Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Exploring Membership Inference Vulnerabilities in Clinical Large Language Models

Alexander Nemecek, Zebin Yun, Zahra Rahmani, Yaniv Harel, Vipin Chaudhary, Mahmood Sharif, Erman Ayday

TL;DR

This paper investigates membership inference vulnerabilities in clinical large language models fine-tuned on electronic health records, focusing on whether attackers can determine if a patient record contributed to training. It introduces a domain-motivated paraphrase-based perturbation attack alongside a standard loss-based baseline, evaluating both on a state-of-the-art clinical LLM (Llemr) using a MIMIC-IV-derived dataset. Results show limited but measurable leakage (approximately AUC ~ 0.54) and confirm that paraphrase-based threats reflect more realistic adversarial conditions, while token-level signals remain weak. The study emphasizes the need for domain-specific privacy evaluations and defenses such as differential privacy fine-tuning and paraphrase-aware training to strengthen privacy and trustworthiness in healthcare AI systems.

Abstract

As large language models (LLMs) become progressively more embedded in clinical decision-support, documentation, and patient-information systems, ensuring their privacy and trustworthiness has emerged as an imperative challenge for the healthcare sector. Fine-tuning LLMs on sensitive electronic health record (EHR) data improves domain alignment but also raises the risk of exposing patient information through model behaviors. In this work-in-progress, we present an exploratory empirical study on membership inference vulnerabilities in clinical LLMs, focusing on whether adversaries can infer if specific patient records were used during model training. Using a state-of-the-art clinical question-answering model, Llemr, we evaluate both canonical loss-based attacks and a domain-motivated paraphrasing-based perturbation strategy that more realistically reflects clinical adversarial conditions. Our preliminary findings reveal limited but measurable membership leakage, suggesting that current clinical LLMs provide partial resistance yet remain susceptible to subtle privacy risks that could undermine trust in clinical AI adoption. These results motivate continued development of context-aware, domain-specific privacy evaluations and defenses such as differential privacy fine-tuning and paraphrase-aware training, to strengthen the security and trustworthiness of healthcare AI systems.

Exploring Membership Inference Vulnerabilities in Clinical Large Language Models

TL;DR

This paper investigates membership inference vulnerabilities in clinical large language models fine-tuned on electronic health records, focusing on whether attackers can determine if a patient record contributed to training. It introduces a domain-motivated paraphrase-based perturbation attack alongside a standard loss-based baseline, evaluating both on a state-of-the-art clinical LLM (Llemr) using a MIMIC-IV-derived dataset. Results show limited but measurable leakage (approximately AUC ~ 0.54) and confirm that paraphrase-based threats reflect more realistic adversarial conditions, while token-level signals remain weak. The study emphasizes the need for domain-specific privacy evaluations and defenses such as differential privacy fine-tuning and paraphrase-aware training to strengthen privacy and trustworthiness in healthcare AI systems.

Abstract

As large language models (LLMs) become progressively more embedded in clinical decision-support, documentation, and patient-information systems, ensuring their privacy and trustworthiness has emerged as an imperative challenge for the healthcare sector. Fine-tuning LLMs on sensitive electronic health record (EHR) data improves domain alignment but also raises the risk of exposing patient information through model behaviors. In this work-in-progress, we present an exploratory empirical study on membership inference vulnerabilities in clinical LLMs, focusing on whether adversaries can infer if specific patient records were used during model training. Using a state-of-the-art clinical question-answering model, Llemr, we evaluate both canonical loss-based attacks and a domain-motivated paraphrasing-based perturbation strategy that more realistically reflects clinical adversarial conditions. Our preliminary findings reveal limited but measurable membership leakage, suggesting that current clinical LLMs provide partial resistance yet remain susceptible to subtle privacy risks that could undermine trust in clinical AI adoption. These results motivate continued development of context-aware, domain-specific privacy evaluations and defenses such as differential privacy fine-tuning and paraphrase-aware training, to strengthen the security and trustworthiness of healthcare AI systems.
Paper Structure (15 sections, 4 equations, 3 figures, 2 tables)

This paper contains 15 sections, 4 equations, 3 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Experimental Design
  4. Adversary Knowledge and Threat Model
  5. Attack Methods
  6. Loss Attack (baseline)
  7. Paraphrased Loss Attack (weakened black-box)
  8. Min-$K\%$ and Min-$K\%++$ attack
  9. Results
  10. Loss and Paraphrased Loss Attack Performance
  11. Semantic Similarity Validation
  12. Min-$K\%$ Attacks
  13. Discussion
  14. Future Work
  15. Conclusion

Figures (3)

  • Figure 1: ROC curve for the Loss Attack. Both axes are log-scaled to highlight separability at low false positive rates. The dashed diagonal represents random guessing.
  • Figure 2: ROC curve for the Paraphrased Loss Attack. Both axes are log-scaled to highlight separability at low false positive rates. The dashed diagonal represents random guessing.
  • Figure 3: Cosine similarity between original and paraphrased clinical Q&A pairs.