médical IA

EXPOSE: erasing the dimensions that encode the scanner in a pathology foundation model buys 0.75 AUROC points — at the cost of deleting 91 % of them

Published on August 31, 2026 · 13 min read

Seven authors from University Medical Center Hamburg-Eppendorf train a sparse autoencoder on the embeddings of a pathology foundation model, identify the dimensions that encode scanner and staining protocol rather than tumour, and erase them. On five-year prostate cancer relapse prediction, masking 3,500 of 3,840 dimensions gains 0.75 AUROC points on average across four protocol variants never seen in training. The gain is real but tiny, no significance test is reported, and every domain compared comes from the same hospital.

The context

A vision foundation model (VFM) applied to pathology is a network trained without labels on millions of histology tiles, whose representations are then reused for all sorts of downstream tasks: grading a tumour, predicting a mutation, estimating a prognosis. You do not retrain it. You ask it to turn a tissue image into a vector of a few hundred numbers — the embedding — and you attach a small classifier on top. This is now the default architecture in digital pathology.

The weak point of that architecture is domain shift. Two sections from the same tissue block, cut at different thicknesses, stained for different durations or digitized on two different scanners, produce different embeddings. The network has not only encoded biology: it has also encoded the laboratory. When a model trained at one hospital is applied at another, performance drops — the best documented failure mode in the field. At bottom this is shortcut learning: the network picks up a spurious correlation, the signature of the device and the protocol, alongside the signal you thought you were teaching it.

The Hamburg team's idea comes from large language model interpretability. A sparse autoencoder (SAE) is a small network trained to reconstruct an embedding through a much wider intermediate layer in which nearly all units are forced to stay at zero. The intuition, popularized since 2023 on language models: in a compressed space each dimension mixes several concepts at once; in a wide, sparse space, each concept has room to occupy its own dimension. If that also holds in pathology, then scanner dimensions and tumour dimensions should be separable — and one should be able to erase the former without damaging the latter. That is precisely the hypothesis this paper puts to the test.

The method

The data. An internal cohort from University Medical Center Hamburg-Eppendorf: 69,251 tissue microarray spot images (millimetre-scale tissue cores arranged in a grid on a single slide) from 17,700 patients who underwent radical prostatectomy between 1992 and 2014. After filtering on image quality and clinical data availability, 24,588 images remain, split into six subdatasets. The endpoint is binary: relapse within five years, defined compositely — biochemical recurrence, additional unplanned therapy, metastasis, or prostate cancer death. Only patients with at least five years of documented follow-up, or a relapse within five years, are included.

The six domains. This is the most carefully built part of the setup. The authors did not look for domain shifts in the wild: they manufactured them, one factor at a time. ScanA (8,141 images) is the standard protocol — 2.5 µm section, normal-duration H&E staining, Aperio scanner at 40x. ScanB (8,141 images) is exactly the same tissue, registered image by image, digitized on a 3DHistech scanner at 80x: only the device changes. ScanA.thin (1,951) and ScanA.thick (1,950) are other sections from the same block at 1 µm and 10 µm. ScanA.long (1,951) applies staining ten times longer. ScanA.spot (8,181) takes a second core, hence another region of the prostate. ScanA and ScanB form the in-domain set; the other four serve as out-of-domain tests and are never seen in training.

The pipeline. The foundation model is H0-mini, a distilled version of H-Optimus-0, frozen, producing 768-dimensional vectors. On those representations the authors train a ReLU sparse autoencoder with an expansion factor of 5: the sparse layer therefore has 3,840 dimensions. Sparsity comes from an L1 penalty with coefficient 1e-5, not from the more recent TopK or JumpReLU mechanisms. Sparse activations are mean-pooled over all tokens of an image, and a plain linear relapse classifier is fit on top.

Identification and masking. To locate the domain dimensions, the authors train a linear ScanA-versus-ScanB classifier — a scanner discriminator — on the registered image pairs. Dimensions are then ranked by weight, and the k most strongly associated with ScanB are zeroed by a fixed binary mask. Three selection strategies are compared (highest positive weights, lowest negative weights, highest absolute value); the first is retained. k is swept from 2 to 3,500. Importantly, the foundation model is never retrained, and once computed the mask applies blindly to any image — no domain label is needed at inference time.

The protocol. The SAE and the domain classifier are trained on ScanA and ScanB (70/15/15, patient-level stratification). The relapse classifier is trained on ScanA only. Results are means over five random seeds, reported with standard deviations. The authors finally introduce an in-house index, the DoRI (Domain Robustness Index): for each embedding, its 20 nearest neighbours are examined and the frequency with which they share the same relapse label is compared to the frequency with which they share the same domain, each normalized by its expectation under a uniform distribution. A positive DoRI means the label structures the space more than the domain does; a negative DoRI means the opposite.

The results

In domain, the SAE helps a little. The base model — raw H0-mini embedding plus linear classifier — reaches AUROC 68.20 on ScanA and 68.58 on ScanB. Passing through the SAE without masking lifts the in-domain mean from 68.39 to 69.32, and masking 256 dimensions to 69.57, that is +1.18 points. Recall what an AUROC of 0.69 means: draw at random one patient who relapsed and one who did not, and the model orders the pair correctly about 69 times out of 100, against 50 by chance. That is a modest prognostic signal, which the authors do not attempt to hide.

Out of domain, the SAE alone degrades, and you must mask nearly everything to gain. This is the central result. The base model's out-of-domain mean is 61.42. The unmasked SAE pushes it down to 60.87 (−0.54). Masking 256 dimensions is not enough to return to the starting point (61.03, i.e. −0.39). Only at k = 3,500 masked dimensions out of 3,840 — leaving 340 active — does it reach 62.16, i.e. +0.75 points over the base model. The per-domain detail is instructive: ScanA.spot goes from 65.38 to 67.74, ScanA.thick from 58.17 to 59.62, ScanA.long from 61.67 to 62.67, but ScanA.thin regresses, from 60.48 for the base model to 58.63 at best for the masked variants. Section thickness shift remains, in the authors' own words, challenging.

The random-masking control. The authors compare their domain-classifier-weight selection to masking the same number of randomly chosen dimensions. DoRI rises steadily under guided masking, while random masking produces only minor changes up to k = 1,024. But the most telling result lies elsewhere: when DoRI is computed on the space combining in-domain and out-of-domain data, it stays negative at every masking level. In other words, even after erasing 91 % of the dimensions, domain still structures the representation space more than prognosis does. The authors themselves write that the separation is partial.

What is good

The dataset is designed, not found. Six variants where one factor changes at a time — scanner, section thickness, staining duration, tissue region — two of them made of registered images of the same spot on two devices. In a literature where domain shift is almost always studied by comparing two hospitals that differ in twenty parameters at once, this design allows an effect to be attributed to a cause. It has a cost, discussed below, but it is rare and it is clean.

The negative control is there. Comparing guided masking to random masking of the same number of dimensions is the obvious experiment that many papers omit. Without it, one could not tell noise removal from domain removal. The authors run it, and it separates the two regimes cleanly up to k = 1,024.

The intervention is light and the code is public. The foundation model is never retrained, which puts the method within reach of a team without heavy compute. The mask is computed once then applied blindly: no domain label is required at inference, a constraint that disqualifies many domain adaptation methods in clinical practice. The repository is open under CC BY 4.0.

What is less good

The effect is the size of the noise, and the winning configuration is chosen on the test set. The 0.75-point out-of-domain gain comes with a cross-domain standard deviation of 3.64, and no significance test and no confidence interval is reported — only standard deviations over five seeds. More awkwardly: the best in-domain configuration (k = 256) is not the best out-of-domain one (k = 3,500), and nothing in the paper indicates how one would have chosen k = 3,500 without looking at the out-of-domain results. Yet those four subdatasets are what stands in for validation. Selecting a hyperparameter on your test set mechanically produces an optimistic estimate: this is a variant of misleading metric, and it is sufficient to explain a gap of this magnitude.

There is no external validation, and the population is narrow. The six domains come from the same tissue blocks, the same patients, the same pathology institute. No public dataset — TCGA, PANDA — and no other institution is used. What the paper demonstrates is robustness to a change of device and protocol at home, which is not the shift that makes models fail on deployment. Add a classic population bias: a single-centre German cohort recruited between 1992 and 2014, restricted to radical prostatectomy patients, with no demographic data reported. The paper also carries no conflict-of-interest statement, no data availability statement and no ethics approval mention — funding, by contrast, is detailed (several DFG SFB projects).

Erasing 91 % of the dimensions is not an explainable bottleneck. This is the conceptual limit. The promise of a sparse autoencoder is to isolate a few interpretable dimensions carrying the domain information. Here, masking 256 dimensions is not enough out of domain; 3,500 of 3,840 must be removed to obtain a gain, and the combined DoRI stays negative even then. The most economical reading is therefore not that domain information was concentrated and removed, but that it is distributed across nearly all dimensions, and that massive masking eventually dilutes it. The authors do acknowledge two limitations — a single foundation model, a single SAE type, and a single domain pair used to identify the dimensions — but not this one. To which one may add a practical constraint that goes largely undiscussed: at development time the method requires paired, registered images of the same tissue on two scanners, which very few laboratories have.

What it changes

For the research community. The most reusable result is not EXPOSE, it is the dataset. Six protocol variants controlled one at a time, on the same patients, with registered pairs across two scanners: this is a better-designed domain shift benchmark than most in circulation, and it would allow clean comparison of stain normalization, augmentation and adaptation methods. The second lesson is negative, and it is the more useful one: on this cohort, the superposition hypothesis — each sparse dimension carrying a separable concept — holds only partially, and the gains obtained by assuming it true are on the order of one AUROC point.

For clinicians and deployment teams. Nothing changes in practice today. A prognostic model at 0.62 out-of-domain AUROC replaces neither the Gleason score, nor stage, nor post-operative PSA, and the paper does not in fact compare it to any of those established clinical factors — a comparator one would have liked to see. The transposable lesson is more prosaic: when a laboratory changes scanner or staining protocol, a model already validated on the old slides must be revalidated on the new ones. This paper quantifies the size of the problem (up to ten AUROC points lost between protocol variants) better than it solves it.

For patients and the public. No tool arising from this work is in clinical, prospective or regulatory evaluation. What the article illustrates, however, deserves to be known outside the technical field: an artificial intelligence trained on medical images does not only learn the disease. It also learns, often just as strongly, the device that produced the image and the hand that prepared the sample. Separating the two remains, in 2026, an open problem.