A privacy-protecting AI kept accuracy on grid and medical image tests

What the tests found

At a privacy budget of ε = 4, the system reached 76.8% accuracy on the smart-grid dataset and 74.2% on the MIMIC-CXR dataset. The researchers report that this was more than 10 percentage points higher than the DP-Diffusion comparison at the same setting, and that the differences in accuracy were statistically significant on both datasets. At ε = 10, accuracy rose to 86.5% for the smart-grid task and 83.1% for the chest-image task, compared with 88.7% and 85.2% for learning from clean examples.

The standard noise-based comparison fell to 36.5% accuracy on the smart-grid task at ε = 1. The proposed method also produced lower image-quality scores and higher text-similarity scores than DP-Diffusion, according to the reported experiments. The abstract says tests against membership-inference and attribute-inference attacks found resistance to those attacks, although the provided results excerpt does not give the proposed method's attack rates.

Why private examples matter

In-context learning can use a small number of examples without retraining a large AI model, but raw examples from healthcare or critical infrastructure can contain sensitive information. This approach aims to reduce that exposure while retaining useful multimodal classification performance, and it does so at the prompt stage rather than through costly privacy-protected fine-tuning.

Evidence and caveats

The evidence comes from experiments on two datasets: 4,800 image-text pairs from a proprietary smart-grid inspection dataset and a balanced 6,000-pair subset of MIMIC-CXR, each divided into training and test sets. The researchers evaluated five-shot classification at privacy budgets of ε = 1, 4, 7 and 10 and compared the method with clean examples, direct feature noise, a generative-adversarial approach and DP-Diffusion. Welch's t-tests comparing the proposed method with DP-Diffusion at ε = 4 were statistically significant for classification on both datasets and for the reported image-quality measure.

The results are limited to these two datasets, the selected five-shot setting and the frozen LLaVA-1.5-7B model. One dataset is proprietary, and the MIMIC-CXR results use a selected five-category subset rather than the full dataset. The excerpts do not provide the proposed method's numerical attack rates, latency measurements or results in other real-world deployments. The authors also identify reducing inference latency for non-text data as future work.