mlsanityData to 7 Oct 2026

Does BERT Pretrained on Clinical Notes Reveal Sensitive Data?

arXiv 2104.07762 ↗First posted 15 Apr 2021cs.CL cs.AI cs.LGcited by 91

Not on the map. Why?

Abstract (arXiv)

Large Transformers pretrained over clinical notes from Electronic Health Records (EHR) have afforded substantial gains in performance on predictive clinical tasks. The cost of training such models (and the necessity of data access to do so) coupled with their utility motivates parameter sharing, i.e., the release of pretrained models such as ClinicalBERT. While most efforts have used deidentified EHR, many researchers have access to large sets of sensitive, non-deidentified EHR with which they might train a BERT model (or similar). Would it be safe to release the weights of such a model if they did? In this work, we design a battery of approaches intended to recover Personal Health Information (PHI) from a trained BERT. Specifically, we attempt to recover patient names and conditions with which they are associated. We find that simple probing methods are not able to meaningfully extract sensitive information from BERT trained over the MIMIC-III corpus of EHR. However, more sophisticated "attacks" may succeed in doing so: To facilitate such research, we make our experimental setup and baseline probing models available at https://github.com/elehman16/exposing_patient_data_release

Key facts. Cited by 91 papers in the map (data through 7 Oct 2026). Builds on 20 of its 38 references that are in the map. First posted on arXiv 15 Apr 2021.

Builds on

20 of 38 references.

References · 20

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2020Language Models are Few-Shot Learnerscited by 32,199
  3. 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,491
  4. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
  5. 2013Efficient Estimation of Word Representations in Vector Spacecited by 4,346
  6. 2020Extracting Training Data from Large Language Modelscited by 2,144
  7. 2019Language Models as Knowledge Bases?cited by 1,922
  8. 2016Understanding intermediate layers using linear classifier probescited by 1,279
  9. 2019Publicly Available Clinical BERT Embeddingscited by 995
  10. 2019How Can We Know What Language Models Know?cited by 953
  11. 2020How Much Knowledge Can You Pack Into the Parameters of a Language Model?cited by 713
  12. 2019ClinicalBERT: Modeling Clinical Notes and Predicting Hospital Readmissioncited by 487
8 more
  1. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  2. 2019BERT has a Mouth, and It Must Speak: BERT as a Markov Random Field Language Modelcited by 184
  3. 2020X-FACTR: Multilingual Factual Knowledge Retrieval from Pretrained Language Modelscited by 117
  4. 2020Language Models as Knowledge Bases: On Entity Representations, Storage Capacity, and Paraphrased Queriescited by 107
  5. 2019Inducing Relational Knowledge from BERTcited by 75
  6. 2020Multi-domain Clinical Natural Language Processing with MedCAT: the Medical Concept Annotation Toolkitcited by 66
  7. 2018Privacy-Preserving Distributed Deep Learning for Clinical Datacited by 8
  8. 2018Auditing Data Provenance in Text-Generation Modelscited by 5

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 2; 2022: 17; 2023: 29; 2024: 20; 2025: 16; 2026: 7.

91 papers.

Sort:

By area:

  1. 2022Knowledge Unlearning for Mitigating Privacy Risks in Language Modelscited by 424
  2. 2022Deduplicating Training Data Mitigates Privacy Risks in Language Modelscited by 309
  3. 2023Analyzing Leakage of Personally Identifiable Information in Language Modelscited by 278
  4. 2023Large Language Model Alignment: A Surveycited by 241
  5. 2022Are Large Pre-Trained Language Models Leaking Your Personal Information?cited by 195
  6. 2022What Does it Mean for a Language Model to Preserve Privacy?cited by 194
  7. 2023Text Embeddings Reveal (Almost) As Much As Textcited by 189
  8. 2024Do Membership Inference Attacks Work on Large Language Models?cited by 188
  9. 2022Quantifying Privacy Risks of Masked Language Models Using Membership Inference Attackscited by 168
  10. 2023A Survey of Large Language Models for Healthcare: from Data, Technology, and Applications to Accountability and Ethicscited by 162
  11. 2024PrivacyLens: Evaluating Privacy Norm Awareness of Language Models in Actioncited by 161
  12. 2023Future Lens: Anticipating Subsequent Tokens from a Single Hidden Statecited by 116
38 more
  1. 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 110
  2. 2023Do We Still Need Clinical Language Models?cited by 97
  3. 2023Language Model Behavior: A Comprehensive Surveycited by 92
  4. 2022Federated Unlearning: How to Efficiently Erase a Client in FL?cited by 90
  5. 2021Pre-trained Language Models in Biomedical Domain: A Systematic Surveycited by 87
  6. 2024Harmful Fine-tuning Attacks and Defenses for Large Language Models: A Surveycited by 86
  7. 2022Language Generation Models Can Cause Harm: So What Can We Do About It? An Actionable Surveycited by 80
  8. 2023Bag of Tricks for Training Data Extraction from Language Modelscited by 67
  9. 2025Harnessing the Universal Geometry of Embeddingscited by 54
  10. 2022Are Attribute Inference Attacks Just Imputation?cited by 48
  11. 2023Privacy in Large Language Models: Attacks, Defenses and Future Directionscited by 48
  12. 2023Event Stream GPT: A Data Pre-processing and Modeling Library for Generative, Pre-trained Transformers over Continuous-time Sequences of Complex Eventscited by 46
  13. 2022Memorization in NLP Fine-tuning Methodscited by 43
  14. 2023Training Data Extraction From Pre-trained Language Models: A Surveycited by 43
  15. 2024Extracting Prompts by Inverting LLM Outputscited by 40
  16. 2024LLM-PBE: Assessing Data Privacy in Large Language Modelscited by 38
  17. 2023Ethicist: Targeted Training Data Extraction Through Loss Smoothed Soft Prompting and Calibrated Confidence Estimationcited by 36
  18. 2023SoK: Memorization in General-Purpose Large Language Modelscited by 36
  19. 2023Privacy Implications of Retrieval-Based Language Modelscited by 31
  20. 2023Identifying and Mitigating Privacy Risks Stemming from Language Models: A Surveycited by 30
  21. 2023Do Localization Methods Actually Localize Memorized Data in LLMs? A Tale of Two Benchmarkscited by 29
  22. 2024Undesirable Memorization in Large Language Models: A Surveycited by 29
  23. 2022Text Revealer: Private Text Reconstruction via Model Inversion Attacks against Transformerscited by 28
  24. 2024Data-Centric Foundation Models in Computational Healthcare: A Surveycited by 27
  25. 2023Quantifying Association Capabilities of Large Language Models and Its Implications on Privacy Leakagecited by 26
  26. 2025DeepResearch Arena: The First Exam of LLMs' Research Abilities via Seminar-Grounded Taskscited by 24
  27. 2024Generative AI in EU Law: Liability, Privacy, Intellectual Property, and Cybersecuritycited by 21
  28. 2023Are Chatbots Ready for Privacy-Sensitive Applications? An Investigation into Input Regurgitation and Prompt-Induced Sanitizationcited by 17
  29. 2023Enhancing Phenotype Recognition in Clinical Notes Using Large Language Models: PhenoBCBERT and PhenoGPTcited by 17
  30. 2024Semantic Membership Inference Attack against Large Language Modelscited by 17
  31. 2022Learning to Ask Like a Physiciancited by 16
  32. 2023Lightweight Transformers for Clinical Natural Language Processingcited by 15
  33. 2023What can we learn from Data Leakage and Unlearning for Law?cited by 15
  34. 2023On the Trustworthiness Landscape of State-of-the-art Generative Models: A Survey and Outlookcited by 15
  35. 2023DarkBERT: A Language Model for the Dark Side of the Internetcited by 13
  36. 2022You Don't Know My Favorite Color: Preventing Dialogue Representations from Revealing Speakers' Private Personascited by 11
  37. 2023Synthetic Query Generation for Privacy-Preserving Deep Retrieval Systems using Differentially Private Language Modelscited by 10
  38. 2023FairSISA: Ensemble Post-Processing to Improve Fairness of Unlearning in LLMscited by 10

50 most cited of 91 All 91 (JSON)