# Pitfalls of defacing whole-head MRI: re-identification risk with diffusion models and compromised research potential

arXiv: https://arxiv.org/abs/2501.18834 · HTML: https://mlsanity.com/paper/2501.18834/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Placed in Medical imaging and segmentation, one of 14 directions in Diffusion models.
- Builds on 13 of its 60 references that are in the map.
- First posted on arXiv 31 Jan 2025.

## Placed in

- Diffusion models / [Medical imaging and segmentation](https://mlsanity.com/diffusion/medical-imaging-and-segmentation/)

## Builds on (most cited first, 13 of 13)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Denoising Diffusion Implicit Models](https://mlsanity.com/paper/2010.02502/) (2020)
- [Cascaded Diffusion Models for High Fidelity Image Generation](https://mlsanity.com/paper/2106.15282/) (2021)
- [The Future of Digital Health with Federated Learning](https://mlsanity.com/paper/2003.08119/) (2020)
- [Med3D: Transfer Learning for 3D Medical Image Analysis](https://mlsanity.com/paper/1904.00625/) (2019)
- [Security and Privacy on Generative Data in AIGC: A Survey](https://mlsanity.com/paper/2309.09435/) (2023)
- [DeepEDN: A Deep Learning-based Image Encryption and Decryption Network for Internet of Medical Things](https://mlsanity.com/paper/2004.05523/) (2020)
- [Refacing: reconstructing anonymized facial features using GANs](https://mlsanity.com/paper/1810.06455/) (2018)
- [Body Composition Assessment with Limited Field-of-view Computed Tomography: A Semantic Image Extension Perspective](https://mlsanity.com/paper/2207.06551/) (2022)
- [Longitudinal Variability Analysis on Low-dose Abdominal CT with Deep Learning-based Segmentation](https://mlsanity.com/paper/2209.14217/) (2022)
- [Field-of-View Extension for Brain Diffusion MRI via Deep Generative Models](https://mlsanity.com/paper/2405.03652/) (2024)
- [Rapid Brain Meninges Surface Reconstruction with Layer Topology Guarantee](https://mlsanity.com/paper/2304.06246/) (2023)
- [Fast refacing of MR images with a generative neural network lowers re-identification risk and preserves volumetric consistency](https://mlsanity.com/paper/2305.16922/) (2023)

## Built on by (most cited first, 1 of 1)

- [Cross-Dataset Linkage of Brain MRI using Image Similarity Measures](https://mlsanity.com/paper/2602.10043/) (2026)

## Abstract (arXiv)

Defacing is often applied to head magnetic resonance image (MRI) datasets prior to public release to address privacy concerns. The alteration of facial and nearby voxels has provoked discussions about the true capability of these techniques to ensure privacy as well as their impact on downstream tasks. With advancements in deep generative models, the extent to which defacing can protect privacy is uncertain. Additionally, while the altered voxels are known to contain valuable anatomical information, their potential to support research beyond the anatomical regions directly affected by defacing remains uncertain. To evaluate these considerations, we develop a refacing pipeline that recovers faces in defaced head MRIs using cascaded diffusion probabilistic models (DPMs). The DPMs are trained on images from 180 subjects and tested on images from 484 unseen subjects, 469 of whom are from a different dataset. To assess whether the altered voxels in defacing contain universally useful information, we also predict computed tomography (CT)-derived skeletal muscle radiodensity from facial voxels in both defaced and original MRIs. The results show that DPMs can generate high-fidelity faces that resemble the original faces from defaced images, with surface distances to the original faces significantly smaller than those of a population average face (p < 0.05). This performance also generalizes well to previously unseen datasets. For skeletal muscle radiodensity predictions, using defaced images results in significantly weaker Spearman's rank correlation coefficients compared to using original images (p < 10-4). For shin muscle, the correlation is statistically significant (p < 0.05) when using original images but not statistically significant (p > 0.05) when any defacing method is applied, suggesting that defacing might not only fail to protect privacy but also eliminate valuable information.