"I stripped the names, the dates, and the device IDs, and called the dataset anonymous. Then a graduate student matched two hundred of my subjects to their own heartbeats in an afternoon."
A Newly Cautious AI Agent
Prerequisites
This section assumes you can extract features and embeddings from a biosignal, the pipelines of Chapter 28 through Chapter 33, and that you understand subject-disjoint (leakage-safe) evaluation from Chapter 5 and Chapter 65. A working notion of a learned embedding and nearest-neighbor matching, from Chapter 17, is helpful. Privacy mechanisms (differential privacy, federated learning) are named here and developed in Chapter 64. Nothing here is legal advice; it is the threat modeling an engineer owes a health dataset before release.
The Big Picture
A physiological signal is not just a measurement of a body; it is a measurement of that body, and bodies differ in ways that are as stable and as distinctive as a fingerprint. The shape of your ECG QRS complex, the timing structure of your gait, the spectral signature of your resting EEG: each is a soft or hard biometric that survives the removal of names, dates, and account IDs. This means "de-identification" done the way tabular data teaches it, dropping the direct identifiers, does almost nothing to a raw waveform, because the waveform is the identifier. Worse, the models we train on these signals can memorize their subjects and leak them back out. This section builds the threat model, teaches you to measure re-identification risk instead of assuming it away, and separates the mitigations that work from the ones that only feel safe.
Every physiological signal is a fingerprint
The defining property of a biometric is that it is stable within a person and variable between people. A remarkable amount of physiological data has exactly this property, often as a nuisance side effect of the anatomy that produced it. Cardiac electrophysiology gives each heart a characteristic depolarization path, so ECG morphology (the relative amplitudes and timings of the P, QRS, and T deflections you met in Chapter 29) reliably distinguishes individuals and has been proposed as an authentication modality in its own right. Photoplethysmography carries a weaker but real version of the same fingerprint through pulse-wave shape. Gait, reconstructed from the wrist or hip IMU streams of Chapter 26, is distinctive enough to re-identify people across sessions and even across devices. Resting EEG has been marketed as a "brainprint." None of these were collected to identify anyone; the identity leaks out for free.
It helps to separate two intents that share the same machinery. A template biometric is a system built on purpose to recognize a person, storing a reference template and matching against it. Biometric leakage is the accidental, unintended presence of that same identifying signal inside data or a model you released for an entirely different purpose, say arrhythmia screening or sleep staging. The leakage is more dangerous precisely because nobody designed for it: there is no enrollment consent, no revocation path, and usually no awareness that the released artifact is a de facto identity database. And unlike a password, a heartbeat cannot be reset. Once a subject's biometric template is linkable to their identity, that link is permanent.
Key Insight
Removing direct identifiers protects tabular records because the identifying information lived in the columns you dropped. It barely protects a raw physiological waveform because the identifying information lives in the signal itself, which you are keeping. De-identification and privacy are not the same axis: a dataset can be perfectly de-identified (no names anywhere) and still be trivially re-identifiable (every record matchable to a person given one reference sample). Treat "we removed PII" as the start of the privacy analysis, never the end of it.
The threat model: three ways a subject leaks out
Concrete risk requires naming the adversary and what they can touch. Three attack surfaces recur for health-sensing systems, in rough order of how much access they assume.
Re-identification (linkage) attacks target released data. The adversary holds one or more reference samples of a target (recorded from a consumer wearable, a hospital visit, or a prior leak) and searches a "de-identified" dataset for the closest match. Because the waveform is a biometric, a nearest-neighbor search in a good feature space returns the right person far above chance. This is the linkage that turns an anonymized ECG corpus into a lookup table from heartbeat to person, and it needs no access to any model.
Membership inference targets a released model. The adversary asks only whether a specific person's data was in the training set, by exploiting the fact that models tend to be more confident (lower loss) on examples they memorized. For health data the membership fact alone can be the harm: if the training set is "patients with early Parkinson's," confirming membership discloses the diagnosis. This is the attack that most directly connects model behavior to a privacy breach, and it is why the leakage-safe splits of Chapter 65 matter for privacy and not only for honest accuracy numbers.
Model inversion and reconstruction is the strongest claim: recovering a representative input, an approximate waveform or template, from the model's parameters or outputs. It assumes more access and yields noisier results, but for embedding models trained with a metric objective it is a genuine risk, since the embedding is engineered to preserve exactly the person-discriminative structure an attacker wants. The through-line across all three: the more your representation preserves identity (great for re-identifiable longitudinal monitoring), the more it leaks.
Measure the risk, do not assume it
Privacy claims should be quantified with the same rigor as accuracy claims. The natural metric for a re-identification attack is the identification rate: given a gallery of enrolled subjects and a fresh probe recording, how often does the nearest gallery template belong to the true subject? Chance is \(1/N\) for \(N\) subjects, so any rate well above that is leakage. For a verification framing (is this probe the claimed person?), report the equal error rate (EER), the operating point where the false-accept and false-reject rates coincide; a low EER means the signal is a strong biometric and therefore a strong leak. Listing 34.4 runs the identification attack directly: it splits recordings by subject into an enrollment gallery and probe set, matches each probe to its nearest gallery embedding, and reports top-1 identification accuracy against the \(1/N\) chance baseline.
import numpy as np
from sklearn.metrics.pairwise import cosine_similarity
def reid_identification_rate(embeddings, subject_ids, seed=0):
"""Top-1 re-identification: split each subject's recordings into a
gallery half and a probe half, then match probes to nearest gallery
template. High accuracy vs 1/N chance == strong biometric leakage."""
rng = np.random.default_rng(seed)
subject_ids = np.asarray(subject_ids)
gal_idx, gal_lab, prb_idx, prb_lab = [], [], [], []
for s in np.unique(subject_ids):
rec = np.where(subject_ids == s)[0]
if len(rec) < 2:
continue # need >=1 to enroll and >=1 to probe
rng.shuffle(rec)
half = len(rec) // 2
gal_idx += list(rec[:half]); gal_lab += [s] * half
prb_idx += list(rec[half:]); prb_lab += [s] * (len(rec) - half)
G, P = embeddings[gal_idx], embeddings[prb_idx]
nearest = cosine_similarity(P, G).argmax(axis=1) # closest template
pred = np.asarray(gal_lab)[nearest]
top1 = (pred == np.asarray(prb_lab)).mean()
chance = 1.0 / len(np.unique(gal_lab))
return top1, chance
# embeddings: (n_recordings, d) from any biosignal encoder (Ch 17);
# subject_ids: which person each recording came from.
acc, chance = reid_identification_rate(embeddings, subject_ids)
print(f"top-1 re-id = {acc:.2%} (chance = {chance:.2%})")
# A benign feature space sits near chance; a leaky one lands near 1.0.Run this audit on your own embeddings and you often get an uncomfortable surprise: a model trained only to stage sleep or flag arrhythmia scores far above chance on identity, because the features that predict a cardiac condition overlap with the features that individuate a heart. That number is your leakage budget, made concrete. Reporting it turns "is this private?" from a vibe into an experiment, exactly the move Chapter 5 made for accuracy.
In Practice: the gait re-identification of a "de-identified" wearable cohort
A digital-health team releases six months of wrist-IMU data from a movement-disorder study to accelerate research, having scrubbed names, MRNs, and exact timestamps. A collaborator, meaning no harm, wants to check re-identifiability first. She trains a small gait encoder on an unrelated public dataset, embeds every recording in the released cohort, and runs the audit in Listing 34.4 using each participant's first month as the gallery and a later month as the probe. Top-1 re-identification comes back near 80 percent against a chance line under 1 percent: the walking signature is stable across months and dominant in the embedding. The implication lands hard. Anyone holding a single reference walk of a participant (from a phone, a smartwatch, a clinic hallway) can pick that person out of the "anonymous" release, and because the study cohort is the diagnosis, the match discloses a medical condition. The fix was not more scrubbing; it was to stop releasing per-recording waveforms and instead share subject-level aggregates plus a synthetic, differentially private twin of the dataset, discussed next and in Chapter 64.
Mitigations that work, and ones that only feel safe
The ineffective moves are the tempting ones: dropping identifier columns, coarsening timestamps, or renaming subjects to random hashes. None touch the waveform, so none reduce the re-identification rate you just measured. Perceptual masking (clipping a few samples, mild filtering) is similarly cosmetic against a learned matcher. What actually moves the number falls into a few families. Do not release raw waveforms when you can release task-sufficient aggregates or features with the identity structure removed; a per-night sleep summary leaks far less than the raw EEG. Add calibrated noise under a formal guarantee: differential privacy, applied to a released statistic or to model training (DP-SGD), bounds how much any single subject can change the output, and unlike ad hoc noise it comes with a provable \(\varepsilon\) budget. Keep the raw data on the device: federated learning trains without centralizing the waveforms, shrinking the attack surface, though it does not by itself stop membership inference (combine it with DP). Represent, then defend the representation: adversarial or disentangling objectives can suppress subject identity in an embedding while preserving the clinical target, which you validate by rerunning Listing 34.4 and confirming the re-identification rate has dropped toward chance while task accuracy holds.
The Right Tool
Training a model with a differential-privacy guarantee from scratch means clipping every per-sample gradient, injecting calibrated Gaussian noise, and tracking the cumulative privacy budget across steps with a moments or Renyi accountant: on the order of 150 lines to get right and easy to get subtly wrong (a mis-set clip norm silently voids the guarantee). Opacus wraps an existing PyTorch training loop instead:
from opacus import PrivacyEngine
privacy_engine = PrivacyEngine()
model, optimizer, loader = privacy_engine.make_private_with_epsilon(
module=model, optimizer=optimizer, data_loader=loader,
epochs=EPOCHS, target_epsilon=8.0, target_delta=1e-5,
max_grad_norm=1.0) # per-sample clip, noise, accountant handled
# ...train as usual; the (epsilon, delta) budget is enforced and tracked.Exercise
Take any biosignal encoder you trained in Part VII (ECG, PPG, or gait) that was not built for identification. Run the audit in Listing 34.4 on a subject-labeled holdout and record the top-1 re-identification rate versus the \(1/N\) chance line. Then apply one mitigation, either release subject-level aggregates instead of per-recording embeddings, or retrain the encoder with an adversarial subject-suppression head, and rerun the audit. Report the change in re-identification rate and the change in your clinical task metric on the same split, so the privacy gain and the utility cost are co-computed in one pass.
Self-Check
1. Why does deleting names, dates, and device IDs reduce re-identification risk for a spreadsheet of lab values but almost not at all for a folder of raw ECG waveforms?
2. Distinguish a re-identification (linkage) attack from a membership-inference attack: what does the adversary have access to in each, and why can membership alone be a harm?
3. You measure a top-1 re-identification rate of 70 percent on your "anonymized" gait release against a 0.5 percent chance line. Name two mitigations that would move this number and one common "de-identification" step that would not.
What's Next
In Section 34.5, we move from the technical fact of leakage to the framework that governs it: informed consent that anticipates biometric re-use, data-governance structures that decide who may hold and link these signals, and the de-identification standards (and their documented limits) that separate a defensible release from a breach waiting to happen.