Does BERT Pretrained on Clinical Notes Reveal Sensitive Data?

By Eric P. Lehman, Sarthak Jain, K. Pichotta, Yoav Goldberg, Byron C. Wallace. 2021

158 citations recorded by the source corpus.

Large Transformers pretrained over clinical notes from Electronic Health Records (EHR) have afforded substantial gains in performance on predictive clinical tasks. The cost of training such models (and the necessity of data access to do so) coupled with their utility motivates parameter sharing, i.e., the release of pretrained models such as ClinicalBERT. While most efforts have used deidentified EHR, many researchers have access to large sets of sensitive, non-deidentified EHR with which they might train a BERT model (or similar). Would it be safe to release the weights of such a model if they did? In this work, we design a battery of approaches intended to recover Personal Health Information (PHI) from a trained BERT. Specifically, we attempt to recover patient names and conditions with which they are associated. We find that simple probing methods are not able to meaningfully extract sensitive information from BERT trained over the MIMIC-III corpus of EHR. However, more sophisticated “attacks” may succeed in doing so: To facilitate such research, we make our experimental setup and baseline probing models available at https://github.com/elehman16/exposing_patient_data_release.

Subfields: Artificial Intelligence, Management Science and Operations Research, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Management Science and Operations Research

In Safety, Robustness & Interpretability

Citations in the corpus

Deduplicating Training Data Mitigates Privacy Risks in Language Models (2022, background): “Au-toregressive and masked transformer LMs have both been shown to be susceptible to model inversion (Carlini et al., 2021b; Lehman et al., 2021).”
Language Generation Models Can Cause Harm: So What Can We Do About It? An Actionable Survey (2022, background): “, 2021), and private clinical notes (Lehman et al., 2021); they have even leaked software code and other protected intellectual property (Ippolito et al.”
What Does it Mean for a Language Model to Preserve Privacy? (2022, background): “ing the same type of data extraction attack on BERT-based models trained on de-identified clinical notes shows that more than 4% of generated sentences with a patient’s name also contain one of their true medical conditions [52].”
You Don’t Know My Favorite Color: Preventing Dialogue Representations from Revealing Speakers’ Private Personas (2022, unknown): “Lehman et al. (2021) examined BERT pretrained on Electronic Health Records via blank filling and model probing to recover Personal Health Information.”
Knowledge Unlearning for Mitigating Privacy Risks in Language Models (2022, background): “…Language Models (LMs) including Personally Identifiable Information (PII) such as names, phone numbers, and email addresses, and other information such as licensed code, private clinical notes, and 128-bit UUIDs (Carlini et al., 2021; Lee et al., 2022; Huang et al., 2022; Lehman et al., 2021).”
Analyzing Leakage of Personally Identifiable Information in Language Models (2023, background): “Other work has explored PII reconstruction in the clinical health setting [34, 57] with masked language models (MLMs) based on the BERT architecture [12].”
Bag of Tricks for Training Data Extraction from Language Models (2023, methodology): “Thus, the focus of our research is on the adversarial task of training data extraction from LMs, a relatively new area of study (Carlini et al., 2021; Lehman et al., 2021).”
Large Language Model Alignment: A Survey (2023, background): “Prompt Attacks involve designing or searching for prompts that lead LMs to output information from the training data, including private details (Carlini et al., 2021; Lehman et al., 2021; Li et al., 2023a; Deng et al., 2023).”
Are Large Pre-Trained Language Models Leaking Your Personal Information? (2022, methodology): “Lehman et al. (2021); Vakili and Dalianis (2021) study the privacy risk of sharing parameters of BERT pre-trained on clinical notes.”
A Survey of Large Language Models for Healthcare: from Data, Technology, and Applications to Accountability and Ethics (2023, unknown): “They provide evidence that NLI test samples deviating from these patterns result in significantly lower scores compared to those adhering to them.”