New research shows that medical AI can leak patient secrets. Some patients have a higher risk than others.

新研究顯示醫療 AI 可能會洩漏患者的秘密，部分患者面臨的風險比其他人更高。

Bad people can use special attacks to find a patient's data in an AI model. This is a big problem for some people.

心術不正的人可以使用特殊攻擊方式，從 AI 模型中找出患者的數據。對於某些人來說，這是一個巨大的問題。

Big and complex AI models are more dangerous. They find more patterns, but they also leak more private information.

越大且越複雜的 AI 模型越危險。它們雖然能發現更多模式，但同時也會洩漏更多隱私資訊。

People from small groups have the most risk. This includes people with rare diseases or different races. The AI needs their data to learn, but this makes their secrets easy to find.

少數群體的人風險最高。這包括患有罕見疾病或不同種族的人。AI 需要他們的數據來學習，但這反而使他們的秘密容易被發現。

The study says we need better rules. We must use new tools to hide patient data and keep it safe.

研究指出我們需要更好的規範，必須使用新工具來隱藏患者數據並確保安全。

Recent research shows that medical AI models are vulnerable to membership inference attacks (MIAs), which can reveal private patient information. This risk is not the same for everyone, as people from underrepresented groups are more likely to have their identities exposed.

最近的研究顯示，醫療 AI 模型容易受到成員推理攻擊（MIAs）的影響，可能會洩漏病患的隱私資訊。這種風險對每個人並不相同，因為代表性不足的群體更有可能被揭露身份。

The problem begins with the ability of MIAs to determine if a specific patient's data was used to train an AI model. While most reports focus on average success rates, this study emphasizes that such numbers hide the high risks faced by individual patients. By testing seven different clinical datasets, including medical images and health records, researchers found that some patients were almost certain to be identified.

問題在於 MIAs 能夠判定特定病患的數據是否被用於訓練 AI 模型。雖然大多數報告集中在平均成功率，但本研究強調，此類數據掩蓋了個別病患所面臨的高風險。研究人員透過測試七個不同的臨床數據集（包括醫療影像與健康記錄），發現某些病患幾乎肯定會被識別出來。

Furthermore, the study suggests that as AI models become more complex, such as when using vision transformers, the number of vulnerable patients increases significantly. This creates a conflict between wanting the most accurate diagnosis and protecting patient privacy, especially for those with rare medical conditions.

此外，研究指出，隨著 AI 模型變得更加複雜（例如使用視覺轉換器時），易受攻擊的病患數量會顯著增加。這在追求最準確診斷與保護病患隱私之間製造了衝突，對於患有罕見疾病的人來說尤其如此。

Finally, the research highlights a systemic inequality in these risks. Patients from minority groups, based on race, insurance status, or rare diseases, face a much higher risk of data exposure. This happens because the AI must work harder to fit these unusual data points to perform well. Consequently, using these models without strong protections could increase health inequalities by putting marginalized populations at greater risk.

最後，研究強調了這些風險中的系統性不平等。基於種族、保險狀態或罕見疾病的少數群體病患，面臨數據洩漏的風險高得多。這是因為 AI 必須更努力地擬合這些不尋常的數據點以提升表現。因此，在缺乏強效保護的情況下使用這些模型，可能會讓邊緣化群體面臨更高風險，進而加劇健康不平等。

The study concludes that reporting average privacy levels is not enough. It recommends using patient-level differential privacy (DP) and strict access controls to prevent the theft of sensitive data.

研究結論認為，僅報告平均隱私水平是不夠的。研究建議使用病患級別的差分隱私（DP）和嚴格的訪問控制，以防止敏感數據被盜用。

Recent research indicates that medical AI models are susceptible to membership inference attacks (MIAs), which can expose sensitive patient data. The risk is not uniformly distributed, with underrepresented populations facing higher probabilities of re-identification.

近期研究指出，醫療 AI 模型容易受到成員推理攻擊（MIA）的影響，可能導致敏感患者數據外洩。此風險並非均勻分佈，代表性不足的人群面臨更高的重新識別機率。

The vulnerability of medical AI stems from the capacity of membership inference attacks (MIAs) to determine if a specific patient's data was utilized during model training. While traditional assessments have focused on aggregate success rates, this study demonstrates that such metrics obscure significant individual-level risks. By employing likelihood-ratio MIAs (LR-MIAs) and robust variants (RMIA) across seven diverse clinical datasets—including electronic health records and medical imaging—researchers identified a subset of patients for whom attack success was nearly absolute.

醫療 AI 的漏洞源於成員推理攻擊（MIA）能夠判定特定患者的數據是否被用於模型訓練。雖然傳統評估側重於整體成功率，但本研究證明此類指標掩蓋了顯著的個體層級風險。研究人員在七個不同的臨床數據集（包括電子健康紀錄與醫療影像）中採用似然比 MIA（LR-MIAs）及其強健變體（RMIA），發現部分患者被攻擊成功的機率幾乎達到絕對值。

Institutional implications are further complicated by the correlation between model capacity and privacy erosion. The data suggest that as model complexity increases—specifically when transitioning to vision transformers—the proportion of highly vulnerable patients expands by orders of magnitude. This indicates a fundamental tension between the pursuit of maximal diagnostic precision and the maintenance of patient confidentiality, particularly for rare clinical presentations.

機構層面的影響則因模型容量與隱私侵蝕之間的相關性而更趨複雜。數據顯示，隨著模型複雜度增加——特別是在轉向視覺轉換器（Vision Transformers）時——高風險患者的比例呈數量級增長。這表明在追求最高診斷精準度與維持患者機密性之間存在根本緊張關係，對於罕見臨床病例而言尤甚。

Furthermore, the research identifies a systemic disparity in risk distribution. A meta-analysis of Pearson residuals reveals that underrepresented subgroups—stratified by race, insurance status, and disease prevalence—are disproportionately represented in the extreme-risk tail of the distribution. This phenomenon is attributed to the necessity for models to fit atypical, long-tailed data points to achieve optimal performance. Consequently, the deployment of these models without rigorous mitigation may exacerbate existing health inequalities by placing a heavier privacy burden on marginalized populations.

此外，研究發現風險分佈存在系統性差異。對 Pearson 殘差的元分析顯示，按種族、保險狀態和疾病盛行率分層的代表性不足亞組，在分佈的極端風險尾端佔比最高。此現象歸因於模型必須擬合非典型的長尾數據點以實現最佳性能。因此，若在缺乏嚴格緩解措施的情況下部署這些模型，可能會增加邊緣化人群的隱私負擔，進而加劇現有的健康不平等。

The study concludes that current aggregate privacy reporting is insufficient. It advocates for the adoption of patient-level differential privacy (DP) and strict access controls to mitigate the risk of sensitive data extraction.

研究結論認為目前的整體隱私報告不足。建議採用患者層級的差分隱私（DP）與嚴格的存取控制，以降低敏感數據被提取的風險。