The de-identification standards most research datasets rely on were written against an adversary who was deliberately attacking the data. A security review published this month describes a less reassuring scenario: linkage occurring incidentally, as a byproduct of a capable model processing two datasets that were each individually compliant.

The reviewers took a de-identified clinical dataset and a publicly available registry, both properly scrubbed of direct identifiers, and prompted a general-purpose model to find record correspondences. It found them, at a rate well above chance, using combinations of admission timing, procedure sequence and geography that no single field made identifying.

The finding is not a novel attack — quasi-identifier linkage has been understood for two decades. What is new is the cost. This previously required a motivated expert and now requires a prompt, which changes the threat model for every institution that has shared a research extract under a standard agreement.

Recommendations from the reviewers focus on shifting from field-level scrubbing to output-controlled access: put the data behind an enclave, log the queries, and stop assuming a file can be made safe to hand over.