RetinaGuard: Privacy-Preserving Fundus Imaging

• RetinaGuard is a privacy-preserving framework that obfuscates retinal age through feature-level generative adversarial masking, maintaining crucial diagnostic details.
• It employs a multi-model-to-one knowledge distillation strategy, integrating diverse age predictors and a retinal foundation model to ensure robust privacy against black-box predictors.
• Empirical results demonstrate increased age prediction errors (e.g., higher MAE, negative R²) while preserving image quality and disease classification accuracy.

RetinaGuard is a privacy-preserving technical framework for fundus imaging that obfuscates sensitive image-derived biomarkers—specifically retinal age—without impairing diagnostic quality or visual fidelity. Developed to address biometric privacy risks emergent in clinical image analysis, RetinaGuard employs feature-level generative adversarial masking, enabling precise control over the obfuscation of latent age-related signals while maintaining integrity of image content relevant to disease assessment. The method further leverages a multi-model-to-one @@@@1@@@@ scheme, incorporating diverse age prediction models and a retinal foundation model to ensure universality and robustness against black-box age predictors. Empirical evaluations demonstrate effective retinal age suppression alongside preservation of diagnostic accuracy and image structure, positioning RetinaGuard as a flexible tool extensible to the protection of other medical image-derived biomarkers (Luo et al., 7 Sep 2025).

1. Problem Statement and Motivation

RetinaGuard was formulated in response to escalating privacy concerns associated with advanced AI-enabled fundus image analysis. Recent studies show that deep neural networks can infer retinal age from fundus images, which acts as a proxy for systemic risk factors, behavioral status, and even mortality prediction. Such implicitly encoded biometric attributes render routine fundus images high-dimensional privacy risks; unauthorized extraction can compromise individual privacy and facilitate bioinformation leakage, especially in scenarios involving insurance assessment or identity verification.

Existing privacy enhancement methods for medical images (e.g., pixel-level blurring or masking) often destroy clinically relevant morphological information. RetinaGuard addresses this by focusing obfuscation at the feature level—targeting only those latent representations carrying age information—thus preserving crucial diagnostic content and image readability.

2. Feature-Level Generative Adversarial Masking Mechanism

RetinaGuard’s architecture consists of three interconnected modules: a feature encoder, a mask generator, and a feature-preserving decoder.

1. Feature Extraction Given a fundus image $I_{in}$, the encoder $\mathcal{E}$ maps it to latent features $f_{lat} = \mathcal{E}(I_{in})$.
2. Adversarial Mask Generation The mask generator $\mathcal{M}$ constructs a feature-level mask using adversarial noise $z$, which itself is derived from the input image rather than external randomization, i.e., $z = z(I_{in})$. The mask is scaled:

$\delta = a \cdot \hat{z}$

where $a \in (0,1]$ is a user-controlled strength parameter and $\hat{z}$ is the z-score normalized adversarial noise.

1. Mask Application and Image Synthesis The mask is applied element-wise:

$f_{ob} = f_{lat} \circ \mathcal{M}(z(I_{in}))$

and the decoder reconstructs the obfuscated image:

$I_{ob} = \mathcal{D}(f_{ob})$

1. Joint Objective Function Optimization balances privacy, image fidelity, and clinical utility:

$$L_{pp} = \lambda \cdot \max(0, \text{cosine similarity}) + \phi \cdot \| I_{in} - I_{ob} \|^2 + (1 - \lambda - \phi) \cdot (\text{KL divergence})$$

where cosine similarity measures age feature overlap (to minimize privacy leakage), mean square error preserves visual content, and KL divergence ensures pathological feature congruence.

1. Adjustable Privacy–Utility Tradeoff The scaling parameter $a$ enables dynamic modulation of obfuscation strength, allowing administrators or clinical protocols to tune privacy suppression against desired diagnostic requirements.

3. Multiple-to-One Knowledge Distillation Strategy

RetinaGuard must maintain effectiveness against unknown or black-box age prediction models:

• Surrogate Age Encoder Construction The framework assembles a pool of diverse age encoders: CNN- and Transformer-based models trained on regression and classification objectives. Outputs are shape-aligned with zero-padding and fused via convolutional layers to produce the composite vector $\tilde{f}_{age}$.
• Retinal Foundation Model Reference The foundation model (RETFound) extracts reference features $f^*_{age}$ representative of the universal retinal age signal space.
• Contrastive Distillation Loss Learning proceeds by minimizing feature similarity:

$$L_{dil} = 1 - \frac{ \tilde{f}_{age} \cdot f^*_{age} }{ \| \tilde{f}_{age} \| \| f^*_{age} \| }$$

The surrogate encoder thus captures broad age-relevant representations, ensuring the adversarial mask effectively disrupts most known and future age predictors operating under black-box conditions.

4. Evaluation Metrics and Empirical Outcomes

RetinaGuard was rigorously evaluated across several datasets including ODIR and RAE using standard metrics for privacy suppression, image quality, and diagnostic retention:

• Privacy Metrics
  • Mean Absolute Error (MAE): Increased MAE after obfuscation indicates degraded age prediction accuracy.
  • R² Score: Negative or near-zero R² marks effective destruction of age linkage.
• Visual and Pathological Utility Metrics
  • SSIM (Structural Similarity Index Measure): High SSIM reflects preservation of global image structure.
  • Disease Classification Accuracy: Maintained or improved diabetic retinopathy (DR-ACC) and glaucoma (GON-ACC) scores.
  • Vessel Segmentation (IoU): Preservation of anatomical segmentation capabilities.

Empirical results show RetinaGuard consistently yields maximal retinal age obfuscation (highest MAE, negative R²), while maintaining SSIM and IoU comparable to non-obfuscated images and reliably supports downstream disease classification.

5. Flexibility and Potential for Extension

Although RetinaGuard is presented in the context of retinal age, its modularity allows extension to arbitrary image-derived biomarkers:

• The feature-level masking and knowledge distillation components can be reconfigured for other prediction targets (e.g., BMI, smoking status, phenotypic risk factors).
• Substitution of disease encoders $\mathcal{S}$ and retraining of adversarial masks enables privacy protection for diverse medical images.
• This flexibility supports deployment in multi-modal clinical environments where multiple implicit biomarkers may require simultaneous privacy protection.

6. Significance and Future Directions

RetinaGuard introduces a paradigm shift in biometric privacy for medical imaging:

• Rather than relying on superficial pixel perturbation, it uses adversarial attacks on features to mask only the sensitive attributes, thus retaining clinical usability.
• The universal distillation approach ensures forward compatibility with future prediction methodologies.
• Future research is anticipated to include optimizations for computational efficiency, adaptive privacy modulation per clinical scenario, and exploration of obfuscation strategies for multimodal (and non-image) health data.

RetinaGuard thus provides a technologically robust solution for privacy protection in fundus imaging—and by extension, other fields of medical image analysis—preserving both personal privacy and clinical value as precision medicine and digital health analytics become increasingly pervasive (Luo et al., 7 Sep 2025).