De-anonymization Attacks on Neuroimaging Datasets

TL;DR

This paper demonstrates a de-anonymization attack on neuroimaging datasets that exploits unique brain features to identify individuals and their task performance, raising privacy concerns.

Contribution

It introduces a novel, scalable matrix analysis-based attack method that can accurately de-anonymize neuroimages and reveal sensitive information.

Findings

The attack accurately identifies individuals across datasets.

It can also infer the tasks performed by subjects.

The method is computationally efficient and scalable.

Abstract

Advances in imaging technologies, combined with inexpensive storage, have led to an explosion in the volume of publicly available neuroimaging datasets. Effective analyses of these images hold the potential for uncovering mechanisms that govern functioning of the human brain, and understanding various neurological diseases and disorders. The potential significance of these studies notwithstanding, a growing concern relates to the protection of privacy and confidentiality of subjects who participate in these studies. In this paper, we present a de-anonymization attack rooted in the innate uniqueness of the structure and function of the human brain. We show that the attack reveals not only the identity of an individual, but also the task they are performing, and their efficacy in performing the tasks. Our attack relies on novel matrix analyses techniques that are used to extract discriminating features in neuroimages. These features correspond to individual-specific signatures that can be matched across datasets to yield highly accurate identification. We present data preprocessing, signature extraction, and matching techniques that are computationally inexpensive, and can scale to large datasets. We discuss implications of the attack and challenges associated with defending against such attacks.

Tables

Table 1. Table 1: Task-wise prediction error expressed as normalized root-mean-squared error.

Task	Train nRMSE (in %)	Test nRMSE (in %)
Language	$0.33\pm 0.11$	$1.52\pm 0.20$
Emotion	$0.28\pm 0.07$	$0.60\pm 0.37$
Relational	$0.44\pm 0.04$	$2.74\pm 0.34$
Working Memory	$0.57\pm 0.12$	$1.93\pm 0.41$

Table 2. Table 2: Summary of prediction accuracy for different noise levels.

Noise Variance(in %)	Identification Accuracy (in %)
	HCP	ADHD-200
$10$	$91.14\pm 1.15$	$96.33\pm 0.79$
$20$	$86.71\pm 2.44$	$89.17\pm 1.82$
$30$	$79.05\pm 5.76$	$84.10\pm 4.43$

Equations

$$p_i=\frac{||A_{i,\star }|{|}_2^2}{{\sum }_i||A_{i,\star }|{|}_2^2}=\frac{||A_{i,\star }|{|}_2^2}{||A_{i,\star }|{|}_F}.$$

$$\mathbb{E}[||A^{T}A-{\tilde{A}}^T\tilde{A}|{|}_F]\le \frac{1}{\sqrt{s}}||A|{|}_F^2.$$

$$p_i=\frac{||U_{i,\star }|{|}_2^2}{{\sum }_i||U_{i,\star }|{|}_2^2}=\frac{1}{n}(P_A{)}_{i,i}\forall i\in \{1\dots m\}.$$

$$||A-A{\tilde{A}}^{†}\tilde{A}|{|}_{\zeta }^2\le (1+ϵ)||A-A_k|{|}_{\zeta }^2,$$

$$l_i=||U_{i,\star }|{|}_2^2,\forall i\in \{1\dots m\}.$$

$$p_{j|i}=\left\{\begin{array}[]{ll}\frac{\exp(-||x_{i}-x_{j}||/2\sigma_{i}^{2})}{\sum_{i\neq k}\exp(-||x_{i}-x_{k}||/2\sigma_{i}^{2})}&x_{i}\neq x_{j}\\ 0&otherwise\\ \end{array}\right.$$

$$C=KL(P_i||Q_i)=\sum _j{p}_{j|i}\log \frac{p_{j|i}}{q_{j|i}}$$

$$Perp(P_i)=2^{H(P_i)}$$

$$H(P_i)=-\sum _j{p}_{j|i}{\log }_2{p}_{j|i}$$

$$\frac{\partial C}{\partial y_i}=2\sum _j(p_{j|i}-q_{j|i}+p_{i|j}-q_{i|j})(y_i-y_j)$$

$$C=KL(P||Q)=\sum _i\sum _j{p}_{ij}\log \frac{p_{ij}}{q_{ij}}$$

$$p_{ij}=\left\{\begin{array}[]{ll}\frac{\exp(-||x_{i}-x_{j}||/2\sigma^{2})}{\sum_{k\neq l}\exp(-||x_{k}-x_{l}||/2\sigma^{2}})&x_{i}\neq x_{j}\\ 0&otherwise\end{array}\right.$$

$$q_{ij}=\frac{(1+||y_i-y_j|{|}^2{)}^{-1}}{{\sum }_{k\ne l}(1+||y_k-y_l|{|}^2{)}^{-1}}$$

$$\frac{\partial C}{\partial y_i}=4\sum _j(p_{ij}-q_{ij})(y_i-y_j)(1+||y_i-y_j|{|}^2{)}^{-1}$$

Full text

1 Background

Studies of high-resolution images of the brain provide the basis for our understanding of the essential processes that underlie the functioning of the brain, help characterize behaviour and anatomy, and their dys-regulation due to disease, neurological disorders, and aging. Images of the brain, neuroimages, serve as phenotypes (observables) of structure and function. Various modalities of imaging rely on different biophysical processes and properties of the brain tissue. Consequently, these modalities highlight different aspects of the brain – broadly speaking these images reveal anatomical structure or behavioral function. Anatomical images are high resolution (< 1 mm side) 3-D images that capture subtle structural details. Structural Magnetic Resonance Images (Structural MRI) can reveal clear boundaries between gray and white matter. Diffusion Tensor Imaging (DTI) and Diffusion Weighted Imaging (DWI) help visualize structural neuronal pathways. The physical manifestation of these features – volumes of gray and white matter and direction of neuronal pathways, are often dys-regulated in subjects with neurological disorders such as Attention Deficiency Disorder (ADD) and Attention Deficiency Hyperactive Disorder (ADHD), or neurodenerative diseases such as Alzheimer’s and Parkinson’s.

Functional images are typically lower resolution 4-dimensional images (three spatial dimensions and one temporal dimension). Commonly used modalities for functional imaging include functional MRIs (fMRI), Electron Encephalography (EEG), and Magnetic Encephalography (MEG). Functional images capture dynamic behaviour of the brain, both in absence of stimulus (called resting-state) and in presence of stimulus (called task-specific). They reveal processes that underlie behaviour, provide the basis for learning, dys-regulation of typical features in subjects with neurological disorders, and aid in prediction (prognosis and diagnosis) of neurological disorders. EEGs use electrodes that record patterns of electrical activity in the brain. Anomalies in normal electrical activity are used to diagnose epilepsy Adeli et al. (2007) and sleep disorders Pet (2004). MEGs record magnetic fields resulting from electrical activity. They are used to understand perception, and in pre-surgical procedures to find regions of the brain associated with pathology of interest Anderson et al. (2014). Functional MRIs and MEGs have better spatial resolution than EEGs; conversely, EEGs have better temporal resolution.

In this paper, we focus on privacy aspects of functional MRI – the most commonly used neuroimaging modality. Functional MRI measures local changes to quantify the activity of different regions of the brain – for instance, Blood Oxygen Level Dependent fMRI (BOLD fMRI) measures the de-oxygenation of blood in veins to measure neuronal activation of surrounding regions. Functional MRIs are used both in research and in practice. They are used in pre-operative procedures to identify regions of the brain that are strongly correlated for various tasks. Similarly, “cortical maps” are constructed from fMRI images for planning surgeries. In research, fMRIs are used to study diverse phenotype, including Alzheimer’s Jack Jr. et al. (2008), schizophrenia Holmes et al. (2005); Mitchell et al. (2004), bipolar disorder (BPD) Mitchell et al. (2004), depression Holmes et al. (2005),dyslexia Ruff et al. (2003), hyperlexia Turkeltaub et al. (2004), homosexual pedophilia Schiffer et al. (2008), cocaine addiction Breiter et al. (1997), gambling Essen et al. (2013), minimal consciousness Moritz (2005), extraversion, self-consciousness, romantic love Fisher et al. (2005), sexual arousal Schiffer et al. (2008), political leaning Westen et al. (2006), neurotism, extraversion and self-consciousness Eisenberger et al. (2005).

Structural and functional images from fMRIs are used to create connection maps of the brain, called connectomes (analogous to genome, which is a map of the gene). The study of connectomes is called connectomics (again, analogous to genomics). A common, intuitive model for understanding brains is a correlation network, which represents regions of the brain that are co-activated in specific contexts. Connectomics provides insights into the architecture of these networks, and how the architecture (i.e., structure) is associated with different behaviour (i.e., function) Sporns et al. (2005). Connectomic studies are driven by, and drive both quantity and quality of neuroimages.

To summarize, large-scale repositories of high-resolution neuroimages are essential for critical clinical and behavioral studies. However, the highly sensitive nature of the data collected – images of human brains is a significant cause for concern with respect to data privacy. Consequently, neuroimage studies anonymize subjects by removing all personally identifiable information. This simple step prevents a naive attacker. However, analogous to de-anonymization attacks in social networks, as we show in this study, neuroimages can be de-anonymized. De-anonmyziation of a subject in an external dataset can de-anonymize all other records of the same subject in other datasets. Such an attack would significantly compromise privacy of individuals.

In this paper, we present a de-anonymization attack on neuroimages in the public domain. Our attack model assumes that there is an entity (the attacker) with a set of personally identifiable neuroimages (potentially from the past), and a public domain database of de-identified patient records that contains neuroimages. This is indeed the existing setup, where imaging centers have access to identifiable imaging data, and repositories from research efforts such as the Human Connectome Project release large amounts of de-identified neuroimaging data, metadata, and often, highly sensitive genomic data. We demonstrate that using our technique, imaging centers can reference imaging data across these datasets, and gain access to patient metadata and health records. We use methods based on matrix sampling and non-linear dimensionality reduction to identify subjects with high accuracy. Our proposed methods are shown to have provide theoretical guarantees, while working exceedingly well in practice, in terms of de-identification accuracy and computational cost.

We make the following specific contributions in this paper:

• •

Present the necessary mathematical framework for leverage score sampling and t-distribution Stochastic Neighbor Embedding (t-SNE) – the core algorithms used to efficiently implement the proposed attack.

• •

Use both resting state and task-data in the HCP to infer the identity of individuals when one of the datasets has been de-anonymized. Specifically, we show that de-anonymization of a set of subjects performing one task can result in their identification, even if they are performing different tasks.

• •

Use anonymized task data in the HCP to identify the task being performed by a subject using t-distribution Stochastic Neighbor Embedding.

• •

Predict the efficacy with which an unknown subject is performing a given task from the de-identified fMRI.

• •

Show that the signatures can be used to de-anonymize subjects with neurological disorders such as Attention Deficit Hyperactive Disorder (ADHD).

• •

Simulate multi-site image acquisition and demonstrate the robustness of signature to different functional MRI machines.

Our demonstrated attack does not rely on any meta-data such as age, sex, ethnicity, education, intelligence, etc. Instead, it relies on patterns in the functional image, which are unique to individuals. In view of our attack, we also highlight challenges associated with simultaneously defending against the attack, while retaining integrity of data in a way that supports necessary data analyses.

2 Related Literature

The topic of privacy and confidentiality is not new in neuroimaging studies. Data sharing between laboratories and open-data access for the public is essential for collaborative research, and for ensuring reproducibility. Large-scale efforts such as International Neuroimaging Data-sharing Initiative (INDI), Alzheimers Disease Neuroimaging Initiative (AFNI), and the Human Connectome Project (HCP) often need to strike a fine balance between enabling research, while respecting the privacy of subjects. A primary requirement of privacy is to prevent re-identification, or de-anonymization, which is one of the core objectives of the INCF Task Force on Neuroimaging Datasharing (Poline et al., 2012).

In the United States, the Department of Health and Human Services (HHS) has specified standards for the privacy of identifiable health information. The legal requirements of these standards include removal of identifiable information, such as name, social security number (SSN), contact details, home address, etc. These standards are broadly drafted for all studies involving human subjects. The applicability of these standards to specific neuroimaging studies for medical doctors or non-medical scientists is complicated, and is described in detail by (Tovino, 2005). Similar standards are established by organizations such as the National Institute of Health (NIH) and Organization for Economic Cooperation and Development (OECD) (Poline et al., 2012).

The anonymization of subjects, as mandated by the HHS Privacy Rules, protects against naive attackers, but does not account for attacks by a competent adversary. Raw 3D images of the brain, regardless of modality – structural MRI, CT scans, MEGs, etc. also include facial features. Each image can be thought of as an overlay of several 2D images, each of which has the outline of the subject’s face, such as shape of nose, cheeks, eye sockets, along with the cranium that houses the brain. The problem of de-identification was first studied by (Chen et al., 2007). (Budin et al., 2008) showed that the chances of matching a 3D reconstructed face with the photograph of the subject was greater than what was expected by chance. With increasing resolution of strutural images, various techniques have been developed with the aim of overcoming threats to privacy. The process of skull stripping – removing non-brain voxels, was developed well before this threat was first studied. Skull stripping classifies voxels as brain and non-brain, and masks the latter. This procedure is effective in removing the skull, when provided with a faceless image, but ineffective in presence of facial features, since the algorithms confuse facial voxels and brain voxels. (Bischoff-Grethe et al., 2007) describe a procedure for de-identifying images by removing voxels that correspond to pre-defined facial features. (Budin et al., 2008) propose deformation of facial features to obfuscate the face, however the effect of this transformation on the integrity of brain voxels is unknown. (Milchenko and Marcus, 2013) describe a more conservative approach that only deforms the surface of the face. Another commonly used strategy is to blur the face, instead of removing the voxels altogether (Holmes et al., 2015). However, all of these procedures have been shown to have an adverse affect on the quality of images, with respect to downstream analyses.

The security and privacy implications of functional MRI data are relatively unexplored in the security community, particularly as they relate to existence, identification, and use of brain signatures. Brain signatures or brain fingerprints are patterns in the functional brain image that are unique to individuals. (Finn et al., 2017) show that two functional connectomes belonging to the same subject are more similar than functional connectomes drawn from two different subjects. It has also been shown that these distinct profiles can be used to predict fluid intelligence. These findings are important to precision psychiatry, a discipline whose goal is to find key individual differences, which in turn aids in the generation of models that can predict behavior. However, there are serious privacy concerns, since the accuracy in identification was shown to be around 90%, and when restricting the analysis to the parieto-frontal region, the accuracy of identification is close to 100%. Similarly, (Vanderwal et al., 2017) show that individual differences in functional connectivity when viewing fast-paced movies can be used to identify individuals with close to 100% accuracy. A leverage-score based sampling method was first presented by (Ravindra et al., 2018). Leverage-score sampling identified a small set of discriminative features that strongly expressed the signature. These features are used to identify small regions, called parcels on the cerebral cortex, which are important to the task of identification.

In this paper, we use leverage score sampling, along with an alternate technique based on t-distribution stochastic neighbor embedding for various identification tasks. Our methods offer a number of advantages over state of the art techniques: first, they offer higher accuracy in identification; second, our method automatically selects features from connectomes, without requiring any knowledge of underlying electro-physiological processes or anatomical structures; third, the features selected by our method are shown to be robust across populations of subjects. For these reasons, our methods provide an excellent basis for a de-anonymization attack.

To clearly characterize the privacy threat, we compute the similarity matrix obtained by applying the method of Ravindra et al. (Ravindra et al., 2018) on the resting-state functional MRIs from the Human Connectome Project (HCP) (Section 3). The results are visualized in Figure 1. The strong intra-subject similarity is represented by the high values on the diagonal; conversely, the weak inter-subject similarity is represented by low off-diagonal values. This pattern holds even in case of task functional MRI, though the contrast between diagonal and off-diagonal values is less stark, as shown in Figure 2.

These results suggest that if one publicly available dataset is de-anonymized, or if a patient’s record at one hospital is de-anonymized, then we can accurately de-anonymize any other corresponding patient datasets or patient records. This potentially reveals confidential details such as the presence of, or progression of disease, behavioural traits, and access to corresponding non-imaging data, such as age, sex, contact details, gender identity, sexual orientation, etc. This issue is of greater concern, especially for multi-modal datasets such as the HCP and Enhancing Neuro Imaging Genetics through Meta Analysis (ENIGMA), which also share Genome-Wide Association Studies (GWAS) data. GWAS is used to find genetic variants, and to predict genetic predisposition to diseases. This is an increasingly important threat, since neuroimage datasets are increasingly enriched by patient details that are relevant to clinical and research studies.

3 Brain Signatures

This section is organized as follows: first, we describe various mathematical models and methods that form the basis for our de-anonymization attack. We then describe the Human Connectome Project (HCP) and ADHD-200 datasets on which we demonstrate our attack. We also describe the role of the canonical Human Brain Atlas in this process. Finally, we perform a comprehensive experimental study on all aspects of our attack, its accuracy, and scope.

3.1 Methodology

We assume an attacker has two functional MRI datasets in their possession and that one of them is de-anonymized. The attacker wishes to de-anonymize the other dataset. However, such an attacker would first need to convert raw neuroimages into a format suitable for analysis, and then extract individual-specific brain signatures from these processed images. A functional MRI is a 4D image. It is comprised of 3 spatial $(x,y,z)$ dimensions, and one temporal dimension $(t)$. For a given time point, an fMRI is a 3D snapshot of the brain. Each 3D unit is a voxel (a volume pixel). Similarly, for a given spatial location, fMRI measures the activity of the corresponding voxel across time. This signal corresponds to a “time-series”.

A raw functional MRI has spatial and temporal artifacts. We apply a denoising procedure that corrects for head motion by the subject during image acquisition, removes skull voxels, and corrects for non-homogeneous magnetic fields. We account for difference in sizes of brains by registering all brains to a standard brain. This preprocessing procedure is described in detail in Section 3.2.1. The output of this step is a denoised, normalized image. We group voxels in this image into regions (or parcels) using a standard brain atlas (Section 3.2.2). We then compute the average time-series for each region by averaging over all voxels. We organize this data into a 2D matrix, in which each row corresponds to the averaged time-series associated with a region ( the matrix has dimensions regions $\times$ time-points). We quantify the co-activity between different regions using correlation measures to create a regions $\times$ regions similarity matrix, which is a representation of the functional connectome. The procedure is repeated for all images in the database.

Each element in the similarity matrices can be viewed as a feature of the corresponding connectomes, and the goal is to find a compact set of features that distinguish subjects from each other. To accomplish this, we vectorize the similarity matrix by stacking its columns one on top of the other. In this manner, each 4D image is reduced to a single (column) feature vector with $regions^{2}$ elements. We take all of the feature vectors corresponding to images in our de-anonymized set and organize them into a matrix. Each column of this matrix corresponds to a subject, and each row corresponds to a feature from the similarity matrix. We compute a second matrix in a similar manner from all of the images in the anonymous image dataset. The goal is to use these matrices to de-anonymize the second dataset. We now introduce two techniques for carrying out such an attack.

Our first technique is based on leverage-score sampling. At a high level, leverage-scores of a matrix measure relative importance of rows/ columns. Recall in our setting that a row of our group matrix corresponds to individual entries (features) in the similarity matrix. We use leverage scores to identify important components (or subspaces) in these vectors, and only retain the rows (features) with high scores. The output of this procedure is a reduced group matrix with (far) fewer rows; however these rows are important for discriminating between individuals. Finally, we measure similarity between all pairs of individuals across the two subject groups using the reduced group matrices based on Pearson Correlation. Pairs of subjects with high correlation correspond to predicted matches. In section 3.1.2, we formally define leverage-scores and the algorithm for leverage-score sampling. This technique is used to de-anonymize healthy subjects at rest and while performing tasks. We also demonstrate their effectiveness of this technique in de-anonymizing patients with ADHD.

Our second algorithm is based on t-distribution stochastic neighbour embedding (t-SNE). This non-linear dimensionality reduction technique is used for clustering and visualization. We use t-SNE on the previously described group matrices to reduce the number of rows down to two. The clusters obtained thereof are used to separate various tasks and also predict the nature of task from a new, anonymized image. The details of our t-SNE based method are presented in Section 3.1.3. We show that t-SNE is particularly effective for our application because it maintains pairwise distance in low dimensions well, while maintaining underlying cluster structure.

3.1.1 Models and Methods

Generating Functional Connectomes.

Given raw fMRI images, the general pre-processing pipeline, shown in Figure 4, removes temporal and spatial artifacts from raw images. These de-noised images are collections of time-series data, with each time series having an associated position in 3-dimensional space. The time-series matrix (voxel $\times$ time) is z-score normalized, averaged over all voxels in a region (as defined by an atlas), and used to compute correlations (using Pearson correlation) to generate a dense co-firing matrix. Note that this matrix can also be interpreted as a weighted complete graph, where nodes correspond to regions and edge weights correspond to correlation in neuronal activity.

A variant of this preprocessing pipeline is used in most fMRI studies. To demonstrate a de-anonymization attack, we require two datasets – a dataset that is de-anonymized, and the second target dataset. We will use the identities revealed for connectomes in the first dataset to predict the corresponding identities in the target dataset. In our experiments on the HCP dataset, we use the left-to-right encoding (L-R) of a set of 100 subjects to create the first dataset; we use the right-to-left enconding (R-L) of the same subjects to create the target/second dataset. The encodings arise from different ordering of scans, which we describe in Section 3.2. We vectorize each correlation matrix and stack them into two matrices, one per dataset as shown in Figure 3. We note that the symmetry of the correlation matrix allows us to vectorize only the top (or bottom) triangle of the correlation matrices.

We use matrix sampling to identify features that encode distinguishing signals. By restricting the predictive procedure to these features, we obtain higher performance in identification, while also making prediction faster. In resting-state fMRI dataset in HCP, this procedure is used to reduce the feature-space from $64620$ to $<100$ rows. In our second set of experiments, we use a non-linear dimensionality reduction technique (t-SNE) to distinguish between tasks; however the massive reduction in dimension results in loss of individual specific signals and hence cannot be used in specific applications where the leverage-score based method is found to be superior. To this end, our two proposed methods are complementary.

3.1.2 Row sampling for identifying location of signatures

In our description of the experimental setup in Section 3.1.1, we introduce group-level matrices comprised of vectorized functional connectomes. Let us call this matrix $A$. In our example, $A$ has $64620$ rows (derived from 360 regions of the brain from the atlas for $(360\times 359)/2=64620$ region-pair correlations or features), with each row representing one entry from the region-wise correlation matrix. $A$ has 100 columns, one for each subject.

Given a matrix $A\in\mathbb{R}^{m\times n}$, the problem of row-sampling is to choose a subset $s$ of rows, $s<m$ such that the resulting matrix $\tilde{A}\in\mathbb{R}^{s\times n}$ approximates $A$. Since $A$ and $\tilde{A}$ are of different dimensions, the error in approximation is expressed as $||A^{T}A-\tilde{A}^{T}\tilde{A}||$. Row sampling can be viewed as a method for dimensionality reduction. However, it is fundamentally different from other well-known approaches such as Principal Component Analysis (PCA). PCA uses the eigenvectors of the covariance matrix as basis vectors. However, eigenvectors themselves have little physical interpretability, since the original data vector has no interpretable representation in the eigenvectors. On the other hand, row-sampling techniques allow us to retain original data vectors, and can therefore be used for feature selection. Our goal is to find a small subset of rows that strongly express the signal required to discriminate subjects (i.e., the columns).

A randomized meta-algorithm that takes a matrix $A\in\mathbb{R}^{m\times n}$ and outputs a sketch matrix $\tilde{A}$ is presented in Algorithm 1 (Drineas et al., 2006).

In this algorithm, each row of the matrix is associated with sampling probability $P$s. In each of $s$ iterations, a row of $A$ is picked in i.i.d (independently and identically distributed) trials. The re-scaling of $\tilde{A}$ in line 6 ensures that $\tilde{A}^{T}\tilde{A}$ is unbiased, i.e., $\mathbb{E}[(\tilde{A}^{T}A)_{i,j}]=(A^{T}A)_{i,j},\forall i\in\{1\dots m\},j\in\{1\dots n\}$ (Drineas et al., 2006)

The theoretical guarantees and practical performance of this meta-algorithm hinge on a cleverly chosen distribution $P$. For instance, a Uniform Random distribution performs poorly in practice. On the other hand, a probability distribution biased on norms of the rows has an intuitive appeal, since important features would be associated with higher weights. This leads to $l_{2}$ sampling, wherein $P$ is defined by the 2-norm of rows.

[TABLE]

If the sampling is weighted by $l_{2}$ norm and we select $\mathcal{O}(m\ \log{m})$ rows, Drineas et al. (Drineas et al., 2006) show that:

[TABLE]

This suggests that $\tilde{A}$ can be used as a low-rank approximation to $A$. However, the error bound defined herein is additive. A stronger error-bound is one in which the error is relative, i.e., the approximation is within a factor $(1\pm\epsilon)$ of the true value. A compact yet powerful method to achieve this is based on a concept of leverage scores.

Leverage Scores.

Given a matrix $A\in\mathbb{R}^{m\times n}$ with $m\gg n$, let $U\in\mathbb{R}^{m\times n}$ be an orthogonal matrix that spans the column space of $A$. For convenience, we assume that $A$ has full column-rank. $U$ has two properties:

$U^{T}U=I$ (as $U$ is orthonormal) 2. 2.

$UU^{T}=P_{A}$ (a projection matrix that spans the column-space of $A$)

In manner similar to Equation 2, we can define a probability distribution on the rows of $U$. These probabilities are known as leverage scores.

[TABLE]

If we select $\mathcal{O}(k\log{k}/\epsilon^{2})$ rows, we get a relative error bound as follows:

[TABLE]

where $\zeta\in\{2,F\}$, $\epsilon\in[0,1/2)$, $A_{k}$ is the best rank-k approximation and $\dagger$ represents the pseudo-inverse ((Drineas et al., 2008)). These randomized algorithms provide the theoretical basis for our de-anonymization approach, which samples the top-leverage scores in a deterministic manner, which provides good matrix sketches (Cohen et al., 2015; Papailiopoulos et al., 2014). In Ravindra et al. (Ravindra et al., 2018), this method is called Principal Features Subspace Method.

Principal Features Subspace Method

As before, let $A$ be the matrix of connectomes, and $U$ be the orthonormal matrix that spans the column space of $A$. Additionally, let $t$ be the number of features that need to be retained. An example of such a matrix $U$ is constructed using left singular vectors from a Singular Value Decomposition (SVD) of $A$. We can then compute the leverage($l$) scores of $A$ as:

[TABLE]

We sort the leverage scores and retain the features corresponding to the top $t$ leverage scores. We call this subspace the principal features subspace. In contrast to prior randomized approaches, we select features in a deterministic manner; Cohen et al. (Cohen et al., 2015) provide theoretical bounds for this selection process.

Starting from the matrix of vectorized correlation values $A$, we compute the left singular vectors using SVD. The ordering of edges according to their leverage scores, if robust across different groups, is indicative of a set of features that can accurately fingerprint an individual’s functional connectome. In this case, for a given parcellation scheme, and for a given measure of region-to-region coherence, we need to apply SVD just once to determine the relevant edges.

3.1.3 t-Distribution Stochastic Neighbours Embedding (t-SNE)

The goal of t-SNE is to map high-dimension data-points into a low-dimension space, while maintaining the cluster structure of the data. It relies on the assumption that high-dimensional data lies on several different, but related, low-dimensional manifolds. For instance, images of objects from multiple classes seen from different viewpoints. t-SNE is commonly used in visualization, since it can be used to map data down to a visual plane (i.e., in two-dimensions). We now describe the use of t-SNE for de-anonymization.

Stochastic Neighbours Embedding (SNE) converts pairwise distances between points in a dataset to conditional probabilities that represent their degree of similarity. For any two high-dimensional data points $x_{i}$ and $x_{j}$,

[TABLE]

Here, $\sigma_{i}$ is the variance of a Gaussian centered at $x_{i}$. Equations of the same form can be written for pairs of points $y_{i}$ and $y_{j}$ in the low-dimension embedding. We denote the associated conditional probability as $q_{j|i}$. A mapping that respects cluster structure needs to map pairwise distances of points. Hence, a good mapping would result in the same values for $p_{j|i}$ and $q_{j|i}$. An intuitive measure, which would penalise any deviation of $q$ from $p$, is the Kulbeck-Leiber divergence, which is defined as:

[TABLE]

The only unspecified detail here is the procedure to set $\sigma_{i}$. The variance about a point in a sparse neighborhood is much larger than the variance about a point in a dense neighborhood. Any choice of $\sigma_{i}$ induces a probability distribution $P_{i}$ over all other data-points. Hence, control on the entropy of $P_{i}$ can be exercised by controlling $\sigma_{i}$. SNE models $P_{i}$ on the basis of a user-defined quantity, perplexity:

[TABLE]

where, $H$ is the entropy defined as:

[TABLE]

SNE minimizes the KL-divergence using a gradient descent algorithm. The gradient descent algorithm is remarkably simple. Differentiating the cost function in 6, we get:

[TABLE]

The $(y_{i}-y_{j})$ term in the gradient can be interpreted as the vector along which a force is felt between the pair of points in high dimension. The sign of the coefficient represents whether the force applied is attractive or repulsive. If the high-dimensional points and their corresponding low-dimension map are similar, the magnitude of the force felt is negligible.

SNE is conceptually simple, however, it has several shortcomings. First, the KL divergence is assymmetric, i.e., $KL(P||Q)\neq KL(Q||P)$, making it computationally expensive. Second, SNE suffers from the problem of “data-crowding”, which we will explain with an example: if the data is inherently in a certain space (say in 10 dimensions), and SNE is used to map the data down to two dimensions, then this map may not be not faithful. For instance, 11 datapoints can be equidistant in 10 dimensions, but geometry forbids this in two dimensions (a maximum of 3 points can be equidistant in 2 dimensions). Beyond data crowding, the variance $\sigma_{i}$ needs to be estimated for each data point.

The t-SNE method, first introduced by van Der Maaten (van Der Maaten and Hinton, 2008) is designed to overcome these problems. It overcomes the assymetry problem by minimizing a single KL-divergence as follows:

[TABLE]

This is symmetric because the joint probability distributions are symmetric, i.e., $p_{ij}=p_{ji}$ and $q_{ij}=q_{ji}$, $\forall i,j$. The probability distributions themselves are given by:

[TABLE]

This definition of $p_{ij}$ is potentially problematic for outliers. If $x_{i}$ is an outlier in high-dimension, then $p_{ij}$ is very low for all other points $j$. Hence, the position of the point in the low-dimension map does not affect the cost function. Hence, its position is not well determined with respect to positions of other points in the dataset. This is avoided by setting $p_{ij}=(p_{i|j}+p_{j|i})/2$, thereby ensuring that $\sum_{j}p_{ij}>1/2n,\forall j$. This implies that each point exerts some control over the cost function, making it robust to outliers.

We can also define $q_{ij}$ in a similar fashion. Here, the variance is estimated once for the entire dataset, hence we circumvent having to estimate the variance of a Gaussian about each point. To overcome the data-crowding problem, t-SNE uses the student t-distribution with one degree (also called the Cauchy distribution) to define the probability distribution in the low-dimension space. This distribution differs from a Gaussian in that it has a heavier tail. Hence, pairs of points at moderate distances in the high-dimensional space can be faithfully mapped to low-dimension, thereby preventing unwanted attractive forces between such points. Formally:

[TABLE]

This equation has a desirable form because $(1+||y_{i}-y_{j}||^{2}$ approaches the inverse-square law for large $||y_{i}-y_{j}||$, hence it is robust to changes in the scale of the map for map-points that are far away from each other. The gradient for t-SNE is slightly different, since we use both Gaussian and t-distribution.

[TABLE]

We can now assemble all the pieces into a simplified version of the t-SNE algorithm.

3.2 Dataset

The Human Connectome Project (HCP) Consortium provides a large collection of neuroimage data over the public domain. The Washington University-University of Minnesota (WU-Minn) project, which is part of HCP conducted a Healthy Young Adult study (Essen et al., 2013) resulting in 3T structural and functional MRI for 1113 adults, 7T resting and task magnetoencephalography (MEG) from 184 subjects, and 3T and 7T diffusion data. In this paper, use resting state functional MRI and task functional MRI for seven tasks.

The resting state functional MRI is acquired over the course of two sessions, spread across two days. The duration of each session was 30 minutes, with the first half session corresponding to L-R encoding and the second half session corresponding to R-L encoding. The voxels are isotropic, with side $2mm$; the temporal resolution (TR) is 720 ms. In this paper, we use data from 100 “unrelated subjects” to avoid genetic factors from confounding the results. For a detailed description of the acquisition protocol, see Smith et al. (Smith et al., 2013).

The HCP image acquisition procedure collected task based functional MRI in addition to resting state functional MRI. The first session consisted of one session of rest, followed by working memory, gambling, and motor tasks. The second session consisted of another session of resting state activity, followed by language skills, social cognition, relational processing, and emotional processing. The tasks themselves comprised of visual and auditory stimuli presented to the subject, who could respond by means of buttons placed near their hands. The responses were recorded, and meta-data such as measures of performance were generated. We refer interested readers to Barch et al. (Barch et al., 2013) for justification of choices of experiments and details of each experiment.

The ADHD-200 dataset was collected by the International Neuroimaging Datasharing Initiative (INDI), as part of a collaboration of eight imaging sites around the world. It consists of multiple scans from 362 children and adolescents diagnosed with ADHD, along with 585 controls. The publicly available dataset consists of both structural MRI, resting state functional MRI, and associated phenotypic information Bellec et al. (2017).

3.2.1 Preprocessing

As with all images, pre-processing helps to clean the data of spurious patterns that arise due to technical, biological, and acquisition protocols. In this paper, we follow the “minimum pre-processing pipeline” prescribed by Glasser et al. (Glasser et al., 2013) and Smith et al. (Smith et al., 2013). The generic steps are shown in Figure 4.

Spatial pre-processing removes artifacts that affect the comparison of a given voxel across time. This includes correction for spatial distortions due to gradient non-linearity, which occurs due to local non-uniformity of the magnetic field. This is followed by head motion correction, which is vital because subjects invariably move their head during the course of imagine. Then, the functional MRI is registered to the subject’s own structural MRI, to ascertain the structural membership of voxels in the functional image. To facilitate comparison across subjects, factors such as differing sizes of brains, difference in sizes of regions in brains need to taken into account. This is achieved by mapping all structural MRIs to a standard brain model, called the Montreal Neurological Institute (MNI) space. Then, voxels in the surface of the brain, called the cortex are separated from the sub-cortical volumetric voxels into a standard CIFTI format. The rationale behind storing data in this format is explained in Glasser et al. (Glasser et al., 2013). In this paper, we only use the cortex for identification.

The HCP temporal pre-processing pipeline suggests a minimal high pass filter (cutoff of 2000 seconds) and a slow roll off beyond that, so as to achieve de-trending of data. In task MRI, the cutoff was 200 seconds. Temporal pre-processing is extremely important in studies that rely on correlation between time-series, which is the case in our work. In resting state functional MRI, the signals of interest correspond to fluctuations of low frequency that arise due to haemodynamic responses to neural activation. Hence, we use a bandpass filter between 0.008 Hz and 0.1 Hz. We also apply global signal regression on resting state data. This procedure removes signal-components that are expressed uniformly throughout the brain.

For the ADHD-200 dataset, we use the Burner pipeline, as outlined by Ashburner et al. Ash (2013). Broadly speaking, the steps followed are in line with Figure 4. We refer interested readers to http://www.preprocessed-connectomes-project.org to download the preprocessed files from different pipelines.

3.2.2 Brain Atlas

A brain atlas is an annotated standard-brain image. Each brain voxel in an atlas is associated with a label. Atlases are necessary in fMRI analyses due to the unreliability of single voxel time-series, which is due to a combination of factors. First, the process of registration and the other pre-processing steps may alter the values of a time series. Second, voxels are created without regard to anatomical or electro-physiological properties of the brain. Ideally, each voxel is given exactly one label. This would make the atlas non-overlapping. Another desirable property is that labels are localized to small, functionally similar regions – called parcels. The process of generating labels can either be done manually, or can be automated. Manual labels are high quality, as the annotations are provided by experts; however, they are slow and expensive. Atlases can also be automatically generated. For instance, a simple scheme to create an atlas with 1000 ROIs (regions of interest) would involve sampling 1000 voxels from a uniform distribution. Then, the regions are progressively grown on the basis of functional similarity and/or physical proximity.

Given a connectome, expressed as a $voxel\times time$ matrix and a membership function for each voxel, one can collapse it into a $region\times time$ matrix, simply by computing region-wise average of time series data. These parcels or regions also serve as a useful abstraction, since they allow us to think of the brain as having distinct regions. In this paper, we use the atlas due to Glasser et al. (Glasser et al., 2016), since the atlas itself was developed on the the same HCP dataset. Additionally, it has been shown that this atlas is sufficient to capture patterns that are unique to individuals (Ravindra et al. (Ravindra et al., 2018)). The atlas partitions the brain into 360 regions, symmetrically distributed across the left and right hemispheres. Similarly, we use the AAL2 atlas due to Tzourio-Mazoyer et al. Tzourio-Mazoyer et al. (2002) for the ADHD-200 dataset. The use of two different atlases on two different datasets shows the robustness of our methods to different atlases and datasets.

3.3 Experimental Evaluation

In this section, we demonstrate de-anonymization attacks under different scenarios using our methods. First, we show that de-anonymization of a subject performing one task can make them vulnerable to de-anonymization in any other dataset, where they may be performing different tasks. We also show that we can predict the nature of task being performed by the subject. Furthermore, we show that the signatures obtained for a task can be used to predict their efficacy in performing the task. These results are important in demonstrating the extent to which de-anonymization can compromise the privacy of healthy individuals who participate in neuroimaging studies. However, the more serious problem is with hospital records, which typically have subjects with neurological disorders. In this context, we show that we can de-anonymize subjects with neurological disorders such as ADHD. Finally, we simulate the most realistic scenario, wherein patients have images obtained from different MRI machines. Even in this case, we show that we can identify subjects with high accuracy.

3.3.1 De-anonymization of subjects across tasks

We first demonstrate an efficient de-anonymization attack in task functional MRI. We assume that one data-set is de-anonymized, and we are interested in characterizing its impact on the anonymity on other datasets. The tasks performed by subjects in the two datasets are potentially different. For instance, the REST1 may be de-anonymized and we are interested in finding the correspondences in the LANGUAGE task. The accuracy in de-anonymizing a dataset of resting-state functional MRIs in the HCP was found to be in excess of 94%, as shown in Figure 1. However, task fMRIs are typically more complex, since task driven brain activities are more complex than spontaneous firings recorded in resting state sessions. Furthermore, task-based activations are localized to specific regions and lobes that are responsible for performing the task. For instance, a task with only visual stimuli would activate the visual cortex, but not the auditory cortex.

As described in Section 3.1.1, we construct two group-wise matrices. The first group has the L-R encoding of REST1, and the L-R encoding of the seven tasks. In the second group, we have the R-L encoding of REST2, along with the R-L encoding of the same seven tasks. We stack the vectorized network representations of the images into two matrices – one for each group. We assume that each of the datasets in the first group is de-anonymized and our task is to reveal the corresponding images in the second group. The feature space of both groups are restricted to the features with top leverage scores in the first group. Figure 3 shows a succinct representation of this process.

The results for this experiment can be seen in Figure 5. It shows that the accuracy of identification is stronger along the diagonal, i.e., when both the datasets correspond to images of the same task. The accuracy is particularly high (> 94%) when they both are resting state functional images. Similarly, accuracies for language processing and relational processing tasks are $>90\%$, and for social processing task is $>80\%$. Surprisingly, MOTOR and WM tasks are ineffective in predicting the correspondence, even for the same task. We also can see that the matrix is clearly asymmetric, implying that de-anonymization of different tasks has varying impact on the anonymity of other datasets. On the whole, we observe that if a resting-state dataset is de-anonymized, it can be used to de-anonymize other tasks with high accuracy. This is particularly worrisome, since most studies produce resting state functional images. On the other hand, de-anonymizing tasks such as working memory and motor tasks reveals relatively less about the identities of individuals in other datasets.

3.3.2 Prediction of task

In this experiment, we show that the task being performed by an anonymized subject can be predicted with high accuracy. To demonstrate this result, we rely on t-SNE (Section 3.1.3). We assume that the task labels of images from 50 subjects from the HCP are known. We stack the vectors of all 100 subjects into one matrix of dimensions $800\times 64620$ (100 patients, each of who has one resting and seven task, for a total of 800 rows). Then, we use t-SNE to reduce the dimensions down to two. The resulting matrix has dimensions of $800\times 2$. We call these two dimensional vectors as task-identifying signatures. Finally, we assign the task labels of the unknown data-points on the basis of their nearest neighbor with known task label. The result of this procedure is shown in Figure 6. The figure shows eight compact clusters – one per task, separated cleanly in the 2-dimensional map. The only exception is resting-state functional MRI (in pink). However, this is still extremely well clustered for real-world data. The objective function of t-SNE aims to respect pairwise distance between all pairs of points; hence this suggests that functional MRI of a subject is more similar to other subjects performing the same task than with the same subject performing different tasks. This observation is consistent with our previous experiment, where high accuracy is observed when both datasets corresponded to the same task. The task prediction accuracy using the nearest-neighbour approach over 100 iterations was 100% for seven tasks and $99.01\pm 0.52$ for the resting-state images. In instances where resting-state images were mis-classified, they were classified as gambling. This can be observed in Figure 6 as well.

3.3.3 Prediction of performance during task

In the previous experiment, we showed that a non-linear dimensionality reduction technique such as t-SNE is capable of finding the underlying cluster structure that allows us to predict what task is being performed by a subject. In this experiment, we predict how well they perform at the task. HCP provides task-performance metrics, which is a measure of effectiveness during the language processing, emotion processing, relational processing, and working memory tasks. This measure is expressed as a percentage accuracy of correct replies for the respective tasks. We show that our signatures can be used to predict the performance metrics of new subjects.

We divide the subjects into two sets, chosen at random – train and test, of sizes 80 and 20 subjects, respectively. For each set of subjects, we compute the group matrices from the L-R images. Hence, the data matrix consists of vectorized correlation matrices of the subjects in train set for a particular task. The target vector consists of the performance metric for the same task. Similarly, a group matrix is constructed for the test set. Since we have the ground truth, i.e., the performance metrics for the test set, we can measure the goodness-of-fit for our model.

First, we compute leverage scores for the group matrix of train samples. We restrict the feature-space to the top leverage scores. We use SVM for regression, with the performance metric as the target. The coefficients learned from the train-set are used to predict the scores in the test set. To avoid biases due to choices of train and test set, we repeat the experiment 1000 times.

The results are shown in Table 1 for both train and test. All the errors are within 4% of the true value. We note that in our setup, we do not use timing information. This information encodes the exact time frames for the different blocks of stimuli within an experiment. Most studies also provide performance metrics within each time-block. The use of this additional data further improves prediction, and provides deeper insights that predict the neuronal response of individuals to particular sub-types of stimuli, such as math and story inputs, which is part of the language task.

3.3.4 Prediction of Identity of subjects with ADHD

In this section, we extend the concept of brain signatures to subjects with neurological disorders such as Attention Deficit Hyperactive Disorder (ADHD). We will use the dataset from the ADHD-200 dataset. As before, we stack the vectorized connectomes of subjects into two matrices, one per session. Since we use the AAL2 atlas for the ADHD-200 dataset, each data-point now has 6670 features.

The stark difference between intra-subject similarity and inter-subject similarity for ADHD Subtypes 1 and 3 are shown in Figures 7 and 8. We divide the subjects into train and test sets, and pick features that correspond to the highest leverage scores of the train matrix, as shown in Figure 3. When we restrict the feature space in the test subjects to the same features, we find the test accuracy to be $97.2\pm 0.9$%.

This result is of significant interest for the following reasons. First, the acquisition protocol of ADHD-200 is different from HCP; also, the atlas used here is drawn differently from the one used in the previous experiments, and has different number of regions. Second, the subjects in this dataset are children with ADHD, whereas the HCP dataset is comprised of healthy young adults. Despite all of these differences, we find a consistent signature that can correctly identify subjects with high accuracy. Finally, functional MRIs of patients exist in patient records outside of neuroimaging studies. Hence, identifiable data of such patients is often not stored with the same strict protocols, thereby increasing vulnerability to de-anonymization attacks. Furthermore, even if the dataset is a combination of cases and controls, which is often the case, we can correctly match scans across datasets. In Figure 9, we show that the strong values on the diagonal suggests a high prediction accuracy, which was observed to be $94.12\pm 3.4$%.

3.3.5 Effect of multi-site image acquisition on signatures

In previous experiments, we varied different parameters such as rest/ task, case/ control and parcellation schemes. However, in the most general case, different scans of a subject can be acquired at different sites/ hospitals. Therefore, the make and model of the instruments used to record the neuronal activity can be different for the two sessions. Hence, the accuracy of identification could be adversely affected.

In this final experiment, we show that even in the case of multi-site acquitisition with different protocols, we can still predict the identity of an anonymized scan. We simulate a multi-site acquisition in the following manner: for each time-series signal in the second session of the Healthy Adult dataset by the HCP, we add Gaussian noise whose mean is equal to the mean of the original signal and whose variance is a fraction of the variance of the original signal. After this additional noising step, we compute the correlation matrices for the second session. Following this, the steps are identical to the previous setup (i.e., Figure 3). We compute the test accuracy for different noise values, and the results are summarized in Table 2. For small values of noise, the prediction accuracy is still in excess of 90%.

We simulate the data for multi-site acquisition because of unavailability of large-scale publicly available datasets. However, this is a common occurence in practice, where a patient may have records at multiple hospitals. Furthermore, due to logistic reasons, a number of studies (including ADHD-200) are conducted in parallel at multiple institutions around the world. Hence, corrections for in-homogeneity in magnetic fields and other batch correction methods have been developed to enhance similarity across sites. It is for this reason that we believe that in our simulation, low values of noise variance reasonably simulate a multi-site acquisition.

4 Discussion & Conclusion

In this paper, we demonstrate a de-anonymization attack on neuroimaging data. Specifically, in functional MRIs, if one dataset of images is de-anonymized, we show that it is possible to de-anonymize any other datasets containing scans of the same subjects. This attack could potentially reveal other information contained in patient health records. We also show that it is possible to predict the task being performed, as well as the ability of a subject to perform specific tasks.

An effective defense to this type of an attack would require removal of the signature pattern without damaging the integrity of the image with respect to downstream analyses. In other words, every other property of the image, like the presence of a lesion or injury, change in relative sizes of different regions of the brain due to disease, etc. need to be maintained. To this end, our work presents a particularly important contribution, in that is clearly identifies a small signature that codes identity. By doing so, it provides a localized region where noise can be added to most effectively defend against such attacks. The impact of such noise added to targeted regions on downstream analyses is a function of the analyses, and must be assessed in specific application contexts.