AI applied to medicine can compromise the privacy of certain patients

A study that publishes Nature led by the Technical University of Munich (Germany) focuses on so-called membership inference attacks (MIA), which through multiple queries to a model aim to determine whether a specific person’s data was used to train it.

Previous research on data risk has relied on entire data sets and does not take individual risk into account; However, the new results show that attacks against privacy are more effective than previously thought when it comes to successfully attacking at the individual level.

MIAs “can be very effective in compromising the privacy of patients who provide data individually”since it is possible to determine a patient’s medical data and private information, the article indicates.

Researchers used seven large data sets composed of real-world clinical information, including medical images, electrocardiograms, and electronic health records, to determine the most vulnerable patients among those who contributed data.

The result was that MIAs “can achieve near-perfect success rates for individual patients,” but this risk is not adequately reflected in the standard evaluation protocol, which measures the effectiveness of attacks in aggregate across registries.

The study indicates that underrepresented groups, that is, those patients who represent a minority in the training data set, “face a disproportionately high attack success rate.”

At the group level, People identified as such in the data sets include those with rare diseases, those belonging to a minority racial group, those with an unfavorable socioeconomic situationor those whose gender is less common.

By having more specific data coded by AI models, it has been found that these groups and people are more vulnerable.

Furthermore, they observed that the number of patients with a high attack success rate increases considerably with the capacity of the model.

The group believes that medical AI models and their implementation contexts should be evaluated for the sensitive information that attackers could obtain if they were able to infer membership in a training data set.

Thus, they recommend that, to avoid privacy damage, vulnerable models be protected through verifiable risk mitigation strategies or strict access controls.