A Germany-UK research collaboration has found that anonymized patient records sitting in medical datasets for years or decades can teach AI models to recognize the same real people when they return for care, shifting predictions toward their old health state and, in some cases, toward a missed diagnosis.
The paper, titled "Memorisation bias in medical AI," tested the effect across four large medical datasets and evaluated differential privacy as a safeguard. It concludes that a patient whose data entered a training set in 2012 may be treated by a model in 2026 as though they were still that earlier person, with their current condition partly obscured by a record the model has effectively memorized.
The finding lands as Germany's national breast cancer screening program runs an AI model trained on 1.2 million mammograms sourced from the same screening population it now serves. Comparable deployment is underway in national breast cancer screening programmes in the United Kingdom and Sweden, both partners in the collaboration alongside Germany.
A 15% Chance Where There Should Be 73%
The paper's central illustration is stark. A model trained on a patient's earlier healthy ECGs assigns a 15% probability to her later heart attack. A model that never saw her historical records assigns 73%. Same patient, same event, a 58-point gap created entirely by the model's memory of who she used to be.
The authors describe the mechanism directly. When models are deployed prospectively, memorisation creates a specific and under-appreciated risk because a patient's records are highly self-similar over time. A future record can act as a partial cue for the memorised historical record, shifting predictions toward the previous health state.
The paper states this is not hypothetical. Medical AI models are routinely deployed on the same population from which their training data was sourced.
The consequences run in both directions. A patient recorded as undergoing cancer treatment 20 years ago and in long-term remission could be treated by AI in the context of that older, cancer-afflicted self, logically increasing the chances of a false diagnosis of recurrence. Conversely, if the 2012 version of a patient's data reflected perfect health, an optimistic standpoint could potentially be imposed onto the older current patient, masking the detection of new conditions.
Four Datasets, Changes Above 70 Points
The researchers tested the effect across MIMIC-CXR, a chest X-ray database; MIMIC-IV-ED, an emergency care records database; MIMIC-ECG; and HEEDB, a much larger collection of ECGs. Dataset sizes ranged from tens of thousands of patients to more than 1.8 million people.
The calculated effect varied considerably. In some cases, changes in predicted probability exceeded 70 percentage points.
As a control, the researchers randomly divided models into groups and repeated the comparison. That produced no significant changes in future predictions, strengthening the case that memorization, not some other artifact, drove the results.
The effect may persist for decades. It generally became weaker and less common as the interval between records increased, but it did not vanish. The HEEDB dataset, which contains ECGs collected from the 1980s to 2025, showed significant changes in predictions more than 25 years after a patient's most recent training record.
The researchers then simulated how memorization could affect diagnostic accuracy when patients later encounter a model trained on their earlier records. Future cases were divided according to whether the patient had developed a new condition absent from the historical training data, or had returned with essentially the same health state.
For new conditions, the effect was consistently negative. Models that had seen a patient's historical records exhibited lower sensitivity across a range of diagnoses in all four datasets, including infarcts and other ECG abnormalities, lung conditions, and wider critical outcomes. The models produced more false negatives precisely when a patient's health had changed.
When a patient's health had not changed, the picture reversed. The model's memory of earlier records made it more likely to produce a correct diagnosis, with both sensitivity and specificity increasing because the current condition resembled a condition already present in the training data.
The authors note this could make systems difficult to assess accurately. If most returning patients still have the same conditions, the model performs better on them, potentially hiding lower sensitivity to the patients who developed something new.
Stay ahead of the AI curve
The most important updates, news, and content — delivered weekly.
No spam. Unsubscribe anytime.
Where the Data Comes From
National and regional directives recommend that patient data for medical AI should ideally be taken from the country where the systems derived from it are intended to be used. The EU AI Act's Article 10(4) requires training data to reflect the geographical and contextual setting of intended use. Similar international guidelines for medical AI development call for the intended patient population to be sufficiently represented in a model's training dataset.
That localization has a cost. Limiting data to only a national dataset increases the chance of memorization, because the model sees the same data many times during training and becomes fixated on over-learned patterns. A larger and more diverse dataset is more likely to generalize to unseen data instead of memorizing specific data-points. But adding foreign medical data risks introducing national health trends and idiosyncrasies that do not apply in the deployment country.
The paper concedes that a certain amount of memorization is appropriate and useful. It helps a model work within the likeliest general medical characteristics of a particular population.
The paper does not address the matter of patients who do not regularly attend check-ups. The article's analysis infers that it is statistically logical for such patients to show up in anonymized data almost exclusively at times when they needed treatment, increasing the chance of projecting a long-cured condition onto the same patient now, because there is no good-health counterbalance in the record.
Prior research into "informed presence bias" in electronic health records supports that reading. Medical datasets disproportionately represent periods when patients are sick and interacting with healthcare services. One study found severely ill patients had 5.05 times as many days with laboratory data and 6.85 times as many days with medication orders as the healthiest patients.
Regular attendance is far from universal. In 2022, around 76% of US adults reported having a routine check-up within the previous year, defined by the CDC as a general physical examination rather than treatment for a specific condition. In Europe, a 2023 multi-country survey found 58% attended at least some preventive check-ups, while only 15% attended all the preventive appointments considered relevant to them.
Privacy Protection Helps, but Does Not Finish the Job
The researchers tested differential privacy during training as a possible safeguard. The technique limits how much information about any individual training example can be retained by the model.
It reduced the memorization effect but did not eliminate it, even at the strongest setting tested. Applying the protection at patient level, covering all records belonging to the same person, was much more effective and almost eliminated the effect.
That route is not always open. If a dataset has been irretrievably anonymized, a patient's data cannot be ring-fenced in a way that allows such methods. And the trade-offs cut both ways. If a dataset was not trained with differential privacy enabled, membership inference attacks become a risk. If it was, the resources necessary for training increase notably.
The Authors Expect the Problem to Grow
The authors close by observing that concerning incidents currently occur at a relatively low rate, but that this may change. They state there is reason to expect the number of missed diagnoses attributable to memorisation bias to increase in future, although this was not tested directly.
The link runs through model capacity. Prior research shows the proportion of training data a model memorises increases with model capacity. Current AI model development is guided by scaling laws, driving rapid growth in both model and dataset sizes in pursuit of improved performance.
The paper states that as larger AI models are trained on historical data from ever-larger patient populations, the absolute number of individuals affected by memorisation bias is likely to rise drastically, exacerbating the risks identified.
The research was published in a paper titled "Memorisation bias in medical AI," produced by a collaboration between Germany and the UK. The findings were reported by Unite.AI, in an article by Martin Anderson, a writer on machine learning and a domain specialist in human image synthesis who served as head of research content at Metaphysic.ai until its dissolution into DNEG's Brahma.ai.