Reconstructing Training Images from Foundation Model Parameters in the Healthcare Domain: Privacy Risks and Defences

Recent studies have shown that it is possible to reconstruct training images from finetuned foundation model parameters alone: first by reconstructing the embeddings, and then by using model inversion to invert these embeddings to the image domain. This could pose a privacy risk for healthcare applications. Yet whether this risk actually transfers to the healthcare domain, where images differ substantially from the general images used in previous works, remains unknown. In this work, we systematically evaluate this risk across three healthcare domains, seven datasets, and sixteen foundation models (twelve medically specialized and four general models). We find that embedding reconstruction attack success is strongly domain-dependent: on average, X-ray images are more vulnerable to embedding reconstruction attacks than pathology or ophthalmology images. However, unlike in the general image domain, current inversion techniques do not lead to recognizable images reconstructed from these embeddings for any of the considered healthcare domains. We thus estimate the current risk to be low. Crucially, we also find that linear probing consistently neutralizes the complete attack, thereby suggesting a readily deployable and future-proof defense.