Membership inference vulnerability and the mitigating influence of regularization and differential privacy in dental radiograph classifiers

Introduction: Deep learning classifiers for dental panoramic radiographs are trained on patient images, and the privacy of that training data is rarely audited. Methods: ResNet-18 features were extracted from 182 annotated teeth in the openly licensed DENTEX dataset and used to train a four-class diagnostic classifier under four configurations (a baseline, L2 weight decay, dropout, and differentially private stochastic gradient descent). Membership inference was mounted with loss- and confidence-threshold attacks and scored with the area under the receiver operating characteristic curve across ten 70/30 train/test splits. Results: The baseline classifier was vulnerable, with a loss-based attack AUC of 0.648 (95% CI 0.62-0.68). L2 weight decay and dropout reduced the AUC only marginally, to 0.647 and 0.633, whereas differentially private training reduced it to 0.537 (95% CI 0.53-0.55) and brought the confidence-based attack to chance (0.499), while lowering test accuracy from 70.4% to 54.5%. Conclusions: Dental radiograph classifiers leak membership information; conventional regularization offers little protection, whereas differential privacy substantially reduces the risk at the cost of accuracy.