Privacy aware rewriting improves safety of synthetic medical records
Exploring The Empirical Privacy Landscape of Synthetic Data
Cryptography and SecurityComputation and Language
Summary
When training AI models on sensitive medical data, there is a risk that private information can leak out. The authors compare ways to reduce this risk while keeping the AI useful. They find that creating synthetic medical records with careful rewriting of sensitive details better protects privacy than other training methods. More advanced rewriting models tend to reduce privacy risks, but the improvements can be inconsistent depending on computation used. Their work shows that rewriting data in a privacy-aware way can better balance usefulness and privacy than previous approaches.
What this means in practice
- •For hospital data teams: Generate synthetic patient records with reduced privacy risks using privacy-aware rewriting techniques to support safer data sharing and analysis.
- •For healthcare software developers: Develop synthetic data generation tools that incorporate uniqueness-aware rewriting instructions to enhance privacy protection while preserving data usefulness.
Tested on simulated data.
Authors
Zihao Zhao, Avi Schwarzschild, Casey Meehan, Katherine Lee, Zhili Feng, Dylan Sam
Abstract
Methods for training language models on sensitive data differ in how they balance capability gains against the risk of leaking private information. In this paper, we present a controlled comparison of data-level and training-level interventions for navigating the capability-privacy tradeoff on synthetic medical records with canaries to probe for leakage. Direct finetuning performs best on capability metrics but leads to the most privacy leakage, while DP-SGD reduces leakage at substantial cost to capabilities. Generating synthetic data from these records offers a more favorable balance, particularly when guided by a uniqueness-aware instruction to replace private details. Relative to naive paraphrasing, privacy-aware rewriting improves privacy protection across a variety of different rewriting models. We also find that more capable rewriting models generally reduce the risks of downstream privacy leakage, although held-out fit does not improve monotonically and increased test-time compute yields inconsistent gains. Overall, these results highlight privacy-aware rewriting as a promising direction for achieving a more favorable trade-off between capabilities and empirical privacy compared to other training-level methods, and our evaluation framework supports comparisons of future models and methods.