{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,26]],"date-time":"2026-06-26T20:55:13Z","timestamp":1782507313279,"version":"3.54.5"},"reference-count":26,"publisher":"MDPI AG","issue":"11","license":[{"start":{"date-parts":[[2021,6,4]],"date-time":"2021-06-04T00:00:00Z","timestamp":1622764800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Office of the Privacy Commissioner of Canada","award":["-"],"award-info":[{"award-number":["-"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Recent research in computer vision has shown that original images used for training of deep learning models can be reconstructed using so-called inversion attacks. However, the feasibility of this attack type has not been investigated for complex 3D medical images. Thus, the aim of this study was to examine the vulnerability of deep learning techniques used in medical imaging to model inversion attacks and investigate multiple quantitative metrics to evaluate the quality of the reconstructed images. For the development and evaluation of model inversion attacks, the public LPBA40 database consisting of 40 brain MRI scans with corresponding segmentations of the gyri and deep grey matter brain structures were used to train two popular deep convolutional neural networks, namely a U-Net and SegNet, and corresponding inversion decoders. Matthews correlation coefficient, the structural similarity index measure (SSIM), and the magnitude of the deformation field resulting from non-linear registration of the original and reconstructed images were used to evaluate the reconstruction accuracy. A comparison of the similarity metrics revealed that the SSIM is best suited to evaluate the reconstruction accuray, followed closely by the magnitude of the deformation field. The quantitative evaluation of the reconstructed images revealed SSIM scores of 0.73\u00b10.12 and 0.61\u00b10.12 for the U-Net and the SegNet, respectively. The qualitative evaluation showed that training images can be reconstructed with some degradation due to blurring but can be correctly matched to the original images in the majority of the cases. In conclusion, the results of this study indicate that it is possible to reconstruct patient data used for training of convolutional neural networks and that the SSIM is a good metric to assess the reconstruction accuracy.<\/jats:p>","DOI":"10.3390\/s21113874","type":"journal-article","created":{"date-parts":[[2021,6,7]],"date-time":"2021-06-07T01:56:40Z","timestamp":1623031000000},"page":"3874","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":24,"title":["An Analysis of the Vulnerability of Two Common Deep Learning-Based Medical Image Segmentation Techniques to Model Inversion Attacks"],"prefix":"10.3390","volume":"21","author":[{"given":"Nagesh","family":"Subbanna","sequence":"first","affiliation":[{"name":"Department of Radiology, University of Calgary, Calgary, AB T2N 1N4, Canada"},{"name":"Hotchkiss Brain Institute, University of Calgary, Calgary, AB T2N 1N4, Canada"},{"name":"Alberta Children\u2019s Hospital Research Institute, University of Calgary, Calgary, AB T2N 1N4, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8845-360X","authenticated-orcid":false,"given":"Matthias","family":"Wilms","sequence":"additional","affiliation":[{"name":"Department of Radiology, University of Calgary, Calgary, AB T2N 1N4, Canada"},{"name":"Hotchkiss Brain Institute, University of Calgary, Calgary, AB T2N 1N4, Canada"},{"name":"Alberta Children\u2019s Hospital Research Institute, University of Calgary, Calgary, AB T2N 1N4, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3942-2732","authenticated-orcid":false,"given":"Anup","family":"Tuladhar","sequence":"additional","affiliation":[{"name":"Department of Radiology, University of Calgary, Calgary, AB T2N 1N4, Canada"},{"name":"Hotchkiss Brain Institute, University of Calgary, Calgary, AB T2N 1N4, Canada"},{"name":"Alberta Children\u2019s Hospital Research Institute, University of Calgary, Calgary, AB T2N 1N4, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2556-3224","authenticated-orcid":false,"given":"Nils D.","family":"Forkert","sequence":"additional","affiliation":[{"name":"Department of Radiology, University of Calgary, Calgary, AB T2N 1N4, Canada"},{"name":"Hotchkiss Brain Institute, University of Calgary, Calgary, AB T2N 1N4, Canada"},{"name":"Alberta Children\u2019s Hospital Research Institute, University of Calgary, Calgary, AB T2N 1N4, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2021,6,4]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Razzak, M.I., Naz, S., and Zaib, A. (2018). Deep Learning for Medical Image Processing: Overview, Challenges and the Future. Classification in BioApps: Automation of Decision Making, Springer International Publishing.","DOI":"10.1007\/978-3-319-65981-7_12"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"062001","DOI":"10.1088\/1741-2552\/abbff2","article-title":"Supervised machine learning tools: A tutorial for clinicians","volume":"17","author":"Vercio","year":"2020","journal-title":"J. Neural Eng."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"9375","DOI":"10.1109\/ACCESS.2017.2788044","article-title":"Deep Learning Applications in Medical Image Analysis","volume":"6","author":"Ker","year":"2018","journal-title":"IEEE Access"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"416","DOI":"10.1139\/gen-2020-0131","article-title":"Machine learning for precision medicine","volume":"64","author":"MacEachern","year":"2021","journal-title":"Genome"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"1684","DOI":"10.1056\/NEJMc1908881","article-title":"Identification of Anonymous MRI Research Participants with Face-Recognition Software","volume":"381","author":"Schwarz","year":"2019","journal-title":"N. Engl. J. Med."},{"key":"ref_6","unstructured":"Glocker, B., Robinson, R., Castro, D.C., Dou, Q., and Konukoglu, E. (2019). Machine Learning with Multi-Site Imaging Data: An Empirical Study on the Impact of Scanner Effects. arXiv."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Fredrikson, M., Jha, S., and Ristenpart, M. (2015, January 12\u201316). Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures. Proceedings of the ACM Conference on Computers and Communication Security 2015 (CCS 15), Denver, CO, USA.","DOI":"10.1145\/2810103.2813677"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Xiao, T., Tsai, Y., Sohn, K., Chandraker, M., and Yang, M. (2020, January 7\u201312). Adversarial Learning of Privacy-Preserving and Task-Oriented Representations. Proceedings of the 34th AAAI Conference on Artificial Intelligence, New York, NY, USA.","DOI":"10.1609\/aaai.v34i07.6930"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"2481","DOI":"10.1109\/TPAMI.2016.2644615","article-title":"SegNet: A Deep Convolutional Encoder-Decoder Architecture for Image Segmentation","volume":"39","author":"Badrinarayanan","year":"2017","journal-title":"IEEE Trans. Pattern Recognit. Mach. Intell."},{"key":"ref_10","first-page":"234","article-title":"U-Net: Convolutional Networks for Biomedical Image Segmentation","volume":"Volume 9351","author":"Ronneberger","year":"2015","journal-title":"Medical Image Computing and Computer Assisted Intervention (MICCAI 15)"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Subbanna, N., Tuladhar, A., Wilms, M., and Forkert, N.D. (2021, January 14\u201318). Understanding privacy risks in typical deep learning models for medical image analysis. Proceedings of the Medical Imaging 2021: Imaging Informatics for Healthcare, Research, and Applications, San Diego, CA, USA.","DOI":"10.1117\/12.2582014"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"1064","DOI":"10.1016\/j.neuroimage.2007.09.031","article-title":"Construction of a 3D probabilistic atlas of human cortical structures","volume":"39","author":"Shattuck","year":"2008","journal-title":"Neuroimage"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Shokri, R., Stronati, M., Song, C., and Shmatikov, V. (2017, January 25). Membership inference attacks against machine learning models. Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP) IEEE, San Jose, CA, USA.","DOI":"10.1109\/SP.2017.41"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Nasr, M., Shokri, R., and Houmansadr, A. (2018, January 15\u201319). Machine learning with membership privacy using adversarial regularization. Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, Toronto, ON, Canada.","DOI":"10.1145\/3243734.3243855"},{"key":"ref_15","unstructured":"Wu, M., Zhang, X., Ding, J., Nguyen, H., Yu, R., Pan, M., and Wong, S. (2020). Evaluation of Inference Attack Models for Deep Learning on Medical Data. arXiv."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"869","DOI":"10.1109\/TNSE.2018.2797930","article-title":"Image and Attribute Based Convolutional Neural Network Inference Attacks in Social Networks","volume":"7","author":"Mei","year":"2020","journal-title":"IEEE Trans. Netw. Sci. Eng."},{"key":"ref_17","unstructured":"Fredrikson, M., Lantz, E., Jha, S., Lin, S., Page, D., and Ristenpart, T. (2014, January 20\u201322). Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing. Proceedings of the 23rd USENIX Conference on Security Symposium, San Diego, CA, USA. SEC\u201914."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Oh, S., Schiele, B., and Fritz, M. (2019). Towards reverse-engineering black-box neural networks. Explainable AI: Interpreting, Explaining and Visualizing Deep Learning, Springer.","DOI":"10.1007\/978-3-030-28954-6_7"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Wang, B., and Gong, N. (2018, January 20\u201224). Stealing hyperparameters in machine learning. Proceedings of the 2018 IEEE Symposium on Security and Privacy (SP) IEEE, San Francisco, CA, USA.","DOI":"10.1109\/SP.2018.00038"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"He, Z., Zhang, T., and Lee, R.B. (2019, January 9\u201313). Model inversion attacks against collaborative inference. Proceedings of the 35th Annual Computer Security Applications Conference, San Juan, PR, USA.","DOI":"10.1145\/3359789.3359824"},{"key":"ref_21","unstructured":"Simonyan, K., and Zisserman, A. (2015, January 7\u20139). Very deep convolutional networks for large-scale image recognition. Proceedings of the International Conference on Learning Representations, San Diego, CA, USA."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"589","DOI":"10.1002\/(SICI)1522-2594(200004)43:4<589::AID-MRM14>3.0.CO;2-2","article-title":"Correction for B(1) and B(0) variations in quantitative T(2) measurements using MRI","volume":"43","author":"Sled","year":"2000","journal-title":"Magn. Reson. Med."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"143","DOI":"10.1109\/42.836373","article-title":"New variants of a method of MRI scale standardization","volume":"19","author":"Nyul","year":"2000","journal-title":"IEEE Trans. Med. Imaging"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"600","DOI":"10.1109\/TIP.2003.819861","article-title":"Image quality assessment: From error visibility to structural similarity","volume":"13","author":"Wang","year":"2004","journal-title":"IEEE Trans. Image Process."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"2033","DOI":"10.1016\/j.neuroimage.2010.09.025","article-title":"A reproducible evaluation of ANTs similarity metric performance in brain image registration","volume":"54","author":"Avants","year":"2011","journal-title":"Neuroimage"},{"key":"ref_26","first-page":"14","article-title":"Techniques for disparity measurement","volume":"53","author":"Jenkin","year":"1991","journal-title":"Comput. Vis. Graph. Image Process. Image Underst."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/21\/11\/3874\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T06:10:45Z","timestamp":1760163045000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/21\/11\/3874"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,6,4]]},"references-count":26,"journal-issue":{"issue":"11","published-online":{"date-parts":[[2021,6]]}},"alternative-id":["s21113874"],"URL":"https:\/\/doi.org\/10.3390\/s21113874","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,6,4]]}}}