💻 computer science

A Utility-preserving De-identification Pipeline for Cross-hospital Radiology Data Sharing

This paper introduces a utility-preserving de-identification pipeline (UPDP) that combines privacy-sensitive term filtering with generative image synthesis to enable secure, high-quality cross-hospital radiology data sharing for training robust medical AI models without compromising diagnostic utility.

Original authors: Chenhao Liu, Zelin Wen, Yan Tong, Junjie Zhu, Xinyu Tian, Yuchi Liu, Ashu Gupta, Syed M. S. Islam, Tom Gedeon, Yue Yao

Published 2026-04-09

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Chenhao Liu, Zelin Wen, Yan Tong, Junjie Zhu, Xinyu Tian, Yuchi Liu, Ashu Gupta, Syed M. S. Islam, Tom Gedeon, Yue Yao

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a world where doctors from different hospitals could share their X-ray photos and reports to teach a super-smart AI how to diagnose diseases better. This AI could eventually help save lives by spotting cancers or broken bones faster than any human.

But there's a huge problem: Privacy.

Hospitals can't just email X-rays to each other because those photos often contain hidden clues about who the patient is (like their name written on the film, their birth date, or even unique body features). It's like trying to share a family photo album with strangers, but you have to cut out everyone's faces and names first. If you cut too much, the photo becomes useless. If you cut too little, you've leaked private info.

This paper introduces a clever new solution called UPDP (Utility-Preserving De-identification Pipeline). Think of it as a "Magic Privacy Filter" that scrubs the data clean without ruining the picture.

Here is how it works, broken down into simple steps:

1. The Problem: The "Too Much vs. Too Little" Dilemma

Usually, when hospitals want to share data, they try to "de-identify" it.

The Old Way: They use a black marker to scribble out names and dates on the text, and they blur out faces or unique marks on the X-ray.
The Flaw: This is like trying to fix a leaky boat by smashing holes in the bottom to let the water out. You stop the leak (privacy), but you also sink the boat (the data becomes useless for training AI). The AI can't learn to spot a broken bone if the bone is blurred out.

2. The Solution: The "Magic Recipe" (UPDP)

The authors created a pipeline that acts like a smart chef. Instead of just deleting ingredients, the chef creates a new dish that tastes exactly the same but uses different, safe ingredients.

Here is the recipe:

The Blacklist (The "No-Go" Zone): Imagine a list of forbidden words like "John Doe," "Hospital A," or specific dates. The system scans the report and instantly deletes anything on this list.
The Whitelist (The "Must-Have" Zone): Imagine a list of medical keywords like "pneumonia," "fracture," or "heart size." The system makes sure these words are highlighted and kept, even if they were near the forbidden words.
The Generative Filter (The "Re-imagining"): This is the magic part. Instead of just blurring the X-ray, the system uses an AI artist (called a Diffusion Model) to paint a brand new X-ray.
- It looks at the "safe" report (the one with the blacklist removed and whitelist kept).
- It paints a new chest X-ray that looks exactly like the original medical condition (showing the pneumonia or broken bone) but doesn't look like the original patient. It's like a "look-alike" actor playing the role of the patient. The disease is real, but the person is fake.

3. The Result: A Safe, Useful Library

The output is a library of "fake" X-rays and "clean" reports.

Privacy: If you try to guess who the patient is from these new images, you'd be guessing at random (like flipping a coin). The privacy is secure.
Utility: If you train an AI on these new images, it learns just as well as if it had seen the real ones. It still knows what a broken bone looks like, even though the "bone" belongs to a digital ghost.

4. Why This Matters (The "Teamwork" Analogy)

The paper tested this by having hospitals share these "fake" images.

Solo Training: An AI trained only on these fake images was almost as good as one trained on real data.
Teamwork: When they mixed the "fake" images with a small amount of real local data, the AI became superhuman. It was better than using real data alone!

Think of it like a cooking class. If you only have real ingredients (real data), you are limited by how many ingredients you can buy. But if you have a machine that can create perfect "fake" ingredients that taste the same, you can cook for a million people. You just need a few real ingredients to make sure the fake ones taste right.

The Bottom Line

This paper solves the "Privacy vs. Progress" standoff. It proves we don't have to choose between protecting patient secrets and building life-saving AI. By using a smart "re-painting" technique, we can share medical data across the globe, train better AI, and keep everyone's secrets safe—all at the same time.

1. Problem Statement

The development of robust medical AI, particularly Vision-Language Models (VLMs) for radiology, relies heavily on large-scale, high-quality datasets containing paired medical images and reports. However, strict privacy regulations (e.g., HIPAA, GDPR) severely restrict the sharing of raw patient data across hospitals.

The Core Conflict: Existing de-identification methods focus primarily on removing identifiers (names, IDs) from text or masking images. While this ensures privacy, it often inadvertently strips away diagnostically critical information (pathology cues) or degrades image fidelity.
The Gap: It remains unclear whether de-identified data can retain sufficient utility to train large-scale VLMs effectively. If de-identification removes the very features needed for diagnosis, the resulting data is safe but useless for model training.

2. Methodology: The UPDP Framework

The authors propose the Utility-Preserving De-identification Pipeline (UPDP), which treats de-identification as a controlled generative problem rather than simple data sanitization. The pipeline generates synthetic, privacy-filtered image-report pairs that preserve clinical semantics.

Key Components:

Semantic Filtering (Text Side):
- Blacklist: A list of privacy-sensitive terms (e.g., patient names, MRNs, dates, specific locations) is constructed based on HIPAA guidelines. These tokens are strictly excluded.
- Whitelist: A list of pathology-related terms (e.g., anatomical structures, disease states, imaging views) is constructed. These tokens are "soft-promoted" to ensure clinically relevant information is retained.
- Process: The original report is tokenized. Sensitive tokens are removed (score set to $-\infty$ ), while whitelist tokens receive a positive bias during selection.
Generative Filtering (Image Side):
- Instead of masking or blurring original images, UPDP uses a Latent Diffusion Model to synthesize new images.
- Optimization Loop: The pipeline optimizes continuous content embeddings to align with the original image features (using a pre-trained Vision-Language model like BiomedCLIP) while adhering to the lexical constraints (blacklist/whitelist).
- Generation: The optimized, de-identified text prompt conditions the diffusion model to generate a new chest X-ray ( $\tilde{x}_i$ ) that visually corresponds to the filtered report ( $\tilde{y}_i$ ), effectively creating a "privacy-filtered yet pathology-reserved" counterpart.
Pipeline Flow:
- Input: Real Image-Report Pair $(x_i, y_i)$ .
- Step 1: Extract features using pre-trained encoders.
- Step 2: Optimize text embeddings to align with image features while applying blacklist/whitelist constraints.
- Step 3: Generate synthetic image $\tilde{x}_i$ using the diffusion model conditioned on the optimized text.
- Output: De-identified dataset $D_S = \{(\tilde{x}_i, y_i)\}$ (Note: The paper pairs the synthetic image with the original report for training, or the optimized report depending on the specific downstream task configuration, though the abstract emphasizes generating counterparts for both).

3. Key Contributions

Utility-Preserving Perspective: Shifts the focus from "privacy removal only" to "privacy removal + utility preservation," explicitly addressing the trade-off between safety and diagnostic value.
Generative Filtering Mechanism: Introduces a novel approach using diffusion models guided by semantic constraints (blacklist/whitelist) to synthesize new images rather than modifying existing ones. This avoids the fidelity loss associated with traditional masking.
Cross-Hospital Data Sharing Solution: Provides a practical framework for hospitals to share data securely, enabling the training of VLMs on aggregated, de-identified datasets without violating patient privacy.

4. Experimental Results

The method was evaluated on MIMIC-CXR and IU-XRay datasets using state-of-the-art VLMs (Qwen2.5-VL, Gemma-3, Phi-3.5).

Privacy Protection (De-identification Effectiveness):
- A patient identity classifier was trained to distinguish patients based on images.
- Results: Accuracy dropped from 97.21% (real images) to 4.57% (UPDP generated images), compared to 13.69% for images generated without the specific de-identification optimization. This confirms effective removal of identity cues.
Utility Preservation (Diagnostic Performance):
- Models trained on UPDP data achieved competitive diagnostic accuracy compared to models trained on original data.
- Metrics: On MIMIC-CXR, BLEU-1 improved from 11.34 (raw transfer) to 13.62 (UPDP transfer). On IU-XRay, it rose from 42.78 to 44.42.
- Comparison: UPDP outperformed baseline content optimization methods (MMA-Diffusion, STEPS) across all metrics (BLEU, METEOR, ROUGE-L, BERTScore, RadGraph F1).
Cross-Hospital Synergy:
- Combining de-identified transfer data with local real data yielded superior performance compared to training on local data alone, demonstrating that UPDP data effectively augments local datasets.

5. Significance and Conclusion

Bridging the Privacy-Utility Gap: The paper demonstrates that it is possible to share radiology data across institutions without sacrificing the diagnostic quality required for training advanced AI models.
Scalability: The generative approach allows for the efficient creation of large-scale, privacy-compliant datasets, addressing the scarcity of annotated medical data.
Future Impact: UPDP offers a viable pathway for collaborative medical AI development, enabling hospitals to pool resources for training robust VLMs while adhering to strict privacy regulations. The authors suggest that while a slight performance gap remains compared to raw local data, the hybrid approach (local + de-identified) offers the best practical compromise for real-world deployment.

Limitations Noted: The evaluation relies on automated metrics (BLEU, RadGraph) rather than expert clinical review. Future work requires integrating expert assessment and more rigorous privacy risk analysis (e.g., membership inference attacks).