Pretrained Brain MRI Representations Retain High Patient Linkage Risk
An arXiv preprint released October 14 2026 shows that frozen pretrained encoders for brain MRI preserve substantial subject-specific information. Rank-1 patient linkage reaches…
- Frozen pretrained encoders retain enough subject-specific detail for up to 99 percent rank-1 patient linkage despite lacking an identification training objective.
- Released embeddings allow recorded-sex prediction with balanced accuracy of 90.9 percent on OASIS-2 and 95.5 percent on MIRIAD.
- Substituting raw brain MRI scans with learned representations does not by itself eliminate linkage or attribute-inference risks.
Study Overview
The preprint evaluates five frozen pretrained encoders on two longitudinal T1-weighted brain MRI datasets, OASIS-2 and MIRIAD. The encoders differ in architecture, pretraining objectives, and training domains.
Researchers simulate an attacker who possesses the released embeddings, the corresponding public encoder, and auxiliary MRI scans. Under this model they measure patient linkage and sensitive-attribute inference.
Main Privacy Results
Substantial subject-specific information remains across the tested representations. Rank-1 patient linkage reaches 99 percent on MIRIAD and exceeds 90 percent on OASIS-2 for the highest-risk encoder.
The embeddings also preserve demographic information. Recorded-sex prediction achieves balanced accuracy of 90.9 percent on OASIS-2 and 95.5 percent on MIRIAD.
These outcomes occur even though none of the encoders were trained with an explicit identification objective.
Implications for Medical Data Sharing
The authors conclude that replacing raw brain MRI with learned embeddings does not, by itself, remove patient-linkage or attribute-inference risk. The approach alone is therefore insufficient to establish anonymity.
The abstract-only evidence highlights limits in current representation-based sharing practices for medical imaging. Additional privacy safeguards appear necessary to mitigate re-identification threats.
Evidence Limitations
This report is based solely on the preprint abstract and metadata. The full paper was not available for independent review or replication.
All performance numbers and conclusions are taken directly from the supplied abstract and should be verified against the complete manuscript when it is released.
