Does BERT Pretrained on Clinical Notes Reveal Sensitive Data?

Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 946–959 June 6–11, 2021. ©2021 Association for Computational Linguistics 946 Does BERT Pretrained on Clinical Notes Reveal Sensitive Data? Eric Lehman⋆ Ψ Υ 1, Sarthak Jain⋆ Υ 2, Karl PichottaΦ, Yoav GoldbergΩ, and Byron C. WallaceΥ ΨMIT CSAIL ΥNortheastern University ΦMemorial Sloan Kettering Cancer Center ΩBar Ilan University / Ramat Gan, Israel; Allen Institute for Artificial Intelligence 1lehmer16@mit.edu 2jain.sar@northeastern.edu Abstract Large Transformers pretrained over clinical notes from Electronic Health Records (EHR) have afforded substantial gains in performance on predictive clinical tasks. The cost of train- ing such models (and the necessity of data access to do so) coupled with their utility motivates parameter sharing, i.e., the release of pretrained models such as ClinicalBERT (Alsentzer et al., 2019). While most efforts have used deidentified EHR, many researchers have access to large sets of sensitive, non- deidentified EHR with which they might train a BERT model (or similar). Would it be safe to release the weights of such a model if they did? In this work, we design a battery of approaches intended to recover Personal Health Informa- tion (PHI) from a trained BERT. Specifically, we attempt to recover patient names and con- ditions with which they are associated. We find that simple probing methods are not able to meaningfully extract sensitive information from BERT trained over the MIMIC-III cor- pus of EHR. However, more sophisticated “at- tacks” may succeed in doing so: To facili- tate such research, we make our experimental setup and baseline probing models available.1 1 Introduction Pretraining large (masked) language models such as BERT (Devlin et al., 2019) over domain spe- cific corpora has yielded consistent performance gains across a broad range of tasks. In biomedical NLP, this has often meant pretraining models over collections of Electronic Health Records (EHRs) (Alsentzer et al., 2019). For example, Huang et al. (2019) showed that pretraining models over EHR data improves performance on clinical predictive tasks. Given their empirical utility, and the fact that pretraining large networks requires a nontriv- ial amount of compute, there is a natural desire to ⋆ equal contribution. 1https://github.com/elehman16/ exposing_patient_data_release. share the model parameters for use by other re- searchers in the community. However, in the context of pretraining models over patient EHR, this poses unique potential pri- vacy concerns: Might the parameters of trained models leak sensitive patient information? In the United States, the Health Insurance Portability and Accountability Act (HIPAA) prohibits the sharing of such text if it contains any reference to Pro- tected Health Information (PHI). If one removes all reference to PHI, the data is considered “dei- dentified”, and is therefore legal to share. While researchers may not directly share non- deidentified text,2 it is unclear to what extent mod- els pretrained on non-deidentified data pose pri- vacy risks. Further, recent work has shown that general purpose large language models are prone to memorizing sensitive information which can subsequently be extracted (Carlini …

Content truncated to 500 words