{"id":"07db09d0-cecd-4028-9065-aee38dbccfc1","arxiv_id":"1908.03260","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"Connectome fingerprints extracted from fMRI scans allow high-accuracy re-identification of subjects across datasets, plus prediction of the task performed and task performance.","lead":"Functional MRI scans carry stable, individual-specific brain-activity patterns that can be used to match the same person across separate, anonymized datasets. This paper demonstrates high-accuracy re-identification, along with prediction of the task being performed and the person's performance, raising privacy concerns for public neuroimaging data.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"HCP de-anonymization appears to evaluate within-cohort feature selection; need a fully independent-cohort test to establish generalizability.","rationale":"The reader's weakest assumption correctly identifies the same load-bearing concern: the HCP-derived Glasser atlas and same-cohort leverage-score feature selection can inflate reported de-anonymization accuracy. My independent review of the manuscript confirms this. Section 3.2.2 explicitly acknowledges the atlas was developed on the HCP dataset. Section 3.1.1 says the first dataset is L-R encoding and the target is R-L encoding 'of the same subjects,' so both matrices contain the 100 subjects whose identities are sought. Algorithm 1 and the principal features subspace method select deterministic top leverage scores from the first group matrix; those features are then used to match the same subjects in the second matrix. This creates a potential circularity because the feature selector has access to the identities (columns) of the very subjects it later matches. The ADHD-200 results are the best existing check and provide partial external validation, but they use a different atlas and pipeline, so they do not certify the HCP numbers. The noise-injection experiment in Section 3.3.5 is specifically weak because it does not test cross-site scanner differences. I therefore agree with the CONDITIONAL verdict, with the recommended concrete test being a fully out-of-cohort evaluation on an independent retest dataset. I do not see a basis for outright rejection: the fingerprinting phenomenon is independently supported in the literature, and the ADHD-200 experiment demonstrates that the general approach can work with a subject-wise split and a different atlas.","tokens_in":18260,"tokens_out":1615,"duration_ms":14421,"concrete_test":"Run the HCP pipeline on an independent fMRI dataset that was never used to derive the Glasser atlas or the leverage-score features; for example, Cambridge or Beijing resting-state scans from the same preprocessed Connectome Project with longitudinal or retest sessions. Compute signatures using the Glasser atlas only if it is re-estimated on a disjoint training cohort (otherwise use AAL2 or a generic atlas), select the top features from a training group whose subject identities are disjoint from the target group, and report the rank-1 identification accuracy with confidence intervals. If accuracy on the independent cohort falls substantially below 94%, the headline HCP result is inflated by within-cohort feature learning.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim of this paper is that functional-connectome signatures permit accurate re-identification across sessions, tasks, and datasets. The strongest evidence is the reported >94% resting-state accuracy on the HCP. However, Section 3.2.2 states that the Glasser atlas 'was developed on the same HCP dataset,' and Section 3.1.1 builds both the known and target group matrices from the same 100 HCP subjects. Leverage-score features are selected from the first group (the de-anonymized set containing the identities of the same subjects whose scans appear in the target matrix), so feature selection can encode cohort-specific or even subject-specific structure. If those selected features carry identity information that does not transfer to a new population, the measured accuracy is an upper bound on real-world attack performance. The ADHD-200 experiment partially addresses this because it uses a different atlas (AAL2), different acquisition, a separate subject cohort, and a train/test subject split for feature selection; but it does not test the specific HCP pipeline, and its corresponding accuracy estimates are reported without the same detail. The multi-site simulation in Section 3.3.5 merely adds noise to HCP and ADHD-200 data; it cannot simulate a genuinely different site protocol, scanner vendor, or population. Therefore, the paper's load-bearing assumption that the selected signature features generalize across cohorts remains unverified.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes and evaluates de-anonymization attacks on fMRI datasets. The authors construct functional connectomes from resting-state and task fMRI, vectorize them, and apply leverage-score sampling to select a compact set of discriminative features; matching between a de-anonymized and an anonymous dataset is then done by Pearson correlation in the reduced feature space. They also use t-SNE for task classification and SVM regression for predicting task performance. Experiments on 100 HCP subjects report >94% resting-state de-anonymization accuracy, task-identification accuracy near 100%, and ADHD-200 de-anonymization accuracy around 94–97%; a simulated multi-site experiment adds Gaussian noise and reports robustness. The paper concludes that anonymized fMRI data can be re-linked across sessions, tasks, and cohorts, and discusses the implications for privacy and possible defenses.","tokens_in":18525,"tokens_out":10141,"duration_ms":96594,"significance":"If the reported accuracies hold under independent-cohort evaluation, the paper demonstrates a practical privacy threat: functional-connectome signatures are stable enough to re-identify individuals across sessions, tasks, and datasets without any metadata, including for a pediatric ADHD population. The ADHD-200 experiment is a genuine external validation, since it uses a different atlas (AAL2), a different subject cohort, and a subject-wise train/test split for feature selection. The paper also makes the claims falsifiable by reporting point accuracies and some error bars. At the same time, the headline HCP result is obtained with feature selection performed on the same subjects whose identities are sought, using an atlas developed on the same dataset; this could make the HCP accuracy an optimistic upper bound. If a fully independent HCP evaluation and a real multi-site test confirm the numbers, the paper would be an important contribution to the security and neuroimaging literatures.","major_comments":[{"comment":"The HCP de-anonymization experiment selects the top leverage-score features from the first group matrix, which contains the same 100 subjects whose identities are sought in the target matrix; consequently, feature selection can exploit subject-specific structure and the reported >94% accuracy may not generalize to a population in which the attacker does not already have scans of the same individuals. Please add a HCP experiment with a subject-wise train/test split, or a fully independent cohort, in which feature selection is performed only on training subjects and accuracy is reported on held-out subjects.","section":"§3.1.2 and §3.3.1"},{"comment":"The use of the Glasser atlas, which was developed on the same HCP dataset, creates an additional circularity for the HCP experiments; the ADHD-200 experiment uses AAL2 and a different cohort, which mitigates the concern for the general method but does not validate the specific HCP atlas/pipeline. The statement in Section 2 that the selected features are 'robust across populations' is also stronger than the evidence, since the ADHD-200 experiment re-selects features from the ADHD-200 training set rather than testing transfer of the HCP-selected features.","section":"§3.2.2"},{"comment":"The multi-site robustness experiment only adds Gaussian noise to the time-series of the second session, which does not model scanner hardware differences, pulse sequences, or site-specific artifacts; moreover, the ADHD-200 dataset is itself a multi-site acquisition (Section 3.2), so the authors could evaluate the method between actual imaging sites rather than relying on the unsupported assumption in Section 4 that low-variance Gaussian noise 'reasonably simulate[s] a multi-site acquisition.'","section":"§3.3.5"},{"comment":"The task-prediction experiment runs t-SNE on all 100 subjects, including the images whose task labels are to be predicted, and then assigns each unknown image the label of its nearest neighbor in the embedding; this is a transductive procedure in which the test images shape the low-dimensional geometry, so the reported 99–100% accuracy is not an inductive prediction accuracy. The authors should either exclude the test subjects from the embedding or explicitly frame the result as a clustering/transductive classification accuracy.","section":"§3.3.2"},{"comment":"The number of retained leverage-score features t is never reported, and the matching rule is not fully specified (e.g., whether a one-to-one assignment is enforced or whether each target column is independently matched to its highest-correlation source column); without these details the experiments are not reproducible and the sensitivity of the reported accuracies to t and to the matching rule cannot be assessed.","section":"§3.1.2 and §3.3.1"}],"minor_comments":[{"comment":"The sentence 'The accuracy in de-anonymizing a dataset of resting-state functional MRIs in the HCP was found to be in excess of 94%, as shown in Figure 1' appears to reference the wrong figure; Figure 5 is the relevant accuracy heatmap.","section":"§3.3.1"},{"comment":"Figure 5 is presented without error bars or confidence intervals, so it is unclear whether the differences between tasks are statistically reliable.","section":"§3.3.1"},{"comment":"The t-SNE perplexity and optimization hyperparameters (learning rate, momentum, number of iterations) are not reported, making the task-prediction experiment difficult to reproduce.","section":"§3.3.2"},{"comment":"The ADHD-200 experiment does not state the number of subjects used in the train and test sets, the number of sessions, or how the reported 97.2±0.9% and 94.12±3.4% accuracies are computed; please provide the sample sizes and the exact decision rule.","section":"§3.3.4"},{"comment":"The abbreviation 'nRMSE' is not defined; the normalization denominator should be stated.","section":"§3.3.3"},{"comment":"The claim that the proposed methods 'have provide theoretical guarantees' is stronger than what the paper establishes, because Equations (2)–(4) are matrix-approximation bounds for randomized sampling, not bounds on de-anonymization accuracy, and the actual method uses deterministic top-t selection with no stated guarantee for the classification task.","section":"§1"}],"recommendation":"major_revision","confidential_remarks":"The paper overlaps heavily with the authors' earlier preprint (Ravindra et al. 2018); the present manuscript should state more explicitly what is new relative to that work. The editor may also want to verify that the HCP results can be reproduced with the missing experimental parameters."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First thing: the core result is real, but the HCP headline numbers are probably optimistic. What's genuinely new here is extending connectome fingerprinting into an attack model: same-subject matching across different tasks, predicting which task is being performed, and predicting task performance from the connectome. The ADHD-200 experiment gives independent support and is the sturdiest result in the paper. The HCP numbers should be treated as upper bounds, not as measured generalizable attack accuracy.\n\nThe paper does several things well. It clearly explains preprocessing, leverage-score feature selection, and t-SNE. The methods are cheap and scalable, which matters for an attack scenario. Cross-task matching is a real extension over Finn et al. and the authors' own prior leverage-score work. The ADHD result uses a different atlas (AAL2), a different acquisition protocol, children with ADHD, and a subject-wise feature-selection split, so it is not just another HCP experiment. That is real evidence that the signature transfers across populations.\n\nThe soft spots are concentrated in the HCP evaluation. Features are selected from a group matrix containing the very subjects whose identities are being recovered, and the Glasser atlas was developed on HCP. This can encode cohort- or subject-specific structure, so reported cross-session accuracy is an upper bound on what the method would do against a new cohort. A fully independent held-out cohort running the same HCP pipeline is needed. Minor but worth fixing: the number of retained leverage-score features t is never reported; several headline accuracies (Figure 5) lack error bars; and the multi-site simulation just adds Gaussian noise to same-site data, which cannot simulate a genuinely different scanner or protocol.\n\nI'd also flag an overstatement in the text: the paper says the methods 'provide theoretical guarantees.' What is actually cited are relative-error bounds for leverage-score matrix sketching. Those guarantee the sketch approximates the matrix, not that de-anonymization accuracy transfers. That should be reworded. The t-SNE task prediction is essentially transductive—nearest neighbors are computed after embedding all points, including the unknowns—so 99% is cluster separability, not a true held-out generalization result. Still, as a task-identification demo it is fine.\n\nWho benefits: privacy researchers, neuroimaging data-sharing policy people, and the connectome fingerprinting community. It deserves a serious referee and revision, not a desk reject. I'd ask for an out-of-cohort validation on HCP, error bars, and t. The citation pattern is fair; prior fingerprinting work is credited.","headline":"Real cross-task fMRI de-anonymization, but the HCP headline numbers are inflated by within-cohort feature selection; the ADHD-200 result is the sturdy part.","tokens_in":19056,"tokens_out":3031,"would_cite":true,"duration_ms":35535,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Functional brain scans carry an individual-specific connectome signature that lets an attacker re-identify anonymized subjects with over 94 percent accuracy.","keywords":["fMRI","de-anonymization","connectome fingerprinting","leverage-score sampling","t-SNE","privacy","neuroimaging","Human Connectome Project"],"falsifier":"Fix the feature set by computing top leverage-score edges from one cohort, then use only those edges to match scans of a disjoint cohort or a different scanner/site that were never involved in feature selection; if accuracy drops to chance the signature is not general. A second check: repeat the multi-site experiment using real scans from different institutions rather than Gaussian-corrupted copies.","tokens_in":18029,"feed_emoji":"🧠","tokens_out":10177,"duration_ms":100255,"temperature":0.7,"pith_summary":"The paper claims that functional MRI contains a stable, individual-specific signature, the pattern of co-activation between brain regions, that survives across scan sessions and across different tasks. Using leverage-score sampling to select a small set of discriminative region-pair correlations, the authors report de-anonymizing resting-state HCP scans with over 94% accuracy and identifying ADHD subjects across sessions at 97.2% accuracy. They further report inferring which of eight tasks a subject performed with near-perfect nearest-neighbor accuracy, and predicting task-performance scores within a few percent. If these results hold, removing metadata from publicly shared neuroimages is insufficient to protect privacy, because the images themselves re-identify the subject.","feed_headline":"Brain scans can re-identify anonymized subjects with over 94% accuracy","feed_subtitle":"A functional-connectivity signature matches the same person across tasks and scan sites","key_machinery":"The central object is the functional connectome, built by averaging BOLD time-series over atlas parcels and computing all pairwise Pearson correlations between the 360 regions of the HCP cortical atlas (or the AAL2 atlas for ADHD-200). Each connectome is vectorized into a feature vector, and the group matrix's left singular vectors yield leverage scores per edge; keeping only the top-scoring edges (from 64,620 down to under 100) defines the principal features subspace used for matching. Matching is done by Pearson correlation between the reduced feature vectors of two datasets, and t-SNE is used separately to project the full connectomes into two dimensions for task clustering. The machinery's role is to show that identity information is concentrated in a small, computable set of correlations, making the attack both accurate and cheap.","core_discovery":"The paper's central claim is that a functional connectome, the matrix of Pearson correlations among regional BOLD time-series, acts as a brain fingerprint that is more similar within a person than between people, even when the two scans come from different sessions, tasks, or acquisition protocols. The authors show that restricting the connectome to the top leverage-score features makes the fingerprint compact and highly discriminative: resting-state de-anonymization in the HCP exceeds 94% accuracy, language and relational task matching exceed 90%, and social task matching exceeds 80%, while motor and working-memory scans transfer poorly to other tasks. In the ADHD-200 cohort, using a different atlas, identification accuracy reaches 97.2% for subtypes and 94.12% for a mixed case/control set, and simulated multi-site noise degrades accuracy gracefully. The paper also reports that t-SNE embeddings of connectomes form clean task clusters, giving about 100% task-identification accuracy, and that the leverage-score features predict per-task performance with normalized root-mean-square error under 4%.","pith_inferences":["Editorial inference: the reported HCP accuracies may be optimistic because the atlas was developed on HCP data and the leverage-score features are selected from a group matrix containing the very subjects later matched; a fixed-feature, unseen-cohort evaluation would settle generalizability.","Editorial inference: if the signature really lives in fewer than 100 region-pair correlations, a targeted defense that perturbs only those edges could block re-identification while preserving most connectomic content, though downstream utility is unknown.","Editorial inference: the clean task clusters from t-SNE suggest task state dominates global connectome structure; separating task-discriminative from identity-discriminative components might yield more transferable fingerprints and better anonymization."],"forward_implications":["Removing names, demographic metadata, and facial features from fMRI does not anonymize the scan; the functional connectivity pattern itself is identifying.","A single de-anonymized resting-state scan can be used to re-identify the same person in datasets where they performed other tasks, so one leaked record compromises other studies.","The task a subject was performing is recoverable from the brain image, so anonymization must also protect behavioral context, not just identity.","Task performance can be estimated from the same signature, implying that inferences about cognitive ability can be drawn from supposedly anonymous scans.","Because accuracy survives moderate simulated acquisition noise across different sites, the threat applies to realistic multi-site and hospital-record settings."],"supporting_citations":[{"why":"Supplies the principal-features-subspace method of leverage-score sampling that selects the discriminative connectome edges.","marker":"[Ravindra et al., 2018]"},{"why":"Establishes that functional connectomes are individually identifying, the baseline result the attack builds on.","marker":"[Finn et al., 2017]"},{"why":"Provides the 360-region multimodal parcellation of human cortex used to build HCP connectomes.","marker":"[Glasser et al., 2016]"},{"why":"Defines the minimal preprocessing pipeline applied to HCP images before connectome construction.","marker":"[Glasser et al., 2013]"},{"why":"Describes the HCP resting-state acquisition protocol whose L-R and R-L scans are matched in the main experiment.","marker":"[Smith et al., 2013]"},{"why":"Supplies the HCP task-fMRI protocol and the performance metrics predicted in the task-efficiency experiment.","marker":"[Barch et al., 2013]"},{"why":"Provides the AAL2 atlas used for the ADHD-200 connectomes.","marker":"[Tzourio-Mazoyer et al., 2002]"},{"why":"Supplies the preprocessed ADHD-200 repository used to test identification in a pediatric clinical cohort.","marker":"[Bellec et al., 2017]"},{"why":"Provides t-SNE, the dimensionality-reduction method used for task clustering and prediction.","marker":"[van Der Maaten and Hinton, 2008]"},{"why":"Gives the relative-error leverage-score sampling bound that justifies selecting top rows of the group matrix.","marker":"[Drineas et al., 2008]"}],"fun_headline_variants":["Brain's unique fingerprint defeats data anonymization","De-anonymizing brain scans: 94%+ success in HCP","Brain connectome reveals identity, task, even performance","Brain scans expose identity and task with 94% accuracy"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack's results stand or fall on the assumption that the discriminative features and brain parcellation are intrinsic to individuals rather than tuned to the specific population being de-anonymized; in the HCP experiments the atlas was built on the same dataset and the features were chosen from a matrix containing the very subjects later matched.","fun_headline_variants_meta":{"raw":{"variants":["Brain's unique fingerprint defeats data anonymization","De-anonymizing brain scans: 94%+ success in HCP","Brain connectome reveals identity, task, even performance","Brain scans expose identity and task with 94% accuracy"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000198,"raw_usage":{"total_tokens":1365,"prompt_tokens":937,"completion_tokens":428,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":553,"completion_tokens_details":{"reasoning_tokens":361}},"tokens_in":553,"tokens_out":428,"duration_ms":4575,"temperature":1.0,"reasoning_tokens":361,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T14:20:02.963736+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Fix the feature set by computing top leverage-score edges from one cohort, then use only those edges to match scans of a disjoint cohort or a different scanner/site that were never involved in feature selection; if accuracy drops to chance the signature is not general. A second check: repeat the multi-site experiment using real scans from different institutions rather than Gaussian-corrupted copies.","supporting_citations":[{"cited_title":"Constructing Compact Brain Connectomes for Individual Fingerprinting","cited_arxiv_id":"1805.08649","evidence_quote":"Supplies the principal-features-subspace method of leverage-score sampling that selects the discriminative connectome edges."},{"cited_title":"Margulies, and R","cited_arxiv_id":null,"evidence_quote":"Supplies the preprocessed ADHD-200 repository used to test identification in a pediatric clinical cohort."},{"cited_title":"Visualizing data using t-sne","cited_arxiv_id":null,"evidence_quote":"Provides t-SNE, the dimensionality-reduction method used for task clustering and prediction."}],"review_version":1}