Pitfalls of defacing whole-head MRI: re-identification risk with diffusion models and compromised research potential
Journal:
arXiv
Published Date:
Jan 31, 2025
Abstract
Defacing is often applied to head magnetic resonance image (MRI) datasets
prior to public release to address privacy concerns. The alteration of facial
and nearby voxels has provoked discussions about the true capability of these
techniques to ensure privacy as well as their impact on downstream tasks. With
advancements in deep generative models, the extent to which defacing can
protect privacy is uncertain. Additionally, while the altered voxels are known
to contain valuable anatomical information, their potential to support research
beyond the anatomical regions directly affected by defacing remains uncertain.
To evaluate these considerations, we develop a refacing pipeline that recovers
faces in defaced head MRIs using cascaded diffusion probabilistic models
(DPMs). The DPMs are trained on images from 180 subjects and tested on images
from 484 unseen subjects, 469 of whom are from a different dataset. To assess
whether the altered voxels in defacing contain universally useful information,
we also predict computed tomography (CT)-derived skeletal muscle radiodensity
from facial voxels in both defaced and original MRIs. The results show that
DPMs can generate high-fidelity faces that resemble the original faces from
defaced images, with surface distances to the original faces significantly
smaller than those of a population average face (p < 0.05). This performance
also generalizes well to previously unseen datasets. For skeletal muscle
radiodensity predictions, using defaced images results in significantly weaker
Spearman's rank correlation coefficients compared to using original images (p <
10-4). For shin muscle, the correlation is statistically significant (p < 0.05)
when using original images but not statistically significant (p > 0.05) when
any defacing method is applied, suggesting that defacing might not only fail to
protect privacy but also eliminate valuable information.
