Pith. sign in

REVIEW 3 major objections 4 minor 27 references

RetinaGuard masks the retinal-age signal in fundus images while keeping images diagnostically usable.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-05 00:01 UTC pith:5DPDLNAU

load-bearing objection A genuinely new privacy problem and a plausible framework, but the 'universal defense' claim is untested and the tables disagree; needs out-of-pool targets and a cleanup. the 3 major comments →

arxiv 2509.06142 v2 pith:5DPDLNAU submitted 2025-09-07 cs.CV

RetinaGuard: Obfuscating Retinal Age in Fundus Images for Biometric Privacy Preserving

Zhengquan Luo , Chi Liu , Dongfu Xiao , Zhen Yu , Yueye Wang , Tianqing Zhu This is my paper
classification cs.CV
keywords retinal agebiometric privacyfundus imageadversarial maskknowledge distillationprivacy-utility trade-offmedical image privacyage obfuscation
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper proposes a new privacy problem: medical images carry implicit biomarkers — retinal age being a proven one — and a snooper can extract them from a fundus photo. RetinaGuard is a framework that edits the image's learned features so that age predictors fail, while keeping the image visually and diagnostically close to the original. On two test sets it raises the average age-prediction error from about 2.3 to 4.9 years and from 1.4 to 5.9 years, with SSIM above 0.92 and disease-classification accuracy roughly unchanged. If the central claim holds, patients and institutions could share fundus images with far less risk of unauthorized age inference.

Core claim

The central claim is that retinal age can be obfuscated at the feature level rather than the pixel level. RetinaGuard encodes the input image into a latent representation, generates an adversarial mask from an input-dependent noise vector, multiplies the mask into the latent features, and decodes the result back into an image. The training loss pushes the masked image's age features away from the original's while keeping pixel-level similarity and disease-feature similarity high. To work against black-box age predictors, the paper builds a single surrogate age encoder by distilling knowledge from four pretrained encoders (CNN and ViT, regression and classification) onto a retinal foundation

What carries the argument

The load-bearing mechanism is a feature-level adversarial mask: an encoder maps the fundus image to latent features, a mask generator converts input-specific adversarial noise into a multiplicative mask, and a decoder reconstructs the image. The mask is trained with a joint loss with three terms — cosine similarity of age features (to be minimized), mean squared error between images (to be minimized), and KL divergence of disease-encoder features (to be minimized). The other mechanism is multiple-to-one knowledge distillation: a pretrained retinal foundation model with a linear probing head serves as the surrogate age encoder A*, trained by contrastively aligning its output with fused featur

Load-bearing premise

The whole defense rests on the assumption that the distilled surrogate age encoder covers the feature space of any unseen black-box age predictor; if an attacker's model uses age features that the surrogate pool did not capture, the mask will not fool it.

What would settle it

Apply RetinaGuard to a set of fundus images, then query an age predictor that was never included in the four-model pool — for instance, a model trained on UK Biobank data with a different architecture or a newer foundation model. If the MAE of that held-out predictor stays close to its raw-image value (e.g., does not rise by at least the 2-3 year margin the paper reports), the universal-defense claim is false for that model.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • If the central claim holds, a practical workflow emerges: run RetinaGuard on fundus images before any third-party disclosure, and retinal-age inference is suppressed without destroying the clinical content.
  • The adjustable intensity scale gives users a direct privacy-utility dial; at delta=100 the paper reports a favorable balance across both datasets.
  • Disease-relevant structures, including vessels and lesions, survive the obfuscation; on ODIR, DR accuracy even matches or slightly exceeds the raw-image level.
  • Because the components are not specific to age, the same architecture can be retargeted to other image-derived biomarkers such as sex, BMI, or smoking status.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The universality claim is only demonstrated on the four models that also define the surrogate pool; a stricter test would hold out an age predictor built from a different architecture or dataset and check whether the mask still raises MAE.
  • The reported DR-ACC improvement hints that age-feature suppression may also reduce demographic bias in disease classifiers; if reproduced on larger cohorts, RetinaGuard could double as a fairness intervention.
  • The noise-intensity results suggest that optimal delta depends on image resolution and dataset; a production version would likely calibrate delta per input, which the paper does not specify.
  • The framework's loss can in principle generalize to several biomarkers at once, but the paper does not analyze whether masking age also masks or unmasks correlated attributes; a snooper could still infer sex or smoking status from the obfuscated image.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper introduces RetinaGuard, a privacy-enhancing method for fundus images that obscures retinal age while preserving visual quality and disease-diagnostic utility. The method uses a feature-level adversarial mask generated from a noise input and applied to the latent representation of an encoder-decoder. A surrogate age encoder A* is trained by knowledge distillation from a pool of four pre-trained age models (ResNet-cls, ResNet-reg, ViT-cls, ViT-reg) using RETFound as a backbone, and the mask is optimized to minimize cosine similarity between age features of the raw and obfuscated images while maintaining pixel-level and disease-feature consistency. Experiments on ODIR and RAE report increased age-prediction MAE and decreased R2, with SSIM values around 0.92-0.96 and roughly unchanged disease classification accuracy. The paper claims a universal defense against arbitrary black-box age prediction models and suggests the framework can be extended to other medical image biomarkers.

Significance. If the claims were fully supported, RetinaGuard would address a real and underappreciated privacy risk in medical imaging: the inference of biometric biomarkers such as retinal age from fundus images. The problem formulation in Section III-A is a useful contribution, and the idea of combining a feature-level adversarial mask with knowledge distillation from multiple surrogate encoders is original. The paper also includes a human-perception study and multiple utility metrics (SSIM, DR/GON accuracy, vessel IoU), which are appropriate for evaluating the privacy-utility trade-off. However, the central evidence for the 'universal defense' claim is missing: every evaluated age model is one of the four models used to train the surrogate A*, so the reported obfuscation numbers may only reflect fitting to known models. In addition, internal inconsistencies between Tables IV and V make the exact quantitative claims unreliable. The strengths do not outweigh these load-bearing gaps without revision.

major comments (3)
  1. [§III-B, Eq. (2)–(3), and Table III] The core claim of a universal defense against arbitrary black-box age models is not tested. A* is distilled from the pool {eA_i} = {ResNet-cls, ResNet-reg, ViT-cls, ViT-reg} using Eq. (3), and the mask is optimized to reduce the cosine similarity between age features of the raw and obfuscated images against A* in Eq. (2). The evaluation in Table III then reports MAE/R2 on exactly the same four models. High obfuscation on these models is expected if the mask only fits the distilled feature space; it does not demonstrate transfer to an unseen age predictor. Please add a held-out age model (different architecture and/or training data) not used in distillation and report its MAE/R2. Without this, the 'universal defense' claim is unsupported.
  2. [§IV-B, Tables IV and V] The two tables report incompatible values for the same four-model RetinaGuard configuration. Table IV lists ODIR SSIM=0.964, AMAE=4.902, IoU=0.874 and RAE SSIM=0.929, AMAE=5.900, IoU=0.885; Table V lists ODIR SSIM=0.950, AMAE=6.064, IoU=0.874 and RAE SSIM=0.944, AMAE=8.490, IoU=0.885. These discrepancies change the reported effect size and the privacy-utility trade-off analysis. Please reconcile and report the exact metrics for the configuration used.
  3. [§III-B and §IV-A] The mask scaler is defined as δ = a·z_hat with a∈(0,1], but the experimental setup states 'The default values of a, λ, and φ are 0, 0.4, and 0.4 for training.' Setting a=0 would zero out the mask and cannot produce the obfuscation shown. This is either a typo or an undefined configuration; please state the actual a/δ used to generate the reported results.
minor comments (4)
  1. [Abstract] The final sentence is duplicated: 'RetinaGuard is also flexible for extension to other medical image derived biomarkers' appears twice.
  2. [Table III] The RAE raw ViT-reg row reports MAE=0.01 and R2=1.00, which is suspiciously perfect and may indicate a data/processing issue or an annotation typo. Please verify and explain.
  3. [§IV-A and Figure 4] The relationship between the scaler δ, the user factor a, and the z-score normalized noise z_hat is unclear. The text refers to 'noise intensity δ' with values 1, 50, 100, etc., but the earlier definition ties δ to a·z_hat. Please clarify how δ is set in the experiments.
  4. [§IV-B, Human Perception] The subjective evaluation uses only 20 real and 20 synthetic images from three ophthalmologists. This is a very small sample, and no confidence intervals or inter-rater agreement statistics are provided. The conclusion of 'near-chance-level discrimination' should be stated more cautiously.

Circularity Check

1 steps flagged

Universal-defense claim is supported only by in-pool evaluation: A* is distilled from the same four age models later used as targets.

specific steps
  1. fitted input called prediction [Section III-B (Eq. 3), Section IV-A, Table III]
    "The distillation is also performed at the feature level using contrastive learning. Let { eAi} be a pool of pre-trained age encoders to be distilled... Then we optimize the cosine similarity between efage and f∗age... We employ four public age models as targets: two classification and two regression models based on ResNet-50 and ViT-B-16, denoted as ResNet-cls, ResNet-reg, ViT-cls, and ViT-reg."

    The surrogate A* is trained to match fused features from exactly the four models {ResNet-cls, ResNet-reg, ViT-cls, ViT-reg} (Eq. 3), and the adversarial mask is optimized to minimize cosine similarity between A*(I_in) and A*(I_ob) (Eq. 2). The evaluation of 'age obfuscation' (Table III) then reports MAE/R2 against exactly those same four models. Thus the reported privacy gains are the expected result of fitting a mask to a feature space distilled from the test targets; they are not evidence that the mask transfers to arbitrary unseen black-box age predictors. No held-out age model is evaluated anywhere, so the universal-defense claim rests on construction rather than out-of-sample prediction.

full rationale

The only load-bearing circularity is in the evaluation of the universal black-box claim. RetinaGuard's surrogate A* is trained by feature-level distillation (Eq. 3) from a pool of four age encoders {ResNet-cls, ResNet-reg, ViT-cls, ViT-reg}. The mask is optimized against A* (Eq. 2). The paper then reports obfuscation MAE/R2 against exactly those four encoders (Table III) as evidence of privacy protection, and claims a universal defense. Since A* is a learned function of the four encoders, decreasing cosine similarity to A* should transfer to those four encoders by construction; the numbers are an in-sample fit, not a prediction for unseen black-box models. No age model outside the pool is evaluated, so the central 'arbitrary unknown age prediction models' claim is not independently supported. I do not count the use of RETFound or the disease encoder as circular: those are external and the disease evaluation is on out-of-distribution data. Separately, I note two non-circular internal inconsistencies (the default a=0 contradicts the definition a∈(0,1], and Table IV vs Table V report different AMAE/SSIM for RetinaGuard) that cast doubt on exact magnitudes but do not change the circularity verdict. Score 6 because the central transfer claim partially reduces to the distillation set.

Axiom & Free-Parameter Ledger

5 free parameters · 4 axioms · 0 invented entities

The central claim rests on several hand-chosen weights, an unspecified PGD budget, a test-set-filtering criterion, and the untested transferability of the distilled surrogate. The most consequential is the reliance on the same four models in both distillation and evaluation, which makes the reported obfuscation numbers partly a fitted outcome.

free parameters (5)
  • lambda (privacy loss weight) = 0.4
    Set by hand as default; no sensitivity analysis is reported, and results may depend on it.
  • phi (visual quality loss weight) = 0.4
    Set by hand as default; same as lambda.
  • mask intensity factor a / delta = default a=0 in Section IV-A, but experiments use delta=100
    The inference formula delta=a*z with a=0 would produce no mask, contradicting the reported results; the noise intensity is swept on the test sets and the optimum is selected for headline numbers.
  • PGD perturbation budget for crafting z = unspecified
    The adversarial noise z is generated with PGD in Section IV-A, but the perturbation magnitude and iteration count are not given; the resulting z strongly affects the mask generator input.
  • inclusion criteria age MAE threshold = 3.0
    Test sets are restricted to images where raw age prediction is accurate (MAE<=3.0), which affects the baseline and the obfuscation gain.
axioms (4)
  • domain assumption A surrogate model trained on a set of target models transfers to unseen black-box models
    Invoked in Section III-B to justify the universal defense claim; no unseen-model evaluation is provided.
  • domain assumption Retinal age is a valid systemic health biomarker (cites [8]-[11])
    Background premise motivating the threat model; not established in this paper.
  • ad hoc to paper The disease encoder S outputs distributions so that KL-divergence in Eq (2) is meaningful
    S is a ResNet18 trained on DR/GON labels; no softmax or probabilistic output is specified, making KL(S(Iin)||S(Iob)) ill-defined.
  • domain assumption Cosine similarity between age features is a sufficient proxy for age-model prediction error
    The privacy loss minimizes the cosine similarity against A*, but no evidence links this metric to the MAE/R2 of arbitrary age predictors.

pith-pipeline@v1.3.0-alltime-deepseek · 10890 in / 14513 out tokens · 133385 ms · 2026-08-05T00:01:35.017077+00:00 · methodology

0 comments
Cite this review

Pith. "Pith review of RetinaGuard: Obfuscating Retinal Age in Fundus Images for Biometric Privacy Preserving." pith.science (2026). https://pith.science/paper/5DPDLNAU

@misc{pith2026250906142,
  author       = {Pith},
  title        = {Pith review of: RetinaGuard: Obfuscating Retinal Age in Fundus Images for Biometric Privacy Preserving},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5DPDLNAU}},
  note         = {Machine review of arXiv:2509.06142}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

The integration of AI with medical images enables the extraction of implicit image-derived biomarkers for a precise health assessment. Recently, retinal age, a biomarker predicted from fundus images, is a proven predictor of systemic disease risks, behavioral patterns, aging trajectory and even mortality. However, the capability to infer such sensitive biometric data raises significant privacy risks, where unauthorized use of fundus images could lead to bioinformation leakage, breaching individual privacy. In response, we formulate a new research problem of biometric privacy associated with medical images and propose RetinaGuard, a novel privacy-enhancing framework that employs a feature-level generative adversarial masking mechanism to obscure retinal age while preserving image visual quality and disease diagnostic utility. The framework further utilizes a novel multiple-to-one knowledge distillation strategy incorporating a retinal foundation model and diverse surrogate age encoders to enable a universal defense against black-box age prediction models. Comprehensive evaluations confirm that RetinaGuard successfully obfuscates retinal age prediction with minimal impact on image quality and pathological feature representation. RetinaGuard is also flexible for extension to other medical image derived biomarkers. RetinaGuard is also flexible for extension to other medical image biomarkers.

Figures

Figures reproduced from arXiv: 2509.06142 by Chi Liu, Dongfu Xiao, Tianqing Zhu, Yueye Wang, Zhengquan Luo, Zhen Yu.

Figure 1
Figure 1. Figure 1: (A) The overview of RetinaGuard, which balances the trade-off between age privacy and diagnostic efficacy. (B) The knowledge distillation strategy [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Synthetic fundus images generated by RetinaGuard. (a) Normal fundus [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Comparative analysis of image quality degradation across age obfuscation methods. Each column represents a different method: (a) Original image, [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Influence of noise intensity (δ) on privacy preservation (AMAE) and diagnostic utility (SSIM) in the ODIR and RAE datasets. (a) Reference (b) δ = 1 (c) δ = 50 (d) δ = 100 (e) δ = 150 (f) δ = 200 (g) δ = 250 [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Example fundus images with varying noise intensities ( [PITH_FULL_IMAGE:figures/full_fig_p007_5.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

27 extracted references · 24 canonical work pages

  1. [1]

    Predicting de- mographics from meibography using deep learning,

    J. Wang, A. D. Graham, S. X. Yu, and M. C. Lin, “Predicting de- mographics from meibography using deep learning,”Scientific Reports, vol. 12, no. 1, p. 15701, 2022

    work page 2022

  2. [2]

    Predicting patient demographics from chest radiographs with deep learning,

    J. Adleberg, A. Wardeh, F. X. Doo, B. Marinelli, T. S. Cook, D. S. Mendelson, and A. Kagen, “Predicting patient demographics from chest radiographs with deep learning,”Journal of the American College of Radiology, vol. 19, no. 10, pp. 1151–1161, 2022

    work page 2022

  3. [3]

    Confounders mediate ai prediction of demographics in medical imaging,

    G. Duffy, S. L. Clarke, M. Christensen, B. He, N. Yuan, S. Cheng, and D. Ouyang, “Confounders mediate ai prediction of demographics in medical imaging,”NPJ digital medicine, vol. 5, no. 1, p. 188, 2022

    work page 2022

  4. [4]

    Biological age predictors,

    J. Jylh ¨av¨a, N. L. Pedersen, and S. H ¨agg, “Biological age predictors,” EBioMedicine, vol. 21, pp. 29–36, 2017

    work page 2017

  5. [5]

    Measuring biological age using omics data,

    J. Rutledge, H. Oh, and T. Wyss-Coray, “Measuring biological age using omics data,”Nature Reviews Genetics, vol. 23, no. 12, pp. 715–727, 2022

    work page 2022

  6. [6]

    Machine learning for brain age prediction: Introduction to methods and clinical applications,

    L. Baecker, R. Garcia-Dias, S. Vieira, C. Scarpazza, and A. Mechelli, “Machine learning for brain age prediction: Introduction to methods and clinical applications,”EBioMedicine, vol. 72, 2021

    work page 2021

  7. [7]

    Privacy intelligence: A survey on image privacy in online social networks,

    C. Liu, T. Zhu, J. Zhang, and W. Zhou, “Privacy intelligence: A survey on image privacy in online social networks,”ACM Computing Surveys, vol. 55, no. 8, pp. 1–35, 2022

    work page 2022

  8. [8]

    Towards regulatory generative ai in ophthalmology healthcare: a security and privacy per- spective,

    Y . Wang, C. Liu, K. Zhou, T. Zhu, and X. Han, “Towards regulatory generative ai in ophthalmology healthcare: a security and privacy per- spective,”British Journal of Ophthalmology, vol. 108, no. 10, pp. 1349– 1353, 2024

    work page 2024

  9. [9]

    Retinal age gap as a predictive biomarker for mortality risk,

    Z. Zhu, D. Shi, P. Guankai, Z. Tan, X. Shang, W. Hu, H. Liao, X. Zhang, Y . Huang, H. Yu,et al., “Retinal age gap as a predictive biomarker for mortality risk,”British Journal of Ophthalmology, vol. 107, no. 4, pp. 547–554, 2023

    work page 2023

  10. [10]

    Retinal age estimation with temporal fundus images enhanced progres- sive label distribution learning,

    Z. Yu, R. Chen, P. Gui, L. Ju, X. Shang, Z. Zhu, M. He, and Z. Ge, “Retinal age estimation with temporal fundus images enhanced progres- sive label distribution learning,” inInternational Conference on Medical Image Computing and Computer-Assisted Intervention, pp. 629–638, Springer, 2023

    work page 2023

  11. [11]

    Biological age estimated from retinal imaging: a novel biomarker of ag- ing,

    C. Liu, W. Wang, Z. Li, Y . Jiang, X. Han, J. Ha, W. Meng, and M. He, “Biological age estimated from retinal imaging: a novel biomarker of ag- ing,” inMedical Image Computing and Computer Assisted Intervention– MICCAI 2019: 22nd International Conference, Shenzhen, China, Octo- ber 13–17, 2019, Proceedings, Part I 22, pp. 138–146, Springer, 2019

    work page 2019

  12. [12]

    A question of trust for AI research in medicine,

    “A question of trust for AI research in medicine,” vol. 6, no. 7, pp. 739– 739

    work page

  13. [13]

    The eu general data protection reg- ulation (gdpr),

    P. V oigt and A. V on dem Bussche, “The eu general data protection reg- ulation (gdpr),”A practical guide, 1st ed., Cham: Springer International Publishing, vol. 10, no. 3152676, pp. 10–5555, 2017

    work page 2017

  14. [14]

    Adversarial attacks and defenses in deep learning: From a perspective of cyberse- curity,

    S. Zhou, C. Liu, D. Ye, T. Zhu, W. Zhou, and P. S. Yu, “Adversarial attacks and defenses in deep learning: From a perspective of cyberse- curity,”ACM Computing Surveys, vol. 55, no. 8, pp. 1–39, 2022

    work page 2022

  15. [15]

    A digital mask to safeguard patient privacy,

    Y . Yang, J. Lyu, R. Wang, Q. Wen, L. Zhao, W. Chen, S. Bi, J. Meng, K. Mao, Y . Xiao,et al., “A digital mask to safeguard patient privacy,” Nature medicine, vol. 28, no. 9, pp. 1883–1892, 2022

    work page 2022

  16. [16]

    Federated learning with heterogeneous client expectations: A game theory approach,

    S. Shen, C. Liu, and T. J. Lim, “Federated learning with heterogeneous client expectations: A game theory approach,”IEEE Transactions on Knowledge and Data Engineering, 2024

    work page 2024

  17. [17]

    De-identification and obfuscation of gender attributes from retinal scans,

    C. Wu, X. Yang, E. G. Gilkes, H. Cui, J. Choi, N. Sun, Z. Liao, B. Fan, M. Santillana, L. Celi,et al., “De-identification and obfuscation of gender attributes from retinal scans,” inWorkshop on Clinical Image- Based Procedures, pp. 91–101, Springer, 2023

    work page 2023

  18. [18]

    Implicit neural obfuscation for privacy preserving medical image sharing,

    M. P. Heinrich and L. Hansen, “Implicit neural obfuscation for privacy preserving medical image sharing,” inMedical Imaging with Deep Learning, pp. 596–609, PMLR, 2024

    work page 2024

  19. [19]

    Unobtrusive biometric data de-identification of fundus images using latent space disentanglement,

    Z. Zhao, S. Faghihroohi, J. Yang, K. Huang, N. Navab, M. Maier, and M. A. Nasseri, “Unobtrusive biometric data de-identification of fundus images using latent space disentanglement,”Biomedical Optics Express, vol. 14, no. 10, pp. 5466–5483, 2023

    work page 2023

  20. [20]

    Practical black-box attacks against machine learning,

    N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical black-box attacks against machine learning,” in Proceedings of the 2017 ACM on Asia conference on computer and communications security, pp. 506–519, 2017

    2017

  21. [21]

    A foundation model for generalizable disease detection from retinal images,

    Y . Zhou, M. A. Chia, S. K. Wagner, M. S. Ayhan, D. J. Williamson, R. R. Struyven, T. Liu, M. Xu, M. G. Lozano, P. Woodward-Court, et al., “A foundation model for generalizable disease detection from retinal images,”Nature, vol. 622, no. 7981, pp. 156–163, 2023

    2023

  22. [22]

    The uk biobank resource with deep phenotyping and genomic data,

    C. Bycroft, C. Freeman, D. Petkova, G. Band, L. T. Elliott, K. Sharp, A. Motyer, D. Vukcevic, O. Delaneau, J. O’Connell,et al., “The uk biobank resource with deep phenotyping and genomic data,”Nature, vol. 562, no. 7726, pp. 203–209, 2018

    work page 2018

  23. [23]

    Road extraction by deep residual u-net,

    Z. Zhang, Q. Liu, and Y . Wang, “Road extraction by deep residual u-net,”IEEE Geoscience and Remote Sensing Letters, vol. 15, no. 5, pp. 749–753, 2018

    work page 2018

  24. [24]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” inInternational Conference on Learning Representations, 2018

    2018

  25. [25]

    Full-resolution network and dual-threshold iteration for retinal vessel and coronary angiograph segmentation,

    W. Liu, H. Yang, T. Tian, Z. Cao, X. Pan, W. Xu, Y . Jin, and F. Gao, “Full-resolution network and dual-threshold iteration for retinal vessel and coronary angiograph segmentation,”IEEE journal of biomedical and health informatics, vol. 26, no. 9, pp. 4623–4634, 2022

    work page 2022

  26. [26]

    Differential privacy for image publication,

    L. Fan, “Differential privacy for image publication,” inTheory and Practice of Differential Privacy (TPDP) Workshop, vol. 1, p. 6, 2019

    work page 2019

  27. [27]

    The limits of fair medical imaging ai in real-world generalization,

    Y . Yang, H. Zhang, J. W. Gichoya, D. Katabi, and M. Ghassemi, “The limits of fair medical imaging ai in real-world generalization,”Nature Medicine, vol. 30, no. 10, pp. 2838–2848, 2024

    work page 2024