标题： 全头MRI的破坏性问题：扩散模型中的重新识别风险和研究潜力的损害 显示英文标题

标题： Pitfalls of defacing whole-head MRI: re-identification risk with diffusion models and compromised research potential

摘要： 对头部磁共振成像（MRI）数据集在公开发布前经常进行破坏处理，以解决隐私问题。 面部和附近体素的改变引发了关于这些技术真正能力的讨论，以确保隐私以及它们对下游任务的影响。 随着深度生成模型的进步，破坏处理在保护隐私方面的程度是不确定的。 此外，虽然被修改的体素含有有价值解剖信息，但它们在破坏处理直接影响的解剖区域之外支持研究的潜力仍然是不确定的。 为了评估这些考虑因素，我们开发了一个重新构建面部的流程，使用级联扩散概率模型（DPMs）从被破坏的头部MRI中恢复面部。 DPMs在180名受试者的图像上进行训练，并在484名未见过的受试者的图像上进行测试，其中469名来自不同的数据集。 为了评估破坏处理中的被修改体素是否包含普遍有用的信息，我们还从被破坏和原始MRI中的面部体素预测计算机断层扫描（CT）衍生的骨骼肌放射密度。 结果表明， DPMs可以生成与原始面部相似的高质量面部，与原始面部的表面距离显著小于人口平均面部（p < 0.05）。 这种性能也很好地推广到之前未见过的数据集。 对于骨骼肌放射密度预测，使用被破坏的图像相比使用原始图像会导致显著较弱的斯皮尔曼等级相关系数（p < 10-4）。 对于小腿肌肉，使用原始图像时相关性具有统计学意义（p < 0.05），但使用任何破坏方法时相关性不具有统计学意义（p > 0.05），这表明破坏处理可能不仅无法保护隐私，还会消除有价值的信息。 显示英文摘要

摘要： Defacing is often applied to head magnetic resonance image (MRI) datasets prior to public release to address privacy concerns. The alteration of facial and nearby voxels has provoked discussions about the true capability of these techniques to ensure privacy as well as their impact on downstream tasks. With advancements in deep generative models, the extent to which defacing can protect privacy is uncertain. Additionally, while the altered voxels are known to contain valuable anatomical information, their potential to support research beyond the anatomical regions directly affected by defacing remains uncertain. To evaluate these considerations, we develop a refacing pipeline that recovers faces in defaced head MRIs using cascaded diffusion probabilistic models (DPMs). The DPMs are trained on images from 180 subjects and tested on images from 484 unseen subjects, 469 of whom are from a different dataset. To assess whether the altered voxels in defacing contain universally useful information, we also predict computed tomography (CT)-derived skeletal muscle radiodensity from facial voxels in both defaced and original MRIs. The results show that DPMs can generate high-fidelity faces that resemble the original faces from defaced images, with surface distances to the original faces significantly smaller than those of a population average face (p < 0.05). This performance also generalizes well to previously unseen datasets. For skeletal muscle radiodensity predictions, using defaced images results in significantly weaker Spearman's rank correlation coefficients compared to using original images (p < 10-4). For shin muscle, the correlation is statistically significant (p < 0.05) when using original images but not statistically significant (p > 0.05) when any defacing method is applied, suggesting that defacing might not only fail to protect privacy but also eliminate valuable information.