Recent research indicates that medical AI models are susceptible to membership inference attacks (MIAs), which can expose sensitive patient data. The risk is not uniformly distributed, with underrepresented populations facing higher probabilities of re-identification.

近期研究指出，醫療 AI 模型容易受到成員推理攻擊（MIA）的影響，可能導致敏感患者數據外洩。此風險並非均勻分佈，代表性不足的人群面臨更高的重新識別機率。

The vulnerability of medical AI stems from the capacity of membership inference attacks (MIAs) to determine if a specific patient's data was utilized during model training. While traditional assessments have focused on aggregate success rates, this study demonstrates that such metrics obscure significant individual-level risks. By employing likelihood-ratio MIAs (LR-MIAs) and robust variants (RMIA) across seven diverse clinical datasets—including electronic health records and medical imaging—researchers identified a subset of patients for whom attack success was nearly absolute.

醫療 AI 的漏洞源於成員推理攻擊（MIA）能夠判定特定患者的數據是否被用於模型訓練。雖然傳統評估側重於整體成功率，但本研究證明此類指標掩蓋了顯著的個體層級風險。研究人員在七個不同的臨床數據集（包括電子健康紀錄與醫療影像）中採用似然比 MIA（LR-MIAs）及其強健變體（RMIA），發現部分患者被攻擊成功的機率幾乎達到絕對值。

Institutional implications are further complicated by the correlation between model capacity and privacy erosion. The data suggest that as model complexity increases—specifically when transitioning to vision transformers—the proportion of highly vulnerable patients expands by orders of magnitude. This indicates a fundamental tension between the pursuit of maximal diagnostic precision and the maintenance of patient confidentiality, particularly for rare clinical presentations.

機構層面的影響則因模型容量與隱私侵蝕之間的相關性而更趨複雜。數據顯示，隨著模型複雜度增加——特別是在轉向視覺轉換器（Vision Transformers）時——高風險患者的比例呈數量級增長。這表明在追求最高診斷精準度與維持患者機密性之間存在根本緊張關係，對於罕見臨床病例而言尤甚。

Furthermore, the research identifies a systemic disparity in risk distribution. A meta-analysis of Pearson residuals reveals that underrepresented subgroups—stratified by race, insurance status, and disease prevalence—are disproportionately represented in the extreme-risk tail of the distribution. This phenomenon is attributed to the necessity for models to fit atypical, long-tailed data points to achieve optimal performance. Consequently, the deployment of these models without rigorous mitigation may exacerbate existing health inequalities by placing a heavier privacy burden on marginalized populations.

此外，研究發現風險分佈存在系統性差異。對 Pearson 殘差的元分析顯示，按種族、保險狀態和疾病盛行率分層的代表性不足亞組，在分佈的極端風險尾端佔比最高。此現象歸因於模型必須擬合非典型的長尾數據點以實現最佳性能。因此，若在缺乏嚴格緩解措施的情況下部署這些模型，可能會增加邊緣化人群的隱私負擔，進而加劇現有的健康不平等。

The study concludes that current aggregate privacy reporting is insufficient. It advocates for the adoption of patient-level differential privacy (DP) and strict access controls to mitigate the risk of sensitive data extraction.

研究結論認為目前的整體隱私報告不足。建議採用患者層級的差分隱私（DP）與嚴格的存取控制，以降低敏感數據被提取的風險。