Paper Info Reviews Author Feedback Meta-Review Back to top
List of Papers Browse by Subject Areas Author List

Abstract

Differential privacy (DP)’s effect in medical imaging is typically evaluated only through end-to-end performance, leaving the mechanism of privacy-induced utility loss unclear. We introduce Differential Privacy Representation Geometry for Medical Imaging (DP-RGMI), a framework that interprets DP as a structured transformation of representation space and decomposes performance degradation into encoder geometry and task-head utilization. Geometry is quantified by representation displacement from initialization and spectral effective dimension, while utilization is measured as the gap between linear-probe and end-to-end utility. Across over 594,000 images from four chest X-ray datasets and multiple pretrained initializations, we show that DP is consistently associated with a utilization gap even when linear separability is largely preserved. At the same time, displacement and spectral dimension exhibit non-monotonic, initialization- and dataset-dependent reshaping, indicating that DP alters representation anisotropy rather than uniformly collapsing features. Correlation analysis reveals that the association between end-to-end performance and utilization is robust across datasets but can vary by initialization, while geometric quantities capture additional prior- and dataset-conditioned variation. These findings position DP-RGMI as a reproducible framework for diagnosing privacy-induced failure modes and informing privacy model selection.

Links to Paper and Supplementary Materials

Main Paper (Open Access Version): https://papers.miccai.org/miccai-2026/paper/1807_paper.pdf

SharedIt Link: Not yet available

SpringerLink (DOI): Not yet available

Supplementary Material: Not Submitted

Link to the Code Repository

https://github.com/tayebiarasteh/CXR-adaptation

Link to the Dataset(s)

The ChestX-ray14: https://www.v7labs.com/open-datasets/chestx-ray14 PadChest dataset: https://bimcv.cipf.es/bimcv-projects/padchest/ MIMIC-CXR dataset, a restricted-access resource, which can be accessed from PhysioNet by agreeing to the respective data protection requirements under: https://physionet.org/content/vindr-cxr/1.0.0/ and https://physionet.org/content/mimic-cxr-jpg/2.0.0/, respectively. The CheXpert: https://stanfordmlgroup.github.io/competitions/chexpert

BibTex

@InProceedings{TaySor_Differential_MICCAI2026,
        author = { Tayebi Arasteh, Soroosh AND Mohammadi, Marziyeh AND Nebelung, Sven AND Truhn, Daniel},
        title = { { Differential Privacy Representation Geometry for Medical Image Analysis } },
        booktitle = {Medical Image Computing and Computer Assisted Intervention -- MICCAI 2026},
        year = {2026},
        publisher = {Springer Nature Switzerland},
        volume = {LNCS 16882},
        month = {September},
        page = {pending}
}

Reviews

Review #1

  • Please describe the contribution of the paper

    The paper’s central contribution is the DP-RGMI framework, which reframes differential privacy evaluation in medical imaging as a representation-level diagnostic problem rather than a purely end-to-end performance question. Concretely, the framework decomposes the performance degradation caused by DP-SGD training into three measurable quantities. First, representation displacement measures how far the privately trained encoder’s embeddings have moved from the pretrained initialization. Second, spectral effective dimension captures how DP reshapes the variance distribution across principal directions of the embedding covariance, essentially quantifying whether representations become more or less anisotropic under privacy. Third, the utilization gap measures the difference between what a linear probe can recover from the frozen private encoder and what end-to-end private training actually achieves. The key empirical finding enabled by this decomposition is that DP often preserves substantial linear separability in the learned representations while the jointly trained task head fails to exploit it. In other words, the encoder still “knows” enough to classify well, but the noisy optimization of DP-SGD prevents the classification head from fully using that information. The paper also shows that the geometric effects of DP displacement and spectral reshaping are non-monotonic and depend heavily on the pretrained initialization, arguing against a simple narrative of “privacy collapses features” in favor of structured, prior-conditioned transformations. The practical implication is that when a utilization gap is large, practitioners might recover performance by freezing the encoder and retraining only the head, or adjusting clipping strategies, rather than relaxing the privacy budget.

  • Please list the major strengths of the paper: you should highlight a novel formulation, an original way to use data, demonstration of clinical feasibility, a novel application, a particularly strong evaluation, or anything else that is a strong aspect of this work. Please provide details, for instance, if a method is novel, explain what aspect is novel and why this is interesting.

    The paper presents a clear and easy-to-follow structure, with the main strengths being : 1) Useful diagnostic framing. Separating “what the encoder preserves” from “what the task head exploits” under DP is practically valuable. Most DP medical imaging work reports only end-to-end metrics, conflating representational damage with optimization difficulty. The utilization gap gives practitioners an actionable signal: if it’s large, the remedy is better head optimization rather than relaxing privacy. 2) Broad and controlled experimental design. The evaluation covers over 594,000 images across four chest X-ray datasets, three pretrained initializations with distinct properties (supervised, self-supervised, domain-specific), and multiple privacy budgets — all with non-privacy hyperparameters held fixed. This isolates the effect of DP on geometry cleanly and makes the findings more credible than a single-dataset study would. 3) Initialization-aware analysis. The paper shows that DP’s geometric effects are strongly initialization-dependent — spectral dimension increases under stronger privacy for ImageNet but decreases for DINOv3, displacement patterns differ across priors. This challenges the simplistic narrative that DP uniformly collapses features, and is directly relevant to foundation model selection for privacy-constrained medical imaging.

  • Please list the major weaknesses of the paper. Please provide details: for instance, if you state that a formulation, way of using data, demonstration of clinical feasibility, or application is not novel, then you must provide specific references to prior work.

    For Δ and d_eff, the framework only issues deployment warnings (e. g. , “large Δ may hurt transfer”, “low d_eff may limit adaptation”) without offering or testing remediation. This is acceptable given their nature. For G, however, the paper explicitly suggests concrete fixes, freezing the encoder, retraining the head, or adjusting clipping for head parameters, but none of these are validated. Since G is presented as the central and most actionable contribution, at least one experiment showing that a suggested intervention actually closes the gap (under preserved privacy) would substantially strengthen the paper. As it stands, the most actionable claim remains conjecture.

  • Please rate the clarity and organization of this paper

    Good

  • Please comment on the reproducibility of the paper. Please be aware that providing code and data is a plus, but not a requirement for acceptance.

    The authors claimed to release the source code and/or dataset upon acceptance of the submission.

  • Based on your review and your understanding of the MICCAI Scientific Code of Ethics, do you believe this submission may involve a potential ethics concern or violation?

    N/A

  • Optional: If you have any additional comments to share with the authors, please provide them here. Please also refer to our Reviewer’s guide on what makes a good review and pay specific attention to the different assessment criteria for the different paper categories: https://conferences.miccai.org/2026/en/REVIEWER-GUIDELINES.html

    N/A

  • Rate the paper on a scale of 1-6, 6 being the strongest (6-4: accept; 3-1: reject). Please use the entire range of the distribution. Spreading the score helps create a distribution for decision-making.

    (4) Weak Accept — marginally above the acceptance threshold, but would not mind if rejected, dependent on rebuttal

  • Please justify your recommendation. What were the major factors that led you to your overall score for this paper?

    The paper introduces a useful diagnostic framework (decomposing DP degradation into displacement, spectral reshaping, and utilization gap) backed by a well controlled experimental design across four datasets, three initializations, and multiple privacy budgets. The initialization dependent findings are informative and challenge simplistic narratives about DP collapsing features. However, the utilization gap is positioned as the central and most actionable contribution, with concrete interventions explicitly suggested (freeze encoder, retrain head, adjust clipping), yet none are validated. Since G is where the paper crosses from diagnosis to prescription, at least one experiment demonstrating that a suggested fix actually closes the gap under preserved privacy is needed. Strong idea, incomplete validation of its most actionable claim, hence a borderline accept.

  • Reviewer confidence

    Confident but not absolutely certain (3)

  • [Post rebuttal] After reading the authors’ rebuttal, please state your final opinion of the paper.

    Accept

  • [Post rebuttal] Please justify your final decision from above.

    Thank you for the clarification. The authors addressed my main comment.

    However, the paper should make this distinction clear and tone down the current claim. Freezing the encoder, retraining the head, or modifying clipping should be presented as possible future remediation strategies suggested by the diagnostic, not as validated interventions. Since these fixes are not directly tested under preserved privacy accounting, the manuscript should explicitly state that validating such interventions is left for future work.



Review #2

  • Please describe the contribution of the paper

    This paper introduces DP-RGMI, a diagnostic framework to analyze how differentially private stochastic gradient descent impacts medical image models by decoupling representation geometry from task-head utilization. The framework quantifies three aspects: representation displacement from a shared pretrained initialization, spectral effective dimension of embeddings, and a utilization gap defined as the difference between linear-probe and end-to-end private performance. Across three chest X-ray datasets and three initializations, the study finds a consistent utilization gap under DP even when linear separability remains high, while geometric quantities exhibit non-monotonic, initialization- and dataset-dependent changes, suggesting DP reshapes representation anisotropy rather than uniformly degrading features.

  • Please list the major strengths of the paper: you should highlight a novel formulation, an original way to use data, demonstration of clinical feasibility, a novel application, a particularly strong evaluation, or anything else that is a strong aspect of this work. Please provide details, for instance, if a method is novel, explain what aspect is novel and why this is interesting.

    By effective dimension as a spectral summary to detect anisotropy shifts under DP is a well-motivated geometric lens rarely applied in medical imaging privacy studies.

    Correlation analyses across datasets and initializations provide a structured view of how geometry and utilization relate to end-to-end utility.

    The findings highlight concrete levers for practice and inform privacy model selection.

  • Please list the major weaknesses of the paper. Please provide details: for instance, if you state that a formulation, way of using data, demonstration of clinical feasibility, or application is not novel, then you must provide specific references to prior work.

    My biggest concern is that the main mechanistic claim of this paper is not sufficiently validated. The observed post-DP separability may simply be a consequence of overparameterization and strong pretrained priors, rather than evidence that DP primarily harms utilization rather than representation quality. Since all experiments use a large ConvNeXt-Small backbone with strong initialization, the paper does not rule out model capacity itself as the source of the reported effect.

    The privacy guarantee is only weakly justified. The choice of \delta is not sufficiently motivated for a medical setting and does not appear particularly conservative relative to dataset size (should be much less than 1/N).

    The DP setup is under-specified. Key DP-SGD details, including the actual clipping norm, noise multipliers, and training duration, are missing, making the privacy-utility tradeoff hard to assess or reproduce.

  • Please rate the clarity and organization of this paper

    Satisfactory

  • Please comment on the reproducibility of the paper. Please be aware that providing code and data is a plus, but not a requirement for acceptance.

    The submission does not mention open access to source code or data, but provides a clear and detailed description of the algorithm to ensure reproducibility.

  • Based on your review and your understanding of the MICCAI Scientific Code of Ethics, do you believe this submission may involve a potential ethics concern or violation?

    N/A

  • Optional: If you have any additional comments to share with the authors, please provide them here. Please also refer to our Reviewer’s guide on what makes a good review and pay specific attention to the different assessment criteria for the different paper categories: https://conferences.miccai.org/2026/en/REVIEWER-GUIDELINES.html

    N/A

  • Rate the paper on a scale of 1-6, 6 being the strongest (6-4: accept; 3-1: reject). Please use the entire range of the distribution. Spreading the score helps create a distribution for decision-making.

    (2) Reject — should be rejected, independent of rebuttal

  • Please justify your recommendation. What were the major factors that led you to your overall score for this paper?

    The main reason for my reject score is that the paper’s central interpretive claim is not convincingly supported by the evidence provided. The manuscript argues that, under DP, linear separability is largely preserved and that the main degradation comes from impaired “utilization” rather than representational collapse. However, all evidence is derived from the same large, strongly pretrained ConvNeXt-Small backbone, using only three strong initialization regimes. This leaves a major alternative explanation unresolved: the apparent post-DP separability may simply be a consequence of overparameterization and strong pretrained priors, rather than evidence for the specific mechanism proposed by the paper. Since the contribution is primarily mechanistic and diagnostic, this is not a minor wording issue that could be fixed by slightly softening the claims. Without experiments that directly address model-capacity confounding, the current evidence mainly supports a descriptive observation in one high-capacity model family, not the broader conclusion that DP primarily harms utilization rather than representation quality.

  • Reviewer confidence

    Confident but not absolutely certain (3)

  • [Post rebuttal] After reading the authors’ rebuttal, please state your final opinion of the paper.

    Reject

  • [Post rebuttal] Please justify your final decision from above.

    I thank the authors for the rebuttal. The response clarifies several issues, including the transcription error in the per-label gap values, the intended DP-SGD specification, and the interpretation of the linear probe experiment. These clarifications are useful, and I appreciate the authors’ effort to address the comments.

    However, my main concern remains unresolved. The rebuttal appears to address a stronger claim than the one I raised. My concern was not that stronger pretrained priors must necessarily produce larger utilization gaps, nor that a capacity-driven effect must yield identical gaps across initializations. Rather, the concern is that the observed preservation of linear separability under DP may depend on the use of a large, strongly pretrained ConvNeXt-Small backbone. Different gaps across ImageNet, DINOv3, and MIMIC show that the prior modulates the effect, but they do not rule out model capacity or pretrained-prior dependence as a confound.

    In particular, the fact that MIMIC yields the smallest gap is not evidence against the strong-prior explanation. A strong in-domain prior could plausibly improve both probe performance and end-to-end DP optimization, thereby reducing the gap. Thus, this argument does not directly address the capacity/prior confounding concern.

    I therefore continue to view the evidence as supporting a descriptive diagnostic observation within one high-capacity pretrained model family, rather than the broader mechanistic interpretation that DP primarily harms utilization rather than representation quality. The framework is interesting, and the empirical study is valuable, but the central interpretive claim remains over-extended relative to the experimental controls provided.

    That said, I recognize that overparameterization is a pervasive feature of modern neural networks rather than an artificial edge case. Therefore, the studied regime is practically relevant, and the paper does provide a useful diagnostic perspective for contemporary pretrained medical-imaging models. However, for the central interpretation to be convincing, I still think the paper needs at least one minimal control outside the strong-pretraining regime, such as a randomly initialized model trained from scratch or another substantially weaker initialization/backbone. Such an experiment would help distinguish whether the observed preservation of linear separability is a general DP-induced utilization phenomenon or a consequence of the high-capacity pretrained setting.

    I understand that the rebuttal stage does not allow authors to introduce new experimental results, so this concern cannot be fully resolved by the current response. My recommendation is therefore still negative: the paper would benefit from additional results and a reanalysis of the claims before acceptance. However, given the practical relevance of the studied regime and the usefulness of the proposed diagnostic framework, if the Area Chair and other reviewers view the contribution primarily as an empirical diagnostic tool for modern pretrained medical-imaging models, I would not strongly oppose acceptance.



Review #3

  • Please describe the contribution of the paper

    This work proposes DP-RGMI, a framework that investigates how Differential Privacy affects learned representations. By decomposing degradation into displacement, spectral characteristics, and the gap between linear-probe and end-to-end utility, the authors provide a novel perspective for privacy-induced performance loss.

  • Please list the major strengths of the paper: you should highlight a novel formulation, an original way to use data, demonstration of clinical feasibility, a novel application, a particularly strong evaluation, or anything else that is a strong aspect of this work. Please provide details, for instance, if a method is novel, explain what aspect is novel and why this is interesting.
    • Novelty: the proposed framework offers interesting diagnostic insights beyond standard privacy vs utility trade-offs.
    • Motivation: the method is well-motivated.
    • Experiments: the authors provide a thorough experimental validation that spans various datasets and initialization strategies.
  • Please list the major weaknesses of the paper. Please provide details: for instance, if you state that a formulation, way of using data, demonstration of clinical feasibility, or application is not novel, then you must provide specific references to prior work.
    • Inconsistency: there appears to be a significant discrepancy between the numerical reporting in Section 4 and the visualizations in Figure 2.For instance, the text reports a +17.0 pneumonia gap for ImageNet at \epsilon=1.0, yet the corresponding y-axis in the figure does not exceed 12.Similar mismatches occur throughout the section. I ask the authors to clarify whether these are indeed inconsistent or if I am misinterpreting the plot.
    • Metric choice: the authors quantify representation displacement using an isotropic measure (average Euclidean distance from initialization). However, given the paper’s later emphasis on anisotropic reshaping, this metric may be suboptimal. Have the authors explored covariance-aware alternatives, such as the Mahalanobis distance?
    • Extreme cases: in the ImageNet branch, the largest displacement is observed at \epsilon=\infty rather than under DP constraints. I would welcome the authors’ intuition on this. Specifically, could the different augmentation strategies employed for DP versus non-DP training be a confounding factor?
    • Generalizability: while the DP-RGMI framework is conceptually model- and dataset-agnostic, the current empirical validation is restricted to a single backbone family and image modality. This limited scope somewhat weakens the claim of broad applicability.

    Minor:

    • The caption labels in the original template (Fig. X, Table Y) are typically bolded. This formatting may have been overridden by a LaTeX package.
    • The literature more commonly uses “DINOv3” rather than “DinoV3.”
  • Please rate the clarity and organization of this paper

    Good

  • Please comment on the reproducibility of the paper. Please be aware that providing code and data is a plus, but not a requirement for acceptance.

    The authors claimed to release the source code and/or dataset upon acceptance of the submission.

  • Based on your review and your understanding of the MICCAI Scientific Code of Ethics, do you believe this submission may involve a potential ethics concern or violation?

    N/A

  • Optional: If you have any additional comments to share with the authors, please provide them here. Please also refer to our Reviewer’s guide on what makes a good review and pay specific attention to the different assessment criteria for the different paper categories: https://conferences.miccai.org/2026/en/REVIEWER-GUIDELINES.html

    N/A

  • Rate the paper on a scale of 1-6, 6 being the strongest (6-4: accept; 3-1: reject). Please use the entire range of the distribution. Spreading the score helps create a distribution for decision-making.

    (3) Weak Reject — marginally below the acceptance threshold, but would not mind if accepted, dependent on rebuttal

  • Please justify your recommendation. What were the major factors that led you to your overall score for this paper?

    The motivation behind the proposed framework is clear, as is its offer of a novel direction for the evaluation of differentially private models. However, I have some concerns about the reliability and interpretation of some results. Specifically, the apparent inconsistency between Section 4 and Fig. 2 is concerning. For this reason, I precautionally lean towards weak-reject, but I am open to raising my score if this can be clarified.

  • Reviewer confidence

    Somewhat confident (2)

  • [Post rebuttal] After reading the authors’ rebuttal, please state your final opinion of the paper.

    Accept

  • [Post rebuttal] Please justify your final decision from above.

    Despite the notable presentation error identified in Section 4, I believe the proposed diagnostic analysis for DP has merit and can be interesting for the community. The authors addressed my major concerns, and the clarified inconsistencies do not appear to affect the main conclusions. I therefore lean towards Accept



Author Feedback

We thank reviewers (R1,R2,R4) and AC. Minor points (“DINOv3”, captions, scope wording) will be revised.

[R2 (main): Capacity/strong-prior confound for utilization gap G] The three initializations span the standard taxonomy: ImageNet (supervised non-medical), DinoV3 (self-supervised non-medical), MIMIC-CXR (supervised in-domain). Existing results rule out both alternatives: (i) Same ConvNeXt-Small, three priors, three different G at strongest privacy (MIMIC=3.4, DinoV3=6.1, ImageNet=8.0; Tab.1). If capacity drove G, gaps would be uniform. (ii) The “stronger prior” prediction is INVERTED: MIMIC (strongest, in-domain prior) yields SMALLEST G; ImageNet (weakest) yields LARGEST. Stronger priors REDUCE G, opposite to R2’s hypothesis. (iii) G(inf)~=0 for ALL priors. The gap arises ONLY under DP while capacity/prior are constant across runs, isolating DP-SGD optimization. (iv) Pattern replicates on three datasets (Tab.2: rho= up to -0.98). (v) G is label-structured (Fig.2: pneumonia largest), inconsistent with a generic capacity/prior artifact. The backbone is a methodological requirement: BatchNorm is incompatible with per-sample gradients in DP-SGD; transformers show unstable DP optimization (Sec.3,[13]). Cross-architecture consistency is established in [13,16,18,22].

[R4 (main): Sec.4 vs Fig.2 inconsistency] We sincerely thank R4 for catching this. The numbers in the “Utilization failure is label-structured” paragraph contain transcription typos: values were copied from the wrong rows of our source results table, producing inconsistent numbers in that paragraph alone. Fig.2 is correct, Tab.1 is correct, and the qualitative interpretation is correct (pneumonia largest, MIMIC smallest, label-structured failure across priors). Accurate pneumonia gaps in Fig.2: +10.6 (ImageNet,eps=1.0), +9.6 (MIMIC,eps=0.7), +11.0 (DinoV3,eps=0.7); no finding (ImageNet,eps=1.0) is +5.6.The discrepancy is localized to one paragraph; figure, table, correlation analysis, and conclusions are consistent with the correct values, confirming a clerical mistake. Text will be corrected (presentation amendment, no change to experiments).

[R2: DP-SGD specification] delta=6e-6 satisfies delta<1/N_train for all training sets (largest CheXpert: 1/N~7.9e-6), per standard medical DP practice [13,16,18,22]. Per Sec.3, non-privacy hyperparameters are fixed across runs; eps is controlled via sigma using a Renyi accountant; q=128/|D_train|. Clipping and per-eps sigma follow established protocols [13,16,18,22]; eps<10 is the accepted medical DP regime [13]; we probe to eps~1.A per-run sigma/clip/epoch summary will be added.

[R1 (main): Validation of G interventions] The linear probe IS a controlled instantiation of “freeze encoder + retrain head”. Probe AUROC > end-to-end AUROC under DP (Tab.1, all priors and datasets) directly demonstrates recoverable structure exists and IS recovered when head optimization is decoupled from joint DP-SGD. Full deployment validation (head-only DP-SGD, modified clipping) is natural follow-up. Sec.5 will be reframed as diagnostic implications rather than prescriptive recipes.

[R4: Mahalanobis vs Euclidean Delta] Delta is deliberately Euclidean to keep diagnostics orthogonal. Mahalanobis would whiten by a covariance whose anisotropy d_eff is designed to capture, conflating displacement with spectral structure.

[R4: Largest ImageNet Delta at eps=inf] Non-private updates are unconstrained, so larger drift is expected. DP-SGD clips gradients and adds noise, dampening per-step movement. Augmentations are identical across DP and non-DP.

[R4: Single backbone] DP-RGMI is model-agnostic by construction (Sec.2); architecture is constrained by DP-SGD compatibility. Cross-architecture consistency is shown in [13,16,18,22].

[Code/data] Code anonymized; public release on acceptance committed in Sec.3. All datasets and initialization weights are public.

The 27-config evaluation across 4 datasets and 3 priors supports the DP-RGMI decomposition.



Meta-Review

Meta-review #1

  • Your recommendation

    Invite for Rebuttal

  • Please justify your decision. In case you deviate from the reviewers’ recommendations, explain in detail the reasons why. In case of an invitation for rebuttal, clarify which points are important to address in the rebuttal.

    The reviews are somewhat mixed, but I believe the reviewers have raised some important questions about the main claims (no representation collapse under DP), impact of strong initialization priors, and some inconsistencies in the results. These issues must be clearly addressed in the rebuttal.

  • After you have reviewed the rebuttal and updated reviews, please provide your recommendation based on all reviews and the authors’ rebuttal.

    Accept

  • Please justify your recommendation.

    The rebuttal addressed most of the reviewer concerns. The final manuscript should emphasize that the proposed method is more diagnostic in nature and the suggested interventions have not been validated. The paper should also specify that model capacity and strength of prior (initialization) are confounding factors that require further in-depth study.



Meta-review #2

  • After you have reviewed the rebuttal and updated reviews, please provide your recommendation based on all reviews and the authors’ rebuttal.

    Accept

  • Please justify your recommendation.

    After carefully reviewing the paper, the rebuttal, and the post-rebuttal evaluations from all reviewers, my final recommendation is Accept. The authors’ rebuttal convincingly addressed the main concerns raised by the reviewers. While R2 remained negative, the argument does not undermine the practical diagnostic value of the framework.



Meta-review #3

  • After you have reviewed the rebuttal and updated reviews, please provide your recommendation based on all reviews and the authors’ rebuttal.

    Accept

  • Please justify your recommendation.

    The paper proposes DP-RGMI, a diagnostic framework that decomposes differential privacy-induced performance degradation in medical imaging into three measurable quantities: representation displacement, spectral effective dimension, and a utilization gap between linear probe and end-to-end private training performance.

    Based on the reviewers’ feedback and the authors’ rebuttal, I recommend accepting this manuscript. Two reviewers agree that their main concerns have been addressed. Review#2 still holds some concerns, and more experimental results would be beneficial to add in future work. The authors should also follow the reviewers’ suggestions to adjust the overall tone in the final version.



back to top