synthetic clinical data generation through constrained optimization.
• Phantoms and Disclosures: a Causal Framework for Auditing Synthetic Data — A causal auditing framework distinguishes true from phantom synthetic data disclosures using statistical tests and held-out data.
• Federated Deep Learning for Privacy-Preserving Cardiovascular Disease Risk Prediction — Federated deep learning improves cardiovascular risk prediction across heterogeneous datasets while preserving patient privacy.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Computation and Language.