Memorisation bias in medical AI
Moritz A. Knolle, Martin J. Menten, Laurin Lux, Mélanie Roschewitz, Emma A. M. Stanley, Georgios Kaissis, Daniel Rueckert, Ben Glocker
cs.LG, cs.CY
2026-09-15
On four longitudinal datasets, training on a patient's history shifts later predictions: new-disease sensitivity drops, unchanged-health scores inflate, and HEEDB bias can last 25 years.
Memorisation in medical AI has been treated as a privacy issue: an attacker can tell whether a record was in the training set. Clinical deployment is a different setting. Models often go live on the same population that supplied the training data. Germany's national breast screening programme is the concrete case, an AI trained on 1.2 million mammograms from the screening population it now reads. Those people come back on a schedule.
A patient's records are highly self-similar over time. A future ECG can cue the model toward the health state it saw years earlier. De-identification, meant to protect privacy, also makes it hard for a hospital to notice that this patient contributed training data and to keep the model off their later exams. The paper names this longitudinal effect memorisation bias and measures it on real follow-up data.
The detection setup extends Feldman and Zhang's definition of memorisation: does including a record in training change the model's prediction on that record. Here the pair is a patient's historical records versus future records the model never trained on.
Four datasets cover ECG, chest X-ray, and emergency-department EHR: MIMIC-ECG, MIMIC-CXR, MIMIC-IV-ED, and HEEDB, a Harvard-Emory ECG archive of 1.8 million patients from the 1980s through 2025. Each follow-up patient is split in time. Historical records train; future records only evaluate. The cut is chosen per patient to enrich future data for de novo conditions, C=1 for ECG, CXR, and ED, and C=2 for HEEDB.
They train 200 models per dataset, each on a random 50% of patients' historical data. For any patient, about 100 models saw them and 100 did not. An energy test compares the two groups' probability vectors on the same future record, with FDR at 0.05. Randomly partitioned models, the negative control, flag zero records on all four datasets. Architectures follow the modality: a 1-D ViT-S-25 (about 14M parameters) for ECG, ImageNet-pretrained DenseNet-121 for CXR, and a random forest for the main ED result.
A non-trivial share of future records change when that patient's history is in training. Average effects are small; some class probabilities move by more than 70 points. Memorisation on historical records is stronger, as expected, and is the same signal membership inference uses. That signal leaks onto unseen future data.
| Setting | Future records with a significant shift | Reference |
| MIMIC-CXR DenseNet-121 | 3,518/74,242 (4.7%) | random grouping: 0 |
| MIMIC-IV-ED random forest | 1,469/65,402 (2.25%) | logistic regression: 0.04% |
| MIMIC-ECG ViT-S-25 | 2,848/250k (1.1%) | random grouping: 0 |
| HEEDB ViT-S-25 | 25,210/4.1M (0.6%) | still significant beyond 25 years |
Three ED models differ by orders of magnitude. Random forest: 2.25% of future records, 93.53% of historical. Logistic regression: 0.04% and 0.77%. Tabular ResNet: 0.12% and 3.61%. Random forests, a default for tabular clinical prediction, memorise people the most. Held-out macro AUROC is 79.68% for CXR, 83.39% for the ED forest, 93.45% for MIMIC-ECG, and 95.38% for HEEDB. Memorisation is not a symptom of a poorly fitted model.
On HEEDB, significant shifts still appear more than 25 years after the latest historical record. The bias gets rarer and weaker with time. It does not vanish.
The diagnostic pattern is asymmetric. Thresholds maximise Youden's J on a held-out test set; 82 comparisons are Bonferroni-corrected. When a patient returns with a condition absent from their training history, models that saw that history lose sensitivity; specificity barely moves. False negatives go up. When health is unchanged, both sensitivity and specificity inflate, so retrospective metrics look better than they are.
Differential privacy (DP) reduces memorisation, but the privacy unit matters. Record-level DP still flags many historical and future records even at ε=1, with future effect sizes above 40 points at the weakest budgets. Patient-level DP keeps only the latest record per person, then applies record-level accounting. MIMIC-ECG then shows at most two affected future records across budgets; HEEDB shows none on historical or future data. The implementation is crude: MIMIC-ECG training shrinks from 475,512 to 146,332 records, so some utility loss is discarded data, not only noise.
If a model is deployed on the people who trained it, anonymisation is not a promise that contributors are unharmed. It can block the obvious fix, taking those people out of AI-assisted reading of their later data. The EU AI Act also wants training data to match the geography and context of use, which pushes toward exactly this deployment pattern.
Three practical takeaways. Evaluation that mixes training contributors in, without stratifying on de novo disease, will credit inflated sensitivity as real skill. Do not treat random forests as the safe tabular default; they remember patients more than logistic regression or a tabular ResNet. If DP is the mitigation, do it at patient level. Record level is not enough.
The absolute count of missed diagnoses in the simulation is modest. De novo cases are rare in routine data, and the temporal split was designed to enrich them, so the numbers speak to direction, not expected incidence. Long follow-up is scarce, so the 25-year tail is likely conservative. Diagnostic harm is estimated from post-hoc thresholds and the model alone, with no clinician in the loop. DP runs used a 1.9M ViT-T instead of 14M ViT-S, and patient-level DP dropped extra records per person, so the utility cost is overstated. There is no subgroup analysis, and no test on segmentation, survival, or language models. The full suite is about 5,200 models and 10,000 GPU-hours.