{"id":"411e4e59-d9e9-4519-b908-9d52661b4b29","arxiv_id":"2412.05533","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"Fine-tuning medical LLMs with DP-SGD on MIMIC-III top-50 ICD codes cuts micro-F1 by more than 40% and widens the gender recall gap by roughly 3 percentage points.","lead":"Researchers applied differential privacy to two medical language models fine-tuned for ICD coding from clinical notes and measured large accuracy drops and wider gender gaps. The paper gives quantitative evidence that privacy-preserving training, under current settings, costs much more for medical NLP than for general language tasks.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The reported >40% micro-F1 drop and >3% gender recall gap rest on a single untuned DP-SGD configuration (C=0.1, sigma=0.05, 20 epochs) versus a 2-epoch non-private baseline; the central trade-off claim may be an artifact of that configuration.","rationale":"The reader's weakest assumption identifies the same load-bearing concern: the observed utility drop and fairness gap are attributed to differential privacy rather than to the specific DP configuration. I agree. The central claim is an empirical observation about DP-SGD at epsilon≈10, so what must be true is that the chosen DP configuration is not itself responsible for the degradation. Section 3.3 shows this is not established: the clipping constant is borrowed from Li et al. (2022), the noise multiplier is selected only to satisfy a budget constraint, and no comparison across clipping constants, noise multipliers, or privacy budgets is reported. Group clipping with many layer groups makes the effective per-group bound small, which can severely distort gradients even when the total gradient norm bound is 0.1. In addition, private and non-private training are compared at different epoch counts (20 versus 2), so the measured utility drop may partly reflect the optimization schedule rather than privacy. A sweep that holds epsilon fixed and tunes C on the validation set would settle this. If tuned private models still lose more than 40% micro-F1 and widen recall gaps, the paper's qualitative conclusion stands. If not, the conclusion should be narrowed to 'this untuned DP-SGD baseline performs poorly on this task.' There is also a separate reporting inconsistency between the abstract and Table 1 on the exact recall gap values, which should be corrected but is not the main load-bearing issue. No non-finding: the concern is concrete and testable with the authors' existing code and compute.","tokens_in":8820,"tokens_out":5430,"duration_ms":51584,"concrete_test":"Run a validation-tuned DP-SGD sweep on the same MIMIC-III top-50 task. Fix the privacy budget at epsilon≈9.97 (PRV accountant, delta=1/N). For C in {0.03, 0.1, 0.3, 1.0, 3.0}, choose the noise multiplier sigma so that the PRV-computed epsilon matches; train private Meditron-7b and Gatortron-large with the same early-stopping criterion as the non-private baseline (select by validation micro-F1, cap at 20 epochs). Report test micro-F1 and male–female recall gap for each C. If the best-C test micro-F1 is within 20% of the non-private value, or the male–female recall gap is below 3 percentage points, the headline 40% drop and fairness widening are artifacts of the untuned C=0.1 configuration rather than robust DP-SGD behavior at epsilon≈10.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim—that DP-SGD fine-tuning at epsilon≈10 degrades ICD-coding utility by more than 40% and widens gender recall gaps—requires that the reported private runs are representative of DP-SGD at that privacy budget. That representativeness is not established. Section 3.3 fixes the clipping constant at 0.1, taken from Li et al. (2022) for other tasks, and chooses the noise multiplier (0.05) only so that the PRV-computed epsilon stays below 10. No tuning of C or sigma on the MIMIC-III validation set is reported. Because group clipping bounds each layer-group gradient to C/sqrt(k), and the models have many parameter groups, C=0.1 imposes a very small per-group budget; the resulting update may be dominated by clipping bias rather than by Gaussian noise. The comparison is also asymmetric in training length: non-private models stop at the epoch-2 validation optimum, while private models run up to 20 epochs, so the >40% gap conflates privacy with training schedule. If a larger C (with sigma recalibrated to hold epsilon≈10) or a different DP recipe preserved most utility, the paper's conclusion that privacy-preserving medical coders suffer these trade-offs would be overstated. The gender recall gap widening could be a secondary effect of the utility collapse; if the collapse is tuned away, the fairness conclusion also needs revisiting. Since no ablation over C, epsilon, or early stopping is reported, the observed drop is not yet attributable to differential privacy itself.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper studies whether differentially private fine-tuning can preserve utility and fairness in LLM-based medical coding. Using the PLM-ICD architecture with Meditron-7B and Gatortron-large encoders, the authors fine-tune on the top-50 ICD labels of MIMIC-III with DP-SGD (ghost clipping plus group clipping, noise multiplier 0.05, clip constant 0.1, PRV-computed epsilon below 10) and compare micro-F1 and fairness metrics against non-private baselines. They report a more than 40% relative micro-F1 drop and an increase in the male/female recall gap from near zero to 3-4 percentage points. The paper interprets these results as evidence that privacy-preserving LLM medical coding suffers severe utility and fairness trade-offs, extending prior healthcare DP findings to the NLP setting.","tokens_in":9140,"tokens_out":4929,"duration_ms":43915,"significance":"If robust, the result is a valuable negative result for healthcare NLP: it suggests that DP-SGD at epsilon around 10 degrades LLM-based ICD coding much more than the small utility losses reported in non-healthcare sentence classification, and that the utility collapse can disproportionately affect female patients. The paper's strengths include using two domain-specific pretrained models, using the PRV accountant rather than a loose moments accountant, and releasing code. The main quantitative claims, however, are not yet supported because the DP configuration is a single untuned operating point, the private/non-private training schedules are asymmetric, and the fairness numbers in the text do not match the tables.","major_comments":[{"comment":"The DP configuration is not shown to be representative of DP-SGD at epsilon approximately 9.97. The clipping constant C=0.1 is taken from Li et al. (2022) without tuning on MIMIC-III, and the noise multiplier sigma=0.05 is chosen only so that the PRV-computed epsilon stays below 10; no ablation over C or sigma is reported. Because group clipping bounds each of the k parameter groups to C/sqrt(k), C=0.1 can impose a very small per-group gradient budget for a 7B-parameter model, so the update may be dominated by clipping bias rather than by the Gaussian mechanism. Without at least a small sweep of C, with sigma recalibrated to the same privacy budget, the paper's attribution of the more than 40% drop to differential privacy itself is not established. This is load-bearing because the abstract and Section 4 state the trade-off as a property of privacy-preserving models, not of one configuration.","section":"Section 3.3 and Section 2.1"},{"comment":"The comparison is asymmetric in training length: non-private models stop at the epoch-2 validation optimum, while private models run up to 20 epochs. The reported gap therefore conflates the effect of differential privacy with the effect of a much longer, noised training schedule. A private run with validation-based early stopping, or a non-private run at the same 20-epoch schedule, is needed to separate these factors. This is load-bearing for the quantitative claims in the abstract, since part of the observed drop could be due to training past the utility optimum in the private runs.","section":"Section 3.3 and Section 4"},{"comment":"The reported gender recall gaps are internally inconsistent. The text states that the Meditron gap increased from 0.4% to 3.6% and the Gatortron gap from 0.0% to 3.4%, but Table 1 shows non-private Meditron recall of 0.68/0.67 (a 1 percentage point gap) and private recall of 0.37/0.34 (a 3 percentage point gap); for Gatortron the table shows 0.72/0.72 (0 percentage points) and 0.20/0.16 (4 percentage points). The abstract's 'over 3%' does not match either reading. Because the fairness claim is one of the two headline results, the discrepancy must be resolved and the correct values reported consistently.","section":"Table 1, Abstract, and Section 4"},{"comment":"All results are single runs with no confidence intervals or significance tests. The phrase 'significant performance drop' is not backed by any statistical test, and the fairness gaps in Tables 1 and 2 are differences between one DP run and one non-private run. The utility drop is large enough that it is probably robust, but the 3-4 percentage point fairness gaps could easily be within run-to-run variance. The authors should report multiple seeds with standard deviations, or at least a clear statement that the fairness comparison is anecdotal.","section":"Tables 1-2 and Section 4"}],"minor_comments":[{"comment":"Please align the quantitative claim in the abstract ('over 3%') with the exact recall-gap values in Table 1.","section":"Abstract and Section 4"},{"comment":"There are several typos, including 'LALAAT' for 'LAAT', 'assiging' for 'assigning', and 'efficint' for 'efficient'; the paper should be copy-edited.","section":"Section 2.1"},{"comment":"The sentence 'we largely followed the Pytorch Extending approach in the fastDP library' is ambiguous; please specify which API or function is used.","section":"Section 3.3"},{"comment":"The AdamW 'epsilon of 10^-5' should be named epsilon_opt or epsilon_adam to avoid confusion with the differential privacy parameter epsilon.","section":"Section 3.3"},{"comment":"The model name is spelled 'Gatotron' in the table but 'Gatortron' in the text and model description; use one spelling consistently.","section":"Table 1"}],"recommendation":"major_revision","confidential_remarks":"The paper is a suitable findings-style contribution, but the central claim is stated more generally than the evidence supports. I am not recommending rejection because the empirical observation may survive additional experiments, and the requested ablations and corrected statistics are feasible. The single-run issue is not merely cosmetic: one of the two headline claims is a fairness gap of a few percentage points, and the text/table inconsistency undermines the reader's ability to check that claim. The reader's circularity concern is not a real issue: the privacy loss is computed externally via PRV, and no result is defined in terms of a fitted parameter."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is the first paper I know that applies DP-SGD to transformer-based ICD coders (Meditron-7b and Gatortron-large) on MIMIC-III top-50, and the question is genuinely important for deployment. But the headline numbers — more than 40% micro-F1 drop and roughly 3% gender recall gap widening at epsilon approx 10 — come from one private configuration, so treat them as preliminary rather than as a settled result.\n\nWhat's good: the paper is clean and readable, uses a tight PRV accountant, makes code available, and gets competitive non-private baselines (Gatortron at 73.6% micro-F1). It correctly frames the result as reinforcing Suriyakumar et al.'s long-tail argument from image/time-series data in the text modality. That is a useful extension for the health NLP community.\n\nThe soft spots are real and mostly addressable. The clipping constant C=0.1 is borrowed from Li et al. (2022) without tuning on MIMIC-III, and the noise multiplier is chosen just to keep epsilon under 10. Under group clipping, C=0.1 is a tight per-group budget, so the update may be dominated by clipping bias rather than by Gaussian noise. No ablation over C or epsilon is reported, and the private runs go to 20 epochs while non-private stops at 2. That does not mean the result is false, but it does mean the observed drop is not yet cleanly attributable to differential privacy itself. The fairness finding is similarly entangled: if the utility collapse is tuned away, the gender recall gap may also change. Also, there are no confidence intervals, 'parity' is never defined, and the gender recall gap numbers in the prose (3.6% and 3.4%) do not match Table 1 (3% and 4%). Minor, but would need fixing.\n\nBottom line: the qualitative direction is credible — DP at around epsilon 10 probably hurts LLM-based medical coding a lot — but the exact magnitude is not established. This paper is for researchers working on private fine-tuning for clinical text; they'll find it a useful first measurement, but they should not take the trade-off sizes as definitive.\n\nRecommendation: send it to peer review with a request for major revisions. The question is important, the work is new in this task space, and the missing ablations are straightforward to run. A small sweep over C holding epsilon constant, plus seeds for variance, would turn this into a solid finding.","headline":"First DP-SGD measurements on LLM-based ICD coding are useful, but the headline 40% F1 drop rests on a single untuned configuration and needs ablations before it can support the paper's broader conclusions.","tokens_in":9700,"tokens_out":3759,"would_cite":true,"duration_ms":34058,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Applying differential privacy to LLM fine-tuning for ICD coding on MIMIC-III top-50 labels at a privacy budget near epsilon = 10 cuts micro F1 by more than 40% and widens the gender recall gap by over 3 percentage points.","keywords":["differential privacy","DP-SGD","medical coding","ICD classification","MIMIC-III","fairness","large language models","privacy-utility trade-off"],"falsifier":"Sweep the clipping constant over a range such as 0.01 to 1.0 with the same noise multiplier, delta, and epoch budget on the same MIMIC-III top-50 split, keeping $\\epsilon$ under 10; if any configuration restores micro F1 to within a small margin of the non-private baselines (73.6% and 67.3%) while holding the gender recall gap near its non-private 0.0%–0.4% level, the paper's broad trade-off claim would be refuted for this setting.","tokens_in":8612,"feed_emoji":"🏥","tokens_out":13221,"duration_ms":99671,"temperature":0.7,"pith_summary":"The paper asks whether large language models can be fine-tuned with differential privacy for medical coding without losing accuracy or worsening disparities between patient groups. On the top-50 ICD coding task from MIMIC-III, the authors find that DP-SGD fine-tuning at a privacy loss below 10 drops micro F1 from 73.6% to 27.2% for GatorTron and from 67.3% to 30.8% for Meditron. The gender recall gap grows from near zero to roughly 3.4 to 3.6 percentage points under privacy, while ethnicity gaps shift in opposite directions depending on the model. The paper takes these results as evidence that privacy-preserving medical coders face substantial utility and fairness costs in clinical text, extending earlier privacy-fairness findings from image and time-series data.","feed_headline":"DP fine-tuning cuts medical coding F1 by over 40%","feed_subtitle":"At epsilon ~10, micro F1 falls from ~74% to ~27% and the gender recall gap widens to ~3.5 points.","key_machinery":"The load-bearing mechanism is gradient-perturbation differential privacy via DP-SGD, implemented with ghost clipping and group-wise clipping. Ghost clipping computes per-example gradient norms efficiently without materializing full per-example gradients, and group clipping partitions the parameters into per-layer groups, each clipped to $C/\\sqrt{k}$ to lower the overhead of private fine-tuning. The privacy loss is computed with a numerical-composition privacy accountant, yielding an upper bound of $\\epsilon = 9.97$ at $\\delta$ equal to the inverse training-set size. The prediction model is the PLM-ICD architecture, which combines a domain-specific PLM encoder (Meditron-7b or GatorTron-large) with the LAAT label-attention head for multi-label classification.","core_discovery":"The central claim is that differentially private fine-tuning of medical LLMs for ICD classification is sharply costly on both utility and fairness even at a comparatively loose privacy budget ($\\epsilon \\approx 9.97$). Using DP-SGD with ghost clipping and group-wise clipping, the authors measure micro F1 falling from 73.6% to 27.2% (GatorTron) and from 67.3% to 30.8% (Meditron) on the top-50 MIMIC-III labels. Recall for female patients drops more than for male patients, widening the gender recall gap from 0.0% to 3.4% for GatorTron and from 0.4% to 3.6% for Meditron; ethnicity effects are mixed, with privacy worsening gaps for GatorTron but slightly improving them for Meditron. The paper reads these findings as extending the privacy-fairness trade-off, previously shown for imaging and time-series healthcare data, to the NLP task of medical coding.","pith_inferences":["Editorial inference: because the clipping constant is fixed at 0.1 from other tasks without tuning on MIMIC-III, a plausible reading is that better DP hyperparameter tuning (or per-layer clip norms) could recover part of the utility loss; the reported numbers reflect one untuned configuration, not necessarily the ceiling of DP medical coding.","Editorial inference: the Meditron ethnicity result suggests the privacy-fairness interaction depends on the model and its pretraining distribution; a natural next experiment is to test whether these patterns persist across model scales and across alternative clinical PLMs.","Editorial inference: a testable extension would separate the epoch count from the DP mechanism by training private and non-private models for the same number of epochs, since the paper trains private models for up to 20 epochs while non-private models reach their optimum at 2."],"forward_implications":["At $\\epsilon \\approx 10$, DP-SGD fine-tuning of medical LLMs does not currently match non-private ICD coding accuracy on MIMIC-III; micro F1 falls below 31% for both tested models.","The privacy-fairness trade-off observed in imaging and time-series healthcare data also appears in clinical text, at least for gender, with female patients' recall falling more than male patients' under DP.","The effect of DP on ethnicity gaps is not consistent across models, so fairness conclusions about protected groups in private medical coders are model-dependent.","If these trade-offs hold, deploying privacy-preserving LLM medical coders in practice requires accepting large utility loss or developing new methods to recover both accuracy and group fairness."],"supporting_citations":[{"why":"Defines DP-SGD gradient clipping and noise addition, the core privacy mechanism the paper applies.","marker":"(Abadi et al., 2016)"},{"why":"Supplies the ghost-clipping implementation and the fixed clipping constant 0.1 the private runs inherit without tuning.","marker":"(Li et al., 2022)"},{"why":"Provides group-wise clipping, the low-overhead clipping strategy the paper uses to make private fine-tuning feasible.","marker":"(Bu et al., 2023a)"},{"why":"Provides the fastDP library implementation that the paper largely follows for private training.","marker":"(Bu et al., 2023b)"},{"why":"Provides the numerical-composition privacy accountant used to compute the epsilon ≈ 9.97 privacy bound.","marker":"(Gopi et al., 2021)"},{"why":"Establishes the privacy-fairness trade-off in healthcare on non-text data, the claim this paper extends to NLP.","marker":"(Suriyakumar et al., 2021)"},{"why":"Defines the PLM-ICD architecture with segment-wise processing that the paper follows for ICD coding.","marker":"(Huang et al., 2022)"},{"why":"Provides the LAAT label attention module that forms the classification head on top of the PLM encoder.","marker":"(Vu et al., 2020)"},{"why":"Supplies the MIMIC-III dataset of discharge summaries used for the top-50 ICD classification experiments.","marker":"(Johnson et al., 2016)"},{"why":"Establishes the top-50 label and 70/15/15 data-split protocol that the paper adopts for comparability.","marker":"(Mullenbach et al., 2018)"}],"fun_headline_variants":["DP fine-tuning slashes medical coding F1 by over 40%","Differential privacy costs medical coders 40% F1","Privacy-preserving LLMs lose 40% F1 in medical coding","DP LLMs in medical coding: accuracy drops 40%, bias rises","LLM medical coding under DP: F1 down 40%, gender gap up"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the specific DP configuration used here (clip constant 0.1 borrowed from other tasks, noise multiplier 0.05, and up to 20 private epochs) stands in for differential privacy in general, so the measured utility drop and fairness gap are attributed to DP itself rather than to an untuned hyperparameter choice.","fun_headline_variants_meta":{"raw":{"variants":["DP fine-tuning slashes medical coding F1 by over 40%","Differential privacy costs medical coders 40% F1","Privacy-preserving LLMs lose 40% F1 in medical coding","DP LLMs in medical coding: accuracy drops 40%, bias rises","LLM medical coding under DP: F1 down 40%, gender gap up"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000482,"raw_usage":{"total_tokens":2354,"prompt_tokens":891,"completion_tokens":1463,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":507,"completion_tokens_details":{"reasoning_tokens":1367}},"tokens_in":507,"tokens_out":1463,"duration_ms":8995,"temperature":1.0,"reasoning_tokens":1367,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T20:37:28.233195+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Sweep the clipping constant over a range such as 0.01 to 1.0 with the same noise multiplier, delta, and epoch budget on the same MIMIC-III top-50 split, keeping $\\epsilon$ under 10; if any configuration restores micro F1 to within a small margin of the non-private baselines (73.6% and 67.3%) while holding the gender recall gap near its non-private 0.0%–0.4% level, the paper's broad trade-off claim would be refuted for this setting.","supporting_citations":[],"review_version":1}