Differential privacy for medical deep learning: methods, tradeoffs, and deployment implications

In plain words

Medical AI models learn from patient records, and a model can sometimes leak details about the people it was trained on. Differential privacy is a way of training so that no single patient's record changes the result much. The usual recipe is to clip each patient's contribution to the learning signal and add random noise. More noise means more privacy and usually a less accurate model.

This paper is a literature review rather than a new method. The authors read 74 published studies that used this kind of privacy protection on medical data. They looked at how the privacy level was set, how much accuracy was lost, which patient groups were affected, and whether the studies reported enough detail to compare them.

The main findings are that strong privacy often costs real accuracy, that the cost depends heavily on the task, that fairness across patient groups is rarely checked, and that many studies do not report the settings needed to interpret their privacy claims.

TL;DR

• Scoping review (PRISMA-ScR) of 74 studies, searched up to March 2025, that apply differential privacy (DP) to medical deep learning § Results § Methods.
• Most studies use DP-SGD; strict budgets (epsilon near 1) often cause convergence failure or sharp accuracy drops § Discussion.
• Fairness across demographic subgroups is rarely audited, and many studies omit epsilon, delta or the privacy accountant § Discussion.
• No code, data or new experiments; numbers are author-reported by the included studies.

Problem

Deep learning models trained on patient data can expose membership, attributes or reconstructable inputs through privacy attacks § Introduction. DP-SGD is the most common defence, but it adds noise that can reduce accuracy and may affect underrepresented subgroups more § Introduction § Fairness considerations in DP-based medical DL. The review asks three questions: how much medical models leak, how well DP mitigates attacks, and what DP does to performance, fairness and clinical applicability § Introduction.

Assumptions: the review covers empirical studies only, excludes purely theoretical work, reviews and commentaries, and includes only English-language items published on or before 1 March 2025 § Methods.

Method

The review was conducted as a PRISMA-ScR scoping review § Methods.

1. Sources. PubMed, IEEE Xplore, ACM Digital Library and Web of Science were searched on 1 March 2025; records were managed in Rayyan. Exact query strings are in Supplementary Table 2 § Methods app. tab. 2.
2. Screening. After duplicate removal, 2,600 unique records were screened by title and abstract, leaving 71 full texts; 20 were excluded at full text, giving 51 studies from databases. Citation tracking and preprints added 23, for 74 studies in total § Results fig. 2.
3. Eligibility. Empirical DP applied with deep learning to healthcare tasks. The methods section also says "impactful preprints" were eligible, a term that is not defined § Methods.
4. Synthesis. Studies were grouped by privacy mechanism. DP-SGD studies were tabulated by modality, setting, task and accountant tab. 1; design choices (architecture, normalisation, augmentation) tab. 2; performance across privacy budgets tab. 3; fairness tab. 4; alternative mechanisms tab. 5; and attack evaluations tab. 6 § Results.

DP-SGD procedure as the review states it

The review writes the DP-SGD update as five steps. In the paper's notation the clipping norm is C, the noise multiplier is sigma, the learning rate is eta and the batch is B eq. 13–eq. 17. The paper gives no values for these.

# DP-SGD update for one step  [eq. 13] [eq. 14] [eq. 15] [eq. 16] [eq. 17]
# Input:  batch of (x_i, y_i); clip norm C; noise multiplier sigma;
#         learning rate eta; current parameters theta
# Output: updated parameters theta

def dp_sgd_step(theta, batch, C, sigma, eta):
    # Gradient of the loss for each example on its own  [eq. 13]
    grads = [loss_gradient(theta, x, y) for (x, y) in batch]
    # Rescale each gradient so its L2 norm is at most C  [eq. 14]
    clipped = [g * min(1, C / l2_norm(g)) for g in grads]
    # Average the clipped gradients over the batch  [eq. 15]
    mean_grad = sum(clipped) / len(batch)
    # Add Gaussian noise; the paper writes N(0, sigma^2 C^2 I)  [eq. 16]
    noisy_grad = mean_grad + gaussian_noise(std = sigma * C)
    # Gradient descent update  [eq. 17]
    return theta - eta * noisy_grad

Privacy accounting as the review states it

• The (epsilon, delta) definition is given as eq. 1. Delta is "often set inversely proportional to dataset size" § Theoretical background.
• Rényi DP eq. 2 eq. 3 is described as the tool that gives tighter composition for iterative training than linear composition § Theoretical background.
• The review gives the approximate scaling epsilon_total ≈ sqrt(T) · epsilon_per_iteration eq. 4 for T iterations. No constants or conditions are given for it.
• Gaussian mechanism: sigma must satisfy sigma ≥ sensitivity · sqrt(2 ln(1.25/delta)) / epsilon § Theoretical background; this is an unnumbered display.
• Laplace mechanism: b = sensitivity_1 / epsilon eq. 8. Exponential mechanism: selection probability proportional to exp(epsilon · u / (2 Δu)) eq. 9 eq. 10.

Alternative mechanisms and attacks (as summarised)

• PATE-style teacher ensembles partition the data across K disjoint teachers eq. 24; votes are counted per class eq. 25; Laplace noise is added to the counts eq. 26; the student receives the noisy majority label eq. 27 § Alternative privacy mechanisms beyond DP-SGD.
• Federated settings add DP at each client (local) or at the server after aggregation fig. 4 § Alternative privacy mechanisms beyond DP-SGD.
• Local DP, DP synthetic data (GANs, diffusion), and hybrids with encryption or MPC are summarised in tab. 5 and described qualitatively § Alternative privacy mechanisms beyond DP-SGD.
• Attacks: membership inference, gradient inversion, reconstruction, attribute and identity disclosure are covered in tab. 6 § Defenses against attacks.

Hyperparameters

The review is not an implementation paper. Values for DP-SGD are not tabulated per study in tab. 1; that table lists only modality, setting, task and mechanism/accountant.

Results

Author-reported, as summarised by the review. The numbers come from the included studies, which use different datasets, metrics and models, so they are not directly comparable tab. 3 § Results. The paper's own headline counts: 74 included studies, 67 of them using DP-SGD fig. 3; the most frequent countries of affiliation are the USA (29 studies), China (24), the UK (13) and Germany (12) fig. 3.

Selected rows from tab. 3 (accuracy or AUC, as reported by each study):

Headline statements in the review, each author-reported:

• Strict budgets (epsilon about 1) frequently led to convergence failure or sharp accuracy drops; moderate budgets (epsilon about 10) preserved clinical accuracy in structured imaging tasks § Discussion.
• Imaging tasks, particularly chest X-ray and CT classification, were comparatively resilient § Discussion.
• Fairness: the most frequently reported metric is statistical parity difference eq. 18. Nearly all studies report disparities only after the fact and at a single epsilon § Discussion. One multi-institutional study found degradation uncorrelated with subgroup size and tied to task difficulty § Discussion.
• Attacks: DP-SGD reduced membership inference and gradient inversion success but did not eliminate them; local DP was judged insufficient against sophisticated attacks § Defenses against attacks.
• Reporting: more than one third of the studies omitted essential details such as epsilon, delta or the accountant § Alternative privacy mechanisms beyond DP-SGD.

Paper vs code

No official code. The paper's code availability statement says no custom code was developed or used; the analysis was manual review of published studies § Code availability. No repository is linked in the paper. The card has no code field. I did not run a GitHub search, because the paper states it has no code.

Pitfalls

• Not a method. The card has no implementation to follow. Use the review to choose study designs and reporting rules, not to set hyperparameters.
• Epsilon columns do not match the caption. tab. 3 is captioned with "very low" as epsilon about 1 and "low" as epsilon about 5 to 10. Some rows fall outside those bands: Adnan et al. at epsilon 2.9 and Gong et al. at epsilon 2 sit in the "very low" column tab. 3. Read the epsilon value in each cell, not the column label.
• Claim vs table. The discussion says epsilon about 10 preserved clinical accuracy, but some rows drop about 10 points at epsilon 10, for example Gong et al. (88.5% to 78.2%) and Guo et al. (69.1% to 61.2%) tab. 3. The "preserved" claim applies to some tasks, not all.
• Approximate composition. The sqrt(T) scaling in eq. 4 is given without constants, conditions or the accountant used. Do not use it to budget an experiment; use the accountant the study used and report it.
• Gaussian bound conditions. The sigma bound for the Gaussian mechanism is written without the range of epsilon for which it holds § Theoretical background.
• Noise notation. eq. 16 writes the noise as N(0, sigma^2 C^2 I). Read this as a covariance, so the standard deviation is sigma · C. The noise is added to the batch average from eq. 15, not to a sum; the paper does not discuss whether this is intended.
• Undefined eligibility. "Impactful preprints" are eligible, but the review does not define "impactful" § Methods.
• Search date. Searches ran on 1 March 2025. Newer studies are not covered, and the review says so § Discussion.
• Uneven evidence. Genomics and survival modelling are underrepresented, and alternative mechanisms are summarised qualitatively, not in aggregate § Discussion.
• Missing settings. Several studies do not report epsilon, delta or the accountant, which limits reproducibility § Alternative privacy mechanisms beyond DP-SGD.

Lineage

• Builds on: DP-SGD [DPSGD] (Abadi et al.), which the review treats as the main method; the paper cites it without an arXiv id in the source.
• Compared against: prior reviews named in the introduction (zhao2019differential, demelius2025recent, fu2024differentially, liu2024survey). The paper says they cover DP broadly or in generic domains, not clinical data § Introduction.
• Superseded by: not known from this wiki.