VoxShield: Protecting 3D Medical Datasets from Unauthorized Training via Frequency-Aware Inter-Slice Disruption

2026-05-17

AI Summary

This work proposes a novel adversarial perturbation mechanism to safeguard publicly available 3D medical image segmentation datasets from misuse, effectively disrupting model training while preserving near-imperceptible visual quality. The method uniquely exploits the voxel-wise inductive bias inherent in 3D medical imaging by jointly introducing cross-slice frequency-domain inconsistency and ℓ₁-divergence-based semantic prediction perturbations, thereby substantially degrading the spatial aggregation capability of 3D segmentation networks. With minimal perturbation magnitude (ε = 4/255), the approach reduces Dice scores on the BraTS19 and FLARE21 datasets from 80.0% and 88.6% to nearly 0.0% and 6.8%, respectively, demonstrating its high efficacy as a protective measure against unauthorized model training.

Abstract

The release of public 3D medical image segmentation (MIS) datasets accelerates clinical research but simultaneously heightens risks of unauthorized AI model training. While Unlearnable Examples (UE) offer protection by injecting imperceptible perturbations to prevent effective model learning, existing methods primarily target 2D scenarios. They neglect the volumetric spatial correlations and inter-slice anatomical consistency inherent in 3D medical volumes, which serve as critical learning priors for 3D segmentation networks. To bridge this gap, we propose VoxShield, a UE framework that explicitly targets the volumetric inductive biases of 3D networks. Our core insight is that by systematically dismantling the cross-slice continuity that 3D architectures rely on, we can fundamentally impair their spatial aggregation process. Specifically, we introduce an Inter-Slice Frequency Consistency Disruption mechanism that maximizes the spectral divergence between adjacent slices, injecting structural incoherence along the $z$-axis. Complementing this structural attack, a Semantic Prediction Disruption module is incorporated. By maximizing the $\ell_1$ divergence between clean and perturbed logits, it forces the injected noise to penetrate the entire network and corrupt the final semantic mapping. Experiments on BraTS19 and FLARE21 demonstrate that VoxShield successfully degrades 3D segmentation performance, reducing the DSC from 80.0% to near 0.0% and from 88.6% to 6.8%, respectively. All protections are achieved with minimal perturbation ($ε=4/255$) to preserve high visual fidelity. The code is available at https://github.com/KK266299/VoxShield.

Problem

• 3D medical image segmentation
• unauthorized training
• unlearnable examples
• volumetric data protection
• privacy-preserving machine learning

Innovation

• Unlearnable Examples
• 3D Medical Image Segmentation
• Inter-Slice Disruption
• Frequency-Aware Perturbation
• Volumetric Inductive Bias