Model-Specific Disruption of Demographic Prediction in Retinal Fundus Images
- 1Harvard University
Abstract
PurposeTo test whether disease-aware adversarial attacks can disrupt demographic classification in color fundus photographs (CFPs) while retaining glaucoma classification and whether effects transfer across model architectures.
MethodsThis retrospective study included 13,959 CFPs from 4,271 patients. Vision Transformer (ViT) models classified glaucoma, race, sex, and ethnicity. Standard and disease-aware FGSM, PGD, C&W, and diffusion attacks changed demographic predictions; disease-aware attacks added a glaucoma classification loss term. Fixed ViT-generated perturbations were tested on ResNet50 and EfficientNetB0. Performance was measured using area under the receiver operating characteristic curve (AUC), accuracy, and image-similarity metrics.
ResultsBaseline glaucoma AUCs were 0.958-0.963 and demographic AUCs were 0.955-0.992. Disease-aware attacks better preserved glaucoma classification while strongly altering demographic predictions. Disease-aware PGD preserved sex-cohort glaucoma AUC at 0.909 (95% CI, 0.894-0.922) while sex AUC fell to 0.000 (95% CI, 0.000-0.000). Disease-aware diffusion preserved ethnicity-cohort glaucoma AUC at 0.946 (95% CI, 0.936-0.956) while ethnicity AUC was 0.001 (95% CI, 0.000-0.002). Demographic changes transferred poorly to ResNet50 and EfficientNetB0.
ConclusionsFor PGD, C&W, and diffusion, disease-aware attacks retained more glaucoma classification performance than standard attacks while strongly disrupting targeted demographic prediction. Weak cross-architecture transfer indicates model-specific effects rather than demographic information removal.
Translational RelevanceMethods intended to reduce sensitive information in retinal images could support multicenter AI development, but failure of one demographic classifier does not establish de-identification. Cross-model evaluation while preserving disease classification may provide a more reliable framework for clinical data sharing.
Related
- Retinal layer thickness prediction from smartphone fundus imaging for early glaucoma detection
- Prediction of incident atrial fibrillation from retinal fundus images using a multimodal foundation model
- A multi task deep learning framework for automated health condition prediction from retinal fundus images using hybrid attention and explainable AI
- Explainable foundation model for dementia screening and risk stratification using retinal fundus images
- Annotated dataset for retinal fundus image segmentation: vascular arcade and optic nerve head
BibTeX
@misc{majid2026modelspecific,
title = {{Model-Specific Disruption of Demographic Prediction in Retinal Fundus Images}},
author = {I. Majid and M. Wang},
howpublished = {medRxiv},
year = {2026},
month = jun,
doi = {10.64898/2026.06.23.26356379},
url = {https://www.medrxiv.org/content/10.64898/2026.06.23.26356379v2},
note = {CC BY-NC-ND},
}
RIS
TY - UNPB
TI - Model-Specific Disruption of Demographic Prediction in Retinal Fundus Images
AU - I. Majid
AU - M. Wang
PY - 2026
DA - 2026/06/23
PB - medRxiv
DO - 10.64898/2026.06.23.26356379
UR - https://www.medrxiv.org/content/10.64898/2026.06.23.26356379v2
AB - PurposeTo test whether disease-aware adversarial attacks can disrupt demographic classification in color fundus photographs (CFPs) while retaining glaucoma classification and whether effects transfer across model architectures. MethodsThis retrospective study included 13,959 CFPs from 4,271 patients. Vision Transformer (ViT) models classified glaucoma, race, sex, and ethnicity. Standard and disease-aware FGSM, PGD, C&W, and diffusion attacks changed demographic predictions; disease-aware attacks added a glaucoma classification loss term. Fixed ViT-generated perturbations were tested on ResNet50 and EfficientNetB0. Performance was measured using area under the receiver operating characteristic curve (AUC), accuracy, and image-similarity metrics. ResultsBaseline glaucoma AUCs were 0.958-0.963 and demographic AUCs were 0.955-0.992. Disease-aware attacks better preserved glaucoma classification while strongly altering demographic predictions. Disease-aware PGD preserved sex-cohort glaucoma AUC at 0.909 (95% CI, 0.894-0.922) while sex AUC fell to 0.000 (95% CI, 0.000-0.000). Disease-aware diffusion preserved ethnicity-cohort glaucoma AUC at 0.946 (95% CI, 0.936-0.956) while ethnicity AUC was 0.001 (95% CI, 0.000-0.002). Demographic changes transferred poorly to ResNet50 and EfficientNetB0. ConclusionsFor PGD, C&W, and diffusion, disease-aware attacks retained more glaucoma classification performance than standard attacks while strongly disrupting targeted demographic prediction. Weak cross-architecture transfer indicates model-specific effects rather than demographic information removal. Translational RelevanceMethods intended to reduce sensitive information in retinal images could support multicenter AI development, but failure of one demographic classifier does not establish de-identification. Cross-model evaluation while preserving disease classification may provide a more reliable framework for clinical data sharing.
ER -