A Data-Interventional Framework for Auditing Privacy and Fairness in Generative Medical Imaging

Mischa Dombrowski; Bernhard Kainz

cs.CVSep 22, 2026

A Data-Interventional Framework for Auditing Privacy and Fairness in Generative Medical Imaging

Authors: Mischa Dombrowski, Bernhard Kainz

Organizations: Friedrich-Alexander-Universität Erlangen-Nürnberg, Erlangen, DE · Imperial College London, London, UK

Abstract

Diffusion-based synthetic data generation offers a promising route for sharing medical imaging data without releasing sensitive patient records. However, generative models face a fundamental tension between privacy and fairness: they may memorize rare training samples, leading to privacy risks, or fail to reproduce underrepresented features, resulting in unfair synthetic distributions. While prior work has largely focused on either memorization or fairness in isolation, their interaction remains insufficiently understood. In this work, we introduce a data-interventional framework to systematically analyze privacy and fairness in diffusion models. We discuss synthetic anatomical fingerprints (SAFs), rare and manually injected image features, as controlled probes to study whether models generalize sensitive attributes across identities, memorize training samples, or suppress rare signals entirely. Across multiple conditioning modalities, we observe a consistent behavior: models either forget these fingerprints or memorize the entire image in which they appear, but do not generalize them to novel images. To support large-scale auditing where explicit sample extraction is infeasible, we further introduce the indicator metric t', which estimates a model's susceptibility to memorization by exploiting the internal structure of the diffusion process. By comparing conditioning signals of varying surprisal, we reveal a clear relationship between conditioning rarity and memorization behavior. Highly surprising conditioning signals act as retrieval keys that amplify memorization, whereas low-surprisal conditioning signals systematically suppress rare features, even when these appear repeatedly in the training data. Our findings provide actionable insights and concrete mitigation strategies for safe and fair synthetic medical data sharing. Code is available at https://github.com/MischaD/Privacy.

Figures & tables

Figure 1: (Left) Training and generated images fall into one of four categories: generalized, memorized, forgotten or lost. Using SAFs, we aim to investigate the category for a selected subgroup of images. (Right) We use synthetic anatomical fingerprints (grey circle inside the blue rectangle) to quantify to which of these categories they belong. Ideally the model learns to pick up their signal and learns to reproduce them without memorizing the entire image (generalization). Memorizing the fingerprints together with their training image would lead to privacy issues. Forgetting them would lead to fairness issues. The dashed border indicates that images are synthetically generated.

Figure 2: Extracting memorized samples from a trained diffusion model. The attacker learns that a ring is in the patient’s image, uses this information, and filters generated samples until reproducing the training image.

Figure 3: Example SAF: To create realistic fingerprints, we use source patches (top row) and inpaint them into target images (bottom row) using poission image editing. Depending on the similarity of source and target image, the fingerprints are barely visible.

Figure 4: Example images with low (left) and high (right) surprisal.

Description		SAF classification		Data synthesis
Dataset	$\|N_{D}\|$	SAF (%)	ID (%)	$\text{FID}_{train}$	$\text{FID}_{test}$	$\mathbb{E}(\|q\|)$	$\|q\|$	$t^{\prime}$
BreastMNIST	546	100	98.7	9.2	62.6	91.6	57	0.886
RetinaMNIST	1080	100	99.6	5.9	19.7	46.3	52	0.998
PneumoniaMNIST	4708	100	99.8	9.5	28.4	10.6	2	0.718
BloodMNIST	11959	100	99.5	9.3	11.0	4.2	0	0.241
OrganSMNIST	13940	99.47	99.8	19.6	19.7	3.6	0	0.582

Table 1: Training results for different MedMNIST datasets. A privacy-preserving model has a low value for

t^{\prime}

, indicating a low likelihood of reproducing the sample itself, but the expected incidence of the SAF should remain close to the observed one

\mathbb{E}(|q|)\sim|q|

|N_{D}|

denotes the number of training samples.

		Classification		OD (Inception)		ID (CXR)		Privacy
	$\|N_{D}\|$	SAF (%)	ID (%)	$\text{FID}_{\text{train}}$	$\text{FID}_{\text{test}}$	$\text{FID}_{\text{train}}$	$\text{FID}_{\text{test}}$	$\mathbb{E}(\|q\|)$	$\|q\|$	$t^{\prime}$
ChestX-ray14	875	100.00	100.00	15.1	30.3	1.0	2.3	34.3	47	0.75
	1750			12.3	29.3	1.0	2.4	17.1	5	0.86
	3500			13.6	32.0	1.2	2.6	8.6	1	0.67
	7001			18.8	38.4	1.6	3.0	4.3	0	0.72
	14003			22.1	41.4	1.9	3.3	2.1	0	0.66

Table 2: Quantitative results on CXR data using two backbones: OD (out-of-domain) Inception and ID (in-domain) models for CXR ( Cohen et al., 2022 ) . Larger datasets reduce memorization risk, quantified by

t^{\prime}

Figure 5: Impact of training length. To assess model memorization, we investigate PSNR and

C_{f+}

. The dashed line in the bottom row indicates the results of a fair model (SAFs appear equally often in training and synthetic datasets).

	# Trainable parameters	$\|q\|$	FID	$t^{\prime}$
Default	$113\,675\,524$	5	32.7	0.77
Model 1	$77\,364\,740$	9	33.0	0.74
Model 2	$71\,439\,108$	0	33.9	0.69
Model 3	$49\,558\,020$	1	34.8	0.69
Model 4	$28\,484\,612$	0	78.7	0.66
Model 5	$28\,448\,388$	0	43.6	0.64

Table 3: Privacy metrics for different model sizes. Architecture details are given in Table 6 .

		PSNR			$C_{f+}$			t’
	Circle	PII	Feature	Cirle	PII	Feature	Cirle	PII	Feature
ChestX-ray14	$24.76$	$25.06$	$24.54$	$0.00$	$0.00$	$0.00$	$0.14$	$0.25$	$0.43$
BCI	$46.41$	$46.48$	$46.01$	$0.00$	$0.00$	$0.00$	$0.10$	$0.26$	$0.25$
ODIR-2019	$46.93$	$46.18$	$47.14$	$51.33$	$61.67$	$39.33$	$0.76$	$0.77$	$0.78$

Table 4: Memorization results for all three datasets. Results are averaged over three different runs. All ChestX-ray14 and BCI runs result in fairness issues due to the complete lack of reproducing the SAFs.

Figure 6: Number of detected fingerprints in the synthetic dataset and memorization indicator

t’

as a function of the number of fingerprinted training samples

N_{f}

. The grey line marks the threshold at which models begin reproducing fingerprints. Left to this threshold, fingerprints are either forgotten or memorized together with their training identity; right to it, early signs of generalization emerge for ChestX-ray14 and BCI datasets.

Figure 7: FID as a function of guidance strength for all four conditioning methods. Each curve represents one method trained on MIMIC-CXR. For Stable Diffusion-based architectures (text, mask), guidance strengths range from 0 to 9; for EDM-based architectures (class, feature), from 1 to 3. Lower FID indicates better perceptual quality.

Conditioning	Split	$N_{f}$
Conditioning	Split	1	5	10	20
Class	high	0	0	1 – 1	38 – 22
Class	low	0	0	0	1 – 1
Text	high	0	55 – 47	111 – 108	195 – 180
Text	low	0	0	0	0
Mask	high	0	0	0	0

Table 5: Counts of detected fingerprints and memorized fingerprints (

C_{f+}

–

|q|

). Columns indicate the number of fingerprints

N_{f}

present in the training dataset. Experiments are grouped by conditioning type and by whether fingerprints are embedded in low surprisal or high surprisal conditionings. For truly unique fingerprints (

N_{f}=1

), all methods forget them. In general, fingerprints embedded in low surprisal conditionings tend to be forgotten, while fingerprints embedded in high surprisal images are memorized.

Figure 8: Comparison of training images (top) containing SAFs with generated images that received positive SAF and identity predictions (bottom). The SAF is indicated by the blue box. In all shown cases, the entire training image is reproduced, confirming memorization rather than generalization of the fingerprint alone.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 9: Illustration of our estimation method in 1D. The grey line denotes the query image $\mathbf{x}_{p}$ . The estimation method iteratively increases the search space in the latent space of the generative model. The green area corresponds to image regions resulting in non-privacy concerning generated samples, while the red area is considered critical.

Figure 10: Illustration of the reverse diffusion process. Left shows query images $\mathbf{x}_{t,p}$ for $t\in\left[0,0.7\right]$ . Right shows the resulting sample.

Default	$113\,675\,524$	6	c,c,2c,2c,4c,4c	2
	# Trainable params	Down blocks	Channels / layer	Layers / block
Model 1	$77\,364\,740$	6	c,c,2c,2c,4c,4c	1
Model 2	$71\,439\,108$	5	c,c,2c,2c,4c,4c	2
Model 3	$49\,558\,020$	5	c,c,2c,2c,4c,4c	1
Model 4	$28\,484\,612$	4	c,c,2c,2c,4c,4c	2
Model 5	$28\,448\,388$	6	c/2,c/2,c,c,2c,2c	2

Appendix

Table 6: Model architecture for the unconditional U-Net used as backbone for the diffusion model. The standard value for the number of channels is

c=128

Figure 11: Pixel-wise entropy map of lung segmentation masks.

Privacy Auditing

Privacy auditing evaluates whether data, models, and AI systems expose sensitive information under realistic adversaries and use.

See all 81 papers

Sep 3, 2026

Auditing Patient Privacy in Medical Generative Models: Scalable Memorization Detection with DeepSSIM++

While deep generative models offer new opportunities for medical image synthesis and data sharing, their ability to memorize and reproduce training samples raises serious concerns about patient confidentiality. Detecting such memorization at scale remains challenging: traditional pixel-based metrics are sensitive to generation artifacts, whereas generic embedding-based metrics often lack the anatomical sensitivity required for medical data. To address this challenge, we introduce DeepSSIM++, a self-supervised similarity metric for scalable memorization auditing in medical generative models. By leveraging multi-scale feature aggregation and anatomy-preserving augmentations, DeepSSIM++ learns an embedding space where cosine similarity approximates the Structural Similarity Index (SSIM), eliminating the need for exact pixel-level registration. Compared with state-of-the-art baselines, DeepSSIM++ achieves an average Macro F1 improvement of 33 percentage points under ideal alignment and 46 percentage points under realistic spatial and intensity perturbations. Furthermore, it accelerates large-scale similarity computation by several orders of magnitude compared with analytical SSIM. By combining anatomical sensitivity and computational efficiency, DeepSSIM++ provides an open-source tool for scalable memorization auditing in medical generative AI. Code and data are publicly available at: https://github.com/brAIn-science/DeepSSIM.

Antonio Scardace, Francesco Guarnera, Sebastiano Battiato +1

University of Catania, Department of Mathematics and Computer Science, Catania, Italy

Privacy Auditing Memorization in Generative Models Medical Image Synthesis

Ask PDF

Jun 1, 2026

FairGen: Preference-Aligned Diffusion for Demographically Equitable Medical Image Synthesis

Medical imaging is central to modern diagnostics, and artificial intelligence (AI) systems are increasingly used to support image-based analysis by improving efficiency, accuracy, and access to care. However, inequities in healthcare access and differential disease prevalence create severe demographic imbalances in clinical image data. Such imbalances are compounded by the fact that diseases can manifest with distinct features across demographic groups, rendering certain phenotypic presentations naturally rare. AI models trained on such imbalanced data risk perpetuating diagnostic bias and widening healthcare disparities. Here we introduce FairGen, a fairness-aware diffusion framework that synthesizes demographically balanced medical images while preserving pathology-relevant visual features. By embedding physician-aligned preferences into the generation process, FairGen improves subgroup coverage during synthesis and downstream classification. Applied to dermatology, radiology, and neuroimaging benchmark tasks, FairGen achieves fairness improvements of 95.9% for skin images, 80.0% for chest radiography, and 35.2% for brain MRI, while maintaining competitive diagnostic accuracy relative to models trained on original clinical data. Clinician-facing expert review and external validation on independent cohorts further support that these gains extend beyond standard fidelity metrics and are not confined to the original in-distribution datasets.

Zhimin Li, Ruichen Zhang, Zhen Tan +3

University of Pittsburgh, Swanson School of Engineering, Pittsburgh, 15261, USA · 2The University of North Carolina at Chapel Hill, Department of Computer Science, Chapel Hill, 27599, USA · 3Arizona State University, School of Computing and Augmented Intelligence, Tempe, 85281, USA +1

Diffusion Model Alignment Synthetic Data Augmentation Algorithmic Fairness Diffusion-Based Image Generation Medical Image Synthesis Fairness in Medical Image Classification

Ask PDF

Jun 1, 2026

No Free Lunch for Synthetic Images under Data Scarcity Conditions

This study investigates the trade-offs between fidelity, privacy, and utility in synthetic data generation under conditions of data scarcity and privacy sensitivity. We propose an evaluation framework that jointly assesses these three dimensions and apply it to three widely used generative models, VAE, GAN, and DDPM. The evaluation spans three image datasets, MNIST, OCTMNIST, and OrganAMNIST, encompassing both general-purpose and medical imaging domains. Notable differences arise between the three models in their behaviour when differential privacy mechanisms are introduced during training. GAN and DDPM demonstrate greater robustness, maintaining higher fidelity and downstream utility across a range of noise levels, while VAE degrades more rapidly as privacy constraints increase. This study highlights the importance of a multidimensional evaluation of deep generative models, also noting that their behaviour significantly differs when privacy techniques are applied.

Borja Arroyo Galende, Alejandro Almodóvar, Patricia A. Apellániz +3

Information Processing and Telecommunications Center, Escuela Técnica Superior de Ingeniería de Telecomunicación, Universidad Politécnica de Madrid, Madrid, 28030, Spain · Escuela Técnica Superior de Ingeniería de Sistemas Informáticos, Universidad Politécnica de Madrid, Madrid, 28030, Spain

Synthetic Data Generation Generative Modeling Medical Image Synthesis Image Generation Evaluation Synthetic Data Evaluation

Ask PDF

Abstract

Privacy Auditing

Explore similar work

Auditing Patient Privacy in Medical Generative Models: Scalable Memorization Detection with DeepSSIM++

FairGen: Preference-Aligned Diffusion for Demographically Equitable Medical Image Synthesis

No Free Lunch for Synthetic Images under Data Scarcity Conditions