Memorisation bias in medical AI

The problem

What is memorisation bias?

AI models do not only learn general patterns from their training data. Their output for a given input can also depend on whether that exact input was in the training set, a property known as memorisation. It is usually studied as a privacy risk. This study asks a clinical question instead: what happens when a patient whose records were used for training comes back, and the same model is applied to their new data?

This is common practice. Germany’s national breast cancer screening programme, for example, uses a model trained on 1.2 million mammograms from the same screening population it now serves. Patients return at regular intervals for years, so many of them meet a model trained on their own earlier, typically healthy, records.

The method

Quantifying longitudinal memorisation

1. Split each patient’s records in time. Earlier records form the historical set, which may be used for training. Later records form the future set, which is never used for training or model selection.
2. Train 200 models, each on the historical records of a random half of the patients. Every patient is therefore in the training data of exactly 100 models (“IN”) and absent from the other 100 (“OUT”).
3. Compare IN and OUT predictions on each future record with an energy-distance test, corrected for multiple comparisons. A significant difference means the patient’s historical records changed the prediction on their new one.
4. Check against chance. Repeating the test with randomly split model groups finds no significant records in any dataset, so the effects are specific to each patient’s own data.

01 · Future predictions shift

Training on a patient’s historical records alters their future predictions

In all four datasets, a share of future records showed significantly different predictions depending on whether the patient’s historical records were in the training data. Most shifts are small, but some exceed 70 percentage points. On the historical records themselves, the ones used for training, the effect is far more common and more pronounced.

Examples from the data

Single future records with a significant shift from the selected dataset. Only aggregate test results are shown; no patient data.

02 · Persistence

Memorisation bias fades with time, but can persist for decades

The longer the gap between a patient’s most recent training record and their new record, the rarer and weaker the shift. It does not disappear: in HEEDB, a dataset of electrocardiograms collected from the 1980s to 2025, significant shifts appear on records acquired more than 35 years after the patient’s last training record.

03 · Diagnostic accuracy

Patients who return with a new condition are diagnosed less often

The study simulated deployment: fixed decision thresholds turn each model’s output into a yes/no call, and the calls of IN and OUT models are compared for patients with a significant shift. The effect is asymmetric. When a patient returns with a condition absent from all their training records, sensitivity drops, so the condition is missed more often. When their health is unchanged, both sensitivity and specificity are artificially inflated, which makes the model look better than it is for these patients.

04 · Mitigation

Patient-level differential privacy prevents memorisation bias; record-level does not

Differential privacy (DP) adds calibrated noise during training to limit how much any single unit of data can affect the model. The unit matters. With record-level DP, the variant most used in practice, significant shifts on future records remain even at the strongest protection tested (ε = 1). With patient-level DP, which protects all of a patient’s records together, at most two future records are affected at any budget, at some cost in diagnostic performance.