Privacy Leakage in Federated Learning in Radiology Reports: A Comparative Evaluation of Tokenizer-Driven Privacy Risks

Image generated by AI

TLDR

• What: An active malicious server can reconstruct up to 43.5% of private radiology text sentences by injecting a 193K-parameter analytic "imprint" probe before positional embeddings during federated training.
• Who's at risk: Decentralized medical/clinical NLP pipelines utilizing federated learning (FL) without cryptographic model attestation, secure aggregation, or differential privacy.
• Key number: Domain-specific tokenizers (RadBERT) leak up to 18.1% of unique clinical terms verbatim compared to only 9.4% under generalist tokenizers (LLaMA-2), revealing a direct trade-off between clinical utility and privacy.

Federated Learning (FL) is frequently championed as a promising privacy-preserving solution for clinical natural language processing. By allowing multi-institutional collaborations to train large language models (LLMs) on sensitive patient records without moving data off-premises, FL promises a path toward compliance with stringent regulations like HIPAA in the US and GDPR in the EU.

However, this architecture relies on a critical assumption: that shared gradient updates do not leak raw training data. Recent research has shown that gradient inversion attacks can reconstruct private text from generic language models, but their efficacy within highly specialized, clinical domains—and the impact of tokenizer selection—remains poorly understood.

A recent paper from researchers at the German Cancer Research Center (DKFZ) titled "Privacy Leakage in Federated Learning in Radiology Reports: A Comparative Evaluation of Tokenizer-Driven Privacy Risks" challenges the security of federated clinical NLP. The authors demonstrate that an active malicious-server threat model can analytically reconstruct substantial portions of private radiology reports. Crucially, they expose a counterintuitive security paradox: the more tailored a tokenizer is to clinical utility, the more vulnerable the system is to high-fidelity data reconstruction.

Threat Model

The paper evaluates a worst-case, active adversary model. Instead of a passive observer, the adversary is an active central server capable of altering the shared model structure.

Background & Related Work

Gradient leakage is a well-documented vulnerability in federated learning. However, previous studies have focused almost exclusively on computer vision or general-domain language models, leaving domain-specific vulnerabilities (and the critical role of tokenization) largely unquantified in clinical radiology.

The table below contrasts this study with established milestones in gradient-inversion literature:

Methodology: The Imprint Probe Attack

To isolate the effect of tokenization as the sole independent variable, the researchers kept the model architecture fixed: a 13.4M parameter GPT-2–style transformer encoder (3 layers, embedding dimension $m = 96$, 8 attention heads, feed-forward hidden size 1536, sequence length 32).

The attack exploits an "imprint" technique. The malicious server injects a lightweight linear probe (representing roughly 193K parameters, or 1.4% of the base model size) immediately after the token embedding lookup and before positional additions and attention mixing.

[Raw Input Tokens] 
       │
       ▼
[Embedding Lookup]
       │
       ▼
[Malicious Imprint Probe] ───► Captures weight/bias gradients per batch
       │
       ▼
[Positional Encoding & Attention]

The Mathematics of Inversion

The imprint module is defined as:

with $W_0 \in \mathbb{R}^{K \times m}$, $b_0 \in \mathbb{R}^K$, and $W_2 \in \mathbb{R}^{m \times K}$, where $K = k$ denotes the number of probe bins (set to 1,000 in this study).

The bias $b_0$ is initialized to the cumulative quantiles of a Laplace prior over the expected pre-activation distribution, and $W_0$ is set to a random Gaussian matrix. Under this construction, the bins partition the input space into cumulative half-spaces. Because the bins are structurally separated, the contribution of individual tokens to the weight gradient $\nabla_{W_0}\mathcal{L}$ and bias gradient $\nabla_{b_0}\mathcal{L}$ can be isolated, even when aggregated over a mini-batch of size $B$.

The input hidden vector $x$ for token $j$ is then recovered in closed form without any optimization:

where $i$ is the bin uniquely activated by token $j$ after the cumulative-bin differencing step:

Token Decoding and Position Recovery

1. Nearest-Neighbor Search: Each recovered vector $\hat{x}_j$ is decoded by performing a nearest-neighbour search over the active tokenizer's embedding table using cosine similarity (top-1).
2. Contextual Tie-Breaking: When multiple vocabulary entries are within a small cosine-similarity margin, the server breaks the tie by re-scoring candidates using the model's language-model-head logit at that position, computed in a server-side forward pass conditioned on the previously-decoded prefix.
3. Positional Recovery: The exact positions of the recovered embeddings are resolved using an optimal-assignment matching between recovered breached embeddings and the 32 known positional embeddings of the sequence, implemented using the Hungarian algorithm (scipy.optimize.linear_sum_assignment).

Key Results & The Tokenizer Paradox

The researchers evaluated three tokenizers on two public clinical and radiology corpora: Dischargesum (98,206 discharge summaries and 368,751 diagnostic reports) and a sample of 1,500 free-text radiology reports from MIMIC-CXR.

The three evaluated tokenizers were:

1. GPT-2 (50,257 tokens)
2. LLaMA-2-7B (32,000 tokens)
3. StanfordAIMI RadBERT (30,522 tokens)

Exact Sentence-Level Reconstruction

The experiments showed that regardless of the tokenizer used, a substantial portion of raw sentences can be perfectly reconstructed.

Below is the exact sentence-level reconstruction accuracy (%) across various batch sizes on the Discharge dataset:

• GPT-2 tokenizer: 42% / 40% / 37% at batch sizes 64 / 128 / 256
• RadBERT tokenizer: 42.3% / 40% / 37% at batch sizes 64 / 128 / 256
• LLaMA-2 tokenizer: 39.4% / 37% / 34% at batch sizes 64 / 128 / 256

On MIMIC-CXR, exact reconstruction ranged from 33% to 41% of sentences across configurations, showing that neither tokenizer choice nor larger batch sizes fully mitigates data leakage.

Why Domain Tokenizers Heighten Privacy Risks

The key finding of this paper is that RadBERT consistently yielded higher reconstruction fidelity (such as S-BLEU scores) and greater recovery of clinical terms.

To verify this, the authors used Google's MedGemma medical NER model on a random sample of 100 original discharge summaries to build a reference vocabulary of 1,440 unique clinical entity surface forms (diagnoses, procedures, anatomical structures, medications) and evaluated how many could be recovered from the reconstructed text.

As presented in Table 4, RadBERT reconstructions recovered the highest number of clinical terms:

This behavior stems from the mechanism of vocabulary segmentation:

• In RadBERT, a domain-specific clinical concept such as "pneumothorax" is encoded as a single token in its vocabulary. A successful nearest-neighbour decode yields the entire concept verbatim.
• In GPT-2's byte-pair encoding, the same concept is segmented into multiple subwords (e.g., "p / neu / moth / orax"). Reconstructing the concept requires all of its subword embeddings to be reconstructed correctly and placed in the correct positional order. Every fragmented subword introduces an additional point of failure.

Limitations & Skeptic's Corner

While the mathematical formulation of this attack is elegant, practitioners should analyze the practical threat model with care. Several constraints limit the generalizability of these findings:

1. Sequence Length: The evaluation used a sequence length of 32 tokens, which is shorter than typical clinical narrative passages. Longer sequences increase input dimensionality and make single-step reconstruction harder in practice.
2. Detectability of Active Modifications: The attack relies on injecting an active "imprint" layer. This layer adds approximately 193K parameters (roughly 1.4% of the base model size) and would be detectable by routine client-side parameter-size audits or cryptographic attestation of the model signature.
3. No Active Defenses Evaluated: This study deliberately focused on characterizing worst-case risks and did not implement or evaluate privacy-preserving defenses (such as secure aggregation, differential privacy, or anomaly detection) in the main experiments.

What Practitioners Should Do

If you are developing or deploying clinical language models via federated learning, implement robust safeguards to protect patient confidentiality:

1. Mandatory Client-Side Model Audits & Cryptographic Attestation

Do not allow clients to train models without verifying their architecture.

• Action: Implement client-side parameter auditing. Verify that the parameter count and tensor shapes match the agreed-upon architecture exactly to detect unauthorized architecture modifications like the imprint module.
• Protocol: Consider mandatory client-side architecture attestation as part of clinical FL audit protocols.

2. Implement Cryptographic Secure Aggregation (SecAgg)

The imprint attack requires the server to view individual client updates.

• Action: Enforce secure aggregation to mask individual updates. This ensures the central server can only observe the aggregated sum of gradients, concealing individual updates and disrupting the analytical recovery of per-sample gradients.

3. Integrate Differential Privacy (DP)

• Action: Apply DP-SGD by introducing gradient clipping and calibrated noise to model updates before they are shared.
• Trade-off: Carefully calibrate the DP noise levels, as clinical language models require high precision to maintain downstream utility for complex radiological terminology.

4. Evaluate Tokenizer-Driven Privacy Risks

• Action: Incorporate tokenizer design into privacy evaluations. Recognize that domain-specific tokenizers like RadBERT can heighten the recoverability of clinical concepts compared to generalist tokenizers, and treat tokenizer selection as a privacy-sensitive design decision.

The Takeaway

"Data-free" training in federated learning does not guarantee absolute privacy. The DKFZ paper proves that tokenizer design directly mediates privacy risk: optimizing a tokenizer for clinical domain performance inadvertently lowers the barrier for malicious gradient inversion. When building federated systems for medical NLP, the selection of vocabulary is not just a performance tuning parameter—it is a critical security design decision.

Den's Take

Federated learning (FL) in clinical NLP is often treated as a regulatory silver bullet, but this paper exposes how fragile that assumption really is. I appreciate this work because it bypasses generic theory to hit practitioners where it hurts: the tokenizer.

The realization that an active server can inject a tiny 193K-parameter analytic "imprint" probe and reconstruct up to 43.5% of private radiology text sentences is a massive wake-up call. More importantly, it highlights a cruel trade-off: optimizing a tokenizer for domain-specific utility (like RadBERT) leaks nearly double the unique clinical terms verbatim (18.1%) compared to a generalist tokenizer like LLaMA-2 (9.4%).

This systematic erosion of privacy under specialized architectures mirrors my prior analysis in Is External Database Protection Static in Retrieval-Augmented Generation? Rethinking Privacy Preservation under Dynamic Queries, where I explored how dynamic operational environments and query modifications fundamentally break static privacy boundaries.

If you are deploying decentralized clinical NLP pipelines using federated learning without implementing cryptographic model attestation or secure aggregation, you are practicing security theater. The privacy is an illusion, and the data is already leaking directly through your gradients.