Federated Learning in Radiology Reports Faces Significant Privacy Leakage

Federated learning (FL) is a promising technology for training AI models on sensitive clinical data, like radiology reports, without directly sharing raw patient information across institutions. However, concerns exist about potential privacy breaches, specifically through gradient inversion attacks, where malicious actors could reconstruct original data from the shared model updates. The extent of this risk, particularly in radiology reports and the role of tokenizer choices, has been unclear. Researchers conducted a comparative evaluation to quantify this privacy risk. They trained GPT-2-style transformers on public radiology corpora using FL, testing three different tokenizers (GPT-2, RadBERT, LLaMA-2) and varying batch sizes. An active malicious server was simulated to perform analytic gradient inversion, attempting to reconstruct the original text. The findings indicate significant privacy leakage, with exact sentence reconstruction rates ranging from 31% to 44% across different tokenizers, datasets, and batch sizes. Even at larger batch sizes, substantial portions of report text were recoverable. RadBERT, a domain-specific tokenizer, showed the highest reconstruction fidelity and recovered more clinical terms. This research underscores that tokenizer design is a critical privacy-relevant decision, not just a utility one, and suggests that additional safeguards like secure aggregation and differential privacy are essential for FL in healthcare to meet regulatory requirements like HIPAA and GDPR.