The pretraining domain outweighs the training objective in setting the privacy-utility trade-off of differentially private medical image analysis

Abstract

Differential privacy protects the patients whose images train medical imaging models, but it lowers diagnostic accuracy, and the initialization is the strongest known remedy. Practice increasingly favors large generic self-supervised encoders. Yet the pretraining objective and the pretraining domain are confounded in existing comparisons, so which one preserves utility under privacy is unknown, and the pretraining corpus is treated as public even when it holds patient images. We trained ConvNeXt classifiers with differentially private stochastic gradient descent from five initializations that vary the objective and the domain independently, at four privacy budgets and without privacy, and evaluated them locally on more than 590,000 chest radiographs from five external datasets in four countries. Supervised pretraining on chest radiographs ranked first in 24 of 25 dataset and budget combinations. Its lead over ImageNet grew from 2.5 to 14.6 points of macro-averaged area under the receiver operating characteristic curve as the budget tightened, and the domain effect exceeded the objective effect by a factor of 2.2 to 3.4. Pretraining that corpus privately cost about 5 points and, under privacy, still beat every public initialization. Low-rank adaptation removed about half the residual gap, and in-domain pretraining raised the worst-performing demographic subgroup. Under privacy, what a model was pretrained on outweighs how it was pretrained.

^∗Correspondence to: Soroosh Tayebi Arasteh ()

Introduction

Deep learning models for medical imaging improve with the size and diversity of the data behind them, yet the images that make them useful are among the most sensitive records a patient generates [18]. Trained networks can memorize their training data, and reconstruction attacks can recover recognizable images from gradients or weights [5]. Differential privacy answers this with a formal bound on how much any single patient can influence a model [10], realized for deep networks by differentially private stochastic gradient descent (DP-SGD), which clips per-sample gradients and adds calibrated noise [1]. The approach is established in medical imaging [47, 38], but the protection is not free. A recent synthesis of 74 studies found that models stay clinically usable at moderate budgets near $\epsilon=10$, while strict budgets near $\epsilon=1$ commonly cost substantial accuracy, with the sharpest losses in small and heterogeneous cohorts [30]. Reconciling that trade-off remains the central obstacle to deploying private medical artificial intelligence (AI) [46].

Among the available remedies, the initialization is the most powerful. Beginning private training from pretrained weights instead of from scratch recovers much of the lost accuracy, an effect documented on natural images [8, 23], in language [24], and in radiography [36]. Two lines of work suggest where better initializations might come from. Self-supervised pretraining produces representations that transfer more broadly and degrade more gracefully than supervised ones [7, 32, 14], has proven useful in medical imaging [22, 27], and has shown early promise under privacy [2], with recent DINOv3 models extending it to convolutional backbones at scale [35]. Separately, pretraining on the target modality is long-standing practice in chest radiography, although its benefit over generic pretraining is contested without privacy [19, 20]. Whether the objective or the domain drives performance under privacy has not been established, because the two are confounded in almost every published comparison: a domain-specific model is typically also a supervised one, and a self-supervised model is typically also a generic one.

Here we separate them. Using a fixed ConvNeXt backbone [25] and a common DP-SGD pipeline, we compare five initializations that vary the objective and the domain independently: random initialization, supervised ImageNet pretraining [9], self-supervised DINOv3 pretraining on natural images [35], and supervised pretraining on chest radiographs from MIMIC-CXR [17], carried out once conventionally and once under DP-SGD (Fig. 1). The last of these addresses a second problem. Private fine-tuning conventionally treats the pretraining corpus as public, an assumption that is hard to defend when that corpus is itself patient data [40]. Pretraining privately makes the guarantee hold end to end. Every initialization is evaluated at four privacy budgets and without privacy, on more than 590,000 radiographs from five external datasets spanning four countries and both routine and intensive care [31, 16, 42, 6, 20], and further across three fine-tuning schemes including low-rank adaptation [15], two model capacities, leave-one-dataset-out generalization to unseen institutions, and performance within demographic subgroups, where privacy is known to fall unevenly [4]. To our knowledge, this is the first study to disentangle the pretraining objective from the pretraining domain under differential privacy at this scale, and the first to measure what protecting the pretraining corpus costs downstream.

The work proceeds from a simple expectation: noise added to every gradient should penalize a model in proportion to how much it still has to learn, so an initialization that already encodes the target modality ought to lose the least. What follows tests that expectation and traces its consequences for diagnostic accuracy, for the privacy a model actually expends before it converges, for transfer to institutions never seen in training, and for the patients a model serves least well. The findings bear on how medical foundation models should be built and released if they are to be useful where privacy is mandatory, and they indicate that curating and sharing domain-matched pretraining corpora may be a more effective route to private medical AI than pursuing ever larger generic ones.

Figure 1: Study overview. a, Five initializations spanning a range of prior knowledge were compared: random (He) initialization trained from scratch; supervised ImageNet and self-supervised DINOv3 pretraining on natural images; and supervised pretraining on chest radiographs from MIMIC-CXR, without and with differential privacy, giving the in-domain standard (InDomain-stand) and in-domain private (InDomain-priv) initializations. The inset shows how the pretrained initializations map onto the training objective (supervised or self-supervised) crossed with the pretraining domain (natural images or chest radiographs); no public self-supervised chest radiograph model was available for the fourth combination. b, Each initialization was fine-tuned using a ConvNeXt backbone (Small, 49.5 million parameters, or Tiny, 27.8 million) with a linear head over five findings, trained with differentially private stochastic gradient descent (DP-SGD), which clips each per-sample gradient and adds Gaussian noise, at four privacy budgets $\epsilon$ and a non-private reference, and under three fine-tuning schemes (full, head-only, and low-rank adaptation, LoRA). c, Models were evaluated on five external chest radiograph datasets from different countries, totaling 591,884 radiographs; MIMIC-CXR (215,187 frontal radiographs) was used for pretraining only. d, Five aspects were evaluated: diagnostic utility, demographic fairness across sex and age, generalization to unseen institutions by leave-one-dataset-out evaluation, the effect of model capacity, and parameter-efficient fine-tuning. The figure shows the study design only and contains no results. DP-SGD, differentially private stochastic gradient descent; $\epsilon$, privacy budget; InDomain-stand, supervised pretraining on MIMIC-CXR; InDomain-priv, differentially private pretraining on MIMIC-CXR; LoRA, low-rank adaptation.

Results

Unless noted otherwise, every performance metric in this section is a percentage, reported as the bootstrap mean followed by its standard deviation and its 95% confidence interval (CI) in brackets, in the form mean $\pm$ std [lower, upper]; the percent sign is dropped in the text. Metrics are macro-averaged over the five shared radiographic findings (atelectasis, cardiomegaly, pleural effusion, pneumonia, and no finding), and the macro-averaged area under the receiver operating characteristic curve is written as macro AUROC. Uncertainty is estimated with a nonparametric bootstrap of 10,000 resamples drawn at the resampling unit, which is the patient for CheXpert and ChestX-ray14 and the image for VinDr-CXR, PadChest, and UKA-CXR. Differences between initializations are assessed on macro AUROC with a two-sided paired bootstrap; its $p$-value is reported to three decimals, and because the test uses 10,000 resamples we write $p<0.0001$ for values below its resolution. Throughout, differences are read by their magnitude and confidence intervals; $p$-values indicate statistical reliability and are not evidence of clinical importance for small effects. Private runs were trained at four target budget levels of the privacy budget $\epsilon$ of Eq. 2, written throughout as $0<\epsilon<1$, $1<\epsilon<3$, $3<\epsilon<6$, and $6<\epsilon<9$, alongside a non-private reference. These labels name the target level and its cap, not the budget each run actually spent. Training stops at the best validation epoch, so a run that converges early spends less than its cap allows. Achieved values ranged from 0.16 to 1.00, 0.65 to 3.01, 2.48 to 6.01, and 3.16 to 9.03 across the four levels, and 5 of the 100 private runs, all of them from in-domain initializations, converged below the lower edge of their label. Initializations are therefore compared at a common target level, and the achieved $\epsilon$ of every run is listed in Supplementary Table 1, with the optimization steps behind it in Supplementary Table 2.

In-domain pretraining sets the privacy-utility frontier

Matching the pretraining domain to the target modality was the single strongest predictor of accuracy under privacy. Fine-tuning a ConvNeXt-Small classifier from five initializations, at four privacy budgets and without privacy, on five external chest radiograph datasets, InDomain-stand reached the highest macro AUROC in 24 of the 25 dataset and budget combinations (Table 1, Fig. 2a–e). The one exception was UKA-CXR without privacy, where InDomain-stand and DINOv3 were indistinguishable (88.8 for both, $p=0.483$).

The size of that lead depended on how much privacy was enforced. Without privacy the five initializations were closely spaced, and InDomain-stand led ImageNet by 2.5 and DINOv3 by 1.4 on average across the datasets. Tightening the budget to $0<\epsilon<1$ pulled them apart: the same margins widened to 14.6 over ImageNet and 8.6 over DINOv3, and to 25.0 over training from scratch (Fig. 2f). Privacy therefore does not act uniformly on the initializations. It penalizes the weaker ones far more, and converts a small non-private advantage into a decisive one.

At the strictest budget the ordering was stable and unambiguous. InDomain-stand averaged 82.0 across the five datasets and ranked first in every one, from 73.7 $\pm$ 0.5 [72.7, 74.7] on ChestX-ray14 to 90.8 $\pm$ 0.5 [89.7, 91.8] on VinDr-CXR, and its nearest competitor in each dataset was the privately pretrained in-domain initialization (Fig. 2i). All 60 paired bootstrap comparisons of InDomain-stand against He, ImageNet, and DINOv3 under privacy favored InDomain-stand at $p<0.0001$ (Fig. 2h).

The same pattern appears as robustness to the privacy mechanism itself. Moving from the non-private setting to $0<\epsilon<1$ cost InDomain-stand only 5.3 points of macro AUROC on average, against 8.0 for InDomain-priv, 12.5 for DINOv3, 17.3 for ImageNet, and 20.8 for training from scratch (Fig. 2g). A representation already tuned to chest radiographs absorbs the noise and gradient clipping of private training with comparatively little loss, whereas an initialization that must still learn the modality from noisy updates loses most of its accuracy.

The ranking did not depend on the choice of metric. At the strictest budget InDomain-stand led on seven of the eight evaluation metrics, including the area under the precision-recall curve (AUPRC), mean average precision (mAP), accuracy, sensitivity, specificity, and the Brier score (Table 2, with per-dataset values in Supplementary Table LABEL:stab:permetric). The exception was expected calibration error (ECE, Eq. 5), which favored ImageNet, so the in-domain advantage in discrimination did not carry over to calibration. The ordering was equally stable across findings: InDomain-stand ranked first in all 25 combinations of finding and dataset at $0<\epsilon<1$ (Supplementary Table 4).

Table 1: Diagnostic utility of five initializations across five external datasets and five privacy settings. Values are macro AUROC in percent, macro-averaged over the five findings, reported as the bootstrap mean $\pm$ standard deviation with the 95% CI in brackets. Rows are grouped by privacy setting, from the strictest budget to the non-private reference, and within each group the initializations are ordered by increasing prior knowledge. Test sets comprise 3,000 (VinDr-CXR), 29,321 (CheXpert), 25,596 (ChestX-ray14), 22,045 (PadChest), and 40,106 (UKA-CXR) radiographs. AUROC, area under the receiver operating characteristic curve; CI, confidence interval; $\epsilon$, privacy budget; He, He (Kaiming) initialization; InDomain-stand, supervised pretraining on MIMIC-CXR; InDomain-priv, differentially private pretraining on MIMIC-CXR.

Initialization	VinDr-CXR	CheXpert	ChestX-ray14	PadChest	UKA-CXR
$0<\epsilon<1$
He	48.3 $\pm$ 1.0 [46.3, 50.2]	58.4 $\pm$ 0.3 [57.7, 59.0]	51.0 $\pm$ 0.4 [50.2, 51.8]	61.3 $\pm$ 0.3 [60.6, 61.9]	66.1 $\pm$ 0.2 [65.7, 66.5]
ImageNet	63.1 $\pm$ 1.1 [61.0, 65.3]	66.7 $\pm$ 0.3 [66.0, 67.3]	59.2 $\pm$ 0.6 [58.0, 60.3]	74.9 $\pm$ 0.3 [74.3, 75.4]	73.2 $\pm$ 0.2 [72.9, 73.6]
DINOv3	79.3 $\pm$ 1.1 [77.0, 81.4]	68.4 $\pm$ 0.3 [67.9, 69.0]	63.7 $\pm$ 0.5 [62.6, 64.8]	75.7 $\pm$ 0.3 [75.1, 76.2]	79.9 $\pm$ 0.2 [79.6, 80.2]
InDomain-stand	90.8 $\pm$ 0.5 [89.7, 91.8]	77.3 $\pm$ 0.3 [76.7, 77.8]	73.7 $\pm$ 0.5 [72.7, 74.7]	84.6 $\pm$ 0.2 [84.1, 85.1]	83.5 $\pm$ 0.1 [83.3, 83.8]
InDomain-priv	85.9 $\pm$ 0.9 [84.1, 87.5]	71.7 $\pm$ 0.3 [71.1, 72.3]	67.9 $\pm$ 0.5 [66.9, 69.0]	78.7 $\pm$ 0.3 [78.2, 79.2]	81.0 $\pm$ 0.2 [80.7, 81.3]
$1<\epsilon<3$
He	49.3 $\pm$ 1.0 [47.4, 51.3]	60.9 $\pm$ 0.3 [60.2, 61.5]	52.6 $\pm$ 0.4 [51.8, 53.4]	65.3 $\pm$ 0.3 [64.7, 66.0]	69.2 $\pm$ 0.2 [68.8, 69.6]
ImageNet	73.4 $\pm$ 1.1 [71.2, 75.6]	67.5 $\pm$ 0.3 [66.9, 68.1]	60.3 $\pm$ 0.6 [59.1, 61.5]	76.2 $\pm$ 0.3 [75.6, 76.7]	75.7 $\pm$ 0.2 [75.3, 76.0]
DINOv3	80.9 $\pm$ 1.0 [78.9, 82.8]	69.7 $\pm$ 0.3 [69.1, 70.2]	64.3 $\pm$ 0.5 [63.2, 65.3]	76.6 $\pm$ 0.3 [76.0, 77.1]	81.5 $\pm$ 0.1 [81.2, 81.8]
InDomain-stand	90.7 $\pm$ 0.6 [89.6, 91.8]	77.4 $\pm$ 0.3 [76.9, 78.0]	74.2 $\pm$ 0.5 [73.3, 75.2]	84.8 $\pm$ 0.2 [84.4, 85.3]	84.5 $\pm$ 0.1 [84.2, 84.7]
InDomain-priv	86.1 $\pm$ 0.9 [84.3, 87.8]	71.4 $\pm$ 0.3 [70.8, 72.0]	68.3 $\pm$ 0.5 [67.2, 69.3]	78.8 $\pm$ 0.3 [78.3, 79.3]	81.9 $\pm$ 0.1 [81.6, 82.2]
$3<\epsilon<6$
He	50.5 $\pm$ 1.0 [48.6, 52.5]	62.7 $\pm$ 0.3 [62.0, 63.3]	54.8 $\pm$ 0.5 [53.8, 55.7]	68.3 $\pm$ 0.3 [67.7, 69.0]	71.5 $\pm$ 0.2 [71.1, 71.9]
ImageNet	77.0 $\pm$ 1.1 [74.9, 79.1]	68.0 $\pm$ 0.3 [67.4, 68.6]	61.0 $\pm$ 0.6 [59.8, 62.2]	77.0 $\pm$ 0.3 [76.5, 77.5]	77.9 $\pm$ 0.2 [77.6, 78.2]
DINOv3	81.4 $\pm$ 1.0 [79.5, 83.2]	70.4 $\pm$ 0.3 [69.8, 70.9]	64.8 $\pm$ 0.5 [63.7, 65.9]	77.1 $\pm$ 0.3 [76.6, 77.6]	82.9 $\pm$ 0.1 [82.6, 83.2]
InDomain-stand	91.1 $\pm$ 0.7 [89.7, 92.5]	77.5 $\pm$ 0.3 [76.9, 78.0]	74.7 $\pm$ 0.5 [73.8, 75.6]	85.4 $\pm$ 0.2 [84.9, 85.9]	85.0 $\pm$ 0.1 [84.7, 85.2]
InDomain-priv	86.1 $\pm$ 0.9 [84.3, 87.8]	71.2 $\pm$ 0.3 [70.6, 71.8]	69.1 $\pm$ 0.5 [68.1, 70.1]	79.2 $\pm$ 0.3 [78.7, 79.7]	82.7 $\pm$ 0.1 [82.4, 83.0]
$6<\epsilon<9$
He	51.4 $\pm$ 1.0 [49.3, 53.5]	63.6 $\pm$ 0.3 [63.0, 64.2]	56.5 $\pm$ 0.5 [55.5, 57.5]	69.1 $\pm$ 0.3 [68.5, 69.7]	72.1 $\pm$ 0.2 [71.7, 72.4]
ImageNet	77.3 $\pm$ 1.0 [75.2, 79.3]	68.3 $\pm$ 0.3 [67.7, 68.9]	61.3 $\pm$ 0.6 [60.1, 62.5]	77.2 $\pm$ 0.3 [76.7, 77.8]	78.9 $\pm$ 0.2 [78.6, 79.2]
DINOv3	82.2 $\pm$ 1.0 [80.2, 84.0]	71.1 $\pm$ 0.3 [70.5, 71.7]	64.8 $\pm$ 0.5 [63.7, 65.9]	77.7 $\pm$ 0.3 [77.2, 78.2]	83.2 $\pm$ 0.1 [82.9, 83.4]
InDomain-stand	91.3 $\pm$ 0.7 [89.9, 92.6]	77.5 $\pm$ 0.3 [76.9, 78.0]	74.7 $\pm$ 0.5 [73.8, 75.6]	85.6 $\pm$ 0.2 [85.2, 86.1]	85.3 $\pm$ 0.1 [85.0, 85.5]
InDomain-priv	86.0 $\pm$ 0.9 [84.3, 87.7]	71.1 $\pm$ 0.3 [70.5, 71.7]	69.2 $\pm$ 0.5 [68.3, 70.2]	79.3 $\pm$ 0.3 [78.8, 79.8]	82.9 $\pm$ 0.1 [82.6, 83.1]
Non-private
He	78.4 $\pm$ 1.2 [76.1, 80.7]	75.3 $\pm$ 0.3 [74.7, 75.8]	69.9 $\pm$ 0.5 [68.9, 70.9]	81.6 $\pm$ 0.3 [81.1, 82.1]	84.0 $\pm$ 0.1 [83.8, 84.3]
ImageNet	89.9 $\pm$ 0.7 [88.5, 91.1]	81.1 $\pm$ 0.3 [80.6, 81.6]	76.1 $\pm$ 0.4 [75.3, 76.9]	88.2 $\pm$ 0.2 [87.8, 88.6]	88.3 $\pm$ 0.1 [88.0, 88.5]
DINOv3	91.9 $\pm$ 0.6 [90.8, 93.0]	82.1 $\pm$ 0.2 [81.6, 82.6]	77.4 $\pm$ 0.4 [76.6, 78.2]	89.2 $\pm$ 0.2 [88.8, 89.6]	88.8 $\pm$ 0.1 [88.6, 89.0]
InDomain-stand	95.8 $\pm$ 0.4 [95.0, 96.5]	82.7 $\pm$ 0.2 [82.3, 83.2]	79.4 $\pm$ 0.4 [78.6, 80.1]	89.6 $\pm$ 0.2 [89.2, 90.0]	88.8 $\pm$ 0.1 [88.5, 89.0]
InDomain-priv	90.8 $\pm$ 0.6 [89.6, 91.9]	81.4 $\pm$ 0.2 [80.9, 81.9]	76.2 $\pm$ 0.5 [75.3, 77.1]	88.4 $\pm$ 0.2 [88.0, 88.8]	88.4 $\pm$ 0.1 [88.2, 88.6]

Figure 2: Diagnostic utility across the privacy-utility frontier for five initializations. Colors denote the five initializations (legend, top). a–e, Macro AUROC against the privacy budget actually spent for each external test set (a, VinDr-CXR; b, CheXpert; c, ChestX-ray14; d, PadChest; e, UKA-CXR; test set sizes are given in Table 1). Each marker sits at that run’s own achieved $\epsilon$, error bars are 95% CIs, and every panel uses its own vertical scale. Solid lines join the private budgets and the dashed segment reaches the non-private reference at $\infty$, with the axis broken (marked by …). Because each run stops at its best validation epoch, a marker can lie outside the range named by its target; the budget every run spent is given in Supplementary Table 1. f, Difference ($\Delta$) in macro AUROC between InDomain-stand and each other initialization in points, averaged over the five datasets, against the mean achieved $\epsilon$ of each target level; the dashed line marks equality. g, Drop in macro AUROC from the non-private setting to the tightest budget, averaged over the five datasets. h, Difference in macro AUROC between InDomain-stand and each other initialization at the tightest budget in every dataset; asterisks mark comparisons significant at the 0.05 level by a two-sided paired bootstrap on macro AUROC with 10,000 resamples and no multiplicity correction. i, Distribution across the five datasets of each initialization’s macro AUROC at the tightest budget; boxes show the median and interquartile range and points show the five datasets. AUROC, area under the receiver operating characteristic curve; CI, confidence interval; $\Delta$, difference; $\epsilon$, privacy budget; InDomain-stand, supervised pretraining on MIMIC-CXR; InDomain-priv, differentially private pretraining on MIMIC-CXR.

Table 2: Diagnostic performance of five initializations across eight evaluation metrics. Each entry is the mean over the five external datasets of the macro-averaged metric in percent, with the standard deviation across those datasets in parentheses; the five test sets are those of Table 1. Higher is better for all metrics except the Brier score and ECE, for which lower is better. Rows are grouped by privacy setting and ordered by metric, and columns are ordered by increasing prior knowledge. Per-dataset values with bootstrap confidence intervals are given in Supplementary Table LABEL:stab:permetric. AUPRC, area under the precision-recall curve; AUROC, area under the receiver operating characteristic curve; ECE, expected calibration error; $\epsilon$, privacy budget; InDomain-stand, supervised pretraining on MIMIC-CXR; InDomain-priv, differentially private pretraining on MIMIC-CXR; mAP, mean average precision.

Metric	He	ImageNet	DINOv3	InDomain-stand	InDomain-priv
$0<\epsilon<1$
AUROC	57.0 (7.3)	67.4 (6.6)	73.4 (7.1)	82.0 (6.7)	77.0 (7.2)
AUPRC	21.9 (8.6)	27.9 (9.2)	35.1 (11.1)	48.6 (13.2)	41.2 (12.8)
mAP	22.0 (8.6)	28.0 (9.1)	35.3 (11.2)	48.8 (13.4)	41.4 (13.0)
Accuracy	53.0 (10.5)	57.5 (11.9)	65.2 (14.7)	73.0 (10.3)	65.9 (14.6)
Sensitivity	58.4 (11.1)	69.6 (5.6)	72.3 (9.2)	77.9 (5.0)	76.2 (4.4)
Specificity	53.1 (11.7)	57.4 (12.2)	64.7 (15.1)	72.3 (9.3)	65.2 (14.8)
Brier score	13.7 (3.7)	11.5 (3.0)	11.4 (3.1)	10.3 (3.1)	11.1 (3.2)
ECE	10.6 (3.4)	6.7 (2.6)	8.5 (2.8)	8.8 (2.2)	8.8 (2.2)
Non-private
AUROC	77.8 (5.5)	84.7 (5.9)	85.9 (6.0)	87.3 (6.4)	85.0 (6.1)
AUPRC	39.9 (12.6)	51.3 (13.2)	54.2 (13.4)	57.0 (14.3)	52.5 (13.5)
mAP	40.1 (12.6)	51.5 (13.3)	54.4 (13.5)	57.3 (14.5)	52.7 (13.6)
Accuracy	68.8 (9.1)	74.5 (9.0)	76.9 (9.0)	77.3 (10.4)	75.8 (10.3)
Sensitivity	74.3 (3.6)	81.2 (3.9)	80.9 (4.7)	82.6 (6.1)	80.2 (4.2)
Specificity	68.0 (9.1)	73.8 (8.4)	76.6 (8.4)	77.2 (9.7)	75.3 (9.5)
Brier score	17.8 (4.7)	14.7 (5.8)	14.4 (5.8)	14.8 (6.7)	15.1 (4.4)
ECE	21.4 (7.3)	17.0 (7.6)	16.4 (7.7)	17.6 (9.2)	18.1 (5.6)

The pretraining domain outweighs the training objective

Two properties distinguish the pretrained initializations: the objective used during pretraining, supervised or self-supervised, and the content of the pretraining images, natural photographs or chest radiographs. ImageNet, DINOv3, and InDomain-stand occupy three cells of that two-by-two design (Fig. 3a), so each property can be read as a main effect. No public self-supervised chest radiograph ConvNeXt existed for the fourth cell, so the two effects are estimated separately and not as an interaction.

Both properties helped, and privacy amplified both. Holding the domain fixed to natural images, exchanging the supervised objective for the self-supervised one raised macro AUROC by 1.2 without privacy and by 6.0 at $0<\epsilon<1$. Holding the objective fixed to supervised training, moving the pretraining images from natural photographs to chest radiographs raised it by 2.5 and by 14.6 (Fig. 3b). Each effect was positive in all 25 dataset and budget combinations, and each grew as the budget tightened in every dataset (Fig. 3g,h).

The domain effect was the larger of the two almost everywhere. It exceeded the objective effect by a factor of 2.2 without privacy and 2.4 at the strictest budget, and by up to 3.4 at intermediate budgets (Fig. 3c). It was the larger effect in 24 of the 25 dataset and budget combinations, the exception being UKA-CXR without privacy, where the two were equal at 0.5 (Fig. 3f). The ordering held in every dataset at $0<\epsilon<1$, where the domain effect ranged from 9.7 on PadChest to 27.7 on VinDr-CXR and the objective effect from 0.8 to 16.2 (Fig. 3d,e). Comparing the two pretrained alternatives directly, the supervised in-domain model exceeded the self-supervised generic one in every dataset at every private budget, by 2.1 to 11.5 points, all at $p<0.0001$ (Fig. 3i).

The practical reading is that under privacy the content of the pretraining images matters more than the way that pretraining was supervised. A supervised model pretrained on roughly two hundred thousand chest radiographs outperformed a self-supervised model pretrained on orders of magnitude more natural images, and the margin grew as the budget tightened. Self-supervision remains valuable, and it is the better choice when only generic images are available, but it did not substitute for seeing the target modality during pretraining.

A domain-matched initialization reaches its optimum with less privacy spent

A privacy budget caps what training may spend; it does not record what training actually spends. Each run stopped at its best validation epoch, so a model that converged early consumed only part of its allowance. The initialization therefore acts on the privacy cost itself, and not on accuracy alone.

Convergence followed the amount of prior knowledge closely. At the tightest budget, training from scratch needed 40.0 epochs on average to reach its best validation macro AUROC, ImageNet 39.4, DINOv3 34.0, InDomain-priv 22.4, and InDomain-stand 18.4 (Fig. 4a). That ordering mirrors the ranking of downstream accuracy. At every budget the two in-domain initializations converged before DINOv3, which converged before ImageNet and training from scratch, although the two in-domain initializations exchanged places at the two loosest budgets (Fig. 4g). Because the budget accumulates with every optimization step, the epoch at which a run peaked and the budget it had consumed by then moved together across the 100 private runs (Fig. 4c).

Earlier convergence translated into privacy saved. Averaged over the five datasets, InDomain-stand expended 66% of the tightest cap, against 94% for DINOv3 and essentially all of it for ImageNet and for training from scratch (Fig. 4b). The two benefits compound, placing the in-domain runs above and to the left of the others in the plane of utility against privacy spent (Fig. 4d,e). On VinDr-CXR, InDomain-stand reached 90.8 macro AUROC having spent $\epsilon=0.16$, while training from scratch reached 48.3 after spending $\epsilon=1.00$. On PadChest it reached 84.6 at $\epsilon=0.44$, against 75.7 for DINOv3 at $\epsilon=0.98$.

The saving was not uniform. On ChestX-ray14 and UKA-CXR, InDomain-stand consumed almost its entire allowance, and its advantage on those datasets came from accuracy alone (Fig. 4f,h). Across the 20 private runs it spent less than ImageNet in 14, and DINOv3 and InDomain-priv also spent less in most runs (Fig. 4i). Where the saving did occur it points to a benefit that a fixed-budget comparison conceals: a well-matched initialization can raise utility and leave part of the privacy budget unused, so the same protection is obtained at a lower true privacy cost.

Figure 3: Separating the pretraining objective from the pretraining domain. Three pretrained initializations fill three cells of a design that crosses the pretraining objective, supervised or self-supervised, with the pretraining domain, natural images or chest radiographs. The objective effect is DINOv3 minus ImageNet, which share the natural image domain, and is drawn in the DINOv3 color. The domain effect is InDomain-stand minus ImageNet, which share the supervised objective, and is drawn in the InDomain-stand color. a, The design, with the mean macro AUROC over the five datasets at the tightest budget in each available cell; no public self-supervised chest radiograph model existed for the ConvNeXt family, so the fourth cell is empty. b, The two effects averaged over the five datasets against the mean achieved $\epsilon$ of each target level, with the non-private reference at $\infty$ and the horizontal axis broken (marked by …). c, Ratio of the domain effect to the objective effect at each target level. d, The two effects in each dataset at the tightest budget. e, Macro AUROC of the three initializations in each dataset at the tightest budget, with lines joining the values for one dataset. f, The domain effect against the objective effect for all 25 combinations of dataset and privacy setting; points above the dashed line of equality are those where the domain effect exceeded the objective effect. g,h, The objective effect (g) and the domain effect (h) for every dataset and privacy setting, on a shared color scale. i, Difference in macro AUROC between InDomain-stand and DINOv3, the direct comparison of a supervised in-domain model against a self-supervised generic one; asterisks mark comparisons significant at the 0.05 level by a two-sided paired bootstrap on macro AUROC with 10,000 resamples and no multiplicity correction. AUROC, area under the receiver operating characteristic curve; $\epsilon$, privacy budget; InDomain-stand, supervised pretraining on MIMIC-CXR.

Figure 4: Privacy actually spent before a model reaches its best validation performance. Colors denote the five initializations (legend, top). Each private run was capped at a target budget of $\epsilon=1$, 3, 6, or 9 but stopped at its best validation epoch, so the budget it consumed can be lower than its cap. a, Epoch at which the best validation macro AUROC was reached, averaged over the five datasets, at each target budget. b, Budget consumed at that epoch as a percentage of the target cap, averaged over the five datasets. c, Epoch of best validation performance against the budget consumed for all 100 private runs, with the Pearson correlation printed; marker shape denotes the target budget. d, Macro AUROC against the budget consumed at the tightest target for all five datasets and five initializations; points toward the upper left correspond to higher utility at lower privacy expenditure. e, The same comparison per dataset, with an arrow drawn from the random initialization to InDomain-stand in each dataset. f, Budget consumed as a percentage of the cap at the tightest target, by dataset, averaged over the five initializations. g,h, Epoch of best validation performance (g) and budget consumed (h) for every dataset and initialization at the tightest target. i, Number of the 20 private runs of each initialization that consumed less budget than the corresponding ImageNet run, with the mean difference in $\epsilon$ printed. AUROC, area under the receiver operating characteristic curve; $\epsilon$, privacy budget; InDomain-stand, supervised pretraining on MIMIC-CXR; InDomain-priv, differentially private pretraining on MIMIC-CXR.

Privatizing the pretraining data preserves most of the in-domain advantage

The in-domain advantage presumes access to a large medical pretraining corpus, and such a corpus carries the same privacy obligations as the data used downstream. InDomain-priv tests whether that obligation can be met. It draws on the identical MIMIC-CXR corpus and the identical supervised recipe, but its pretraining stage runs under DP-SGD and satisfies an $(\epsilon,\delta)$ guarantee with $\epsilon=7.93$.

Protecting the pretraining stage carried a real and stable cost. InDomain-priv trailed InDomain-stand by 4.9 points of macro AUROC at $0<\epsilon<1$ and by 5.0 to 5.2 points at the looser budgets, with every dataset and budget comparison significant at $p<0.0001$ (Table 3). With no privacy downstream the gap narrowed to 2.2. The penalty is therefore paid once, during pretraining, and it does not compound as the downstream budget tightens.

The consequential question is where that leaves the privately pretrained model against the public alternatives. Under privacy it outperformed all of them. At $0<\epsilon<1$ it led DINOv3 by 3.6, ImageNet by 9.6, and training from scratch by 20.0. It exceeded DINOv3 in all five datasets ($p<0.0001$) and in 17 of the 20 private cells, and it exceeded ImageNet in all 20.

Only without privacy did it fall behind, trailing DINOv3 by 0.8. The value of private in-domain pretraining is therefore specific to private downstream training, which is the setting where it is needed. Combined with the fine-tuning guarantee, this makes an end-to-end private pipeline practical: the pretraining corpus and the fine-tuning data can both be protected, and the resulting model still begins from a stronger position than any publicly pretrained alternative.

Table 3: Cost of privatizing the pretraining data. Macro AUROC in percent for the two in-domain initializations, which share the same MIMIC-CXR pretraining corpus and differ only in whether that pretraining stage was itself differentially private. Values are the bootstrap mean $\pm$ standard deviation with the 95% CI in brackets. $\Delta$ is the InDomain-stand minus InDomain-priv difference in points, and $p$ is from a two-sided paired bootstrap with 10,000 resamples and no multiplicity correction. Rows are grouped by privacy setting of the downstream fine-tuning, from the strictest budget to the non-private reference, and within each group by dataset following the order of presentation in the main text. AUROC, area under the receiver operating characteristic curve; CI, confidence interval; $\epsilon$, privacy budget; InDomain-stand, supervised pretraining on MIMIC-CXR; InDomain-priv, differentially private pretraining on MIMIC-CXR.

Dataset	InDomain-stand	InDomain-priv	$\Delta$	$p$
$0<\epsilon<1$
VinDr-CXR	90.8 $\pm$ 0.5 [89.7, 91.8]	85.9 $\pm$ 0.9 [84.1, 87.5]	+4.9	$<$0.0001
CheXpert	77.3 $\pm$ 0.3 [76.7, 77.8]	71.7 $\pm$ 0.3 [71.1, 72.3]	+5.5	$<$0.0001
ChestX-ray14	73.7 $\pm$ 0.5 [72.7, 74.7]	67.9 $\pm$ 0.5 [66.9, 69.0]	+5.8	$<$0.0001
PadChest	84.6 $\pm$ 0.2 [84.1, 85.1]	78.7 $\pm$ 0.3 [78.2, 79.2]	+5.9	$<$0.0001
UKA-CXR	83.5 $\pm$ 0.1 [83.3, 83.8]	81.0 $\pm$ 0.2 [80.7, 81.3]	+2.6	$<$0.0001
$1<\epsilon<3$
VinDr-CXR	90.7 $\pm$ 0.6 [89.6, 91.8]	86.1 $\pm$ 0.9 [84.3, 87.8]	+4.7	$<$0.0001
CheXpert	77.4 $\pm$ 0.3 [76.9, 78.0]	71.4 $\pm$ 0.3 [70.8, 72.0]	+6.0	$<$0.0001
ChestX-ray14	74.2 $\pm$ 0.5 [73.3, 75.2]	68.3 $\pm$ 0.5 [67.2, 69.3]	+5.9	$<$0.0001
PadChest	84.8 $\pm$ 0.2 [84.4, 85.3]	78.8 $\pm$ 0.3 [78.3, 79.3]	+6.1	$<$0.0001
UKA-CXR	84.5 $\pm$ 0.1 [84.2, 84.7]	81.9 $\pm$ 0.1 [81.6, 82.2]	+2.6	$<$0.0001
$3<\epsilon<6$
VinDr-CXR	91.1 $\pm$ 0.7 [89.7, 92.5]	86.1 $\pm$ 0.9 [84.3, 87.8]	+5.1	$<$0.0001
CheXpert	77.5 $\pm$ 0.3 [76.9, 78.0]	71.2 $\pm$ 0.3 [70.6, 71.8]	+6.3	$<$0.0001
ChestX-ray14	74.7 $\pm$ 0.5 [73.8, 75.6]	69.1 $\pm$ 0.5 [68.1, 70.1]	+5.6	$<$0.0001
PadChest	85.4 $\pm$ 0.2 [84.9, 85.9]	79.2 $\pm$ 0.3 [78.7, 79.7]	+6.2	$<$0.0001
UKA-CXR	85.0 $\pm$ 0.1 [84.7, 85.2]	82.7 $\pm$ 0.1 [82.4, 83.0]	+2.3	$<$0.0001
$6<\epsilon<9$
VinDr-CXR	91.3 $\pm$ 0.7 [89.9, 92.6]	86.0 $\pm$ 0.9 [84.3, 87.7]	+5.3	$<$0.0001
CheXpert	77.5 $\pm$ 0.3 [76.9, 78.0]	71.1 $\pm$ 0.3 [70.5, 71.7]	+6.4	$<$0.0001
ChestX-ray14	74.7 $\pm$ 0.5 [73.8, 75.6]	69.2 $\pm$ 0.5 [68.3, 70.2]	+5.5	$<$0.0001
PadChest	85.6 $\pm$ 0.2 [85.2, 86.1]	79.3 $\pm$ 0.3 [78.8, 79.8]	+6.3	$<$0.0001
UKA-CXR	85.3 $\pm$ 0.1 [85.0, 85.5]	82.9 $\pm$ 0.1 [82.6, 83.1]	+2.4	$<$0.0001
Non-private
VinDr-CXR	95.8 $\pm$ 0.4 [95.0, 96.5]	90.8 $\pm$ 0.6 [89.6, 91.9]	+5.0	$<$0.0001
CheXpert	82.7 $\pm$ 0.2 [82.3, 83.2]	81.4 $\pm$ 0.2 [80.9, 81.9]	+1.3	$<$0.0001
ChestX-ray14	79.4 $\pm$ 0.4 [78.6, 80.1]	76.2 $\pm$ 0.5 [75.3, 77.1]	+3.2	$<$0.0001
PadChest	89.6 $\pm$ 0.2 [89.2, 90.0]	88.4 $\pm$ 0.2 [88.0, 88.8]	+1.2	$<$0.0001
UKA-CXR	88.8 $\pm$ 0.1 [88.5, 89.0]	88.4 $\pm$ 0.1 [88.2, 88.6]	+0.3	$<$0.0001

Parameter-efficient fine-tuning compensates for a weak initialization

Differential privacy perturbs every trainable parameter, so limiting how many parameters are trained changes how much noise a model must absorb. We compared full fine-tuning against two parameter-efficient schemes, training the classification head alone and low-rank adaptation (Eq. 1), on VinDr-CXR and CheXpert at two budgets and from three initializations (Table 4).

Low-rank adaptation was the better scheme without exception. It exceeded full fine-tuning in all 12 configurations, by 6.7 points of macro AUROC on average and by as much as 15.2. Head-only training was less dependable. It helped in 10 of the 12 configurations, by 2.2 points on average, but it fell as much as 4.9 points below full fine-tuning when the backbone was randomly initialized, where a frozen random backbone gives the head little to read.

The benefit was largest where the initialization was weakest. Low-rank adaptation gained 8.0 points on average from a random initialization and 9.5 from ImageNet, against 2.7 from InDomain-stand. It also narrowed the spread between the weakest and strongest initialization, on VinDr-CXR at $3<\epsilon<6$ from 40.6 to 27.9 points. It never closed that spread. The best generic initialization trained with low-rank adaptation still trailed InDomain-stand trained with ordinary full fine-tuning in every configuration, so restricting the trainable parameters compensates for a weak starting point without substituting for a good one.

Combining the two levers produced the strongest private models. InDomain-stand with low-rank adaptation reached 93.2 $\pm$ 0.5 [92.2, 94.2] on VinDr-CXR and 80.2 $\pm$ 0.3 [79.7, 80.7] on CheXpert at $0<\epsilon<1$, within 2.6 and 2.5 points of the respective non-private references. Full fine-tuning from the same initialization left gaps of 5.0 and 5.4. Once a domain-matched initialization is in place, confining the private updates to a small set of parameters removes about half of the utility that strict privacy still costs.

Table 4: Macro AUROC in percent for three fine-tuning schemes under differential privacy. Full fine-tuning updates all backbone and head parameters, head-only fine-tuning freezes the backbone and trains the linear head, and low-rank adaptation freezes the backbone and trains inserted low-rank adapters together with the head. Test sets comprise 3,000 (VinDr-CXR) and 29,321 (CheXpert) radiographs. Values are the bootstrap mean $\pm$ standard deviation with the 95% CI in brackets. Rows are grouped by dataset and privacy setting, and within each group the initializations are ordered by increasing prior knowledge. AUROC, area under the receiver operating characteristic curve; CI, confidence interval; $\epsilon$, privacy budget; InDomain-stand, supervised pretraining on MIMIC-CXR; LoRA, low-rank adaptation.

Initialization	Full	Head-only	LoRA
VinDr-CXR, $0<\epsilon<1$
He	48.3 $\pm$ 1.0 [46.3, 50.2]	52.8 $\pm$ 1.0 [50.7, 54.8]	55.4 $\pm$ 1.0 [53.4, 57.4]
ImageNet	63.1 $\pm$ 1.1 [61.0, 65.3]	72.2 $\pm$ 1.0 [70.3, 74.2]	77.1 $\pm$ 0.9 [75.2, 78.9]
InDomain-stand	90.8 $\pm$ 0.5 [89.7, 91.8]	92.1 $\pm$ 0.5 [91.0, 93.1]	93.2 $\pm$ 0.5 [92.2, 94.2]
VinDr-CXR, $3<\epsilon<6$
He	50.5 $\pm$ 1.0 [48.6, 52.5]	57.8 $\pm$ 1.1 [55.6, 59.9]	65.7 $\pm$ 1.2 [63.3, 68.2]
ImageNet	77.0 $\pm$ 1.1 [74.9, 79.1]	77.4 $\pm$ 0.9 [75.7, 79.1]	83.8 $\pm$ 0.8 [82.1, 85.4]
InDomain-stand	91.1 $\pm$ 0.7 [89.7, 92.5]	93.3 $\pm$ 0.5 [92.3, 94.2]	93.6 $\pm$ 0.6 [92.4, 94.7]
CheXpert, $0<\epsilon<1$
He	58.4 $\pm$ 0.3 [57.7, 59.0]	55.3 $\pm$ 0.3 [54.7, 55.9]	63.4 $\pm$ 0.3 [62.8, 64.0]
ImageNet	66.7 $\pm$ 0.3 [66.0, 67.3]	69.6 $\pm$ 0.3 [69.0, 70.1]	75.0 $\pm$ 0.3 [74.4, 75.5]
InDomain-stand	77.3 $\pm$ 0.3 [76.7, 77.8]	79.6 $\pm$ 0.3 [79.1, 80.2]	80.2 $\pm$ 0.3 [79.7, 80.7]
CheXpert, $3<\epsilon<6$
He	62.7 $\pm$ 0.3 [62.0, 63.3]	57.8 $\pm$ 0.3 [57.2, 58.4]	67.3 $\pm$ 0.3 [66.7, 67.9]
ImageNet	68.0 $\pm$ 0.3 [67.4, 68.6]	70.6 $\pm$ 0.3 [70.0, 71.2]	77.0 $\pm$ 0.3 [76.5, 77.6]
InDomain-stand	77.5 $\pm$ 0.3 [76.9, 78.0]	79.7 $\pm$ 0.3 [79.2, 80.2]	80.4 $\pm$ 0.3 [79.9, 80.9]

The initialization advantage carries over to unseen institutions and outweighs model capacity

Deployment usually means running a model at an institution whose data it never saw. To test that, each dataset was held out in turn, the model was trained on the remaining four, and performance was measured on the unseen one. Every initialization gave up ground on the held-out institution, by 3.9 to 6.4 points of macro AUROC at $0<\epsilon<1$, and the loss was similar across initializations, so the ordering survived the shift (Fig. 5a,c,d and Supplementary Table 5).

InDomain-stand led in four of the five held-out datasets under strict privacy, averaging 76.4 against 67.2 for DINOv3, 63.5 for ImageNet, and 51.2 for training from scratch (Fig. 5a). The budget again governed the size of the lead. Without privacy the strongest initializations converged to within a point of one another, at 80.2 for InDomain-stand and 79.5 for DINOv3, and InDomain-stand led in four of five with a tie against DINOv3 on ChestX-ray14 (Fig. 5b,e).

UKA-CXR was the exception. With that dataset held out at $0<\epsilon<1$, ImageNet led at 67.7, InDomain-stand reached 66.3, and DINOv3 trailed at 61.4 (Fig. 5f). UKA-CXR is the only cohort collected primarily in intensive care and the only one labeled by structured clinical grading. It is also the one target for which pretraining on MIMIC-CXR gave no advantage, which suggests the in-domain benefit depends on the pretraining corpus resembling the deployment setting and not merely the imaging modality.

Capacity mattered far less than initialization. Moving from ConvNeXt-Small to the smaller ConvNeXt-Tiny changed macro AUROC by 1.5 points on average and by at most 6.5 in either direction, while within the Tiny backbone alone the initializations spanned 23.8 points on VinDr-CXR and 15.0 on CheXpert at $0<\epsilon<1$ (Fig. 5g–i and Supplementary Table 6). Under a fixed privacy budget, where the model starts therefore counts for considerably more than how large it is. The two in-domain initializations were released for the Small backbone only, so this comparison covers the three generic initializations.

Figure 5: Generalization to unseen institutions and the effect of backbone capacity. Colors denote the five initializations (legend, top). Each dataset was held out in turn, the model was trained on the remaining four, and macro AUROC was measured on the held-out test set. a,b, Macro AUROC on each held-out dataset at the tightest privacy budget (a) and without privacy (b). c, Loss in macro AUROC on moving from the internal evaluation to the held-out evaluation at the tightest budget, averaged over the five datasets. d, Held-out macro AUROC against internal macro AUROC at the tightest budget for all five datasets and five initializations; the dashed line marks equal performance, and points below it denote a loss on the held-out institution. e, Mean held-out macro AUROC of each initialization without privacy and at the tightest budget, with a line joining the two settings. f, Held-out macro AUROC on UKA-CXR at the tightest budget for the five initializations. g, ConvNeXt-Small against ConvNeXt-Tiny for the three initializations released for both, on the two datasets where both capacities were trained; the dashed line marks equal performance and marker shape denotes the privacy setting. h, The Small minus Tiny difference for each of those configurations. i, The spread of macro AUROC across initializations within a fixed backbone, compared with the largest difference attributable to backbone capacity. The two in-domain initializations were released for the Small backbone only, so panels g–i cover the three generic initializations. AUROC, area under the receiver operating characteristic curve; $\epsilon$, privacy budget; InDomain-stand, supervised pretraining on MIMIC-CXR; InDomain-priv, differentially private pretraining on MIMIC-CXR.

In-domain pretraining raises the worst-subgroup floor under privacy

Differential privacy is known to fall unevenly across patient groups, and it usually costs the smallest groups the most. Macro AUROC was therefore measured separately by sex and across three age bands in every test set.

Disparities were overwhelmingly a matter of age. Averaged over the five datasets, the gap between the best and worst age band ran from 4.0 to 7.1 points depending on the initialization, while the gap between male and female patients stayed between 0.9 and 1.5 (Fig. 6a). Performance was almost identical for male and female patients under every initialization, and fell steadily with age (Fig. 6b,c). At $0<\epsilon<1$ the weakest group was patients over 70 in 21 of the 25 dataset and initialization combinations (Fig. 6i).

Privacy widened that age gap for the generic initializations and left it untouched for the in-domain one. Moving from non-private training to $0<\epsilon<1$, the average age gap grew from 5.7 to 6.6 for ImageNet, from 4.3 to 6.3 for DINOv3, and from 4.6 to 7.1 for InDomain-priv, while for InDomain-stand it moved from 4.1 to 4.0 (Fig. 6d and Supplementary Tables 7 and 8).

The floor tells the clearest story. At $0<\epsilon<1$ the worst-performing subgroup averaged 78.7 macro AUROC with InDomain-stand, against 69.5 with InDomain-priv, 66.9 with DINOv3, 60.9 with ImageNet, and 55.4 with training from scratch, and InDomain-stand held the highest floor in all five datasets (Fig. 6e,g and Supplementary Table 7). Strict privacy cost that floor only 5.6 points relative to non-private training, against 16.0 to 18.4 points for the generic initializations (Fig. 6f).

One comparison needs care. The two narrowest age gaps under privacy belonged to initializations at opposite ends of performance: InDomain-stand at 4.0 and training from scratch at 4.5. Their worst subgroups were far apart, averaging 78.7 and 55.4, and the randomly initialized model scored between 45.8 and 65.2 across the five datasets, close to chance on VinDr-CXR. A model that performs poorly for everyone has little room left for disparity, so a narrow gap is not on its own evidence of equitable performance. Measured by the level the least well served group actually reaches, InDomain-stand was the only initialization whose weakest subgroup stayed above 70 macro AUROC in every dataset, the next best reaching 62.6 (Fig. 6h). The age gaps widened more than the sex gaps under privacy because the age subgroups are the more imbalanced. The extreme-age bands are smaller and differ more in finding prevalence across datasets than the two sexes (Supplementary Table 12), and per-sample clipping with added noise reduces the effective learning signal most for small, prevalence-skewed subgroups. A domain-matched initialization lessens this effect by reducing the optimization burden that private training places on the model.

Figure 6: Performance within demographic subgroups under differential privacy. Colors denote the five initializations (legend, top). Subgroups are the two recorded sexes and three age bands, and every value is a macro AUROC computed within that subgroup of a test set. The sex gap is the absolute difference between male and female patients, and the age gap is the difference between the best and worst age band. The floor is the lowest macro AUROC across all five subgroups of a dataset. a, Sex gap and age gap for each initialization at the tightest budget, averaged over the five datasets. b, Macro AUROC within each subgroup at the tightest budget, averaged over the five datasets. c, The same values across the three age bands, with a line per initialization. d, Age gap without privacy and at the tightest budget, with a line joining the two settings for each initialization. e, The floor at the tightest budget, averaged over the five datasets, with the individual datasets shown as points. f, Loss in the floor on moving from non-private training to the tightest budget, averaged over the five datasets. g, The floor for every dataset and initialization at the tightest budget. h, The floor against the age gap at the tightest budget. i, Number of the 25 dataset and initialization combinations in which each subgroup was the weakest at the tightest budget. AUROC, area under the receiver operating characteristic curve; $\epsilon$, privacy budget; InDomain-stand, supervised pretraining on MIMIC-CXR; InDomain-priv, differentially private pretraining on MIMIC-CXR.

Discussion

We asked whether the benefit of pretraining under differential privacy comes from the objective a model was pretrained with or from the images it was pretrained on, and which combination best preserves diagnostic utility once a formal guarantee is enforced. Across five external chest radiograph datasets, four privacy budgets, two model capacities, and three fine-tuning schemes, the answer was consistent. The pretraining domain dominated the objective, supervised pretraining on chest radiographs set the privacy-utility frontier, and its margin over generic initializations widened as privacy grew stricter.

That result sharpens a question the non-private literature has left unsettled. Careful comparisons on chest radiographs have repeatedly found that generic ImageNet pretraining transfers well and that matching the pretraining domain buys surprisingly little [19, 3], and our non-private measurements agree with them. What privacy changes is the margin for error. DP-SGD clips every per-sample gradient and adds noise to it, so the useful signal surviving each update is small and the number of useful updates is capped by the budget [1]. A model that must still learn what a chest radiograph looks like has to spend that scarce signal on building a representation, while a model that already encodes the modality can spend it on the diagnostic task. Domain proximity stops being a marginal convenience and becomes the binding constraint. The same logic explains why the self-supervised objective helped and yet helped less. Self-supervision yields broader and more robust features [7, 14], which is worth real accuracy under noise [22, 2], but breadth across natural images is not the same thing as closeness to radiographs, and scaling the self-supervised corpus does not close that distance [32, 35].

The dominant remedies proposed for private training have been scale and compute. Very large batches, long schedules, and very large public corpora recover much of the accuracy that DP-SGD costs on natural images [8, 23]. Those routes are largely closed to a hospital training on its own patients, which is the setting differential privacy exists to serve. Our results point to a cheaper lever that is available there. Choosing a starting point already matched to the modality required no additional data, no additional compute, and no change to the privacy accounting, and it moved the frontier further than either a better objective or a larger backbone did.

A second observation concerns what private training actually costs. Privacy budgets are almost always reported as the value a run was allowed to reach, and recent surveys note that privacy parameters in medical imaging are reported inconsistently and often incompletely [30, 46]. The guarantee that matters, however, attaches to the mechanism actually released [10]. Because training halts at the best validation epoch, the budget a run consumes can fall well below its cap, and how far below depends on the initialization. A model that converges quickly buys its accuracy with less of the patient’s privacy. This reframes the initialization as a lever on both sides of the trade-off at once, and it argues that the achieved budget, not the target, is the quantity that belongs in a privacy statement. The saving was not uniform across datasets, so it should be measured and reported for each run and not assumed.

The strength of in-domain pretraining raises an uncomfortable question about where that pretraining corpus comes from. Private fine-tuning is conventionally justified by treating the pretraining data as public, an assumption that is difficult to sustain when the corpus consists of patient radiographs [40], and the risk is not hypothetical, since training data can be reconstructed from released models [5]. Our privately pretrained initialization shows the assumption is avoidable. Protecting the pretraining stage cost accuracy, but the resulting encoder still outperformed every publicly pretrained alternative once privacy was enforced downstream, and it does so while carrying its own formal guarantee, so the protection extends to the patients in the pretraining corpus as well [38]. For groups now assembling open medical foundation models [28], this suggests a concrete design choice. An encoder pretrained under differential privacy can be released with a stated guarantee and will still serve downstream private training better than a generic public encoder.

The advantage also survived the two stresses that matter most for deployment. Models are almost always used at institutions that contributed nothing to their training, and chest radiograph classifiers are known to lose accuracy under that shift [20, 36]. Every initialization paid a similar penalty on a held-out institution, so the shift did not reorder them, and a domain-matched start remained the best available option at a new site. Backbone capacity, by contrast, moved performance far less than the choice of initialization did. This does not contradict the finding that scale helps private learning [8], which was established across orders of magnitude and with batch sizes far beyond what we used. Within the range a hospital would realistically deploy, capacity was the weaker lever, and effort is better spent on where the model starts.

Restricting the trainable parameters was the one intervention that partly substituted for prior knowledge. Low-rank adaptation improved on full fine-tuning in every configuration we tested, and training the head alone improved on it in most, which extends to medical imaging a principle established in private language modeling [45, 24, 15]. The pattern beneath it is informative. The gain was largest for the weakest initializations and smallest for the strongest, so limiting the parameters that noise must cover partly compensates for knowledge the model does not have. It did not reorder the initializations, and it did not close the gaps between them. Parameter efficiency and a well-matched initialization are therefore complementary, with diminishing returns once the starting point is already close to the target domain.

Differential privacy is known to distribute its costs unevenly, falling hardest on the smallest and least well represented groups [4], and a recent synthesis found that few medical studies examine this at all and that several report widening subgroup gaps under privacy [30]. Our subgroup results support that concern and add a methodological caution. Disparities here were driven by age far more than by sex, and the two narrowest age gaps under strict privacy belonged to the domain-matched initialization and to the model trained from scratch, whose worst subgroups differed by more than twenty points. A gap statistic cannot tell those two situations apart, because it rewards uniform failure as readily as uniform success. Judging equity by the level the least well served group actually reaches gives the opposite and more defensible ranking, and it aligns fairness reporting with the question a clinician would ask about the patients a model serves worst [37]. We would encourage reporting the worst-group level alongside the gap in privacy-preserving medical AI.

Several limitations qualify these conclusions. First, the design that separates objective from domain is incomplete, because no self-supervised chest radiograph model was available for the ConvNeXt family we fixed; self-supervised radiograph encoders do exist for other architectures [39, 43], and closing this cell would require pretraining one, which would allow the two properties to be tested as an interaction instead of as main effects. Second, the findings are associational. Learning rates were tuned separately for each initialization and privacy setting, which is standard practice and gives each arm its best chance, but it means we compare optima and cannot isolate a single causal mechanism. Third, the in-domain advantage was absent on the intensive care cohort, which is also the cohort most unlike the emergency and inpatient population of the pretraining corpus [17]; the benefit may depend on resemblance to the deployment setting and not on the imaging modality alone, and confirming that would need pretraining corpora drawn from several care settings. Fourth, we studied one backbone family at two capacities and one modality, so whether the same ordering holds for transformers, for three-dimensional imaging, or for other tasks is untested, and settling it would require repeating the design on those architectures. Fifth, the fairness analysis covered sex and age only, with binary sex and three age bands, because race and ethnicity were not recorded in these datasets; intersectional subgroups and finer strata were therefore out of reach and would need cohorts that collect those attributes. Sixth, we evaluated a single privacy mechanism, and federated, synthetic-data, and hybrid approaches [18, 27] may trade utility against privacy differently, so the ranking reported here should not be assumed to transfer to them. Finally, the datasets are retrospective and heterogeneously labeled, through expert annotation, rule-based report labeling, and structured clinical grading, and no model was validated prospectively in clinical use.

Under differential privacy, where a model starts matters more than how it was taught or how large it is, and what it was shown during pretraining matters most of all. The practical consequence is encouraging. Pairing a domain-matched initialization with parameter-efficient private fine-tuning recovers much of the accuracy that strict privacy otherwise costs, raises the floor for the patients a model serves least well, and can reach its best performance having spent less of the privacy budget than a weaker starting point would require. That combination makes privacy-preserving diagnostic imaging less of a compromise than it has appeared. It also redirects effort. The most useful contribution to private medical AI may not be an ever larger generic pretraining corpus, but curated, openly released, domain-matched encoders whose own training was protected, so that the guarantee holds from the first image a model ever saw to the last prediction it makes.

Methods

Ethics statement

All procedures were conducted in compliance with applicable guidelines and regulations. Ethical approval for this retrospective study was granted by the Ethics Committee of the Medical Faculty of RWTH Aachen University (Reference No. EK 22-319). The committee waived the requirement for individual informed consent. VinDr-CXR and MIMIC-CXR were obtained through PhysioNet under their data use agreements, and all images were processed locally without transmission to any third-party service. No new patient data were collected for this study.

Datasets and preprocessing

We measured diagnostic utility on five external chest radiograph datasets, VinDr-CXR [31], CheXpert [16], ChestX-ray14 [42], PadChest [6], and UKA-CXR [20], and used a sixth dataset, MIMIC-CXR [17], only to construct domain-specific initializations. Every dataset was mapped to a single canonical vocabulary of five findings, atelectasis, cardiomegaly, pleural effusion, pneumonia, and no finding, and each radiograph was represented by a five-dimensional multi-label vector in this fixed order, so predictions were directly comparable and could be pooled across datasets. The source column of each dataset that supplied each canonical finding, and the two datasets whose encodings required a decoding rule, are listed in Supplementary Table 9, and the full curation procedure is given in Supplementary Note Supplementary Note 1: dataset curation and label harmonization.

The datasets differ in acquisition and labeling. VinDr-CXR, PadChest, and ChestX-ray14 provide binary labels. CheXpert labels were produced by a rule-based report labeler with positive, negative, and uncertain categories, and uncertain labels were treated as negative; for CheXpert only frontal projections were used. For PadChest, posteroanterior and anteroposterior projections were used. UKA-CXR labels came from structured clinical reporting, with radiographic sex numerically encoded, cardiomegaly graded on an ordinal scale and treated as positive at grade 3 or 4, and the remaining findings binary. Each dataset was split into training, validation, and test sets using the native split of its curated master list; VinDr-CXR has no native validation split, so its test split was reused for validation and threshold selection while remaining disjoint from the training split. The datasets varied in size and composition (Supplementary Table 10). VinDr-CXR contributed 18,000 radiographs (15,000 training and 3,000 test), and its demographic metadata were sparse, with sex recorded for 8,608 radiographs and age for 4,234. ChestX-ray14 contributed 112,120 radiographs from 30,805 patients (77,870 training, 8,654 validation, and 25,596 test), 56.5% from male patients, with a median age of 49 years (interquartile range, IQR, 34 to 59). PadChest contributed 110,525 frontal radiographs, retained from 160,704 by keeping posteroanterior and anteroposterior projections, from 67,205 patients (79,697 training, 8,783 validation, and 22,045 test), with a near-even sex balance and a median age of 63 years (IQR 47 to 74). CheXpert contributed 157,878 frontal radiographs from 57,872 patients (115,458 training, 13,099 validation, and 29,321 test), 59.0% from male patients, with a median age of 61 years (IQR 49 to 74). UKA-CXR contributed 193,361 radiographs from 54,176 patients, collected primarily in intensive-care settings (137,902 training, 15,353 validation, and 40,106 test), 65.2% from male patients, with a median age of 68 years (IQR 58 to 77). Across the five evaluation datasets, 591,884 radiographs were used. The two domain-specific initializations were pretrained on frontal radiographs of MIMIC-CXR (215,187 anteroposterior and posteroanterior images), in a pretraining stage carried out outside the evaluation pipeline; MIMIC-CXR labels were produced by the same rule-based labeler as CheXpert. The number of positive examples of every finding in every split is given in Supplementary Table 11. Per-subgroup sizes and per-finding prevalence on each test set are reported in Supplementary Table 12, and the availability of the demographic attributes themselves, which limits those subgroups, is described in Supplementary Note Supplementary Note 1: dataset curation and label harmonization.

Radiographs were resized to $224\times 224$ pixels [34], intensity-normalized per image, converted to 8-bit grayscale, and contrast-standardized by histogram equalization to reduce inter-dataset variability arising from differences in acquisition and post-processing; they were then loaded as three-channel images scaled to the unit interval. During non-private training only, images were augmented with random horizontal flipping (probability 0.5) and random rotation (up to 7 degrees); validation, test, and all differentially private training used no augmentation, because naive per-sample augmentation changes per-sample sensitivity under DP-SGD. Class imbalance was addressed by a per-label positive weight in the loss (Eq. 4). The resampling unit for the paired bootstrap was the patient where reliable patient identifiers were available and the image otherwise. Patient identifiers were recovered from the image path for CheXpert and from the filename for ChestX-ray14; VinDr-CXR, PadChest, and UKA-CXR were resampled at the image level.

Initialization strategies

We compared five initializations spanning a spectrum of prior knowledge. He initialization trained the network from scratch: all convolutional and linear weights were reinitialized with He (Kaiming) normal initialization [13] and all normalization layers were reset. ImageNet initialization used the supervised ImageNet-1k pretrained ConvNeXt backbone [9]. DINOv3 initialization used the self-supervised DINOv3 ConvNeXt backbone [35]. The in-domain standard initialization ( InDomain-stand) used a ConvNeXt backbone pretrained by supervised multi-label classification on the domain-matched chest radiograph dataset MIMIC-CXR. The in-domain private initialization (InDomain-priv) used the same supervised MIMIC-CXR pretraining carried out under DP-SGD, giving an initialization whose pretraining stage itself satisfies an $(\epsilon,\delta)$-differential privacy guarantee with $\epsilon=7.93$ and $\delta=6\times 10^{-6}$. The two in-domain initializations were available for the ConvNeXt-Small backbone only. All backbones were publicly available checkpoints, run locally, with the classification head reinitialized in every case.

Backbone architecture and fine-tuning

The classifier was a ConvNeXt backbone [25] with an attached linear head mapping the 768-dimensional pooled embedding to the five findings. We used two capacities: ConvNeXt-Small (49.5 million parameters) as the main backbone, and ConvNeXt-Tiny (27.8 million parameters) for the capacity analysis. Three fine-tuning schemes were considered. Full fine-tuning updated all backbone and head parameters. Head-only fine-tuning froze the backbone and trained the head alone. Low-rank adaptation (LoRA) [15] froze the backbone and inserted trainable low-rank adapters into the pointwise ($1\times 1$) convolutional linear layers of the ConvNeXt blocks, with the head trainable. Each adapter replaced a frozen linear map $W_{0}$ by

$$y=W_{0}x+\frac{\alpha}{r}\,B\,\mathrm{dropout}(Ax),$$ (1)

where $A\in\mathbb{R}^{r\times d_{\mathrm{in}}}$ and $B\in\mathbb{R}^{d_{\mathrm{out}}\times r}$ are the low-rank factors of rank $r$, $\alpha$ is a scaling factor, $A$ is initialized to small random values, and $B$ to zero so that adaptation starts from the pretrained map. We used $r=16$, $\alpha=32$, and dropout 0.05.

Differentially private training

Differential privacy bounds the influence of any single training example on the released model. A randomized mechanism $\mathcal{M}$ satisfies $(\epsilon,\delta)$-differential privacy if, for every pair of datasets $D$ and $D^{\prime}$ differing in one example and every measurable set of outputs $S$,

$$\Pr[\mathcal{M}(D)\in S]\;\leq\;e^{\epsilon}\,\Pr[\mathcal{M}(D^{\prime})\in S]+\delta.$$ (2)

We trained with differentially private stochastic gradient descent (DP-SGD) [1] as implemented in Opacus [44]. At each step, the per-sample gradients $g_{i}$ over a batch $B$ were clipped to a maximum $L_{2}$ norm $C$, and Gaussian noise proportional to $C$ was added to their sum, giving the privatized gradient

$$\tilde{g}=\frac{1}{|B|}\left(\sum_{i\in B}\frac{g_{i}}{\max\!\left(1,\,\lVert g_{i}\rVert_{2}/C\right)}\;+\;\mathcal{N}\!\left(0,\,\sigma^{2}C^{2}\mathbf{I}\right)\right),$$ (3)

where $\sigma$ is the noise multiplier. The privacy loss was tracked with the Rényi differential privacy accountant [33]. For each run, the noise multiplier $\sigma$ of Eq. 3 was calibrated by Opacus to reach a target $\epsilon$ at a fixed budget of 150 epochs, given $\delta=6\times 10^{-6}$, the clipping norm $C$, and the Poisson sampling rate $q=|B|/N$, with logical batch size $|B|=128$ and training set size $N$. The clipping norm was $C=4$ for ConvNeXt-Small and $C=3.5$ for ConvNeXt-Tiny. The logical batch of 128 was realized in physical batches of 64 by gradient accumulation, and modules incompatible with per-sample gradients were replaced by differentially private equivalents before training. The Gaussian noise was sampled from the standard pseudo-random generator, with the Opacus secure-mode generator not enabled. We used four target budgets, $\epsilon\in\{2,5,8,11\}$, and stopped training when the spent budget reached a cap of 0.99, 2.99, 5.99, and 8.99, respectively. Because training stopped at the cap and the reported model is the converged one, the achieved budget of every run fell within one of four bands: $0<\epsilon<1$, $1<\epsilon<3$, $3<\epsilon<6$, and $6<\epsilon<9$. A non-private reference was trained for 20 epochs without DP-SGD. The reported $(\epsilon,\delta)$ budgets quantify the privacy of the fine-tuning stage with respect to the target dataset. Pretraining is a separate stage: He uses none, ImageNet and DINOv3 use public non-medical images, and InDomain-stand uses MIMIC-CXR without a privacy guarantee, so for these four initializations the guarantee covers the target-dataset fine-tuning alone. For InDomain-priv the pretraining stage additionally satisfies its own $(\epsilon=7.93,\delta=6\times 10^{-6})$ guarantee over MIMIC-CXR, so both its pretraining and its fine-tuning are differentially private. The achieved $\epsilon$, noise multiplier, sampling rate, and clipping norm of every run are reported in Supplementary Table 1, and the optimization steps in Supplementary Table 2.

Optimization, model selection, and decision thresholds

Models minimized a per-label weighted binary cross-entropy over the five findings,

$$\mathcal{L}=-\frac{1}{|B|}\sum_{i\in B}\sum_{c=1}^{5}\Big[\,w_{c}\,y_{ic}\log\hat{p}_{ic}+(1-y_{ic})\log(1-\hat{p}_{ic})\,\Big],\qquad w_{c}=\frac{N-n_{c}^{+}}{n_{c}^{+}},$$ (4)

where $\hat{p}_{ic}=\sigma(z_{ic})$ is the predicted probability for finding $c$, $y_{ic}$ the label, $n_{c}^{+}$ the number of positive training examples for finding $c$, and $N$ the training set size [29]. Optimization used AdamW [26] with weight decay 0.01 over the trainable parameters. Learning rates were selected per fine-tuning scheme, per privacy setting, and, for full fine-tuning, per initialization, to maximize validation macro AUROC. For full fine-tuning the learning rate was $1\times 10^{-5}$ for the He, ImageNet, and DINOv3 initializations in both settings and $5\times 10^{-6}$ for the two domain-specific initializations under privacy; head-only fine-tuning used $1\times 10^{-3}$ without privacy and $2\times 10^{-3}$ with privacy; and LoRA used $1\times 10^{-4}$ without privacy and $5\times 10^{-4}$ with privacy. Models were validated every epoch, and the converged model was the epoch with the highest validation macro AUROC. Non-private models used a 20-epoch schedule; differentially private models used the 150-epoch budget with early stopping at the privacy cap. All loaders used a batch size of 128, and training was seeded (seed 42) with deterministic behavior enabled. A single training seed was used; because fitting the full set of runs under DP-SGD is computationally intensive, uncertainty in all reported metrics was quantified by bootstrapping the test set (Statistical analysis) instead of by repeated training with different seeds. Decision thresholds for the threshold-dependent metrics were the per-label Youden’s-index thresholds [41], that is the operating points maximizing sensitivity plus specificity minus one, computed on the validation set at the converged epoch, frozen, and then applied to the test set. The ranking and calibration metrics did not use these thresholds.

Experimental design

The main experiment fit ConvNeXt-Small for every combination of the five initializations, the four privacy budgets and the non-private reference, and the five datasets, giving 125 runs. Three targeted experiments extended it. The capacity experiment repeated the He, ImageNet, and DINOv3 initializations with ConvNeXt-Tiny on CheXpert and VinDr-CXR at the strictest budget and the non-private reference. The parameter-efficient fine-tuning experiment compared head-only fine-tuning and LoRA against full fine-tuning for the He, ImageNet, and InDomain-stand initializations on CheXpert and VinDr-CXR at $0<\epsilon<1$ and $3<\epsilon<6$. The leave-one-dataset-out experiment held out each dataset in turn, trained on the pooled training data of the other four, and tested on the held-out dataset, for all five initializations at the strictest budget and the non-private reference; the positive weights of the pooled training set were aggregated over its constituent datasets. The 125 runs of the main experiment took 1,592 hours of single-GPU training in total, and private training cost about twice as much per epoch as non-private training at every dataset size (Supplementary Table 13).

Evaluation metrics

For each experiment we computed eight metrics per label and macro-averaged over the five findings: the area under the receiver operating characteristic curve (AUROC), mean average precision (mAP), the area under the precision-recall curve (AUPRC, by trapezoidal integration), accuracy, sensitivity, specificity, the Brier score, and the expected calibration error (ECE). Accuracy, sensitivity, and specificity used the validation-derived thresholds; the other five metrics were threshold-free. The Brier score was the mean squared difference between predicted probability and label [11]. The ECE was computed with $M=15$ equal-width probability bins as the weighted mean absolute gap between bin accuracy and bin confidence,

$$\mathrm{ECE}=\sum_{m=1}^{M}\frac{|B_{m}|}{n}\,\big|\,\mathrm{acc}(B_{m})-\mathrm{conf}(B_{m})\,\big|,$$ (5)

where $B_{m}$ is the set of the $n$ predictions whose probability falls in bin $m$, and $\mathrm{acc}$ and $\mathrm{conf}$ are its empirical accuracy and mean predicted probability [12].

Statistical analysis

Uncertainty for every metric was estimated by a nonparametric bootstrap with 10,000 resamples [21]. For each dataset, one set of bootstrap resamples was constructed once over the ordered test set and reused by every experiment, so all comparisons on that dataset were paired. Resampling was at the unit level: each resample drew, with replacement, as many units as there were unique units, and a unit drawn several times contributed its rows the corresponding number of times. The resampling unit was the patient for CheXpert and ChestX-ray14 and the image for VinDr-CXR, PadChest, and UKA-CXR. Each metric was summarized by the mean, the standard deviation of the bootstrap distribution (the bootstrap standard error, one degree of freedom), and the 2.5th and 97.5th percentiles as the 95% confidence interval; resamples in which a label had only one class present were treated as missing for the ranking metrics. All metric values are reported as percentages with one decimal place.

Comparisons between initializations were made on macro AUROC with a two-sided paired bootstrap test. For a pair of initializations on the same dataset and privacy setting, the paired difference between their macro AUROC bootstrap distributions was centered under the null by subtracting its mean, and the two-sided $p$-value was the fraction of the centered distribution whose magnitude was at least the observed mean difference. Because the test used 10,000 resamples, its finest resolution was $0.0001$, so smaller values are reported as $p<0.0001$. $p$-values are reported to three decimals and were not corrected for multiple comparisons; the significance threshold was 0.05. Demographic subgroup metrics were computed by restricting the same paired bootstrap to the rows of each subgroup, a conditional bootstrap that keeps the subgroup analysis paired with the full test; subgroup sizes, per-label prevalence, and the number of examples excluded for a missing attribute are reported in Supplementary Table 12. These exclusions applied only to the subgroup analyses; every other evaluation used the complete test set of each dataset. The excluded fraction was negligible for all datasets except VinDr-CXR, whose demographic metadata are sparse, with 58.2% of test radiographs lacking a recorded sex and 84.4% lacking an age. Per-epoch training time was summarized as the mean of the densest cluster of per-epoch times within 5% of their median, to avoid inflation by transient stalls. The analyses of uncertainty and of subgroup performance are descriptive; the macro AUROC comparisons between initializations are inferential.

Data availability

This study draws on a combination of publicly available datasets, controlled-access resources, and an institutional clinical cohort. ChestX-ray14 and PadChest are openly accessible and can be obtained from their public repositories at https://www.kaggle.com/datasets/nih-chest-xrays/data and https://bimcv.cipf.es/bimcv-projects/padchest/. VinDr-CXR and MIMIC-CXR are distributed under controlled access via PhysioNet and require completion of the corresponding data use agreements prior to download at https://physionet.org/content/vindr-cxr/1.0.0/ and https://physionet.org/content/mimic-cxr-jpg/2.0.0/. CheXpert is available upon request from Stanford University through https://stanfordmlgroup.github.io/competitions/chexpert/. The UKA-CXR dataset comprises clinical imaging data collected at University Hospital RWTH Aachen, Germany; access to the full cohort is subject to institutional approval and may be granted upon reasonable request to the corresponding authors under a formal collaboration agreement. In addition, a subset of the UKA-CXR dataset has been released publicly and is available through the Hugging Face platform at https://huggingface.co/TLAIM.

Code availability

All source code, configuration files, and instructions required to reproduce the experiments are publicly available at https://github.com/tayebiarasteh/dp_dinov3. Training and evaluation were performed strictly in full 32-bit floating point precision. Experiments were conducted between October 27, 2025, and July 19, 2026. The implementation used Python 3.10.13 with PyTorch 2.5.1 and torchvision 0.20.1 (CUDA 12.4). Numerical and statistical analysis, including the bootstrap and the metric computations, used NumPy 2.2.6, SciPy 1.15.2, scikit-learn 1.7.1, and pandas 2.3.2; differential privacy used Opacus 1.5.4; image loading and processing used OpenCV 4.12.0 and Pillow 9.4.0; and figures were produced with Matplotlib 3.9.1. Hugging Face tooling comprised transformers 4.56.0, huggingface-hub 0.34.4, accelerate 1.10.1, tokenizers 0.21.4, and safetensors 0.6.2. All experiments were run on NVIDIA L40S GPUs with 48 GB of memory and Intel Xeon Silver 4310 CPUs.

All pretrained initialization weights were obtained from official public repositories hosted on Hugging Face. Supervised ImageNet initialization used the ConvNeXt-Tiny and ConvNeXt-Small models available at https://huggingface.co/facebook/convnext-tiny-224 and https://huggingface.co/facebook/convnext-small-224. Self-supervised initialization used the DINOv3-pretrained ConvNeXt models released by Meta AI, specifically https://huggingface.co/facebook/dinov3-convnext-small-pretrain-lvd1689m and https://huggingface.co/facebook/dinov3-convnext-tiny-pretrain-lvd1689m.

Author contributions

The formal analysis and conceptualization were conducted by S.T.A. and D.T.. The original draft was written by S.T.A., M.F., and M.L.. The code was developed by S.T.A.. The experiments were performed by S.T.A.. The illustrations were designed by S.T.A.. The statistical analyses were performed by S.T.A., M.F., S.N., and D.T.. B.H.P., C.K., S.N., and D.T. provided clinical expertise. S.T.A., M.F., M.L., J.B., M.A., M.R., and D.T. provided technical expertise. The study was defined by S.T.A.. All authors read the manuscript, agreed to the submission of this paper, and contributed to the editing.

Competing interests

S.T.A. is an editorial board member at Communications Medicine and at European Radiology Experimental, and a trainee editorial board member at Radiology: Artificial Intelligence. M.L. is employed by Generali Deutschland Services GmbH, Germany, and is on the editorial board of European Radiology Experimental. B.H.P. is an associate editor at the Journal of Medical Internet Research. D.T. received honoraria for lectures by Bayer, GE, Roche, AstraZeneca, and Philips, and holds shares in StratifAI GmbH, Germany, and in Synagen GmbH, Germany. The other authors have no competing interests to disclose.

Supplementary information

Supplementary Table 1: Privacy accounting for every differentially private run of the main experiment. The Poisson sampling rate, the noise multiplier, and the per-sample gradient clipping norm are properties of the mechanism and the dataset, so within a dataset and target level they are identical for all five initializations and are listed once. The budget actually spent at the selected epoch differs by initialization and is given for each. All runs used $\delta=6\times 10^{-6}$, a logical batch size of 128, and a 150-epoch budget, and each stopped at its best validation epoch, which is why the spent budget can fall below the target. The epoch at which each run peaked is shown in Fig. 4. $\epsilon$, privacy budget; He, He (Kaiming) initialization; InDomain-stand, supervised pretraining on MIMIC-CXR; InDomain-priv, differentially private pretraining on MIMIC-CXR.

				Budget spent, $\epsilon$
Target level	Sampling rate	Noise mult.	Clip norm	He	ImageNet	DINOv3	InDomain-stand	InDomain-priv
VinDr-CXR
$0<\epsilon<1$	0.00855	2.607	4.0	0.996	0.996	0.969	0.158	0.996
$1<\epsilon<3$	0.00855	1.305	4.0	2.829	2.998	2.591	0.655	2.465
$3<\epsilon<6$	0.00855	0.992	4.0	5.957	5.920	5.377	5.995	3.950
$6<\epsilon<9$	0.00855	0.853	4.0	9.032	8.644	7.068	8.295	3.990
CheXpert
$0<\epsilon<1$	0.00111	1.123	4.0	0.996	0.996	0.852	0.708	0.549
$1<\epsilon<3$	0.00111	0.721	4.0	3.010	3.010	2.919	2.130	1.649
$3<\epsilon<6$	0.00111	0.622	4.0	5.965	5.965	5.965	3.408	2.475
$6<\epsilon<9$	0.00111	0.571	4.0	9.032	8.947	8.348	4.262	3.162
ChestX-ray14
$0<\epsilon<1$	0.00164	1.294	4.0	1.003	0.990	0.910	1.003	0.896
$1<\epsilon<3$	0.00164	0.787	4.0	2.993	2.944	2.490	2.993	2.796
$3<\epsilon<6$	0.00164	0.666	4.0	5.998	5.897	5.726	5.656	5.998
$6<\epsilon<9$	0.00164	0.606	4.0	9.002	8.914	7.920	7.827	8.291
PadChest
$0<\epsilon<1$	0.00161	1.282	4.0	0.991	0.965	0.978	0.438	0.438
$1<\epsilon<3$	0.00161	0.782	4.0	3.000	3.000	2.853	3.000	2.678
$3<\epsilon<6$	0.00161	0.663	4.0	6.003	5.935	5.969	5.834	5.592
$6<\epsilon<9$	0.00161	0.604	4.0	9.004	8.960	8.872	8.564	7.737
UKA-CXR
$0<\epsilon<1$	0.00093	1.057	4.0	0.995	0.995	0.928	0.976	0.985
$1<\epsilon<3$	0.00093	0.696	4.0	2.992	2.992	2.927	2.971	2.992
$3<\epsilon<6$	0.00093	0.605	4.0	5.951	6.013	5.291	6.013	6.013
$6<\epsilon<9$	0.00093	0.557	4.0	8.861	8.988	7.259	9.028	9.028

Supplementary Table 2: Optimization steps of every differentially private run of the main experiment. Each entry is the number of optimization steps taken up to the epoch selected as converged, which is the epoch of highest validation macro AUROC. Because the privacy budget accumulates with every step, this count is the quantity that determines the budget actually spent, reported alongside it in Supplementary Table 1. Rows are grouped by dataset and within each group ordered by target level from the strictest to the loosest; columns are ordered by increasing prior knowledge. All runs used a logical batch size of 128 and a 150-epoch budget. $\epsilon$, privacy budget; He, He (Kaiming) initialization; InDomain-stand, supervised pretraining on MIMIC-CXR; InDomain-priv, differentially private pretraining on MIMIC-CXR.

Target level	He	ImageNet	DINOv3	InDomain-stand	InDomain-priv
VinDr-CXR
$0<\epsilon<1$	4,756	4,756	4,524	116	4,756
$1<\epsilon<3$	6,148	6,844	5,220	116	4,756
$3<\epsilon<6$	10,208	10,092	8,468	10,324	4,756
$6<\epsilon<9$	12,180	11,252	7,772	10,440	2,436
CheXpert
$0<\epsilon<1$	36,080	36,080	24,354	12,628	902
$1<\epsilon<3$	45,100	45,100	41,492	12,628	902
$3<\epsilon<6$	73,062	73,062	73,062	12,628	902
$6<\epsilon<9$	90,200	88,396	75,768	9,020	902
ChestX-ray14
$0<\epsilon<1$	25,536	24,928	21,280	25,536	20,672
$1<\epsilon<3$	33,440	32,224	21,280	33,440	28,576
$3<\epsilon<6$	51,680	49,856	46,816	45,600	51,680
$6<\epsilon<9$	61,408	60,192	46,816	45,600	51,680
PadChest
$0<\epsilon<1$	25,502	24,258	24,880	622	622
$1<\epsilon<3$	34,210	34,210	30,478	34,210	26,124
$3<\epsilon<6$	52,870	51,626	52,248	49,760	45,406
$6<\epsilon<9$	62,822	62,200	60,956	56,602	45,406
UKA-CXR
$0<\epsilon<1$	38,772	38,772	31,233	36,618	37,695
$1<\epsilon<3$	49,542	49,542	46,311	48,465	49,542
$3<\epsilon<6$	85,083	87,237	63,543	87,237	87,237
$6<\epsilon<9$	102,315	105,546	63,543	106,623	106,623

Supplementary Table 3: Per-dataset values of the eight evaluation metrics, at the strictest privacy budget and without privacy, expanding the cross-dataset means of Table 2. Every value is macro-averaged over the five findings and given in percent as the bootstrap mean $\pm$ standard deviation with the 95% CI in brackets, from 10,000 resamples drawn at the resampling unit of that dataset. Test sets comprise 3,000 (VinDr-CXR), 29,321 (CheXpert), 25,596 (ChestX-ray14), 22,045 (PadChest), and 40,106 (UKA-CXR) radiographs. Higher is better for all metrics except the Brier score and ECE, for which lower is better. Accuracy, sensitivity, and specificity use the validation-derived per-label thresholds; the remaining five metrics are threshold-free. Rows are grouped by privacy setting and dataset, and within each group ordered by metric following the order used in Table 2; columns are ordered by increasing prior knowledge. AUPRC, area under the precision-recall curve; AUROC, area under the receiver operating characteristic curve; CI, confidence interval; ECE, expected calibration error; $\epsilon$, privacy budget; He, He (Kaiming) initialization; InDomain-stand, supervised pretraining on MIMIC-CXR; InDomain-priv, differentially private pretraining on MIMIC-CXR; mAP, mean average precision.

Metric	He	ImageNet	DINOv3	InDomain-stand	InDomain-priv
VinDr-CXR, $0<\epsilon<1$
AUROC	48.3 $\pm$ 1.0 [46.3, 50.2]	63.1 $\pm$ 1.1 [61.0, 65.3]	79.3 $\pm$ 1.1 [77.0, 81.4]	90.8 $\pm$ 0.5 [89.7, 91.8]	85.9 $\pm$ 0.9 [84.1, 87.5]
AUPRC	19.1 $\pm$ 0.3 [18.6, 19.7]	23.6 $\pm$ 0.5 [22.6, 24.6]	35.2 $\pm$ 1.0 [33.3, 37.2]	63.6 $\pm$ 1.5 [60.7, 66.5]	53.2 $\pm$ 1.8 [49.6, 56.8]
mAP	19.3 $\pm$ 0.3 [18.7, 19.8]	23.8 $\pm$ 0.5 [22.8, 24.9]	35.7 $\pm$ 1.0 [33.7, 37.8]	64.6 $\pm$ 1.5 [61.6, 67.6]	54.1 $\pm$ 1.9 [50.5, 57.7]
Accuracy	39.0 $\pm$ 0.3 [38.5, 39.6]	56.8 $\pm$ 0.5 [55.8, 57.8]	74.1 $\pm$ 0.6 [72.9, 75.3]	86.3 $\pm$ 0.4 [85.6, 87.0]	79.4 $\pm$ 0.5 [78.3, 80.4]
Sensitivity	66.4 $\pm$ 0.6 [65.1, 67.6]	60.9 $\pm$ 1.8 [57.2, 64.4]	77.6 $\pm$ 1.8 [74.0, 81.1]	85.1 $\pm$ 1.1 [82.8, 87.3]	80.0 $\pm$ 1.7 [76.7, 83.2]
Specificity	37.6 $\pm$ 0.4 [36.8, 38.3]	60.9 $\pm$ 0.6 [59.7, 62.0]	72.8 $\pm$ 0.5 [71.7, 73.9]	84.4 $\pm$ 0.3 [83.7, 85.0]	78.9 $\pm$ 0.5 [77.9, 79.9]
Brier score	10.1 $\pm$ 0.3 [9.5, 10.7]	9.4 $\pm$ 0.2 [9.0, 9.7]	8.5 $\pm$ 0.3 [7.9, 9.0]	6.9 $\pm$ 0.2 [6.6, 7.2]	7.4 $\pm$ 0.3 [7.0, 7.9]
ECE	8.3 $\pm$ 0.3 [7.6, 9.0]	7.9 $\pm$ 0.3 [7.2, 8.5]	7.7 $\pm$ 0.3 [7.2, 8.3]	8.6 $\pm$ 0.2 [8.3, 9.0]	7.0 $\pm$ 0.3 [6.5, 7.5]
CheXpert, $0<\epsilon<1$
AUROC	58.4 $\pm$ 0.3 [57.7, 59.0]	66.7 $\pm$ 0.3 [66.0, 67.3]	68.4 $\pm$ 0.3 [67.9, 69.0]	77.3 $\pm$ 0.3 [76.7, 77.8]	71.7 $\pm$ 0.3 [71.1, 72.3]
AUPRC	21.5 $\pm$ 0.3 [21.0, 22.0]	28.1 $\pm$ 0.4 [27.4, 28.8]	33.7 $\pm$ 0.4 [33.0, 34.4]	42.0 $\pm$ 0.4 [41.2, 42.8]	35.6 $\pm$ 0.4 [34.8, 36.3]
mAP	21.5 $\pm$ 0.3 [21.0, 22.0]	28.1 $\pm$ 0.4 [27.4, 28.8]	33.7 $\pm$ 0.4 [33.0, 34.4]	42.1 $\pm$ 0.4 [41.3, 42.9]	35.6 $\pm$ 0.4 [34.9, 36.3]
Accuracy	64.5 $\pm$ 0.2 [64.2, 64.8]	55.8 $\pm$ 0.2 [55.4, 56.1]	70.8 $\pm$ 0.2 [70.4, 71.2]	69.4 $\pm$ 0.2 [69.0, 69.8]	63.0 $\pm$ 0.2 [62.6, 63.4]
Sensitivity	45.2 $\pm$ 0.5 [44.2, 46.1]	70.7 $\pm$ 0.6 [69.6, 71.7]	57.5 $\pm$ 0.5 [56.6, 58.4]	73.3 $\pm$ 0.5 [72.3, 74.2]	70.3 $\pm$ 0.5 [69.3, 71.3]
Specificity	66.5 $\pm$ 0.2 [66.1, 66.8]	54.1 $\pm$ 0.3 [53.6, 54.6]	70.8 $\pm$ 0.3 [70.2, 71.3]	68.7 $\pm$ 0.2 [68.3, 69.2]	62.1 $\pm$ 0.3 [61.5, 62.7]
Brier score	13.6 $\pm$ 0.1 [13.5, 13.7]	12.2 $\pm$ 0.1 [12.1, 12.3]	11.0 $\pm$ 0.1 [10.8, 11.1]	10.2 $\pm$ 0.1 [10.0, 10.4]	11.2 $\pm$ 0.1 [11.1, 11.4]
ECE	9.6 $\pm$ 0.1 [9.4, 9.9]	7.6 $\pm$ 0.1 [7.4, 7.9]	5.4 $\pm$ 0.1 [5.3, 5.6]	7.5 $\pm$ 0.1 [7.4, 7.7]	8.3 $\pm$ 0.1 [8.0, 8.5]
ChestX-ray14, $0<\epsilon<1$
AUROC	51.0 $\pm$ 0.4 [50.2, 51.8]	59.2 $\pm$ 0.6 [58.0, 60.3]	63.7 $\pm$ 0.5 [62.6, 64.8]	73.7 $\pm$ 0.5 [72.7, 74.7]	67.9 $\pm$ 0.5 [66.9, 69.0]
AUPRC	15.7 $\pm$ 0.2 [15.3, 16.2]	19.9 $\pm$ 0.4 [19.1, 20.7]	24.1 $\pm$ 0.4 [23.2, 25.0]	32.9 $\pm$ 0.7 [31.7, 34.2]	27.5 $\pm$ 0.6 [26.5, 28.7]
mAP	15.8 $\pm$ 0.2 [15.3, 16.3]	20.0 $\pm$ 0.4 [19.2, 20.8]	24.1 $\pm$ 0.4 [23.3, 25.0]	33.0 $\pm$ 0.7 [31.7, 34.3]	27.6 $\pm$ 0.6 [26.5, 28.7]
Accuracy	51.9 $\pm$ 0.2 [51.5, 52.2]	39.0 $\pm$ 0.6 [37.8, 40.2]	39.0 $\pm$ 0.6 [37.8, 40.2]	58.2 $\pm$ 0.6 [57.0, 59.5]	42.0 $\pm$ 0.6 [40.8, 43.3]
Sensitivity	48.3 $\pm$ 0.6 [47.2, 49.4]	76.2 $\pm$ 0.6 [74.9, 77.3]	81.0 $\pm$ 0.5 [80.0, 82.0]	73.3 $\pm$ 0.6 [72.1, 74.6]	80.8 $\pm$ 0.5 [79.8, 81.7]
Specificity	53.7 $\pm$ 0.2 [53.3, 54.1]	37.8 $\pm$ 0.6 [36.7, 39.0]	37.7 $\pm$ 0.6 [36.5, 38.8]	59.1 $\pm$ 0.7 [57.8, 60.5]	41.1 $\pm$ 0.6 [39.9, 42.3]
Brier score	16.7 $\pm$ 0.3 [16.2, 17.2]	12.5 $\pm$ 0.2 [12.2, 12.9]	12.2 $\pm$ 0.2 [11.9, 12.5]	11.6 $\pm$ 0.1 [11.3, 11.9]	12.2 $\pm$ 0.2 [11.9, 12.5]
ECE	15.9 $\pm$ 0.3 [15.4, 16.5]	9.1 $\pm$ 0.3 [8.6, 9.7]	8.4 $\pm$ 0.2 [8.1, 8.8]	8.9 $\pm$ 0.2 [8.6, 9.2]	8.7 $\pm$ 0.2 [8.3, 9.0]
PadChest, $0<\epsilon<1$
AUROC	61.3 $\pm$ 0.3 [60.6, 61.9]	74.9 $\pm$ 0.3 [74.3, 75.4]	75.7 $\pm$ 0.3 [75.1, 76.2]	84.6 $\pm$ 0.2 [84.1, 85.1]	78.7 $\pm$ 0.3 [78.2, 79.2]
AUPRC	16.6 $\pm$ 0.2 [16.2, 17.0]	24.5 $\pm$ 0.3 [23.9, 25.0]	29.2 $\pm$ 0.4 [28.5, 30.0]	43.3 $\pm$ 0.5 [42.4, 44.3]	33.3 $\pm$ 0.4 [32.5, 34.2]
mAP	16.7 $\pm$ 0.2 [16.3, 17.1]	24.5 $\pm$ 0.3 [24.0, 25.1]	29.4 $\pm$ 0.4 [28.6, 30.1]	43.5 $\pm$ 0.5 [42.5, 44.5]	33.4 $\pm$ 0.4 [32.6, 34.2]
Accuracy	47.4 $\pm$ 0.1 [47.2, 47.7]	68.8 $\pm$ 0.2 [68.4, 69.2]	70.4 $\pm$ 0.2 [70.0, 70.8]	76.0 $\pm$ 0.2 [75.7, 76.3]	71.5 $\pm$ 0.2 [71.1, 71.8]
Sensitivity	70.1 $\pm$ 0.5 [69.2, 71.1]	71.3 $\pm$ 0.5 [70.3, 72.3]	70.1 $\pm$ 0.5 [69.0, 71.2]	80.2 $\pm$ 0.5 [79.2, 81.0]	76.1 $\pm$ 0.5 [75.1, 77.1]
Specificity	45.8 $\pm$ 0.1 [45.6, 46.1]	68.5 $\pm$ 0.2 [68.1, 68.9]	71.1 $\pm$ 0.2 [70.7, 71.6]	75.0 $\pm$ 0.1 [74.7, 75.3]	70.4 $\pm$ 0.2 [70.1, 70.8]
Brier score	10.0 $\pm$ 0.1 [9.9, 10.2]	7.9 $\pm$ 0.1 [7.8, 8.0]	9.2 $\pm$ 0.1 [9.1, 9.4]	7.9 $\pm$ 0.1 [7.8, 8.0]	9.0 $\pm$ 0.1 [8.8, 9.1]
ECE	7.5 $\pm$ 0.1 [7.3, 7.6]	2.3 $\pm$ 0.1 [2.1, 2.5]	7.9 $\pm$ 0.1 [7.8, 8.1]	6.6 $\pm$ 0.1 [6.5, 6.8]	7.3 $\pm$ 0.1 [7.1, 7.5]
UKA-CXR, $0<\epsilon<1$
AUROC	66.1 $\pm$ 0.2 [65.7, 66.5]	73.2 $\pm$ 0.2 [72.9, 73.6]	79.9 $\pm$ 0.2 [79.6, 80.2]	83.5 $\pm$ 0.1 [83.3, 83.8]	81.0 $\pm$ 0.2 [80.7, 81.3]
AUPRC	36.7 $\pm$ 0.2 [36.3, 37.2]	43.5 $\pm$ 0.3 [43.0, 44.0]	53.5 $\pm$ 0.3 [53.0, 54.1]	61.0 $\pm$ 0.3 [60.4, 61.5]	56.4 $\pm$ 0.3 [55.8, 57.0]
mAP	36.8 $\pm$ 0.2 [36.3, 37.2]	43.5 $\pm$ 0.3 [43.0, 44.0]	53.6 $\pm$ 0.3 [53.0, 54.1]	61.0 $\pm$ 0.3 [60.4, 61.6]	56.5 $\pm$ 0.3 [55.9, 57.1]
Accuracy	62.0 $\pm$ 0.1 [61.7, 62.3]	67.1 $\pm$ 0.1 [66.8, 67.4]	71.5 $\pm$ 0.1 [71.2, 71.7]	75.1 $\pm$ 0.1 [74.8, 75.3]	73.7 $\pm$ 0.1 [73.4, 73.9]
Sensitivity	62.1 $\pm$ 0.3 [61.5, 62.7]	69.1 $\pm$ 0.3 [68.6, 69.7]	75.2 $\pm$ 0.3 [74.7, 75.7]	77.6 $\pm$ 0.2 [77.2, 78.1]	73.8 $\pm$ 0.3 [73.2, 74.3]
Specificity	61.8 $\pm$ 0.2 [61.5, 62.1]	65.5 $\pm$ 0.2 [65.2, 65.8]	71.0 $\pm$ 0.2 [70.7, 71.4]	74.4 $\pm$ 0.1 [74.2, 74.7]	73.5 $\pm$ 0.1 [73.2, 73.8]
Brier score	18.2 $\pm$ 0.1 [18.1, 18.4]	15.6 $\pm$ 0.1 [15.5, 15.7]	16.3 $\pm$ 0.1 [16.1, 16.5]	14.8 $\pm$ 0.1 [14.6, 14.9]	15.7 $\pm$ 0.1 [15.6, 15.9]
ECE	11.7 $\pm$ 0.1 [11.4, 11.9]	6.4 $\pm$ 0.1 [6.3, 6.6]	13.1 $\pm$ 0.1 [12.9, 13.3]	12.3 $\pm$ 0.1 [12.1, 12.4]	12.5 $\pm$ 0.1 [12.3, 12.7]
VinDr-CXR, Non-private
AUROC	78.4 $\pm$ 1.2 [76.1, 80.7]	89.9 $\pm$ 0.7 [88.5, 91.1]	91.9 $\pm$ 0.6 [90.8, 93.0]	95.8 $\pm$ 0.4 [95.0, 96.5]	90.8 $\pm$ 0.6 [89.6, 91.9]
AUPRC	36.4 $\pm$ 1.2 [34.2, 38.9]	56.6 $\pm$ 1.7 [53.2, 59.9]	62.9 $\pm$ 1.4 [60.2, 65.6]	71.8 $\pm$ 1.6 [68.5, 74.9]	60.2 $\pm$ 1.5 [57.1, 63.2]
mAP	37.1 $\pm$ 1.2 [34.8, 39.6]	57.3 $\pm$ 1.7 [53.9, 60.7]	63.7 $\pm$ 1.4 [60.9, 66.4]	72.7 $\pm$ 1.6 [69.5, 75.9]	61.0 $\pm$ 1.6 [57.9, 64.0]
Accuracy	75.6 $\pm$ 0.6 [74.5, 76.7]	82.3 $\pm$ 0.4 [81.4, 83.2]	87.3 $\pm$ 0.4 [86.5, 88.0]	89.4 $\pm$ 0.3 [88.8, 90.0]	86.2 $\pm$ 0.4 [85.5, 86.9]
Sensitivity	70.8 $\pm$ 2.0 [66.9, 74.7]	86.9 $\pm$ 1.2 [84.6, 89.2]	86.0 $\pm$ 1.4 [83.2, 88.6]	93.0 $\pm$ 0.8 [91.2, 94.5]	84.4 $\pm$ 1.4 [81.7, 87.0]
Specificity	74.8 $\pm$ 0.5 [73.9, 75.8]	80.8 $\pm$ 0.4 [80.0, 81.6]	86.4 $\pm$ 0.4 [85.7, 87.1]	88.3 $\pm$ 0.3 [87.7, 88.9]	84.6 $\pm$ 0.4 [83.8, 85.2]
Brier score	11.0 $\pm$ 0.3 [10.5, 11.5]	7.7 $\pm$ 0.2 [7.3, 8.1]	7.1 $\pm$ 0.2 [6.7, 7.5]	5.6 $\pm$ 0.2 [5.3, 6.0]	10.8 $\pm$ 0.2 [10.4, 11.3]
ECE	12.8 $\pm$ 0.3 [12.2, 13.3]	7.9 $\pm$ 0.3 [7.4, 8.4]	6.3 $\pm$ 0.3 [5.8, 6.8]	5.1 $\pm$ 0.2 [4.7, 5.6]	14.3 $\pm$ 0.3 [13.7, 14.9]
CheXpert, Non-private
AUROC	75.3 $\pm$ 0.3 [74.7, 75.8]	81.1 $\pm$ 0.3 [80.6, 81.6]	82.1 $\pm$ 0.2 [81.6, 82.6]	82.7 $\pm$ 0.2 [82.3, 83.2]	81.4 $\pm$ 0.2 [80.9, 81.9]
AUPRC	37.7 $\pm$ 0.4 [36.9, 38.4]	44.8 $\pm$ 0.4 [43.9, 45.6]	46.7 $\pm$ 0.4 [45.9, 47.6]	48.1 $\pm$ 0.5 [47.2, 49.0]	45.6 $\pm$ 0.4 [44.8, 46.4]
mAP	37.7 $\pm$ 0.4 [36.9, 38.5]	44.9 $\pm$ 0.4 [44.0, 45.7]	46.8 $\pm$ 0.4 [46.0, 47.7]	48.2 $\pm$ 0.5 [47.3, 49.1]	45.7 $\pm$ 0.4 [44.9, 46.5]
Accuracy	68.5 $\pm$ 0.1 [68.2, 68.7]	70.7 $\pm$ 0.1 [70.5, 71.0]	74.4 $\pm$ 0.1 [74.1, 74.7]	73.8 $\pm$ 0.1 [73.5, 74.0]	75.3 $\pm$ 0.1 [75.0, 75.6]
Sensitivity	70.6 $\pm$ 0.5 [69.7, 71.6]	79.1 $\pm$ 0.4 [78.2, 79.9]	76.3 $\pm$ 0.4 [75.5, 77.2]	78.4 $\pm$ 0.4 [77.6, 79.3]	74.4 $\pm$ 0.5 [73.5, 75.3]
Specificity	67.5 $\pm$ 0.2 [67.1, 67.8]	69.2 $\pm$ 0.2 [68.9, 69.5]	73.8 $\pm$ 0.2 [73.5, 74.1]	72.5 $\pm$ 0.2 [72.2, 72.8]	74.7 $\pm$ 0.2 [74.4, 75.0]
Brier score	19.6 $\pm$ 0.1 [19.5, 19.7]	16.0 $\pm$ 0.1 [15.9, 16.1]	16.4 $\pm$ 0.1 [16.3, 16.5]	16.0 $\pm$ 0.1 [15.9, 16.1]	15.9 $\pm$ 0.1 [15.8, 16.1]
ECE	25.1 $\pm$ 0.1 [24.9, 25.3]	20.6 $\pm$ 0.1 [20.4, 20.8]	21.8 $\pm$ 0.1 [21.6, 22.0]	20.8 $\pm$ 0.1 [20.5, 21.0]	20.7 $\pm$ 0.1 [20.4, 20.9]
ChestX-ray14, Non-private
AUROC	69.9 $\pm$ 0.5 [68.9, 70.9]	76.1 $\pm$ 0.4 [75.3, 76.9]	77.4 $\pm$ 0.4 [76.6, 78.2]	79.4 $\pm$ 0.4 [78.6, 80.1]	76.2 $\pm$ 0.5 [75.3, 77.1]
AUPRC	27.6 $\pm$ 0.6 [26.4, 28.8]	34.8 $\pm$ 0.7 [33.5, 36.1]	37.1 $\pm$ 0.7 [35.7, 38.5]	39.3 $\pm$ 0.7 [37.9, 40.7]	35.3 $\pm$ 0.8 [33.8, 36.8]
mAP	27.6 $\pm$ 0.6 [26.4, 28.9]	34.9 $\pm$ 0.7 [33.6, 36.2]	37.2 $\pm$ 0.7 [35.8, 38.6]	39.4 $\pm$ 0.7 [38.0, 40.8]	35.4 $\pm$ 0.8 [33.9, 36.8]
Accuracy	53.2 $\pm$ 0.6 [52.0, 54.3]	60.5 $\pm$ 0.4 [59.6, 61.4]	63.0 $\pm$ 0.5 [62.0, 64.0]	61.8 $\pm$ 0.5 [60.8, 62.9]	58.7 $\pm$ 0.5 [57.7, 59.7]
Sensitivity	75.1 $\pm$ 0.7 [73.8, 76.3]	76.3 $\pm$ 0.6 [75.0, 77.5]	75.5 $\pm$ 0.6 [74.3, 76.7]	77.7 $\pm$ 0.5 [76.6, 78.7]	77.2 $\pm$ 0.6 [76.1, 78.4]
Specificity	52.4 $\pm$ 0.6 [51.3, 53.5]	61.2 $\pm$ 0.5 [60.3, 62.2]	64.0 $\pm$ 0.5 [63.0, 65.1]	63.3 $\pm$ 0.6 [62.1, 64.4]	59.6 $\pm$ 0.5 [58.5, 60.7]
Brier score	23.9 $\pm$ 0.3 [23.4, 24.5]	23.4 $\pm$ 0.2 [22.9, 23.9]	22.6 $\pm$ 0.3 [22.0, 23.2]	24.3 $\pm$ 0.3 [23.7, 24.9]	22.0 $\pm$ 0.3 [21.4, 22.6]
ECE	29.8 $\pm$ 0.4 [29.0, 30.5]	27.7 $\pm$ 0.3 [27.1, 28.3]	26.2 $\pm$ 0.4 [25.5, 26.9]	30.1 $\pm$ 0.4 [29.4, 30.9]	26.8 $\pm$ 0.4 [26.0, 27.5]
PadChest, Non-private
AUROC	81.6 $\pm$ 0.3 [81.1, 82.1]	88.2 $\pm$ 0.2 [87.8, 88.6]	89.2 $\pm$ 0.2 [88.8, 89.6]	89.6 $\pm$ 0.2 [89.2, 90.0]	88.4 $\pm$ 0.2 [88.0, 88.8]
AUPRC	36.4 $\pm$ 0.5 [35.5, 37.4]	50.2 $\pm$ 0.5 [49.1, 51.2]	53.1 $\pm$ 0.6 [52.0, 54.2]	54.6 $\pm$ 0.6 [53.5, 55.7]	51.0 $\pm$ 0.5 [49.9, 52.0]
mAP	36.6 $\pm$ 0.5 [35.6, 37.5]	50.3 $\pm$ 0.5 [49.2, 51.4]	53.2 $\pm$ 0.6 [52.1, 54.3]	54.7 $\pm$ 0.6 [53.6, 55.8]	51.1 $\pm$ 0.5 [50.1, 52.2]
Accuracy	73.7 $\pm$ 0.2 [73.4, 74.0]	80.5 $\pm$ 0.1 [80.2, 80.7]	80.9 $\pm$ 0.1 [80.6, 81.1]	82.7 $\pm$ 0.1 [82.5, 82.9]	80.3 $\pm$ 0.1 [80.0, 80.6]
Sensitivity	76.4 $\pm$ 0.5 [75.5, 77.4]	82.2 $\pm$ 0.4 [81.3, 83.1]	84.1 $\pm$ 0.4 [83.3, 84.9]	82.0 $\pm$ 0.4 [81.1, 82.8]	82.5 $\pm$ 0.4 [81.7, 83.4]
Specificity	72.7 $\pm$ 0.1 [72.4, 73.0]	79.9 $\pm$ 0.1 [79.7, 80.2]	80.4 $\pm$ 0.1 [80.1, 80.6]	82.9 $\pm$ 0.1 [82.7, 83.1]	79.8 $\pm$ 0.1 [79.5, 80.1]
Brier score	17.8 $\pm$ 0.1 [17.6, 17.9]	12.3 $\pm$ 0.1 [12.2, 12.4]	11.6 $\pm$ 0.1 [11.5, 11.8]	13.8 $\pm$ 0.1 [13.7, 14.0]	11.8 $\pm$ 0.1 [11.7, 12.0]
ECE	24.6 $\pm$ 0.1 [24.4, 24.8]	16.2 $\pm$ 0.1 [16.0, 16.4]	13.9 $\pm$ 0.1 [13.7, 14.1]	18.7 $\pm$ 0.1 [18.5, 18.9]	15.1 $\pm$ 0.1 [14.9, 15.3]
UKA-CXR, Non-private
AUROC	84.0 $\pm$ 0.1 [83.8, 84.3]	88.3 $\pm$ 0.1 [88.0, 88.5]	88.8 $\pm$ 0.1 [88.6, 89.0]	88.8 $\pm$ 0.1 [88.5, 89.0]	88.4 $\pm$ 0.1 [88.2, 88.6]
AUPRC	61.2 $\pm$ 0.3 [60.6, 61.8]	70.2 $\pm$ 0.3 [69.7, 70.8]	71.3 $\pm$ 0.3 [70.7, 71.8]	71.2 $\pm$ 0.3 [70.7, 71.8]	70.5 $\pm$ 0.3 [69.9, 71.0]
mAP	61.3 $\pm$ 0.3 [60.7, 61.8]	70.3 $\pm$ 0.3 [69.7, 70.8]	71.3 $\pm$ 0.3 [70.7, 71.8]	71.3 $\pm$ 0.3 [70.8, 71.8]	70.5 $\pm$ 0.3 [69.9, 71.0]
Accuracy	72.9 $\pm$ 0.1 [72.7, 73.2]	78.3 $\pm$ 0.1 [78.1, 78.5]	78.8 $\pm$ 0.1 [78.6, 79.0]	79.0 $\pm$ 0.1 [78.8, 79.2]	78.4 $\pm$ 0.1 [78.1, 78.6]
Sensitivity	78.8 $\pm$ 0.2 [78.4, 79.2]	81.6 $\pm$ 0.2 [81.2, 82.0]	82.5 $\pm$ 0.2 [82.1, 82.9]	81.9 $\pm$ 0.2 [81.5, 82.3]	82.3 $\pm$ 0.2 [81.9, 82.7]
Specificity	72.4 $\pm$ 0.1 [72.1, 72.6]	78.0 $\pm$ 0.1 [77.8, 78.2]	78.2 $\pm$ 0.1 [78.0, 78.5]	78.8 $\pm$ 0.1 [78.6, 79.0]	77.6 $\pm$ 0.1 [77.4, 77.9]
Brier score	16.5 $\pm$ 0.1 [16.4, 16.7]	14.3 $\pm$ 0.1 [14.2, 14.5]	14.4 $\pm$ 0.1 [14.2, 14.5]	14.3 $\pm$ 0.1 [14.2, 14.4]	14.8 $\pm$ 0.1 [14.7, 15.0]
ECE	14.7 $\pm$ 0.1 [14.5, 14.8]	12.7 $\pm$ 0.1 [12.6, 12.9]	13.9 $\pm$ 0.1 [13.8, 14.1]	13.5 $\pm$ 0.1 [13.3, 13.7]	13.5 $\pm$ 0.1 [13.4, 13.7]

Supplementary Table 4: AUROC in percent for each individual finding, at the strictest privacy budget and without privacy. Values are bootstrap means. Rows are grouped by privacy setting and dataset, and within each group ordered by finding following the order used throughout the paper; columns are ordered by increasing prior knowledge. AUROC, area under the receiver operating characteristic curve; $\epsilon$, privacy budget; He, He (Kaiming) initialization; InDomain-stand, supervised pretraining on MIMIC-CXR; InDomain-priv, differentially private pretraining on MIMIC-CXR.

Finding	He	ImageNet	DINOv3	InDomain-stand	InDomain-priv
VinDr-CXR, $0<\epsilon<1$
Atelectasis	45.4	64.5	74.3	89.3	81.9
Cardiomegaly	52.3	70.6	86.5	94.6	92.0
Pleural effusion	43.4	66.5	78.7	98.1	88.1
Pneumonia	45.6	49.9	73.8	84.7	81.5
No finding	54.8	64.2	83.2	87.4	85.8
CheXpert, $0<\epsilon<1$
Atelectasis	53.0	58.2	56.8	65.8	62.3
Cardiomegaly	59.0	63.8	75.0	84.7	78.2
Pleural effusion	64.3	75.8	80.3	86.9	83.2
Pneumonia	50.0	55.0	51.2	64.3	54.8
No finding	65.6	80.5	78.9	84.6	80.2
ChestX-ray14, $0<\epsilon<1$
Atelectasis	50.5	56.5	64.1	73.8	67.4
Cardiomegaly	49.3	55.1	56.4	77.5	67.9
Pleural effusion	53.6	65.0	72.2	81.1	76.5
Pneumonia	50.8	55.8	58.0	64.7	58.7
No finding	50.8	63.5	67.8	71.3	69.1
PadChest, $0<\epsilon<1$
Atelectasis	51.6	68.0	66.8	81.0	72.9
Cardiomegaly	59.3	75.9	83.3	86.0	81.1
Pleural effusion	68.1	85.2	87.1	95.4	92.6
Pneumonia	63.4	66.1	65.3	77.6	68.7
No finding	63.8	79.2	75.8	83.0	78.1
UKA-CXR, $0<\epsilon<1$
Atelectasis	63.0	72.5	79.5	82.1	80.3
Cardiomegaly	66.2	71.2	77.4	81.6	79.6
Pleural effusion	68.9	77.8	82.5	86.7	84.8
Pneumonia	63.6	69.0	81.6	84.9	80.3
No finding	68.9	75.6	78.4	82.3	79.8
VinDr-CXR, Non-private
Atelectasis	70.1	84.6	87.8	93.7	86.0
Cardiomegaly	85.2	93.3	95.0	97.5	94.6
Pleural effusion	78.0	95.4	97.3	98.6	96.6
Pneumonia	78.4	87.1	89.6	94.8	87.5
No finding	80.6	89.0	89.9	94.3	89.3
CheXpert, Non-private
Atelectasis	63.9	68.5	69.4	70.5	68.9
Cardiomegaly	83.4	87.0	87.8	88.3	87.3
Pleural effusion	81.1	87.0	88.4	88.8	88.0
Pneumonia	64.1	75.5	77.0	77.9	75.3
No finding	83.9	87.4	88.0	88.2	87.4
ChestX-ray14, Non-private
Atelectasis	67.1	74.4	76.9	78.8	74.2
Cardiomegaly	81.3	86.9	89.0	89.8	88.3
Pleural effusion	72.8	80.6	82.0	83.5	80.8
Pneumonia	60.7	67.5	67.6	71.7	66.9
No finding	67.4	71.1	71.7	73.0	70.8
PadChest, Non-private
Atelectasis	73.1	83.7	86.1	86.8	84.3
Cardiomegaly	89.2	92.4	92.6	93.0	92.4
Pleural effusion	91.3	95.5	95.8	96.1	95.4
Pneumonia	74.4	83.7	85.0	85.8	84.0
No finding	80.0	85.7	86.5	86.4	85.8
UKA-CXR, Non-private
Atelectasis	83.3	86.1	86.8	86.4	86.3
Cardiomegaly	81.3	85.2	85.9	86.0	85.7
Pleural effusion	87.4	91.2	91.7	91.8	91.5
Pneumonia	84.9	92.3	92.5	92.6	91.9
No finding	83.4	86.4	86.9	87.0	86.7

Supplementary Table 5: Leave-one-dataset-out generalization to unseen institutions. Each dataset in turn was held out, the model was trained on the remaining four, and macro AUROC in percent was measured on the held-out test set. Values are the bootstrap mean $\pm$ standard deviation with the 95% CI in brackets. Rows are grouped by privacy setting and within each group ordered by dataset following the order of presentation in the main text; columns are ordered by increasing prior knowledge. AUROC, area under the receiver operating characteristic curve; CI, confidence interval; $\epsilon$, privacy budget; He, He (Kaiming) initialization; InDomain-stand, supervised pretraining on MIMIC-CXR; InDomain-priv, differentially private pretraining on MIMIC-CXR.

Held-out dataset	He	ImageNet	DINOv3	InDomain-stand	InDomain-priv
$0<\epsilon<1$
VinDr-CXR	49.9 $\pm$ 1.0 [47.9, 51.9]	63.6 $\pm$ 1.0 [61.5, 65.6]	73.9 $\pm$ 1.1 [71.7, 76.1]	88.6 $\pm$ 0.6 [87.3, 89.8]	79.8 $\pm$ 0.9 [78.1, 81.5]
CheXpert	53.0 $\pm$ 0.3 [52.4, 53.6]	62.1 $\pm$ 0.3 [61.5, 62.8]	65.9 $\pm$ 0.3 [65.3, 66.5]	74.2 $\pm$ 0.3 [73.7, 74.8]	68.7 $\pm$ 0.3 [68.1, 69.3]
ChestX-ray14	51.6 $\pm$ 0.5 [50.7, 52.5]	57.8 $\pm$ 0.6 [56.7, 59.0]	61.1 $\pm$ 0.6 [59.9, 62.3]	72.8 $\pm$ 0.5 [71.8, 73.8]	65.5 $\pm$ 0.6 [64.3, 66.7]
PadChest	49.8 $\pm$ 0.4 [49.1, 50.5]	66.3 $\pm$ 0.3 [65.7, 66.9]	73.5 $\pm$ 0.3 [72.9, 74.1]	80.0 $\pm$ 0.3 [79.5, 80.6]	76.7 $\pm$ 0.3 [76.2, 77.3]
UKA-CXR	51.9 $\pm$ 0.2 [51.6, 52.3]	67.7 $\pm$ 0.2 [67.3, 68.1]	61.4 $\pm$ 0.2 [61.1, 61.7]	66.3 $\pm$ 0.1 [66.0, 66.6]	62.3 $\pm$ 0.2 [62.0, 62.6]
Non-private
VinDr-CXR	78.1 $\pm$ 0.9 [76.3, 79.8]	89.3 $\pm$ 0.5 [88.2, 90.3]	89.6 $\pm$ 0.5 [88.6, 90.6]	90.0 $\pm$ 0.5 [89.0, 90.9]	89.2 $\pm$ 0.5 [88.1, 90.2]
CheXpert	70.1 $\pm$ 0.3 [69.5, 70.7]	74.7 $\pm$ 0.3 [74.1, 75.2]	76.0 $\pm$ 0.3 [75.4, 76.6]	77.0 $\pm$ 0.3 [76.4, 77.5]	76.4 $\pm$ 0.3 [75.9, 77.0]
ChestX-ray14	67.4 $\pm$ 0.5 [66.3, 68.4]	75.8 $\pm$ 0.5 [74.9, 76.7]	77.6 $\pm$ 0.4 [76.8, 78.5]	77.6 $\pm$ 0.4 [76.8, 78.4]	75.2 $\pm$ 0.5 [74.2, 76.2]
PadChest	76.6 $\pm$ 0.3 [76.1, 77.2]	81.4 $\pm$ 0.3 [80.9, 81.9]	82.4 $\pm$ 0.3 [81.9, 82.9]	83.5 $\pm$ 0.3 [83.0, 84.0]	79.8 $\pm$ 0.3 [79.3, 80.4]
UKA-CXR	69.2 $\pm$ 0.2 [68.9, 69.5]	71.4 $\pm$ 0.1 [71.1, 71.7]	72.0 $\pm$ 0.2 [71.7, 72.3]	72.7 $\pm$ 0.1 [72.4, 73.0]	70.5 $\pm$ 0.2 [70.2, 70.8]

Supplementary Table 6: Effect of backbone capacity on macro AUROC in percent. ConvNeXt-Tiny has 27.8 million parameters and ConvNeXt-Small 49.5 million. Values are the bootstrap mean $\pm$ standard deviation with the 95% CI in brackets, and $\Delta$ is the Small minus Tiny difference in points. Rows are grouped by dataset and privacy setting, and within each group the initializations are ordered by increasing prior knowledge. The two in-domain initializations were released for the Small backbone only and are therefore not included. AUROC, area under the receiver operating characteristic curve; CI, confidence interval; $\epsilon$, privacy budget; He, He (Kaiming) initialization.

Initialization	ConvNeXt-Tiny	ConvNeXt-Small	$\Delta$
VinDr-CXR, $0<\epsilon<1$
He	49.0 $\pm$ 1.0 [47.0, 51.1]	48.3 $\pm$ 1.0 [46.3, 50.2]	-0.7
ImageNet	64.9 $\pm$ 1.1 [62.6, 67.1]	63.1 $\pm$ 1.1 [61.0, 65.3]	-1.8
DINOv3	72.8 $\pm$ 1.2 [70.5, 75.1]	79.3 $\pm$ 1.1 [77.0, 81.4]	+6.5
VinDr-CXR, Non-private
He	79.8 $\pm$ 1.1 [77.5, 81.9]	78.4 $\pm$ 1.2 [76.1, 80.7]	-1.4
ImageNet	90.1 $\pm$ 0.7 [88.7, 91.4]	89.9 $\pm$ 0.7 [88.5, 91.1]	-0.2
DINOv3	92.4 $\pm$ 0.5 [91.4, 93.4]	91.9 $\pm$ 0.6 [90.8, 93.0]	-0.5
CheXpert, $0<\epsilon<1$
He	54.6 $\pm$ 0.3 [54.0, 55.1]	58.4 $\pm$ 0.3 [57.7, 59.0]	+3.8
ImageNet	65.6 $\pm$ 0.3 [65.0, 66.2]	66.7 $\pm$ 0.3 [66.0, 67.3]	+1.1
DINOv3	69.6 $\pm$ 0.3 [69.1, 70.2]	68.4 $\pm$ 0.3 [67.9, 69.0]	-1.2
CheXpert, Non-private
He	75.0 $\pm$ 0.3 [74.4, 75.5]	75.3 $\pm$ 0.3 [74.7, 75.8]	+0.3
ImageNet	81.1 $\pm$ 0.2 [80.6, 81.6]	81.1 $\pm$ 0.3 [80.6, 81.6]	+0.0
DINOv3	81.8 $\pm$ 0.2 [81.3, 82.3]	82.1 $\pm$ 0.2 [81.6, 82.6]	+0.3

Supplementary Table 7: Macro AUROC in percent within each demographic subgroup of every external test set at the strictest privacy budget, $0<\epsilon<1$. Values are the bootstrap mean $\pm$ standard deviation with the 95% CI in brackets. Rows are grouped by dataset and within each group ordered by sex and then by age band; columns are ordered by increasing prior knowledge. Radiographs without a recorded attribute contribute to no subgroup, so subgroup sizes are smaller than the corresponding test set; those sizes are given in Supplementary Table 12 and the reasons in Supplementary Note Supplementary Note 1: dataset curation and label harmonization. AUROC, area under the receiver operating characteristic curve; CI, confidence interval; $\epsilon$, privacy budget; He, He (Kaiming) initialization; InDomain-stand, supervised pretraining on MIMIC-CXR; InDomain-priv, differentially private pretraining on MIMIC-CXR.

Subgroup	He	ImageNet	DINOv3	InDomain-stand	InDomain-priv
VinDr-CXR
Male	48.7 $\pm$ 1.8 [45.1, 52.3]	61.9 $\pm$ 2.1 [57.7, 66.1]	78.8 $\pm$ 2.0 [74.9, 82.4]	87.8 $\pm$ 1.1 [85.5, 89.8]	83.9 $\pm$ 1.6 [80.6, 87.0]
Female	48.2 $\pm$ 2.3 [43.7, 52.9]	63.9 $\pm$ 2.6 [58.6, 68.8]	74.4 $\pm$ 3.0 [68.3, 80.1]	88.4 $\pm$ 1.6 [85.0, 91.2]	83.6 $\pm$ 2.2 [79.0, 87.6]
Age $<$40	59.2 $\pm$ 5.6 [49.1, 69.8]	44.2 $\pm$ 4.3 [36.5, 53.2]	73.2 $\pm$ 5.6 [59.3, 82.2]	87.6 $\pm$ 4.4 [75.9, 93.9]	77.2 $\pm$ 6.7 [60.8, 87.5]
Age 40–70	51.7 $\pm$ 2.8 [46.1, 57.2]	58.9 $\pm$ 3.1 [52.7, 65.0]	71.9 $\pm$ 3.6 [64.7, 78.4]	88.1 $\pm$ 1.6 [84.8, 91.0]	79.7 $\pm$ 2.7 [74.0, 84.7]
Age $>$70	45.8 $\pm$ 7.0 [32.8, 60.4]	58.8 $\pm$ 5.9 [47.4, 70.9]	64.7 $\pm$ 7.1 [49.6, 77.4]	88.1 $\pm$ 2.8 [82.3, 93.2]	65.2 $\pm$ 6.2 [52.4, 76.9]
CheXpert
Male	59.3 $\pm$ 0.4 [58.5, 60.1]	67.1 $\pm$ 0.4 [66.3, 67.9]	68.4 $\pm$ 0.4 [67.6, 69.1]	77.7 $\pm$ 0.4 [77.0, 78.4]	71.0 $\pm$ 0.4 [70.3, 71.8]
Female	57.9 $\pm$ 0.5 [56.9, 58.9]	66.0 $\pm$ 0.5 [64.9, 67.0]	68.5 $\pm$ 0.5 [67.6, 69.5]	76.6 $\pm$ 0.4 [75.8, 77.5]	72.9 $\pm$ 0.5 [72.0, 73.8]
Age $<$40	61.3 $\pm$ 0.8 [59.7, 62.9]	70.1 $\pm$ 0.8 [68.6, 71.7]	70.3 $\pm$ 0.8 [68.8, 71.8]	80.5 $\pm$ 0.7 [79.0, 81.9]	73.9 $\pm$ 0.7 [72.4, 75.4]
Age 40–70	58.3 $\pm$ 0.5 [57.4, 59.2]	66.2 $\pm$ 0.4 [65.4, 67.1]	67.9 $\pm$ 0.4 [67.1, 68.7]	77.3 $\pm$ 0.4 [76.6, 78.0]	71.5 $\pm$ 0.4 [70.6, 72.3]
Age $>$70	56.5 $\pm$ 0.6 [55.3, 57.7]	63.3 $\pm$ 0.6 [62.2, 64.4]	65.7 $\pm$ 0.5 [64.7, 66.8]	73.4 $\pm$ 0.5 [72.3, 74.4]	68.3 $\pm$ 0.5 [67.3, 69.4]
ChestX-ray14
Male	51.2 $\pm$ 0.5 [50.2, 52.3]	59.5 $\pm$ 0.8 [58.0, 61.1]	64.1 $\pm$ 0.7 [62.8, 65.4]	74.6 $\pm$ 0.6 [73.4, 75.8]	68.5 $\pm$ 0.7 [67.1, 69.8]
Female	50.6 $\pm$ 0.6 [49.4, 51.8]	58.8 $\pm$ 0.9 [57.0, 60.5]	63.2 $\pm$ 0.9 [61.5, 64.9]	72.4 $\pm$ 0.8 [70.8, 73.9]	67.3 $\pm$ 0.9 [65.5, 69.0]
Age $<$40	50.7 $\pm$ 0.7 [49.3, 52.0]	60.4 $\pm$ 1.0 [58.5, 62.4]	65.1 $\pm$ 0.9 [63.3, 66.9]	73.9 $\pm$ 0.8 [72.4, 75.6]	68.8 $\pm$ 0.8 [67.2, 70.4]
Age 40–70	50.8 $\pm$ 0.5 [49.8, 51.7]	58.6 $\pm$ 0.8 [57.1, 60.0]	63.4 $\pm$ 0.7 [62.0, 64.8]	74.0 $\pm$ 0.6 [72.8, 75.3]	68.3 $\pm$ 0.7 [66.8, 69.7]
Age $>$70	52.5 $\pm$ 1.8 [49.1, 56.0]	56.0 $\pm$ 2.3 [51.4, 60.3]	59.0 $\pm$ 1.7 [55.7, 62.4]	70.1 $\pm$ 1.8 [66.7, 73.7]	62.6 $\pm$ 1.9 [59.0, 66.5]
PadChest
Male	60.7 $\pm$ 0.5 [59.8, 61.6]	74.5 $\pm$ 0.4 [73.7, 75.2]	74.8 $\pm$ 0.4 [74.1, 75.6]	84.3 $\pm$ 0.3 [83.7, 84.9]	78.3 $\pm$ 0.4 [77.6, 79.0]
Female	61.8 $\pm$ 0.5 [60.8, 62.8]	75.0 $\pm$ 0.4 [74.1, 75.8]	76.3 $\pm$ 0.4 [75.5, 77.2]	84.8 $\pm$ 0.4 [84.1, 85.6]	78.8 $\pm$ 0.4 [78.0, 79.6]
Age $<$40	58.8 $\pm$ 1.6 [55.5, 62.0]	70.2 $\pm$ 1.4 [67.4, 73.0]	76.4 $\pm$ 1.2 [74.0, 78.7]	84.6 $\pm$ 1.0 [82.4, 86.4]	78.3 $\pm$ 1.1 [75.9, 80.4]
Age 40–70	59.7 $\pm$ 0.6 [58.6, 60.8]	73.8 $\pm$ 0.5 [72.9, 74.8]	75.0 $\pm$ 0.5 [74.0, 76.0]	83.6 $\pm$ 0.4 [82.8, 84.4]	78.3 $\pm$ 0.5 [77.4, 79.2]
Age $>$70	59.7 $\pm$ 0.5 [58.7, 60.7]	69.0 $\pm$ 0.5 [68.1, 69.9]	67.0 $\pm$ 0.5 [66.1, 67.9]	80.2 $\pm$ 0.4 [79.4, 81.0]	72.1 $\pm$ 0.5 [71.2, 73.1]
UKA-CXR
Male	66.9 $\pm$ 0.2 [66.4, 67.4]	73.4 $\pm$ 0.2 [72.9, 73.8]	79.6 $\pm$ 0.2 [79.2, 80.0]	83.3 $\pm$ 0.2 [83.0, 83.6]	80.6 $\pm$ 0.2 [80.3, 81.0]
Female	65.4 $\pm$ 0.4 [64.7, 66.0]	73.5 $\pm$ 0.3 [72.9, 74.1]	80.3 $\pm$ 0.3 [79.7, 80.8]	83.7 $\pm$ 0.2 [83.2, 84.1]	81.5 $\pm$ 0.3 [81.0, 82.0]
Age $<$40	66.8 $\pm$ 0.8 [65.1, 68.4]	74.0 $\pm$ 0.7 [72.5, 75.4]	81.1 $\pm$ 0.7 [79.7, 82.4]	85.9 $\pm$ 0.6 [84.8, 87.0]	82.5 $\pm$ 0.6 [81.3, 83.8]
Age 40–70	66.9 $\pm$ 0.3 [66.4, 67.5]	74.2 $\pm$ 0.3 [73.7, 74.7]	81.0 $\pm$ 0.2 [80.5, 81.4]	84.4 $\pm$ 0.2 [84.0, 84.8]	81.9 $\pm$ 0.2 [81.5, 82.3]
Age $>$70	65.2 $\pm$ 0.3 [64.6, 65.8]	71.9 $\pm$ 0.3 [71.4, 72.5]	78.2 $\pm$ 0.2 [77.7, 78.7]	82.0 $\pm$ 0.2 [81.5, 82.4]	79.4 $\pm$ 0.2 [79.0, 79.9]

Supplementary Table 8: Macro AUROC in percent within each demographic subgroup of every external test set without privacy, for comparison with Supplementary Table 7. Values are the bootstrap mean $\pm$ standard deviation with the 95% CI in brackets. Rows are grouped by dataset and within each group ordered by sex and then by age band; columns are ordered by increasing prior knowledge. Radiographs without a recorded attribute contribute to no subgroup, so subgroup sizes are smaller than the corresponding test set; those sizes are given in Supplementary Table 12 and the reasons in Supplementary Note Supplementary Note 1: dataset curation and label harmonization. AUROC, area under the receiver operating characteristic curve; CI, confidence interval; $\epsilon$, privacy budget; He, He (Kaiming) initialization; InDomain-stand, supervised pretraining on MIMIC-CXR; InDomain-priv, differentially private pretraining on MIMIC-CXR.

Subgroup	He	ImageNet	DINOv3	InDomain-stand	InDomain-priv
VinDr-CXR
Male	75.2 $\pm$ 2.1 [71.0, 79.1]	88.8 $\pm$ 1.1 [86.6, 90.8]	90.7 $\pm$ 1.0 [88.7, 92.5]	94.3 $\pm$ 0.6 [92.9, 95.4]	89.6 $\pm$ 1.0 [87.4, 91.4]
Female	74.0 $\pm$ 3.0 [67.8, 79.6]	89.5 $\pm$ 1.5 [86.4, 92.2]	92.1 $\pm$ 1.4 [89.0, 94.6]	95.6 $\pm$ 1.2 [93.0, 97.4]	90.1 $\pm$ 1.3 [87.4, 92.5]
Age $<$40	68.6 $\pm$ 5.6 [57.4, 78.7]	85.6 $\pm$ 4.8 [73.5, 93.3]	93.3 $\pm$ 3.8 [83.5, 97.9]	96.2 $\pm$ 1.7 [91.9, 98.7]	85.9 $\pm$ 5.0 [72.2, 92.7]
Age 40–70	71.3 $\pm$ 2.7 [65.8, 76.5]	86.2 $\pm$ 2.1 [81.7, 89.9]	90.7 $\pm$ 1.6 [87.2, 93.4]	93.4 $\pm$ 1.2 [90.9, 95.5]	86.6 $\pm$ 2.2 [81.8, 90.5]
Age $>$70	63.0 $\pm$ 5.9 [51.9, 76.0]	74.3 $\pm$ 7.0 [60.1, 87.9]	87.5 $\pm$ 3.5 [80.4, 93.9]	91.7 $\pm$ 2.4 [86.4, 96.0]	81.5 $\pm$ 5.5 [71.2, 92.5]
CheXpert
Male	75.2 $\pm$ 0.4 [74.5, 75.9]	81.2 $\pm$ 0.3 [80.6, 81.8]	82.1 $\pm$ 0.3 [81.5, 82.7]	82.7 $\pm$ 0.3 [82.1, 83.3]	81.4 $\pm$ 0.3 [80.8, 82.1]
Female	75.5 $\pm$ 0.4 [74.7, 76.3]	80.8 $\pm$ 0.4 [80.0, 81.6]	82.1 $\pm$ 0.4 [81.4, 82.9]	82.8 $\pm$ 0.4 [82.1, 83.6]	81.3 $\pm$ 0.4 [80.5, 82.1]
Age $<$40	77.7 $\pm$ 0.7 [76.2, 79.1]	83.4 $\pm$ 0.7 [82.0, 84.7]	84.5 $\pm$ 0.7 [83.2, 85.8]	85.2 $\pm$ 0.7 [83.9, 86.5]	83.9 $\pm$ 0.7 [82.6, 85.2]
Age 40–70	74.9 $\pm$ 0.4 [74.1, 75.6]	80.6 $\pm$ 0.3 [79.9, 81.3]	81.8 $\pm$ 0.3 [81.1, 82.5]	82.3 $\pm$ 0.3 [81.6, 83.0]	81.0 $\pm$ 0.4 [80.3, 81.7]
Age $>$70	72.3 $\pm$ 0.5 [71.3, 73.3]	78.7 $\pm$ 0.5 [77.7, 79.6]	79.5 $\pm$ 0.5 [78.6, 80.4]	80.2 $\pm$ 0.4 [79.3, 81.1]	78.6 $\pm$ 0.5 [77.7, 79.6]
ChestX-ray14
Male	70.1 $\pm$ 0.7 [68.8, 71.4]	76.5 $\pm$ 0.5 [75.5, 77.6]	78.1 $\pm$ 0.5 [77.1, 79.1]	80.1 $\pm$ 0.5 [79.1, 81.0]	76.6 $\pm$ 0.6 [75.5, 77.7]
Female	69.5 $\pm$ 0.8 [68.0, 71.1]	75.4 $\pm$ 0.7 [74.0, 76.8]	76.3 $\pm$ 0.7 [75.0, 77.6]	78.3 $\pm$ 0.6 [77.0, 79.5]	75.5 $\pm$ 0.8 [74.0, 77.0]
Age $<$40	70.6 $\pm$ 0.9 [68.9, 72.4]	76.9 $\pm$ 0.7 [75.6, 78.4]	78.4 $\pm$ 0.7 [77.0, 79.8]	80.4 $\pm$ 0.7 [79.2, 81.7]	77.7 $\pm$ 0.7 [76.4, 79.2]
Age 40–70	69.6 $\pm$ 0.7 [68.3, 70.9]	75.7 $\pm$ 0.6 [74.6, 76.8]	77.1 $\pm$ 0.5 [76.0, 78.1]	78.9 $\pm$ 0.5 [77.8, 79.9]	75.4 $\pm$ 0.6 [74.2, 76.6]
Age $>$70	66.4 $\pm$ 1.5 [63.5, 69.3]	72.8 $\pm$ 1.4 [69.9, 75.5]	75.0 $\pm$ 1.4 [72.3, 77.7]	76.4 $\pm$ 1.6 [73.4, 79.5]	72.2 $\pm$ 1.8 [68.5, 75.7]
PadChest
Male	81.6 $\pm$ 0.3 [81.0, 82.3]	88.0 $\pm$ 0.3 [87.4, 88.5]	88.7 $\pm$ 0.3 [88.1, 89.2]	89.1 $\pm$ 0.3 [88.6, 89.6]	88.1 $\pm$ 0.3 [87.5, 88.6]
Female	81.1 $\pm$ 0.4 [80.3, 81.9]	88.2 $\pm$ 0.3 [87.5, 88.8]	89.5 $\pm$ 0.3 [88.9, 90.1]	90.0 $\pm$ 0.3 [89.4, 90.5]	88.5 $\pm$ 0.3 [87.9, 89.1]
Age $<$40	80.1 $\pm$ 1.0 [78.0, 82.0]	86.6 $\pm$ 1.1 [84.3, 88.6]	87.2 $\pm$ 1.1 [85.0, 89.2]	88.0 $\pm$ 1.0 [85.9, 89.8]	85.6 $\pm$ 1.1 [83.3, 87.6]
Age 40–70	80.8 $\pm$ 0.4 [80.0, 81.7]	87.7 $\pm$ 0.4 [87.0, 88.4]	88.7 $\pm$ 0.3 [88.0, 89.4]	89.1 $\pm$ 0.3 [88.4, 89.8]	87.9 $\pm$ 0.4 [87.2, 88.6]
Age $>$70	75.8 $\pm$ 0.4 [74.9, 76.7]	84.0 $\pm$ 0.4 [83.3, 84.7]	85.4 $\pm$ 0.3 [84.7, 86.0]	85.9 $\pm$ 0.3 [85.2, 86.6]	84.6 $\pm$ 0.4 [83.8, 85.3]
UKA-CXR
Male	83.9 $\pm$ 0.2 [83.6, 84.2]	88.1 $\pm$ 0.1 [87.8, 88.4]	88.6 $\pm$ 0.1 [88.3, 88.8]	88.5 $\pm$ 0.1 [88.3, 88.8]	88.3 $\pm$ 0.1 [88.0, 88.5]
Female	84.1 $\pm$ 0.2 [83.6, 84.5]	88.3 $\pm$ 0.2 [88.0, 88.7]	88.9 $\pm$ 0.2 [88.6, 89.3]	88.9 $\pm$ 0.2 [88.6, 89.3]	88.5 $\pm$ 0.2 [88.2, 88.9]
Age $<$40	85.7 $\pm$ 0.5 [84.6, 86.7]	90.6 $\pm$ 0.4 [89.8, 91.3]	91.2 $\pm$ 0.4 [90.5, 91.9]	91.3 $\pm$ 0.4 [90.5, 92.0]	91.0 $\pm$ 0.4 [90.2, 91.7]
Age 40–70	85.0 $\pm$ 0.2 [84.6, 85.3]	89.1 $\pm$ 0.2 [88.8, 89.4]	89.5 $\pm$ 0.1 [89.2, 89.8]	89.5 $\pm$ 0.1 [89.2, 89.8]	89.1 $\pm$ 0.2 [88.8, 89.4]
Age $>$70	82.5 $\pm$ 0.2 [82.1, 82.9]	86.7 $\pm$ 0.2 [86.4, 87.1]	87.4 $\pm$ 0.2 [87.1, 87.7]	87.3 $\pm$ 0.2 [87.0, 87.6]	87.0 $\pm$ 0.2 [86.7, 87.3]

Supplementary Table 9: Harmonization of the label vocabularies of the five evaluation datasets. Each row gives the canonical finding used throughout this work and the column of each dataset’s curated master list from which it was decoded. A radiograph was counted positive for a finding when the corresponding column equalled 1, with two exceptions. In CheXpert the rule-based labeler emits positive, negative, and uncertain values, and uncertain was mapped to negative. In UKA-CXR cardiomegaly is graded on an ordinal scale and was counted positive at grade 3 or 4, and the absence of findings is recorded in a column named for a healthy study. Column names are reproduced verbatim so that the decoding can be repeated from the public master lists.

Canonical finding	VinDr-CXR	CheXpert	ChestX-ray14	PadChest	UKA-CXR
Atelectasis	Atelectasis	atelectasis	atelectasis	atelectasis	atelectasis
Cardiomegaly	Cardiomegaly	cardiomegaly	cardiomegaly	cardiomegaly	cardiomegaly
Pleural effusion	Pleural effusion	pleural_effusion	effusion	pleural_effusion	pleural_effusion
Pneumonia	Pneumonia	pneumonia	pneumonia	pneumonia	pneumonic_infiltrates
No finding	No finding	no_finding	no_finding	no_finding	healthy

Supplementary Table 10: Size and curation of the five external evaluation datasets. Columns give the total number of radiographs, the training, validation, and test split sizes (radiographs), the number of unique patients, and the projections retained. VinDr-CXR has no native validation split and reused its test split for validation (^a). The paired bootstrap resampled at the patient level for CheXpert and ChestX-ray14 and at the image level for VinDr-CXR, PadChest, and UKA-CXR; VinDr-CXR carries no patient identifiers. For CheXpert, only frontal projections were used and uncertain labels were set to negative; for PadChest, posteroanterior and anteroposterior projections were used; for UKA-CXR, cardiomegaly was defined as radiographic grade 3 or 4. All datasets share the canonical five-finding vocabulary. AP, anteroposterior; N/A, not applicable; PA, posteroanterior.

Dataset	Total	Train	Validation	Test	Patients	Views
VinDr-CXR	18,000	15,000	a	3,000	N/A	all
CheXpert	157,878	115,458	13,099	29,321	57,872	frontal
ChestX-ray14	112,120	77,870	8,654	25,596	30,805	all
PadChest	110,525	79,697	8,783	22,045	67,205	PA, AP
UKA-CXR	193,361	137,902	15,353	40,106	54,176	all

Supplementary Table 11: Number of positive examples of each finding in every split of the five evaluation datasets, with the percentage of the split in parentheses. Findings are multi-label, so the percentages within a split do not sum to 100. The training-set counts determine the per-label positive weights of the loss in Eq. 4. VinDr-CXR has no native validation split, so it contributes training and test rows only.

Split	$n$	Atelectasis	Cardiomegaly	Pleural effusion	Pneumonia	No finding
VinDr-CXR
Training	15,000	62 (0.4)	1,817 (12.1)	634 (4.2)	471 (3.1)	10,601 (70.7)
Test	3,000	86 (2.9)	309 (10.3)	111 (3.7)	246 (8.2)	2,051 (68.4)
CheXpert
Training	115,458	19,488 (16.9)	14,317 (12.4)	48,439 (42.0)	2,851 (2.5)	12,088 (10.5)
Validation	13,099	2,302 (17.6)	1,629 (12.4)	5,265 (40.2)	297 (2.3)	1,372 (10.5)
Test	29,321	4,523 (15.4)	3,944 (13.5)	11,438 (39.0)	816 (2.8)	3,540 (12.1)
ChestX-ray14
Training	77,870	7,392 (9.5)	1,549 (2.0)	7,833 (10.1)	782 (1.0)	45,415 (58.3)
Validation	8,654	888 (10.3)	158 (1.8)	826 (9.5)	94 (1.1)	5,085 (58.8)
Test	25,596	3,279 (12.8)	1,069 (4.2)	4,658 (18.2)	555 (2.2)	9,861 (38.5)
PadChest
Training	79,697	4,413 (5.5)	7,083 (8.9)	5,071 (6.4)	3,793 (4.8)	26,074 (32.7)
Validation	8,783	513 (5.8)	808 (9.2)	540 (6.1)	437 (5.0)	2,858 (32.5)
Test	22,045	1,240 (5.6)	1,954 (8.9)	1,373 (6.2)	992 (4.5)	7,216 (32.7)
UKA-CXR
Training	137,902	19,063 (13.8)	64,447 (46.7)	17,372 (12.6)	18,976 (13.8)	53,233 (38.6)
Validation	15,353	2,260 (14.7)	7,143 (46.5)	1,950 (12.7)	2,301 (15.0)	5,858 (38.2)
Test	40,106	5,650 (14.1)	18,758 (46.8)	5,107 (12.7)	5,895 (14.7)	15,364 (38.3)

Supplementary Table 12: Composition of the demographic subgroups in each external test set. For every dataset, the table lists the number of radiographs in each subgroup and the prevalence in percent of each finding within that subgroup, together with the number of radiographs excluded from the subgroup analysis because the attribute was missing. Age is grouped into three bands. Rows are ordered by dataset following the order of presentation in the main text, and within a dataset by sex and then by age band. N/A, not applicable.

Subgroup	$n$	Atelectasis	Cardiomegaly	Pleural effusion	Pneumonia	No finding
VinDr-CXR (excluded for missing sex, 1746; for missing age, 2532)
Male	702	4.1	8.3	6.1	11.0	55.8
Female	552	3.3	22.5	4.2	6.7	55.8
Age $<$40	149	1.3	4.0	1.3	5.4	83.9
Age 40–70	250	5.6	14.8	4.4	10.4	46.0
Age $>$70	69	4.3	46.4	5.8	13.0	5.8
CheXpert (excluded for missing sex, 0; for missing age, 0)
Male	17,885	16.0	13.4	38.7	2.8	11.8
Female	11,436	14.6	13.5	39.5	2.7	12.4
Age $<$40	4,391	11.1	10.5	27.1	3.0	23.2
Age 40–70	16,421	16.1	11.9	38.3	2.4	12.4
Age $>$70	8,509	16.3	18.0	46.6	3.4	5.7
ChestX-ray14 (excluded for missing sex, 0; for missing age, 1)
Male	14,882	12.9	3.6	18.4	2.2	38.4
Female	10,714	12.7	4.9	17.9	2.1	38.7
Age $<$40	8,410	9.5	4.9	15.9	2.7	41.5
Age 40–70	15,495	13.9	3.7	18.6	2.0	37.3
Age $>$70	1,690	19.0	4.7	25.9	1.2	34.9
PadChest (excluded for missing sex, 1; for missing age, 142)
Male	11,408	6.2	7.9	7.6	5.0	27.5
Female	10,636	5.0	9.9	4.7	4.0	38.4
Age $<$40	3,612	2.4	0.8	2.8	8.1	60.1
Age 40–70	10,788	5.1	5.2	4.6	3.1	37.8
Age $>$70	7,503	8.0	18.0	10.4	4.8	12.6
UKA-CXR (excluded for missing sex, 0; for missing age, 15)
Male	25,536	14.5	50.8	12.8	15.8	34.8
Female	14,570	13.4	39.7	12.6	12.8	44.4
Age $<$40	2,325	14.5	27.6	9.8	16.9	50.6
Age 40–70	19,383	14.2	43.2	12.0	15.9	40.8
Age $>$70	18,383	13.9	53.0	13.9	13.2	34.1

Supplementary Table 13: Training cost of the main experiment. For each dataset the table reports the number of training radiographs, the mean time for one epoch without privacy and under differentially private training, the ratio of the two, and the total time summed over the 25 runs of that dataset. Epoch times are the robust estimates defined in the Methods. The ratio isolates the overhead of per-sample gradient clipping and noise addition, which roughly doubles the cost of an epoch at every dataset size. The final row gives the pooled training set size and the total cost of all 125 runs.

Dataset	Training images	Non-private (min)	Private (min)	Ratio	Total (h)
VinDr-CXR	15,000	1.2	2.4	2.02	65
CheXpert	115,458	9.3	19.1	2.05	414
ChestX-ray14	77,870	6.2	12.9	2.07	315
PadChest	79,697	6.4	13.2	2.06	327
UKA-CXR	137,902	11.0	22.7	2.06	471
All five datasets	425,927				1,592

Supplementary Note 1: dataset curation and label harmonization

All five evaluation datasets and the pretraining corpus are public, so every step between the released files and the tensors used here is reproducible. This note records those steps and the choices that a reader would otherwise have to infer.

Label harmonization

The five datasets were released with different label vocabularies, different numbers of findings, and different conventions for encoding uncertainty. They were reduced to one vocabulary of five findings by selecting, in each curated master list, the column corresponding to each canonical finding (Supplementary Table 9). Three conventions required a decision. CheXpert marks a finding as uncertain when the report labeler cannot resolve it, and we mapped uncertain to negative, which is the conservative choice because it never asserts a finding the report does not support. UKA-CXR grades cardiomegaly on an ordinal scale instead of marking it present or absent, and we counted grades 3 and 4 as positive, so that only clinically meaningful enlargement contributes. UKA-CXR also records the absence of findings in a column denoting a healthy study, which maps to the canonical no finding. ChestX-ray14 names pleural effusion simply as effusion. No other renaming, thresholding, or relabeling was applied, and no finding was inferred from another.

Projection filtering and exclusions

Two datasets were filtered by projection before any split was formed, so that the filter applies identically to training, validation, and test data. CheXpert was reduced from 184,325 to 157,878 radiographs by keeping frontal projections and discarding 26,447 lateral ones. PadChest was reduced from 160,704 to 110,525 by keeping the posteroanterior, anteroposterior, and horizontal anteroposterior projections and discarding 50,179 rows in other or unspecified projections. VinDr-CXR, ChestX-ray14, and UKA-CXR were used in full. No radiograph was excluded for image quality, for a missing label, or for any reason other than projection, so the counts in Supplementary Table 10 follow from the released files and this single filter.

Splits

Each dataset carries a split assignment in its curated master list, and those assignments were used verbatim so that the partition is fixed and reproducible. VinDr-CXR is the one dataset released without a validation split. Its test split was therefore reused for validation, which is how the original release is commonly used, and it remains disjoint from the training split. One consequence should be kept in mind when reading the VinDr-CXR columns: the epoch selected as converged and the decision thresholds were both chosen on the same radiographs that form its test set, so VinDr-CXR internal performance is optimistic relative to the other four datasets, where validation and test are disjoint. This affects the absolute values on that dataset and not the comparison between initializations, since every initialization was selected under the identical procedure. The leave-one-dataset-out evaluation, where VinDr-CXR is never used for selection when it is the held-out set, is unaffected.

Demographic metadata

Subgroup analyses were limited by what each dataset records. Sex is stored as a single letter in VinDr-CXR, ChestX-ray14, and PadChest, as a word in CheXpert, and as a numeric code in UKA-CXR, where 0 denotes male and 1 female. Values outside the two recorded categories were not assigned to a subgroup: CheXpert contains one radiograph marked unknown, PadChest contains a small number marked other or left blank, and VinDr-CXR records sex for 8,608 of its 18,000 radiographs, 4,542 male and 4,066 female. Age is recorded in years in four datasets. In VinDr-CXR a missing age is stored as zero and not as an empty field, which affects 13,766 of 18,000 radiographs and leaves 4,234 with a usable age, whose median is 57 years with an interquartile range of 41 to 67. The three age bands used throughout exclude zero by construction: the youngest band covers ages above 0 and below 40, the middle band ages from 40 up to but excluding 70, and the oldest band ages from 70 up to but excluding 100. Radiographs with an unusable age therefore contribute to the overall results but to no age subgroup, and the subgroup sizes in Supplementary Table 12 are smaller than the corresponding test set for this reason.

Class prevalence

The five findings are heavily imbalanced and imbalanced differently in each dataset, which is why the loss carries a per-label positive weight instead of treating the findings symmetrically. The positive counts of every split are given in Supplementary Table 11, and the training-set counts are exactly the quantities entering that weight in Eq. 4. Two features of the table are worth noting when interpreting the results. Pneumonia is the rarest finding almost everywhere, falling to 1.0% of ChestX-ray14 training radiographs, which is why its AUROC is the lowest of the five findings for every initialization. UKA-CXR, an intensive care cohort, is the one dataset in which cardiomegaly is common, at 46.7% of training radiographs, reflecting a population selected for cardiopulmonary disease and not a difference in labeling.