Pith. sign in

REVIEW 3 major objections 6 minor 21 references

Filtering synthetic CT slices reduces memorization and membership leakage, but patient re-identification attack remains near-perfect across all filtered variants.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review

2026-08-01 09:38 UTC pith:NMF43HKD

load-bearing objection Useful, honest challenge write-up; the Attack 3 negative result is solid, but the 'geometric filtering' effect is confounded with coreset diversity and partly circular. the 3 major comments →

arxiv 2607.20692 v1 pith:NMF43HKD submitted 2026-07-22 cs.CV cs.AI

DS@GT ARC at ImageCLEFmed GANs 2026: Geometric Filtering for Privacy-Preserving CT Slice Generation

Eric Regina , Richard Arnaud , Samir Hadi Cisneros This is my paper
classification cs.CV cs.AI
keywords privacy-preserving medical imagingCT slice generationflow matchinggeometric filteringmembership inferencepatient re-identificationsubset selectionsynthetic data
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper argues that privacy in synthetic medical imaging is not achieved merely by making generated images visually dissimilar from training data. Using a flow-matching generator followed by post-generation geometric filtering that scores candidates by distance to training images in learned latent spaces, the authors show that nearest-neighbor memorization and membership-inference leakage drop substantially. However, a patient re-identification attack remains near-perfect across all variants, indicating that deep anatomical identity persists. This matters because it redefines the target for privacy-preserving generation: stopping image copying is necessary but not sufficient.

Core claim

On its own terms, the central claim is that geometric filtering in learned latent spaces can reduce certain privacy leaks but cannot remove patient identity. The best model, a 100-epoch flow-matching run, reaches a Privacy Preservation Score (PPS) of 0.549 with an FID of 0.3290; the best filtered variant improves FID to 0.2639 while retaining a PPS of 0.492. Filtering lowers Attack 1 (nearest-neighbor memorization) leakage to as low as 0.0804 and reduces Attack 2 (membership inference), but Attack 3 (patient re-identification) rank-1 coverage stays between 0.97 and 1.00 for every submission. The authors conclude that preventing direct similarity to training images does not eliminate deeper a

What carries the argument

The central object is the 'Supervisor' pipeline: generate a large pool of candidate slices (20,000), embed both candidates and the training reference set with autoencoders trained on the same image domain (variants: spatial, contrastive, and Riemannian metric embeddings), score each candidate by its distance to the nearest training sample (cosine similarity, geodesic distance over a k-nearest-neighbor graph, or a local Riemannian anisotropic distance), and finally select 5,000 slices using determinantal point processes or Stein kernel thinning. The load-bearing idea is that distance in a learned latent space acts as a privacy proxy.

Load-bearing premise

The paper treats 'far from the nearest training image in a learned latent space' as equivalent to 'private', yet its own patient re-identification attack shows this monotonicity fails; the filter optimizes exactly the distance that the defeated attacks measure, so part of the observed improvement may be measuring the wrong thing.

What would settle it

A concrete test: run the same Supervisor pipeline but evaluate Attack 3 on a cohort of patients with similar anatomy (e.g., matching lung volume or sex); if rank-1 coverage falls below 0.9, the claim that geometric filtering cannot reduce re-identification would be overturned. Alternatively, measure Attack 3 leakage for a synthetic set selected randomly rather than by latent distance — if random selection performs equally, then filtering is not the operative mechanism.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Early stopping reduces parameter-level memorization more than post-hoc filtering: the 100-epoch model outperforms the 300-epoch model on Attacks 1, 2, and 4.
  • Geometric filtering is effective at suppressing verbatim copying and membership-inference bias, with the best Attack 1 score reaching 0.0804.
  • Patient re-identification leakage is not reduced by these methods, staying above 0.97 even for the most aggressive filters.
  • The privacy–utility frontier for this pipeline is roughly PPS 0.549 at FID 0.3290, with FID as low as 0.2639 at PPS 0.492.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The pipeline's core assumption — that distance from the training set in latent space equals privacy — is contradicted by the paper's own Attack 3 results, suggesting that the selection metric should be replaced or supplemented with identity-specific measures rather than similarity-based ones.
  • A testable extension: apply the same filtering to images from a generator trained with differential privacy; if Attack 3 leakage drops substantially, the residual identity leakage lies in the generative model's distribution rather than in the selection step.
  • The near-total Attack 3 coverage suggests anatomical identity features are broadly distributed across the cohort, implying future work should quantify identity through concrete anatomical signatures (e.g., bone density ratios, organ topology, or vascular geometry) and make them differentiable objectives.
  • This memorization-versus-identity distinction may extend beyond CT: any generative model on sensitive structured data (e.g., facial images) could pass nearest-neighbor audits while still enabling re-identification, so the paper's caution is likely general.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. This paper reports a submission to the ImageCLEFmed GANs 2026 privacy task. The authors train an Optimal Transport Conditional Flow Matching UNet on lung CT slices and then filter a pool of 20,000 generated candidates using 'Supervisor' gates (spatial autoencoder cosine distance, contrastive-geodesic distance, Riemannian anti-memory distance) combined with DPP/SKT coreset selection. Official results in Table 1 show fm-unet-100 achieves PPS 0.549/FID 0.3290 and the spatial-DPP variant achieves FID 0.2639/PPS 0.492. The authors conclude that geometric filtering generally reduces nearest-neighbor memorization (Attack 1) and membership inference (Attack 2) but that patient re-identification (Attack 3) remains near maximal leakage, arguing that distance-based filtering does not remove anatomical identity.

Significance. If the causal attribution held, this would be a useful practical recipe: post-hoc selection can improve the realism/privacy frontier, and the negative Attack 3 result is an important caution. The manuscript is honest about the uncontrolled 100-vs-300 epoch comparison, provides source code, and reports official numbers. Its main significance is currently limited by the confounding described below; the pipeline is promising but the evidence does not yet isolate geometric privacy scoring from coreset diversity.

major comments (3)
  1. [Table 1, §3.4] The central claim that geometric filtering reduces Attack 1/2 leakage is confounded. All sv-* variants combine privacy scoring with DPP/SKT coreset selection; the unfiltered fm-unet-100 baseline includes neither. Because DPP/SKT explicitly diversify the selected subset in an embedding, they can move selected images away from dense training regions regardless of the quality scores. No control using DPP/SKT with uniform quality weights or a random 5,000-image subset from the 20,000-candidate pool is reported. The observed reductions therefore cannot be causally attributed to geometric privacy scores. Add such a control, or revise the contribution to describe the combined pipeline only.
  2. [§3.4 vs §4.1] The spatial gate's score is q_spatial(g)=max(0,1-s_max(g)), i.e., 1 minus cosine similarity to the nearest training latent; Attack 1 is a nearest-neighbor distance audit. Filtering on q_spatial directly removes candidates close to training images in a learned latent space, so the Attack 1 reduction is partly by construction. Since the official attack features are not disclosed, it is unclear whether this transfers. Discuss this overlap explicitly; if possible, report Attack 1/2 for a selection that does not use distance-to-training scores.
  3. [Table 1] All results are single runs without error bars, confidence intervals, or repeated selection. Some of the supporting differences are small (Attack 1 0.0901 vs 0.0835; Attack 2 0.3797 vs 0.3519), and one 100-epoch filtered variant (sv-riemannian-wdpp-100) has Attack 2 slightly higher than the unfiltered baseline. Please quantify stability (e.g., repeated random subsets or bootstraps) or explicitly label the comparisons as exploratory; otherwise 'generally reduced' is not supported statistically.
minor comments (6)
  1. [§3.5] The internal near-duplicate thresholds are described only as 'high/low percentile' of train self-neighbor statistics; exact percentiles and neighborhood sizes are missing, so Appendix Table 2 is not reproducible.
  2. [§5.1] The 300-epoch model is called fm-unet-base in the text but fm-unet-300 in Table 1; Appendix uses inconsistent dpp/wdpp naming. Please harmonize.
  3. [§4.1] 'Our approached were engineered' should read 'Our approaches were engineered.'
  4. [Author block] The author email in the footer appears corrupted ('envel⌢pe-⌢peneric.regina@gatech.edu').
  5. [Conclusion / Abstract] Consider defining 'generally' quantitatively. Among the 100-epoch variants, not all reduce Attack 2 (e.g., sv-riemannian-wdpp-100 has Attack 2 = 0.3838 vs 0.3797 for fm-unet-100).
  6. [§3.4] Consider replacing 'privacy score' with 'training-distance score' or similar, given the paper's own Attack 3 results show distance from training is not equivalent to identity privacy.

Circularity Check

1 steps flagged

Geometric filtering's headline Attack 1 reduction is partly by construction: the privacy gates select on nearest-training distance and Attack 1 audits nearest-training distance.

specific steps
  1. self definitional [Section 3.4 (Post-Generation Selection and Privacy Gating) and Section 4.1 (Evaluation Protocol)]
    ""Candidates that are farther from the training bank are assigned higher privacy scores and are preferred during subset selection. ... The spatial privacy score is the corresponding cosine distance: q_spatial(g)=max(0,1−s_max(g))." (Sec. 3.4) "Attack 1 (Nearest-Neighbour Distance Audit): Measures instance-level memorization by calculating the feature-space distance between synthetic images and their nearest training counterparts." (Sec. 4.1)"

    The spatial gate's privacy score is literally 1 minus the cosine similarity to the nearest training slice, and Attack 1 is a nearest-neighbour distance audit between synthetic images and their nearest training counterparts. Selecting candidates to maximize the former therefore directly optimizes the latter, up to the choice of feature space. The reported decreases in Attack 1 for filtered variants (e.g., 0.0901→0.0835/0.0804) are partly by construction: the filter is a nearest-training-distance selector and the metric is a nearest-training-distance audit. The geodesic and RAM gates similarly score by distance to the training manifold, so the same reduction-by-definition applies. Attack 3 and Attack 4 are not defined this way and indeed are not reduced, providing non-circular evidence.

full rationale

The paper's central positive claim that geometric filtering reduces nearest-neighbor memorization is, to a significant degree, a tautology: the privacy scores are defined as distance to the nearest training latent, and Attack 1 is defined as distance to the nearest training counterpart. Thus the filtered-vs-unfiltered comparison for Attack 1 measures, in part, the selection criterion itself. This is not the whole story: the paper honestly reports that Attack 3 remains near-maximal (~0.97–1.00) across all filtered variants and that filtered variants often worsen Attack 4, results that are not encoded in the filtering objective and give the work independent empirical content. There are no load-bearing self-citations; the method relies on standard external tools (OTCFM, DPP, SKT). The absence of an ablation separating geometric privacy scoring from DPP/SKT diversity selection is a real confound but is a correctness/attribution concern rather than a circularity. Overall, the circularity is localized to the nearest-neighbor/memorization claim, hence a score of 6 rather than higher.

Axiom & Free-Parameter Ledger

7 free parameters · 6 axioms · 0 invented entities

The analysis relies on a large set of hand-chosen hyperparameters and on the assumption that latent distance to the training bank is a valid privacy signal. No new physical or biological entities are introduced. The most important ad hoc assumption is the distance-privacy monotonicity, which the paper's own Attack 3 result partially falsifies.

free parameters (7)
  • FOV mask outside-FOV threshold = near-zero in ≥90% of real slices
    Hand-set preprocessing threshold in §3.1; determines which pixels are masked before encoder training.
  • Spatial latent size = 8×32×32
    Architecture choice for spatial/contrastive encoders in §3.3; controls granularity of privacy scoring.
  • Riemannian embedding dimension = 128
    Metric head outputs a 128-dim embedding in §3.3; hand-chosen.
  • PCA retained directions r = not reported
    PCA whitening in the geodesic gate (§3.4) retains r directions; value not given.
  • kNN/geodesic hyperparameters (k_d, sigma_rho, k_q, eta, alpha, beta) = not reported
    Density estimation and Riemannian distance constants in §3.3–3.4; no values reported, yet they set the privacy scores.
  • Training duration (100 vs 300 epochs) = 100 chosen as best PPS run
    Selected from leaderboard; §5.1 says this is not a controlled ablation, so the privacy benefit of early stopping is an observed association.
  • Candidate pool size = 20,000
    Generation pool size in §3.2; fixed by authors/challenge, affects filtering efficacy.
axioms (6)
  • standard math OT-CFM with minibatch optimal transport learns the data distribution.
    Invoked in §3.2 as the foundation of the generator; accepted from [5].
  • standard math DPP and SKT produce diverse, representative subsets.
    Used in §3.4 for subset selection; accepted from [6,7].
  • domain assumption The four official attacks are valid operationalizations of privacy.
    The paper's conclusions depend on the organizers' Attack 1–4 protocol (§4.1) being meaningful measures of privacy.
  • ad hoc to paper Distance from the training manifold in a learned latent space correlates inversely with privacy.
    Core to the Supervisor design; stated in §3.4 without independent justification and contradicted by Attack 3.
  • domain assumption 2D axial lung CT slices carry per-patient anatomical identity detectable by rank-1 centroids.
    Needed to interpret Attack 3 in §5.4 as patient re-identification rather than generic anatomy.
  • domain assumption Autoencoders trained on the same training images yield privacy-relevant embeddings without themselves constituting leaks.
    The Supervisor's encoders are trained on the same data (§3.3); the paper does not evaluate whether the encoders amplify memorization.

reviewed 2026-08-01 · how reviews work

0 comments
read the original abstract

We present a privacy-preserving framework for synthetic lung CT slice generation developed for the Image-CLEFmed GANs 2026 challenge. The approach combines Optimal Transport Conditional Flow Matching with privacy-oriented training and a post-generation "Supervisor" pipeline that filters generated candidates in learned geometric latent spaces using autoencoder embeddings, Determinantal Point Processes, and Stein Kernel Thinning. Official results show a strong realism-privacy trade-off, with the best-performing model achieving a Privacy Preservation Score of 0.549 and competitive visual fidelity with an FID of 0.3290. While the proposed geometric filtering substantially reduces nearest-neighbor memorization and membership-inference leakage, persistent patient re-identification scores indicate that preventing direct image copying is not sufficient to remove deeper patient-specific anatomical identity, highlighting an important frontier for future privacy-preserving medical image generation.

Figures

Figures reproduced from arXiv: 2607.20692 by Eric Regina, Richard Arnaud, Samir Hadi Cisneros.

Figure 1
Figure 1. Figure 1: Image generation pipeline overview [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Consensus field-of-view (FOV) mask derived from the real slices. A pixel is marked as outside-FOV if it is near-zero in at least 90% of real slices. 3.1. Dataset and Pre-processing The dataset provided for Subtask 3 consists of 10,000 unlabeled 256×256 two-dimensional axial lung CT slices. We identified 69 exact binary duplicates and removed them from the dataset, leaving 9,931 unique slices. We then appli… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

21 extracted references · 4 linked inside Pith

  1. [1]

    Goodfellow, J

    I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, Y. Bengio, Generative adversarial nets, in: Advances in Neural Information Processing Systems, volume 27, 2014

    2014

  2. [2]

    Dhariwal, A

    P. Dhariwal, A. Nichol, Diffusion models beat gans on image synthesis, in: Advances in Neural Information Processing Systems, volume 34, 2021, pp. 8780–8794

    2021

  3. [3]

    Ionescu, H

    B. Ionescu, H. Müller, D. Stanciu, A. Radu, R. Bolborici, M. Negru, A. Ene, V. Vasilescu, A.-A. Nicolae, L. Ştefan, M. Constantin, M. Dogariu, A. Andrei, H. Damm, T. M. G. Pakull, A. Ben Abacha, A. García Seco de Herrera, C. M. Friedrich, R. Brüngel, L. Reinartz, H. Schäfer, C. S. Schmidt, B. Bracke, P. Nath, B. Eryılmaz, M. Hjuler, D. Fabre, C. Lemaire, ...

    2026

  4. [4]

    Andrei, M

    A. Andrei, M. Constantin, M. Dogariu, D. Karpenka, Y. Prokopchuk, A. Radzhabov, D. Stanciu, L. Ştefan, V. Kovalev, H. Müller, B. Ionescu, Overview of the 2026 ImageCLEFmedical GANs task: Fingerprint detection, latent space analysis, and privacy-preserving medical image synthesis, in: CLEF 2026 Working Notes, CEUR Workshop Proceedings, CEUR-WS.org, Jena, G...

    2026

  5. [5]

    Lipman, R

    Y. Lipman, R. T. Q. Chen, H. Ben-Hamu, M. Nickel, M. Le, Flow matching for generative modeling, in: The Eleventh International Conference on Learning Representations, 2023. URL: https:// openreview.net/forum?id=PqvMRDCJT9t

    2023

  6. [6]

    Kulesza, B

    A. Kulesza, B. Taskar, Determinantal point processes for machine learning, Foundations and Trends in Machine Learning 5 (2012) 123–286

    2012

  7. [7]

    Dwivedi, L

    R. Dwivedi, L. Mackey, Kernel thinning, in: Advances in Neural Information Processing Systems, volume 34, 2021, pp. 17539–17551

    2021

  8. [8]

    Azadi, C

    S. Azadi, C. Olsson, T. Darrell, I. Goodfellow, A. Odena, Discriminator rejection sampling, in: International Conference on Learning Representations (ICLR), 2019

    2019

  9. [9]

    J. R. Dormand, P. J. Prince, A family of embedded runge-kutta formulae, Journal of Computa- tional and Applied Mathematics 6 (1980) 19–26. URL: https://api.semanticscholar.org/CorpusID: 122754533

    1980

  10. [10]

    R. T. Q. Chen, torchdiffeq, 2018. URL: https://github.com/rtqichen/torchdiffeq

    2018

  11. [11]

    Ågren, The nt-xent loss upper bound, 2022

    W. Ågren, The nt-xent loss upper bound, 2022. URL: https://arxiv.org/abs/2205.03169. arXiv:2205.03169

    Pith/arXiv arXiv 2022

  12. [12]

    Zhang, Y

    S. Zhang, Y. Xu, N. Usuyama, H. Xu, J. Bagga, R. Tinn, S. Preston, R. Rao, M. Wei, N. Valluri, C. Wong, A. Tupini, Y. Wang, M. Mazzola, S. Shukla, L. Liden, J. Gao, A. Crabtree, B. Piening, C. Bifulco, M. P. Lungren, T. Naumann, S. Wang, H. Poon, A multimodal biomedical foundation model trained from fifteen million image–text pairs, NEJM AI 2 (2024). URL:...

    doi:10.1056/aioa2400640 2024

  13. [13]

    X. Mei, Z. Liu, P. M. Robson, B. Marinelli, M. Huang, A. Doshi, A. Jacobi, C. Cao, K. E. Link, T. Yang, Y. Wang, H. Greenspan, T. Deyer, Z. A. Fayad, Y. Yang, Radimagenet: An open ra- diologic deep learning research dataset for effective transfer learning, Radiology: Artificial Intelligence 0 (0) e210315. URL: https://doi.org/10.1148/ryai.210315. doi:10.1...

    doi:10.1148/ryai.210315

  14. [14]

    M. F. Naeem, S. J. Oh, Y. Uh, Y. Choi, J. Yoo, Reliable fidelity and diversity metrics for generative models, 2020. URL: https://arxiv.org/abs/2002.09797.arXiv:2002.09797

    Pith/arXiv arXiv 2020

  15. [15]

    Gretton, K

    A. Gretton, K. M. Borgwardt, M. J. Rasch, B. Schölkopf, A. Smola, A kernel two-sample test, Journal of Machine Learning Research 13 (2012) 723–773. URL: http://jmlr.org/papers/v13/gretton12a.html

    2012

  16. [16]

    Z. Wang, E. Simoncelli, A. Bovik, Multiscale structural similarity for image quality assessment, in: The Thrity-Seventh Asilomar Conference on Signals, Systems & Computers, 2003, volume 2, 2003, pp. 1398–1402 Vol.2. doi:10.1109/ACSSC.2003.1292216

    Pith/arXiv arXiv 2003

  17. [17]

    Zhang, P

    R. Zhang, P. Isola, A. A. Efros, E. Shechtman, O. Wang, The unreasonable effectiveness of deep features as a perceptual metric, in: CVPR, 2018

    2018

  18. [18]

    Z. Wang, A. Harting, M. Barreau, M. M. Zavlanos, K. H. Johansson, Source-guided flow matching,

  19. [19]

    Georgia Institute of Technology, Partnership for an Advanced Computing Environment (PACE),

  20. [2017]

    URL: https://pace.gatech.edu

  21. [2025]

    URL: https://arxiv.org/abs/2508.14807.arXiv:2508.14807

    Pith/arXiv arXiv

This paper was first reviewed by deepseek-v4-flash on August 1, 2026.