探索临床大语言模型中的成员推理漏洞
Exploring Membership Inference Vulnerabilities in Clinical Large Language Models
AI总结：
本研究针对临床大语言模型的成员推理漏洞展开探索，测试经典攻击与领域适配的扰动策略，发现模型存在可测量的有限隐私泄露，为医疗AI的隐私防御研发提供依据。
摘要：
随着大语言模型（LLM）日益深入地应用于临床决策支持、文档记录和患者信息系统，确保其隐私性与可信度已成为医疗保健领域的一项紧迫挑战。在敏感电子健康记录（EHR）数据上微调LLM虽能提升领域适配性，但也增加了通过模型行为泄露患者信息的风险。在这项进行中的研究里，我们针对临床LLM的成员推理漏洞开展了探索性实证研究，重点关注攻击者能否推断出特定患者记录是否被用于模型训练。我们采用前沿临床问答模型Llemr，既评估了经典的基于损失的攻击方法，也测试了一种由领域需求驱动的基于释义的扰动策略，该策略更贴近真实的临床攻击场景。我们的初步结果显示，成员信息泄露程度有限但可被测量，这表明当前的临床LLM具备一定的抵抗能力，但仍易受细微隐私风险的影响，这类风险可能会削弱人们对临床AI应用的信任。这些结果推动了情境感知、领域特定的隐私评估与防御手段的持续研发，例如差分隐私微调、释义感知训练等，以增强医疗AI系统的安全性与可信度。
英文摘要：
As large language models (LLMs) become progressively more embedded in clinical decision-support, documentation, and patient-information systems, ensuring their privacy and trustworthiness has emerged as an imperative challenge for the healthcare sector. Fine-tuning LLMs on sensitive electronic health record (EHR) data improves domain alignment but also raises the risk of exposing patient information through model behaviors. In this work-in-progress, we present an exploratory empirical study on membership inference vulnerabilities in clinical LLMs, focusing on whether adversaries can infer if specific patient records were used during model training. Using a state-of-the-art clinical question-answering model, Llemr, we evaluate both canonical loss-based attacks and a domain-motivated paraphrasing-based perturbation strategy that more realistically reflects clinical adversarial conditions. Our preliminary findings reveal limited but measurable membership leakage, suggesting that current clinical LLMs provide partial resistance yet remain susceptible to subtle privacy risks that could undermine trust in clinical AI adoption. These results motivate continued development of context-aware, domain-specific privacy evaluations and defenses such as differential privacy fine-tuning and paraphrase-aware training, to strengthen the security and trustworthiness of healthcare AI systems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
