🤖 AI

The pretraining domain outweighs the training objective in setting the privacy-utility trade-off of differentially private medical image analysis

This study demonstrates that in differentially private medical image analysis, the domain of the pretraining corpus (specifically in-domain chest radiographs) is a more critical determinant of the privacy-utility trade-off than the pretraining objective, as models initialized with private in-domain data significantly outperform those using public or generic pretraining even under strict privacy constraints.

Original authors: Soroosh Tayebi Arasteh, Mina Farajiamiri, Mahshad Lotfinia, Behrus Hinrichs-Puladi, Jonas Bienzeisler, Mohamed Alhaskir, Mirabela Rusu, Christiane Kuhl, Sven Nebelung, Daniel Truhn

Published 2026-07-27

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Soroosh Tayebi Arasteh, Mina Farajiamiri, Mahshad Lotfinia, Behrus Hinrichs-Puladi, Jonas Bienzeisler, Mohamed Alhaskir, Mirabela Rusu, Christiane Kuhl, Sven Nebelung, Daniel Truhn

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to teach a robot to read X-rays of human lungs. This robot needs to learn two things: how to see the shapes of bones and organs, and how to spot the tiny signs of sickness. But there's a catch: the robot is only allowed to learn from a very strict set of rules called "differential privacy." Think of this like a super-strict librarian who lets the robot study a library of patient records but insists that the robot must never be able to memorize any single patient's story. To make sure the robot doesn't cheat, the librarian adds a little bit of "static noise" to every lesson the robot learns. This noise protects the patients' secrets, but it also makes the lessons harder to understand, often causing the robot to make more mistakes.

Scientists have been trying to fix this problem by giving the robot a "head start" before it even opens the library. This is called "pretraining." It's like letting the robot watch a million hours of nature documentaries or study a huge pile of general photos before it ever sees an X-ray. The big question has been: does it matter what the robot studied during that head start? Does it help more if the robot studied general pictures (like cats and cars) using a smart, self-taught method, or does it help more if the robot studied actual chest X-rays, even if it was taught in a more traditional way? And, crucially, does it matter if the robot studied those chest X-rays in a way that also protected the patients' privacy?

This paper sets out to answer that question by running a massive experiment. The researchers built a team of five different "student robots," each starting with a different kind of head start. They then put all five robots through the same strict privacy training on chest X-rays from five different hospitals around the world. They tested how well each robot could diagnose five common lung problems, from pneumonia to fluid buildup, while keeping the privacy rules tight.

The results were surprisingly clear and gave a definitive answer to the debate. The robot that started with the best head start was the one that had already studied a huge collection of chest X-rays before the privacy training began. This "in-domain" robot crushed the competition. When the privacy rules were made extremely strict (which usually makes AI performance crash), this robot still performed incredibly well, while the others struggled. In fact, as the privacy rules got tighter, the gap between the chest-X-ray-trained robot and the others grew wider and wider. By the time the privacy rules were at their strictest, the chest-X-ray-trained robot was outperforming the robot trained on general photos by a massive margin—up to 14.6 points on their scoring system.

The study also found that how the robot learned during that head start mattered less than what it learned. A robot that studied chest X-rays using a traditional, supervised method (where a teacher tells it the answers) did better than a robot that studied general photos using a fancy, self-taught method, even though the self-taught method is usually considered the "cooler" and more advanced approach. The researchers also tested a version of the chest-X-ray robot that learned its head start under privacy rules too. Even though this made the robot slightly less accurate at the start, it still beat every other robot once the final privacy training began.

Perhaps the most exciting finding is that this privacy-protected, chest-X-ray-trained robot was not only the most accurate but also the most fair. When the researchers looked at how well the robots worked for different groups of people, the chest-X-ray-trained robot kept its performance high even for the oldest patients, who usually suffer the most when privacy rules are strict. The other robots, especially the ones trained from scratch or on general photos, saw their accuracy for older patients drop significantly.

In short, the paper proves that if you want to build a medical AI that respects patient privacy, the most important thing you can do is give it a head start with data that looks exactly like the job it will do. It doesn't matter how huge or fancy the general data is; if the robot hasn't seen a chest X-ray before, it will struggle when privacy rules get tough. The best path forward isn't necessarily building bigger, generic models, but rather creating and sharing specialized models that have already learned the language of medicine, all while protecting the privacy of the patients who helped teach them.

Technical Summary: The Pretraining Domain Outweighs the Training Objective in Differentially Private Medical Image Analysis

Problem Statement
Differential privacy (DP) offers a formal guarantee against reconstruction attacks and membership inference in medical imaging by bounding the influence of any single patient on the model via Differentially Private Stochastic Gradient Descent (DP-SGD). However, this protection incurs a significant utility cost, often rendering models clinically unusable under strict privacy budgets ( $\epsilon \approx 1$ ). While pretraining is known to mitigate this loss, existing literature conflates two critical variables: the pretraining objective (supervised vs. self-supervised) and the pretraining domain (generic natural images vs. domain-specific medical images). Furthermore, standard private fine-tuning pipelines often treat the pretraining corpus as public, even when that corpus consists of sensitive patient data, breaking the end-to-end privacy guarantee. The central question remains: under differential privacy, does the choice of pretraining objective or the choice of pretraining domain drive diagnostic utility?

Methodology
The authors conducted a large-scale empirical study to disentangle these variables using a fixed ConvNeXt backbone and a standardized DP-SGD pipeline.

Initializations: Five distinct initialization strategies were compared, varying the objective and domain independently:
1. Random (He): Trained from scratch.
2. ImageNet: Supervised pretraining on natural images.
3. DINOv3: Self-supervised pretraining on natural images.
4. InDomain-stand: Supervised pretraining on chest radiographs (MIMIC-CXR).
5. InDomain-priv: Differentially private supervised pretraining on MIMIC-CXR (satisfying an $(\epsilon, \delta)$ guarantee with $\epsilon=7.93$ ).
Experimental Setup: Models were fine-tuned on ConvNeXt-Small (49.5M parameters) and ConvNeXt-Tiny (27.8M parameters) across four privacy budget levels ( $0 < \epsilon < 1$ , $1 < \epsilon < 3$ , $3 < \epsilon < 6$ , $6 < \epsilon < 9$ ) and a non-private reference.
Evaluation: Performance was evaluated on five external chest radiograph datasets from four countries (VinDr-CXR, CheXpert, ChestX-ray14, PadChest, UKA-CXR), totaling over 590,000 images. Metrics included macro-averaged AUROC, AUPRC, mAP, accuracy, sensitivity, specificity, Brier score, and Expected Calibration Error (ECE).
Additional Analyses: The study assessed generalization to unseen institutions (leave-one-dataset-out), the impact of parameter-efficient fine-tuning (Low-Rank Adaptation and head-only training), and demographic fairness across sex and age subgroups.

Key Results

Domain Dominates Objective: The pretraining domain was the single strongest predictor of accuracy under privacy. Supervised pretraining on chest radiographs (InDomain-stand) ranked first in 24 of 25 dataset and budget combinations. As the privacy budget tightened from non-private to $0 < \epsilon < 1$ , the performance gap between InDomain-stand and generic ImageNet pretraining widened from 2.5 to 14.6 macro AUROC points. The domain effect exceeded the objective effect (self-supervised vs. supervised) by a factor of 2.2 to 3.4.
Robustness to Privacy Noise: In-domain representations absorbed the noise and gradient clipping of DP-SGD with minimal loss. Moving from non-private to strict privacy ( $0 < \epsilon < 1$ ) cost InDomain-stand only 5.3 points of macro AUROC, compared to 17.3 points for ImageNet and 20.8 points for training from scratch.
Cost of Privatizing Pretraining: Privately pretraining on MIMIC-CXR (InDomain-priv) incurred a stable cost of approximately 5 points compared to standard in-domain pretraining. Crucially, even with this penalty, InDomain-priv outperformed all public initializations (ImageNet, DINOv3) under downstream privacy constraints.
Privacy Efficiency: Models with strong in-domain initialization converged faster, consuming significantly less of the privacy budget cap. InDomain-stand reached its peak performance having spent only 66% of the tightest budget cap on average, whereas training from scratch consumed nearly 100%.
Parameter-Efficient Fine-Tuning: Low-Rank Adaptation (LoRA) compensated for weak initializations, improving performance by an average of 8.0 points for random initialization. However, LoRA did not close the gap between generic and in-domain models; the best generic model with LoRA still trailed the in-domain model with full fine-tuning.
Demographic Fairness: Privacy costs fell unevenly on age subgroups, particularly those over 70. InDomain-stand maintained the highest "floor" (worst-performing subgroup performance) across all datasets, keeping the worst subgroup above 70 macro AUROC, whereas other initializations dropped significantly lower.

Significance and Claims
The paper argues that for private medical AI, where a model starts matters more than how it was taught or how large it is. The authors claim that curating and sharing domain-matched pretraining corpora is a more effective route to private medical AI than pursuing ever-larger generic pretraining objectives.

Key implications highlighted include:

End-to-End Privacy: It is feasible and beneficial to protect the pretraining corpus itself, creating a pipeline where the privacy guarantee holds from the first image seen to the final prediction.
Reframing the Trade-off: A well-matched initialization acts as a lever on both sides of the privacy-utility trade-off: it maximizes utility while minimizing the actual privacy budget consumed.
Fairness Reporting: The authors caution that narrow disparity gaps do not necessarily equate to fairness if the overall performance is poor. They advocate for reporting the performance level of the worst-serving subgroup alongside gap statistics.

The study concludes that pairing a domain-matched initialization with parameter-efficient private fine-tuning recovers much of the accuracy lost to strict privacy, making privacy-preserving diagnostic imaging less of a compromise.

Technical Summary: The Pretraining Domain Outweighs the Training Objective in Differentially Private Medical Image Analysis

More like this