Medical AI models can leak sensitive patient information through privacy attacks, even when average risk metrics look acceptable. This paper shows that while aggregate membership inference attack success often appears close to random guessing, individual patient-level risks can be extremely high— with some patients facing near-perfect identifiability.

The risks are also disparate: they disproportionately affect underrepresented groups (by race, disease prevalence, or insurance status). Larger models tend to increase these individual and group-level privacy vulnerabilities.