Stripping the DICOM header and blacking out burned-in text leaves a chest X-ray still identifiable. Packhäuser and colleagues showed in 2022 that a verification network can match two ChestX-ray14 radiographs of the same patient almost perfectly, so the anatomy itself works as a biometric. In arXiv:2610.40722, Nishi Kanta Paul and Md Shihabul Islam Shovo from NIMISHES Lab in Dhaka and Désiré Sidibé from IBISC at Université d’Évry Paris-Saclay describe LAPIS, a method that changes the pixels of each chest radiograph so the released image is harder to link back to the patient, while keeping enough clinical content to train pathology models on it.
The paper reports plainly where its method loses to an older baseline, which is a big part of why I picked it.
What the method does
LAPIS works inside the latent space of a convolutional autoencoder. A 256 x 256 radiograph is encoded into a 128-channel, 32 x 32 code. The method learns to split that code into two parts.
- A small identity residual. A learned orthonormal basis of 8 channel directions (6.25% of the latent channels), shared across every spatial location, pulls out the part of the code that is patient-specific. A contrastive loss trained on repeat studies of the same patient makes this residual good at telling patients apart. Hard negatives are matched on pathology labels, view position and pixel spacing so the residual cannot cheat by encoding disease or scanner setup.
- A clinical complement. Everything else in the code. A spatial adversary tries to recognize the patient from this part and the encoder is trained to defeat it, while a pathology head checks that the fourteen ChestX-ray14 findings are still predictable from it.
- Replacement-aware decoding. During training, the decoder sees codes where one patient’s identity residual has been swapped onto another patient’s clinical complement. A frozen patient verifier pushes the output away from the source identity, a pathology classifier checks the findings did not change, a cycle loss ties both halves back to their sources, and a PatchGAN discriminator keeps the output looking like a real radiograph.
- Release. At release time, each image’s identity residual is replaced by a random mix of two donor residuals from the training cohort, matched on coarse clinical and acquisition properties. A filter rejects any candidate that still looks too similar to the source or to either donor.
What comes out of it
The output is a new 256 x 256 frontal radiograph. The featured image shows two cases from Fig. 3 of the paper: the original, a plain autoencoder reconstruction, the LAPIS release and a map of where the release differs from the reconstruction. The lungs and mediastinum look the same at a glance. The change is smooth, low-frequency and mostly around the periphery, which is what you would expect from swapping a few channel directions rather than warping the anatomy.
For a data-sharing team, this would slot in after standard DICOM de-identification. You would still strip tags and burned-in annotations with your usual tooling, then run LAPIS on the pixel data before export. It is a 2D, single-view method trained at 256 x 256, so it sits in a research release pipeline, not inside a diagnostic viewer.
How they tested it
ChestX-ray14 (112,120 frontal radiographs, 30,805 patients) is split by patient into three disjoint sets: one to train the anonymizer and all attackers, one to anonymize and release, and one kept real for testing downstream models. The attackers (ResNet-50, ConvNeXt-T and ViT-S verifiers) are trained on anonymized images, so they know the technique and plain domain shift cannot fool them. The authors also run every method through the autoencoder alone as a control, and they report two different threats: linking a released image to another study of the same patient, and linking it back to its own source image.
Against the reconstruction control, LAPIS lowers worst-case cross-study linkability from 0.961 to 0.791 AUC. A DenseNet-121 trained on the released images and tested on real ones loses 0.012 macro AUROC relative to training on reconstructions, inside the 0.02 margin the authors fixed in advance. It also beats PriCheXy-Net, a deformation-based anonymizer, on that test, and no other method that stays inside the utility margin gets lower linkability.
Where it falls short
- Same-image linking. A simple structural attack using SSIM and cross-correlation finds the source image more often for LAPIS releases than for PriCheXy-Net. Because LAPIS keeps the global geometry of the anatomy, deformation is still better if your threat is someone holding the original image.
- Imperfect split. Probes can still recover identity from the clinical complement above chance, and some pathology information sits in the identity residual.
- One finding degrades. Emphysema is the one adequately powered finding with a clear drop in AUROC. It is a diffuse texture finding, and the smooth change from the residual swap may interfere with exactly that cue.
- Scope. One public dataset, frontal views only, 256 x 256 resolution, and no test on other hospitals or modalities.
- Part of the attack is acquisition. With acquisition-matched negatives, linkability drops further for every method, so some of what the attackers exploit is scanner and protocol, not the patient.
Code, weights and license
I could not find public code or trained weights for LAPIS at the time of writing; the paper does not link a repository. The preprint is released under CC BY 4.0. Training ran on two NVIDIA A100 40 GB GPUs. The authors state that no anonymized derivative images were distributed with the work. If you need the basics first, see our guides on DICOM anonymization using Python and DICOM anonymizer software.
My take
Header anonymization and pixel anonymization are two different jobs, and most release pipelines only do the first one. LAPIS gives a clean recipe for the second, with an evaluation protocol that I would copy for any internal privacy test: adaptive attackers, a reconstruction control and both linking threats reported separately. Without code, a team would have to reimplement it, and I would want to see it on higher resolution images and a second hospital before using it for an actual data release.