PaperlayerView exact revision on arXiv

Source-linked AI summary

PrivMeSA: Privacy-Aware Self-Evolving Multi-Agent System for Medicine via Local-Remote LLM Collaboration

Dannong Wang, Yuran Zhang, Bian Sun, Alex Stinard, Yuzhang Shang, Song Wang, Yu Tian

arXiv:2609.38458v1cs.AI

TL;DR

In multi-turn clinical delegation, quasi-identifiers can accumulate across consultations and patient visits, while existing approaches do not jointly address those disclosures and re-identification risk. PrivMeSA combines local reinforcement-learning control of remote consultations with a memory that reuses generalized specialist guidance. It improves accuracy while reducing disclosure and re-identification on an MIMIC-IV-ED benchmark.

  • Problem

    Quasi-identifiers can accumulate across multi-turn consultations and repeated visits to enable re-identification, while prior delegation methods do not address this combined risk.

    Source: §1 · p. 1

  • Method

    PrivMeSA trains a local agent to balance accuracy against disclosure and re-identification risk, and distills completed specialist consultations into reusable local lessons.

    Source: §1 · p. 2, §3.4 · p. 6

  • Results

    92% of patients remain re-identifiable under delegation, versus none under PrivMeSA with Gemma 4 12B, which also exceeds delegation in accuracy across tested local-model settings.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The results show that higher clinical task performance and lower patient exposure are achievable together, while retained expertise can support later patients without another external exchange.

    Source: §5 · p. 10

    A lesson distilled from an episode becomes available only after that episode is complete, so it cannot guide its own consultation.

    Source: §3.4 · p. 6

Abstract

from arXiv · show

Clinical large language model (LLM) agents deployed locally can consult more capable remote models, but doing so risks exposing patient information. Privacy-conscious delegation places disclosure decisions with a local agent, yet removing explicit identifiers is insufficient: quasi-identifiers can accumulate across multi-turn consultations and repeated patient visits to enable re-identification. We introduce PrivMeSA, a privacy-aware self-evolving multi-agent system that learns to control disclosure and retains remote expertise for local reuse. A local agent manages each encounter and consults remote specialists that may request additional information. Reinforcement learning balances task accuracy against direct disclosure and registry-based re-identification risk, with privacy evaluated over the complete outbound transcript of each encounter. A local lesson memory distills completed consultations into generalized clinical guidance and retrieves relevant lessons before transmission, allowing subsequent cases to reuse expertise without another remote exchange. Memory grows without additional outcome labels or parameter updates. On an emergency-department benchmark built from MIMIC-IV-ED records, PrivMeSA improves mean task accuracy over delegation by up to 15.8 percentage points. In the same setting, PrivMeSA reduces the disclosure of personal details from 98.0% to 0.2% of cases and the share of cases in which the patient can be narrowed to ten or fewer registry patients from 74% to 0%.

1 INTRODUCTION

Clinical delegation must balance remote expertise with privacy because quasi-identifiers can accumulate across consultations and visits. PrivMeSA combines learned disclosure control with reusable local lessons, improving accuracy while reducing disclosure and re-identification on an MIMIC-IV-ED benchmark.

1 INTRODUCTION

  • Age, sex, vital signs, and complaint can act as quasi-identifiers whose combination distinguishes patients, and disclosures across consultations or visits can enable re-identification.Existing privacy-conscious delegation methods focus on designated sensitive information and do not address specialist-initiated multi-turn follow-up or accumulated disclosures across visits.Source: §1 · pp. 1–2
  • A remote consultation can provide guidance for subsequent patients, so retaining expertise locally can reduce the need for another disclosure when relevant knowledge is already available.Privacy-aware delegation therefore involves both what to disclose for remote expertise and whether a new consultation is needed.Source: §1 · p. 2
  • PrivMeSA trains a local agent with reinforcement learning to balance task accuracy against direct disclosure and re-identification risk while deciding what to ask and withhold.A privacy-aware memory distills specialist responses into generalized lessons for similar future cases without additional outcome labels.Source: §1 · p. 2
  • With Gemma 4 12B, PrivMeSA exceeds delegation by 2.8 points and PAPILLON by 6.6, sends a personal detail in 0.9% of cases, and leaves no patient re-identifiable versus 92% under delegation.With Granite 4.2 8B, accuracy rises by 15.8 points over delegation; test-time memory reduces remote messages by 15% at equal or higher accuracy.Source: §1 · p. 2
  • The benchmark uses real hospital records and evaluates multi-turn specialist requests plus direct disclosure and registry-based re-identification per visit and across patient histories.The evaluation includes ablations of training and self-evolution effects on task performance and privacy.Source: §1 · p. 2

2 RELATED WORK

Prior work addresses clinical privacy, delegation, and agent memory through distinct mechanisms, but the described approaches leave gaps in privacy-aware clinical policy optimization and information reuse.

2 RELATED WORK

  • Clinical-agent privacy safeguards regulate record access or report generation rather than optimizing clinical policies.The cited approaches include access permissions for EHR agents and k-anonymity or ℓ-diversity for reports from a frozen multimodal predictor.Source: §2 · p. 3
  • Privacy-conscious delegation rewrites or routes supplied requests, but does not jointly learn information acquisition and disclosure as clinical evidence accumulates or assess risk across repeated visits.Prior approaches include local request reformulation, chunk-level routing, task-aware rewriting, and LLM-estimated k-anonymity.Source: §2 · p. 3
  • Agent-memory methods use self-assessed outcomes, clinical action feedback, or reusable search traces, while shared-memory and inter-agent messages remain potential disclosure channels.Improved task performance alone does not establish safe information reuse.Source: §2 · p. 3

3 PRIVMESA: A PRIVACY-AWARE SELF-EVOLVING DELEGATION FRAMEWORK

PrivMeSA couples episode-level control of information sent to remote specialists with local reuse of expertise from completed consultations. Its framework uses a memory gate, a privacy-aware learning objective, and a persistent lesson store.

3 PRIVMESA: A PRIVACY-AWARE SELF-EVOLVING DELEGATION FRAMEWORK

  • A local policy manages each clinical episode, gates consultation drafts through memory, and learns disclosure decisions while completed consultations become lessons for later episodes.The framework addresses both whether to disclose information for remote expertise and whether existing local expertise can avoid a new consultation.Source: §3 · p. 4, §3.4 · p. 6

3.1 INTERACTIVE DELEGATION AND DISCLOSURE RISK

  • Privacy risk is assessed over the episode’s complete outbound transcript, where individually non-identifying clinical facts can jointly identify a patient.Re-identification is measured by counting registry patients consistent with disclosed quasi-identifiers, including across linked visits.Source: §3.1 · p. 4

3.2 MEMORY-GATED CONSULTATION

  • Before a consultation leaves the institution, the memory gate can offer a retrieved lesson, continue locally, or let the policy revise and send the draft.Remote specialists have distinct clinical roles and may request additional information, which is added to the outbound transcript.Source: §3.2 · pp. 4–5

3.3 LEARNING DISCLOSURE DECISIONS

  • The policy learns a sequence of choices about consulting, message content, follow-up requests, withholding information, and accepting retrieved lessons, scored after the episode ends.The objective evaluates privacy over the full consultation trajectory rather than penalizing only designated sensitive fields.Source: §3.3 · pp. 5–6
  • Task accuracy, withheld synthetic personal details, and registry-based anonymity contribute distinct terms to the episode-level objective.The anonymity term considers both the specialists’ pooled information and the most identifying individual specialist view.Source: §3.3 · p. 5

3.4 LEARNING FROM COMPLETED CONSULTATIONS

  • After an episode, a distiller converts completed exchanges into lessons with a task, generalized question, specialist answer, and provenance; retrieval uses embedding similarity.Only earlier episodes can contribute lessons available during a current episode, and the memory grows through consultation updates rather than trainable retriever, judge, or distiller components.Source: §3.4 · p. 6

4 EXPERIMENTS

The experiments evaluate PrivMeSA on multi-encounter MIMIC-IV-ED cases, measuring task accuracy, direct disclosure, and re-identification. Results cover baseline comparisons, ablations, test-time memory, and a qualitative case.

4.1 EXPERIMENTAL SETUP

  • Cases come from 1,700 training patients and 200 held-out evaluation patients, each contributing 3–10 encounters for measuring linkage across visits.The registry contains 205,504 MIMIC-IV-ED patients; evaluation includes 897 encounters.Source: §4.1 · p. 6
  • Accuracy averages diagnosis, disposition, and procedure tasks; privacy measures track injected-detail disclosure and registry matches per episode and across linked visits.An unanswered task counts as incorrect, and episodes sending nothing have k = |R|.Source: §4.1 · p. 6, Table 2 · p. 7
  • For test-time learning, the policy processes 897 held-out encounters in one pass from empty memory, with visits ordered chronologically and lessons distilled without recorded answers.The paired control processes the same sequence with memory kept empty; results are reported by quarter.Source: §4.1 · p. 7

4.2 MAIN RESULTS

  • 0.592 mean accuracy with Gemma 4 12B and 0.583 with Granite 4.2 8B; PrivMeSA remains highly accurate while disclosing almost nothing and leaving no patient re-identifiable.With Granite, its accuracy falls by less than one point, while both baselines fall more than ten points below their Gemma accuracy.Source: Table 1 · p. 7, §4.2 · p. 8
  • Prompting and per-message rewriting leave re-identification risk: linked visits make 92% of delegation patients and 8% of PAPILLON patients match ten or fewer registry patients.PAPILLON also passes personal details in 80% of cases with Granite 4.2 8B.Source: §4.2 · p. 8
  • Without training, the PrivMeSA architecture matches delegation accuracy and discloses a personal detail in 90% of cases; training without consultation leaves diagnosis accuracy at 0.305 versus 0.380.A policy trained without personal-information requests discloses a detail in 81% of cases when such requests appear at evaluation.Source: §4.2 · p. 8
  • Growing test-time memory sends 15% fewer specialist messages while matching or exceeding control accuracy in every quarter, with low re-identification throughout.In the last quarter, median linked k is 3,584 with memory versus 3,176 without it.Source: §4.2 · p. 8
  • In one Gemma case, PrivMeSA answers both tasks from memory, declines an occupational-history request, and leaves 22,799 registry patients matching.The example contrasts delegation, which narrows the match to two patients, and PAPILLON, which transmits an unsupported procedure claim.Source: §4.2 · p. 8

5 CONCLUSION

PrivMeSA combines transcript-level reinforcement learning for disclosure control with a lesson memory that retains specialist guidance for subsequent cases. The conclusion presents privacy-aware delegation as a way to improve clinical task performance while reducing patient exposure and reusing remote expertise locally.

5 CONCLUSION

  • PrivMeSA combines a transcript-level reinforcement learning objective for disclosure and re-identification risk with a lesson memory that retains specialist guidance for later cases.The conclusion frames the combined system as achieving better clinical task performance and lower patient exposure, including across repeated visits.Source: §5 · pp. 8–10
  • Test-time memory further reduces remote communication while maintaining comparable accuracy.The cited Table 3 caption describes memory-on and memory-off results by quarter, but supplies no cell values.Source: Table 3 · p. 9, §5 · p. 10
  • By retaining expertise acquired through remote consultation, PrivMeSA lets later patients draw on local guidance without another external exchange.This is the conclusion's stated practical consequence of combining disclosure control with locally retained knowledge.Source: §5 · p. 10

A BENCHMARK CONSTRUCTION

The benchmark samples emergency-department patients with repeated visits and replays each visit as a timeline of clinical information and actions. Earlier visits can be retrieved as summaries, while tests and other information become available as the encounter unfolds.

A.1 COHORT AND EPISODES

  • The cohort samples 1,900 MIMIC-IV-ED patients with 3 to 10 visits, with test patients stratified by visit count.The 200 test patients include 128 with 3 or 4 visits, 44 with 5 or 6, and 28 with 7 to 10; the main results use a random subset of 100.Source: §A.1 · p. 13
  • Each episode replays one recorded ED visit along its timeline, with earlier visits of the same patient available as summaries.Demographics, arrival mode, triage assessment, vital signs, and the injected personal record are available at the start; later information appears at recorded times.Source: §A.1 · p. 13
  • The local agent can read clinical information, review earlier encounters, search and place orders, wait, consult specialists, and submit task predictions.Table 5 is identified as listing the available actions.Source: §A.1 · p. 13, Table 5 · p. 13

A.2 TASKS

The benchmark defines clinical task labels, synthetic personal attributes, and measures for disclosure and registry-based re-identification. Its evaluation aggregates quasi-identifiers across a visit and uses linked registry patients to assess identification risk.

A.2 TASKS

  • Diagnosis labels use single-level CCS categories and span 94 categories in the test set, where the most frequent-category baseline has 0.073 accuracy.Diagnoses may be submitted in ICD-9-CM or ICD-10-CM; procedure labels are imbalanced toward no.Source: §A.2 · p. 14, Table 6 · p. 14

A.3 SYNTHETIC PERSONAL RECORD

  • Each patient receives synthetic personal attributes, including name, occupation, employer, home address, and next of kin.Direct disclosure evaluation focuses on these five attributes with many possible values.Source: §A.3 · p. 14

B.1 DIRECT DISCLOSURE

  • A personal detail counts as disclosed when a distinctive part appears as a whole word in a message received by a specialist.The scoring includes follow-up replies and, for PAPILLON, rewritten messages.Source: §B.1 · p. 14

B.2 RE-IDENTIFICATION

  • The re-identification attacker combines quasi-identifiers across specialist messages and matches them against a registry; k counts matching patients.The threshold is k ≤10; because MIMIC-IV-ED is de-identified, this measurement cannot identify real individuals. Incorrectly extracted visits are excluded from per-visit and linked statistics.Source: §B.2 · p. 14

B.3 ROBUSTNESS TO THE ATTACKER

The robustness analysis re-evaluates PrivMeSA transcripts with the training attacker and compares its re-identification counts with those from the evaluation attacker. The attackers produce the same k for 371 of 453 visits.

B.3 ROBUSTNESS TO THE ATTACKER

  • The training and evaluation attackers produce the same k for 371 of 453 visits when re-evaluating PrivMeSA transcripts.Table 7 reports re-identification under both attackers and defines identifiers as the mean number of quasi-identifiers extracted per visit.Source: §B.3 · p. 14, Table 7 · p. 15

C.1 LESSON MEMORY

The lesson memory retrieves verified lessons for consultation drafts and distills completed exchanges into reusable guidance. The reward details also specify how anonymity is bounded and how episodes without messages are scored.

C.1 LESSON MEMORY

  • A frozen judge checks up to one of the ten most similar lessons and verifies its applicability before the policy receives it.Retrieval uses cosine similarity; drafts below 0.775 receive a miss notice.Source: §C.1 · p. 15
  • A frozen distiller processes completed exchanges without the record, labels, or reward, and may write or discard a lesson.A new lesson replaces one for the same task at key similarity of at least 0.90; memory holds 2,026 Gemma lessons and 1,470 Granite lessons after training.Source: §C.1 · p. 15

C.2 REWARD DETAILS

  • The anonymity term uses the combined transcript as a lower bound because each specialist receives only a subset of its messages.This prevents extraction errors from making a specialist’s view appear more identifying than the combined transcript.Source: §C.2 · p. 15
  • Episodes with no messages, including those resolved entirely from memory, receive fixed anonymity of 0.65 and discretion of 0.9.The paper says these values are close to careful consultation, so accuracy drives whether to consult.Source: §C.2 · p. 15

C.3 TRAINING DETAILS

Table 9 lists training settings for the two local models; the accompanying text specifies several settings and a Granite training stopping point.

C.3 TRAINING DETAILS

  • Granite training stopped after 120 of 200 scheduled steps once its privacy metrics had plateaued.Source: §C.3 · p. 16
  • For both local models, the training attacker, judge, and distiller are frozen Gemma 4 12B models.Source: §C.3 · p. 16
  • Table 9 lists training settings for both local models, including LoRA adapters and advantages computed without standard-deviation normalization.Source: §C.3 · p. 16, Table 9 · p. 16

D BASELINES AND ABLATIONS

The baselines vary consultation, memory, probing, and remote access. In test-time learning, a growing memory answers more drafts and reduces specialist messages and quasi-identifiers without a reported accuracy or anonymity cost.

D BASELINES AND ABLATIONS

  • Local-only variants omit consultation, delegation sends drafts directly to specialists, and Base Gemma uses the full protocol with empty memory.Source: D BASELINES AND ABLATIONS · p. 16
  • The no-probing variant avoids requests for personal information during training but may request one clinical fact; evaluation uses standard specialists and its accumulated memory.Source: D BASELINES AND ABLATIONS · p. 16
  • PAPILLON rewrites outgoing messages for a single remote consultant, while Remote only uses GPT-5.6-Luna as the doctor without consultation.Source: D BASELINES AND ABLATIONS · p. 16

E.1 TEST-TIME LEARNING DYNAMICS

  • Memory grows from empty to 1,062 lessons, while drafts answered from memory rise from 7% in the first 100 cases to 20.5% in the last quarter.Source: §E.1 · p. 17
  • With memory, messages fall to 5.98 rather than 7.02 per case and quasi-identifiers to 1.42 rather than 1.55, with no accuracy or anonymity cost.Figure 4 tracks the comparison over the test sequence; median matching registry patients are 3,548 with memory and 3,236 without.Source: Figure 4 · p. 17, §E.1 · p. 17

E.2 REWARD DESIGN

Reward ablations compare anonymity scored over linked visits with per-visit scoring, and compare the full reward with accuracy-only training. Linked scoring provides a weaker learning signal in this setup.

E.2 REWARD DESIGN

  • With the full reward, 6.6% of episodes send a personal detail and median k is 1,954; with accuracy alone, those figures are 40.1% and 20.Both runs reach similar training accuracy, 0.502 and 0.499, and consult in 97% of episodes over steps 129–148.Source: §E.2 · p. 17
  • 96% of patients are narrowed to ten or fewer registry patients with linked-anonymity reward, versus 61% with per-visit reward.The linked-reward policy sends 6.34 quasi-identifiers per visit against 3.36 under per-visit reward; Table 10 reports reward ablations.Source: §E.2 · p. 17, Table 10 · p. 18
  • Linked median k remains at 1 through step 120, leaving rollouts with nearly the same anonymity reward and a weak learning signal.The paper attributes this to linked k shrinking as visits are added and the untrained policy already narrowing most chains to one patient.Source: §E.2 · pp. 17–18
  • Per-visit k responds to changes in each visit and rises from 5 to 830 during training; PrivMeSA therefore trains per visit and evaluates linkage at test time.Source: §E.2 · p. 18

F PROMPTS

This section documents the prompts for PrivMeSA and the PAPILLON comparison pipeline, including consultation roles and responses, disclosure rules, reusable clinical lessons, and re-identification evaluation.

F.1 LOCAL DOCTOR

  • The local-doctor prompt enforces structured tool actions, task sequencing, and cautious ordering, including treating silent orders as unresolved rather than negative findings.It also specifies exact answer formats and limits order searches to up to 24 terms.Source: §F.1 · pp. 18–19
  • The local doctor consults one of three specialists for knowledge-dependent questions, but specialists see only the information sent, and the doctor makes the final decision against the record.The interpreter reads test results, the diagnostician predicts recorded diagnosis and procedure coding, and the clinician predicts disposition.Source: §F.1 · pp. 19–20
  • The PrivMeSA prompt prohibits sharing patient registration details and directs the local doctor to provide only clinically necessary, less identifying facts while accounting for disclosures across visits.It recommends age ranges instead of exact ages, verbal descriptions instead of numeric vital signs, and syndrome descriptions instead of verbatim triage lines.Source: §F.1 · p. 19
  • PrivMeSA sends each consult question to local memory first; only a second send reaches the specialist, after the question is reworded to disclose the clinically necessary minimum.The first, local query can be specific to retrieve lessons; apply a lesson only when it clearly fits, otherwise consult the remote expert.Source: §F.1 · p. 19

F.2 TASKS

  • Table 11 presents the task prompts shown to the agent and their required answer formats.The supplied passage identifies the table’s scope but does not provide its cell contents.Source: Table 11 · p. 21, §F.2 · p. 21

F.3 SPECIALISTS

  • Specialist prompts require brief, decision-focused responses, with focused requests for relevant facts and predictions of what the emergency department actually recorded rather than ideal care.For PrivMeSA’s no-probing variant, diagnostician and clinician prompts use a revised request-information instruction before recommendations.Source: §F.3 · pp. 21–22
  • The results interpreter explains what findings establish, rule out, and leave uncertain, while leaving disposition and coding to the physician unless asked.Its prompts allow a focused question about a likely recorded fact when that fact would change interpretation.Source: §F.3 · p. 21

F.4 MEMORY

  • The memory gate offers locally stored lessons or reports a miss; a clearly fitting lesson can guide the next action without remote consultation, while uncertain fits trigger a remote query.Reading memory sends nothing to the remote service, and memory does not take replies.Source: §F.4 · pp. 22–23
  • A stored lesson applies only when its clinical task, condition category, and patient picture match the current case closely enough not to change the recommendation.When no lesson clearly fits, the prompts direct the system to send nothing to the remote consultant or return an empty selection, with one prompt routing the case to a human expert.Source: §F.4 · p. 23
  • The lesson-building prompt asks for a self-contained, reusable expert rule that would help a similar future patient with the same task.It distinguishes reusable reasoning from advice tied to the particular patient's exact numbers.Source: §F.4 · p. 23
  • Reusable lessons retain transferable clinical rules while removing patient-specific values, and are limited to task, applicable situation, and actionable guidance.Lessons may preserve stated thresholds and criteria, but patient-record lookups, information requests without guidance, unsupported conclusions, and nonclinical formatting advice are not reusable clinical knowledge.Source: §F.4 · pp. 23–24

F.5 RE-IDENTIFICATION ATTACKER

  • The re-identification attacker receives every numbered outbound message from a visit and records only quasi-identifier values explicitly stated about that patient.The instructions leave unstated or inferred values null and specify conventions for age, triage vitals, and chief complaint.Source: §F.5 · p. 24

F.6 PAPILLON

  • PAPILLON’s prompt creator is instructed to abstract user queries into privacy-preserving prompts, including replies to a remote consultant’s requests for one fact.The creator is told to provide the prompt without commentary and uses a specified JSON format.Source: §F.6 · p. 24
  • PAPILLON’s information aggregator is instructed to answer user queries using the remote model’s example response, with output in a single-field JSON object.The released aggregator instruction calls for a detailed, engaging response.Source: §F.6 · p. 25
  • The PAPILLON remote consultant is prompted to give a decision-focused next step, request relevant patient-background details before recommending, and predict what the ED recorded for prediction tasks.For prediction, it is instructed to state the predicted answer first and base it on what distinguishes the patient rather than what is usual.Source: §F.6 · p. 25
Loading 2609.38458v1…