cs.CVJan 27, 2026
SaveThe pretraining domain outweighs the training objective in setting the privacy-utility trade-off of differentially private medical image analysis
Organizations: Lab for AI in Medicine, RWTH Aachen University, Aachen, Germany · Department of Diagnostic and Interventional Radiology, University Hospital RWTH Aachen, Aachen, Germany · Department of Urology, Stanford University, Stanford, CA, USA · Department of Radiology, Stanford University, Stanford, CA, USA · School of Business and Economics, RWTH Aachen University, Aachen, Germany · Pattern Recognition Lab, Friedrich-Alexander-Universität Erlangen-Nürnberg, Erlangen, Germany · Department of Oral and Maxillofacial Surgery, University Hospital RWTH Aachen, Aachen, Germany · Institute of Medical Informatics, University Hospital RWTH Aachen, Aachen, Germany
Abstract
Differential privacy limits how much each training image can influence a medical imaging model but lowers its diagnostic accuracy. Pretrained weights reduce this loss. It is unknown whether the pretraining objective or domain improves accuracy more. Here we train chest radiograph classifiers under differential privacy from five starting points on 591,884 radiographs from five datasets. We show that supervised pretraining on chest radiographs ranks first in 24 of 25 combinations of dataset and privacy setting. Measured by the area under the receiver operating characteristic curve, its lead over supervised pretraining on natural images is 2.6% without privacy and 15.3% at the strictest budget. From that starting point, changing the domain improves this area 2.2 to 3.7 times more than changing the objective. Private pretraining on chest radiographs lowers this area by about 5% under privacy but outperforms the three starting points without patient data at the strictest budget. Under privacy, supervised chest radiograph pretraining leads in the worst-performing demographic subgroup.
Figures & tables
Figure 1: Study design. Colors mark the five initializations. a , The initializations of the ConvNeXt [ 27 ] classifier. He initialization [ 13 ] trains the network from scratch. ImageNet [ 8 ] was pretrained with labels on ImageNet-1k, and DINOv3 [ 43 ] was pretrained without labels on LVD-1689M. Both datasets contain natural images. InDomain-stand and InDomain-priv were pretrained with labels on the 153,255 frontal radiographs of the MIMIC-CXR [ 17 ] training split. InDomain-priv was pretrained under differential privacy. b , Every initialization was finetuned to predict five findings from a chest radiograph, once without privacy and once at each of four privacy budgets. Private finetuning used DP-SGD [ 1 ] , which clips the gradient of every training radiograph and adds Gaussian noise at every step. The ConvNeXt backbone has 49.5 million parameters (Small) or 27.8 million (Tiny). c , The five datasets, VinDr-CXR [ 34 ] , CheXpert [ 16 ] , ChestX-ray14 [ 53 ] , PadChest [ 5 ] , and UKA-CXR [ 21 ] , each with its country and the number of radiographs used. d , Evaluations of diagnostic utility in eight metrics, fairness across sex and three age bands, generalization to an institution held out of training, model capacity with ConvNeXt-Small and ConvNeXt-Tiny, and the parameter-efficient schemes of head-only finetuning and LoRA [ 15 ] . The radiograph in b is from ChestX-ray14. DP, differential privacy; DP-SGD, differentially private stochastic gradient descent; ImageNet-1k, the 1,000-class ImageNet dataset; LoRA, low-rank adaptation; LVD-1689M, the 1.7 billion web images of DINOv3 pretraining; M, million; , privacy budget.
| Initialization | VinDr-CXR | CheXpert | ChestX-ray14 | PadChest | UKA-CXR |
|---|---|---|---|---|---|
| He | 52.2 1.2 [49.8, 54.5] | 52.9 0.3 [52.3, 53.4] | 50.2 0.5 [49.2, 51.2] | 53.4 0.4 [52.6, 54.1] | 51.8 0.3 [51.2, 52.5] |
| ImageNet | 59.4 1.0 [57.3, 61.5] | 67.2 0.3 [66.6, 67.8] | 59.2 0.6 [58.0, 60.3] | 74.9 0.3 [74.2, 75.5] | 73.2 0.3 [72.6, 73.8] |
| DINOv3 | 77.9 1.2 [75.5, 80.3] | 68.9 0.3 [68.3, 69.4] | 63.7 0.5 [62.6, 64.8] | 75.7 0.3 [75.0, 76.3] | 79.9 0.2 [79.4, 80.3] |
| InDomain-stand | 90.5 0.6 [89.4, 91.7] | 78.0 0.3 [77.5, 78.6] | 73.7 0.5 [72.7, 74.7] | 84.6 0.3 [84.1, 85.1] | 83.5 0.2 [83.1, 83.9] |
| InDomain-priv | 85.4 0.9 [83.6, 87.2] | 72.9 0.3 [72.3, 73.5] | 67.9 0.5 [66.9, 69.0] | 78.7 0.3 [78.1, 79.3] | 81.0 0.2 [80.5, 81.4] |
Table 1: Macro AUROC of five initializations at four privacy budgets and without privacy on the test sets of five datasets ( test radiographs). Every model is a ConvNeXt-Small [ 27 ] finetuned with differentially private stochastic gradient descent [ 1 ] , except in the rows without privacy. Each entry is the AUROC averaged over the five findings in percent, as the mean standard deviation [95% confidence interval] of 10,000 bootstrap resamples. Rows are grouped by privacy setting and ordered from no pretraining to in-domain pretraining. The test sets have 3,000 (VinDr-CXR [ 34 ] ), 29,321 (CheXpert [ 16 ] ), 25,596 (ChestX-ray14 [ 53 ] ), 22,045 (PadChest [ 5 ] ), and 40,106 (UKA-CXR [ 21 ] ) radiographs. AUROC, area under the receiver operating characteristic curve; , privacy budget; He, He initialization [ 13 ] ; ImageNet, supervised pretraining on ImageNet [ 8 ] ; DINOv3, self-supervised DINOv3 pretraining [ 43 ] ; InDomain-stand and InDomain-priv, supervised pretraining on MIMIC-CXR [ 17 ] without and with differential privacy.
Figure 2: Macro AUROC of ConvNeXt-Small [ 27 ] classifiers finetuned with differentially private stochastic gradient descent [ 1 ] from five initializations at four privacy budgets and without privacy on the test sets of five datasets ( test radiographs). Colors mark the initializations. In a – e , a marker is the mean of 10,000 bootstrap resamples of the test set, and the error bar is the 95% confidence interval, from the 2.5th to the 97.5th percentile. No other panel has an error bar. Counts per panel: 25 runs ( a – e ), values that are means over the five datasets ( f , g ), 20 comparisons ( h ), and 5 datasets per initialization ( i ). a – e , Macro AUROC on the test sets of VinDr-CXR [ 34 ] ( ), CheXpert [ 16 ] ( ), ChestX-ray14 [ 53 ] ( ), PadChest [ 5 ] ( ), and UKA-CXR [ 21 ] ( ) against the achieved of each run, with dashed lines to the non-private reference at beyond the dotted break. f , Macro AUROC of InDomain-stand minus that of each other initialization. g , Decrease in macro AUROC from non-private training to . h , InDomain-stand minus each other initialization at . An asterisk marks in a two-sided paired bootstrap test with 10,000 resamples and no correction for multiple comparisons. i , Macro AUROC at . A dot is one dataset, and a box spans the 25th to the 75th percentile with the median as a line and whiskers to the smallest and largest value. AUROC, area under the receiver operating characteristic curve; , privacy budget; He, He initialization [ 13 ] ; ImageNet, supervised pretraining on ImageNet [ 8 ] ; DINOv3, self-supervised DINOv3 pretraining [ 43 ] ; InDomain-stand, supervised pretraining on MIMIC-CXR [ 17 ] ; InDomain-priv, differentially private pretraining on MIMIC-CXR.
| Metric | He | ImageNet | DINOv3 | InDomain-stand | InDomain-priv |
|---|---|---|---|---|---|
| AUROC | 52.1 1.2 | 66.8 7.4 | 73.2 6.7 | 82.1 6.4 | 77.2 6.9 |
| AUPRC | 18.7 5.0 | 27.8 9.4 | 35.6 11.1 | 49.1 13.2 | 41.5 12.6 |
| mAP | 18.7 5.0 | 27.9 9.4 | 35.8 11.1 | 49.4 13.5 | 41.7 12.7 |
| Accuracy | 54.6 7.0 | 58.3 11.9 | 63.8 15.3 | 72.4 9.4 | 66.5 14.3 |
| Sensitivity | 50.7 7.8 | 66.6 11.8 | 72.9 5.2 | 77.9 4.4 | 75.7 5.2 |
Table 2: Eight metrics of five initializations at and without privacy on the test sets of five datasets ( test radiographs). Each entry is the metric averaged over the five findings in percent, as the mean standard deviation over the five datasets. Lower is better for the Brier score and ECE and higher for the other metrics. Accuracy, sensitivity, and specificity use the thresholds selected on the validation set. Rows are grouped by privacy setting. The models are those of Table 1 . AUPRC, area under the precision-recall curve; AUROC, area under the receiver operating characteristic curve; ECE, expected calibration error; , privacy budget; He, He initialization [ 13 ] ; ImageNet, supervised pretraining on ImageNet [ 8 ] ; DINOv3, self-supervised DINOv3 pretraining [ 43 ] ; InDomain-stand and InDomain-priv, supervised pretraining on MIMIC-CXR [ 17 ] without and with differential privacy; mAP, mean average precision.
Figure 3: Contrasts of the pretraining objective and the pretraining domain on the test sets of VinDr-CXR [ 34 ] , CheXpert [ 16 ] , ChestX-ray14 [ 53 ] , PadChest [ 5 ] , and UKA-CXR [ 21 ] ( test radiographs). The objective contrast is the macro AUROC of DINOv3 minus that of ImageNet, which were both pretrained on natural images. The domain contrast is InDomain-stand minus ImageNet, which were both pretrained with labels. Blue marks the objective contrast, and green marks the domain contrast. Marker shapes mark the privacy settings in f . No panel has an error bar. Counts per panel: 3 initializations ( a ), 5 privacy settings ( b , c ), 5 datasets ( d , e ), and 25 combinations of dataset and privacy setting ( f – i ). a , The three evaluated initializations by pretraining objective and domain, with their mean macro AUROC over the five datasets at and the two contrasts as arrows from ImageNet. The fourth combination was not evaluated. b , The two contrasts averaged over the five datasets. c , Ratio of the two averaged contrasts, with a dashed line at 1. d , The two contrasts in each dataset at . e , Macro AUROC of the three initializations at , with a line per dataset. f , Domain contrast against objective contrast, with a dashed line of equality. g , h , The two contrasts on a shared color scale. i , InDomain-stand minus DINOv3, which equals the domain contrast minus the objective contrast (Eq. 4 ). An asterisk marks in an uncorrected two-sided paired bootstrap test with 10,000 resamples. AUROC, area under the receiver operating characteristic curve; , privacy budget; ImageNet, supervised pretraining on ImageNet [ 8 ] ; DINOv3, self-supervised DINOv3 pretraining [ 43 ] ; InDomain-stand, supervised pretraining on MIMIC-CXR [ 17 ] .
Figure 4: Converged epoch and achieved of the 100 private runs of the main experiment on the test sets of VinDr-CXR [ 34 ] , CheXpert [ 16 ] , ChestX-ray14 [ 53 ] , PadChest [ 5 ] , and UKA-CXR [ 21 ] ( test radiographs). Every run finetuned a ConvNeXt-Small [ 27 ] with differentially private stochastic gradient descent [ 1 ] . The converged epoch is the epoch with the highest validation macro AUROC. The achieved is the privacy budget spent up to the converged epoch. Colors mark the initializations, and marker shapes mark the privacy budgets in c . No panel has an error bar. Counts per panel: 20 bars, each a mean over the five datasets ( a , b ), 100 runs ( c ), 25 runs at ( d , g , h ), 10 runs ( e ), 5 bars, each a mean over the five initializations ( f ), and 20 runs per initialization ( i ). a , Converged epoch. b , Achieved as a percentage of the upper end of the budget, with a dashed line at 100%. c , Converged epoch against achieved , with the Pearson correlation . d , Macro AUROC against achieved at . e , Arrows from He initialization to InDomain-stand at , one per dataset. f , Achieved at as a percentage of 1, with a dashed line at 100%. g , h , Converged epoch ( g ) and achieved ( h ) at , with the datasets as the rows of both. i , Number of private runs of each initialization with a lower achieved than the ImageNet run on the same dataset at the same budget. Both values were rounded to one decimal before the comparison. AUROC, area under the receiver operating characteristic curve; , privacy budget; He, He initialization [ 13 ] ; ImageNet, supervised pretraining on ImageNet [ 8 ] ; DINOv3, self-supervised DINOv3 pretraining [ 43 ] ; InDomain-stand, supervised pretraining on MIMIC-CXR [ 17 ] ; InDomain-priv, differentially private pretraining on MIMIC-CXR.
| Dataset | InDomain-stand | InDomain-priv | |
|---|---|---|---|
| VinDr-CXR | 90.5 0.6 [89.4, 91.7] | 85.4 0.9 [83.6, 87.2] | +5.1 |
| CheXpert | 78.0 0.3 [77.5, 78.6] | 72.9 0.3 [72.3, 73.5] | +5.1 |
| ChestX-ray14 | 73.7 0.5 [72.7, 74.7] | 67.9 0.5 [66.9, 69.0] | +5.8 |
| PadChest | 84.6 0.3 [84.1, 85.1] | 78.7 0.3 [78.1, 79.3] | +5.9 |
| UKA-CXR | 83.5 0.2 [83.1, 83.9] | 81.0 0.2 [80.5, 81.4] | +2.5 |
Table 3: Macro AUROC of the two in-domain initializations, whose pretraining on MIMIC-CXR [ 17 ] differs only in being differentially private or not, on the test sets of five datasets ( test radiographs). Values are in percent, as the mean standard deviation [95% confidence interval] of 10,000 bootstrap resamples. is InDomain-stand minus InDomain-priv. Each of the 25 differences has in a two-sided paired bootstrap test with 10,000 resamples and no correction for multiple comparisons. Rows are grouped by the privacy setting of the finetuning. The test sets are those of Table 1 . AUROC, area under the receiver operating characteristic curve; , privacy budget; InDomain-stand and InDomain-priv, supervised pretraining on MIMIC-CXR without and with differential privacy.
Figure 5: Macro AUROC of three finetuning schemes at and on the test sets of VinDr-CXR [ 34 ] and CheXpert [ 16 ] ( test radiographs). Every model is a ConvNeXt-Small [ 27 ] finetuned with differentially private stochastic gradient descent [ 1 ] . Full finetuning trains all parameters, head-only finetuning trains only the classification head, and LoRA [ 15 ] trains low-rank adapters and the head. Colors mark the initializations. The dashed line in a – d marks the non-private macro AUROC of InDomain-stand with full finetuning. In a – d , a marker is the mean of 10,000 bootstrap resamples of the test set, and the error bar is the 95% confidence interval, from the 2.5th to the 97.5th percentile. No other panel has an error bar. Counts per panel: 9 runs and 1 non-private reference ( a – d ), 12 pairs of runs ( e , f ), 6 values that are means over 4 pairs of runs ( g ), 3 schemes ( h ), and 6 private runs against 2 non-private references ( i ). a – d , Macro AUROC on the test sets of VinDr-CXR ( ) at ( a ) and ( b ) and of CheXpert ( ) at ( c ) and ( d ). e , f , Macro AUROC with LoRA ( e ) and with head-only finetuning ( f ) minus that with full finetuning. The two panels share one color scale. A value below 0 takes the color of 0. g , Differences of e and f averaged over the two datasets and the two budgets. h , Number of trainable parameters of ConvNeXt-Small with each scheme, on a logarithmic axis. i , Non-private macro AUROC of InDomain-stand with full finetuning minus its macro AUROC at with each scheme. AUROC, area under the receiver operating characteristic curve; , privacy budget; He, He initialization [ 13 ] ; ImageNet, supervised pretraining on ImageNet [ 8 ] ; InDomain-stand, supervised pretraining on MIMIC-CXR [ 17 ] ; LoRA, low-rank adaptation.
Figure 6: Generalization to unseen institutions and effect of backbone capacity on the test sets of VinDr-CXR [ 34 ] , CheXpert [ 16 ] , ChestX-ray14 [ 53 ] , PadChest [ 5 ] , and UKA-CXR [ 21 ] ( test radiographs). A ConvNeXt-Small [ 27 ] was finetuned on the other four datasets for the held-out value of a dataset and on the dataset itself for its internal value. Private finetuning used differentially private stochastic gradient descent [ 1 ] . ConvNeXt-Tiny was trained from He initialization, ImageNet, and DINOv3 on VinDr-CXR and CheXpert. Colors mark the initializations, and marker shapes mark the privacy settings. No panel has an error bar. Counts per panel: 25 runs ( a , b , d ), means over the five datasets ( c , e ), 5 runs ( f ), 12 pairs of runs ( g , h ), and 8 and 12 values (dots in i ). a , b , Macro AUROC on each held-out dataset at ( a ) and without privacy ( b ). c , Internal minus held-out macro AUROC at . d , Held-out against internal at , with a dashed line of equality. e , Held-out macro AUROC. f , Macro AUROC with UKA-CXR held out at . g , ConvNeXt-Small against ConvNeXt-Tiny, with a dashed line of equality. h , ConvNeXt-Small minus ConvNeXt-Tiny. i , Range across the three initializations within each backbone, and absolute difference between the two backbones for each initialization, per dataset and privacy setting. A box spans the 25th to the 75th percentile with the median as a line and whiskers to the smallest and largest value. AUROC, area under the receiver operating characteristic curve; , privacy budget; He, He initialization [ 13 ] ; ImageNet, supervised pretraining on ImageNet [ 8 ] ; DINOv3, self-supervised DINOv3 pretraining [ 43 ] ; InDomain-stand, supervised pretraining on MIMIC-CXR [ 17 ] ; InDomain-priv, differentially private pretraining on MIMIC-CXR.
Figure 7: Macro AUROC of ConvNeXt-Small [ 27 ] classifiers finetuned with differentially private stochastic gradient descent [ 1 ] in demographic subgroups of the test sets of VinDr-CXR [ 34 ] , CheXpert [ 16 ] , ChestX-ray14 [ 53 ] , PadChest [ 5 ] , and UKA-CXR [ 21 ] ( test radiographs). The subgroups are male and female patients and the age bands from above 0 to below 40, from 40 to below 70, and from 70 to below 100 years. The sex gap is the absolute difference between the sexes, the age gap is the largest minus the smallest age-band value, and the worst subgroup has the smallest value of the five. Colors mark the initializations, and marker shapes mark the privacy settings in d . No panel has an error bar. Counts per panel: means over the five datasets ( a – f , h ), 5 datasets per initialization (dots in e ), and 25 combinations of dataset and initialization ( g , i ). a , Sex gap and age gap at . b , Macro AUROC within each subgroup at . c , Macro AUROC within each age band at . d , Age gap without privacy and at . e , Macro AUROC of the worst subgroup at . f , Macro AUROC of the worst subgroup without privacy minus that at . g , Macro AUROC of the worst subgroup at in each dataset. h , Macro AUROC of the worst subgroup against age gap at . i , Number of combinations of dataset and initialization in which each subgroup has the lowest macro AUROC at . AUROC, area under the receiver operating characteristic curve; , privacy budget; He, He initialization [ 13 ] ; ImageNet, supervised pretraining on ImageNet [ 8 ] ; DINOv3, self-supervised DINOv3 pretraining [ 43 ] ; InDomain-stand, supervised pretraining on MIMIC-CXR [ 17 ] ; InDomain-priv, differentially private pretraining on MIMIC-CXR.
Supplementary Fig. 1: Eight evaluation metrics of ConvNeXt-Small [ 27 ] classifiers finetuned with differentially private stochastic gradient descent [ 1 ] at the strictest privacy budget, , on the test sets of VinDr-CXR [ 34 ] , CheXpert [ 16 ] , ChestX-ray14 [ 53 ] , PadChest [ 5 ] , and UKA-CXR [ 21 ] ( test radiographs). Each metric is averaged over the five findings. Color marks the initialization. A marker is the mean of 10,000 bootstrap resamples of the test set, and its error bar is the 95% CI, from the 2.5th to the 97.5th percentile. Higher is better for every metric except the Brier score and ECE. Accuracy, sensitivity, and specificity use the per-finding thresholds selected on the validation set. Counts per panel: 25 markers, for 5 datasets and 5 initializations. a – h , AUROC, mean average precision, AUPRC, accuracy, sensitivity, specificity, Brier score, and ECE. Supplementary Fig. 2 plots the same metrics without privacy. AUPRC, area under the precision-recall curve; AUROC, area under the receiver operating characteristic curve; CI, confidence interval; ECE, expected calibration error; , privacy budget; He, He initialization [ 13 ] ; ImageNet, supervised pretraining on ImageNet [ 8 ] ; DINOv3, self-supervised DINOv3 pretraining [ 43 ] ; InDomain-stand and InDomain-priv, supervised pretraining on MIMIC-CXR [ 17 ] without and with differential privacy; mAP, mean average precision.
Supplementary Fig. 2: Eight evaluation metrics of ConvNeXt-Small [ 27 ] classifiers finetuned without privacy on the test sets of VinDr-CXR [ 34 ] , CheXpert [ 16 ] , ChestX-ray14 [ 53 ] , PadChest [ 5 ] , and UKA-CXR [ 21 ] ( test radiographs). Each metric is averaged over the five findings. Color marks the initialization. A marker is the mean of 10,000 bootstrap resamples of the test set, and its error bar is the 95% CI, from the 2.5th to the 97.5th percentile. Higher is better for every metric except the Brier score and ECE. Accuracy, sensitivity, and specificity use the per-finding thresholds selected on the validation set. Counts per panel: 25 markers, for 5 datasets and 5 initializations. a – h , AUROC, mean average precision, AUPRC, accuracy, sensitivity, specificity, Brier score, and ECE. Supplementary Fig. 1 plots the same metrics at . AUPRC, area under the precision-recall curve; AUROC, area under the receiver operating characteristic curve; CI, confidence interval; ECE, expected calibration error; , privacy budget; He, He initialization [ 13 ] ; ImageNet, supervised pretraining on ImageNet [ 8 ] ; DINOv3, self-supervised DINOv3 pretraining [ 43 ] ; InDomain-stand and InDomain-priv, supervised pretraining on MIMIC-CXR [ 17 ] without and with differential privacy; mAP, mean average precision.
Supplementary Fig. 3: AUROC of each finding for ConvNeXt-Small [ 27 ] classifiers at the strictest privacy budget, , under differentially private stochastic gradient descent [ 1 ] , and without privacy, on the test sets of VinDr-CXR [ 34 ] , CheXpert [ 16 ] , ChestX-ray14 [ 53 ] , PadChest [ 5 ] , and UKA-CXR [ 21 ] ( test radiographs). Each entry is the mean AUROC in percent over 10,000 bootstrap resamples of the test set, and its color encodes the same value on a scale shared by all panels. Columns are the initializations, and rows are the findings. No panel has an error bar. For CheXpert, a radiograph with an uncertain label for atelectasis or pleural effusion does not enter the AUROC of that finding. Counts per panel: 25 entries, for 5 findings and 5 initializations. a , c , e , g , i , VinDr-CXR, CheXpert, ChestX-ray14, PadChest, and UKA-CXR at . b , d , f , h , j , The same datasets without privacy. AUROC, area under the receiver operating characteristic curve; , privacy budget; He, He initialization [ 13 ] ; ImageNet, supervised pretraining on ImageNet [ 8 ] ; DINOv3, self-supervised DINOv3 pretraining [ 43 ] ; InDomain-stand and InDomain-priv, supervised pretraining on MIMIC-CXR [ 17 ] without and with differential privacy.
Supplementary Fig. 4: Macro AUROC within each demographic subgroup for ConvNeXt-Small [ 27 ] classifiers at the strictest privacy budget, , under differentially private stochastic gradient descent [ 1 ] , and without privacy, on the test sets of VinDr-CXR [ 34 ] , CheXpert [ 16 ] , ChestX-ray14 [ 53 ] , PadChest [ 5 ] , and UKA-CXR [ 21 ] ( test radiographs). Each entry is the mean macro AUROC in percent over 10,000 bootstrap resamples of the test set, restricted to the radiographs of the subgroup. Its color encodes the same value on a scale shared by all panels. Columns are the initializations, and rows are the subgroups. No panel has an error bar. The subgroups are male and female patients and the age bands from above 0 to below 40, from 40 to below 70, and from 70 to below 100 years. A radiograph without a recorded attribute belongs to no subgroup of that attribute. Supplementary Table 7 lists the size of every subgroup. Counts per panel: 25 entries, for 5 subgroups and 5 initializations. a , c , e , g , i , VinDr-CXR, CheXpert, ChestX-ray14, PadChest, and UKA-CXR at . b , d , f , h , j , The same datasets without privacy. AUROC, area under the receiver operating characteristic curve; , privacy budget; He, He initialization [ 13 ] ; ImageNet, supervised pretraining on ImageNet [ 8 ] ; DINOv3, self-supervised DINOv3 pretraining [ 43 ] ; InDomain-stand and InDomain-priv, supervised pretraining on MIMIC-CXR [ 17 ] without and with differential privacy.
| Term | Definition |
|---|---|
| Data | |
| Datasets | VinDr-CXR [ 34 ] , CheXpert [ 16 ] , ChestX-ray14 [ 53 ] , PadChest [ 5 ] , and UKA-CXR [ 21 ] , with 591,884 radiographs in total. Each dataset is split into training, validation, and test sets. |
| MIMIC-CXR | The 153,255 frontal radiographs of the training split of MIMIC-CXR [ 17 ] , used only to pretrain the two in-domain initializations. |
| Findings | The five labels of every radiograph: atelectasis, cardiomegaly, pleural effusion, pneumonia, and no finding. |
| Initializations | |
| He initialization (He) | Training from scratch. Every convolutional and linear weight is drawn from the He (Kaiming) normal distribution [ 13 ] . No weight comes from a trained model. |
Supplementary Table 1: Glossary of the terms of this study, grouped by data, initialization, contrast, privacy, finetuning, metric, and reporting convention. Every metric is a percentage computed on the test set of a dataset. The tables omit the percent sign.
| Analysis | Comparison | Result | Interpretation |
|---|---|---|---|
| Privacy-utility frontier | Five initializations on five datasets at every privacy setting | InDomain-stand highest in 24 of 25 combinations and equal to DINOv3 on UKA-CXR without privacy (88.8 each, ). Lead over ImageNet and DINOv3 of 2.6 and 1.4 without privacy and of 15.3 and 8.8 at | In-domain pretraining sets the frontier. Its lead grows under privacy |
| Loss under privacy | Non-private training against | Decrease of 5.1 for InDomain-stand, 7.3 for InDomain-priv, 12.5 for DINOv3, and 17.8 for ImageNet. He initialization at 50.2 to 56.5 at every privacy budget | The domain-matched initialization loses the least |
| Dataset size | InDomain-stand minus ImageNet in each dataset | 31.1 at and 5.8 without privacy on VinDr-CXR, the smallest dataset. Between 9.7 and 14.5 at and between 0.6 and 3.3 without privacy on the other four datasets | The in-domain lead is largest on the smallest dataset |
| Other metrics | Eight metrics at , averaged over the datasets | Best AUROC, AUPRC, mean average precision, accuracy, sensitivity, specificity, and Brier score for InDomain-stand. Its ECE of 8.4 is above those of ImageNet (7.5) and He initialization (5.8) | The advantage holds for seven of the eight metrics |
| Objective and domain | The two contrasts and their difference | Both contrasts positive in all 25 combinations. Domain contrast larger in 24 of 25, with a mean 2.2 times the mean objective contrast without privacy and 2.4 to 3.7 times under privacy. Difference of 2.1 to 12.6 under privacy, each of the 20 with | Changing the domain improves macro AUROC more than changing the objective at every privacy budget |
| Privacy spent | Converged epoch and achieved at | Converged epoch of 18.6, 22.2, 37.0, 38.4, and 39.4, and achieved at 67%, 77%, 96%, 98%, and 99% of the upper end of the budget, for InDomain-stand, InDomain-priv, DINOv3, He initialization, and ImageNet | The domain-matched initializations converge earlier and spend less |
Supplementary Table 2: Summary of the findings, in the order in which they are reported. Values are taken unchanged from the main text. Every value is a macro AUROC or a difference in macro AUROC in percent, unless the row names another quantity. The -values are from the two-sided paired bootstrap test. The datasets are VinDr-CXR [ 34 ] , CheXpert [ 16 ] , ChestX-ray14 [ 53 ] , PadChest [ 5 ] , and UKA-CXR [ 21 ] . AUPRC, area under the precision-recall curve; AUROC, area under the receiver operating characteristic curve; ECE, expected calibration error; , privacy budget; He, He initialization [ 13 ] ; ImageNet, supervised pretraining on ImageNet [ 8 ] ; DINOv3, self-supervised DINOv3 pretraining [ 43 ] ; InDomain-stand and InDomain-priv, supervised pretraining on MIMIC-CXR [ 17 ] without and with differential privacy; LoRA, low-rank adaptation [ 15 ] .
| Achieved | ||||||||
| Privacy budget | Sampling rate | Noise multiplier | Clipping norm | He | ImageNet | DINOv3 | InDomain-stand | InDomain-priv |
| VinDr-CXR | ||||||||
| 0.01075 | 2.910 | 4.0 | 1.0 | 1.0 | 1.0 | 0.2 | 1.0 | |
| 0.01075 | 1.426 | 4.0 | 3.0 | 3.0 | 2.9 | 0.6 | 3.0 | |
| 0.01075 | 1.067 | 4.0 | 6.0 | 6.0 | 5.7 | 5.7 | 5.7 | |
| 0.01075 | 0.908 | 4.0 | 9.0 | 9.0 | 8.3 | 9.0 | 7.8 | |
Supplementary Table 3: Privacy accounting of the 100 differentially private runs of the main experiment. The Poisson sampling rate, the noise multiplier, and the per-sample clipping norm depend on the dataset and the privacy budget and are identical for the five initializations. They are therefore listed once. On VinDr-CXR, the accountant computed the achieved at a sampling rate of 1/92, the reciprocal of its 92 steps per epoch. The achieved is the budget spent up to the epoch whose model was kept and is given for each initialization at one decimal. Rows are grouped by dataset and ordered by privacy budget, from the strictest to the loosest. Every run used and a noise multiplier calibrated for 150 epochs. Every model is a ConvNeXt-Small [ 27 ] finetuned with differentially private stochastic gradient descent [ 1 ] on VinDr-CXR [ 34 ] , CheXpert [ 16 ] , ChestX-ray14 [ 53 ] , PadChest [ 5 ] , and UKA-CXR [ 21 ] . , privacy budget; He, He initialization [ 13 ] ; ImageNet, supervised pretraining on ImageNet [ 8 ] ; DINOv3, self-supervised DINOv3 pretraining [ 43 ] ; InDomain-stand and InDomain-priv, supervised pretraining on MIMIC-CXR [ 17 ] without and with differential privacy.
| Privacy budget | He | ImageNet | DINOv3 | InDomain-stand | InDomain-priv |
|---|---|---|---|---|---|
| VinDr-CXR | |||||
| 3,772 | 3,772 | 3,772 | 184 | 3,680 | |
| 5,428 | 5,428 | 5,060 | 92 | 5,428 | |
| 8,188 | 8,188 | 7,452 | 7,544 | 7,360 | |
| 9,568 | 9,660 | 8,372 | 9,660 | 7,360 | |
| CheXpert | |||||
Supplementary Table 4: Optimization steps of the 100 differentially private runs of the main experiment. Each entry is the number of optimization steps taken up to the epoch whose model was kept, which is the epoch of highest validation macro AUROC. This count determines the achieved in Supplementary Table 3 . Rows are grouped by dataset and ordered by privacy budget, from the strictest to the loosest, and columns are ordered from no pretraining to in-domain pretraining. The datasets are VinDr-CXR [ 34 ] , CheXpert [ 16 ] , ChestX-ray14 [ 53 ] , PadChest [ 5 ] , and UKA-CXR [ 21 ] . AUROC, area under the receiver operating characteristic curve; , privacy budget; He, He initialization [ 13 ] ; ImageNet, supervised pretraining on ImageNet [ 8 ] ; DINOv3, self-supervised DINOv3 pretraining [ 43 ] ; InDomain-stand and InDomain-priv, supervised pretraining on MIMIC-CXR [ 17 ] without and with differential privacy.
| Held-out dataset | He | ImageNet | DINOv3 | InDomain-stand | InDomain-priv |
|---|---|---|---|---|---|
| VinDr-CXR | 51.4 1.2 [49.1, 53.6] | 61.0 1.1 [58.8, 63.1] | 73.6 1.2 [71.2, 75.8] | 88.6 0.6 [87.3, 89.8] | 79.6 0.9 [77.9, 81.3] |
| CheXpert | 52.0 0.3 [51.5, 52.6] | 62.6 0.3 [62.0, 63.2] | 66.4 0.3 [65.8, 67.0] | 74.8 0.3 [74.2, 75.4] | 69.3 0.3 [68.7, 69.9] |
| ChestX-ray14 | 50.3 0.4 [49.4, 51.2] | 58.4 0.6 [57.2, 59.5] | 61.3 0.6 [60.1, 62.5] | 73.0 0.5 [72.0, 74.0] | 65.6 0.6 [64.4, 66.7] |
| PadChest | 51.1 0.4 [50.3, 51.9] | 65.2 0.4 [64.4, 65.9] | 73.3 0.3 [72.7, 74.0] | 80.0 0.3 [79.4, 80.7] | 76.7 0.3 [76.1, 77.3] |
| UKA-CXR | 50.0 0.3 [49.4, 50.6] | 67.4 0.3 [66.8, 68.0] | 61.7 0.2 [61.2, 62.1] | 66.2 0.2 [65.8, 66.6] | 61.6 0.2 [61.2, 62.1] |
Supplementary Table 5: Leave-one-dataset-out generalization to unseen institutions ( test radiographs). Each dataset was held out in turn, a ConvNeXt-Small [ 27 ] was trained on the pooled training data of the other four, and macro AUROC in percent was measured on the test set of the held-out dataset. Values are the bootstrap mean standard deviation with the 95% CI in brackets from 10,000 resamples. Rows are grouped by privacy setting, and columns are ordered from no pretraining to in-domain pretraining. The held-out test sets are those of Table 1 , from VinDr-CXR [ 34 ] , CheXpert [ 16 ] , ChestX-ray14 [ 53 ] , PadChest [ 5 ] , and UKA-CXR [ 21 ] . AUROC, area under the receiver operating characteristic curve; CI, confidence interval; , privacy budget; He, He initialization [ 13 ] ; ImageNet, supervised pretraining on ImageNet [ 8 ] ; DINOv3, self-supervised DINOv3 pretraining [ 43 ] ; InDomain-stand and InDomain-priv, supervised pretraining on MIMIC-CXR [ 17 ] without and with differential privacy.
| Initialization | ConvNeXt-Tiny | ConvNeXt-Small | |
| VinDr-CXR, | |||
| He | 50.9 1.1 [48.6, 53.1] | 52.2 1.2 [49.8, 54.5] | +1.3 |
| ImageNet | 62.9 1.1 [60.7, 65.0] | 59.4 1.0 [57.3, 61.5] | -3.5 |
| DINOv3 | 71.3 1.2 [68.9, 73.6] | 77.9 1.2 [75.5, 80.3] | +6.6 |
| VinDr-CXR, non-private | |||
| He | 50.5 1.1 [48.3, 52.5] | 51.5 1.2 [49.2, 53.7] | +1.0 |
Supplementary Table 6: Effect of backbone capacity on macro AUROC in percent on two test sets ( test radiographs). ConvNeXt-Tiny [ 27 ] has 27.8 million parameters and ConvNeXt-Small 49.5 million. Values are the bootstrap mean standard deviation with the 95% CI in brackets from 10,000 resamples, and is ConvNeXt-Small minus ConvNeXt-Tiny. The two in-domain initializations exist for ConvNeXt-Small only. The comparison therefore covers the three other initializations. The test sets comprise 3,000 (VinDr-CXR [ 34 ] ) and 29,321 (CheXpert [ 16 ] ) radiographs. AUROC, area under the receiver operating characteristic curve; CI, confidence interval; , privacy budget; He, He initialization [ 13 ] ; ImageNet, supervised pretraining on ImageNet [ 8 ] ; DINOv3, self-supervised DINOv3 pretraining [ 43 ] .
| Subgroup | Radiographs | Atelectasis | Cardiomegaly | Pleural effusion | Pneumonia | No finding |
|---|---|---|---|---|---|---|
| VinDr-CXR (1,746 without a recorded sex, 2,532 outside the age bands) | ||||||
| Male | 702 | 4 | 8 | 6 | 11 | 56 |
| Female | 552 | 3 | 22 | 4 | 7 | 56 |
| Age 40 | 149 | 1 | 4 | 1 | 5 | 84 |
| Age 40 to 70 | 250 | 6 | 15 | 4 | 10 | 46 |
| Age 70 to 100 | 69 | 4 | 46 | 6 | 13 | 6 |
Supplementary Table 7: Composition of the demographic subgroups of the five test sets ( test radiographs). For every subgroup, the table gives the number of radiographs and the prevalence in percent of each finding within it. The age bands are from above 0 to below 40, from 40 to below 70, and from 70 to below 100 years. For CheXpert, the prevalence of atelectasis and pleural effusion is computed over the radiographs with a label for that finding. The heading row of each dataset lists the number of test radiographs without a recorded sex and the number with an age outside the three age bands. These radiographs belong to no subgroup of that attribute. Rows are ordered by dataset and within a dataset by sex and then by age band. The datasets are VinDr-CXR [ 34 ] , CheXpert [ 16 ] , ChestX-ray14 [ 53 ] , PadChest [ 5 ] , and UKA-CXR [ 21 ] .
| Dataset | Total | Training | Validation | Test | Patients | Projections |
|---|---|---|---|---|---|---|
| VinDr-CXR | 18,000 | 12,000 | 3,000 | 3,000 | N/A | All |
| CheXpert | 157,878 | 115,458 | 13,099 | 29,321 | 57,872 | Frontal |
| ChestX-ray14 | 112,120 | 77,870 | 8,654 | 25,596 | 30,805 | All |
| PadChest | 110,525 | 79,697 | 8,783 | 22,045 | 67,205 | PA, AP, horizontal AP |
| UKA-CXR | 193,361 | 137,902 | 15,353 | 40,106 | 54,176 | All |
| All five datasets | 591,884 |
Supplementary Table 8: Size and composition of the five datasets after projection filtering ( radiographs). Columns give the number of radiographs in total and in the training, validation, and test splits, the number of unique patients, and the projections retained. VinDr-CXR records no patient identifiers, and its validation split is 20% of its official training split. The datasets are VinDr-CXR [ 34 ] , CheXpert [ 16 ] , ChestX-ray14 [ 53 ] , PadChest [ 5 ] , and UKA-CXR [ 21 ] . AP, anteroposterior; N/A, not applicable; PA, posteroanterior.
| Split | Radiographs | Atelectasis | Cardiomegaly | Pleural effusion | Pneumonia | No finding |
|---|---|---|---|---|---|---|
| VinDr-CXR | ||||||
| Training | 12,000 | 51 ( 1) | 1,453 (12) | 507 (4) | 377 (3) | 8,481 (71) |
| Validation | 3,000 | 11 ( 1) | 364 (12) | 127 (4) | 94 (3) | 2,120 (71) |
| Test | 3,000 | 86 (3) | 309 (10) | 111 (4) | 246 (8) | 2,051 (68) |
| CheXpert | ||||||
| Training | 115,458 | 19,488 (19) | 14,317 (12) | 48,439 (44) | 2,851 (2) | 12,088 (10) |
Supplementary Table 9: Number of positive radiographs of each finding in every split of the five datasets ( radiographs), with the percentage of the split in parentheses. The findings are not mutually exclusive. The percentages of a split therefore do not sum to 100. The training counts set the positive weights of the loss in Eq. 1 . For CheXpert, the percentage of atelectasis and pleural effusion is taken over the radiographs with a label for that finding. The datasets are VinDr-CXR [ 34 ] , CheXpert [ 16 ] , ChestX-ray14 [ 53 ] , PadChest [ 5 ] , and UKA-CXR [ 21 ] .
| Dataset | Training radiographs | Non-private (min) | Private (min) | Ratio | Total (h) |
|---|---|---|---|---|---|
| VinDr-CXR | 12,000 | 0.9 | 1.9 | 2.12 | 49 |
| CheXpert | 115,458 | 8.6 | 18.5 | 2.16 | 439 |
| ChestX-ray14 | 77,870 | 6.1 | 12.8 | 2.08 | 317 |
| PadChest | 79,697 | 6.3 | 13.2 | 2.08 | 325 |
| UKA-CXR | 137,902 | 10.8 | 22.6 | 2.08 | 486 |
| All five datasets | 422,927 | 1,616 |
Supplementary Table 10: Training cost of the 125 runs of the main experiment. For each dataset, the table gives the number of training radiographs, the mean time of one epoch without privacy and under DP-SGD [ 1 ] , the ratio of the two, and the total training time summed over the 25 runs of that dataset. The epoch time of a run is the mean of its epoch times in the most populated window of plus or minus 5% of their median. The last row gives the total number of training radiographs and the total training time of the 125 runs. The datasets are VinDr-CXR [ 34 ] , CheXpert [ 16 ] , ChestX-ray14 [ 53 ] , PadChest [ 5 ] , and UKA-CXR [ 21 ] . DP-SGD, differentially private stochastic gradient descent.