Privacy Protection in MRI Scans Using 3D Masked Autoencoders

TL;DR

CP-MAE is proposed, a model that de-identifies the face by remodeling it by remodeling it rather than by removing parts using masked autoencoders, which outperforms all previous approaches in terms of downstream task performance as well as de-identification.

Abstract

MRI scans provide valuable medical information, however they also contain sensitive and personally identifiable information that needs to be protected. Whereas MRI metadata is easily sanitized, MRI image data is a privacy risk because it contains information to render highly-realistic 3D visualizations of a patient's head, enabling malicious actors to possibly identify the subject by cross-referencing a database. Data anonymization and de-identification is concerned with ensuring the privacy and confidentiality of individuals' personal information. Traditional MRI de-identification methods remove privacy-sensitive parts (e.g. eyes, nose etc.) from a given scan. This comes at the expense of introducing a domain shift that can throw off downstream analyses. In this work, we propose CP-MAE, a model that de-identifies the face by remodeling it (e.g. changing the face) rather than by removing parts using masked autoencoders. CP-MAE outperforms all previous approaches in terms of downstream task performance as well as de-identification. With our method we are able to synthesize high-fidelity scans of resolution up to $256^3$ -- compared to $128^3$ with previous approaches -- which constitutes an eight-fold increase in the number of voxels.

Figures (5)

• Figure 1: MRI scans pose a privacy risk since highly-realistic face renderings can be crafted and misused for malicious purposes. Our model aims to advance the so-called remodeling-based subclass of MRI de-identification which retains the brain ($=$) and remodels all other features ($\neq$). (top: 3D view, bottom slice-view)
• Figure 2: Vector Quantization Stage. Following standard preprocessing we execute two independent stages: (i) We extract the brain of the scan, and inversely (ii) remove the brain from the full skull. Both representations are then compressed independently by two VQ-VAEs into 3D integer volumes of much lower resolution.
• Figure 3: Latent Modeling Stage (MAE). The two representations obtained in Fig \ref{['fig:figPreprocessing']} serve as conditioning variable (brain) resp. to-be-degraded input (full skull) of the MAE. The MAE's task is to reverse the degradation.
• Figure 4: Test-time De-Identification. We repeat the steps from Fig \ref{['fig:figPreprocessing']} to obtain the highly-compressed brain representation which is used as the condition in the inference stage of the masked autoencoder. Starting from a randomly-initialized $\hat{X}$ the network refines its estimate of how a skull around the given brain could look like. The final de-identified scan is obtained by blending the original scan with the last estimate $\hat{X}$ where the binary brain representation acts as a mask. This step ensures that the brain is preserved.
• Figure 5: Downstream Tasks: Subcortical segmentation. We analyze to which extent de-identification affects the quality of subcortical segmentation methods. The depicted values are the class-averaged Dice scores over $15$ classes for FIRST and resp. $78$ classes for FASTSURFER. To increase visual discernability we excluded MRI WATERSHED (avg. $\approx 0.21$). Higher values are preferable.