Can large language models be privacy preserving and fair medical coders?

Ali Dadsetan; Dorsa Soleymani; Frank Rudzicz; Xijie Zeng

REVIEW 4 major objections 5 minor 27 references

Can large language models be privacy preserving and fair medical coders?

T0 review · 4 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Applying differential privacy to LLM fine-tuning for ICD coding on MIMIC-III top-50 labels at a privacy budget near epsilon = 10 cuts micro F1 by more than 40% and widens the gender recall gap by over 3 percentage points.

desk verdict First DP-SGD measurements on LLM-based ICD coding are useful, but the headline 40% F1 drop rests on a single untuned configuration and needs ablations before it can support the paper's broader conclusions. read the letter →

arxiv 2412.05533 v1 pith:O5KK7X54 submitted 2024-12-07 cs.LG cs.CR

Ali Dadsetan , Dorsa Soleymani , Xijie Zeng , Frank Rudzicz This is my paper · ORCID

classification cs.LGcs.CR

keywords differentialprivacyDP-SGDmedicalcodingICDclassificationMIMIC-IIIfairnesslargelanguagemodelsprivacy-utilitytrade-off

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper asks whether large language models can be fine-tuned with differential privacy for medical coding without losing accuracy or worsening disparities between patient groups. On the top-50 ICD coding task from MIMIC-III, the authors find that DP-SGD fine-tuning at a privacy loss below 10 drops micro F1 from 73.6% to 27.2% for GatorTron and from 67.3% to 30.8% for Meditron. The gender recall gap grows from near zero to roughly 3.4 to 3.6 percentage points under privacy, while ethnicity gaps shift in opposite directions depending on the model. The paper takes these results as evidence that privacy-preserving medical coders face substantial utility and fairness costs in clinical text, extending earlier privacy-fairness findings from image and time-series data.

What carries the argument

The load-bearing mechanism is gradient-perturbation differential privacy via DP-SGD, implemented with ghost clipping and group-wise clipping. Ghost clipping computes per-example gradient norms efficiently without materializing full per-example gradients, and group clipping partitions the parameters into per-layer groups, each clipped to $C/\sqrt{k}$ to lower the overhead of private fine-tuning. The privacy loss is computed with a numerical-composition privacy accountant, yielding an upper bound of $\epsilon = 9.97$ at $\delta$ equal to the inverse training-set size. The prediction model is the PLM-ICD architecture, which combines a domain-specific PLM encoder (Meditron-7b or GatorTron-large) with the LAAT label-attention head for multi-label classification.

What would settle it

Sweep the clipping constant over a range such as 0.01 to 1.0 with the same noise multiplier, delta, and epoch budget on the same MIMIC-III top-50 split, keeping $\epsilon$ under 10; if any configuration restores micro F1 to within a small margin of the non-private baselines (73.6% and 67.3%) while holding the gender recall gap near its non-private 0.0%–0.4% level, the paper's broad trade-off claim would be refuted for this setting.

Watch

Extended reading notes

Core claim

The central claim is that differentially private fine-tuning of medical LLMs for ICD classification is sharply costly on both utility and fairness even at a comparatively loose privacy budget ($\epsilon \approx 9.97$). Using DP-SGD with ghost clipping and group-wise clipping, the authors measure micro F1 falling from 73.6% to 27.2% (GatorTron) and from 67.3% to 30.8% (Meditron) on the top-50 MIMIC-III labels. Recall for female patients drops more than for male patients, widening the gender recall gap from 0.0% to 3.4% for GatorTron and from 0.4% to 3.6% for Meditron; ethnicity effects are mixed, with privacy worsening gaps for GatorTron but slightly improving them for Meditron. The paper reads these findings as extending the privacy-fairness trade-off, previously shown for imaging and time-series healthcare data, to the NLP task of medical coding.

Load-bearing premise

The load-bearing premise is that the specific DP configuration used here (clip constant 0.1 borrowed from other tasks, noise multiplier 0.05, and up to 20 private epochs) stands in for differential privacy in general, so the measured utility drop and fairness gap are attributed to DP itself rather than to an untuned hyperparameter choice.

Editorial extensions

If this is right

At $\epsilon \approx 10$, DP-SGD fine-tuning of medical LLMs does not currently match non-private ICD coding accuracy on MIMIC-III; micro F1 falls below 31% for both tested models.
The privacy-fairness trade-off observed in imaging and time-series healthcare data also appears in clinical text, at least for gender, with female patients' recall falling more than male patients' under DP.
The effect of DP on ethnicity gaps is not consistent across models, so fairness conclusions about protected groups in private medical coders are model-dependent.
If these trade-offs hold, deploying privacy-preserving LLM medical coders in practice requires accepting large utility loss or developing new methods to recover both accuracy and group fairness.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial inference: because the clipping constant is fixed at 0.1 from other tasks without tuning on MIMIC-III, a plausible reading is that better DP hyperparameter tuning (or per-layer clip norms) could recover part of the utility loss; the reported numbers reflect one untuned configuration, not necessarily the ceiling of DP medical coding.
Editorial inference: the Meditron ethnicity result suggests the privacy-fairness interaction depends on the model and its pretraining distribution; a natural next experiment is to test whether these patterns persist across model scales and across alternative clinical PLMs.
Editorial inference: a testable extension would separate the epoch count from the DP mechanism by training private and non-private models for the same number of epochs, since the paper trains private models for up to 20 epochs while non-private models reach their optimum at 2.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: this is the first paper I know that applies DP-SGD to transformer-based ICD coders (Meditron-7b and Gatortron-large) on MIMIC-III top-50, and the question is genuinely important for deployment. But the headline numbers — more than 40% micro-F1 drop and roughly 3% gender recall gap widening at epsilon approx 10 — come from one private configuration, so treat them as preliminary rather than as a settled result.

What's good: the paper is clean and readable, uses a tight PRV accountant, makes code available, and gets competitive non-private baselines (Gatortron at 73.6% micro-F1). It correctly frames the result as reinforcing Suriyakumar et al.'s long-tail argument from image/time-series data in the text modality. That is a useful extension for the health NLP community.

The soft spots are real and mostly addressable. The clipping constant C=0.1 is borrowed from Li et al. (2022) without tuning on MIMIC-III, and the noise multiplier is chosen just to keep epsilon under 10. Under group clipping, C=0.1 is a tight per-group budget, so the update may be dominated by clipping bias rather than by Gaussian noise. No ablation over C or epsilon is reported, and the private runs go to 20 epochs while non-private stops at 2. That does not mean the result is false, but it does mean the observed drop is not yet cleanly attributable to differential privacy itself. The fairness finding is similarly entangled: if the utility collapse is tuned away, the gender recall gap may also change. Also, there are no confidence intervals, 'parity' is never defined, and the gender recall gap numbers in the prose (3.6% and 3.4%) do not match Table 1 (3% and 4%). Minor, but would need fixing.

Bottom line: the qualitative direction is credible — DP at around epsilon 10 probably hurts LLM-based medical coding a lot — but the exact magnitude is not established. This paper is for researchers working on private fine-tuning for clinical text; they'll find it a useful first measurement, but they should not take the trade-off sizes as definitive.

Recommendation: send it to peer review with a request for major revisions. The question is important, the work is new in this task space, and the missing ablations are straightforward to run. A small sweep over C holding epsilon constant, plus seeds for variance, would turn this into a solid finding.

Referee Report

4 major / 5 minor

Summary. This paper studies whether differentially private fine-tuning can preserve utility and fairness in LLM-based medical coding. Using the PLM-ICD architecture with Meditron-7B and Gatortron-large encoders, the authors fine-tune on the top-50 ICD labels of MIMIC-III with DP-SGD (ghost clipping plus group clipping, noise multiplier 0.05, clip constant 0.1, PRV-computed epsilon below 10) and compare micro-F1 and fairness metrics against non-private baselines. They report a more than 40% relative micro-F1 drop and an increase in the male/female recall gap from near zero to 3-4 percentage points. The paper interprets these results as evidence that privacy-preserving LLM medical coding suffers severe utility and fairness trade-offs, extending prior healthcare DP findings to the NLP setting.

Significance. If robust, the result is a valuable negative result for healthcare NLP: it suggests that DP-SGD at epsilon around 10 degrades LLM-based ICD coding much more than the small utility losses reported in non-healthcare sentence classification, and that the utility collapse can disproportionately affect female patients. The paper's strengths include using two domain-specific pretrained models, using the PRV accountant rather than a loose moments accountant, and releasing code. The main quantitative claims, however, are not yet supported because the DP configuration is a single untuned operating point, the private/non-private training schedules are asymmetric, and the fairness numbers in the text do not match the tables.

major comments (4)

[Section 3.3 and Section 2.1] The DP configuration is not shown to be representative of DP-SGD at epsilon approximately 9.97. The clipping constant C=0.1 is taken from Li et al. (2022) without tuning on MIMIC-III, and the noise multiplier sigma=0.05 is chosen only so that the PRV-computed epsilon stays below 10; no ablation over C or sigma is reported. Because group clipping bounds each of the k parameter groups to C/sqrt(k), C=0.1 can impose a very small per-group gradient budget for a 7B-parameter model, so the update may be dominated by clipping bias rather than by the Gaussian mechanism. Without at least a small sweep of C, with sigma recalibrated to the same privacy budget, the paper's attribution of the more than 40% drop to differential privacy itself is not established. This is load-bearing because the abstract and Section 4 state the trade-off as a property of privacy-preserving models, not of one configuration.
[Section 3.3 and Section 4] The comparison is asymmetric in training length: non-private models stop at the epoch-2 validation optimum, while private models run up to 20 epochs. The reported gap therefore conflates the effect of differential privacy with the effect of a much longer, noised training schedule. A private run with validation-based early stopping, or a non-private run at the same 20-epoch schedule, is needed to separate these factors. This is load-bearing for the quantitative claims in the abstract, since part of the observed drop could be due to training past the utility optimum in the private runs.
[Table 1, Abstract, and Section 4] The reported gender recall gaps are internally inconsistent. The text states that the Meditron gap increased from 0.4% to 3.6% and the Gatortron gap from 0.0% to 3.4%, but Table 1 shows non-private Meditron recall of 0.68/0.67 (a 1 percentage point gap) and private recall of 0.37/0.34 (a 3 percentage point gap); for Gatortron the table shows 0.72/0.72 (0 percentage points) and 0.20/0.16 (4 percentage points). The abstract's 'over 3%' does not match either reading. Because the fairness claim is one of the two headline results, the discrepancy must be resolved and the correct values reported consistently.
[Tables 1-2 and Section 4] All results are single runs with no confidence intervals or significance tests. The phrase 'significant performance drop' is not backed by any statistical test, and the fairness gaps in Tables 1 and 2 are differences between one DP run and one non-private run. The utility drop is large enough that it is probably robust, but the 3-4 percentage point fairness gaps could easily be within run-to-run variance. The authors should report multiple seeds with standard deviations, or at least a clear statement that the fairness comparison is anecdotal.

minor comments (5)

[Abstract and Section 4] Please align the quantitative claim in the abstract ('over 3%') with the exact recall-gap values in Table 1.
[Section 2.1] There are several typos, including 'LALAAT' for 'LAAT', 'assiging' for 'assigning', and 'efficint' for 'efficient'; the paper should be copy-edited.
[Section 3.3] The sentence 'we largely followed the Pytorch Extending approach in the fastDP library' is ambiguous; please specify which API or function is used.
[Section 3.3] The AdamW 'epsilon of 10^-5' should be named epsilon_opt or epsilon_adam to avoid confusion with the differential privacy parameter epsilon.
[Table 1] The model name is spelled 'Gatotron' in the table but 'Gatortron' in the text and model description; use one spelling consistently.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: the reported privacy-utility and privacy-fairness trade-offs are direct empirical measurements under a stated DP configuration, not derivations that reduce to their own inputs.

full rationale

The paper's central claims are empirical comparisons: DP-SGD fine-tuned models achieve micro F1 scores of 27.2% (Gatortron) and 30.8% (Meditron) versus 73.6% and 67.3% non-privately, and gender recall gaps widen from 0.4% to 3.6% (Meditron) and 0.0% to 3.4% (Gatortron). Nothing in the paper defines these outcomes in terms of a fitted parameter or a predicted quantity that was itself used as input. The privacy loss epsilon is computed with the external PRV accountant (Gopi et al., 2021) from the noise multiplier, number of updates, and sampling rate; it is not derived from the reported F1 or fairness numbers. The clipping constant C=0.1 is borrowed from Li et al. (2022) and the noise multiplier is chosen so that the PRV-computed epsilon stays below 10, but neither is fitted to the MIMIC-III validation or test outcomes, so the performance drop is a measured consequence of that configuration rather than a tautology. The uneven training schedules (2 epochs non-private versus up to 20 epochs private) and the untuned clipping constant are legitimate threats to the generalizability or representativeness of the result, but they are not circularity: they concern whether the observed drop is attributable to differential privacy itself, not whether the conclusion is presupposed by construction. A reviewer's critique on configuration choice belongs in a correctness or robustness assessment. Self-citations are minimal and not load-bearing: only Wang et al. (2024) shares an author with this paper, and it is not used to justify the privacy-fairness claim. Therefore, no circular step can be exhibited from the text, and the appropriate circularity score is 0.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The paper contributes an empirical measurement. Its quantitative claims depend on hyperparameter choices (noise multiplier, clip constant, epoch counts) and on assumptions that the top-50 subset and micro-recall gaps represent utility and fairness. These are stated or standard choices, not hidden fitted values, so the ledger is short.

free parameters (5)

noise multiplier = 0.05
Chosen so that the PRV accountant gives epsilon below 10; not tuned to the ICD coding task.
clipping constant C = 0.1
Taken from Li et al. (2022), stated as optimal for other tasks; not validated on MIMIC-III.
private epochs = 20 (no improvement after convergence)
Maximum epochs for private runs; non-private runs stop at 2 epochs based on validation.
learning rate = 5e-5
AdamW learning rate used for all runs.
top-K labels = 50
Subset of most frequent ICD-9 codes; all reported metrics are on this subset.

assumptions (4)

standard math DP-SGD with PRV accounting provides the stated epsilon and delta privacy guarantees.
Invoked in Section 3.3 when computing final privacy loss of 9.97.
domain assumption Group clipping, with groups as weights and biases of linear layers, preserves the per-example gradient norm bound and hence the DP guarantee.
Stated in Section 2.1 and 3.3; relies on Bu et al. (2023a) results.
domain assumption Micro-F1 on the top-50 ICD codes is a meaningful measure of medical coding utility.
Used throughout Section 4; the top-50 subset omits the long tail that is central to real ICD coding.
domain assumption Gender and ethnicity recall gaps measured on the test set capture the fairness impact of DP.
Fairness analysis in Section 3.3 and Tables 1 and 2; no statistical test or confidence interval is reported.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Can large language models be privacy preserving and fair medical coders?." pith.science (2026). https://pith.science/paper/O5KK7X54

@misc{pith2026241205533,
  author       = {Pith},
  title        = {Pith review of: Can large language models be privacy preserving and fair medical coders?},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/O5KK7X54}},
  note         = {Machine review of arXiv:2412.05533}
}

read the original abstract

Protecting patient data privacy is a critical concern when deploying machine learning algorithms in healthcare. Differential privacy (DP) is a common method for preserving privacy in such settings and, in this work, we examine two key trade-offs in applying DP to the NLP task of medical coding (ICD classification). Regarding the privacy-utility trade-off, we observe a significant performance drop in the privacy preserving models, with more than a 40% reduction in micro F1 scores on the top 50 labels in the MIMIC-III dataset. From the perspective of the privacy-fairness trade-off, we also observe an increase of over 3% in the recall gap between male and female patients in the DP models. Further understanding these trade-offs will help towards the challenges of real-world deployment.

Figures

Figures reproduced from arXiv: 2412.05533 by the authors.

**Figure 1.** Comparison of F1 score between models trained with DP and models trained regularly. There is a clear decrease in performance of the privacy preserving models [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗

**Figure 2.** Comparison of gender gap in F1 score between models trained with DP and models trained regularly. The gender gap is clearly increased in privacy preserving models. 7 [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗

**Figure 3.** Comparison of ethnicity gap, between white and black ethnicity, in F1 score between models trained with DP and models trained regularly. The ethnicity gap is increased in gatortron, and decreased in meditron. Similar results hold for other ethnicity pairs. 3. Removed standalone numbers; for example, ’120mg’ was retained, while ’700’ was excluded. 4. Removed extra whitespace to ensure clean text. 5. Removed rows … view at source ↗

Figures from the paper (1 more)

**Figure 4.** Figure 4: Pre-processing flow chart. 9 [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

27 extracted references · 8 canonical work pages

[1]

Deep learning with differential privacy

Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pages 308--318, 2016

2016
[2]

On the accuracy and efficiency of group-wise clipping in differentially private optimization

Zhiqi Bu, Ruixuan Liu, Yu-Xiang Wang, Sheng Zha, and George Karypis. On the accuracy and efficiency of group-wise clipping in differentially private optimization. arXiv preprint arXiv:2310.19215, 2023 a

arXiv 2023
[3]

Differentially private optimization on large model at small cost

Zhiqi Bu, Yu-Xiang Wang, Sheng Zha, and George Karypis. Differentially private optimization on large model at small cost. In International Conference on Machine Learning, pages 3192--3218. PMLR, 2023 b

work page 2023
[4]

Extracting training data from large language models

Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21), pages 2633--2650, 2021

2021
[5]

Membership inference attacks from first principles

Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. In 2022 IEEE Symposium on Security and Privacy (SP), pages 1897--1914. IEEE, 2022

work page 2022
[6]

Meditron-70b: Scaling medical pretraining for large language models

Zeming Chen, Alejandro Hern \'a ndez Cano, Angelika Romanou, Antoine Bonnet, Kyle Matoba, Francesco Salvi, Matteo Pagliardini, Simin Fan, Andreas K \"o pf, Amirkeivan Mohtashami, et al. Meditron-70b: Scaling medical pretraining for large language models. arXiv preprint arXiv:2311.16079, 2023

arXiv 2023
[7]

The algorithmic foundations of differential privacy

Cynthia Dwork, Aaron Roth, et al. The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science , 9 0 (3--4): 0 211--407, 2014

2014
[9]

Havtorn, Lasse Borgholt, Maria Maistro, Tuukka Ruotsalo, and Lars Maaløe

Joakim Edin, Alexander Junge, Jakob D. Havtorn, Lasse Borgholt, Maria Maistro, Tuukka Ruotsalo, and Lars Maaløe. Automated Medical Coding on MIMIC - III and MIMIC - IV : A Critical Review and Replicability Study . In Proceedings of the 46th International ACM SIGIR Conference on Research and Development in Information Retrieval , Taipei, Taiwan, 2023 b . A...

arXiv 2023

Show all 27 references

[10]

Numerical composition of differential privacy

Sivakanth Gopi, Yin Tat Lee, and Lukas Wutschitz. Numerical composition of differential privacy. Advances in Neural Information Processing Systems, 34: 0 11631--11642, 2021

2021
[11]

PLM - ICD : Automatic ICD coding with pretrained language models

Chao-Wei Huang, Shang-Chi Tsai, and Yun-Nung Chen. PLM - ICD : Automatic ICD coding with pretrained language models. In Tristan Naumann, Steven Bethard, Kirk Roberts, and Anna Rumshisky, editors, Proceedings of the 4th Clinical Natural Language Processing Workshop, pages 10--2...

2022 doi
[12]

Mimic-iii, a freely accessible critical care database

Alistair EW Johnson, Tom J Pollard, Lu Shen, Li-wei H Lehman, Mengling Feng, Mohammad Ghassemi, Benjamin Moody, Peter Szolovits, Leo Anthony Celi, and Roger G Mark. Mimic-iii, a freely accessible critical care database. Scientific data, 3 0 (1): 0 1--9, 2016

2016
[13]

Computing tight differential privacy guarantees using fft

Antti Koskela, Joonas J \"a lk \"o , and Antti Honkela. Computing tight differential privacy guarantees using fft. In International Conference on Artificial Intelligence and Statistics, pages 2560--2569. PMLR, 2020

2020
[14]

ICD coding from clinical text using multi-filter residual convolutional neural network, 2019

Fei Li and Hong Yu. ICD coding from clinical text using multi-filter residual convolutional neural network, 2019. URL https://arxiv.org/abs/1912.00862

2019 arXiv
[15]

Large language models can be strong differentially private learners

Xuechen Li, Florian Tramer, Percy Liang, and Tatsunori Hashimoto. Large language models can be strong differentially private learners. In International Conference on Learning Representations, 2022. URL https://openreview.net/forum?id=bVuP3ltATMz

2022
[16]

Learning differentially private recurrent language models

H Brendan McMahan, Daniel Ramage, Kunal Talwar, and Li Zhang. Learning differentially private recurrent language models. arXiv preprint arXiv:1710.06963, 2017

2017 arXiv
[17]

Quantifying privacy risks of masked language models using membership inference attacks

Fatemehsadat Mireshghallah, Kartik Goyal, Archit Uniyal, Taylor Berg-Kirkpatrick, and Reza Shokri. Quantifying privacy risks of masked language models using membership inference attacks. In Yoav Goldberg, Zornitsa Kozareva, and Yue Zhang, editors, Proceedings of the 2022 Confe...

2022 doi
[18]

R \'e nyi differential privacy of the sampled gaussian mechanism

Ilya Mironov, Kunal Talwar, and Li Zhang. R \'e nyi differential privacy of the sampled gaussian mechanism. arXiv preprint arXiv:1908.10530, 2019

1908 arXiv
[19]

Explainable prediction of medical codes from clinical text

James Mullenbach, Sarah Wiegreffe, Jon Duke, Jimeng Sun, and Jacob Eisenstein. Explainable prediction of medical codes from clinical text. In Proceedings of the 2018 Conference of the North A merican Chapter of the Association for Computational Linguistics: Human Language Tech...

2018 doi
[20]

Deepspeed: System optimizations enable training deep learning models with over 100 billion parameters

Jeff Rasley, Samyam Rajbhandari, Olatunji Ruwase, and Yuxiong He. Deepspeed: System optimizations enable training deep learning models with over 100 billion parameters. In Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, page 35...

2020
[21]

Suriyakumar, Nicolas Papernot, Anna Goldenberg, and Marzyeh Ghassemi

Vinith M. Suriyakumar, Nicolas Papernot, Anna Goldenberg, and Marzyeh Ghassemi. Chasing your long tails: Differentially private prediction in health care settings. FAccT '21, page 723–734, New York, NY, USA, 2021. Association for Computing Machinery. ISBN 9781450383097. doi:10...

2021
[22]

A label attention model for ICD coding from clinical text

Thanh Vu, Dat Quoc Nguyen, and Anthony Nguyen. A label attention model for ICD coding from clinical text. arXiv preprint arXiv:2007.06351, 2020

2007 arXiv
[23]

Multi-stage retrieve and re-rank model for automatic medical coding recommendation

Xindi Wang, Robert Mercer, and Frank Rudzicz. Multi-stage retrieve and re-rank model for automatic medical coding recommendation. In NAACL, 2024

2024
[24]

Subsampled r \'e nyi differential privacy and analytical moments accountant

Yu-Xiang Wang, Borja Balle, and Shiva Prasad Kasiviswanathan. Subsampled r \'e nyi differential privacy and analytical moments accountant. In The 22nd international conference on artificial intelligence and statistics, pages 1226--1235. PMLR, 2019

2019
[25]

Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Scao, Sylvain Gugger, Mari...

2020 arXiv
[26]

Yu, and Yangyong Zhu

Xiancheng Xie, Yun Xiong, Philip S. Yu, and Yangyong Zhu. EHR coding with multi-scale feature attention and structured knowledge graph propagation. In Proceedings of the 28th ACM International Conference on Information and Knowledge Management, page 649–658, New York, NY, USA,...

2019
[27]

A large language model for electronic health records

Xi Yang, Aokun Chen, Nima PourNejatian, Hoo Chang Shin, Kaleb E Smith, Christopher Parisien, Colin Compas, Cheryl Martin, Anthony B Costa, Mona G Flores, Ying Zhang, Tanja Magoc, Christopher A Harle, Gloria Lipori, Duane A Mitchell, William R Hogan, Elizabeth A Shenkman, Jiang...

2022
[28]

Knowledge injected prompt based fine-tuning for multi-label few-shot ICD coding

Zhichao Yang, Shufan Wang, Bhanu Pratap Singh Rawat, Avijit Mitra, and Hong Yu. Knowledge injected prompt based fine-tuning for multi-label few-shot ICD coding. In Yoav Goldberg, Zornitsa Kozareva, and Yue Zhang, editors, Findings of the Association for Computational Linguisti...

2022 doi

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [1]

Deep learning with differential privacy

Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pages 308--318, 2016

2016

[2] [2]

On the accuracy and efficiency of group-wise clipping in differentially private optimization

Zhiqi Bu, Ruixuan Liu, Yu-Xiang Wang, Sheng Zha, and George Karypis. On the accuracy and efficiency of group-wise clipping in differentially private optimization. arXiv preprint arXiv:2310.19215, 2023 a

arXiv 2023

[3] [3]

Differentially private optimization on large model at small cost

Zhiqi Bu, Yu-Xiang Wang, Sheng Zha, and George Karypis. Differentially private optimization on large model at small cost. In International Conference on Machine Learning, pages 3192--3218. PMLR, 2023 b

work page 2023

[4] [4]

Extracting training data from large language models

Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21), pages 2633--2650, 2021

2021

[5] [5]

Membership inference attacks from first principles

Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. In 2022 IEEE Symposium on Security and Privacy (SP), pages 1897--1914. IEEE, 2022

work page 2022

[6] [6]

Meditron-70b: Scaling medical pretraining for large language models

Zeming Chen, Alejandro Hern \'a ndez Cano, Angelika Romanou, Antoine Bonnet, Kyle Matoba, Francesco Salvi, Matteo Pagliardini, Simin Fan, Andreas K \"o pf, Amirkeivan Mohtashami, et al. Meditron-70b: Scaling medical pretraining for large language models. arXiv preprint arXiv:2311.16079, 2023

arXiv 2023

[7] [7]

The algorithmic foundations of differential privacy

Cynthia Dwork, Aaron Roth, et al. The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science , 9 0 (3--4): 0 211--407, 2014

2014

[8] [9]

Havtorn, Lasse Borgholt, Maria Maistro, Tuukka Ruotsalo, and Lars Maaløe

Joakim Edin, Alexander Junge, Jakob D. Havtorn, Lasse Borgholt, Maria Maistro, Tuukka Ruotsalo, and Lars Maaløe. Automated Medical Coding on MIMIC - III and MIMIC - IV : A Critical Review and Replicability Study . In Proceedings of the 46th International ACM SIGIR Conference on Research and Development in Information Retrieval , Taipei, Taiwan, 2023 b . A...

arXiv 2023