Adversarial Privacy Preservation in MRI Scans of the Brain
Authors: Lennart Alexander Van der Goten
Tobias Hepp
Zeynep Akata
Kevin Smith
Venue:  (2021)
Keywords: medical imaging
generative modeling
privacy
de-identification

Abstract: De-identification of magnetic resonance imagery (MRI) is intrinsically difficult since, even with all metadata removed, a person's face can easily be rendered and matched against a database. Existing de-identification methods tackle this task by obfuscating or removing parts of the face, but they either fail to reliably hide the patient's identity or they remove so much information that they adversely affect further analyses in the 3D space surrounding the face. In this work, we describe a new class of MRI de-identification techniques that remodel privacy-sensitive facial features as opposed to removing them.To accomplish this, we propose a conditional, multi-scale, 3D GAN architecture that takes a patient's MRI scan as input and generates a 3D volume in which the brain is not modified but the face has been de-identified. Compared to the classical removal-based techniques, our deep learning framework preserves privacy more reliably without adversely affecting downstream medical analyses on the brain, including segmentation and age prediction.

Under review as a conference paper at ICLR 2021
ADVERSARIAL PRIVACY PRESERVATION IN MRI SCANS OF THE BRAIN
Anonymous authors Paper under double-blind review
ABSTRACT
De-identification of magnetic resonance imagery (MRI) is intrinsically difficult since, even with all metadata removed, a person's s face can easily be rendered and matched against database. Existing de-identification methods tackle this task by obfuscating or removing parts of the face, but they either fail to reliably hide the patient's identity or they remove so much information that they adversely affect further analyses. In this work, we describe a new class of MRÍ de-identification techniques that remodel privacy-sensitive facial features as opposed removing them. To accomplish this, we propose a conditional, multi-scale, 3D GAN ar- chitecture that takes patient's MRI scan as input and generates 3D volume which the brain is not modified but the face has been de-identified. Compared the classical removal-based techniques, our deep learning framework preserves privacy more reliably without adversely affecting downstream medical analyses on the brain, including segmentation and age prediction.
INTRODUCTION
Magnetic Resonance Images (MRI) are an essential tool used both in diagnostic and research set- tings, but they are a privacy risk. Detailed renderings of the head can be crafted from MRI scans using techniques such as volumetric raycasting. Those renderings, when matched against facial im- ages, can be used to infer patient identity in a type of attack already demonstrated for CT scans (Mazura et al. 2012). Commonly, MRT scans are de-identified before sharing using crude removal- based techniques, which seek to remove privacy-sensityy parts of the head without disturbing the brain (Figure I]. However, as we demonstrate, these techniques often fail to reliably mask the pa- tient's identity,
they so aggressive that they adversely affect downstream medical analyses on the brain, e.g. segmentation and age prediction. In this work, instead of removing potentially essential parts of the MRI scans of the head and brain, we propose de-identify them by reshaping the privacy-sensitive regions without altering the content of medically relevant data.
Our approach is remodel privacy-sensitie facial structures rather than remove them, while leaving the brain untouched. Unlike removal-based approaches, under our method the head and face exhibit realistic appearance and structure. To accomplish this, we propose novel multi-scale volumetric Generative Adversarial Network (GAN), called C-DeID-GAN that conditions on a convex hull of the skull extracted from the scan to be de-identified. The generator learns to synthesize MRI volumes that preserve medically-sensitee regions such as the brain, while non- non-invertibly remodeling privacy- sensitive characteristics such as the face from the original scan.
It is worthwhile to point out why such an approach is necessary, when methods that extract the brain - so-called skull-stripping methods- - already exist. In short, automated measurements behave unpredictably when data is removed. As recently shown by De Sitter et al. (2020), software designed to perform measurements (e.g. brain segmentation or age estimation) are developed to work robustly for original data (Smith et al. 2004 Schhiit al. 2012). If measurements are made data de- identified by removal, it can result in inaccuracies or even total failure. Thus, remodeling rather than deleting the privacy-sensitivy region would be desirable because it protect privacy and at the same time ensure robustness of the downstream medical analyses.
The main contributions of this work follows:

---

Under review as a conference paper at ICLR 2021
Putient MRI slices
Rendering
Rendorings of reamwwl-haseed privacy appeouches
Rendeingg
Generated MRI slices
Original
FACE MASK
DEFACE
QUICKSHEAR WATERSHED
C-DMID-GAN
Figure Privacy concerns MRI scans and methods to prevent identification. (left) Detailed 3D renderings of human heads with identifiable features can be crafted from MRI scans and used to identify patients (Mazura et al. 2012). (center) Existing de-identification approaches attempt to remove privacy-sensitive parts of the head, but alter the structure and appearance and often fail to reliably mask the patient's identity. (right) We remodel privacy-sensitive facial structures while leaving the brain untouched using conditional multi-scale volumetric GAN.
1. We define a novel methodology to ensure privacy in medical imagery that enables the shar- ing of data in which medically relevant regions are preserved and privacy-sensitive regions are de-identified realistically
2. We propose C-DeID-GAN, conditional multi-scale volumetric GAN that realizes solution to the aforementioned methodology
3. We show that C-DeID-GAN preserves privacy in MRI scans more reliably than removal-base techniques without adversely affecting downstream analyses.
In addition, we make technical contributions towards the generation of the convex hull and surface representations necessary for the privacy conditioning of the GAN.
2 RELATED WORK
A handful of de-identification techniques exist for MRI data, which are conventionally used for shar- ing and distribution. The most common include removal-based approaches shown in Figure [ FACE MASK (Milchenko & Marcus 2013) DEFACE (Bischoff Grette et al. 2007), QUICKSHEAR (Schimke) let al. 2011). and MRI WATERSHED (Ségonne et al.) (004)) all of which we describe in the Appendix. De Sitter et al. (2020) were the first to report that these methods should be used with caution as they remove regions of the face expected by algorithms for brain segmentation and other tasks. As already pointed our in the introduction, failure modes include estimations being inaccurate or, in the worst case, it might even be impossible to perform the measurement at all. These de- de-identification approaches are relatively primitive and a more modern approach is currently lacking in the litera- ture. However, [Shin al. (2018) recently proposed a pix2pix-inspired (Isola et al., 2016) model to generate synthetic abnormal MRI images with brain tumors. In this work, the authors argue that, in principle, their approach can be used generate completely artificial corpus where none of the scans can be attributed to actual patients. The downside is that brain data is also hallucinated which adversely affects medical analyses. contrast, our approach de-identifies privacy-sensitiv information of every patient, but fully preserves the medically relevant information.
More broadly, the literature on the removal of privacy-sensitive sensitive information from image data largely focuses on de-identification of photographs of faces (Jourabloo et al.) 2015) Newton et al. 2005). Among these, Deep Privacy (Hukkelās et al. 2019) is the closest to our approach as it was the first to use GANs to de-identify faces. It conditions generator to inpaint privacy-senside regions while preserving insensitive regions.
priori binary segmentation, guiding the
Whereas Deep Privacy de-identifies conventional images of size 128x 128, our goal is to generate much higher dimensional 3D MRI volumes at 128 voxels - the equivalent of a 1448 x 1448 image. To identify privacy-sene sensitvve face regions for conditional inpainting, Deep Privacy relies dard detector (Liu et al., 2015). Because a 3D analog does not exist, we develop an approach to extract convex hull enclosing the head and mask of the brain for conditioning.
stan-
2

---

Under review as a conference paper at ICLR 2021
brain uxtraction
rendering
reg conected
nemmsized Intenulyy
extrected head farm
COmTe
brain mask
brain
NRl sices
propracassing
Privacy Transform 2017
GAN is condit aned on these concalonated valumes
Fhelloo s00
No0 RReet2
ELComs 1MT
Lnfons C00
EocCn Sos
Cancet
Conoa
(a/k+-) lele hore
(i(6-1)
Disoriinaaor bockk
senderinng
Gencrator block.
Figure 2: Overview of our approach: We apply model-agnostic preprocessing to standardize the scans and construct a surface representation using novel technique. We then extract a convex hull c(z), a brain mask b(x), and the original brain intensities b(x) z, stacked to form the privacy transform 7xx) which serves as a conditioning variable at various scales for the generator and dis- criminator of our model C-DeID-GAN. It learns to convert the distribution Px of original MR scans to de-identified counterpart Py, and because (2) does not contain any
information, renderings from the synthesized volumes are guaranteed not to reveal patient's identity.
3 CONDITIONAL DE-IDENTIFICATIOON OF MRI VOLUMES
Given a set MR scans (X(()) /=l.... iid Px with values ISXSXS over some intensity space C induced by the modality of the scans, we are interested in finding a function of the form (=))()())~>Pp that maps MR scan X to its de-identified counterpart Y. The task of the function (X) is to filter out any sensitive information in order to make it impossible to infer patient's identity from only Y; create privacy preserving representation. In this work, 7 is function of the convex hull of the head c(X)e (0, 1]5x5x5 and the brain mask b(X)e 5xxx8x
Within this remodeling-base based privacy mapping framework, we impose three requirements:
1. Establishment of Anonymity: Non-invertibility of ((X)
2. Distribution preservation: Px and Py are stochastically indistinguishable
3. Brain preservation: V(i,j,k) b(X) =1
Xij fa (7(X))
In other words, we are interested in deriving a function fs that maps some original scan X to some de-identified scan Y. while retaining medically relevant information (e.g. the brain) but preventing other information specific to X to leak into Y (e.g. the face). This makes it impossible to infer person's 's identity from facial renderings alone. In the following, we describe the de-identification process depicted in Figure 2 including how to construct the privacy transform x(X), and how it is used to build the mapping function fo via a conditional multi-scale volumetric GAN.
3.1 THE PRIVACY TRANSFORM 7(X)
The goal of the privacy transform is to non-invertibly change an individual MRT representation x into a form ((x) that removes detailed privacy-sensitie information and replaces with convex hull filled with I's, smoothing away detailed face information (e.g. eyes, nose mouth). The transform guides the GAN, showing which regions should be hallucinated via convex hull c(x) and which regions should be retained through a brain mask b(x: and the brain data or. Following common practice, we first apply a series of standard model-aggostic preprocessing steps to each volume including registration, denoising, and orientation correction, see the Appendix for details. Following the preprocessing, we define a function c(x) that maps scan I5xSx5 to a binary convex hull
MRT scans be acquired under different conditions, we consider common T1-weighted MR signals.
3

---

Under review as a conference paper at ICLR 2021
volume of the same shape. As efficient off- off-the-shelf algorithm exists, propose probabilistic solution that first constructs a surface representation from the MRI scan, and from this we compute the convex hull of the head. These steps described below.
Surface Representation. To extract a surface representation Z from an MRI scan I, we compute maps where rays cast from each direction intersect the head random rotations. We then rotate these measurements back to the reference coordinates and treat each as the probability of it belonging to the surface. We begin by converting given scan into a sequence of K binarized and rotated scans
m
Rot( 1 [x: 2 6): R,) E ISXXx8
(1)
for sampled rotations R1. Rx iid ((S) where (SO(3)) denotes the uniform distribution over all rotations in faree-dimensiona space and E I represents a suitably chosen binarization threshold for the binarization operator I [.]. Let us further introduce the concept of the Ca
of some voxel at position (ko, ki, 122) for some axis {0, 1 and some direction d E (11,++1)
1) (S- -
ka if d = +1 otherwise.
(a,a(Ko, k1, k=)=
(2)
kia
For fixed a and d, we can use this to create an intersection map Ai.s for each binary image my:
A di [Ko, k1, K2] = " mioo ( - a
=1)
(Sa.d(oo, ki, h2) = min (kaa(ka-1
ke++1)
SE 10...... -
(3)
m 1
where (ka-1 8 Ra+1) indicates that the a-th index is set to and the two others their associated value in ku, k1, 12. We average the intersection map over all axis-direction combinations:
A 1/6 Σ>
A
(4)
This process can be thought of as casting rays from each principle direction and recording the lo- cation of the intersection with the rotated, binarized head m Voxels on the surface of the
head will exhibit high values of A()) The final step is back-rotate A(1) 1-... A(K) to the refer-
ence coordinate system and average among the K randomly sampled rotations to create the surface representation:
K
Z 1/K/K Σ Rot (
R ) E [0, Sxxss
(S)
Note that Z is random variable induced by the sampled rotations R1,.... Rx. We interpret in- dividual voxel values of Z as Bernoulli parameters characterizing the probability of some voxel belonging to the surface. This interpretation justifies binarizing Z by considering it a three- dimensional Bernoulli tensor and sampling from it on a voxel-wise basis in the next step.
Convex Hull. From Z, we sample a set of non-zero indices and use Chan's Algorithm (Chan 1996) to compute the triangles T making up the convex hull. We initialize uniform volume filled with I's, then randomly select a sufficient number of triangles (100 suffice) from T. For each triangle, we find its corresponding hyperplane and the half-spaces within c(z) defined by it. Voxels in the outward half-space of c(r) are set to O while the rest are unchanged, yielding a binary convex hull volume.
Privacy Transform. The binary convex hull volume e(x) instructs the GAN as to which regions should be hallucinated. A binary brain mask b(z) obtained by applying the Robex algorithm (Igle- sias et al.) 2011) indicates which regions should be preserved. Together, these volumes along with the masked continuous values of the brain b(x)) x, are concatenated to make the privacy transform (x)) The GAN is conditioned on 7(z) as depicted in Figure 2 in the following subsection.
3.2 CONDITIONAL DE-IDENTIFICATION GAN (C-DEID-GAN)
Our proposed GAN architecture depicted in Figure 2 C-DeID-GAN, is capable of generating volumes at multiple scales and passing gradients between each scale during training. We start from 2D
The threshold 8 is chosen be larger than the noise values surrounding the skull.
4

---

Under review as a conference paper at ICLR 2021
generation framework similar to MSG-GAN (Karnewar & Wang 2019) and adapt it to our task by means of the following: (1) we incorporate conditional information via the privacy transform, (2) make architectural improvements described below, (3) we use
resampling strategy, (4) we adopt relativistic (non-averaging) R-LSGAN loss, and (5) we operate on 3D volumes. We use bottlenecks between scales as recently suggested by Karras et al. (2019), in which the generator outputs single-channel maps instead of multi-channel maps. To reduce the memory footprint, we use modified MobileNet v2 convolutions as suggested in Howard al. (2017).
Both the generator Go (7(x)) and the discriminator D v) are conditioned on 7(x), where either denotes a restuuiasolllinal original or fake sample. Regarding scales suppose that S and are powers of two that denote the maximum/minimun resolution synthesized by Gp. Then both Go and De are defined to have NB = (og)(%/) + blocks (indexed by k) that either double (Go) or halve (De) their input resolution. Here, we generate scales from 4x4x4 x4 to 128 1 128 128.
Generator. The generator Go = G(Ns) .... o G for @ and (k) 2 s x 2 x 2 synthesizes sequence of fake images 91. 'N, of increasing resolutions as follows:
Rro x (k) + (ro
9k (k) (gk-1, for k 2
(6)
where 90 ~ 10, and " (k)))(k) 7(2) is (xx) downsampled to a resolution of rk(()).
Discriminator: The discriminator De = DoD (NB) o.. .. for D B xR(=(1) + (1)
resp. ( Rro(k-1) x RTD(() x (k) + R ( 1) and rD( = 5/2"-1 x 5/2"-1 x
8/2* assigns scalar to a sequence of image of of decreasing resolutions 01. ..... UN follows:
(e((,, De(dk-1, 7k) (k.78)
dz
>>
where 7k (k) (() is ((x) downsampled to resolution of (k) and F is fully-connected layer that computes a scalar summary of the output of (Na)
Resampling blocks. Karras al. 20188 2019 recently proposed to use bilinear interpolation for downsampling, but adapting this approach is problematic as it will create undesirable interpola- tion effects in the binary volumes. Therefore, we leverage probabilistic interpretation of average pooling which guarantees that the proportion of non-zero voxels is preserved (in expectation) while maintaining voxel-wise correspondence to conventional average pooling performed on non-binary images. To achieve this, we first perform average pooling on the binary volume followed by inter- preting the averaged values as probability parameters to voxel-dependent Bernoulli distributions. A final voxel-wise sampling step then yields the desired binary outcome (see Appendix for details). Upsampling is done using nearest neigest interpolation.
Loss Function. We use the relativistic (non-averaging) R-LSGAN loss (Jolioeur-Marrineauu 2018):
La 21E a, (PP [(De De (x, + 1) LD (n. )> [De) - (z( ) + +
where Px, Py denote the original resp. fake distribution induced by fa. For simplicity, we drop the conditioning variable (zz) from the notation. Originally formulated for an unconditional scenario, give some reasoning in the Appendix why the non-averaging class of relativistic losses is more amenable to conditional scenarios than the more commonly used averaging variants. We opt for relativistic losses as they induce a lower memory footprint than, for instance, the widely-established WGAN-GP (Gulrajani et al. 2017) requiring an additional forward/backwant pass.
Brain Preservation. One of the requirements defined above in the Problem Definition is to perfectly preserve medically relevant information. Therefore, in a similar process to image inpainting in which original image content is masked and retained, we use the brain mask b(x:) to embed the original brain data into the volume synthesized by the generator: (x(x))
(1-
21 NN in case of an original image and g1.-..: ONg in case of fake image
5

---

Under review as a conference paper at ICLR 2021
Original
4
04816-3
ADM
?
41.28
.1.83
48.03
11.97
FACE MASK MASK
34.44
+1.79
42.26
+ 1.88
38.47
.1.9
43.09
1..87
QUICKSHEAR
35.25
=1.86
34.28
1:1.8
18.90
1.54
22.28
1..56
CDNID-GAN
23.88
21.68
21.58
11.63
Figure 3: Study on De-ldentification Quality: (left) Amazon Mechanical Turk workers were asked to defeat the de-identification methods: We show the original rendering and 5 renderings of different patients, the task is to select the de-identified rendering matching the query. Here, ADNI patients de- identified using C-DeID-GAN are shown, "5" is correct. (right) Correct identification rates (#s.d.) for 800 distinct questions per dataset, evenly distributed among the methods. Each question was given to five workers, totalling 4,000 assignments (random guessing 20%).
EXPERIMENTS
Above, we proposed new and modern approach de-identify medical image data. To judge its utility, we must address the following questions: (1) Does remodeling preserve privacy better than existing removal-basee -based de-identification methods? (2) Does our approach adversely affect the performance of common medical applications? In this section, we compare our approach to other de-identification methods to answer these questions experimentally. We also show qualitatively that changing (z) allows us to manipulate the synthesis of privacy- seevacy-eensitvve regions with C-DeID-GAN.
4.1 SETUP
Here, we present the datasets, the benchmark de-dentification methods that we compare our model with and the training details of our model.
Datasets. In this work, we use two standard publicly available large-scale Alzheimer's disease imaging studies which feature T1- Tl-weighted volumetric MR scans of the head for each subject: A selection of 2,172 MRIs from ADNI (Weiner et al. 2017 Wyyma et al.) 2013) and 2.168 MRIs from OASIS-3 (LaMontagne et al., 2019). Both datasets are split 20% train-test) on patient level to avoid memorizing the patient's II) from previously seen scans. Scanner types and acquisition protocols differ between and within the datasets, details can be found the Appendix.
Benchmark De-Identification Methods. We compare result with four publicly available and widely-establisse methods for de-identification MRI head scans, depicted Figure All meth- ods have in common that they (1) are deep-learning-driver (2) require additional training and (3), are used on a day-to-day basis in neuroscience and clinical research. All procedures were applied with default settings images of resolution 128x 128x 128. The methods include QUICks. HEAR (Schimke et al. 2011). MASK (Milchenko & Marcus 2013), DEFACE (Bischoff-Grethe et al.) 2007 2007land and MRI WATERSHED (Ségonne et 2004). Descriptions of the methods are provided in the Appendix.
Training. We train C-DeID-GAN in a distributed setup on an NVIDIA DGX-1 with V100 GPUs, where two GPUs model the generator and two control the discriminator. We use the AdamP (Heo al. 2020) optimizer with a learning rate of 2 10-3 and 8 (0, 0.99) and batch size of 2. See the Appendix for complete list of the hyperparameters.
4.2 RESULTS
In this section, we present results on (1) user study comparing the identification rate of our model with existing de-identification methods, (2) two medical imaging end tasks on brain segmentation and age prediction and (3) our model's ability to manipulate the appearance of the generated 3D volumes. In addition, we provide comparison of execution times of the various methods in the Appendix and video results of the original and de-identified scans as Supplementary Material.
Study on De-Identification Quality. The privacy attack described in Mazura et al. (2012) used prospectively collected data, meaning the authors had access to CT scans well as photographs of the patient's 's faces. Testing de-identification quality by replicating that study for MRI scans is impossible, because photographs of ADNI and OASIS-3 patients do not exist. Therefore, conduct

---

Under review as a conference paper at ICLR 2021
O
ADNI
QASIS-3
DHAN
VGSF
BRAN
VCDF
1.0
Sonnrse-- sceffciint
9.6
2.4
ADNI
WATTE
OREY
WHITE
GREY
1.0
mu -
PACE
CEROSSHEAS
AiRi 14T221911
COUDINAN
Rick MACA
QUROSHEES
And Ant
CONDAAN
NicE MASK
And tet CORDGAN
Maa
DePice
ARD WATESIRO
REPES
aooca of
(a) Brain Segmentation
(b) Age Estimation
Figure 4: Effect of De-Identification on Brain Segmentation and Age Estimation: (a) We compare how de-identification affects the reliability of segmenting various brain regions: grey matter, white matter, VCSF, and total brain. The box plots show the Sørensen-Dice coefficient computed between segmentations on the original scan and the de-identified scan using standard software. SIENAX. Higher scores indicate better fidelity. (b) Box plots show how de-identification affects reliability of brain age predictions from a deep neural network. The network predicts brain age on the original scan (no) and a de-identified scan (nD), and we show the distribution of n.D Ro in years. All de-identification methods show acceptable deviations, within ranges reported in other works.
similarly-spirited study using Amazon Mechanical Turk in which workers are asked to defeat the various de-identification methods given renderings of MRI scans, shown in Figure Workers were presented with an unaltered rendering of query patient along with five renderings de-identified using a single method one which is a de-identified rendering of the query patient. The task was then to pick out the de-identified rendering which corresponds to the unaltered query rendering. The workers could choose between the five de-identified renderings of different patients, or select "uncertain". We asked 800 distinct questions per dataset. Each question was given five workers, for a total of 4,000 assignments that are evenly distributed among the methods. The mean and the standard deviation are estimated by bootstrapping over 1,000 samples.
In the table on the right of Figure we report the identification rate, or how often the workers were able to defeat each method. The sdentification rate accounts for the correct identifications and "un- certain" responses, see Appendix for details. In addition to the five de-identification methods, we added a control task BLURRED to measure the lower performance bound, in which the 2D renderings are blurred to mildly obscure the patient identity. An upper performance bound from random guess- ing corresponds to 20%. The results substantiate the claim that C-DeID-GAN performs extraordinarily well at de-identifying MR imagery. Although MRI WATERSHED slightly outperforms method on OASIS-3, it removes everything but the brain, rendering it nearly useless at the downstream tasks as shown in the following sections. Our model outperforms the other de-identification methods sub- stantially with identification rate gaps of 13%-22% on ADNI and 11 1-% on OASIS-3. We note that for both datasets, C-DeIDGGAN performs near to the theoretical optimum of 20%.
Effect of De-Identification on Brain Segmentation. Beyond ensuring patient privacy, de- identification methods should not adversely affect software tools commonly used on MRI scans. However, it has been recently shown that certain facial de-identification methods do adversely im- pact subsequent automated image analysis used in research and in the clinic (De Sitter et al.) 2020). In line with this study, we assess how the de facto standard brain tissue segmentation tool, SIENAX (Smith et al. 2004), performs on de-identified MRI scans comparison to the originals. Using this tool, we segment four regions commonly used in neuroimaging: gray matter, white matter, ven- tricular cerebral spinal fluid (VCSF), and total brain, which can be used to assess progression in Alzheimer's is disease (Matsuda 2016). We record the estimated volumes and compare how segmen- tations obtained on the original overlaps with de-identified segmentations using the Sørensen- Dice coefficient (Sørensen 1948 Dice 1945), commonly referred to Dice score.
In Figure 4a we report the distribution of Dice scores between the original and de-identified scans for various brain regions. Numeric volume estimations are provided in the Appendix. We observe

---

Under review as a conference paper at ICLR 2021
that de-identified scans using C-DeID-GAN reliable in comparison to the original sean, although there is a minor drop in fidelity compared to QUICKSHEAR, DEFACE and FACE MASK. In contrast, de- identification with MRI WATERSHED substantially alters the segmentation as it removes everything except the brain.
Effect of De-Identification on Deep Learning-based Age Prediction. Machine learning algo- rithms can be trained to estimate brain age from MRI scans, and the difference between predicted and chronoligeal age is shown to have links to aging and brain disease (Jónsson et al.) 2019). Here, we investigate whether de-identification adversely affects brain age estimation. We train a three- dimensional adaptation ResNet- 18 (He et al. (016) combined with a L2-loss function to estimate brain age in MRI scans. Details of the training procedure can be found in the Appendix. We assess how the network's 's predicted age RDD on the de-identified scans compares to the predicted age on the originals no by measuring the difference nn no between the two in years.
The results appear in Figure 4b We find that our model performs on par with the other de- identification models, with notably little bias in the ADNI data. FACE MASK shows the least bias and smallest variance, but it is worth noting that an uncertainty of 3-4 years is typical, as chronological age is a noisy label. The deviations reported by the de-identification methods are in the range of similar age estimation studies (Huang et al.) 2017; Ueda et al. 2019 Cole et al. (017). suggest- ing that the effect on age estimation is acceptable. The performance of C-DeID-GAN is surprisingly good considering that the age estimation model exploits age cues in regions outside of the brain, suggesting C-DeID-GAN may implicitly model age information from the brain conditions on.
Controlling Synthesis via the Privacy Transform. Finally, we demonstrate that it is possible, in principle, to control certain aspects of the synthesized MRI scan by manipulating the privacy transform 7(x) upon which C-DEID-GAN is conditioned. As mroof-of-concep. we apply simple resizing to the privacy transformed representation, parameterized by scale factor a R. Recall that ((z) contains the brain mask, brain data, and convex hull [b(x)), x o c(x), as depicted in Figure 5 We alter each of these volumes by resizing from shape 53 to [a:53, then use a linear spline interpolation to infer intensities integral positions (where [-] denotes the floor function). The resulting volume is then either center cropped or evenly padded, yielding a convex hull, brain mask, and brain scaled by a within a volume of shape St.
In Figure 5 we observe that manipulating the size of the synthesized volume by scaling y(x) yields realistic results. The top three rows show the conditioning volumes from y(z). and the last row shows the generated MRI scans. C-DeID-GAN manages to account for the size of the conditioning information without any visible degradation of quality. We set scaling limits (Omin: amas) shown in Figure 5 to reflect the distribution of brain sizes present in the data, see Appendix for details. As the GAN has not been exposed to 7(x) with extreme brain sizes beyond (Ckmin: amax) during training. scans generated at such extremes may be less realistic. This experiment demonstrates that it is possible to control the appearance of the generated volume through manipulation of the privacy transform. Future work may explore more refined means of manipulation, including some which provide even better privacy guarantees.
5 CONCLUSION
In this work, we have defined a new paradigm for de-identifiiation of medical imagery and realized it for MRI scans in a novel approach, C-DeIDGAN. In contrast to traditional de-identification methods, our approach does not aim to remove certain regions but rather aims remodel privacy-relevant information while keeping medically-relevant information untouched (i.e. the brain in this work). In theory, this new model class allows us produce images that appear completely genuine but do not actually contain any privacy-sensitive information. We have shown, through experiments, that our method protects privacy substantially better than existing methods without strongly affecting the performance of common tools typically found in research and clinical settings. However, we note that certain existing de-identification methods affect these downstream tasks to a lesser extent, and a future line of research will be to improve the fidelity of GAN-generated volumes to mitigate this effect. We outline these limitations and avenues for future research in the Appendix. The code and model weights necessary to reproduce our work will be made public upon publication. It is our hope that the approaches we have outlined in this work will find use to better preserve privacy in clinical and research settings.
8

---

Under review as a conference paper at ICLR 2021
(a) OASIS-3
(b) ADNI
0.85
0.9
0.95
1,03
1.1
1,15
0.85
0.9
0.95
1.05
L
1,15
Figure 5: Manipulating the Appearance of the Synthesis: We demonstrate how our model can control the appearance of the synthesized volume by manipulating the privacy transform (ax) which c-DeID- GAN is conditioned on (top three rows). Here, we apply simple resizing using scale factor a E [0.85, 1.15] prior to presenting it to C-DeID-GAN. Synthesized volumes (bottom row) are appropriately sized and appear realistic, implying that more sophisticated manipulations may be possible.
REFERENCES
Amanda Bischoff-Grethe, I. Burak Ozyurt, Evelina Busa, Brian T. Quinn, Christine Fennema- Notestine, Camellia P. Clark, Shaunna Morris, Mark W. Bondi, Terry L. Jernigan, Anders M. Dale, Gregory G. Brown, and Bruce Fischl. A technique for the deidentification of structural brain MR images. Human Brain Mapping. 28(9):892-90) 903, sep 2007. ISSN 10659471. doi:
10.1002/hbm.23112
T. M. Chan. Optimal output-sensitive convex hull algorithms in two and three dimensions. Dis- crete and Computational Geometry, 16(4):361-368, 1996. ISSN 01795376. doi: 10.1007/ BF02712873.
James H Cole, Rudra P K Poudel, Dimosthenis Tsagkrasoulis, Matthan W A Caan, Claire Steves, Tim D Spector, and Giovanni Montana. Predicting brain age with deep learning from raw imaging data results in a reliable and heritable biomarker. Neuroimage,
December 2017.
A. De Sitter, M. Visser, I. Brouwer, K. S. Cover, R. A. van Schijndel, R. S. Eijgelaar, D. M.J. Müller, S. Ropele, L. Kappos, Rovira, M. Filippi, C. Enzinger, J. Frederiksen, O. Ciccarelli, C. R.G. Guttmann, M. P. Wattjes, M. G. Witte, P. C. de Witt Hamer, F. Barkhof, and H. Vrenken. Facing privacy in neuroimaging: removing facial features degrades performance of image analysis methods. European Radiology, 30(2):002- -074, feb 2020. ISSN 14321084. doi: 10.1007/ s00330--09--0455933
Lee R. Dice. Measures of the Amount of Ecologic Association Between Species. Ecology, 26(3): 297-302, jul 1945. ISSN 00129658. doi: 10.2307/1932409. URI. http:://oii wi ley.
com/10. 11100000227722220000
Ishaan Guirajani, Faruk Ahmed, Martin Arjovsky, Vincent Dumoulin, and Aaron Courville. Im- proved training of wasserstein gans. In Advances in neural information processing systems, pp- 5767-5777, 2017.
K He, X Zhang, S Ren, and J Sun. Deep residual learning for image recognition. In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 770-778, June 2016.
Byeongho Heo, Sanghyuk Chun, Scong Joon Oh, Dongyoon Han, Sangdoo Yun, Youngjung Uh, and Jung-Woo Ha. Slowing down the weight norm increase in momentum-based optimizers. arXiv preprint arXiv:2006.088 082 /7, 2020.
Andrew G. Howard, Menglong Zhu, Bo Chen, Dmitry Kalenichenko, Weijun Wang, Tobias Weyand, Marco Andreetto, and Hartwig Adam. Mobilenets: Efficient convolutional neural networks for mobile vision applications. CORR, abs/11744.4861, 2017. URL http://t///aa org/ abs/
T704. 04861

---

Under review as a conference paper at ICLR 2021
T Huang, H. Chen, R Fujimoto, K Ito, K Wu, K Sato, Y Taki, H Fukuda, and T Aoki. Age estimation from brain MRI images using deep learning. In 2017 IEEE 14th International Symposium on Biomedical Imaging (ISBI 2017). pp. 849-852, April 2017.
Häkon Hukkelås, Rudolf Mester, and Frank Lindseth. DeepPrivacy: A Generative Adversarial Net- org/ abs/ 04538
work for Face Anonymization. sep 2019. httt::tt///aatt
Juan Eugenio Iglesias, Cheng Yi Liu, Paul M. Thompson, and Zhuowen Tu. Robust brain extraction across datasets and comparison with publicly available methods. IEEE Transactions on Medical Imaging, 309):1617-1634, sep 2011. ISSN 02780062. doi: 10.1199/TM12001221131552
Phillip Isola, Jun Yan Zhu, Tinghui Zhou, and Alexei A. Efros. Image-to-Image Translation with Conditional Adversarial Networks. Proceedings 30th IEEE Conference on Computer Vision and
Puttern Recognition, CVPR 2017, 2017-Jamuary nov 2016. URLhttp://arre
arg/abs/1611 07004
Alexia JolicoeurMMarineau
The relativistic discriminator: a key element missing from standard GAN. 7th International Conference on Learning Representations, ICLR 2019, jul 2018. URL
http://arxiv/ http///xwv..ogg//////////// 1000000033
Benedikt Atli Jónsson, Gyda Bjornsdottir, TE Thorgeirsson, Lotta María Ellingsen, G Bragi Walters, DF Gudbjartsson, Hreinn Stefansson, Kari Stefansson, and MO Ulfarsson. Brain age prediction using deep learning uncovers associated sequence variants. Nature communications, 10(1):1-10, 2019.
Amin Jourabloo, Xi Yin, and Xiaoming Liu. Attribute preserved face de-identification. 2015 International conference on biometrics (ICB). pp. 278-285, IEEE, 2015.
Animesh Karnewar and Oliver Wang. MSG-GAN: Multi-Scale Gradient GAN for Stable Image Synthesis. mar 2019,
06048
Tero Karras, Samuli Laine, and Timo Aila. A Style-Based Generator Architecture for Generative Adversarial Networks. Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition, 2019-June:4396-4445, dec 2018. URL/ttp::/ http:://aaxxvvoooo.e
abs 1 1812 04 948
Tero Karras, Samuli Laine, Miik Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Ana- lyzing and Improving the Image Quality of StyleGAN. dec 2019.
/ttp:://aaxvvvo. org/
abs/ 91 1912..4.. 04958
Pamela J LaMontagne, Tammic L.S. Benzinger, John C. Morris, Sarah Keefe, Russ Hornbeck, Chengjie Xiong, Elizabeth Grant, Jason Hassenstab, Krista Moulder, Andrei Vlassenko, Mar- cus E. Raichle, Carlos Cruchaga, and Daniel Marcus. OASIS-3: Longitudinal Neuroimag- ing, Clinical, and Cognitive Dataset for Normal Aging and Alzheimer Disease. medRxiv, pp- dec 2019, doi:
13.1
13.
Wei Liu, Dragomir Anguelov, Dumitru Erhan, Christian Szegedy, Scott Reed, Cheng- Yang Fu, and Alexander C. Berg. SSD: Single Shot MultiBox Detector. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 9905 LNCS:21-37, dec 2015. doi: 10. 10.10077978833319-444455
2. URL
doi http://wwww...ooor///////2222222 http://2...222aaaop/o./......... 978 3 319 46448-044411
Hiroshi Matsuda. MRI morphometry in Alzheimer's disease, sep 2016. ISSN 18729649. URL
https::/pubbee: ncbi...medddd............ nobi. n mlm. wtw....oo....2222222
Jan C Mazura, Krishna Juluru, Joseph J Chen, Tara A Morgan, Majnu John, and Eliot Siegel. Facial recognition software success rates for the identification of 3d surface reconstructed facial images: implications for patient privacy and security. Journal of digital imaging, 2573):347-351, 2012.
10

---

Under review as a conference paper at ICLR 2021
Mikhail Milchenko and Daniel Marcus. Obscuring surface anatomy in volumetric imaging data.
Neuroinformatics, 11(1):65-75, jan 2013. ISSN 15392791. doi: 10. 1001000000
URL http:// www. ncbi. nlm. www..ii.ihhhmmmmmmmmmm..mm..mi.. gov/ httppppbmmml/2288111ttt
Pubmedcent.aal.. www...........mm www.wh.......iiiiioee habbmmdbeen.al........///rrrriie
erender fagi 1at
Elaine M Newton, Latanya Sweeney, and Bradley Malin. Preserving privacy by de-identifying face images. IEEE transactions on Knowledge and Data Engineering. 17(2):232-22 2005.
Nakeisha Schimke, Mary Kuehler, and John Hale. Preserving privacy in structural neuroimages. In Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), volume 6818 LNCS, pp. 301-308. Springer, Berlin, Hei- delberg, 2011. ISBN 9783642223471. doi: 10.1007/978-3- 3-62- 3-6-2-22248----------- 22348-8.26
Paul Schmidt, Christian Gaser, Milan Arsic, Dorothea Buck, Annette Förschler, Achim Berthele, Muna Hoshi, Rüdiger Ilg. Volker J. Schmid, Claus Zimmer, Bernhard Hemmer, and Mark Mühlau. An automated tool for detection of flait-hyperintense white-matter lesions in multiple sclerosis. Neurolmage. 5974) 3783, 2012. ISSN 1053-8119, doi: https//doi.org/10.
n01off.meuroommaee22111.... 2011.11.33 URL http:// /wwww www.eiieeeeeeee.....c.cee.eeee.e wttee/irreettccccccceeeeee cww.sciincc///////cccciccccccccc artii article/pii. 053811 91 013319
F. Ségonne, A. M. Dale, E. Busa, M. Glessner, D. Salat, H. K. Hahn, and B. Fischl. A hybrid approach to the skull stripping problem in MRI. Neurolmage, 2203):1000-1775, jul 2004. ISSN 10538119. doi:
20006f/.ccrrommaee20004...4
Hoo-Chang Shin, Neil Tenenholtz, Jameson K Rogers, Christopher G Schwarz, Matthew L Sen- jem, Jeffrey L Gunter, Katherine Andriole, and Mark Michalski. Medical Image Synthesis for Data Augmentation and Anonymization using Generative Adversarial Networks. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 11037 LNCS:1-11, jul 2018. URL http::/ http://aaxxiv..ogaabba///ssa absg///b//1800
10225
Stephen M. Smith, Mark Jenkinson, Mark W. Woolrich, Christian F. Beckmann, Timothy E.J. Behrens, Heidi Johansen-Bert Peter R. Bannister, Marilena De Luca, Ivana Drobnjak, David E. Flitney, Rami K. Niazy, James Saunders, John Vickers, Yongyue Zhang, Nicola De Stefano, Michael Brady, and Paul M. Matthews. Advances in functional and structural MR image anal- ysis and implementation jan 2004. doi: 10. 10.1016/j.mmm. 10.1016/j..eurrriee www.oimage..004.000000
FSL. In Neurolmage, volume 23, pp. 2208-221. Academic Press,
T.J. Sprensen. A Method of Establishing Groups of Equal Amplitude in Plant Sociology Based on Similarity of Species Content and Its Application Analyses of the Vegetation on Dan- ish Commons. Biologiske skrifter. I kommission hos E. Munksgaard, 1948. URL https:
//books. www.ooooolele..ooo de.bookeeeebboo.. ?id
M Ueda, K Ito, K Wu, K Sato, Y Taki, Fukuda, and T Aoki. An age estimation method using 3D-CNN from brain MRI images. In 20/9 IEEE 16th International Symposium on Biomedical Imaging (ISBI 20/9), pp. 380-383, April 2019.
Michael W. Weiner. Dallas P. Veitch, Paul S. Aisen, Laurel A. Beckett, Nigel J. Cairns, Robert Green, Danielle Harvey, Clifford R. Jack, William Jagust, John C. Morris, Ronald C. Petersen, Jennifer Salazar, Andrew J. Saykin, Leslie M. Shaw, The Alzheimer's Disease Neuroimaging Initiative 3: Continued innovation for clinical trial improvement, may 2017. ISSN 15525279.
Arthur W. Toga, and John Q. Trojanowski.
URL http:://ww..r. www. wwm. nih hwwp://wwww.....o/o//////////ee. www. www.eddenntaa.....m.m.. nihh htt.://twwwa.....o..o//rrrr..eee
Bradley T. Wyman, Danielle J. Harvey, Karen Crawford, Matt A. Bernstein, Owen Carmichael, Patricia E. Cole, Paul K. Crane, Charles Decarli, Nick C. Fox, Jeffrey L. Gunter, Derek Hill, Ronald J. Killiany, Chahin Pachai, Adam Schwarz, Norbert Schuff, Matthew L. Senjem, Joyce Suhy, Paul M. Thompson, Michael Weiner, and Clifford R. Jack. Standardization of analysis sets for reporting results from ADNI MRI data, may 2013. ISSN 15525279.


Reviews:
[{"review_id": "zLVV3M6P187", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The authors proposed a conditional GAN-based de-identification method for MRI scans. This method aimed to prevent possible personal information from leaking from the face surface of MRI data. The study is useful in certain clinical situations. However, the applied methods lack enough novelty in the aspect of deep learning theory. C-GAN that can manipulate the generation results have been proposed and applied to a lot of tasks in recent years. In my opinion, this submission is more suitable for medical imaging conferences such as  MICCAI, ISBI, or EMBC. \n\nFeedbacks from authors are constructive to solve my puzzle and I decided to increase my rating. ", "extra_scores": {}, "extra_text": {}}, {"review_id": "ib9rQ4kHQU5", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 7, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The authors developed a GAN based method for privacy preservation in Neuroimaging called C-DeID-GAN. Providing an overview of the related work, they highlighted the shortcomings of the commonly applied methods to preserve privacy while simultaneously maintaining facial structures to enable commonly applied operations such as brain segmentation. To address these challenges the authors built on similar GANs approaches and adjusted it to the 3D dimensionality and the added criteria to fully preserve the brain area in the transformation. They experimentally validated the proposed method using two MR imaging datasets (ADNI and OASIS-3) for a) privacy preservation b) Common image processing (Brain/VCSF/GM/WM segmentation and age prediction). Finally they demonstrated a PoC for different image resolutions.\n\nThe scope of the paper is very relevant to the community. The paper is well presented within the scientific context. The methodology development and the experimental validation are well done. Overall the contribution is justified.\n\nMajor comments:\n\n* While the experimental validation is well designed, a statistical analysis is missing and is quite essential to support some of the authors' claims. Claims such as “the model performs on par with the other models” are not meaningful enough without a statistical test to confirm it. This specifically refers to the analysis results shown in Figures 3 and 4. \n* One of the main advantages of MRI compared to other neuroimaging methods is the multi-modality, i.e. utilization of different MRI sequences (such as DWI, PWI, FLAIR and others) to retrieve different properties of the brain tissue. The authors tested the operations of segmentation and age prediction but did not address this aspect. A common process that is usually done with MRI multi-modal imaging is co-registration. Where does that come into play with regard to the DeID method? How is that addressed or will be potentially addressed? I would find it useful if the authors could relate to that point. \n* Regarding the analysis on controlling synthesis via the privacy transform, I’ve found the motivation for the analysis as well as the conclusion are not entirely clear. I find this analysis not directly relevant to the study objectives. I would therefore suggest moving it to the appendix and instead include the study limitations.\n\nMinor comments:\n\n* Page 3, Figure 2 legend line 5-6: There’s a double “to” in the sentence - please delete it.\n* Page 6, Benchmark De-Identification methods: The authors state that the comparison methods are used “day-to-day basis” in the clinic. Can you support this claim by a relevant reference or other source?\n\n\n\n\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "a95_PE9aJG0", "reviewer": "AnonReviewer5", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper is well written, and seems to solve the proposed problem well. I am very confused however about the point of the problem you are trying to solve. From what I understand you want to take a voxelized version of an MRI scan and distort it such that the observed face is no longer identifiable with the original patient, but the useful information in the MRI is preserved. Part of your method requires or extracts the brain from the MRI. In either case you claim that that is information is available and sufficient for downstream tasks, and everything can be removed. Would a superior method here not just be to take this brain information directly.  The De-Identification Quality metric which you use would obviously get the optimal 20% accuracy here as the we have no way of associating images of brains with images of faces, and even if we do, you have not demonstrated that you method would perform well on it either. I see no point in altering the face of the scans as the face information will be useless for any downstream task, and all other information is apparently preserved, so why not just take this preserved data as the privacy preserving MRI information? While this may fail to perform well under SIENAX, I would say this is a problem with using this software as a metric, as the brain would clearly be preserved. \n\nIf I am mistaken here, I apologies, and am happy to change by rating and comments given sufficient reasoning. However, from the knowledge I posses in the field I do not think the approach has merit due to superior, trivial baselines. \n\nI also have an issue with the experiment for assessing privacy preservation. I would say that the mechanical turk experiment is valuable, but only if you also demonstrate that deep learning based approaches cannot identify the associate the faces as well. Without this I have no way of knowing if your method fails to a simple CNN. \n\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "SJ-h5UNB5k", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposes a GAN-based method to remodel the privacy information of an MRI scan, i.e., the face. They first propose a probabilistic solution to construct a surface representation and then compute the convex hull of the head. The convex hull was used to instruct the GAN to generate a synthetic face. The main contribution of this paper is that they use GAN to generate a 3D volume MRI in which the face has been remodeled rather than removed. Experiment results showed the proposed method outperforms several existing removed-based methods.\nCons:\nMy main concern about this paper is the purpose of remodeling the face. In my opinion, removing the original face is enough for the de-identification of an MRI scan. Why spent so much effort to generate a new one? Is the new face provides extra information to the downstream medical analyses? The authors point out that their method did not alter any content of medically relevant data. Therefore, I think remodeling the fake face is unnecessary and the method may have little practical uses.\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "PyQk3l51nnz", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Pros.\n\n    • This work develops a novel approach to de-identify privacy-sensitive regions of the MRI scans that enables sharing the data for downstream tasks like segmentation, classification etc.\n\n    • The presented de-identification framework is non-reversible and also preserves medically sensitive regions.\n\n    • The performance of the presented methodology is established through various simulations.\n\n\nCons.\n\n    • While experimental results supports author’s claims regarding privacy-preservation without adversely affecting the medically relevant features, further justification is required for the superiority of the proposed method over existing algorithms. For instance, while with the DEFACE method illustrated in Figure 1 it seems impossible to identify the patient, the de-identification quality for DEFACE in Figure 3 does not agree with that. Similar argument can be made for the QUICKSHEAR method as well.\n\n    • While it has been argued in the beginning of the manuscript that the removal-based methods can compromise the medically relevant features for the downstream tasks, this is not inferred from Figure 4 in which FACEMASK and QUICKSHEAR methods achieve higher Dice index for brain segmentation as well as lower bias (s.d.) for age estimation. Authors can improve the presentation to clarify these concerns.", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper received diverging review feedback. While reviewers found merits in the work, they also raise serious concerns over experimental validation, comparison with the existing methods, and practicality of the proposed method. It appears that the paper can benefit from better writing and more experimental validations clarifying all these points. 
Decision: Reject