Can Demographic Information Be Reduced in Retinal Fundus Images While Preserving Glaucoma-Relevant Features?
Discuss this preprint
Start a discussion What are Sciety discussions?Listed in
This article is not in any list yet, why not save it to one of your lists.Abstract
Purpose
To determine whether disease-aware adversarial perturbations can reduce demographic recoverability encoded in color fundus photographs (CFPs) while preserving glaucoma-related diagnostic features.
Design
Retrospective analysis of a single-institution retinal imaging dataset using adversarial machine-learning experiments.
Participants
A total of 4,271 patients contributing 13,959 CFPs from Massachusetts Eye and Ear.
Methods
Vision Transformer (ViT) was trained for glaucoma detection and for prediction of race, sex, and ethnicity. Standard and disease-aware (DA) variants of four adversarial attacks—Fast Gradient Sign Method (FGSM), Projected Gradient Descent (PGD), Carlini & Wagner (C&W), and a diffusion-based attack—were applied to suppress demographic prediction; DA attacks augmented the adversarial objective with a disease-preservation term. Cross-architecture transferability was assessed by generating perturbations on ViT and applying them to ResNet50 and EfficientNetB0.
Main Outcome Measures
Area under the receiver operating characteristic curve (AUC) and accuracy for glaucoma and demographic classification before and after perturbation, and disease-preservation and attack transferability across architectures.
Results
At baseline, CFPs encoded both glaucoma-related and demographic information. Glaucoma detection AUCs were 0.958 (95% CI, 0.949–0.967), 0.960 (95% CI, 0.951–0.967), and 0.963 (95% CI, 0.955–0.971) in the race, sex, and ethnicity analysis cohorts, respectively. Demographic prediction performance was also high, with AUCs of 0.955 (95% CI, 0.945–0.963) for race, 0.983 (95% CI, 0.977–0.988) for sex, and 0.992 (95% CI, 0.987– 0.996) for ethnicity. Standard attacks substantially reduced demographic AUC but often degraded glaucoma detection. Disease-aware optimization improved disease preservation while maintaining demographic suppression. Using a prespecified success criterion of at least 90% disease AUC preservation and demographic AUC reduction to 30% or less of baseline, DA-PGD and DA-Diffusion succeeded across race, sex, and ethnicity; DA-C&W succeeded for sex and ethnicity. Cross-architecture transferability experiments demonstrated that disease preservation transferred more robustly than demographic suppression.
Conclusions
Disease-aware adversarial perturbations reduced the recoverability of demographic information in CFPs under white-box conditions while preserving glaucoma-relevant features, suggesting these representations are partially separable. Reduced demographic recoverability did not fully transfer across architectures, highlighting the need for architecture-agnostic methods.
Précis
Disease-aware adversarial perturbations reduced demographic recoverability from color fundus photographs while preserving glaucoma detection under white-box conditions, but demographic suppression transferred poorly across model architectures.
