The question
When a research group at an academic medical center prepares to share imaging data, they face a real trade-off: defacing protects patient identity, but aggressive defacing can damage the very data that downstream research needs.
The University of Pennsylvania radiation oncology team set out to answer the question directly: across modern defacing techniques, which one preserves the most clinical utility while still preventing facial re-identification?
The study
Wang, Lee, Wang, and Xiao (Penn Radiation Oncology) compared four defacing algorithms on imaging from 185 patients:
- Brain cohort — 88 patients from the Burdenko Glioblastoma Progression Dataset (MRI, topometric CT, full RT planning files including RTStruct, RTPlan, and RTDose).
- Head-and-neck cohort — 97 patients from the Head-Neck-PET-CT data set (CT, PET, and the same RT planning files).
The four methods evaluated:
- Quickshear — complete facial removal via a single oblique cutting plane.
- Biometric_mask — partial facial removal using orthogonal masking planes derived from face and ear masks.
- mri_reface — facial replacement with an average-face template via nonlinear registration.
- CuratAI’s deidentifier (Carina Medical LLC, version 1.12.0) — mask-based blurring that obscures facial features while preserving overall head contour.
Re-identification risk was measured with ArcFace, a deep-learning facial recognition algorithm, by computing cosine similarity between original and defaced scans (lower AUC = better privacy). Data utility was measured by changes to organ volumes, image intensity (CT HU), and dose-volume histograms across nine anatomic structures: brain, brainstem, mandible, GTV, oral cavity, optic chiasm, eyes, lens, optic nerves, and parotid glands.
The result
Privacy. Quickshear achieved the strongest privacy protection (lowest AUC across most modalities) — but at a substantial cost in data utility. CuratAI’s deidentifier delivered moderate, balanced privacy protection. mri_reface was close behind. Biometric_mask was the weakest, with the highest re-identification AUCs across every modality (brain CT 0.88, brain MRI 0.94, HN CT 0.84, HN PET 0.82).
Utility. Here the gap between methods was sharpest. From the paper:
CuratAI’s deidentifier was the least disruptive, preserving original volumes with no measurable changes across all structures.
Specifically:
- Oral cavity preservation. Quickshear changed median CT intensity by −77.7% in the brain cohort and −24.6% in head-and-neck — catastrophic disruption. Biometric_mask changed it by −48.4% brain, −48.5% HN. CuratAI’s effect on oral cavity intensity was negligible.
- Eye and lens preservation. CuratAI introduced small superficial changes (brain eyes +44.4%, lens +24.6%; HN eyes +31.0%, lens +27.4%) — limited to the directly defaced region, not deeper anatomy.
- Dose preservation. CuratAI closely reproduced the original dose-volume histograms across organs at risk, with a small uptick in dose to the eyes and lens. GTV D95% was fully preserved (median difference 0.0 Gy across all methods).
Success rate. CuratAI completed defacing successfully on 100% of brain CT scans, 81.3% of brain MRI scans (a challenging modality where T2-weighted images often include non-brain tissue), 100% of brain dose maps, and 96.9% of head-and-neck CT, PET, and dose scans.
The takeaway
For institutions where the imaging data must remain useful for downstream radiation oncology research — dose analysis, OAR segmentation, GTV measurement — defacing that destroys oral cavity, eye, lens, or dose-map fidelity isn’t a viable option, no matter how well it protects privacy.
The Penn study positions CuratAI’s defacing where it should be: a balanced choice that holds re-identification risk down while keeping the downstream clinical research workable.