ADVERSARIAL PRIVACY PRESERVATION IN MRI SCANS OF THE BRAIN

Abstract

De-identification of magnetic resonance imagery (MRI) is intrinsically difficult since, even with all metadata removed, a person's face can easily be rendered and matched against a database. Existing de-identification methods tackle this task by obfuscating or removing parts of the face, but they either fail to reliably hide the patient's identity or they remove so much information that they adversely affect further analyses. In this work, we describe a new class of MRI de-identification techniques that remodel privacy-sensitive facial features as opposed to removing them. To accomplish this, we propose a conditional, multi-scale, 3D GAN architecture that takes a patient's MRI scan as input and generates a 3D volume in which the brain is not modified but the face has been de-identified. Compared to the classical removal-based techniques, our deep learning framework preserves privacy more reliably without adversely affecting downstream medical analyses on the brain, including segmentation and age prediction.

1. INTRODUCTION

Magnetic Resonance Images (MRI) are an essential tool used both in diagnostic and research settings, but they are a privacy risk. Detailed renderings of the head can be crafted from MRI scans using techniques such as volumetric raycasting. Those renderings, when matched against facial images, can be used to infer patient identity in a type of attack already demonstrated for CT scans (Mazura et al., 2012) . Commonly, MRI scans are de-identified before sharing using crude removalbased techniques, which seek to remove privacy-sensitive parts of the head without disturbing the brain (Figure 1 ). However, as we demonstrate, these techniques often fail to reliably mask the patient's identity, or they are so aggressive that they adversely affect downstream medical analyses on the brain, e.g. segmentation and age prediction. In this work, instead of removing potentially essential parts of the MRI scans of the head and brain, we propose to de-identify them by reshaping the privacy-sensitive regions without altering the content of medically relevant data. Our approach is to remodel privacy-sensitive facial structures rather than remove them, while leaving the brain untouched. Unlike removal-based approaches, under our method the head and face exhibit realistic appearance and structure. To accomplish this, we propose a novel multi-scale volumetric Generative Adversarial Network (GAN), called C-DeID-GAN, that conditions on a convex hull of the skull extracted from the scan to be de-identified. The generator learns to synthesize MRI volumes that preserve medically-sensitive regions such as the brain, while non-invertibly remodeling privacysensitive characteristics such as the face from the original scan. It is worthwhile to point out why such an approach is necessary, when methods that extract the brain -so-called skull-stripping methods -already exist. In short, automated measurements behave unpredictably when data is removed. As recently shown by De Sitter et al. (2020) , software designed to perform measurements (e.g. brain segmentation or age estimation) are developed to work robustly for original data (Smith et al., 2004; Schmidt et al., 2012) . If measurements are made on data deidentified by removal, it can result in inaccuracies or even total failure. Thus, remodeling rather than deleting the privacy-sensitive region would be desirable because it can protect privacy and at the same time ensure robustness of the downstream medical analyses. The main contributions of this work are as follows: 1

