Can brain-MRI embeddings still identify patients?

What was tested

The audit compared five frozen encoders: AnatCL, 3D-Neuro-SimCLR, Brain-MRI-SSL, DINO-ViT and SAM-Med3D. They span three-dimensional and two-dimensional architectures, self-supervised and supervised objectives, and pretraining on brain MRI, broader medical images or natural images. The encoders were not trained on either evaluation dataset and were not designed with patient identification as an objective.

Two longitudinal T1-weighted MRI datasets supplied repeated observations. OASIS-2 contributed 150 subjects, each with two to five sessions over multiple years. MIRIAD contributed 69 subjects and 708 scans, with as many as 12 scans across nine visits and follow-up intervals ranging from about two weeks to two years. These are scans acquired at different times, not repeated copies of a single image. OASIS-2 was already motion-corrected, registered, skull-stripped and intensity-corrected; MIRIAD differed in acquisition and preprocessing.

For every scan in turn, the authors treated its embedding as the query and ranked all other scans by Canberra similarity. The query itself was excluded, and every subject had at least one genuine same-person reference. The reported top-rank metric is therefore the proportion of scans whose nearest eligible reference came from the same dataset subject. A random subject-level guess would be about 0.68% in OASIS-2 and 1.45% in MIRIAD.

A separate random-forest analysis tested whether embeddings predicted the recorded binary sex field. Subjects were kept entirely in either training or held-out test folds so that repeated scans from one person did not leak across the split. Balanced accuracy was used because it gives equal weight to the two recorded categories. This is attribute inference from representation features, not a clinical or biological assessment of gender identity.[1][2]

The results varied, but the highest risks were far above chance

AnatCL produced the highest top-ranked matching result on OASIS-2 at 92.05% and reached 99.71% on MIRIAD. DINO-ViT reached 82.35% and 98.70% respectively. SAM-Med3D was the lowest-risk encoder in both sets, yet its matching result was still 13.94% on OASIS-2 and 89.58% on MIRIAD. The large cross-dataset shifts show why one headline percentage cannot describe every representation or deployment.

A hand-engineered baseline of 15 FreeSurfer anatomical measurements reached 75.00% on OASIS-2 and 99.93% on MIRIAD. That comparison matters: the privacy signal is not necessarily created by a foundation model. Stable brain anatomy can itself be distinctive, and both learned and conventional representations may retain it. The paper therefore supports testing the released artefact, not assuming that a particular model family is uniquely responsible.

Recorded-sex prediction also varied. Brain-MRI-SSL reached balanced accuracy of 90.93% on OASIS-2 and 95.46% on MIRIAD. But performance fell when a classifier trained on one cohort was tested on the other, often approaching chance. That weak cross-dataset transfer suggests that acquisition, preprocessing or cohort-specific factors may contribute to the signal. It does not erase the within-dataset result, but it limits claims about generalisation.[1]

What hospitals, researchers and patients should take from it

A hospital or research consortium should not label an embedding anonymous merely because it cannot be viewed like a scan. Before sharing, teams can test patient linkage and sensitive-attribute inference under realistic auxiliary-data assumptions, document who can obtain the encoder and preprocessing code, and decide whether access controls, contractual limits, aggregation or privacy-preserving transformation are required. The paper's audit is evidence for risk assessment, not a certification method or a legal determination.

For clinicians and data stewards, the practical issue is secondary use. A representation created for segmentation, retrieval or another downstream task may preserve information that task does not need. Minimising exported features, limiting repeated longitudinal records, separating identity-linked reference stores and logging access can reduce opportunity for misuse. Any protection also needs a utility test: removing identity-bearing structure may degrade the clinical or research signal the representation was created to preserve.

For patients, the study does not mean that any released brain embedding can be converted into a name. Linkage requires a pathway to auxiliary scans, and re-identification requires those references to be identity-linked. It does mean that organisations should explain those pathways when describing de-identification and should avoid suggesting that vectorisation by itself makes sensitive imaging safe to publish.[1]

Evidence limits and what would change the assessment

The evidence is bounded to two relatively small longitudinal datasets, five encoders, one image type and one inferred attribute. The models differ at the same time in architecture, training data, objective and preprocessing, so the comparison cannot isolate which design choice caused a result. MIRIAD has many repeated scans per person, increasing the number of genuine references, and its preprocessing differs from OASIS-2. The authors' reduced-scan analysis still found high matching, but dataset effects remain substantial.

Confidence would rise with preregistered replication on independent clinical cohorts, more scanners and institutions, other image modalities and explicit external attackers who do not share the researcher's pipeline knowledge. Studies should compare raw scans, embeddings and protected representations at matched downstream utility, report confidence intervals and test whether attacks survive realistic distribution shift. Peer review and independent reproduction of the released code would also clarify implementation sensitivity.

The assessment would weaken if privacy transformations consistently drove linkage and attribute inference close to chance without materially reducing diagnostic or research performance. It would strengthen if attackers linked embeddings across institutions under realistic access conditions or inferred a wider set of sensitive attributes in external cohorts. For now, the defensible conclusion is narrower: the evaluated embeddings retained measurable, sometimes very strong subject-specific information, so vectorisation alone was not anonymity.[1]