Pitfalls of defacing whole-head MRI: re-identification risk with diffusion models and compromised research potential

TL;DR

This study demonstrates that current defacing techniques for head MRI images can be bypassed using diffusion models to recover facial features, and that defacing may also remove useful anatomical information, raising privacy and research concerns.

Contribution

The paper introduces a diffusion probabilistic model-based refacing pipeline that can recover faces from defaced MRIs and evaluates the impact of defacing on anatomical information useful for research.

Findings

Diffusion models can generate high-fidelity faces from defaced MRIs.

Defacing reduces the accuracy of predicting skeletal muscle radiodensity from facial voxels.

Defacing may eliminate valuable anatomical information, compromising research potential.

Abstract

Defacing is often applied to head magnetic resonance image (MRI) datasets prior to public release to address privacy concerns. The alteration of facial and nearby voxels has provoked discussions about the true capability of these techniques to ensure privacy as well as their impact on downstream tasks. With advancements in deep generative models, the extent to which defacing can protect privacy is uncertain. Additionally, while the altered voxels are known to contain valuable anatomical information, their potential to support research beyond the anatomical regions directly affected by defacing remains uncertain. To evaluate these considerations, we develop a refacing pipeline that recovers faces in defaced head MRIs using cascaded diffusion probabilistic models (DPMs). The DPMs are trained on images from 180 subjects and tested on images from 484 unseen subjects, 469 of whom are from a different dataset. To assess whether the altered voxels in defacing contain universally useful information, we also predict computed tomography (CT)-derived skeletal muscle radiodensity from facial voxels in both defaced and original MRIs. The results show that DPMs can generate high-fidelity faces that resemble the original faces from defaced images, with surface distances to the original faces significantly smaller than those of a population average face (p < 0.05). This performance also generalizes well to previously unseen datasets. For skeletal muscle radiodensity predictions, using defaced images results in significantly weaker Spearman's rank correlation coefficients compared to using original images (p < 10-4). For shin muscle, the correlation is statistically significant (p < 0.05) when using original images but not statistically significant (p > 0.05) when any defacing method is applied, suggesting that defacing might not only fail to protect privacy but also eliminate valuable information.