arXiv:2606.02276v2 Announce Type: replace-cross

Abstract: Hospitals may release de-identified chest radiographs while restricting access to their reports. An attacker who already has reports from the same population and their metadata can use a vision-language model (VLM) to match images to reports. We introduce selective linkage precision, which measures correct matches among the highest-confidence queries after filtering candidates by the available attributes. Across 8 public VLMs and 3 chest radiograph datasets, the maximum whole-pool Recall@1 is 0.40%. However, this metric averages over every query without attribute filtering. On ReXGradient-160K, MedSigLIP-448 reaches 67.68% precision at a budget of 100 after filtering by sex, age band, and projection, with a median of 327 candidate reports. On the same eligible query set, an attribute-only policy reaches 24.99% and the model alone reaches 1.98%. Adding acquisition year, available in only 1 of the 3 datasets, yields 99.05% precision and a median of 24 candidates. Uniform guessing on the observed selected queries has an expected precision of 19.91%. Expanding the primary-setting collection to all 123,100 ReXGradient studies lowers precision to 37.23%. On BioViL-T, the tested head finetuning procedures do not lower linkage below the public checkpoint. Selective linkage precision requires inference without retraining and could help hospitals evaluate which attributes to publish.