• MiDeFace

mideface - a FreeSurfer tool for Minimally Invasive DeFacing of MRI images

Note: a bug was found in the 7.4.0 version of MiDeFace when creating the head mask and true face surface. In a small number of cases, it was found that the thresholds were being set too high causing an undersegmentation of the head. The problem was worse in non-T1w contrasts. This likely does not compromise privacy; rather, it typically caused the defacing to be too aggressive. Another small bug was fixed where SAMSEG would occasionally label the root of the nose (the spot right between the eyes) as skull; this caused this area to be "protected" from defacing leaving that part of the face intact. This is a small region and unlikely to compromise privacy. Fixes have been deployed in FreeSurfer version 7.4.1, which can be found here.

Introduction

MRI images of the brain inevitably include the head and so the face. These images can be processed in a way to reconstruct the outside of the head which can often yield a near-photo quality image of the face (see image; displayed with permission of the subject). Before sharing such MRIs, it is usually a good idea to remove the information about the face so as to protect the subject's privacy. However, removing too much information could degrade the utility of the MRIs. This page describes a tool for defacing MRI images in a way that is both minimally invasive and achieves goals of privacy. Here, "minimally invasive" means changing the image in the smallest way to still be private.

Algorithm

First, the head is segmented from the input volume and a head surface created. mideface then runs Samseg on the input image. Samseg will register the input to a template as well as segment the brain, skull, eyeballs, and other structures. An average face surface in the template space is then mapped into the native space. The average face has several labels including lower face, upper face without eyes, eyes, forehead, ears, and back of head. The average face surface within a label is projected inwards by a distance just far enough until it intersects with at least 95% of the true face in that area. The average face is also projected outwards by a constant distance just far enough to include all of the true face. The distance is the same for all vertices within a label. Voxels in the input volume are segmented into four labels (see image above): (1) inside both the true and average faces ("InnerTissue", blue), (2) outside the true face but inside the average face (green, "InnerBackground"), (3) inside the true face but outside the average face (red, "OuterTissue"), (4) outside both the true and average face ("OuterBackground"). By default, voxels in #1 and #2 are replaced with random intensities set to the mean of voxels in #1 (tissue mean); voxels in #3 and #4 are replaced with random intensities with mean equal to the mode of voxels in #4 (background mean). The result is that the voxels at the tissue mean form the average face resulting in the average face surface if reconstructed. The true face is essentially encompassed by the face mask which assures privacy in that the true face is reduced to a few parameters (12 from the affine registration, and two distances for each label). The true face is private assuming that it cannot be reconstructed from this hand full of parameters. The invasiveness is minimized by projecting the average surface the minimal distance and by excluding voxels labeled by samseg as brain or skull or eyeball. The ears are removed by default, and there are options to remove the forehead and the back of the head (back of the head can be useful if there is wrap-around). Note that the average face has waves in it and a "MIDEFACE" watermark across the eyes. These are there to assure the user that this is indeed an average face and not a true face. Note that the face segmentation DOES have information about the true face and so should not be distributed.

Basic Usage

In the basic usage, one passes the MRI volume to mideface and specifies an output volume

mideface --i volume.mgz --o volume.defaced.mgz

This should take roughly 15min to run. The original and defaced volumes can be viewed with freeview:

freeview volume.mgz volume.defaced.mgz

Quality Assurance (QA)

One can run the above freeview command to verify that the voxels of the face have been replaced with random values, but a more extensive QA is possible by adding and output folder:

mideface --i volume.mgz --o volume.defaced.mgz --odir qa

The qa folder will have many files in it that can be used for QA, but the most important will be head.surf and head.defaced.surf which can be viewed with

freeview volume.mgz volume.defaced.mgz -f qa/head.surf:edgecolor=yellow -f qa/head.defaced.surf:edgecolor=red:visible=0

In the surface view, you will see head.surf. This is a rendering of the entire original head, including the face. Hit the Alt-C button to turn off head.surf and display head.defaced.surf. This is the head after defacing. You should see something like image where the face now has a wave in it and you may be able to read the "MIDEFACE" watermark across the eyes. This is the replacement face. If you see the wave and the watermark, then you know that the face has been replaced. Hit Alt-C a few times to switch back and forth. Rotate the head to verify that the ears have been removed.

Creating Pictures for Quality Assurance

Viewing the face surfaces above can be quite tedious if the number of subjects to deface is large. To make QA easier, mideface has the ability to take snapshots which can then be arranged in a slide show or animation or movie.

mideface --i volume.mgz --o volume.defaced.mgz --odir qa --pics --code codename

Adding --pics will trigger the taking of pictures which will be saved as codename.face-before.png, codename.face-after.png, and codename.before+after.gif, where codename is a unique string for this case. Note: you must have an output folder (--odir) to create pictures.

There are several practical details that may need to be addressed. mideface will call freeview to take the picture. This may result in freeview appearing and disappearing from your display, which can be quite annoying. If you have Xvfb installed, it will try to use that. Xvfb is a frame buffer virtual display, meaning that a freeview window will not show up on your display. mideface will use the ImageMagik convert program to crop the images, add the codename to the image, and create the gif. mideface expects this program to be in /usr/bin/convert. If it is not there, you can pass it the path with --imconvert /path/to/convert. If convert is not found or specified, then just the pngs are created. If a codename is not supplied, then the file names and the images will not have the codename. The codename.before+after.gif file is an animated gif switching between the true face and the defaced. To create a slide show, just copy the pngs or the gifs to a folder and go to that folder with your slide viewing program (note that you will need to specify a codename for this otherwise all the files will have the same name).

Fixing Registration Failures

Sometimes the registration of the volume to standard space fails. This can be fixed in a couple of ways:

Create Registration Using Another Program

Eg, using mri_coreg, like mri_coreg --mov volume.mgz --dof 12 --reg reg.lta --targ  $FREESURFER/average/samseg/20Subjects_smoothing2_down2_smoothingForAffine2/template.nii Then running mideface as before but adding --init-reg reg.lta

Manually Edit the Registration

First, copy the automatic registration to a new location, eg, cp midefacedir/samseg/template.lta reg.man.lta Then run tkregisterfv tkregisterfv --mov volume.mgz --reg reg.man.lta --targ  $FREESURFER/average/samseg/20Subjects_smoothing2_down2_smoothingForAffine2/template.nii Then running mideface as before but adding --init-reg reg.lta

Automatically Searching for Registration Failures

The automatic registration tries to minimize a cost, so the final value of the cost is an indication of how well the registration did. The samseg costs are saved in midefacedir/samseg/cost.txt. This file will have several entries, but the one you should look at is something like {{{templateRegistration 3 -0.857563 }}}. The last value is the registration cost. It will be a value roughly between -1 and 0 with -1 being the best. If this value is greater than -0.8, then it is a good idea to check the case. If the registration has failed, you can use on of the methods above to fix it.

Programmatic Quality Assurance

The method above requires manual intervention to check whether the defacing was performed properly. There is also a way to check whether a given volume is the output of mideface in a an automatic fashion. mideface will embed the string "mideface-freesurfer" as the first 19 values in the corner of the volume. To check whether this string is present, run mideface --check vol.mgz It will print a 1 to standard out if the string is present and 0 if not. An output file can also be given as in mideface --check vol.mgz outfile.txt If the output file is present, the 0 or 1 will be printed to this file. This is more robust as sometimes things can be printed to standard out in an uncontrolled way.

This programmatic method only checks whether the volume is an output of mideface and cannot verify the quality of the actual defacing. This is intended to be an easy way to verify that mideface has at least been run when one has many volumes to make public. It can also be used by someone who has received the data to verify that the data have at least been run through mideface. The checker should be able to recognize midefaced data after arbitrary dimension permutations.

Applying to Other Images

It is often the case that multiple types of images are acquired on a given individual (eg, T2, FLAIR). To deface these images, one could simply run mideface on them (not thoroughly tested on T2 and FLAIR) or once could generate the face segmentation from one volume and apply it to another. To do this, first run mideface on the T1 image like

mideface --i t1.mgz --o t1.defaced.mgz --facemask t1.facemask.mgz

This will save out the face segmentation mentioned above. Then run

mideface --apply  t2.mgz t1.facemask.mgz t2-to-t1.registration.lta t2.defaced.mgz

where t2-to-t1.registration.lta is a registration matrix, which can be computed with

mri_coreg --mov t2.mgz --targ t1.mgz --reg t2-to-t1.registration.lta

If the images were acquired in the same session or are already in registration, then you can skip running mri_coreg and just specify regheader instead of t2-to-t1.registration.lta

Notes

1. Samseg is run in a mode to make it fast but less accurate, so don't use the output segmentation for studies unless you use the --no-samseg-fast flag. This will increase the run time to 30-45min.
2. You can replace face voxels with 0 instead of random values with --fill-zero
3. Include removal of the back of the head with --back-of-head
4. Include removal of the forehead with --forehead
5. Run faster with multiple CPUs with --threads N where N is the number of CPUs to use
6. If you specify and output folder (--odir), you do not need to specify output or facemask volumes; these will be stored as defaced.mgz and face.mask.mgz in the output folder.
7. Likewise, if you specify a folder with --o (eg, --o outputdir), then this is the same a using --odir outputdir.

8. You can specify output volumes to be nifti format (eg, t1.deface.nii or nii.gz). If you are allowing mideface to save the output in an output folder, you can use either --nii or --nii.gz to save the defaced volume in that format. If you have already produced mgz files, you can convert them to nii with mri_convert file.mgz file.nii (or nii.gz)

Disclaimers

1. Has not been tested on subjects less than 18 years