Diffusion models reveal privacy and fairness issues in synthetic medical images
A Data-Interventional Framework for Auditing Privacy and Fairness in Generative Medical Imaging
Computer Vision and Pattern Recognition
Summary
Creating fake medical images using diffusion models can help share data without risking patient privacy. However, the authors find that these models either remember rare patient details, risking privacy, or ignore unusual features altogether, causing unfair results. They introduced special fake features to test the models and discovered these features rarely generalize to new images. The authors also created a method to estimate how much the models memorize data without needing to extract it directly, helping improve privacy and fairness.
What this means in practice
- •For hospital data teams: Assess and improve synthetic medical image generation to reduce patient data leaks and ensure diverse feature representation.
- •For medical ai developers: Use the authors’ metric and controlled probes to audit and mitigate memorization and bias in generative medical imaging models.
Authors
Mischa Dombrowski, Bernhard Kainz
Abstract
Diffusion-based synthetic data generation offers a promising route for sharing medical imaging data without releasing sensitive patient records. However, generative models face a fundamental tension between privacy and fairness: they may memorize rare training samples, leading to privacy risks, or fail to reproduce underrepresented features, resulting in unfair synthetic distributions. While prior work has largely focused on either memorization or fairness in isolation, their interaction remains insufficiently understood. In this work, we introduce a data-interventional framework to systematically analyze privacy and fairness in diffusion models. We discuss synthetic anatomical fingerprints (SAFs), rare and manually injected image features, as controlled probes to study whether models generalize sensitive attributes across identities, memorize training samples, or suppress rare signals entirely. Across multiple conditioning modalities, we observe a consistent behavior: models either forget these fingerprints or memorize the entire image in which they appear, but do not generalize them to novel images. To support large-scale auditing where explicit sample extraction is infeasible, we further introduce the indicator metric t', which estimates a model's susceptibility to memorization by exploiting the internal structure of the diffusion process. By comparing conditioning signals of varying surprisal, we reveal a clear relationship between conditioning rarity and memorization behavior. Highly surprising conditioning signals act as retrieval keys that amplify memorization, whereas low-surprisal conditioning signals systematically suppress rare features, even when these appear repeatedly in the training data. Our findings provide actionable insights and concrete mitigation strategies for safe and fair synthetic medical data sharing. Code is available at https://github.com/MischaD/Privacy.