Pith. sign in

REVIEW 4 major objections 4 minor 49 references

A malicious server can reconstruct 31–44% of radiology report sentences from federated-learning gradients, and the domain-specific RadBERT tokenizer leaks the most clinical terms.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-02 02:48 UTC pith:JZ7Y2DXF

load-bearing objection Careful setup, but the headline exact-recovery rates rest on an unexplained binning regime and are contradicted by the paper's own re-run. the 4 major comments →

arxiv 2607.14205 v1 pith:JZ7Y2DXF submitted 2026-07-15 cs.LG cs.CLcs.CR

Privacy Leakage in Federated Learning in Radiology Reports: A Comparative Evaluation of Tokenizer-Driven Privacy Risks

Santhosh Parampottupadam , Andres Martinez , Dimitrios Bounias , Sinem Sav , Klaus Maier-Hein , Ralf Floca This is my paper
classification cs.LG cs.CLcs.CR
keywords federated learninggradient inversionprivacy leakagetokenizer designradiology reportsclinical NLPtransformerdifferential privacy
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Federated learning lets hospitals train shared models without moving raw reports, but the paper claims this protection collapses under a worst-case adversary: a malicious server that quietly inserts a small probe into the model can read patient text out of the gradients clients send back. Across three tokenizers and batch sizes of 64–256, 31–44% of sentences were reconstructed exactly, and up to 18% of a 1,440-term clinical vocabulary—diagnoses, procedures, medications—was recovered. The central finding is that tokenizer design is a privacy variable: the radiology-specific RadBERT tokenizer recovered the most clinical terms, while the general-purpose LLaMA-2 leaked the least, and no tokenizer prevented leakage. Larger batches softened but never stopped the attack. If correct, this means federated radiology NLP needs active defenses, and domain-adapted tokenizers carry a privacy cost that audits should measure.

Core claim

Under an active malicious-server threat model (server modifies the shared model before distribution), the paper demonstrates that a linear 'imprint' probe placed before positional embedding makes token-level embeddings recoverable in closed form from batch-averaged gradient updates: each token's hidden vector is estimated as the ratio of the probe's weight and bias gradients per cumulative bin, then decoded to the nearest token in the tokenizer's embedding table. With the model architecture fixed, the authors vary only the tokenizer (GPT-2, RadBERT, LLaMA-2) and report exact sentence reconstruction of 30.6–43.5% across 27 tokenizer-dataset-batch-size cells, RadBERT giving the highest fidelit

What carries the argument

The key mechanism is the imprint probe: a two-layer linear module with K=1000 cumulative-Laplace bins inserted between token embedding and positional encoding, so each token's pre-mixing hidden vector triggers a distinct bin. From the probe's weight and bias gradients returned by the client, the server computes each token embedding in closed form as \hat{x} = ∇W_i/∇b_i after consecutive-bin differencing, then decodes via nearest-neighbour cosine search against the active tokenizer's embedding table, with language-model-head logits breaking ties. Its role is to convert the batch-averaged gradient—generally not invertible—into per-token analytic recovery. Tokenizer vocabulary segmentation is t

Load-bearing premise

The load-bearing premise is that each imprint bin is activated by at most one token so that \hat{x}=∇W_i/∇b_i recovers a single token embedding—yet every tested batch size puts 2–8 tokens per bin on average, and the paper's own re-run fails to reproduce the headline accuracies, so the exact-reconstruction numbers rest on an unvalidated multi-occupancy decoding assumption.

What would settle it

Compute, for a real training batch, the per-bin occupancy; then test whether every exactly reconstructed sentence's tokens all came from singly-occupied bins. If exact decodes occur for tokens sharing bins, the closed-form mechanism is not responsible; if they are restricted to singly-occupied tokens, the 31–44% sentence rates exceed what the mechanism allows at these batch sizes and the attack surface is overstated.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • A malicious server can reconstruct complete sentences and clinically meaningful terms from a single client's FedAvg gradient update, even with batch size 256 and no access to activations.
  • Tokenizer choice is a privacy decision: domain-specific vocabularies that bundle clinical entities into single tokens increase leakage severity, so privacy audits of clinical models should report leakage per tokenizer.
  • None of the three tested tokenizers prevents leakage; the implication is that secure aggregation or calibrated differential privacy is needed for federated radiology NLP to approach HIPAA/GDPR compliance.
  • Larger batch sizes reduce but do not remove leakage; even at the coarsest aggregation, about one in three sentences is fully recovered under the worst-case threat model.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The paper's own verification re-run (Appendix 8) reports exact-sentence accuracies that differ substantially from the headline numbers (e.g., 64.7% vs 42.1% for GPT-2/Discharge/B=64), so the absolute rates should be read as pipeline-sensitive; the monotone batch-size trend and RadBERT > GPT-2 > LLaMA-2 ordering survive more robustly.
  • The closed-form recovery rule is proven only for singly-occupied bins, yet all tested batches average 2–8 tokens per bin; an independent derivation of decodes under multi-occupancy, or a per-bin occupancy audit, is needed to validate the reported rates.
  • A direct testable extension: increase K (bin count) relative to batch size; the birthday-paradox argument predicts leakage should track the fraction of singly-occupied bins, which can be measured and compared against observed exact-reconstruction rates.
  • If the RadBERT-vs-LLaMA-2 ordering holds in defended settings, it suggests domain adaptation and privacy hardening may be in tension in medical NLP, informing how regulators audit federated clinical models.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper reports a federated-learning gradient-inversion study on radiology reports, holding a 3-layer GPT-2-style transformer fixed and varying three tokenizers (GPT-2, RadBERT, LLaMA-2) at batch sizes 64, 128, and 256 across three public corpora (Dischargesum, Diagnosis, MIMIC-CXR). Under an active malicious-server threat model, the authors insert an imprint probe and use the closed-form recovery x̂ = ∇W_i / ∇b_i (Eq. 2), then measure exact sentence accuracy, S-BLEU, G-BLEU, ROUGE-L, and clinical-entity recall via MedGemma. They report exact sentence reconstruction of 31–44%, with RadBERT generally highest and no tokenizer preventing leakage, concluding that tokenizer design is a privacy-relevant axis in FL for radiology NLP. The manuscript also contains a Limitations note and a verification re-run (Multimedia Appendix 8) whose numbers differ substantially from the primary results and which describes a different attack mechanism.

Significance. If the reported results were correct, this would be a valuable first tokenizer-controlled benchmark for text gradient inversion in clinical FL: the architecture is held fixed, the threat model is clearly specified, the datasets are public, and clinical-entity leakage is quantified separately from generic BLEU overlap. However, the central quantitative claims are undermined by internal inconsistencies and by the inability of the described mechanism to produce the reported exact-recovery rates. The tokenizer comparison, which is the paper's main contribution, is not statistically supported by the verification data. The paper is therefore not publishable in its current form; the contribution could only be salvaged after a consistent re-execution, a corrected attack description, and public per-seed results.

major comments (4)
  1. [Background & Preliminaries, 'Clarification on the cumulative-bin regime'] Equation (2) is exact only when each of K=1000 bins is activated by at most one token. The 'Clarification' allocates bins over the full B×T token pool (T=32), so at B=64 there are 2048 tokens and expected occupancy 2.05/bin; at B=256, 8.19/bin. The next sentence says the 'strict single-occupancy regime (B<K)' holds at B=64, which is inconsistent with the preceding sentence. The reported exact-sentence accuracies of 30–44% therefore lack a supporting derivation. For uniformly random token-bin assignment, the probability that all 32 tokens of a sentence fall in singly occupied bins is ~10^-28, so ~42% exact sentences cannot be explained by the described single-occupancy mechanism, and the 'blurred but non-vacuous' multi-occupancy claim is not derived. This is load-bearing for the headline.
  2. [Multimedia Appendix 8 and Limitations] As acknowledged in the Limitations, the verification re-run yields exact-sentence values that differ dramatically from the primary tables: Table A8-1 gives GPT-2 Discharge B=64 as 64.69% vs Appendix 1's 42.1%, RadBERT 70.00 vs 42.3, and sBLEU at B=64 is roughly 0.66 vs 0.44. The main text states these values 'should not be interpreted as reproducing' the primary results. Since both are supposed to be the same pipeline with the same seeds, the primary numbers are not reproducible. Appendix 8 also describes the attack as using 'per-position cumulative-bin disentanglement,' while the main-text clarification says bins are allocated globally over the batch; these are different mechanisms. The implemented attack is therefore unspecified and inconsistent.
  3. [Results and Multimedia Appendix 8, Table A8-2] The comparative claim that RadBERT 'consistently achieved higher reconstruction scores' is contradicted by the paper's own verification: of 27 paired tokenizer comparisons, only one reaches p<0.05 (GPT-2 vs RadBERT at B=64 on MIMIC-CXR), and at B=64 the re-run point estimates favor GPT-2 over RadBERT on MIMIC-CXR and Diagnosis. The main text reports per-cell standard deviations below 1 percentage point, but Table A8-1 reports SDs of 2–7 percentage points. No per-seed data are provided for the original five-run experiment. The tokenizer ordering, which is the central contribution, is therefore not statistically supported by the material in the manuscript.
  4. [Evaluation Metrics and Tables 1–3] Exact-sentence accuracy requires every token to match ground truth, yet the qualitative tables contain many [DROP] positions. It is not explained whether sentences containing [DROP] are excluded from the denominator, whether oracle alignment is used in scoring (the attacker does not have it), or how terminal-punctuation segmentation interacts with dropped token positions. The exact-sentence numbers in Appendix 1 cannot be interpreted without this information.
minor comments (4)
  1. [Data Availability] Code is available only 'upon reasonable request.' For a study whose central numbers are contested by its own verification appendix, a public repository with the attack implementation and per-seed results is necessary for reproducibility.
  2. [Discussion, 'Why batch size reduces leakage'] The statement that increasing K relative to B 'would partially compensate' is a plausible conjecture but is not tested; it should be explicitly labeled as speculation or supported by an experiment.
  3. [Abstract vs Appendix 1] The abstract quotes 31–44% exact sentence reconstruction, while Appendix 1 gives 30.6–43.5% across the 27 cells. Both appear in the text; ensure the ranges are consistent and clearly defined.
  4. [Multimedia Appendix 6] The 95% confidence intervals are computed from the stated upper-bound SD of 1 percentage point, not from the actual per-cell SDs. If the original per-seed SDs are not available, this should be stated more prominently; the Appendix 8 SDs of 2–7 pp suggest the intervals are misleadingly narrow.

Circularity Check

1 steps flagged

No derivation-chain circularity; tokenizer comparison partly restates vocabulary segmentation, but central leakage measurement is independent.

specific steps
  1. renaming known result [Attack Implementation, Step 5 ('Design for fair tokenizer comparison'); Discussion, 'Mechanism — why domain-specific tokenization heightens reconstruction'; Abstract/Table 4.]
    "Because decoding uses each tokenizer’s own embedding table, reconstruction fidelity reflects vocabulary segmentation and tokenizer-induced exposure (single token entities vs fragmented subwords)."

    The clinical-term recall metric counts exact surface-form matches against a 1,440-term reference. Since RadBERT's vocabulary encodes those surface forms as single tokens, nearest-neighbor decoding against RadBERT's own embedding table is more likely to output the exact surface form; the 'RadBERT recovers the most clinical terms (18.1%)' result is therefore a restatement of vocabulary granularity rather than an independent empirical discovery about gradient leakage. The paper itself concedes the dependence. This does not make the exact-sentence-recovery measurement circular—those are ground-truth comparisons—but the headline tokenizer-comparison conclusion is partly definitional.

full rationale

The paper's inversion chain is a closed-form construction (Eq. 2) inherited from cited prior work, not a fit to the data it later 'predicts'; no fitted parameter is renamed as a prediction. The central claim that substantial report text is recoverable is a direct measurement against ground-truth sentences and does not reduce to the attack's inputs. The tokenizer comparison is the only circularity-adjacent element: decoding via each tokenizer's own embedding table means that vocabularies storing clinical terms as single tokens trivially yield higher clinical-term recall, as the paper explicitly acknowledges. Self-citations are minor and not load-bearing. The Appendix 8 verification discrepancy and the multi-occupancy issue (B=64 gives 2048 tokens for 1000 bins) are serious correctness/reproducibility concerns but are not circularity; they do not change the fact that the reported rates are empirical measurements. Score 2 reflects one low-severity definitional aspect while the core leakage finding retains independent content.

Axiom & Free-Parameter Ledger

4 free parameters · 5 axioms · 0 invented entities

The ledger shows that the central quantitative claims rest on hand-chosen attack hyperparameters (K, L, epsilon, delta) and on the single-occupancy bin premise, which the paper's own occupancy arithmetic contradicts. The domain assumptions (observed gradients, unverified architecture, no defenses) are explicit and standard for worst-case gradient-inversion studies, but they mean the numbers are an upper-bound attack rate under a strong adversary, not expected leakage. The MedGemma recall estimate depends on a saturation claim for a 100-report sample that is not fully demonstrated.

free parameters (4)
  • Imprint bin count K = 1000
    Hand-chosen; the attack's claimed exactness requires K to exceed the number of tokens in a batch, but at B=64 the batch contains 2048 tokens, so average occupancy is ~2.05 tokens per bin.
  • Sequence length L = 32 tokens
    Fixed to the Field Guide baseline; all leakage rates are conditional on this short-window regime, and the authors state longer sequences are expected to be harder to attack.
  • Numerical ridge epsilon = 10^-8 (main text) / 10^-6 (Appendix 7)
    Denominator stabilization; two different values are stated in different sections of the paper.
  • Tie-break cosine margin delta
    Logit re-scoring is described for near-ties, but no numerical margin is reported, so this decoding step is underspecified.
axioms (5)
  • domain assumption The server observes per-client, per-round weight and bias gradients under standard FedAvg/FedSGD with no defenses.
    Threat-model capabilities C1–C3; the attack surface disappears under secure aggregation or differential privacy.
  • domain assumption Clients do not verify model architecture, so the server's inserted imprint probe is accepted and trained.
    The paper notes the ~193K-parameter probe is detectable by a parameter-size audit, so this is a deployment-policy premise rather than a fundamental property.
  • standard math The cumulative-bin imprint construction recovers token embeddings from gradient ratios ∇W_i/∇b_i when each bin is singly occupied.
    Analytic result taken from prior work (Fowl et al., 'Robbing the Fed'); the paper applies it without re-derivation.
  • ad hoc to paper Each of the K=1000 probe bins is activated by at most one token in the batch in the evaluated configurations.
    The exact-recovery formula requires this, but the paper's own occupancy count (B×T tokens vs K bins) gives 2.05–8.19 tokens per bin at B=64–256, so the premise is violated at every tested batch size.
  • domain assumption The 100-report MedGemma reference vocabulary of 1,440 unique entities is saturated and representative for clinical-entity recall.
    NER recall is reported only for discharge summaries; saturation is asserted from pilot analyses that are not shown, and extension to Diagnosis/MIMIC-CXR is explicitly deferred.

pith-pipeline@v1.3.0-alltime-deepseek · 23780 in / 18991 out tokens · 180791 ms · 2026-08-02T02:48:35.384604+00:00 · methodology

0 comments
read the original abstract

Federated learning (FL) enables multi-institutional training on clinical text without sharing raw data, but gradient inversion can reconstruct sensitive information from shared model updates. The extent of this leakage for radiology reports, and the role of tokenizer design, remains unclear. We quantify gradient-based text reconstruction in FL and compare privacy risk across three tokenizers with the model architecture held fixed. Six FL clients trained a GPT-2-style transformer (sequence length 32) on public radiology corpora (368,751 diagnostic reports, 98,206 discharge summaries, 1,500 MIMIC-CXR free-text reports) using the GPT-2, RadBERT, and LLaMA-2 tokenizers at batch sizes of 64, 128, and 256. Assuming an active malicious server that modifies the shared architecture before distribution, we applied analytic gradient inversion and measured reconstruction fidelity over five runs. Exact sentence reconstruction ranged from 31% to 44% across tokenizers (30.6-43.5% across the 27 tokenizer x dataset x batch-size cells). At batch size 64 on the Discharge dataset, accuracy was 42.1% (GPT-2), 42.3% (RadBERT), and 39.4% (LLaMA-2), decreasing to 37.3%, 37.2%, and 34.3% at batch size 256. S-BLEU declined as batch size grew (GPT-2: 0.44 to 0.33; RadBERT: 0.48 to 0.35). RadBERT yielded the highest reconstruction fidelity and recovered the most clinical terms (18.1% of a 1,440-term reference vocabulary, vs 12.5% for GPT-2 and 9.4% for LLaMA-2), yet no tokenizer prevented leakage. Substantial portions of report text are therefore recoverable from FL gradients even at larger batch sizes and with domain-specific tokenizers. Tokenizer design influences leakage severity and is a privacy-relevant decision, not only a utility one; safeguards such as secure aggregation and differential privacy are likely necessary to meet HIPAA and GDPR requirements for FL in radiology NLP.

Figures

Figures reproduced from arXiv: 2607.14205 by Andres Martinez, Dimitrios Bounias, Klaus Maier-Hein, Ralf Floca, Santhosh Parampottupadam, Sinem Sav.

Figure 1
Figure 1. Figure 1: Gradient-inversion attack pathway in federated radiology NLP. A malicious central server coordinates model training across multiple hospitals. By inserting a lightweight linear probe at the embedding stage, the server exposes token-level representations and, from the probe’s gradi￾ents, reconstructs token embeddings in closed form. Decoding these embeddings via the tokenizer’s embedding table yields patien… view at source ↗
Figure 2
Figure 2. Figure 2: Reconstruction fidelity across datasets and tokenizers at varying batch sizes. Top row: S-BLEU scores; second row: ROUGE-L scores; third row: G-BLEU scores; bottom row: Exact Sentence Reconstruction Accuracy scores. Each column corresponds to a dataset (Discharge, Diagnosis, and MIMIC-CXR), and colors indicate tokenizers (GPT-2, RadBERT, and LLaMA-2). Across all metrics and datasets, RadBERT consistently a… view at source ↗
Figure 3
Figure 3. Figure 3: Violin plots showing the distribution of S-BLEU scores across five runs for each tokenizer (GPT-2, RadBERT, and LLaMA-2) on three datasets: Discharge, Diagnosis, and MIMIC-CXR. Each violin represents performance at a given batch size (64, 128, 256), with color-coded distinctions shown in the legend. The plots illustrate both central tendency and variability, highlighting that RadBERT consistently achieved … view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

49 extracted references · 10 canonical work pages · 5 internal anchors

  1. [1]

    The effect of clinical information on radiology reporting: A systematic review

    Castillo C, Steffens T, Sim L, Caffery L. The effect of clinical information on radiology reporting: A systematic review. J Med Radiat Sci Wiley; 2021 Mar;68(1):60–74

    2021

  2. [2]

    Large language models in medicine

    Thirunavukarasu AJ, Ting DSJ, Elangovan K, Gutierrez L, Tan TF, Ting DSW. Large language models in medicine. Nat Med Nature Publishing Group US New York; 2023;29(8):1930–1940

    2023

  3. [3]

    Improving language understanding by generative pre-training

    Radford A, Narasimhan K. Improving language understanding by generative pre-training. 2018. Available from:https://api.semanticscholar.org/CorpusID:49313245

    2018

  4. [4]

    Revolutionizing radiology with GPT-based models: current ap- plications, future possibilities and limitations of ChatGPT

    Lecler A, Duron L, Soyer P. Revolutionizing radiology with GPT-based models: current ap- plications, future possibilities and limitations of ChatGPT. Diagn Interv Imaging Elsevier; 2023;104(6):269–274

    2023

  5. [5]

    Large language models in summarizing radiology re- port impressions for lung cancer in Chinese: evaluation study

    Hu D, Zhang S, Liu Q, Zhu X, Liu B. Large language models in summarizing radiology re- port impressions for lung cancer in Chinese: evaluation study. J Med Internet Res 2025 Apr 3;27:e65547. doi: 10.2196/65547

    work page doi:10.2196/65547 2025

  6. [6]

    Evaluating large language models for automated reporting and data systems categorization: cross-sectional study

    Wu Q, Wu Q, Li H, Wang Y, Bai Y, Wu Y, Yu X, Li X, Dong P, Xue J, Shen D, Wang M. Evaluating large language models for automated reporting and data systems categorization: cross-sectional study. JMIR Med Inform 2024 July 17;12:e55799. doi: 10.2196/55799

    work page doi:10.2196/55799 2024

  7. [7]

    A systematic review of large language model (LLM) evaluations in clinical medicine

    Shool S, Adimi S, Saboori Amleshi R, Bitaraf E, Golpira R, Tara M. A systematic review of large language model (LLM) evaluations in clinical medicine. BMC Med Inform Decis Mak 2025 Mar 7;25(1):117. doi: 10.1186/s12911-025-02954-4

    doi:10.1186/s12911-025-02954-4 2025

  8. [8]

    The HIPAA Privacy Rule

    hhs.gov. The HIPAA Privacy Rule. Available from:https://www.hhs.gov/hipaa/for-profe ssionals/privacy/index.html

  9. [9]

    General Data Protection Regulation (GDPR)

    gdpr.eu. General Data Protection Regulation (GDPR). Available from:https://gdpr.eu/ta g/gdpr/

  10. [10]

    Communication-efficient learning of deep networks from decentralized data

    McMahan B, Moore E, Ramage D, Hampson S, y Arcas BA. Communication-efficient learning of deep networks from decentralized data. Artif Intell Stat PMLR; 2017. p. 1273–1282

    2017

  11. [11]

    Continually tuning a large language model for multi-domain radiology report generation

    Sun Y, Khor HG, Wang Y, Wang Z, Zhao H, Zhang Y, Ma L, Zheng Z, Liao H. Continually tuning a large language model for multi-domain radiology report generation. Int Conf Med Image Comput Comput-Assist Interv Springer; 2024. p. 177–187

    2024

  12. [12]

    Chatbots and large language models in radiology: a practical primer for clinical and research applications

    Bhayana R. Chatbots and large language models in radiology: a practical primer for clinical and research applications. Radiology Radiological Society of North America; 2024;310(1):e232756

    2024

  13. [13]

    Large language models in radiology: fundamentals, applications, ethical considerations, risks, and future directions

    D’Antonoli TA, Stanzione A, Bluethgen C, Vernuccio F, Ugga L, Klontzas ME, Cuocolo R, Cannella R, Koçak B. Large language models in radiology: fundamentals, applications, ethical considerations, risks, and future directions. Diagn Interv Radiol 2024;30(2):80

    2024

  14. [14]

    Leveraging foundation and large language models in medical artificial intelligence

    Wong IN, Monteiro O, Baptista-Hon DT, Wang K, Lu W, Sun Z, Nie S, Yin Y. Leveraging foundation and large language models in medical artificial intelligence. Chin Med J (Engl) 2024;137(21):2529–2539

    2024

  15. [15]

    Client security alone fails in federated learning: 2D and 3D attack insights

    Parampottupadam S, Floca R, Bounias D, Hamm B, Roy S, Sav S, Zenk M, Maier-Hein K. Client security alone fails in federated learning: 2D and 3D attack insights. MICCAI EMERGE Workshop 2024, Marrakesh, Morocco. Springer; 2024. p. 235–244

    2024

  16. [16]

    Federated machine learning, privacy-enhancing technologies, and 26 data protection laws in medical research: scoping review

    Brauneck A, Schmalhorst L, Kazemi Majdabadi MM, Bakhtiari M, Völker U, Baumbach J, Baumbach L, Buchholtz G. Federated machine learning, privacy-enhancing technologies, and 26 data protection laws in medical research: scoping review. J Med Internet Res 2023 Mar 30;25:e41588. doi: 10.2196/41588

    doi:10.2196/41588 2023

  17. [17]

    Personalized and privacy- preserving federated heterogeneous medical image analysis with PPPML-HMI

    Zhou J, Zhou L, Wang D, Xu X, Li H, Chu Y, Han W, Gao X. Personalized and privacy- preserving federated heterogeneous medical image analysis with PPPML-HMI. Comput Biol Med 2024 Feb;169:107861. doi: 10.1016/j.compbiomed.2023.107861

    arXiv 2024

  18. [18]

    End-to-end privacy preserving deep learning on multi-institutional medical imaging

    Kaissis G, Ziller A, Passerat-Palmbach J, Ryffel T, Usynin D, Trask A, Lima Jr I, Man- cuso J, Jungmann F, Steinborn M-M, others. End-to-end privacy preserving deep learning on multi-institutional medical imaging. Nat Mach Intell Nature Publishing Group UK London; 2021;3(6):473–484

    2021

  19. [19]

    Do gradient inversion attacks make federated learning unsafe? IEEE Trans Med Imaging IEEE; 2023

    Hatamizadeh A, Yin H, Molchanov P, Myronenko A, Li W, Dogra P, Feng A, Flores MG, Kautz J, Xu D, others. Do gradient inversion attacks make federated learning unsafe? IEEE Trans Med Imaging IEEE; 2023

    2023

  20. [20]

    A new era of text mining in radiology with privacy- preserving LLMs

    Akinci D’Antonoli T, Bluethgen C. A new era of text mining in radiology with privacy- preserving LLMs. Radiol Artif Intell Radiological Society of North America; 2024;6(4):e240261

    2024

  21. [21]

    Domain- specific language model pretraining for biomedical natural language processing

    Gu Y, Tinn R, Cheng H, Lucas M, Usuyama N, Liu X, Naumann T, Gao J, Poon H. Domain- specific language model pretraining for biomedical natural language processing. ACM Trans Comput Healthc 2021;3(1):1–23

    2021

  22. [22]

    arXiv preprint arXiv:2310.14558; 2023

    ZhangX,TianC,YangX,ChenL,LiZ,PetzoldLR.Alpacare: Instruction-tunedlargelanguage models for medical application. arXiv preprint arXiv:2310.14558; 2023. Available from:https: //arxiv.org/abs/2310.14558

    Pith/arXiv arXiv 2023

  23. [23]

    RadiolArtifIntell2022July1;4(4):e210258

    YanA,McAuleyJ,LuX,DuJ,ChangEY,GentiliA,HsuC-N.RadBERT:adaptingtransformer- basedlanguagemodelstoradiology. RadiolArtifIntell2022July1;4(4):e210258. doi: 10.1148/ryai.210258

    doi:10.1148/ryai.210258

  24. [25]

    Llama 2: Open foundation and fine-tuned chat models

    Touvron H, Martin L, Stone K, Albert P, Almahairi A, Babaei Y, Bashlykov N, Batra S, Bhargava P, Bhosale S, others. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288; 2023. Available from:https://arxiv.org/abs/2307.09288

    Pith/arXiv arXiv 2023

  25. [26]

    iDLG: improved deep leakage from gradients

    Zhao B, Mopuri KR, Bilen H. iDLG: improved deep leakage from gradients. arXiv; 2020. doi: 10.48550/arXiv.2001.02610

    Pith/arXiv arXiv doi:10.48550/arxiv.2001.02610 2020

  26. [27]

    MedGemmatechnicalreport

    Sellergren A, Kazemzadeh S, Jaroensri T, Kiraly A, Traverse M, Kohlberger T, Xu S, Jamil F, HughesC,LauC,others. MedGemmatechnicalreport. arXiv; 2025. doi: 10.48550/arXiv.2507.05201

    Pith/arXiv arXiv doi:10.48550/arxiv.2507.05201 2025

  27. [28]

    Dischargesum Dataset

    Peng C. Dischargesum Dataset. 2024. Available from:https://huggingface.co/discharge sum

    2024

  28. [29]

    MIMIC-CXR-JPG, a large publicly available database of labeled chest radiographs

    Johnson AEW, Pollard TJ, Greenbaum NR, Lungren MP, Deng C, Peng Y, Lu Z, Mark RG, Berkowitz SJ, Horng S. MIMIC-CXR-JPG, a large publicly available database of labeled chest radiographs. 2019. Available from:https://arxiv.org/abs/1901.07042

    Pith/arXiv arXiv 2019

  29. [30]

    BLEU: a method for automatic evaluation of machine translation

    Papineni K, Roukos S, Ward T, Zhu W-J. BLEU: a method for automatic evaluation of machine translation. Proc 40th Annu Meet Assoc Comput Linguist USA: Association for Computational Linguistics; 2002. p. 311–318. doi: 10.3115/1073083.1073135

    arXiv 2002

  30. [31]

    Overview of the RadSum23 shared task on multi-modal and multi-anatomical radiology report summarization

    Delbrouck J-B, Varma M, Chambon P, Langlotz C. Overview of the RadSum23 shared task on multi-modal and multi-anatomical radiology report summarization. 22nd Workshop Biomed 27 Nat Lang Process BioNLP Shar Tasks Toronto, Canada: Association for Computational Lin- guistics; 2023. p. 478–482. doi: 10.18653/v1/2023.bionlp-1.45

    work page doi:10.18653/v1/2023.bionlp-1.45 2023

  31. [32]

    Clinical text summarization: adapting large language models can outperform human experts

    Veen DV, Uden CV, Blankemeier L, Delbrouck J-B, Aali A, Bluethgen C, Pareek A, Polacin M, Reis EP, Seehofnerova A, Rohatgi N, Hosamani P, Collins W, Ahuja N, Langlotz C, Hom J, Gatidis S, Pauly J, Chaudhari A. Clinical text summarization: adapting large language models can outperform human experts. In Review; 2023. doi: 10.21203/rs.3.rs-3483777/v1

    work page doi:10.21203/rs.3.rs-3483777/v1 2023

  32. [33]

    ROUGE: a package for automatic evaluation of summaries

    Lin C-Y. ROUGE: a package for automatic evaluation of summaries. Annu Meet Assoc Comput Linguist 2004. Available from:https://api.semanticscholar.org/CorpusID:964287

    2004

  33. [34]

    Differential Privacy

    Dwork C. Differential Privacy. In: Bugliesi M, Preneel B, Sassone V, Wegener I, editors. Autom Lang Program Berlin, Heidelberg: Springer Berlin Heidelberg; 2006. p. 1–12

    2006

  34. [35]

    Practical secure aggregation for privacy-preserving machine learning

    Bonawitz K, Ivanov V, Kreuter B, Marcedone A, McMahan HB, Patel S, Ramage D, Segal A, Seth K. Practical secure aggregation for privacy-preserving machine learning. Proc 2017 ACM SIGSAC Conf Comput Commun Secur New York, NY, USA: Association for Computing Machinery; 2017. p. 1175–1191. doi: 10.1145/3133956.3133982

    arXiv 2017

  35. [36]

    ACM Trans Intell Syst Technol 2023 Dec 31;14(6):1–32

    ZhangX,KangY,ChenK,FanL,YangQ.Tradingoffprivacy, utility, andefficiencyinfederated learning. ACM Trans Intell Syst Technol 2023 Dec 31;14(6):1–32. doi: 10.1145/3595185

    work page doi:10.1145/3595185 2023

  36. [37]

    Generated Data with Fake Privacy: Hidden Dangers of Fine-tuning Large Language Models on Generated Data

    Akkus A, Aghdam MP, Li M, Chu J, Backes M, Zhang Y, Sav S. Generated data with fake privacy: hidden dangers of fine-tuning large language models on generated data. arXiv; 2024. doi: 10.48550/arXiv.2409.11423

    work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.2409.11423 2024

  37. [38]

    Synthetic data — anonymisation groundhog day

    Stadler T, Oprisanu B, Troncoso C. Synthetic data — anonymisation groundhog day. arXiv

  38. [39]

    Evaluating differentially private machine learning in practice

    Jayaraman B, Evans D. Evaluating differentially private machine learning in practice. arXiv

  39. [40]

    Cluster Based Secure Multi-Party Computation in Federated Learning for Histopathology Images

    Hosseini SM, Sikaroudi M, Babaei M, Tizhoosh HR. Cluster based secure multi-party computa- tioninfederatedlearningforhistopathologyimages. arXiv; 2022. doi: 10.48550/arXiv.2208.10919

    work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.2208.10919 2022

  40. [41]

    A scoping review of privacy and utility metrics in medical synthetic data

    Kaabachi B, Despraz J, Meurers T, Otte K, Halilovic M, Kulynych B, Prasser F, Raisaro JL. A scoping review of privacy and utility metrics in medical synthetic data. Npj Digit Med 2025 Jan 27;8(1):60. doi: 10.1038/s41746-024-01359-3

    doi:10.1038/s41746-024-01359-3 2025

  41. [42]

    doi: 10.48550/arXiv.1902.08874

    work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.1902.08874 1902

  42. [43]

    Inverting gradients — how easy is it to break privacy in federated learning? Advances in Neural Information Processing Systems (NeurIPS) 2020; 2020

    Geiping J, Bauermeister H, Dröge H, Moeller M. Inverting gradients — how easy is it to break privacy in federated learning? Advances in Neural Information Processing Systems (NeurIPS) 2020; 2020. Available from:https://arxiv.org/abs/2003.14053

    Pith/arXiv arXiv 2020

  43. [44]

    Advances and open problems in federated learning

    Kairouz P, McMahan HB, Avent B, et al. Advances and open problems in federated learning. Foundations and Trends in Machine Learning, vol. 14, no. 1-2; 2021. doi: 10.1561/2200000083

    doi:10.1561/2200000083 2021

  44. [45]

    Robbing the Fed: directly obtaining private data in federated learning with modified models

    Fowl L, Geiping J, Czaja W, Goldblum M, Goldstein T. Robbing the Fed: directly obtaining private data in federated learning with modified models. International Conference on Learning Representations (ICLR) 2022; 2022. Available from:https://arxiv.org/abs/2110.13057

    Pith/arXiv arXiv 2022

  45. [46]

    TAG: Gradient Attack on Transformer-based Language Models

    Deng J, Wang Y, Li J, Shang C, Qin C, Liu H, Rajasekaran S, Ding C. TAG: gradient attack on transformer-basedlanguagemodels. FindingsofEMNLP2021; 2021. doi: 10.48550/arXiv.2103.06819 28

    work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.2103.06819 2021

  46. [47]

    Deep leakage from gradients

    Zhu L, Liu Z, Han S. Deep leakage from gradients. Advances in Neural Information Processing Systems (NeurIPS) 2019; 2019. doi: 10.48550/arXiv.1906.08935 29 Multimedia Appendices Multimedia Appendix 1 Exact sentence-level reconstruction accuracy (%) across batch sizes (64, 128, 256) for three tokenizers (GPT-2, RadBERT, and LLaMA-2) on three radiology data...

    Pith/arXiv arXiv doi:10.48550/arxiv.1906.08935 2019

  47. [48]

    When the curious abandon honesty: federated learning is not private

    Boenisch F, Dziedzic A, Schuster R, Shamsabadi AS, Shumailov I, Papernot N. When the curious abandon honesty: federated learning is not private. IEEE European Symposium on Security and Privacy (EuroS&P) 2023; 2023

    2023

  48. [2019]

    Available from:https://arxiv.org/abs/1908.09203

    Pith/arXiv arXiv 1908

  49. [2020]

    doi: 10.48550/arXiv.2011.07018

    work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.2011.07018 2011