Quantifying privacy risks in foundation model representations of brain MRI
This paper asks whether releasing learned embeddings from pretrained brain MRI encoders—instead of raw scans—actually protects patient privacy. The authors audit five diverse encoders on two longitudinal datasets, measuring patient linkage, re-identification, and sex-attribute inference under an explicit attacker model. They find that several embeddings retain enough subject-specific structure to enable rank-1 re-identification above 90% on both datasets, and that sex can be inferred with balanced accuracy up to 95.5%. The core takeaway is that embedding release alone is insufficient to establish anonymity.
The paper is a methodical privacy audit with clear threat models and an important practical message: learned embeddings of brain MRI leak identifying information. Its longitudinal design—using scans separated by weeks to years—addresses the near-duplicate-image critique leveled at prior work. Nevertheless, the absence of raw-pixel or untrained-network baselines makes it impossible to tell whether the observed re-identification rates reflect foundation-model-specific leakage or stable anatomical similarity that any feature extractor would capture. The honest acknowledgment that architecture, domain, and objective are confounded is a strength, but causal claims about what drives risk remain unsupported.
The explicit separation of linkability, re-identification, and attribute inference is methodologically sound and addresses ambiguities in prior work. The use of longitudinal acquisitions with realistic clinical intervals directly confronts the near-duplicate-image concern. The finding that privacy risk is multidimensional is important and well-supported: reducing linkability does not guarantee reduced attribute leakage. The FreeSurfer baseline shows that even 15 hand-crafted anatomical features enable strong re-identification, reinforcing that brain morphology is intrinsically distinctive.
First, the paper does not include a raw-pixel or random-feature baseline, which Engelmann et al. showed can achieve comparable re-identification on longitudinal medical images. The FreeSurfer baseline is informative but is itself a curated anatomical descriptor, not a triviality check. Second, the dataset-dependence is extreme: SAM-Med3D drops from 89.58% ReID@1 on MIRIAD to 13.94% on OASIS-2, and 3D-Neuro-SimCLR swings by 31 percentage points between datasets. This variability suggests that acquisition, preprocessing, and cohort factors dominate model-specific effects. Third, the Canberra distance metric was selected post-hoc because it "yields higher linkability" (Appendix A.1), which risks biiding the risk estimate upward. Cross-dataset attribute inference also collapses to near-chance for most models, undermining the robustness of demographic leakage claims.
The paper fairly cites both Nebbia et al. and Engelmann et al., and it distinguishes its anatomical setting from retinal imaging. The honest limitation statement that encoders "differ simultaneously in architecture, pretraining domain, and objective" prevents unfounded causal attributions. However, the comparison to related work would be stronger if the authors had implemented Engelmann et al.'s recommended pixel-matching baseline to demonstrate that their embeddings leak information beyond trivial image similarity. Without this, the central claim—that replacing raw MRI with learned embeddings does not eliminate risk—holds, but the converse (that embeddings are uniquely leaky) is not tested.
Reproducibility is partially supported: an anonymous repository is provided with extraction and evaluation scripts, and both datasets are publicly available. However, critical implementation details are underspecified in the main text. Random forest hyperparameters (e.g., number of estimators, depth constraints) are not reported. The random seeding strategy is absent. DINO-ViT and Brain-MRI-SSL require slice selection and averaging, yet the exact slice indices and aggregation logic are only described at a high level. The repository link may contain these details, but a reproducibility checklist in the paper itself would reduce friction for independent verification.
Pretrained representations are increasingly used to share and reuse information from medical images without exposing the original scans, but it is unclear how much patient-specific information these representations retain. We investigate this question for brain magnetic resonance imaging (MRI) by evaluating five frozen pretrained encoders spanning different architectures, pretraining objectives, and training domains on two longitudinal T1-weighted datasets, OASIS-2 and MIRIAD. Under an attacker model with access to released embeddings, the corresponding public encoder, and auxiliary MRI scans, we evaluate patient linkage and sensitive-attribute inference. Across the evaluated representations, we observe substantial subject-specific information: rank-1 patient linkage reaches up to 99\% on MIRIAD and exceeds 90\% on OASIS-2 for the highest-risk representation, despite the absence of an identification objective during encoder training. We further show that the released embeddings retain information about a demographic attribute, with recorded-sex prediction reaching balanced accuracy of 90.9\% on OASIS-2 and 95.5\% on MIRIAD. Overall, our results demonstrate that replacing raw brain MRI with learned embeddings does not, by itself, eliminate patient-linkage or attribute-inference risk, and is therefore insufficient on its own to establish anonymity.
Pick a starting point or write your own. Challenges run in the background, so you can keep reading while the AI investigates.
No challenges yet. Disagree with the review? Ask the AI to revisit a specific claim.