视觉标记遮蔽无法有效防止医疗文档中的结构化隐私信息泄露。
Vision Token Masking Alone Cannot Prevent PHI Leakage in Medical Document OCR: A Systematic Evaluation
- 测试七种视觉层遮蔽策略，均在推理时进行
- 长格式信息完全消除，但短结构化信息仍100%泄露
- 建议结合NLP后处理，适合关注医疗数据安全的研究者
大型视觉语言模型（VLM）在医疗文档光学字符识别（OCR）中应用日益广泛，引发对受保护健康信息（PHI）泄露的担忧。本文首次系统评估了基于DeepSeek-OCR的推理时视觉标记遮蔽作为隐私保护机制的有效性。设计七种遮蔽策略（V3-V9），针对SAM编码器、压缩层、双视觉编码器及投影融合等不同架构层级，使用100张合成医疗账单（源自38,517份标注文档）进行评估，所有策略均实现42.9%的PHI减少率。长格式空间分布标识符（如患者姓名、出生日期、地址）被100%抑制，但短结构化标识符（如病历号、社保号、邮箱、账户号）仍0%防护失效。消融实验显示，遮蔽半径扩大至r=1,2,3无法突破该上限，表明泄漏源于语言模型上下文推断，而非视觉遮蔽不足。模拟混合架构结合视觉遮蔽与NLP后处理，实现88.6%总减少率（假设NLP准确率80%）。研究明确了纯视觉干预的边界，区分了适于视觉或语言层面删减的PHI类型，推动未来研究向解码器微调与混合防御架构发展。
原文摘要 · Abstract (English)
Large vision-language models (VLMs) are increasingly deployed for optical character recognition (OCR) in healthcare settings, raising critical concerns about protected health information (PHI) exposure during document processing. This work presents the first systematic evaluation of inference-time vision token masking as a privacy-preserving mechanism for medical document OCR using DeepSeek-OCR. We introduce seven masking strategies (V3-V9) targeting different architectural layers (SAM encoder blocks, compression layers, dual vision encoders, projector fusion) and evaluate PHI reduction across HIPAA-defined categories using 100 synthetic medical billing statements (drawn from a corpus of 38,517 annotated documents) with perfect ground-truth annotations. All masking strategies converge to 42.9% PHI reduction, successfully suppressing long-form spatially-distributed identifiers (patient names, dates of birth, physical addresses at 100% effectiveness) while failing to prevent short structured identifiers (medical record numbers, social security numbers, email addresses, account numbers at 0% effectiveness). Ablation studies varying mask expansion radius (r=1,2,3) demonstrate that increased spatial coverage does not improve reduction beyond this ceiling, indicating that language model contextual inference - not insufficient visual masking - drives structured identifier leakage. A simulated hybrid architecture combining vision masking with NLP post-processing achieves 88.6% total PHI reduction (assuming 80% NLP accuracy on remaining identifiers). This negative result establishes boundaries for vision-only privacy interventions in VLMs, provides guidance distinguishing PHI types amenable to vision-level versus language-level redaction, and redirects future research toward decoder-level fine-tuning and hybrid defense-in-depth architectures for HIPAA-compliant medical document processing.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。