Balancing Privacy and Utility in Artificial Intelligence-Based Clinical Decision Support: Empirical Evaluation Using De-Identified Electronic Health Record Data

Abstract

The secondary use of electronic health records is essential for developing artificial intelligence-based clinical decision support systems. However, even after direct identifiers are removed, de-identified electronic health records remain vulnerable to re-identification, membership inference attacks, and model extraction attacks. This study examined the balance between privacy protection and model utility by evaluating de-identification strategies and differentially private learning in large-scale electronic health records. De-identified records from a tertiary medical center were analyzed and compared with three strategies—baseline generalization, enhanced generalization, and enhanced generalization with suppression—together with differentially private stochastic gradient descent. Privacy risks were assessed through k-anonymity distributions, membership inference attacks, and model extraction attacks. Model performance was evaluated using standard predictive metrics, and privacy budgets were estimated for differentially private stochastic gradient descent. Enhanced generalization with suppression consistently improved k-anonymity distributions by reducing small, high-risk classes. Membership inference attacks remained at the chance level under all conditions, indicating that patient participation could not be inferred. Model extraction attacks closely replicated victim model outputs under baseline training but were substantially curtailed once differentially private stochastic gradient descent was applied. Notably, privacy-preserving learning maintained clinically relevant performance while mitigating privacy risks. Combining suppression with differentially private stochastic gradient descent reduced re-identification risk and markedly limited model extraction while sustaining predictive accuracy. These findings provide empirical evidence that a privacy–utility balance is achievable in clinical applications.

Ähnliche Arbeiten