Privacy protection tuning for LLMs in medical decision making
Methods and systems include annotating a set of training data to indicate tokens that are sensitive. Instructions are generated based on the training data, including original token sequences and respective substituted token sequences. A language model is fine-tuned using the instructions with a penalty-based loss function to generate a privacy-protected language model.
1 . A computer-implemented method, comprising:
annotating a set of training data to indicate tokens that are sensitive;
generating instructions based on the training data, including original token sequences and respective substituted token sequences; and
fine-tuning a language model using the instructions with a penalty-based loss function to generate a privacy-protected language model, wherein the penalty-based loss includes separate unigram and bigram terms, wherein the unigram term is:
l
1
gram
(
s
,
k
)
=
∑
w
1
PII
∈
Θ
1
P
(
w
1
PII
❘
"\[LeftBracketingBar]"
{
w
i
}
i
=
1
k
-
1
)
and where the bigram term is
l
2
gram
(
s
,
k
)
=
∑
(
w
1
PII
,
w
2
PII
)
∈
Θ
2
P
(
w
1
PII
❘
"\[LeftBracketingBar]"
{
w
i
}
i
=
1
k
-
1
)
P
(
w
2
PII
❘
"\[LeftBracketingBar]"
{
w
i
}
i
=
1
k
)
where s is a sequence, k is a position in the sequence
w
1
PII
and
w
2
PII
are tokens associated with sensitive information, w 1 is a term of the sequence, Θ 1 is a set of unigrams associated with sensitive information, Θ 2 is a set of bigrams associated with sensitive information, and P is a probability function.
2 . The method of claim 1 , wherein annotating the set of training data includes generating a privacy label sequence for each original sequence in the training data with a binary sensitivity indicator for each token of respective original sequences.
3 . The method of claim 1 , wherein the substituted token sequences include the tokens of the original token sequences but with sensitive tokens being replaced by a placeholder.
4 . The method of claim 1 , wherein generating the instructions includes generating a positive example and a negative example based on an original token sequence and a respective substituted token sequence.
5 . The method of claim 1 , wherein the sensitive tokens relate to personally identifiable information.
6 . The method of claim 1 , further comprising providing a patient's medical records to the privacy-protected language model to aid in medical decision making, wherein the training data includes medical records.
7 . The method of claim 1 , wherein the language model is a pre-trained machine learning model that processes natural language inputs.
8 . The method of claim 6 , further comprising automatically altering the patient's treatment responsive to an output of the privacy-protected language model.
9 . A system, comprising:
a hardware processor; and
a memory that stores a computer program that, when executed by the hardware processor, causes the hardware processor to:
annotate a set of training data to indicate tokens that are sensitive;
generate instructions based on the training data, including original token sequences and respective substituted token sequences; and
fine-tune a language model using the instructions with a penalty-based loss function to generate a privacy-protected language model, wherein the penalty-based loss includes separate unigram and bigram terms, wherein the unigram term is:
l
1
gram
(
s
,
k
)
=
∑
w
1
PII
∈
Θ
1
P
(
w
1
PII
|
{
w
i
}
i
=
1
k
-
1
)
and where the bigram term is
l
2
gram
(
s
,
k
)
=
∑
(
w
1
PII
,
w
2
PII
)
∈
Θ
2
P
(
w
1
PII
❘
"\[LeftBracketingBar]"
{
w
i
}
i
=
1
k
-
1
)
P
(
w
2
PII
❘
"\[LeftBracketingBar]"
{
w
i
}
i
=
1
k
)
where s is a sequence, k is a position in the sequence,
w
1
PII
and
w
2
PII
are tokens associated with sensitive information, w 1 is a term of the sequence, Θ 1 is a set of unigrams associated with sensitive information, Θ 2 is a set of bigrams associated with sensitive information, and P is a probability function.
10 . The system of claim 9 , wherein the computer program further causes the hardware processor to generate a privacy label sequence for each original sequence in the training data with a binary sensitivity indicator for each token of respective original sequences.
11 . The system of claim 9 , wherein the substituted token sequences include the tokens of the original token sequences but with sensitive tokens being replaced by a placeholder.
12 . The system of claim 9 , wherein the computer program further causes the hardware processor to generate a positive example and a negative example based on an original token sequence and a respective substituted token sequence.
13 . The system of claim 9 , wherein the sensitive tokens relate to personally identifiable information.
14 . The system of claim 9 , wherein the computer program further causes the hardware processor to provide a patient's medical records to the privacy-protected language model to aid in medical decision making, wherein the training data includes medical records.
15 . The system of claim 9 , wherein the language model is a pre-trained machine learning model that processes natural language inputs.
16 . The system of claim 14 , wherein the computer program further causes the hardware processor to automatically alter the patient's treatment responsive to an output of the privacy-protected language model.