Chenyu Gao, Kaiwen Xu, Michael E Kim, Lianrui Zuo, Zhiyuan Li, Derek B Archer, Timothy J Hohman, Ann Zenobia Moore, Luigi Ferrucci, Lori L Beason-Held, Susan M Resnick, Christos Davatzikos, Jerry L Prince, Bennett A Landman. “Pitfalls of defacing whole-head MRI: re-identification risk with diffusion models and compromised research potential”. Computers in Biology and Medicine. Volume 197, Part B, October 2025, 111112. https://doi.org/10.1016/j.compbiomed.2025.111112
Highlights
Diffusion probabilistic models can reconstruct faces from defaced whole-head MRI.
Facial voxels removed by defacing hold valuable information about the human body.
Defacing may fail to ensure privacy and compromise broader research value.
Unaltered data with policy restrictions or full skull-stripping can be considered.
Abstract
Defacing is often applied to head magnetic resonance image (MRI) datasets prior to public release to address privacy concerns. The alteration of facial and nearby voxels has provoked discussions about the true capability of these techniques to ensure privacy as well as their impact on downstream tasks. With advancements in deep generative models, the extent to which defacing can protect privacy is uncertain. Additionally, while the altered voxels are known to contain valuable anatomical information, their potential to support research beyond the anatomical regions directly affected by defacing remains uncertain. To evaluate these considerations, we develop a refacing pipeline that recovers faces in defaced head MRIs using cascaded diffusion probabilistic models (DPMs). The DPMs are trained on images from 180 subjects and tested on images from 484 unseen subjects, 469 of whom are from a different dataset. To assess whether the altered voxels in defacing contain universally useful information, we also predict computed tomography (CT)-derived skeletal muscle radiodensity from facial voxels in both defaced and original MRIs. The results show that DPMs can generate high-fidelity faces that resemble the original faces from defaced images, with surface distances to the original faces significantly smaller than those of a population average face (p < 0.05). This performance also generalizes well to previously unseen datasets. For skeletal muscle radiodensity predictions, using defaced images results in significantly weaker Spearman’s rank correlation coefficients compared to using original images (p ≤ 10−4). For shin muscle, the correlation is statistically significant (p < 0.05) when using original images but not statistically significant (p > 0.05) when any defacing method is applied, suggesting that defacing might not only fail to protect privacy but also eliminate valuable information. We advocate two solutions for data sharing that comply with privacy: 1) share skull-stripped images along with measurements of facial and cranial features extracted before skull-stripping for public access, while acknowledging that this approach inherently compromises many research potentials; or 2) share the unaltered images with privacy enforced through policy restrictions.
Fig. 1. There are pitfalls of defacing, a technique used to alter facial voxels in whole-head MRIs to protect privacy. First, with deep generative models such as diffusion probabilistic models, it is possible to synthesize MRIs with realistic faces, which closely resemble the original faces, from defaced MRIs. This capability poses a re-identification risk, thus questioning the efficacy of defacing in protecting privacy. Second, facial and other non-brain voxels in whole-head MRIs contain valuable anatomical information. For instance, this information could be used to study correlations between head and body measurements using paired head MRI and body CT data. The alteration of these voxels results in information loss, thereby compromising such research potentials. The experiments in this paper are designed to showcase these two pitfalls.Fig. 2. Given a defaced T1-weighted (T1w) MRI, our refacing pipeline generates a T1w image with a face. The pipeline consists of two stages. In stage 1, a 3D diffusion model, conditioned on the downsampled defaced image, generates a low-resolution refaced image. In stage 2, a 2.5D diffusion model, conditioned on the high-resolution defaced image and the up-sampled low-resolution refaced image from stage 1, generates a high-resolution refaced image. This is done in a slab-by-slab manner, where each slab consists of a stack of axial slices. To mitigate border effects, adjacent slabs have overlapping slices to share anatomical context. Finally, the high-resolution slabs produced by stage 2 are merged to form the complete high-resolution 3D refaced image.Fig. 3. For an example subject, 3D renderings of the faces in the original image, image defaced by MRI_Deface, image refaced from the defaced image by our DPMs, and image processed with mri_reface (which replaces the original face with a population average face) are presented in each row. The MASD is computed between the original face and the face in each image type. A smaller distance corresponds to a higher similarity to the original face.Fig. 4. For the same subject in Fig. 3, 3D renderings of the faces in the DPMs-refaced images generated from each type of defaced image are presented alongside the original face. The images are ordered by the MASD to the original face. As the distance increases, the face appears perceptually more different from the original face.Fig. 5. From skull-stripped images, the diffusion probabilistic models (DPMs) failed to generate faces that resemble the original faces.Fig. 6. On the external testing set (N = 469), faces generated by our DPMs from images defaced using Pydeface, FSL_deface, Quickshear, and MRI_Deface show significantly lower mean absolute surface distances (MASDs) to the original faces, compared to the linearly aligned population average face produced by mri_reface, indicating higher facial similarity. In contrast, faces generated by DPMs from skull-stripped images show significantly higher MASDs, indicating lower facial similarity. Statistical significance was assessed using the Wilcoxon signed-rank test; “∗∗∗∗” indicates p ≤ 0.0001.Fig. 7. The correlation between predicted residuals of abdomen, thigh, and shin muscle radiodensity (measured from segmented ROI in CT data, in Hounsfield units, with age and sex regressed out using linear models) and ground truth values is stronger using original images compared to defaced or skull-stripped images. Examples of each image type are provided in the Supplementary Materials. The image types are arranged such that those with more facial voxels removed are placed on the right (e.g., skull-stripping), while those with fewer facial voxels removed are placed on the left (e.g., original). As more voxels are removed, the correlation between head and body becomes weaker and more difficult to capture. For instance, the correlations between predicted abdomen muscle radiodensity from FSL_deface, MRI_Deface, Pydeface, and skull-stripped images and the ground truth values are not statistically significant, as indicated by 95 % confidence intervals (CI) overlapping with 0. For shin muscle, the head-body correlation is statistically significant only when using original images. Bootstrapping (n = 1000) is used to estimate the mean and 95 % confidence intervals of the Spearman’s rank correlation coefficients. Statistical significance is indicated by “∗∗∗∗” for p-value ≤10−4, based on the Wilcoxon signed-rank test.
