Replacing MRI facial voxels with realistic synthetic data (mri_reface) protects privacy against AI facial reconstruction attacks.

BACKGROUND
• Facial structure in head MRI poses re-identification risk.
• Traditional defacing removes facial voxels; mri_reface replaces the face with a realistic, synthetic alternative.
• Generative AI can partially reverse some traditional defacing, but whether such reversibility extends to mri_reface is unknown.
• We conducted a red-team evaluation to test if mri_reface can withstand state-of-the-art AI reconstruction attacks.
• We tested 469 mri-refaced images against three escalating attack strategies, including reverse-engineering the mask and fine-tuning diffusion probabilistic models (DPMs, see workflow on left).

RESULTS & CONCLUSIONS
While traditional defacing is easily reversed, all three reconstruction attacks on mri_reface failed.
• Pre-trained AI models were tricked by residual synthetic features (#1) and failed to generalize when aggressive cropping was applied (#2).
• Even using a fine-tuned model (#3), the faces were no closer to the original subject than a generic population average.
• Replacing facial voxels provides more robust privacy protection compared to naive voxel removal.