From Redaction to Restoration: Deep Learning for Medical Image Anonymization and Reconstruction

Adrienne Kline; Abhijit Gaonkar; Daniel Pittman; Chris Kuehn; Nils Forkert

cs.CVApr 13, 2026

From Redaction to Restoration: Deep Learning for Medical Image Anonymization and Reconstruction

Authors: Adrienne Kline, Abhijit Gaonkar, Daniel Pittman, Chris Kuehn, Nils Forkert

Organizations: Center for Artificial Intelligence, BCVI, Northwestern Medicine, Chicago, IL, USA · Department of Electrical and Computer Engineering, Northwestern University, Chicago, IL, USA · Department of Surgery, Northwestern University, Chicago, IL, USA · Xtasis Inc., Chicago, IL, USA ·

Abstract

Removing patient-specific information from medical images is crucial to enable sharing and open science without compromising patient identities. However, many methods currently used for deidentification have negative effects on downstream image analysis tasks because of removal of relevant but non-identifiable information. This work presents an end-to-end deep learning framework for transforming raw clinical image volumes into de-identified, analysis-ready datasets without compromising downstream utility. The methodology developed and tested in this work first detects and redacts regions likely to contain protected health information (PHI), such as burned-in text and metadata, and then uses a generative deep learning model to inpaint the redacted areas with anatomically and imaging plausible content. The proposed pipeline leverages a lightweight hybrid architecture, combining CRNN-based redaction with a latent-diffusion inpainting restoration module (Stable Diffusion 2). We evaluate the approach using both privacy-oriented metrics, which quantify residual PHI and success of redaction, and image-quality and task-based metrics, which assess the fidelity of restored volumes for representative deep learning applications. Our results suggest that the proposed method yields de-identified medical images that are visually coherent, maintaining fidelity for downstream models, while substantially reducing the risk of patient re-identification. By automating anonymization and image reconstruction within a single workflow, and dissemination of large-scale medical imaging collections, thereby lowering a key barrier to data sharing and multi-institutional collaboration in medical imaging AI.

Figures & tables

Figure 1: Typical example of an echocardiogram with a synthetic PHI overlay

Approach	Data type	Metrics / outcomes	Limitations	Ref.
End-to-end de-identification pipeline combining OCR, deep-learning based text detection, and skull-stripping and defacing for multi-modal images and raw k-space	DICOM MRI and CT, whole-slide images, vendor-specific raw data (e.g., Siemens TWIX)	PHI text-removal accuracy, proportion of sensitive DICOM tags cleared, defacing / skull-stripping quality, per-study runtime and throughput compared with existing toolchains	Does not recover anatomy within redacted regions; evaluation emphasizes tag/text clearance and skull-stripping quality more than downstream model performance or fidelity of restored content.	[ 20 ]
A two-stage de-identification process for privacy-preserving medical image analysis. Stage 1: PACS export and systematic DICOM header stripping; Stage 2: attribute-level cleansing with rule-based verification and QA	CT images in DICOM format	Completeness of PHI removal (manual review of tags and headers), preservation of essential clinical/technical metadata, PACS and DICOM viewer compatibility	Primarily metadata- and header-focused; does not address burned-in text or image overlays; no mechanism to restore obscured anatomy; relies on rule-based configuration and manual verification.	[ 21 ]
Project-level GDPR-compliant pipelines across AI4HI projects; standardized DICOM tag profiles, ID pseudonymization, tag removal, and region masking	Multicentre cancer-related imaging datasets plus linked clinical data	Number and type of DICOM tags modified, overlap of tag profiles across projects, qualitative assessment of GDPR compliance and operational lessons learned	Provides guidance of GDPR-compliant workflows rather than a concrete pixel-level de-identification algorithm; largely qualitative evaluation; limited treatment of burned-in text; no reconstruction of masked regions.	[ 22 ]
Federated learning frameworks with privacy-preserving mechanisms (e.g., DP, secure aggregation) and uncertainty estimation (Bayesian & ensemble methods)	Multi-site medical imaging tasks (classification, detection, segmentation) surveyed across modalities	Model performance (AUC, Dice, accuracy) under FL vs centralized training, empirical/privacy-leakage analyses, calibration and uncertainty-quality metrics reported in reviewed studies	Addresses privacy at the model-training level rather than at the image or DICOM-object level; raw images and burned-in text remain unchanged; privacy guarantees are largely theoretical/empirical for gradients, not for released image volumes.	[ 23 ]
Conditional GANs to synthesize realistic brain MRIs with tumors for both data augmentation and anonymization	Multi-parametric brain MRI (e.g., BRATS, ADNI)	Tumor segmentation Dice score when training on real vs. synthetic vs. mixed datasets; visual realism and utility of synthetic images as an anonymized surrogate for real patient data	Synthetic images may still leak identity trends inherent in the training distribution; not designed as a general-purpose DICOM de-identification tool (no tag handling, no explicit text detection); reconstruction of already redacted regions not considered.	[ 24 ]
CNN-based verification and retrieval models for re-identifying patients from chest radiographs	Chest X-ray datasets (ChestX-ray14, CheXpert, COVID-19 CXR collections)	Verification AUC and accuracy for same-/different-patient classification, retrieval performance (mAP@R, precision@1), cross-dataset generalization of re-identification risk	Demonstrates re-identification risk rather than offering a de-identification solution; limited to chest radiographs; highlights that naive de-identification (e.g., header stripping alone) is insufficient but does not propose reconstruction or robust mitigation strategies.	[ 25 ]

Table 1: Overview of medical imaging privacy-preserving techniques, data types, evaluation metrics, and limitations

Figure 2: Pipeline and architecture of detecting private health information and subsequent inpainting. The redaction portion of the architecture is composed of a CRNN and CTC, which create a binary that which is directed to a latent-diffusion model for image restoration.

Metric	Mean $\pm$ std.
F1 score	0.892 $\pm$ 0.04
Recall	0.939 $\pm$ 0.06
Precision	0.854 $\pm$ 0.06

Table 2: Metrics for Binary Mask

Inpainting Type	F1	Recall	Precision
Diffusion (no context)	0.999	0.999	0.999
Diffusion (with context)	0.998	0.998	0.998
Telea	0.998	0.998	0.998

Table 3: Validation metrics for downstream classification task

Figure 3: Example data entry of synthetic PHI overlay (left) with ground truth redaction mask (middle) and predicted mask (right).

Metric	Diffusion	Diffusion (NC)	Telea
MSE	912 $\pm$ 1586	880 $\pm$ 1426	1003 $\pm$ 1101
RMSE	25 $\pm$ 17	25 $\pm$ 16	28 $\pm$ 14
SSIM	0.83 $\pm$ 0.09	0.83 $\pm$ 0.09	0.96 $\pm$ 0.03

Table 4: Validation metrics for downstream classification task. Recored as

\mu\ \pm\ \sigma

Figure 4: Masking and inpainting of 3 different techniques and their difference with the original image

Aug 21, 2026

Masking Is Not Enough: Generative Restoration for Multimodal De-Identification in Medical AI

Medical image-text data can expose protected health information (PHI) through both visible image content as well as accompanying text, creating a barrier to privacy-preserving medical AI systems. This risk is especially prominent in multimodal systems, where images, questions, reports, and clinical context may enter training, evaluation, or inference pipelines. Existing medical vision-language benchmarks primarily emphasize task utility, while de-identification methods are often evaluated separately from downstream reasoning. We introduce ClinX, an end-to-end multimodal PHI sanitization framework for medical image-text data. ClinX detects visible identifiers with optical character recognition (OCR), constructs binary PHI masks, and applies ClinX-PRISM, a no-skip generative restoration module with privacy-oriented post-processing for burned-in identifier suppression. In parallel, text-side PHI is reduced through progressive de-identification levels: regex masking, context-aware masking, and rewrite-based sanitization. We evaluate ClinX in medical visual question answering (MedVQA), jointly measuring PHI leakage and downstream utility across image-side, text-side, and combined de-identification settings. Results show that OCR-only masking is not sufficient as a standalone solution, and restoration-based sanitization better preserves clinically relevant visual context while sharply reducing recoverable PHI.

Shiva Shrestha, Zongxing Xie, Chen Zhao +3

Department of Computer Science Kennesaw State University Marietta, GA 30060, USA · Department of Computer Science and Software Engineering Miami University Oxford, OH 45056, USA · Department of Computer Science Georgia State University Atlanta, GA 30303, USA +1

Privacy Protection in VLMs Image Restoration

Ask PDF

Aug 6, 2026

MirrorNet: Can Medical Image Anonymization Really Protect Patient Identity?

Medical images are routinely de-identified---names, dates, and other metadata removed---and then shared for research, teaching, and public benchmarks under the assumption that this renders them anonymous. Such de-identification protects the metadata but not the pixels, and---apart from scans that directly contain facial structures---whether the image content itself identifies the patient has received little scrutiny. We investigate this question by learning a cycle-consistent correspondence between a cross-sectional medical image and a non-medical, patient-identifying image, using a pair of coupled, cycle-consistent variational autoencoders. From a held-out scan, the model recovers a recognisable likeness of the patient (identity-region MAE = 0.163); conversely, it synthesises a scan from such an image. These results indicate that a de-identified medical scan remains identifying---it is, in effect, a photograph of the patient---and that imaging data should be governed as biometric data rather than as anonymisable records. To support reproducibility, the code and trained models are shared at https://github.com/attilasimko/public-repository.

Attila Simkó

Department of Diagnostics and Intervention Umeå University, Umeå, Sweden

Biometric Identification Medical Image Analysis

Ask PDF

Apr 8, 2026

A Utility-preserving De-identification Pipeline for Cross-hospital Radiology Data Sharing

Large-scale radiology data are critical for developing robust medical AI systems. However, sharing such data across hospitals remains heavily constrained by privacy concerns. Existing de-identification research in radiology mainly focus on removing identifiable information to enable compliant data release. Yet whether de-identified radiology data can still preserve sufficient utility for large-scale vision-language model training and cross-hospital transfer remains underexplored. In this paper, we introduce a utility-preserving de-identification pipeline (UPDP) for cross-hospital radiology data sharing. Specifically, we compile a blacklist of privacy-sensitive terms and a whitelist of pathology-related terms. For radiology images, we use a generative filtering mechanism that synthesis a privacy-filtered and pathology-reserved counterparts of the original images. These synthetic image counterparts, together with ID-filtered reports, can then be securely shared across hospitals for downstream model development and evaluation. Experiments on public chest X-ray benchmarks demonstrate that our method effectively removes privacy-sensitive information while preserving diagnostically relevant pathology cues. Models trained on the de-identified data maintain competitive diagnostic accuracy compared with those trained on the original data, while exhibiting a marked decline in identity-related accuracy, confirming effective privacy protection. In the cross-hospital setting, we further show that de-identified data can be combined with local data to yield better performance.

Chenhao Liu, Zelin Wen, Yan Tong +7

Shandong University · Hong Kong University of Science and Technology · Australian National University +3

Privacy-Preserving ML Healthcare

Ask PDF

Abstract

Explore similar work

Masking Is Not Enough: Generative Restoration for Multimodal De-Identification in Medical AI

MirrorNet: Can Medical Image Anonymization Really Protect Patient Identity?

A Utility-preserving De-identification Pipeline for Cross-hospital Radiology Data Sharing