Executive Summary

The paper's first figure explains the structure of the study through an example patient named Alice. Alice contributed three electrocardiograms to the training dataset, all of them showing a normal sinus rhythm. Today she returns with an anterior infarct, a heart attack involving the front wall of the heart. The figure's caption continues: the model that saw her healthy historical records during training assigns "a substantially lower probability" to that anterior infarct, and may miss the diagnosis as a result.

The researchers stood a second model beside it. Same architecture, same training procedure, same hyperparameters, with Alice's historical records left out. Both models get the same new electrocardiogram and their answers go side by side. If the two answers differ, that difference comes from having seen Alice's old records. Alice is an illustrative example from the figure, and the numbers that follow come from the records of hundreds of thousands of real patients. What this paper reports is that the difference does occur, and that it occurs with a direction.

The researchers call the phenomenon memorisation bias. This paper is not where the name was coined. The same authors used it in the title of a preliminary study presented at a medical imaging workshop held in Daejeon, Korea in September 2025. The new ground here is not the term but the time axis. The authors write that this is the first time the effect has been traced into the records a data contributor leaves behind later, using real longitudinal patient data.

1.1Four datasets, three institutions

The material is four public clinical datasets. It is easy to read the four as four different hospitals, and that reading is wrong. The first three are different modalities from a single site, Beth Israel Deaconess Medical Center, and only the fourth comes from the Harvard-Emory ECG Database, where the study uses the Massachusetts General Hospital data alone. The tasks are not the same either. The problem posed on the emergency department records is not diagnosis but prediction of hospitalisation and critical outcomes.

The sizes in the table are the sizes of the whole datasets, not of the cohort this study analysed. The 1.8 million patients on the last row in particular is the full count of the Massachusetts General Hospital share of the Harvard-Emory database, and the number of patients who actually entered the analysis after the temporal split lives only inside the paper's figures. The Methods section gives record counts for the test sets instead: in the order of the table above, 49,655, 57,529, 20,872 and 143,062. Test performance is an average over many models, with standard deviations all at or below 0.25 percentage points. The four datasets are provided for open research use, and the finding of this paper concerns how models are built rather than the care quality of any particular hospital.

The models differ by dataset as well. Both ECG datasets use a vision transformer with its two-dimensional convolutions converted to one dimension, roughly 14 million parameters. The chest X-rays use an ImageNet-pretrained DenseNet-121 at roughly 7 million parameters, and the emergency department records use a scikit-learn random forest with 100 trees and a minimum of 4 samples per leaf. The architecture comparison and the protection experiments in later sections sit on top of this arrangement.

Where the labels came from does not appear in the table. The 15 ECG findings were derived by regular expression matching against machine-generated text reports, the 14 chest conditions are structured labels extracted from free-text radiology reports, and the 36 classes in the Massachusetts General Hospital data were assigned by a semi-automatic diagnostic system. The ground truth the models learned is a label pulled out of the record, not a value re-adjudicated by a clinician for this study. Since the question is whether two groups of models diverge on the same labels, the comparison holds. Reading the absolute performance figures in the table as clinical accuracy is a different matter, and the provenance of the labels comes first.

1.2Two hundred models split into two groups

The measurement frame has two stages. First a random split by patient produces a follow-up cohort plus validation and test sets. Then, for every patient in the follow-up cohort, their records are lined up in time and cut at one point. Before the cut is the historical data, after it the future data. Only the historical records go into training. The cut point is neither a fixed date nor a fixed ratio but is chosen per patient, and the aim is to leave as many first occurrences as possible on the future side of a condition for which that patient's historical training records held no positive case, what the paper calls a de novo condition.

The rule is written out as a procedure in the Methods. Line up a patient's records in time and count, at each record, how many of the conditions ever documented for that patient have not yet appeared. That count only decreases over time, so the cut goes just before the last record at which C or more conditions are still unseen. C was set per dataset: 1 for the ECG, chest X-ray and emergency department data, 2 for the Massachusetts General Hospital ECGs. Patients with a single record, or with the same condition documented throughout, meaning patients whose state never changed, were not split at all and had all their records placed on the historical side. So the "unchanged state" records that appear later are not the records of people whose health never varied. They are the records that stayed the same, drawn from patients who did see change in some other condition.

Then 200 models are trained per setting. Each model draws a random half of all patients and sees only those people's historical records. From the point of view of one patient, the 200 split exactly down the middle: 100 models that learned that patient and 100 that did not. The probability vectors the two groups assign to the same future record go into a non-parametric test based on energy distance, with a multiple-comparison correction applied across all historical and future records in the dataset. "Memorisation was detected" means that this test judged the two groups' prediction distributions to differ. Splitting 200 models into subsets is not itself new: the design comes from membership inference research, and the same team's earlier paper used 200 models per dataset too.

The paper's two axes were measured with different rulers. The p values on the memorisation detection side come from a fast chi-squared approximation to the energy test, which the paper states is appropriate at the group sizes used here, 100 per side. The multiple-comparison correction is the Benjamini-Hochberg procedure holding the false discovery rate at 5%. The sensitivity and specificity comparison in section 3, by contrast, is an exact permutation test that reshuffles model assignments 100,000 times, corrected by Bonferroni. At 100,000 permutations the raw p value floors at 2/(B+1), roughly 0.00002, and the corrected floor is 0.0016, which the paper states itself. So "significant" does not carry the same resolution on the two axes. The detection rates that follow stand on an approximate test, and the claim that diagnostic decisions diverged stands on an exact one.

1.3This is not data leakage

Data leakage means evaluation data bleeding into training. This phenomenon is a different thing. The authors spell it out twice: the future data "was never used for model training or model selection". Hyperparameters were chosen without looking at the future records either. The split was correct, so there is no split to fix.

Pinning it on overfitting is hard too. That overfitting worsens memorisation is already established, so the researchers checkpointed on validation loss and kept only the weights that generalised best. The optimisation hyperparameters came from 50 rounds of random search per dataset, choosing the setting with the highest validation performance. The effect of other patients happening to fall in or out of a given subset cancels in this design. Prior work showing that this influence washes into the average quickly once enough models are used is the premise of the measurement frame, and the paper cites that same literature for it.

To verify that point the researchers ran one more control. Instead of splitting by patient, they split the 200 models into two meaningless random halves and ran the same test. That control produced not a single significant difference, on historical or future records. It confirms that the difference comes from having learned a particular patient rather than from noise in the test. This is also where this article parts from the case where records from the same mother leaked into both training and evaluation and inflated the score, which was about a flaw in evaluation methodology. The problem there was a badly designed evaluation. The problem here is what happens after a correctly designed model is deployed.

The paper this article reads is the sequel to the study we covered in June 2026 that measured membership inference risk one patient at a time, and shares a first author. The boundary between the two is written into the paper. The earlier work addressed a world in which an attacker guesses membership for the very record a model trained on. The harm in this paper "does not require interference from adversarial actors". Nobody attacks anything, and the answer changes at the next visit of the person who gave their records.

The next question is time. If the effect of having seen the old records faded after a few months, there would be little to handle in practice. To measure it the researchers set up an axis they call the acquisition interval: how many months lie between that patient's most recent historical training record and the future record now under evaluation. Along that axis, the detection rate and the effect size show what becomes of the trace over time.

Of the four datasets, only one really allows long intervals to be seen. The Massachusetts General Hospital ECG data was collected from the 1980s to 2025, so decades can separate one patient's records. There the researchers detected significant prediction changes on future records taken more than 25 years after the last historical training record. The other three were collected over too short a span for intervals of that length to exist in the data at all. "Persists for decades" is therefore a fact observed at that one site, not a property of all four datasets.

The trace does fade. In the authors' phrasing, as the interval lengthens the effect "generally becomes less pronounced and rarer". It does not reach zero. The speed of the fading also differs considerably between datasets, and what the authors offer for that difference is a hypothesis: how closely the future records resemble the historical ones, and how the intervals at which patients return vary from dataset to dataset. That is an estimate the authors put forward rather than a measured result, and the paper says as much.

The authors attach one condition to that conclusion themselves. Patients with long follow-up are rare in every dataset. Estimates for the long-interval range therefore rest on comparatively few records, and the authors add that their estimates are likely conservative for that reason. When computing summary statistics they also drew a line at the point where fewer than 500 records remained and reported nothing beyond it. It is a way of not making large claims on small samples, and at the same time it marks where the resolution of this axis runs out.

In practice this becomes a question about time horizons. Setting a data retention period, deciding whether to reuse an old cohort for training, choosing how long to keep a model in service: all of those usually rest on an intuition that the influence of old records fades on its own. This paper pushes the expiry date of that intuition past 25 years in one dataset.

A wobble in predicted probability is not yet the language of clinical care. The researchers went one step further and simulated what a wobbled probability does once it becomes a diagnostic decision. For each dataset and each class they set a decision threshold on the test set, used that threshold to sort both model groups' predictions on the future records into positive and negative, and then computed the difference in correct-classification rate between the two groups for every record. The thresholds were fixed on the average prediction across all models, which keeps them independent of which model learned which patient, and the test was an exact permutation test reshuffling model assignments 100,000 times.

The comparison ran on two strata. One stratum is records where a patient returned with a condition for which their historical training records held no positive case. Since that stratum contains only positives, control records matched on sex and within a five-year age band were sampled from the same dataset to pair with them. The other stratum is records where the health state matches the past: positives for conditions that were already positive in the historical records, and negatives for conditions that had only ever been negative.

The two strata came out opposite. On records where a patient returned with a condition absent from their history, models trained on that patient's historical data had significantly lower sensitivity than models that had not. They found less of what needed finding, which in the authors' terms is a higher rate of false negatives. On records where the health state was unchanged, sensitivity and specificity were both significantly higher. The paper writes that this "artificially" inflates apparent diagnostic performance.

Which records this comparison ran on needs stating. The sensitivity and specificity comparison did not run over all future records but was restricted to future records where memorisation had been detected in the previous step. The Methods say so. So the result does not say that sensitivity drops by this much across everyone who contributed records to training. It says that among records where memorisation was detected, the direction splits this way. The thresholds were fixed in advance on the 200-model average, so the restriction does not reach into the choice of threshold.

We cannot carry the per-condition numbers over either. How many percentage points sensitivity dropped for each condition appears nowhere in the text of this version. The values all live inside the figures, and the figures are raster images that we cannot read off and carry over. What the text gives is direction and significance. The relevant figure applies a Bonferroni correction across 82 comparisons, and for one ECG dataset only the ten conditions with the most cases made it into the main figure.

3.1Mixed together, the two errors erase each other

Practice never gets the two results separately. It gets them combined. Performance falls in one stratum and rises in the other. In real deployment the two strata are mixed. Most people who contributed their records come back with their state largely unchanged, and a minority arrive with a new condition. A single block measured without separating the strata lets the inflated side offset the deflated side. Fold two errors of opposite sign into one number and the number reports that nothing happened.

The authors turned this into a warning about evaluation design. A prospective trial that does not stratify cases of conditions absent from the historical records is, in their words, likely to "reach incorrect conclusions" about diagnostic primary endpoints for data contributors. The reason sits alongside it: patients usually return with unchanged health states. For anyone writing a validation protocol, that sentence is the first line of this paper to get used.

3.2Four conditions the authors attached first

These results have to be read with their conditions. The paper writes out four of them, and dropping any single one makes the result read larger than it is.

• The magnitude is small. The authors describe the number of missed diagnoses attributable to memorisation bias in the simulation as "modest".
• This is not an incidence rate. Cases of a condition absent from the historical records are rare in routinely collected data, and this study's temporal split deliberately enriched for them. The figure therefore speaks to the existence and direction of the effect rather than the frequency to expect in deployment.
• It is a simulation, not an observation. Changes in predicted probability were converted into diagnostic decisions by a post-hoc threshold, and the models were evaluated standalone with no clinician in the loop. The true downstream clinical impact, the paper writes, "remains to be quantified prospectively".
• Subgroups were not examined. This paper did not break the results down by axes such as race, sex or insurance. The finding that risk concentrates in groups underrepresented in the training data comes from the same team's earlier paper, and whether that disparity extends to memorisation bias is an open question, as this paper states. Our article on subgroup gaps in a glucose prediction model sets out what goes unseen when performance is never measured group by group.

If everything so far describes the phenomenon, the question left is what it depends on. The researchers took one dataset, the emergency department records, and ran the same experiment three times while changing only the model architecture: a random forest, an L2-regularised logistic regression, and a ResNet for tabular data. Two hundred models per architecture, the same subset protocol, the same test. The task is not diagnosis but prediction of hospitalisation and critical outcomes from 64 clinical variables.

These three rows are the only comparison in the paper for which every number appears in the body text. Here is the share of the 65,402 future records where memorisation was detected, next to the test performance of those same models.

The three values in the rightmost column sit within 0.89 percentage points of one another. On the performance metric alone the three models are effectively indistinguishable. Yet the second column from the left reads 2.25% against 0.04%, a gap of roughly fifty-six times. The paper never places that contrast in one sentence. All three numbers are in its body text and we are the ones who set them side by side. Once they stand side by side, one sentence for practice falls out of them. That column stays outside any decision taken on performance alone.

The direction also runs against what a reader expects. The heaviest memoriser was the random forest, not the neural network, and the lightest was the logistic regression. So the authors conclude that memorisation bias is "not limited to modern AI models", adding that random forests are a model class widely used for tabular clinical prediction. Read as a deep learning problem, the finding loses its point. The paper's introduction likewise presents memorisation as documented in both deep learning and classical machine learning models, and for the classical side its list reaches back to a 1998 study.

The random-split control ran alongside these three rows too, and none of the three architectures produced a single significant record, historical or future. Reading the rates themselves as absolute values does need care. "Memorisation was detected" is a judgement relative to the test this paper chose and to this design. The rates move with the 200 models, the 100-versus-100 split per patient and the 5% false discovery rate. The three architectures, on the other hand, were measured with the same ruler, so the architecture-to-architecture comparison stands.

The historical column gives a sense of scale alongside it. For the random forest, memorisation was detected on 93.53% of the historical records used for training. The denominator for that rate is 321,530 historical records, given in the caption of an extended data figure. Predictions wobbling on records that went into training is already a known phenomenon, and it is exactly the signal a membership inference attack exploits. This paper adds the observation that the signal spreads beyond the training records, into later records of the same person.

The scope of the tasks this paper covered ends here. It measured models trained by supervised classification and nothing else. Prior work suggests the same phenomenon in segmentation, survival prediction, foundation models and large language models, the authors write, but the shape it takes in each needs separate study, as the last item of their limitations says. The medical foundation model study this paper cites shows where that side currently stands. It offers a suite for probing memorisation in models trained on structured clinical records, at the embedding level and the generation level, and what it measures there is privacy risk rather than change in diagnostic accuracy.

Do not apply the model's reading to patients who contributed their records to its training. The paper examines that route first, and then shows in three steps why it is hard to make work in practice.

It starts with the shape of consent. In most jurisdictions model training counts as a secondary use of health data collected in the course of care, and proceeds under broad consent or a consent waiver rather than study-specific consent. So patients are rarely informed that their data went into the training of any particular model. De-identification procedures then sit on top of that. Once a model is deployed, the paper writes, determining whether the patient in front of you was represented in its training dataset is "not straightforward".

Exclusion as a prescription only works when the targets can be identified. With identification blocked, the prescription hangs in the air. Each of the three routes the paper examines is blocked in a different place.

The third row weighs heaviest here. There is room to refine the first two with better engineering, but the third gets worse as data grows. Training datasets are growing everywhere right now, and the more they grow the fewer people there are left to exclude. In the authors' phrasing, "exclusion becomes self-defeating".

The authors have grounds on the model side too for expecting that direction. Several prior studies report that the share of training data that gets memorised grows with model capacity, and model development is currently heading toward scale as the route to performance. Larger models trained on the historical records of broader patient populations would raise the absolute number of people affected by memorisation bias considerably, the authors write. In the same paragraph they state that they did not test that increase directly. It is an expectation rather than a measurement.

Calling this structure a paradox is our reading. The paper puts it more drily. Current model development practice, it says, has a "shortcoming", and the common practice of building medical AI on anonymised historical patient data "needs a fundamental reassessment". Keeping fact and interpretation apart serves better here. The fact is that de-identification makes exclusion hard. The interpretation is the reading that a measure introduced to protect an individual blocks the route to protecting that same individual.

Two adjacent problems covered on this blog put this one in place. The problem of erasing specific data from an agent's memory asked how to delete what needs deleting, and the audit of whether traces remain after robot demonstration data is removed asked whether the deletion actually happened. The problem in this article is not deletion but exclusion, and it is blocked one step earlier. The difficulty is not choosing what to erase. It is choosing whom to protect.

For memorisation bias to arise, some of the people a model is used on have to be people who gave records to its training. That condition is not an edge case. It is where national screening programmes stand today. The paper points to Germany's national breast cancer screening as an example: the AI model now examining that population was trained on data "sourced from the same screening population it now serves". Comparable deployments are under way in the United Kingdom and Sweden, it adds.

The way the paper writes the scale goes like this. Hundreds of thousands of people in a screening population return at regular intervals over years or decades. So anyone who contributed their records meets a model that may have memorised their earlier records not once but repeatedly. And by the nature of a screening programme, those earlier records are typically healthy ones. This is where the time horizon from section 2 becomes a practical matter.

On one figure in this passage the paper and the original study it cites do not agree. The paper gives the training scale of the German model as 1.2 million mammograms, while the Methods section of the original study it cites for that gives "more than 2 million images". One exam consists of several images, so a conversion is possible, but we could not find the basis for it in the original. So this figure travels only as a statement of what the paper wrote. And these screening programmes are cited as examples of the overlap, not as reports of memorisation bias confirmed in them.

6.1The rules encourage the overlap

On this overlap the paper writes that "regulatory guidance actively encourages this" and cites one provision, Article 10(4) of the EU AI Act. The text itself runs wider than the citation. Its subject is not training data but "data sets", covering training, validation and testing alike; what they must take into account is not two settings, geographical and contextual, but four, "geographical, contextual, behavioural or functional"; and the whole is qualified by "to the extent required by the intended purpose".

The provision that demands the overlap more directly sits one paragraph earlier. Article 10(3) requires training, validation and testing data sets to be "sufficiently representative", with appropriate statistical properties, and specifies that this holds "as regards the persons or groups of persons in relation to whom the high-risk AI system is intended to be used". It asks the data to reflect the people who will be served. A requirement pointing the same way exists on the medical device side. The document the paper cites is the ten guiding principles for Good Machine Learning Practice, finalised by the International Medical Device Regulators Forum on 27 January 2025, and we obtained that text. Principle 3 asks clinical evaluation to use datasets representative of the intended patient population, and names the datasets that must carry that representativeness as those "for training, testing, and monitoring". In the edition issued jointly by the United States, Canadian and United Kingdom regulators in October 2021, the same slot read "the clinical study and training and test datasets".

6.2The same rulebook tells validation to leave them out

The fourth of those same ten principles requires training and test datasets to be independent of one another. It then enumerates by name the sources that can break that independence, and the first item on the list is the patient. The 2021 edition reads "All potential sources of dependence, including patient, data acquisition, and site factors, are considered and addressed to assure independence", and the 2025 edition adds one sentence to the same requirement: "The extent of external validation is proportionate to risk." Principle 8 goes a step further and asks for clinically relevant device performance information to be generated "independently of the training data set". The 2025 edition polishes the test plans into "methodologically and statistically sound" ones and leaves that phrase intact. Article 15 of the AI Act then has the accuracy figures produced that way "declared in the accompanying instructions of use".

From here on this is our reading of the texts. The paper does not make this argument. What the paper writes about regulation stops at "regulatory guidance actively encourages this", and nowhere in its body does it argue from principle numbers.

Follow the rules as written and not a single patient who gave records to training enters the test data. The number produced that way is the performance that goes on the product. At the same time another provision requires the data to reflect the people who will use the system, and as the previous section showed, the actual deployment population has contributors mixed into it. So the people the performance number was measured on and the people it is applied to are separated by the rules. And the error this paper measured is precisely the error that arises only on the separated side. The more perfectly a validation study complies, the less room it has to see this bias.

Neither requirement is at fault, and that is what makes the structure hard. Separating training sets from test sets exists to stop performance inflation; reflecting the deployment population exists for generalisation. Each is right, and laid on top of each other they open a place nobody looks at.

6.3The texts have no word for them

So we went looking for the other side. Is there any provision setting out how to treat the people who gave data to training once the model is deployed? We searched the AI Act whole, articles and recitals together, and opened two more documents that deal with the period after deployment: the United States Food and Drug Administration guidance on predetermined change control plans, which covers the procedure for retraining a model, and the EU Medical Device Regulation, which governs post-market clinical follow-up. The table below puts the same search terms through all three the same way.

Checking the neighbouring provisions leaves the layers misaligned as well. Article 15(5) enumerates cybersecurity threats and names "confidentiality attacks" explicitly, alongside data poisoning and adversarial examples. The rules do handle memorisation, but the place they do it is security. Article 72, on post-market monitoring, requires performance data to be collected and analysed actively and systematically, but asks for no separation between the stratum that gave records to training and the stratum that did not. Principle 10 of the ten principles likewise asks for real-world monitoring after deployment without mentioning that stratification. We have written before about the provision in the AI Act that permits processing of sensitive data as an exception for bias detection, and that provision looks at a different layer too.

The United States guidance on predetermined change control plans first appeared on 4 December 2024 and was issued again in final form on 18 August 2025. It covers retraining AI-enabled device software functions and re-measuring their performance, so it is the document that decides which population the post-deployment performance is measured on. A single sentence in its definition of test data contains both requirements from the previous section. Test data "should be representative of the proposed intended use populations", and at the same time "should be independent of data used for training and tuning and should generally be from multiple sites different from those that were used to generate training and tuning data". The misalignment we built in section 6.2 by setting two documents' provisions against each other lies here side by side within one definition.

The unit in which that guidance operationalises independence, however, is not the person. The sentence defining sequestration says the test data set must be "a unique data set compared to the data set used for training and tuning", and the axis stacked on top of it is the site. The things it names for separation into training, tuning and test sets are subpopulations: race, ethnicity, disease severity, sex, age. The data management questions in its appendix give sex, age and race, disease subtypes, and care settings such as inpatient and outpatient as examples of stratified sampling, and the performance re-evaluation item asks how test data is produced "that are different from any training or tuning data". Principle 4 named the patient as a source of dependence, and in this guidance, which turns that requirement into procedure, the name is gone. No question on the list asks whether the same person sits on both sides.

On the European side, post-market clinical follow-up lives in Part B of Annex XIV of the Medical Device Regulation. It enumerates five objectives the plan must aim at and eight items the plan must contain. If one of those thirteen has to be picked as the place memorisation bias might catch, it would be the objective of "identifying and analysing emergent risks on the basis of factual evidence". But an item asking for the stratum that gave records to training to be examined separately is not among the thirteen. This regulation has no vocabulary for that stratum in the first place. In the text as published in the 2017 Official Journal, machine learning, artificial intelligence and training data do not appear once. Software comes up in more than fifty places, and what that software was trained on was not a concern when the regulation was written.

The misalignment in section 6.2 is therefore not one document's mistake. The requirement to measure performance outside the contributors and the requirement for data to reflect a population with contributors in it both appear across several documents, and the word that would join the two is in none of them. Opening two more documents covering the period after deployment did not change the result. This is as far as our own reading of the texts goes.

A note on which editions we used. We read both editions of the ten principles in full. One is the edition issued jointly in October 2021 by the US Food and Drug Administration, Health Canada and the UK Medicines and Healthcare products Regulatory Agency; the other is the version finalised by the International Medical Device Regulators Forum on 27 January 2025, which is the one the paper cites. The forum's website would not load from our side, so we read the latter from the same file preserved in the Internet Archive. The two editions differ little. Principle 3 names training, testing and monitoring datasets as the carriers of representativeness, principle 4 gains the sentence on proportionality of external validation, and principle 10 shortens its treatment of retraining. The two sentences the previous section's argument hangs on, the independence requirement in principle 4 and the phrase "independently of the training data set" in principle 8, are present in both.

A Korean-language edition of the same document exists as well, and this time we opened the distributed file directly. It is "Good Machine Learning Practice for Medical Device Development: Guiding Principles", registered as guidance number 1421-01 by the Medical Device Evaluation Department of the National Institute of Food and Drug Safety Evaluation on 26 March 2025. The Korean edition states of itself that Korea's Ministry of Food and Drug Safety translated the IMDRF original and that the IMDRF does not endorse the translated content. Principle 4 matches the English. It asks for training and test data to be set up independently and, for that independence, to consider "patients, the hospital the data came from, and factors related to data collection". In principle 8, however, the Korean edition carries no clause corresponding to "independently of the training data set". Across the whole document, the word for independence appears only in principle 4. So a developer in Korea reading only the Korean edition never sees the requirement to generate performance independently of the training data as a sentence, and never sees one of the two axes of the misalignment built in the previous section. This is a gap produced in translation rather than a conflict between provisions.

The standard tool against memorisation is differential privacy. It mixes calibrated noise into training so that the result is nearly indistinguishable whether one unit of data went in or stayed out. How indistinguishable is written as a budget, ε. A smaller ε means stronger protection and lower performance. Yet whether this method works depends less on where ε is set than on the word in front of it. What counts as one unit of data.

The researchers ran this experiment on two ECG datasets across four budgets. Compute constraints forced the model down from 14 million parameters to 1.9 million, and for each accounting scheme they trained a separate non-private baseline of the same architecture and recipe to compare against. So these numbers did not come from the same models as the sections before.

Alongside the budget ε sits a δ, which this experiment set to the reciprocal of the size of the relevant historical training data. Changing the unit of protection changes that size, so the value of δ moves with it. Patient-level protection was constructed by shrinking the historical training data alone, leaving the future record dataset untouched. The zeros on the future side of the table below are not zeros obtained by shrinking what was evaluated.

The zeros on the lower row are best kept apart from the zeros seen earlier. The zero from the control in section 1 confirmed that the method does not pick up noise; the zero here is the result of a safeguard actually removing the traces. Same notation, different statement. The upper row, where protection applied one record at a time fails to stop person-level risk, matches what the earlier paper already reported on the membership inference side, the authors write.

The authors locate the reason the result splits this way when the unit rises by one step in the cause of the phenomenon. Memorisation bias arises because one person's records stay similar to one another over time. A shield placed over one record at a time therefore leaves the passage that similarity opens exactly as it was. The paper's general principle is one sentence.

The prescription itself is not this paper's invention, and that is worth putting down. The recommendation to raise the unit of protection from the record to the patient is already in the conclusion of the same team's earlier Nature paper. This paper's contribution lies not in issuing the prescription but in measuring, for the first time, what happens when that recommendation is actually carried out, and doing so along a time axis that reaches into later records.

7.1So is patient-level protection the answer?

Closing this section with "use patient-level differential privacy" throws away three conditions the paper attached. First, the patient-level implementation in this experiment is naive. It kept only the single most recent historical record per patient, discarded the rest, and applied record-level accounting. Training records fell from 475,512 to 146,332 on one dataset and from 6,147,511 to 1,767,104 on the other. So the performance drop that came with it mixes the price of the safeguard with the price of the discarded data, and the authors themselves write that the cost is an overestimate. Thin tuning pushes the same way. The hyperparameters for this experiment came from 20 rounds of random search at one budget, ε=100, and were reused across all four, with no regularisation such as weight decay or dropout. Searching per budget and adding the engineering that has accumulated on the differentially private training side could raise diagnostic performance, the paper says outright.

Second, patient-level protection rests on an assumption of its own. Duplicate entries for the same person in a database, or distinct patients who are family members or genetically similar, break the premise that each protected unit is independent. Third, this experiment ran on only two of the four datasets, and with a shrunken model at that. There is no basis yet for carrying the conclusion across all four.

So is there a proper implementation that keeps all of a patient's records while giving a person-level guarantee? Adjacent fields have it worked out. On the language model fine-tuning side, the problem that treating each text record as the privacy unit makes guarantees uneven when contributions per user vary has already been raised, and two routes, Group Privacy and User-wise DP-SGD, have been systematically compared. The paper names two studies to consult at that point: a 2022 study that lifted the accuracy of differentially private image classification through scale, and a 2025 study on scaling laws for differentially private language models. A co-author of this paper appears on the author list of the latter, so that route sits within this team's range. A demonstration at medical imaging or ECG scale that gives a person-level guarantee while keeping all of a patient's records is something we did not find while writing this, and the authors call it an "open research problem" as well. Treating one person's share as the unit recurs in the same shape on the language model side.

7.2Why removing memorisation is not the direction

A simpler prescription suggests itself. Why not get rid of memorisation altogether? A theorem from 2020 blocks that route: for natural data distributions, memorisation of labels is necessary for achieving close-to-optimal generalisation error. That holds even for outliers and noisy labels. Its condition is written alongside it: memorisation becomes necessary when the distribution of subpopulation frequencies is long-tailed.

The theorem points to the long-tailed character of image and text data as its evidence, and evidence that medical data meets that condition is in neither this paper nor the theorem. So nothing here establishes that removal is impossible. It does mean that one question has to be answered before removal can be offered as a prescription. The direction this paper actually demonstrated was not removal but the unit.

A large part of what Pebblous sells is deciding units. What counts as one item when deduplicating, what gets bundled as one block when splitting training from evaluation, what counts as one sample when scoring quality. This paper measured a unit too. The model saw records, and the harm went to a person.

The paper also names the cause of that mismatch. One person's records resemble one another. The electrocardiogram taken today is no stranger to the one taken ten years ago. So a procedure that protects one record at a time, deduplicates one record at a time and counts one sample at a time leaves the passage that resemblance opens exactly as it was. The shape is not unique to medicine. Thousands of inspection images from one production line, the driving logs of one driver, the bundle of utterances from one user all have that shape. Data handled every day in quality diagnosis looks like this.

8.1Which layer broke

The model did not break, and the split was not wrong. In all four datasets the future records went into neither training nor model selection, and the randomly partitioned control produced not one significant record. The procedures were all correct. What was missing was who the performance number had been measured on.

That the omission works in both directions is what makes it particular. Sensitivity falls for someone returning with a condition absent from their history, and sensitivity and specificity are both inflated for someone whose state is unchanged. Combined into a single figure, the two cancel. That is why the authors attached a warning to prospective trial design. A third item stacks on top. One entry is empty in the criteria for choosing a model. The three tabular models scored almost identically on the test set, and the share of future records where memorisation was detected differed fifty-six fold.

8.2Three things practice can change now

The prescriptions that carry straight from this paper into practice gather into three.

• Measure performance separately. Once for the stratum that gave records to training and once for the stratum that did not. Where that separation cannot be made, the fact that it cannot be made is itself the first result to write down.
• Stratify the cases where the state changed. Two strata whose directions run opposite erase each other once mixed. Stratum definitions written into the evaluation protocol in advance cost less than analysis after the fact.
• Raise the unit of protection, deduplication and splitting. From the record to the subject. Protection applied one record at a time left traces even at the strongest setting, and raising the unit to the person almost removed them from later records.

Getting rid of memorisation is not on that list. A theorem holds that memorisation is necessary for optimal generalisation under a long-tailed distribution, and the patient-level protection in this paper cut performance too. The authors take the cost to be overestimated because of the implementation, but either way practice still comes back to the three items above.

8.3The shape of the missing entry

A model report today shows roughly where that entry is missing. It carries performance metrics and dataset sizes. How far the training population and the deployment population overlap, and what the performance was among the people in that overlap, mostly does not get written down.

That omission is not laziness. As section 6 showed, the rules are written that way. The ten guiding principles for Good Machine Learning Practice name the patient as a source of dependence between the training set and the test set and ask for the two to be separated, and ask for performance to be generated independently of the training data. The same set of principles and the AI Act require the data to reflect the people who will use the system. Both requirements hold, and a study that complies with both measures one group of people and is applied to another. A provision setting out how to count that overlap appeared in none of the documents we opened.

The idea itself is simple. The only manipulation this paper performed was splitting 200 models into two groups. It is not free, of course. The paper writes that reproducing all of its experiments would require training 5,200 models at roughly 10,000 GPU hours on an A100. About 8,200 of those hours go to the differential privacy experiments, 1,681 to the non-private experiments of the earlier sections, and within that the Massachusetts General Hospital ECGs alone took 1,069 hours at 5.3 hours per model. Storing the model outputs took 2 terabytes. Yet the same section notes that training the random forest and the logistic regression on the emergency department records took about 4 CPU hours. For tabular clinical prediction models, that is the threshold of this measurement. The hard part is not doing the measuring but deciding to measure, and making that decision come round regularly is a matter of process rather than tooling. If Pebblous stands where units of data get defined and quality gets diagnosed by those units, this article points to exactly that work.

The figures in the body come from three streams. Values from preprint 1 were carried over after checking the body and Methods of the public arXiv version directly, and values that live only inside the figures were not carried over at all. From 2 onward the entries are either prior work the paper cites or work addressing the same problem in another field, and every verbatim quotation was checked against its own original. Regulatory documents are recorded with their editions, and where the route to the original was unusual, that route is recorded too.

The backbone of this report (checked against the primary text)

• 1.Moritz A. Knolle, Martin J. Menten, Laurin Lux, Mélanie Roschewitz, Emma A. M. Stanley, Georgios Kaissis, Daniel Rueckert, Ben Glocker. "Memorisation bias in medical AI." Preprint, arXiv:2609.17223v1, submitted 15 September 2026, cs.LG, CC BY 4.0. arXiv: 2609.17223 — checked against the body, Methods, extended data captions and the PDF cover. Affiliations appear only on the PDF cover: the Technical University of Munich and its university hospital, the Munich Center for Machine Learning, the Department of Computing at Imperial College London, and the Hasso Plattner Institute. On the cover only Mélanie Roschewitz carries no affiliation footnote marker, so this article attaches no institution to that author. The arXiv Comments field is empty, so there is no submission or review information.

Prior work and adjacent measurements

• 2.Moritz A. Knolle, Martin J. Menten, Friederike Jungmann, Felix Meissen, Ben Glocker, Daniel Rueckert, Georgios Kaissis (2026). "Disparate privacy risks from medical AI." Nature 656(8126), 192–198. doi.org/10.1038/s41586-026-10688-0 — the earlier paper. Checked in full against an open-access copy. Seven datasets, 200 models per dataset, the unequal distribution of membership inference risk, and the recommendation to raise the unit of protection to the patient all came from here. There is no analysis of future or unseen records in that paper.
• 3.Moritz Knolle, Martin J. Menten, Daniel Rueckert, Georgios Kaissis, Ben Glocker (2025). "Memorisation Bias: AI predictions for data contributors are biased towards their health states in the training data." LMID 2025 (workshop held with MICCAI 2025, Daejeon, Korea, 27 September 2025), LNCS 16184, pp. 24–33 — where the term was first presented. It used two datasets, CheXpert and Kermany-OCT, which overlap with none of the four datasets in this paper.
• 4.Vitaly Feldman (2020). "Does Learning Require Memorization? A Short Tale about a Long Tail." STOC 52. arXiv:1906.05271 — the basis for section 7.2. Verbatim from the abstract, the condition is that the distribution of subpopulation frequencies is long-tailed, and the evidence it points to is the character of image and text data. Evidence that medical data meets that condition is in neither paper.
• 5.Lynn Chua et al. (2024). "Mind the Privacy Unit! User-Level Differential Privacy for Language Model Fine-Tuning." COLM 2024. arXiv:2406.14322 — the basis for section 7.1. Verbatim from the abstract, it states that most current evaluations treat each text record as the privacy unit, which makes per-user guarantees uneven, and it compares Group Privacy against User-wise DP-SGD. It is not a demonstration at medical scale.
• 6.Dataset descriptor papers: Zuzana Koscova et al. (2026), "The Harvard-Emory ECG database," Scientific Data 13(1), 516 / Brian Gow et al. (2023), MIMIC-IV-ECG, PhysioNet / Alistair Johnson et al. (2019), MIMIC-CXR / Feng Xie et al. (2022), MIMIC-IV-ED benchmark, Scientific Data — the sizes, institutions and tasks in the section 1 table come from these together with the paper's Methods. This study uses only the Massachusetts General Hospital data within the Harvard-Emory database.
• 7.Methodological tools: Gábor J. Székely, Maria L. Rizzo (2004), "Testing for equal distributions in high dimension," InterStat 5(16.10), 1249–1272 — the origin of the energy distance test, implemented with hyppo v0.5.2 (Panda et al. 2019, arXiv:1907.02088). The p values come from the chi-squared approximation of Cheng Shen, Sambit Panda, Joshua T. Vogelstein (2022), "The chi-square test of distance correlation," Journal of Computational and Graphical Statistics 31(1), 254–262 / Nicholas Carlini et al. (2022), "Membership inference attacks from first principles," IEEE S&P — the balanced subset design / W. J. Youden (1950), Cancer 3(1), 32–35 — decision thresholds / Yury Gorishniy et al. (2021), NeurIPS — tabular ResNet / Martin Abadi et al. (2016), CCS — DP-SGD / Borja Balle et al., JAX-Privacy (the repository citation record gives v0.4.0; the privacy accounting implementation named in the paper's Methods is v2.1.0) — we read the repository README in full and found no mention corresponding to group privacy or user-level accounting, and a full pass over the code was blocked by a search login wall. This article makes no claim about the scope of that library. The engineering routes section 7.1 names, following the paper, are Soham De et al. (2022), "Unlocking high-accuracy differentially private image classification through scale," arXiv:2204.13650 and Ryan Mckenna et al. (2025), "Scaling laws for differentially private language models," ICML 42. The author list of the latter includes Georgios Kaissis, a co-author of paper 1.
• 8.Deployment cases: Nico Eisemann et al. (2025), "Nationwide real-world implementation of AI for cancer detection in population-based mammography screening," Nature Medicine 31(3), 917–924 / Christian Leibig et al. (2022), Lancet Digital Health 4(7), e507–e519 / EDITH in the United Kingdom and MASAI in Sweden — section 6 cites these only as examples of the overlap. Memorisation bias was not confirmed in these programmes. The figure of 1.2 million mammograms is a statement in paper 1, while the Methods of the original study it cites gives more than 2 million images.
• 9.Sana Tonekaboni, Lena Stempfle, Adibvafa Fallahpour, Walter Gerych, Marzyeh Ghassemi (2025). "An Investigation of Memorization Risk in Healthcare Foundation Models." NeurIPS 2025. arXiv:2510.12950 — referenced in the scope paragraph at the end of section 4. The abstract establishes a black-box evaluation suite probing memorisation in foundation models trained on structured clinical records, at the embedding level and the generation level, framed around privacy risk. It is not a study measuring change in diagnostic accuracy.

Regulation and guidance (editions stated)

• 10.Regulation (EU) 2024/1689 (the EU AI Act), Article 10(3) and 10(4), Article 15(1), (3) and (5), Article 72. EUR-Lex original text — the verbatim provisions and the full-text search results in section 6 come from here. The search covered the whole regulation including the recitals.
• 11.US Food and Drug Administration, Health Canada and the UK Medicines and Healthcare products Regulatory Agency (October 2021). "Good Machine Learning Practice for Medical Device Development: Guiding Principles." fda.gov/media/153486 — the verbatim text of principles 3, 4, 8, 9 and 10 cited in section 6.2 comes from this edition. It is the predecessor of 12.
• 12.IMDRF/AIML WG/N88 FINAL:2025 (27 January 2025). "Good machine learning practice for medical device development: guiding principles" — the document cited by paper 1. imdrf.org would not load from our side, so we read the full text from the same PDF preserved in the Internet Archive. It shares a lineage with 11 and is not conflated with it here. The 2025 wording of principles 3, 4 and 8 quoted in sections 6.1 and 6.2, and the edition comparison in section 6.3, come from here. The phrase "independently of the training dataset" in principle 8 is present in this edition too.
• 13.Ministry of Food and Drug Safety, National Institute of Food and Drug Safety Evaluation, Medical Device Evaluation Department (26 March 2025). "Good Machine Learning Practice for Medical Device Development: Guiding Principles" (Korean edition), civil guidance registration number 1421-01. mfds.go.kr guidance — the Korean translation of 12, and the source of the Korea paragraph in section 6.3. We opened the distributed PDF directly and read it in full. The document states that the Ministry translated the IMDRF original and that the IMDRF does not endorse the translated content. Principle 8 carries no clause corresponding to "independently of the training data set", and across the whole document the word for independence appears only in principle 4.
• 14.US Food and Drug Administration (issued 18 August 2025; originally issued 4 December 2024). "Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions," Guidance for Industry and FDA Staff, docket FDA-2022-D-2628. fda.gov/media/166704 — the predetermined change control plan paragraphs in section 6.3 come from here. We obtained the full PDF and searched it directly. Its definition of test data puts representativeness of the deployment population and independence from training and tuning data in one sentence, defines sequestration at the level of the data set, and gives the site as the additional axis of independence. contributor, contributed, whose data and included in the training return zero hits each.
• 15.Regulation (EU) 2017/745 (the EU Medical Device Regulation), Annex XIV Part B (post-market clinical follow-up). Official Journal OJ L 117/1, 5 May 2017, as published. EUR-Lex 32017R0745 — the post-market clinical follow-up paragraph in section 6.3 comes from here. Part B sets out five objectives and eight mandatory plan items, and an item asking for the stratum of training contributors to be examined separately is not among those thirteen. In this text machine learning, artificial intelligence and training data return zero hits each, while software returns more than fifty. We searched the 2017 Official Journal text rather than a consolidated version.

Adjacent articles on the Pebblous blog

• 16.The earlier study that measured membership inference risk one patient at a time — referenced in sections 1 and 7. That one is a world with an attacker; this one is a world where no attacker is needed.
• 17.The case where records from the same mother leaked into both training and evaluation and inflated the score — used in section 1.3 as the line of distinction. That article is about a flaw in evaluation methodology; this one is about what happens after deployment under a correct design.
• 18.The problem of erasing specific data from an agent's memory and the audit of whether traces remain after robot demonstration data is removed — referenced in section 5 when setting deletion apart from exclusion.
• 19.Treating one person's share as the unit, subgroup gaps in a glucose prediction model, and the AI Act's exception for processing sensitive data — referenced one line each in sections 7.1, 3.2 and 6.3.