Health-misinformation analysis presents a dual challenge: misleading claims can affect public well-being, while systems designed to detect them may expose sensitive user-submitted text. This motivates privacy-preserving inference for public-health applications in which user queries may contain confidential medical information and trained models and reference databases are maintained on organizational servers. We design a privacy-preserving text inference framework based on CKKS homomorphic encryption for health-misinformation classification and semantic retrieval. The classification pipeline fuses BioBERT embeddings, PCA-reduced MPNet embeddings, and SVD-reduced TF-IDF features, while the retrieval pipeline combines MPNet embeddings with ISCC-SCT semantic fingerprints through late fusion. We evaluate predictive performance and benchmark plaintext versus ciphertext-based execution. The hybrid classifier achieved an accuracy of 0.971 and a macro-F1 score of 0.950, with identical reported metrics under plaintext and ciphertext-based inference. The hybrid late-fusion similarity model achieved a Pearson correlation of 0.8691 with human sentence-pair similarity scores on STS-B. For ciphertext-based retrieval, we evaluated naive and optimized implementations. The optimized implementation uses CKKS single instruction, multiple data (SIMD) packing to compute and return multiple similarity scores together, reducing single-query latency over 7,128 indexed items from 222.028 to 5.168 seconds and communication overhead from 6.11 GB to 2.13 MB. These findings demonstrate the technical feasibility of privacy-preserving text inference for health-misinformation applications and characterize its predictive utility and efficiency trade-offs.
Figures & tables
Representation
Dim.
Accuracy
F1-Fake
F1-Real
Macro-F1
Total HE (s)
TF-IDF
300
0.942
0.844
0.964
0.904
94.347
BioBERT
768
0.944
0.844
0.966
0.905
79.918
MPNet
256
0.938
0.837
0.962
0.899
44.230
BioBERT + MPNet
1,024
0.967
0.906
0.980
0.943
51.754
BioBERT + TF-IDF
1,068
0.957
0.878
0.974
0.926
97.476
Full hybrid
1,324
0.971
0.918
0.983
0.950
132.789
Table 1: Classification performance and ciphertext-based inference cost over 1,081 held-out test samples
Representation
Pearson
Spearman
MSE
MAE
ISCC-SCT
0.8302
0.8298
0.0938
0.2445
MPNet
0.8625
0.8699
0.1327
0.3084
ISCC-SCT + Ridge calibration
0.8312
0.8298
0.0289
0.1323
MPNet + Ridge calibration
0.8666
0.8697
0.0237
0.1192
Late Ridge fusion
0.8691
0.8682
0.0232
0.1170
Table 2: Semantic similarity performance on the STS-B test split
Mode
Encode (s)
Encrypt (s)
Server (s)
Decrypt (s)
Total (s)
Communication
Plaintext
0.053
0.000
0.004
0.000
0.057
63.69 KB
Naive Ciphertext-based
0.053
0.008
210.695
11.272
222.028
6.11 GB
Opt. Ciphertext-based
0.053
0.008
5.105
0.002
5.168
2.13 MB
Table 3: Single-query retrieval latency and communication over 7,128 database items
Membership inference attacks (MIAs) try to determine whether a specific record was used to train a model, a privacy risk that matters in natural language processing (NLP), where training data can contain sensitive user text. This paper presents a controlled benchmark of membership inference vulnerability for text classification on the GLUE SST-2 sentiment dataset. A TF-IDF + Logistic Regression pipeline and a fine-tuned DistilBERT classifier are compared under a loss-threshold MIA, with utility measured by development accuracy and macro F1. DistilBERT reached 0.9466 accuracy and 0.9460 macro F1 against 0.8756 and 0.8727 for Logistic Regression, yet both models leaked membership signal (Attack AUC 0.5615 and 0.5800, respectively). Two mitigations were tested. Stronger regularization reduced leakage for Logistic Regression at a visible utility cost, whereas fine-tuning DistilBERT for 2 epochs instead of 3 reduced leakage with negligible accuracy loss. Lightweight training adjustments can improve the privacy-utility trade-off without complex defenses.
Current LLM-based services typically require users to submit raw text regardless of its sensitivity. While intuitive, such practice introduces substantial privacy risks, as unauthorized access may expose personal, medical, or legal information. Although prior defenses strived to mitigate these risks, they often incur substantial computational overhead and degrade model performance. To overcome this privacy-efficiency trade-off, we introduce Privacy-Preserving Fine-Tuning (PPFT), a novel training pipeline that eliminates the need for transmitting raw prompt text while maintaining a favorable balance between privacy preservation and model utility for both clients and service providers. Our approach operates in two stages: first, we train a client-side encoder together with a server-side projection module and LLM, enabling the server to condition on k-pooled prompt embeddings instead of raw text; second, we fine-tune the projection module and LLM on private, domain-specific data using noise-injected embeddings, allowing effective adaptation without exposing plain text prompts and requiring access to the decoder's internal parameters. Extensive experiments on domain-specific and general benchmarks demonstrate that PPFT achieves a striking balance between privacy and utility, maintaining competitive performance with minimal degradation compared to noise-free upper bounds.
Jeongho Yoon, Chanhee Park, Yongchan Chun +2
Department of Computer Science and Engineering, Korea University · Samsung Mobile eXperience Business
Medical language models (LMs) can memorize and reproduce protected health information, but privacy evaluations often focus on recovery of training text rather than disclosure under realistic threat models. We introduce a clinically grounded framework that evaluates leakage along a graded axis of adversarial access, ranging from publicly inferable demographics to leaked note fragments. At each tier, we measure verbatim memorization of patient-specific text and semantic leakage of sensitive diagnoses. Applying the framework to an LM pretrained on 378k clinical notes, we find that routine encounter metadata (i.e. name, date of birth, provider, practice, visit date) elicits high rates of verbatim memorization across a patient's timeline and sensitive-diagnosis recovery (AUROC 0.91 for abortion, 0.81 for HIV). At the same time, exact-match memorization can overstate disclosure: 36% of memorized tokens reflect templated documentation. Our work highlights the risks of training on longitudinal clinical data, providing a practical framework for contextual privacy evaluation of medical LMs.
Sasha Ronaghi, Sana Tonekaboni, Lena Stempfle +6
1Stanford University · 2Massachusetts Institute of Technology · 3American Board of Family Medicine