RetinaGuard: Obfuscating Retinal Age in Fundus Images for Biometric Privacy Preserving

2025-09-07

AI Summary

Retinal age—a sensitive biometric trait inferred from fundus images—can be illicitly extracted by black-box models, leading to biomedical privacy breaches. Method: We propose RetinaGuard, the first general-purpose defense framework for biomedical privacy protection in medical imaging. It employs adversarial generation to mask sensitive features in the latent space and integrates a many-to-one knowledge distillation strategy that jointly trains a retinal foundation model with multiple surrogate age encoders, enabling robust protection against unknown black-box age predictors. Contribution/Results: Experiments demonstrate that RetinaGuard reduces age prediction accuracy by over 85% on average, while preserving image visual fidelity, critical pathological feature integrity, and downstream disease diagnostic utility. This work formally defines the problem of biomarker privacy protection in medical imaging and establishes a scalable, generalizable framework extendable to other biological ages or physiological biomarkers.

Technology Category

• Machine Learning: Privacy
• Computer Vision: Bias, Fairness & Privacy
• Natural Language Processing: Ethics — Bias, Fairness, Transparency & Privacy

Application Category

• User Modeling, Personalization and Recommendation: User privacy protection in personalized systems
• Security and Privacy: Data transparency and provenance
• Search and Retrieval-Augmented AI: Agentic search

Abstract

The integration of AI with medical images enables the extraction of implicit image-derived biomarkers for a precise health assessment. Recently, retinal age, a biomarker predicted from fundus images, is a proven predictor of systemic disease risks, behavioral patterns, aging trajectory and even mortality. However, the capability to infer such sensitive biometric data raises significant privacy risks, where unauthorized use of fundus images could lead to bioinformation leakage, breaching individual privacy. In response, we formulate a new research problem of biometric privacy associated with medical images and propose RetinaGuard, a novel privacy-enhancing framework that employs a feature-level generative adversarial masking mechanism to obscure retinal age while preserving image visual quality and disease diagnostic utility. The framework further utilizes a novel multiple-to-one knowledge distillation strategy incorporating a retinal foundation model and diverse surrogate age encoders to enable a universal defense against black-box age prediction models. Comprehensive evaluations confirm that RetinaGuard successfully obfuscates retinal age prediction with minimal impact on image quality and pathological feature representation. RetinaGuard is also flexible for extension to other medical image derived biomarkers. RetinaGuard is also flexible for extension to other medical image biomarkers.

Problem

• Protecting retinal age privacy in fundus images
• Preventing bioinformation leakage from medical images
• Obscuring sensitive biomarkers while preserving diagnostic utility

Innovation

• Generative adversarial masking mechanism for privacy
• Multiple-to-one knowledge distillation strategy
• Preserves image quality and diagnostic utility