Pretrained brain MRI representations fail to protect patient identity and sensitive demographics

Evaluating five frozen neuroimaging foundation encoders on longitudinal cohorts demonstrates that released embeddings permit up to 99% rank-1 patient re-identification and over 90% recorded-sex inference.

Primary source: arXiv:2610.20494: https://arxiv.org/abs/2610.20494

What’s new: Sharing learned feature representations instead of raw neuroimaging scans is widely assumed to preserve patient privacy while enabling multi-institutional collaboration. In Quantifying Privacy Risks in Foundation Model Representations of Brain MRI (arXiv:2610.20494, 14 Oct 2026), researchers from École de technologie supérieure (ÉTS) Montreal, Inria, INSA Lyon, and CREATIS challenge this assumption. They formulate an adversarial audit where an attacker possesses released patient embeddings, the corresponding public encoder, and a separate set of auxiliary scans from the same or related cohorts. The audit evaluates five prominent pretrained encoders spanning different architectures and objectives (AnatCL, 3D-Neuro-SimCLR, Brain-MRI-SSL, DINO-ViT, and SAMMed3D) on longitudinal T1-weighted scans from the OASIS-2 and MIRIAD datasets.

The experiments reveal extensive patient leakage across all architectures, even though none of the models were trained with identity supervision. Nearest-neighbor patient linkage achieves rank-1 re-identification accuracy of up to 99% on MIRIAD and exceeds 90% on OASIS-2 for the most vulnerable representations. System-level linkability metrics confirm that same-subject embeddings across longitudinal visits cluster tightly compared to inter-subject distances. Beyond direct patient re-identification, frozen embeddings leak protected demographic variables: simple linear probes predict recorded sex with balanced accuracies of 90.9% on OASIS-2 and 95.5% on MIRIAD. Even under score-distribution normalization, patient signatures remain highly separable, proving that feature abstraction alone does not satisfy regulatory or clinical standards of de-identification.

Why it matters: Clinical AI initiatives increasingly promote embedding sharing and centralized feature stores as a compliant alternative to sharing raw DICOM or NIfTI files. This study provides empirical evidence that raw scan privacy risks directly transfer to high-dimensional representation spaces. Data custodians and research consortia cannot treat feature vectors as anonymized data without applying formal differential privacy, explicit feature sanitization, or cryptographic secure multiparty computation.

Caveats: The evaluation is conducted on two curated longitudinal Alzheimer’s disease cohorts (OASIS-2 and MIRIAD) using 3D T1-weighted structural MRI, which may exhibit more distinct morphological patterns than heterogeneous routine clinical scans. The attack assumes the adversary has access to auxiliary scans from the target individuals and knows the exact encoder architecture used. Defense mechanisms such as differential privacy noise injection or dimensionality reduction were analyzed primarily as baseline comparisons rather than fully optimized privacy-utility trade-offs.