Xiaowen Liang

Aïcha Ben Zemzem

Laetitia Vanalderwiert

Béatrice Romier- Crouzet

Sébastien Blaise

Timm Weitkamp

Manuel Dauchez

Stéphanie Baud

Laurent Debelle

Nicolas Passat

Sébastien Almagro
email: sebastien.almagro@univ-reims.fr

Exploring damaged elastic arteries by Synchrotron X-ray Micro-CT

Keywords: Synchrotron X-ray, Extracellular matrix, micro-CT, cardiovascular diseases, diabetes

Introduction

Diabetes is a chronic pathology affecting about 10% of the world population. It accelerates arterial stiffness and increases the probability of cardiovascular diseases. The effect of diabetes on the stiffness of the vascular system has been broadly estimated to correspond to 6-15 years of chronological aging [START_REF] Vatner | Vascular Stiffness in Aging and Disease[END_REF]). This pathology is mainly characterized by an important level of blood glucose leading to the formation of cross-links within elastin fibers and collagens, resulting in a decrease of arterial wall distensibility. Large arteries such as the aorta contain, in their extracellular matrix, an amorphous elastic hydrophobic polymer named elastin, which is the major component of elastic fibers. Its entropic elasticity and its concentric lamellar organization within the aortic wall allow the aorta to remain in a reversible deformation domain during the cardiac cycle, which alternate phases of overpressure and contraction. Alterations to elastin due to a pathological situation or aging permanently affect the arterial mechanics. Synchrotron X-ray microtomography (µ-CT) enables imaging of large sample volumes with sub-micrometric resolution associated to millimeter size field [START_REF] Weitkamp | Microtomography on the ANATOMIX beamline at Synchrotron SOLEIL[END_REF][START_REF] Zemzem | X-ray microtomography reveals a lattice-like network within aortic elastic lamellae[END_REF]. We have developed a protocol to harvest mice aorta, with a limited collapse, for µ-CT imaging.

Methods

Animals and Sample Preparation

Mouse procedures were authorized and realized in accordance with local laws (agreement D-51-454-2). The mice, 6-month-old C57BL6J (control, n = 4) and 6-month-old db/db (diabetic, n = 6), were purchased from C. River and share the same genetic background. Aortas were collected after euthanasia and heparin injection, the heart and aorta were then flushed with phosphate buffered saline to remove residual blood. The aorta was further prefixed by injecting 4% formalin then filled of 1% low melting agarose to keep the aorta opened and to prevent collapse during dehydration and inclusion steps. Gel solidification in the lumen exerts a counterpressure to avoid collapse. The heart and aorta were collected with surrounding tissues. Finally, the samples were fixed in 4% formalin, dehydrated, and embedded in paraffin. The final samples were about 4-cm-long paraffin rods containing the heart and aorta.

Imaging Procedures

Synchrotron X-ray µ-CT was performed on the ANATOMIX beamline (SOLEIL synchrotron, Gif-sur-Yvette, France) with an effective pixel size of 0.65 µm at the sample level. Tomographic reconstruction was performed using the standard processing pipeline at the beamline. The reconstructed volume stacks for each scan contained 2048 × 2048 × 2048 voxels of size (0.65 µm) 3 , giving a 32 GB file per stack.

Arterial Structure Segmentation

Arterial structures were segmented automatically from reconstructed stacks with bespoke Matlab scripts as previously described [START_REF] Zemzem | X-ray microtomography reveals a lattice-like network within aortic elastic lamellae[END_REF]. The result of this segmentation for each tomography volume scan is a 2048-image 3D stack containing 8-bit voxels of the arterial wall.

Reserve Length of Elastic Lamellae

Elastic lamellae are first "fragmented" using thresholding. Typically, about 15-30 fragments are kept per image, leading to about 2,000-30,000 fragments per stack. 10 images stacks were retained for control mice, 11 for diabetic mice.

Results and Discussion

Figure 1a shows a typical reconstructed raw 2D image plane extracted from a synchrotron X-ray µ-CT acquisition (2048 3 voxels) at 0.65 µm/voxel for an aortic segment of a 6-month control mouse. The sample was not sectioned and not stained. The phase-contrast image exhibits the different structures of the aortic environment from the thoracic region. Figure 1b shows an automatic segmentation of elastic structures by our program. Elastic lamellae are altered in diabetic mice (Fig. 2 upper row versus lower row). The control presents a wavy aspect indicating a reserve length. This reserve length allows a spring to be stretched above its apparent length, i.e., its end-to-end distance. If a spring is stretched too much or altered, it loses its reserve and its ability to be reversibly deformed when overstretched. To assess the reserve length of these lamellae, we compute, for a given segment, the ratio (r) between its Euclidean (i.e., end-to-end) and geodesic lengths (i.e., its real length). 127,180 measurements were made on control mice (r=0.823, s=0.047), 159,485 on diabetic mice (r=0.889, s=0.026) to have an exhaustive view over the length, for each elastic lamella and in each orientation. Our analysis shows that diabetic mice have lost a significant part (p<0.004) of their reserve length (59.5 % less) as compared to the control group [START_REF] Zemzem | Early Alterations of Intra-Mural Elastic Lamellae Revealed by Synchrotron X-ray Micro-CT Exploration of Diabetic Aortas[END_REF]. To go further in our study, we have developed an approach combining standard image analysis and deep learning approaches to segment and separate finely the elastic lamellae to study them one by one, associated with the capabilities of the ROMEO supercomputer (Reims), allows us to extract parameters such as local geometry (thickness, density, local curvature) and the geometry of arteriola branching.

Conclusions

In-line phase-contrast synchrotron X-ray microtomography of the arterial wall with label-free tissues grants access to fine details of elastic structures. The strength of this method lies in its large field, its excellent resolution, and a good contrast for intramural elastic structures. Coupled to an automatic image analysis program, this technique provides information that cannot be obtained using other imaging methods. Moreover, for each sample, it allows the computation of thousands of measurements for a given feature, such as the ratio between Euclidean and geodesic distances of a segment of an elastic lamella.

Our results show that the reserve length of elastic lamellae is reduced in diabetic mice together with the loss of filaments that support the This suggests that elasticity is correlated to the existence of this lattice-like network that has disappeared at 6 months of diabetes.

The challenge is to extract measurements that allow us to accurately estimate the physiological age of the artery. We plan to develop a pressurization system to image and measure the deformation of arterial wall structures under X-ray beam, so as to decipher the link between small scale alterations and their biomechanical incidence. Further, as the methods we use allow us to make contiguous tomographic scans, we can merged them into a global view of the murine arterial network. This aorta envelope will be used to model the blood flow inside this deformable network.

Figure 1 .

 1 Figure 1. 2D-plane reconstruction from synchrotron acquisition and its automatic segmentation.

Figure 2 .

 2 Figure 2. Comparison of control (upper row) and diabetic (lower row) elastic structures in one 2D plane (left) versus 3D perspective of 800 planes (right). We have previously shown (Ben Zemzem et al. 2021) that an inner lattice-like network (Fig 2., upper right image) is present inside the elastic structure, to which it seems to confer flexibility and resistance. 6-monthold diabetic mice exhibit a drastic destruction of this network (Fig 2., lower right image) in comparison of normal mice of the same age, suggesting a structural role for this lattice-like network.To go further in our study, we have developed an approach combining standard image analysis and deep learning approaches to segment and separate finely the elastic lamellae to study them one by one, associated with the capabilities of the ROMEO supercomputer (Reims), allows us to extract parameters such as local geometry (thickness, density, local curvature) and the geometry of arteriola branching.

Acknowledgements

The chair MAgICS, the University of Reims Champagne-Ardenne and DRRT of Champagne-Ardenne funded this work. The authors acknowledge Synchrotron SOLEIL to have provided beamtime for this study under project 20191028. ANATOMIX is funded by the Investments for the Future program of the French National Research Agency, project NanoimagesX (ANR-11-EQPX-0031). Fundings from the "Grand-Est" Region (OMAGE & FHU program), ERRDF and CNRS are acknowledged.


Ignacio Roa

Camille Deberne

Marie-Charlotte Renoult

Christophe Dumouchel

Jorge César

Brändle De Motta

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Break or Relax

Normandie Univ, INSA ROUEN, UNIROUEN, CNRS, CORIA, 76000 Rouen, France Droplet breakup under turbulent conditions is not such a straight-forward process. A series of droplets initialized on a spherical state surrounded by a turbulent flow were realized and left to evolve until breakup was reached.

Although the statistical properties of the turbulence are equivalent for all the droplets, their deformation history is unique. This uniqueness arises from the delicate equilibrium between turbulent-induced and cohesive forces. A strong deformation event can emerge during the droplet lifetime (first column). This state can lead to either a rapid breakup due to capillary instabilities (first row) or relaxation due to surface tension (last row).

In essence, droplet breakup in turbulence is a dynamic and individualized process.

Droplet database generated using ARCHER code


Khuram Faraz
email: khuram.faraz@creatis.insa-lyon.fr

Grégoire Dauce

Amine Bouhamama

Benjamin Leporq

Hajime Sasaki

Yoshitaka Bito

Olivier Beuf

Frank Pilleul

Amine Bouhama

Characterization of Breast Tumors from MR Images Using Radiomics and Machine Learning Approaches

Keywords: radiomic analysis, tumor characterization, IHC markers, automatic classification, multicontrast MRI

come   L'archive ouverte pluridisciplinaire

Introduction

The identification of various immunohistochemical (IHC) markers, like the status of estrogen (ER) or progesterone (PR) hormones, or the responsiveness of the tumors to the HER2 protein, is helpful in determining the course of treatment in breast cancer patients. The overexpression of ER and PR receptors is observed in numerous breast cancer cases, and this characteristic has been helpful in developing targeted treatments [START_REF] Yip | Estrogen and progesterone receptors in breast cancer[END_REF]. HER2 (human epidermal growth factor) expression also plays an important role in breast cancer prognosis, and its overexpression is associated with malignancy [START_REF] Yarden | Biology of HER2 and Its Importance in Breast Cancer[END_REF]. HER2 has been used to design strategies for breast cancer treatment [START_REF] Tai | The role of HER2 in cancer therapy and targeted drug delivery[END_REF]. A combination of the statuses of various IHCs is used to describe different molecular subtypes, of which luminal A (ER + and/or PR + , HER2 -, low proliferation marker Ki-67) and luminal B (ER -and/or PR + , HER2 + or HER2 - with high Ki-67) are frequently used for characterizing breast tumors [START_REF] Johnson | Molecular Subtypes of Breast Cancer: A Review for Breast Radiologists[END_REF]. Another widely used tumor characterization is triple-negative (TN), where ER, PR, and HER2 statuses are all negative. Histologically, breast tumors may be classified as invasive ductal carcinoma (IDC), invasive lobular carcinoma (ILC), or a combination of the two. The histological type influences the prognosis in conjunction with the molecular subtypes [START_REF] Du | Invasive lobular and ductal breast carcinoma differ in immune response, protein translation efficiency and metabolism[END_REF][START_REF] Xiao | Mixed invasive ductal and lobular carcinoma has distinct clinical features and predicts worse prognosis when stratified by estrogen receptor status[END_REF]. Traditionally, genetic approaches have been used to determine the molecular subtypes in breast cancer tumors. This involves the analysis of a sample obtained through a biopsy. Throughout the past decade, there has been a continuous and ongoing exploration of the relationship between radiomic features and the molecular subtypes of breast cancer [START_REF] Grimm | Computational approach to radiogenomics of breast cancer: Luminal A and luminal B molecular subtypes are associated with imaging features on routine breast MRI extracted using computer vision algorithms[END_REF][START_REF] Lee | Radiomics in Breast Imaging from Techniques to Clinical Applications: A Review[END_REF][START_REF] Ye | The Application of Radiomics in Breast MRI: A Review[END_REF][START_REF] Ji | Differences in Molecular Subtype Reference Standards Impact AI-based Breast Cancer Classification with Dynamic Contrast-enhanced MRI[END_REF][START_REF] Davey | Radiomic differentiation of breast cancer molecular subtypes using pre-operative breast imaging-A systematic review and meta-analysis[END_REF].

A radiomic analysis involves extracting a number of features describing the shape, size, or texture of a region selected in an image. Several existing studies have explored the relationship between radiomics features and various IHC markers, or, on a more basic diagnostic level, to distinguish benign and malignant tumors. Radiomics, combined with machine learning, is used in [START_REF] Lee | Classification of MR-Detected Additional Lesions in Patients with Breast Cancer Using a Combination of Radiomics Analysis and Machine Learning[END_REF] to distinguish benign satellite tumors from malignant ones. The markers extracted from DCE (dynamic contrast-enhanced) MR images were used in [START_REF] Bhooshan | Cancerous Breast Lesions on Dynamic Contrast-enhanced MR Images: Computerized Characterization for Image-based Prognostic Markers[END_REF] to differentiate between invasive and noninvasive breast lesions. This study was also extended to the classification of the malignancy level of breast tumors [START_REF] Bhooshan | Computerized three-class classification of MRI-based prognostic markers for breast cancer[END_REF]. The DCE MR images were used in [START_REF] Zhou | Diagnosis of Benign and Malignant Breast Lesions on DCE-MRI by Using Radiomics and Deep Learning with Consideration of Peritumor Tissue[END_REF] for the benign vs. malignant classification of breast tumors. In another study, Chou et al. target the ductal carcinoma cases for predicting their receptor statuses through the features in DCE MR images [START_REF] Chou | Computer-aided heterogeneity analysis in breast MR imaging assessment of ductal carcinoma in situ: Correlating histologic grade and receptor status[END_REF]. Tan et al. [START_REF] Tan | Mammography-based radiomics nomogram: A potential biomarker to predict axillary lymph node metastasis in breast cancer[END_REF] used radiomics to predict auxiliary lymph node metastasis. Radiomics analysis has also been used to complement the traditional genetic-based analysis [START_REF] Guo | Prediction of clinical phenotypes in invasive breast carcinomas from the integration of radiomics and genomics data[END_REF]. It should be noted that the use of radiomics-based analysis is not exclusive to the MR image modality. For instance, radiomics analysis on echographic images has also been used to characterize breast tumors [START_REF] Yu | Ultrasound-based radiomics nomogram: A potential biomarker to predict axillary lymph node metastasis in early-stage invasive breast cancer[END_REF][START_REF] Lee | Predictive performance of ultrasonography-based radiomics for axillary lymph node metastasis in the preoperative evaluation of breast cancer[END_REF]. Furthermore, instead of extracting the radiomics, the deep learning approaches have also been directly applied to the image data [START_REF] Truhn | Radiomic versus Convolutional Neural Networks Analysis for Classification of Contrast-enhancing Lesions at Multiparametric Breast MRI[END_REF].

There has been an upward trend in the radiomics-based prediction of the molecular subtypes [START_REF] Davey | Radiomic differentiation of breast cancer molecular subtypes using pre-operative breast imaging-A systematic review and meta-analysis[END_REF][START_REF] Zhang | Value of genomics-and radiomics-based machine learning models in the identification of breast cancer molecular subtypes: A systematic review and meta-analysis[END_REF] and continues to be a subject of interest [START_REF] Caballo | Four-Dimensional Machine Learning Radiomics for the Pretreatment Assessment of Breast Cancer Pathologic Complete Response to Neoadjuvant Chemotherapy in Dynamic Contrast-Enhanced MRI[END_REF][START_REF] Zhang | Predicting breast cancer types on and beyond molecular level in a multi-modal fashion[END_REF][START_REF] Lafcı | DCE-MRI Radiomics Analysis in Differentiating Luminal A and Luminal B Breast Cancer Molecular Subtypes[END_REF][START_REF] Huang | Application of DCE-MRI radiomics signature analysis in differentiating molecular subtypes of luminal and non-luminal breast cancer[END_REF]. Multi-contrast MR images were used in [START_REF] Liu | Radiomics of Multiparametric MRI for Pretreatment Prediction of Pathologic Complete Response to Neoadjuvant Chemotherapy in Breast Cancer: A Multicenter Study[END_REF] for a radiomics-based prediction of HER2 status and TN cases. Radiomics is used for TN prediction on mono-contrast images in [START_REF] Ma | Radiomics Analysis Based on Automatic Image Segmentation of DCE-MRI for Predicting Triple-Negative and Nontriple-Negative Breast Cancer[END_REF]. Xie et al. [START_REF] Xie | Machine Learning-Based Analysis of MR Multiparametric Radiomics for the Subtype Classification of Breast Cancer[END_REF] also used radiomics, but on multi-parametric data for TN prediction. In some studies, the HER2 status is reported to be difficult to predict through radiomics analysis on the regular contrast images, but a potential for improvement for this classification by using multi-parametric data is shown [START_REF] Zhou | Radiomics Signatures Based on Multiparametric MRI for the Preoperative Prediction of the HER2 Status of Patients with Breast Cancer[END_REF][START_REF] Li | Quantitative MRI radiomics in the prediction of molecular classifications of breast cancer subtypes in the TCGA/TCIA data set[END_REF]. There are fewer studies that use radiomics to classify individual IHC markers, as opposed to a direct characterization of molecular subtypes defined by them. Among such studies, ER and PR classification, along with HER2 classification on MR images is performed by Li et al. [START_REF] Li | Quantitative MRI radiomics in the prediction of molecular classifications of breast cancer subtypes in the TCGA/TCIA data set[END_REF]. ER, PR, and HER2 prediction in the context of studying breast cancer brain metastasis is the subject of a study by Luo et al. [START_REF] Luo | Radiomic Signatures for Predicting Receptor Status in Breast Cancer Brain Metastases[END_REF]. The classification of ER, PR, and HER2 is conducted on radiomics and genomics data by Yoon et al. [START_REF] Yoon | Deep radiogenomics for predicting clinical phenotypes in invasive breast cancer[END_REF]. In a recent work by Zhong et al. [START_REF] Zhong | Multiregional Radiomic Signatures Based on Functional Parametric Maps from DCE-MRI for Preoperative Identification of Estrogen Receptor and Progesterone Receptor Status in Breast Cancer[END_REF], radiomic features from parametric maps in MRI were used to predict the ER and PR statuses. While a vast majority of the tumors are of type IDC, ILC remains understudied [START_REF] Mouabbi | Invasive lobular carcinoma: An understudied emergent subtype of breast cancer[END_REF][START_REF] Chen | Invasive lobular carcinoma of the breast: A special histological type compared with invasive ductal carcinoma[END_REF] and there appears to be a limited existing literature on the radiomics-based differentiation of the two types. A textural analysis of the breast tumors was used by Holli et al. [START_REF] Holli | Characterization of Breast Cancer Types by Texture Analysis of Magnetic Resonance Images[END_REF] to differentiate IDC and ILC. Both texture and entropy features were individually used by Waugh et al. for the same task [START_REF] Waugh | Magnetic resonance imaging texture analysis classification of primary breast cancer[END_REF].

The aim of this study is to explore the predictability of various molecular signatures as well as the histological subtypes IDC and ILC in breast tumors via both a mono-and multicontrast radiomics analysis and, in a limited case, compare it with a CNN (convolutional neural network)-based approach. Although the HER2 status is frequently explored in the literature, we found fewer studies that used radiomics for predicting the ER and PR responses individually, rather than as a part of luminal A, luminal B or TN molecular subtypes. In the existing literature on radiomics-based analysis, the histological subtypes have not been as much investigated as the molecular subtypes or the IHC markers. In our study, the IDC/ILC classification is performed on the same cohort of patients as used for the ER, PR, and HER2 classification. A partial contribution of our study is to group these tasks, which can individually be found in the existing literature.

Materials and Methods

Image Acquisition Protocol

This study included patients who had a diagnosis of breast cancer confirmed both by a biopsy and via a breast MRI (median age: 52 years; age range: 24-86 years; female patients only). Furthermore, the patients were included in the study only if they did not present a history of thoracic surgery, chemotherapy, or radiation therapy. Only the baseline MRI at diagnosis was included before any chemotherapy or surgery. Patients were included after their biopsy (range: 2-28 days). The MRI protocol was sequentially composed of T1weighted imaging (T1), Dixon T2-weighted imaging (in-phase, out-of-phase, water and fat images) or T2 SPAIR (T2), and 3D gradient-echo dynamic contrast-enhanced (DCE) images with fat suppression, acquired at 3 and 5 min after the intravenous injection of 0.1 mmol/kg gadolinium-based contrast agent. Furthermore, a subtraction image (Sub) was achieved through the subtraction of the T1 image from the DCE image. The acquisitions were performed using three different MR systems at two different static magnetic fields (Philips Ingenia 1.5 T, SIEMENS MAGNETOM Vida 3.0 T, and SIEMENS MAGNETOM Aera 1.5 T). The data acquisition period is from early 2017 to mid-2020. Histological subtypes, HER2 expression, ER expression, and PR expression were retrieved from the patients' database. Patient data were collected after institutional review board approval. Patients who did not consent to the use of their clinical data for an academic study were excluded, according to national and European laws.

Segmentation of the Lesions

The lesion/tumor region in the images needs to be separated before performing a radiomics analysis. Ideally, this should be fully automated to allow for an efficient treatment of a large dataset, which is crucial for machine learning-based analysis. However, at this stage, we used segmentations overseen by an experimented radiologist, with 9 years of experience in oncology imaging, so that the impact of any segmentation errors on the radiomics analysis is minimized. A semiautomatic tool available in ITK-SNAP [START_REF] Yushkevich | User-guided 3D active contour segmentation of anatomical structures: Significantly improved efficiency and reliability[END_REF] was used for the guided segmentation of the tumors. The lesions were delineated on DCE images, in which the pixels corresponding to a tumor tend to have a higher intensity than the neighboring pixels. The guided steps allowed for an approximate segmentation of the tumor within an ROI box drawn around the lesion. An experimented radiologist subsequently made slice-by-slice manual correction of the segmentation mask.

Data Preparation and Experimental Setup

Some small artifacts in the masks (like thin gaps or uneven boundaries) introduced due to manual delineation of the tumor were smoothed out through simple mathematical morphology operations (sequential opening and closing using a 3 × 3 × 3 pixels cubic kernel). Among the T2-weighted acquisitions, fat-suppressed (with Dixon fat-water decomposition or spectral attenuated inversion recovery (SPAIR)) images were selected for radiomics analysis. All three image types (DCE, Sub, and T2) were extrapolated to the same dimensions using ITK libraries [START_REF] Avants | The Insight ToolKit image registration framework[END_REF]. The same segmentation mask, with necessary extrapolation, was applied to the three image types. We excluded the tumors having very small sizes (smaller than 5 mm) because they are potentially inadequate for a radiomics analysis and are subject to particular consideration [START_REF] Gibbs | Characterization of Sub-1 cm Breast Lesions Using Radiomics Analysis[END_REF]. Indeed, the dimensions of some convolution kernels come very close to the size of small tumors. The tumors with roots spread in the entire gland were also excluded due to their complex bifurcations and very irregular shape, which pose difficulty in precise segmentation.

For experimental purposes, we divided our data into five sets (folds) by random selection of patients. Initially, we established the feasibility of the radiomics-based classification of molecular subtypes by training different machine learning models on four of the five folds to maximize the classification precision on the fifth one. In a second setup, we reserved one fold as a pseudo-external validation dataset (referred to as a test dataset in the article). After training the model on three folds to obtain optimum results on a fourth layer, the model was applied to the test dataset. We also tried to determine the impact of the MRI contrast on the classification task. Therefore, the experiments were performed either on the individual types of images (mono-contrast) or on a combination of types (multi-contrast). In the case of mono-contrast, the data from only one type of image (DCE, T2, or Sub) were used, whereas the data from two or three types of images were combined in multi-contrast experiments.

We used the setup with a test dataset in two other types of experiments. One set of these additional experiments was to explore the performance of the CNN-based approach, for which we compared the performance on the mono-contrast data with the radiomics approach. The second set of the exploratory experiments applied the radiomics-based approach on a dataset having a stricter exclusion criterion regarding the tumor sizes to have a more homogeneous data in this regard. For this, we retained only the tumors with a size within 50% of the median size of the tumors in the previous dataset. We used the average of the length, width, and height of a tumor in the orientation defined by the acquisition setup as a representative of its size. Since the tumors may be quite irregular in shape, we used this indicator of size, rather than the precise 3D volume, for a basic statistical analysis of the homogeneity of tumor sizes.

Radiomics-Based Classification

Figure 1 illustrates a radiomics-based pipeline for classifying the molecular subtypes. PACS is the database that contains the complete patient scans. The images, along with the histology results, obtained from this database are anonymized and annotated. Once the tumors have been segmented, a radiomics analysis is performed over the region corresponding to the segmentation mask. The details of the extracted features can be found in [START_REF] Bouhamama | Prediction of Histologic Neoadjuvant Chemotherapy Response in Osteosarcoma Using Pretherapeutic MRI Radiomics[END_REF]. Figure 2 summarizes the categories of the 342 radiomics features extracted. Since the initial radiomics set contains several hundred features, a dimension reduction algorithm is applied to select the most pertinent and uncorrelated radiomic features. A classification model is subsequently trained on the reduced number of radiomic features. The approaches used in the key steps of this pipeline are presented in detail below.

classification of molecular subtypes by training different machine learning models on four of the five folds to maximize the classification precision on the fifth one. In a second setup, we reserved one fold as a pseudo-external validation dataset (referred to as a test dataset in the article). After training the model on three folds to obtain optimum results on a fourth layer, the model was applied to the test dataset. We also tried to determine the impact of the MRI contrast on the classification task. Therefore, the experiments were performed either on the individual types of images (mono-contrast) or on a combination of types (multi-contrast). In the case of mono-contrast, the data from only one type of image (DCE, T2, or Sub) were used, whereas the data from two or three types of images were combined in multi-contrast experiments.

We used the setup with a test dataset in two other types of experiments. One set of these additional experiments was to explore the performance of the CNN-based approach, for which we compared the performance on the mono-contrast data with the radiomics approach. The second set of the exploratory experiments applied the radiomics-based approach on a dataset having a stricter exclusion criterion regarding the tumor sizes to have a more homogeneous data in this regard. For this, we retained only the tumors with a size within 50% of the median size of the tumors in the previous dataset. We used the average of the length, width, and height of a tumor in the orientation defined by the acquisition setup as a representative of its size. Since the tumors may be quite irregular in shape, we used this indicator of size, rather than the precise 3D volume, for a basic statistical analysis of the homogeneity of tumor sizes.

Radiomics-Based Classification

Figure 1 illustrates a radiomics-based pipeline for classifying the molecular subtypes. PACS is the database that contains the complete patient scans. The images, along with the histology results, obtained from this database are anonymized and annotated. Once the tumors have been segmented, a radiomics analysis is performed over the region corresponding to the segmentation mask. The details of the extracted features can be found in [START_REF] Bouhamama | Prediction of Histologic Neoadjuvant Chemotherapy Response in Osteosarcoma Using Pretherapeutic MRI Radiomics[END_REF]. Figure 2 summarizes the categories of the 342 radiomics features extracted. Since the initial radiomics set contains several hundred features, a dimension reduction algorithm is applied to select the most pertinent and uncorrelated radiomic features. A classification model is subsequently trained on the reduced number of radiomic features. The approaches used in the key steps of this pipeline are presented in detail below. The radiomic features were extracted from the zones of the tumors corresponding to the manually segmented masks. From each image, 6 contrast images were derived by using different intensity levels (8, 16, 24, 32, 48, and 64). This allows for taking into account the intensity variation in the original image due to variations in acquisition conditions. The radiomic features extracted from these six contrast images were then averaged. A total of 342 radiomic features describing the tumor's size, shape, or texture, were extracted. All of these radiomic features are not necessarily relevant, and using all of them might result in an ineffective model. Hence, a dimension reduction was needed. Two kinds of dimension reduction algorithms were tested: (i) ReliefF [START_REF] Kononenko | Estimating Attributes: Analysis and Extensions of RELIEF[END_REF]-selection of the least correlated features and (ii) LASSO (least absolute shrinkage and selection operator)-regression-based.

For ReliefF, 32 most relevant features were selected, whereas a relaxed reduction weight for LASSO was selected over a hundred features. The reduced features were selected by using only the train and validation datasets (the data were also z-score normalized with respect to the combined train and validation datasets before the dimension reduction). The list of features thus obtained was then used to select the same features for the test dataset as well.

Two types of classification models were used: (i) support vector machine (SVM, with a linear kernel and no regularization) for a linear classification and (ii) a fully connected neural network (FCNN) with five layers (with the number of neurons in these layers being 50, 40, 30, 20, and 10). Different combinations of dimension reduction approaches and classification models were used. For each experiment, one of the five folds was retained as the test dataset. For the remaining data, 25 models for each experiment were generated by randomly dividing the train-validation dataset into 25% validation and 75% train dataset (considering that one-fifth of the data was retained for the test, this amounts to a 20/20/60 split into test/validation/train). Out of 25 models, the one with the optimum performance on the validation dataset was retained for a given test fold. The results were averaged over 5 cycles by choosing different test folds.

CNN-Based Classification

As a second approach to classifying tumor subtypes, we used a CNN-based classification scheme applied directly to the manually segmented tumors. This was achieved through an adaptation of faster R-CNN architecture [START_REF] Ren | Towards real-time object detection with region proposal networks[END_REF] that employed a dense U-Net [START_REF] Cai | Dense-UNet: A novel multiphoton in vivo cellular image segmentation model based on a convolutional neural network[END_REF] with 3 resolution levels for feature extraction. Since a preliminary comparison of the 3D and 2D classifications did not indicate any notable differences in the performance, we opted for a 2D model due to significantly less computation time and memory overload. We first trained the region proposal networks (RPN) of faster R-CNN for lesion detection tasks on patches of 384 × 384 pixel size. The patches were randomly sampled from the The radiomic features were extracted from the zones of the tumors corresponding to the manually segmented masks. From each image, 6 contrast images were derived by using different intensity levels (8, 16, 24, 32, 48, and 64). This allows for taking into account the intensity variation in the original image due to variations in acquisition conditions. The radiomic features extracted from these six contrast images were then averaged. A total of 342 radiomic features describing the tumor's size, shape, or texture, were extracted. All of these radiomic features are not necessarily relevant, and using all of them might result in an ineffective model. Hence, a dimension reduction was needed. Two kinds of dimension reduction algorithms were tested: (i) ReliefF [START_REF] Kononenko | Estimating Attributes: Analysis and Extensions of RELIEF[END_REF]-selection of the least correlated features and (ii) LASSO (least absolute shrinkage and selection operator)-regression-based.

For ReliefF, 32 most relevant features were selected, whereas a relaxed reduction weight for LASSO was selected over a hundred features. The reduced features were selected by using only the train and validation datasets (the data were also z-score normalized with respect to the combined train and validation datasets before the dimension reduction). The list of features thus obtained was then used to select the same features for the test dataset as well.

Two types of classification models were used: (i) support vector machine (SVM, with a linear kernel and no regularization) for a linear classification and (ii) a fully connected neural network (FCNN) with five layers (with the number of neurons in these layers being 50, 40, 30, 20, and 10). Different combinations of dimension reduction approaches and classification models were used. For each experiment, one of the five folds was retained as the test dataset. For the remaining data, 25 models for each experiment were generated by randomly dividing the train-validation dataset into 25% validation and 75% train dataset (considering that one-fifth of the data was retained for the test, this amounts to a 20/20/60 split into test/validation/train). Out of 25 models, the one with the optimum performance on the validation dataset was retained for a given test fold. The results were averaged over 5 cycles by choosing different test folds.

CNN-Based Classification

As a second approach to classifying tumor subtypes, we used a CNN-based classification scheme applied directly to the manually segmented tumors. This was achieved through an adaptation of faster R-CNN architecture [START_REF] Ren | Towards real-time object detection with region proposal networks[END_REF] that employed a dense U-Net [START_REF] Cai | Dense-UNet: A novel multiphoton in vivo cellular image segmentation model based on a convolutional neural network[END_REF] with 3 resolution levels for feature extraction. Since a preliminary comparison of the 3D and 2D classifications did not indicate any notable differences in the performance, we opted for a 2D model due to significantly less computation time and memory overload. We first trained the region proposal networks (RPN) of faster R-CNN for lesion detection tasks on patches of 384 × 384 pixel size. The patches were randomly sampled from the larger MR images with the constraint that 90% of them should contain a lesion. Squares of sizes 5, 10, 25, 50, and 100 pixels were used as anchors for the RPN. We used distance-IoU loss [START_REF] Zheng | Distance-IoU Loss: Faster and Better Learning for Bounding Box Regression[END_REF] for bounding-box regression and focal loss for classification. The detection results achieved an average recall of 90% across 5 cross-validation folds at the cost of an average of 10 false positives per patient. We used these pretrained RPN to train a full faster-RCNN architecture on the tumor subtype classification task. After the feature maps were computed, we extracted the features corresponding to a given region of interest with the ROI align technique [START_REF] He | Proceedings of the 2017 IEEE International Conference on Computer Vision (ICCV)[END_REF]. Since reducing the number of parameters helps to prevent overfitting, we applied adaptive average pooling to reduce the multi-dimension vector to a 1D vector. We mapped a single linear layer on this vector that had the number of classes to be predicted as output. We used the same 5-fold data split scheme as used for the radiomics approach for training and testing the CNN-based classification model. All experiments were performed using Adam optimizer with default parameters [START_REF] Kingma | A Method for Stochastic Optimization[END_REF].

Results

After presenting the dataset used in the experiments, the AUC (short for AUROC, the area-under-the-receiver-operator curve) results for different experimental setups are given.

Dataset

Although a database of 534 tumors (from 367 patients) was available, the exclusion of 78 tumors due to some factors, such as incomplete histological data, limited the number of tumors available in this study. Moreover, we excluded twenty-five tumors due to their small size (smaller than 5 mm) and two tumors due to their very large size (spread in the entire gland). For comparison purposes, only the tumors for which all three types of acquisitions (DCE, Sub, and T2) were available were retained. These exclusion and selection criteria left us with 429 tumors from 323 patients.

Figure 3a summarizes the number of tumors for both categories of different classification tasks addressed in this study. Not only was there a large imbalance in classes for all tasks, but the tumors also displayed wide heterogeneity in other aspects as well, as Figure 3b illustrates for tumor sizes. The tumor size distribution was 24.6 ± 16.6 mm (mean ± SD), with a median value of 20.3 mm, around which most of the tumors are located. Please note that each of the ER, PR, HER2, and IDC/ILC statuses is not available for all the tumors. Hence, a disparity in the number of total number of tumors and the number of samples available for a given classification task is shown in Figure 3a. Figure 3b, on the other hand, is a histogram of the tumor size distribution of all 429 tumors. J. Pers. Med. 2023, 13, x FOR PEER REVIEW 6 of 14 larger MR images with the constraint that 90% of them should contain a lesion. Squares of sizes 5, 10, 25, 50, and 100 pixels were used as anchors for the RPN. We used distance-IoU loss [START_REF] Zheng | Distance-IoU Loss: Faster and Better Learning for Bounding Box Regression[END_REF] for bounding-box regression and focal loss for classification. The detection results achieved an average recall of 90% across 5 cross-validation folds at the cost of an average of 10 false positives per patient. We used these pretrained RPN to train a full faster-RCNN architecture on the tumor subtype classification task. After the feature maps were computed, we extracted the features corresponding to a given region of interest with the ROI align technique [START_REF] He | Proceedings of the 2017 IEEE International Conference on Computer Vision (ICCV)[END_REF]. Since reducing the number of parameters helps to prevent overfitting, we applied adaptive average pooling to reduce the multi-dimension vector to a 1D vector. We mapped a single linear layer on this vector that had the number of classes to be predicted as output. We used the same 5-fold data split scheme as used for the radiomics approach for training and testing the CNN-based classification model. All experiments were performed using Adam optimizer with default parameters [START_REF] Kingma | A Method for Stochastic Optimization[END_REF].

Results

After presenting the dataset used in the experiments, the AUC (short for AUROC, the area-under-the-receiver-operator curve) results for different experimental setups are given.

Dataset

Although a database of 534 tumors (from 367 patients) was available, the exclusion of 78 tumors due to some factors, such as incomplete histological data, limited the number of tumors available in this study. Moreover, we excluded twenty-five tumors due to their small size (smaller than 5 mm) and two tumors due to their very large size (spread in the entire gland). For comparison purposes, only the tumors for which all three types of acquisitions (DCE, Sub, and T2) were available were retained. These exclusion and selection criteria left us with 429 tumors from 323 patients.

Figure 3a summarizes the number of tumors for both categories of different classification tasks addressed in this study. Not only was there a large imbalance in classes for all tasks, but the tumors also displayed wide heterogeneity in other aspects as well, as Figure 3b illustrates for tumor sizes. The tumor size distribution was 24.6 ± 16.6 mm (mean ± SD), with a median value of 20.3 mm, around which most of the tumors are located. Please note that each of the ER, PR, HER2, and IDC/ILC statuses is not available for all the tumors. Hence, a disparity in the number of total number of tumors and the number of samples available for a given classification task is shown in Figure 3a.

Classification Results

Table 1 presents the results for different approaches without setting apart a test dataset. The results are obtained over random 80/20 training/validation splits. The results shown are the ones with the best AUC of the 25 models for the radiomics-based approach.

Classification Results

Table 1 presents the results for different approaches without setting apart a test dataset. The results are obtained over random 80/20 training/validation splits. The results shown are the ones with the best AUC of the 25 models for the radiomics-based approach. For the experiments involving results given in Table 2, the dataset is divided into five patient-wise folds, as described in Section 2.4. This table displays results both for the radiomics-based and R-CNN-based approaches for various input images. To consider the impact of the tumor size heterogeneity, Table 3 shows the results of classification tasks performed using only the tumors of mean size 20 ± 10 mm. Table 4 presents category-wise numbers of radiomic features selected by the ReleifF method for a set of experiments involving T2 images. The proportion of positive and negative responses of different molecular signatures in our dataset does not diverge significantly from their occurrence reported in the general population [START_REF] Hwang | Impact of Breast Cancer Subtypes on Prognosis of Women with Operable Invasive Breast Cancer: A Population-based Study Using seer databasebreast cancer subtype and prognosis[END_REF][START_REF] Allison | Estrogen and Progesterone Receptor Testing in Breast Cancer: ASCO/CAP Guideline Update[END_REF][START_REF] Li | Clinicopathological Characteristics and Breast Cancer-Specific Survival of Patients with Single Hormone Receptor-Positive Breast Cancer[END_REF]. Nevertheless, there is a noticeable unbalance between the two classes for all the IHCs and histological types. This can cause a strong bias toward the larger class during the training of a neural network model for their prediction, and, consequently, render it largely imprecise. This observation makes the AUC a more useful metric for appreciating the classification results on these data. The results in Table 1 present an insight into the potential of the radiomics-based classification. The best results on the validation data were obtained for ER + vs. ER -and IDC vs. ILC classification tasks, with the AUC surpassing 0.8 for several classification models. Furthermore, the results on the multicontrast data tended to be better than on the mono-contrast alone. The results obtained using LASSO-based reduction and FCNN-based classification schemes were slightly better than those obtained by using ReliefF and SVM. For the classification tasks involving HER2 and PR, the results were significantly poorer, with AUCs around 0.6 in the majority of the experiments.

At present, we do not have access to data for external validation. Hence, for a rigorous evaluation (at the expense of reducing our training dataset) we set aside a part of our data as pseudo-external data, which we will herein refer to as the test dataset. For this setup, we also compare the performance with an R-CNN-based scheme, applied directly to the image data. The relative performance of various classification tasks in this setup (see Table 2) was in agreement with the previously discussed validation results. The experiments were most successful for ER and IDC vs. ILC tumor classification tasks, with AUC often approaching or surpassing 0.7 in both cases. The results were most unsatisfactory for the prediction of HER2 and PR statuses. In the case of multi-contrast experiments, an improvement in the ER and IDC/ILC (especially ER) classification was observed. The improvement with T2+Sub or DCE + T2 + Sub combinations was more pronounced, with the ER classification AUC reaching 0.78. On the other hand, the performance of HER2 and PR classification tasks did not improve with any of the multi-contrast combinations.

The performance of the R-CNN-based approaches is comparable to that of the radiomicsbased one. Once again, a higher AUC of around 0.7 was reached for ER classification. For the IDC vs. ILC classification, the AUC was relatively lower than that of the radiomicsbased approach. This difference might be explained by the lack of sufficient data to train deep-learning models. Training on a large dataset is needed to efficiently extract the relevant features directly from the images. The radiomics-based approach, on the other hand, uses mathematically formulated radiomic features. As for the computation times, the radiomicsbased approach took from a few seconds to 1 or 2 min, depending on the classification methodology used, whereas the R-CNN approach required several hours to train a model even on the images resampled to a smaller size.

In the case of using the tumors with limited size variations (Table 3), while the general tendency for the ER and IDC/ILC classification was about the same as in the previous results, there was an improvement in the HER2 and PR classification results: for both cases, the results showed a tendency to approach or even sometimes surpass 0.6 AUC. This is in contrast to the previous results, where the AUC was not much different from that of a random classifier. This might indicate that the tumor heterogeneity influences the classifier and, consequently, an extensive training set covering vast variations in tumor sizes might be helpful in training a more reliable classifier.

Finally, we add a brief discussion on the radiomic features selected for the classification tasks. The radiomic features summarized in Table 4 correspond to only one set of experiments involving ReliefF-based dimension reduction that we conducted to obtain the results presented in this work. One of the salient observations is regarding the categories of features retained for the IHC classification tasks (involving ER, PR, and HER2) and the tumor-type classification (IDC vs. ILC). While all the classification tasks selected more texture features than the size and shape features, there was an overwhelmingly larger selection of texture features (30 out of 32) for the tumor-type classification. Furthermore, the texture features for the ER and PR classification tasks generally included several frequency-based features (Gabor filter responses), whereas the IDC vs. ILC classification favored the graylevel matrix-based texture features. The next step after the identification of the pertinent radiomic features is to analyze their repeatability. There have been some preliminary studies on both contrast images and multi-parametric MRIs [START_REF] Bobholz | Radiomic Features of Multiparametric MRI Present Stable Associations with Analogous Histological Features in Patients with Brain Cancer[END_REF][START_REF] Cattell | Robustness of radiomic features in magnetic resonance imaging: Review and a phantom study[END_REF] in this regard. While a detailed presentation of the features selected in our various experiments would be quite voluminous, we do note a few key observations. The features selected depended not only on the classification task, but also on the contrast types used. The repeatability of features in the tasks with a higher classification accuracy was considerably higher than the other classification tasks. For instance, a large majority of the radiomic features remained the same in the case of ER + vs. ER -classification task for five experiments for different folds of the training dataset. However, less than half were reproducible for HER2 + vs. HER2 - classification task.

Comparison with Existing Studies

Although our performance level and results of the MRI radiomics-based IHC classification task do not consistently match with those found in the existing literature, the tendency of ER status to be more easily predictable and the better classification found using multi-contrast data are in agreement with the existing literature. In a study performed by Li et al. [START_REF] Li | Quantitative MRI radiomics in the prediction of molecular classifications of breast cancer subtypes in the TCGA/TCIA data set[END_REF] on the TCGA dataset, the AUCs for ER, PR, and HER2 classification tasks were 0.89, 0.69, and 0.65, respectively. In a more recent study, Luo et al. [START_REF] Luo | Radiomic Signatures for Predicting Receptor Status in Breast Cancer Brain Metastases[END_REF] reported promising results in a breast cancer brain metastases study, with ER, PR, and HER2 being 0.89, 0.88, and 0.87, respectively, on a cohort of 68 patients. In their comparison of radiomics-based and genomics-based classifications, Yoon et al. [START_REF] Yoon | Deep radiogenomics for predicting clinical phenotypes in invasive breast cancer[END_REF] reported the AUC values for the radiomics-based classification of ER, PR, and HER2 as 0.82, 076, and 0.72, re-spectively. For the ER and PR classification tasks, Zhong et al. [START_REF] Zhong | Multiregional Radiomic Signatures Based on Functional Parametric Maps from DCE-MRI for Preoperative Identification of Estrogen Receptor and Progesterone Receptor Status in Breast Cancer[END_REF] obtained their respective AUCs as 0.76 and 0.81 by using the radiomic features from the intratumoral region, and 0.73 and 0.71 for the peritumoral region. The difficulty of obtaining a better performance for HER2 classification is also reported in a previous study [START_REF] Zhou | Radiomics Signatures Based on Multiparametric MRI for the Preoperative Prediction of the HER2 Status of Patients with Breast Cancer[END_REF]. They worked with an extensive initial radiomic feature set of over one thousand features and obtained a better performance (AUC 0.86) using multi-contrast data. Huang et al. [START_REF] Huang | Multi-Parametric MRI-Based Radiomics Models for Predicting Molecular Subtype and Androgen Receptor Expression in Breast Cancer[END_REF] obtained an AUC of 0.86 in leave-one-out cross-validation (LOOCV) for HER2 prediction that reached 0.86, using radiomics analysis on multi-parametric images.

As for the classification of the histological subtypes, Waugh et al. [START_REF] Waugh | Magnetic resonance imaging texture analysis classification of primary breast cancer[END_REF] obtained a 0.75 AUC using co-occurrence matrix features and a 0.63 AUC using entropy features for the classification of 92 IDC and 45 ILC tumors by using a K-nearest neighbor (kNN) classifier. Their results, whose AUC values vary between 0.62 and 0.75, are very close to ours depending on the classification method and the image types used. Holli et al. [START_REF] Holli | Characterization of Breast Cancer Types by Texture Analysis of Magnetic Resonance Images[END_REF] differentiated 10 IDC and I0 ILC cases by using co-occurrence matrix features by using kNN and other methods. They achieved an accuracy between 80 and 100% depending on the classification method and the types of MRI used.

Limitations

In addition to the need to further investigate the PR and HER2 classification tasks, this study has some limitations. The dataset for all the classification tasks is very unbalanced. This is the reason we have used only the AUC and not the metrics such as precision and recall to assess our results as the last two metrics are likely to be biased by the overrepresented class. It would be interesting to have obtained the results with a balanced dataset. Since the class unbalance agrees with the distribution of the studied molecular subtypes in the general population, such data would likely need to be sampled from a larger cohort of patients by discarding some data from the over-represented class. Furthermore, we have only analyzed the inhomogeneity in terms of tumor sizes only. A thorough study of the impact of various characteristics, like texture and shape, would be helpful in the selection of more pertinent radiomic features. Additionally, for a practical application, the radiomics analysis should be robust to the acquisition setup [START_REF] Doran | Real-world" radiomics from multi-vendor MRI: An original retrospective study on the prediction of nodal status and disease survival in breast cancer, as an exemplar to promote discussion of the wider issues[END_REF]. The data used in this study come from three different MR systems at two different static magnetic fields. At this stage, we have not yet developed a method to select only the radiomics features that remain independent of the acquisition setup.

Conclusions

In this work, we have shown that multi-contrast MRI-based radiomics could bring insights into the histological subtype classification (IDC vs. ILC) and ER molecular subtype classification of breast cancer. In addition, the CNN-based methods yielded results comparable to the radiomics-based classification. The diagnostic performances for the classification of PR and HER2 remain insufficient and further studies need to be performed to try to improve the performances by using other sources of radiomics such as multiparametric quantitative MRI. The multi-parametric approach might also be helpful in investigating the repeatability of the radiomics features independent of the contrast types. Furthermore, model training on a more extensive dataset and validation on external data are highly desirable. Finally, a fully automated precise segmentation of the tumors is crucial for efficiently treating large data.

Institutional Review Board Statement: Ethical review and approval were not required for the study on human participants in accordance with MR004 reference methodology of Commission nationale de l'informatique et des libertés (CNIL, English: National Commission on Informatics and Liberty). This allows us to use anonymized data without having to go through an Institutional Review Board committee. Written informed consent from the patients/participants or patients/participants' legal guardians/next of kin was not required to participate in this study in accordance with the national legislation and the institutional requirements.

Informed Consent Statement:

Patients not agreeing to the use of their clinical data for an academic study were excluded according to national and European laws (MR004).

Figure 1 .

 1 Figure 1. Radiomics pipeline.Figure 1. Radiomics pipeline.

Figure 1 .

 1 Figure 1. Radiomics pipeline.Figure 1. Radiomics pipeline.

Figure 2 .

 2 Figure 2. Radiomic feature set before dimension reduction.

Figure 2 .

 2 Figure 2. Radiomic feature set before dimension reduction.

Figure 3 .

 3 Figure 3. (a) Sample sizes of various IHC markers (b) Histogram of tumor sizes.

Figure 3 .

 3 Figure 3. (a) Sample sizes of various IHC markers (b) Histogram of tumor sizes.

  Conventional measurements and features: n = 10 Moments: n = 5 Descriptor-based features: n = 2; Gray level co-occurrence matrix; (GLCM) features: n = 15 ER + vs. ER - Conventional measurements and features: n = 3 Transforms: n = 1 Descriptor-based feature: n = 2; Gabor filter responses: n = 3; Other frequency-based features: n = 17; GLCM features: n = 6 PR + vs. PR - Conventional measurements and features: n = 3 Moments: n = 4 Transforms: n = 1 Descriptor-based features: n = 3; Gabor filter responses: n = 4; Other frequency-based features: n = 4; GLCM features: n = 11; Neighboring gray tone difference matrix (NGTDM) features: n = 1; Gray level run length matrix (GLRLM) features: n = 1 IDC vs. ILC Conventional measurements and features: n = 2 GLCM features: n = 19; GLRLM features: n = 1; NGTDM features: n = 5; Gray level size zone matrix;(GLSZM) features: n = 5

Table 1 .

 1 AUC results for various classification models without test dataset holdout.

				Mono-Contrast			Multi-Contrast
	Classification Task	Methodology	DCE	(Val. Data AUC) Sub	T2	DCE + Sub	(Val. Data AUC) DCE + T2 Sub + T2	DCE + Sub + T2
		ReliefF + FCNN	0.61	0.66	0.69	0.65	0.65	0.61	0.57
	HER2 + vs.	ReliefF + SVM	0.61	0.62	0.60	0.59	0.60	0.59	0.61
	HER2 -	LASSO + FCNN	0.61	0.60	0.64	0.67	0.59	0.64	0.65
		LASSO + SVM	0.63	0.70	0.63	0.61	0.59	0.65	0.61
	ER + vs.	ReliefF + FCNN ReliefF + SVM	0.80 0.77	0.78 0.73	0.81 0.78	0.77 0.80	0.81 0.83	0.87 0.76	0.87 0.80
	ER -	LASSO + FCNN	0.85	0.87	0.85	0.90	0.88	0.91	0.93
		LASSO + SVM	0.86	0.84	0.85	0.88	0.89	0.91	0.95
	PR + Vs.	ReliefF + FCNN ReliefF + SVM	0.59 0.63	0.67 0.61	0.65 0.64	0.69 0.58	0.69 0.67	0.68 0.64	0.58 0.66
	PR -	LASSO + FCNN	0.42	0.61	0.71	0.55	0.57	0.63	0.59
		LASSO + SVM	0.63	0.68	0.55	0.56	0.65	0.59	0.64
		ReliefF + FCNN	0.78	0.80	0.82	0.79	0.79	0.80	0.83
	IDC vs.	ReliefF + SVM	0.74	0.73	0.80	0.80	0.85	0.84	0.81
	ILC	LASSO + FCNN	0.79	0.74	0.87	0.80	0.85	0.83	0.80
		LASSO + SVM	0.78	0.86	0.83	0.76	0.85	0.78	0.82

Table 2 .

 2 AUC results for various classification models on an unseen test dataset.

				Mono-Contrast			Multi-Contrast
	Classification Task	Methodology	DCE	(Test Data AUC) Sub	T2	DCE +Sub	(Test Data AUC) DCE + T2 Sub + T2	DCE + Sub + T2
		ReliefF + FCNN	0.57	0.51	0.53	0.48	0.51	0.49	0.53
	HER2 +	ReliefF + SVM	0.57	0.58	0.53	0.50	0.53	0.49	0.53
	vs. HER2 -	LASSO + FCNN	0.53	0.53	0.50	0.49	0.52	0.53	0.56
		LASSO + SVM	0.52	0.53	0.50	0.50	0.49	0.56	0.53
		Faster R-CNN	0.51	0.53	0.45
		ReliefF + FCNN	0.68	0.66	0.71	0.67	0.74	0.72	0.64
	ER +	ReliefF + SVM	0.60	0.61	0.55	0.66	0.65	0.68	0.66
	vs. ER -	LASSO + FCNN	0.67	0.68	0.64	0.70	0.66	0.73	0.78
		LASSO + SVM	0.73	0.70	0.72	0.74	0.74	0.74	0.73
		Faster R-CNN	0.70	0.68	0.72

Table 2 .

 2 Cont.

				Mono-Contrast			Multi-Contrast
	Classification Task	Methodology	DCE	(Test Data AUC) Sub	T2	DCE +Sub	(Test Data AUC) DCE + T2 Sub + T2	DCE + Sub + T2
		ReliefF + FCNN	0.52	0.53	0.49	0.57	0.50	0.58	0.55
	PR +	ReliefF + SVM	0.49	0.58	0.52	0.51	0.50	0.53	0.55
	vs. PR -	LASSO + FCNN	0.50	0.49	0.53	0.52	0.54	0.51	0.49
		LASSO + SVM	0.51	0.49	0.52	0.48	0.47	0.55	0.51
		Faster R-CNN	0.54	0.53	0.49
		ReliefF + FCNN	0.64	0.67	0.73	0.67	0.67	0.70	0.68
	IDC	ReliefF + SVM	0.64	0.66	0.70	0.68	0.73	0.71	0.70
	vs. ILC	LASSO + FCNN	0.61	0.68	0.64	0.64	0.68	0.67	0.68
		LASSO + SVM	0.62	0.65	0.69	0.69	0.63	0.64	0.69
		Faster R-CNN	0.58	0.51	0.56

Table 3 .

 3 AUC of test data results for various prediction models for small variation in tumor size.

				Mono-Contrast			Multi-Contrast
	Classification Task	Methodology	DCE	(Test Data AUC) Sub	T2	DCE + Sub	(Test Data AUC) DCE + T2 Sub + T2	DCE + Sub + T2
		ReliefF + FCNN	0.58	0.61	0.57	0.55	0.55	0.59	0.55
	HER2 + vs.	ReliefF + SVM	0.56	0.55	0.64	0.57	0.58	0.62	0.55
	HER2 -	LASSO + FCNN	0.48	0.56	0.51	0.57	0.53	0.58	0.52
		LASSO + SVM	0.55	0.55	0.59	0.58	0.56	0.58	0.53
	ER + vs.	ReliefF + FCNN ReliefF + SVM	0.69 0.73	0.65 0.70	0.79 0.8	0.69 0.64	0.68 0.77	0.72 0.75	0.74 0.73
	ER -	LASSO + FCNN	0.70	0.60	0.73	0.64	0.69	0.73	0.64
		LASSO + SVM	0.71	0.71	0.74	0.71	0.75	0.69	0.74
	PR + vs.	ReliefF + FCNN ReliefF + SVM	0.53 0.52	0.49 0.54	0.56 0.60	0.51 0.59	0.59 0.59	0.53 0.52	0.53 0.57
	PR -	LASSO + FCNN	0.54	0.55	0.55	0.46	0.53	0.51	0.49
		LASSO + SVM	0.48	0.56	0.53	0.41	0.53	0.51	0.51
		ReliefF + FCNN	0.68	0.62	0.70	0.64	0.65	0.67	0.74
	IDC vs.	ReliefF + SVM	0.70	0.63	0.68	0.65	0.70	0.70	0.70
	ILC	LASSO + FCNN	0.67	0.62	0.69	0.66	0.67	0.70	0.75
		LASSO + SVM	0.69	0.64	0.69	0.70	0.69	0.65	0.71

Table 4 .

 4 The types of radiomic features retained for various classification tasks after dimension reduction through ReliefF on data obtained from T2 images. The result is given for a single experiment chosen arbitrarily. The input data and their division into the training, validation, and test folds are the same for each classification task.

	Classification	Number of Reduced Radiomic Features by Categories
	Task	Size and Shape	Texture
	HER2 +
	Vs.
	HER2 -

J. Pers. Med. 2023, 13, 1062. https://doi.org/10.3390/jpm13071062 https://www.mdpi.com/journal/jpm

J. Pers. Med. 2023, 13, x FOR PEER REVIEW

Acknowledgments: This work was performed within the framework of the SIRIC LyriCAN grant INCa_INSERM_DGOS_12563 and LABEX PRIMES (ANR-11-LABX-0063), program "Investissements d'avenir" (ANR-11-IDEX-0007).

Data Availability Statement:

The patient data used in this study are not in open access to conform with the patient confidentiality as per the General Data Protection Regulation of the EU.


Antoine Boutet
email: antoine.boutet@insa-lyon.fr

Carole Frindel
email: carole.frindel@creatis.insa-lyon.fr

Mohamed Maouche
email: mohamed.maouche@inria.fr

Towards an evolution in the characterization of the risk of re-identification of medical images

Keywords: Privacy, Risk Assessment, Re-Identification, Medical Images

I. INTRODUCTION

Face recognition systems are increasingly deployed for the authentication process as well as mass surveillance programs [START_REF] Hill | Meet clearview ai, the secretive company that might end privacy as we know it[END_REF]. These systems are typically built by scraping publicly available images from social media. Smart cameras equipped with facial recognition are becoming a new threat to privacy. However, this risk does not only concern images and facial recognition tools can be used also on medical imaging.

In recent years, medical professionals have increasingly relied on various imaging technologies for diagnosing patients. Brain imaging, in particular, has seen remarkable advancements, with Magnetic Resonance Imaging (MRI), Positron Emission Tomography (PET), and Computed Tomography (CT) being among the key imaging modalities. Moreover, MRI, which continues to evolve in terms of both modalities and contrast techniques, provide diverse capabilities for visualizing brain tissues, ranging from highlighting fat (T1weighted), fluids (T2-weighted), and lesions (FLAIR, DWI) to mapping functional activity (fMRI) and vascular structures (SWI, MRA) and assessing macromolecular content (MTI).

However, this rapid enhancement in brain imaging quality, along with the widespread sharing of tagged personal images on social media, raises concerns regarding the potential for re-identification using facial recognition software. Instances of re-identification have been reported for anatomical MRI images [START_REF] Mikulan | A comparative study between state-of-the-art mri deidentification and anonyMI, a new method combining re-identification risk reduction and geometrical preservation[END_REF][START_REF] Schwarz | Identification of anonymous MRI research participants with facerecognition software[END_REF][START_REF] Schwarz | Identification from MRI with face-recognition software[END_REF], PET images [START_REF] Schwarz | Potential for re-identifying brain PET research participants using face recognition[END_REF][START_REF] Schwarz | Potential for re-identifying brain PET research participants using face recognition[END_REF], CT images [START_REF] Parks | Automated facial recognition of computed tomography-derived facial images: patient privacy implications[END_REF], as well as functional MRI (fMRI, dMRI, and ASF) images [START_REF] Schwarz | A face-off of MRI research sequences by their need for de-facing[END_REF]. To mitigate this risk, de-facing software has been developed to obscure or replaces part of the human faces [START_REF] Gulban | poldracklab/pydeface: Pydeface v2[END_REF][START_REF] Schwarz | Changing the face of neuroimaging research: Comparing a new MRI de-facing technique with popular alternatives[END_REF]. Nevertheless, these mitigation measures often compromise image utility and do not provide complete protection against reidentification [START_REF] Abramian | Refacing: Reconstructing anonymized facial features using GANs[END_REF][START_REF] Schwarz | Popular MRI defacing software does not sufficiently protect participants from re-identification via face recognition: Neuroimaging/optimal neuroimaging measures for tracking disease progression[END_REF].

In the pursuit of automating face recognition from medical images, methods for face reconstruction typically involve creating an isosurface and applying skin rendering [START_REF] Mikulan | A comparative study between state-of-the-art mri deidentification and anonyMI, a new method combining re-identification risk reduction and geometrical preservation[END_REF][START_REF] Schwarz | Identification of anonymous MRI research participants with facerecognition software[END_REF]. Recognition is then achieved through geometric structural properties [START_REF] Li | An efficient 3D face recognition method using geometric features[END_REF] or dedicated neural networks [START_REF] Hu | When face recognition meets with deep learning: an evaluation of convolutional neural networks for face recognition[END_REF]. Commercial face recognition software, such as Amazon Rekognition1 , Deep Vision AI2 , Face++ 3 or Microsoft Azure Cognitive Services Face API 4 is increasingly integrated into face databases.

The rapid evolution of imaging technologies and the accessibility of certain tools gives rise to significant privacy questions. Legal frameworks like the European General Data Protection Regulation (GDPR), the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), and the California's Consumer Privacy Act (CCPA) mandate the quantification of privacy risks and the effective protection and anonymization of personal data, particularly sensitive health-related information. These laws take into account evolving practices, available tools, and adversaries's capacities for identification. For example, under GDPR Article 29 [14], there is a strong emphasis on considering contextual factors and all potential identification methods, especially in light of recent technological advancements and increased computing power. Therefore, the evolving landscape of face reconstruction and recognition tools calls a reassessment of re-identification risk and the implementation of appropriate protection measures.

While re-identification is a central concern, privacy violations encompass more than just this risk. GDPR and similar regulations emphasize safeguarding against three primary risks: singling out, linkability, and inference. These risks extend beyond mere identification, allowing data to be linked, and potentially disclosing highly sensitive information. In this paper, we also explore a less-studied aspect: the possibility of inferring individual attributes from MRI images with a high degree of confidence.

Imaging data, although not publicly available, resides in health data warehouses. Yet, this data is increasingly shared for research purposes or with private laboratories. Hospitals, in particular, face cybersecurity attacks, leading to data breaches in recent years 5 . Therefore, safegaurding this medical data at its source is crucial to prevent re-identification risks.

This paper aims to assess privacy violations related to brain imaging, considering the evolving landscape of available tools and data. Indeed, to establish the privacy risk assessment, we take into account both the severity of the impacts (which depends on the significance of the consequences and how difficult it would be for subjects to overcome them) and likelihood (which depends on the feasibility of the threat and its motivation). With the evolution of facial recognition and reconstruction tools, as well as their easier accessibility, we discuss the need to consider a higher likelihood. Additionally, we present a comprehensive evaluation campaign to illustrate these risks. Specifically, the contributions of the papers can be summarized as follows:

• We utilize a more robust setting to evaluate the privacy risk compared to the state of the art. Taking inspiration from research in other data modalities (for instance VoicePrivacy Challenge [START_REF] Tomashenko | The VoicePrivacy 2022 Challenge evaluation plan[END_REF]). • We design two different attacks of MRI face recognition and we compare them within the same dataset. • We propose a hair-removing technique on the photographs to increase the effectiveness of the attack. • We evaluate attribute inference on Age, Gender and Ethnic group, and compare the effectiveness between the attack on photographs or MRI. Our results show that there are leakages in sharing MRI images (both in terms of re-identification risk and sensitive attribute inference). Also, our removing facial hair technique is important when using deep-learning based face recognition techniques.

II. RELATED WORK

In the literature, works have addressed the privacy concerns associated with the sharing of brain MRI data in various manners. However, a prevailing consensus has emerged, indicating that the safeguarding of brain MRI images predominantly relies on the application of defacing techniques. A comprehensive examination of state-of-the-art techniques is provided in the study of Schwarz et al. [START_REF] Schwarz | Changing the face of neuroimaging research: Comparing a new MRI de-facing technique with popular alternatives[END_REF]. Starting with this principle some works have tackled the reversing of such defacing method. For instance, Abramian et al. [START_REF] Abramian | Refacing: Reconstructing anonymized facial features using GANs[END_REF] have used a CycleGAN [START_REF] Zhu | Unpaired image-to-image translation using cycle-consistent adversarial networks[END_REF] in order to reverse the defacing methods. Most specifically, they showed that the method that removes the face (mri deface [START_REF] Bischoff-Grethe | A technique for the deidentification of structural brain mr images[END_REF] for the FreeSurfer package [START_REF] Fischl | Freesurfer[END_REF]) is harder to reverse compared to a blurring method Mask-Face [START_REF] Milchenko | Obscuring surface anatomy in volumetric imaging data[END_REF]. In addition some works have tried to compute rapidly deface masks that are considered effective. Such as the work of Khazane et al. [START_REF] Khazane | Deepdefacer: Automatic removal of facial features via U-Net image segmentation[END_REF], where a 3D U-net is used to construct a faster version of pydeface [START_REF] Gulban | poldracklab/pydeface: Pydeface v2[END_REF] with high accuracy (up-to 10 times faster).

As for the attack that illustrates the privacy risk of sharing MRI images. Some have focuses on the inter-MRI linkability. For instance, Ravindra et al. [START_REF] Ravindra | De-anonymization attacks on neuroimaging datasets[END_REF] aim at linking fMRIs from two different datasets without face reconstruction. To do this, they use matrix decomposition to reduce the dimension of each data sample to a smaller vector (100 dimension only) from the functional connectomes matrix. Authors assume that patients are present in both datasets. Thus, the attacker can conduct a full bipartite graph matching between two pseudonymized datasets (a single permutation is found). They noticed that the accuracy is high (> 94%) when both datasets correspond to resting state fMRI compared to the accuracy for language processing and relational processing tasks which is > 90%, and for social processing task which is > 80%.

Similarly to our setup, some works aim at finding the identity of the MRI owner from photographs. For instance, Mikulan et al. [START_REF] Mikulan | A comparative study between state-of-the-art mri deidentification and anonyMI, a new method combining re-identification risk reduction and geometrical preservation[END_REF] evaluate their defacing method with both a Human-recognition and a Machine-recognition experiment. The machine recognition is constructed using the Surf-Ice Sofwtare [START_REF] Rorden | Surf-Ice: A neuroimaging visualization and analysis tool[END_REF] to generate 2D renders. The dlib package [START_REF] King | Dlib-ml: A machine learning toolkit[END_REF] is then used with the pre-trained detector from [START_REF] Geitgey | Face recognition[END_REF]. The main drawback of this work compared to ours is that their evaluation of machine-recognition is flawed because the average number of true identifications is defined as "proportion of subjects in which the correct subject was among the ones indicated by the algorithm". A subject would be indicated by their algorithm only if its score was above a fixed threshold. This is a typical error in Machine Learning (ML) model evaluation where we can always artificially increase the true positive rate by choosing a low threshold but we should also look at the impact on the false positive rate. In other words, a detection system could accept the correct subject by accepting way more false subjects on the way (e.g., 1 correct subject accepted with 99 other false ones). To avoid such mistakes, in our work we use a more robust setting with identity verification and AUC in case of classification evaluation (see Section III). As for their proposed method AnonMI, they use the watershed algorithm from FreeSurfer [START_REF] Fischl | Freesurfer[END_REF] to reconstruct the skin and skull of the subject. Then, they use a template constructed from the IXI dataset to determine the location of ears and face to fill in the voxels with new values. All the values outside of this skin model are set to zero.

The attack described by Schwarz et al. [START_REF] Schwarz | Identification of anonymous MRI research participants with facerecognition software[END_REF] was used in various state-of-art studies [START_REF] Schwarz | Potential for re-identifying brain PET research participants using face recognition[END_REF][START_REF] Schwarz | Changing the face of neuroimaging research: Comparing a new MRI de-facing technique with popular alternatives[END_REF] in order to compare various defacing (or refacing) techniques. This attack was also used to study the privacy risk of different type of imaging techniques beyond classical MRI (dMRI, fmRI, ASL compared to classical T1-W, T2...) [START_REF] Schwarz | A face-off of MRI research sequences by their need for de-facing[END_REF]. The base of the attack is to first apply thresholding and remove artifacts disconnected from the head, then create an isosurface using Matlab's built-in function, and render it to static 2D images using Surf-Ice [START_REF] Rorden | Surf-Ice: A neuroimaging visualization and analysis tool[END_REF]. Then, if needed, the attacker conducts a refacing method using an average template. As for the face recognition itself, for each image, the attacker generates a single 3D surface that they transform into 10 renders (2D, png files) under a range of simulated viewing and lighting angles. These renders are used as training for the Microsoft Azure Face API PersonGroup classifier which is tested using 5 real photographs of each participant. The classifiers used Microsoft's pre-trained models for face detection (detection 03) and recognition (recognition 02). Unfortunately, these models are commercial Microsoft products, and their underlying algorithms have not been published. This why in our work we make use of deepface [START_REF] Serengil | Lightface: A hybrid deep face recognition framework[END_REF] to extract face recognition features with open source programs. Another differentiating aspect of our work is that to the best of our knowledge, we are the only one to inspect the effect of removing hair on photographs for the face recognition.

III. THREAT MODEL AND PRIVACY METRICS

We opted for privacy evaluation protocols used in stateof-the-art competitions. Notably, the VoicePrivacy Challenge [START_REF] Tomashenko | The VoicePrivacy 2022 Challenge evaluation plan[END_REF]. First, lets define the threat model depicted in Fig. 1. We consider a setting where MRI data become available online (honestly or dishonestly) after going through an anonymization method. This data is shared to participate in a given downstream taks. We call it the utility task, which can be as simple as a diagnostic by a physician or as advanced as the training of large deep learning models.

We consider that an attacker obtains this data a ∈ A (e.g., through a data leak in a hospital) and compares it to known data she has accumulated b ∈ B using a linkage function that outputs a score s = LF (a, b). In our setting the known data B is a list of social network photos that could include the real photograph of the subject that produced a. For the metrics, we consider an oracle evaluator that analyzes the list of scores s ∈ S outputted by the attacker for given sets of A and B in order to assess how much information the attacker could have exploited to better link any given a with the correct element b. The setting is often used to evaluate verification systems (e.g., for authentication) where we evaluate the atomic capacity of an attack to differentiate if a pair of data (a, b) come from the same identity (called a mated pair). Unlike, the metrics that are based on finding a fixed correct match, our setting has the advantage to generalize to an arbitrary number of identities in both A and B. For instance, compared to the re-identification rate which is highly sensitive to the number and the nature of elements in B.

A. Equal-Error-Rate -EER

The EER is the most known metric in verification systems. It assumes a threshold-based decision on the score s (i.e., comparing it to a fixed threshold t). In that case, two types of error can be occur: (1) False alarms with rate P f a (t) and ( 2) Misses P miss (t). The EER corresponds to the error rate given with the threshold t e where both the error rates are equal.

EER = P f a (te) = P miss (te) (1)

B. Area under the ROC curve -AUC

We could consider the attacker as a classifier that tries to distinguish between mated and non-mated pairs. Then, we use classical method to evaluate binary classifiers such as the ROC-AUC which evaluates the quality of a binary classification task with every threshold used.

C. Linkability

Linkability was also proposed in [START_REF] Gomez-Barrero | General framework to evaluate unlinkability in biometric template protection systems[END_REF] for biometric template protection systems. The goal of this metric is to estimate the non-overlapping regions between the scores of mated pairs and non-mated pairs (Equation 2). The intuition is to evaluate how much an attacker could deduce the nature of a pair (i.e., mated) depending on how non-confusing the scores are (Equation 3).

L(s) = max(0, p(H|s) -( H|s)), (2)
L(S) = p(H|s) • L(s)ds, (3)
where s represents a given score and p(H|s) represent the probability that a pair is mated H (same subject) given the score s (respectively, non-mated with H). Thus L(s) measures the chances that a score describes a mated pair rather than a non-mated pair. Finally L(S) is the global linkability computed across all scores.

IV. DESIGNED ATTACKS

A. Face Recognition

In this study, we employed a multi-faceted approach to reconstruct facial images from MRI data and subsequently compared these reconstructions with photographs of subjects' identification images (id images) as well as facial photographs sourced from the LFW (Labelled Faces in the Wild) database [START_REF] Huang | Labeled faces in the wild: A database for studying face recognition in unconstrained environments[END_REF] (social network images). The reconstruction process was accomplished using the 3D Slicer software [START_REF] Fedorov | 3d slicer as an image computing platform for the quantitative imaging network[END_REF], which allowed us to generate 3D models of subjects' faces from the MRI data. To optimize the reconstruction process, we employed various parameterizations within 3D Slicer: Crop Volume with Isotropic Spacing for uniform voxel sizes, Thresholding in Segment Editor to isolate the facial region, and Smoothing Effect to refine the 3D model's surface. These parameterization steps were crucial in creating accurate and visually appealing 3D models of subjects' faces from the MRI data, facilitating subsequent analyses and comparisons with reference photographs. For face recognition, we employed two distinct approaches: one based on geometrical features (named GEO) and the other on deep learning features extracted using the VGG neural network architecture (named Deepface).

1) GEO: For face recognition using geometrical features, we utilized the face recognition library [START_REF] Geitgey | Face recognition[END_REF], which relies on the powerful dlib package (a versatile Python library renowned for its facial recognition capabilities [START_REF] King | Dlib-ml: A machine learning toolkit[END_REF]). It works by first detecting facial landmarks on the input images, which are critical points such as eyes, nose, mouth, and chin. These landmarks are located using a deep learning-based facial landmark detection model, typically a shape predictor trained on a large dataset of annotated facial landmarks as depicted in Fig. 2. Once the facial landmarks were detected using dlib, we computed a set of geometrical features, such as the distances between these landmarks, angles formed by specific points, and ratios between different facial measurements.

2) Deepface: To extract deep learning features, we utilized the deepface library [START_REF] Serengil | Lightface: A hybrid deep face recognition framework[END_REF], which incorporates the VGG-Face model. The VGG-Face model is a deep convolutional neural network pretrained on a vast dataset of facial images. It is specifically designed for face recognition and feature extraction. The VGG-Face model operates by passing facial images through its layers, extracting high-level features at various abstraction levels, effectively encoding unique facial characteristics into compact feature vectors.

To quantify the similarity between the reconstructed images and the reference photograph or LFW database images, we computed the Euclidean L2 distance between the feature vectors. This distance metric allowed us to quantitatively measure the dissimilarity between features extracted from the reconstructed faces and those from the photographs. This distance is converted to a similarity metric to it use as a linkage function LF as described in Section III.

3) Baldness: The rationale behind this approach lies in correcting the inherent inability of MRI reconstruction to faithfully reproduce hair details. Instead of fabricating artificial facial hair in these reconstructions, we opt to enhance the similarity of the photographs by eliminating facial hair from them. The method employed for hair removal in portrait images while maintaining facial structure and identity, as detailed in [START_REF] Wu | Hairmapper: removing hair from portraits using gans[END_REF], consists of several steps. Initially, hair removal is achieved by creating paired latent codes for portraits, one with hair and one without hair. Subsequently, a HairMapper network is trained using these pairs, and the results are seamlessly blended with the original image through an image blending process. To enhance the quality of the blending, the hair mask is improved by dilation and blurring, ensuring a smoother transition. This pre-trained model was then applied to our dataset to generate "bald" versions of photographs.

B. Sensitive Attribute Inference

To investigate the inclusion of gender, age, and ethnicity information within the feature vectors produced by Deepface, we employed the pre-trained model to extract feature vectors from each ID image and its corresponding MRI reconstruction. We omitted the final classification layer during this process. Next, we introduced a fully connected layer and conducted training specifically for attribute classification. Our evaluation involves a comprehensive assessment of the models' performance in attribute classification, based on ground truth data available for each subject in our dataset.

V. EVALUATION

A. Dataset

This scientific paper reports on a study conducted at the University Hospital of Lyon between February and April 2022, involving 49 healthy volunteers. The study had stringent inclusion criteria, which required participants to be between 18 and 50 years of age, have no previous neurological issues or a history of neck surgery, and possess no contraindications for undergoing an MRI scan. Additionally, individuals with dental implants or braces were excluded from the study to reduce potential artifacts during image acquisition. Each volunteer provided their informed consent to participate in the study and to be part of this work, with a T2-weighted sagittal imaging using Turbo Spin Echo and their photograph collected for documentation purposes.

B. Distinguishability of mated pairs

In Table I, we present the results of attacks conducted with the metrics defined in Section III. The results show that Deepface method is highly sensitive to the face hair of the subjects. But removing them using our method make the attack behave the best out of our 4 configurations. On the other hand, we notice that removing hair has little impact on GEO as expected since the face landmarks can be found even with hair present. Notably without removing the hair, GEO behaves better than deepface. This illustrates the sensitivity of deepface to hair. This is probably due to how the model of [START_REF] Geitgey | Face recognition[END_REF] was trained (similar hairstyle/facial hair in training).

The comparison is better illustrated in Fig. 4, where we compare the different classification between pairs using the Roc-curve. We notice that the Bald deep combination behaves way better than random (diagonal line) showing that there is leakage of information and distinguishability between data pairs from same subjects compared to different subjects. To be noted, all of the metric order the attack in the same manner. EER also shows that there is still error in conducting the attack by setting up a threshold-based decision with an EER of 32%.

C. Evaluation of sensitive attribute inference

In Table II, we present the results of our inference attacks on both the social media photograph and MRI. We notice for the Gender using the photograph was more effective compared to MRI. But, for both age and ethnic origin the MRI was more effective. Showing the high risk of sharing such type of data.

VI. DISCUSSION AND CONCLUSION

In this paper, we contribute to evaluating privacy risks associated with MRI data. By designing attacks to do recognition through social network photographs and through sensitive attribute inference. Our results highlight vulnerabilities in sharing MRI data, emphasizing the need for enhanced privacy safeguards and continued vigilance. More precisely, we evaluate the leakage with both the GEO method and deepface, illustrating the impact of hair removal. We also discovered discrepancies in the inference of attributes when using an MRI or a photograph. However, there are some limitations that include the lack of testing of defacing methods and we did not evaluate the usage of commercial solutions for face recognition. Nonetheless, we introduced a more robust evaluation protocol in the context of MRI imaging that we advocate for. Also, to the best of our knowledge, we are the first work that compares different attacks and we also study the effect of facial hair removal.

In future work, we want to explore attack capacity beyond face recognition but rather find direct patterns on the brain tissues (e.g., with fingerprinting) in order to evaluate if defacing techniques are appropriate anonymization techniques.

Fig. 1 .

 1 Fig. 1. Threat model: an adversary having access to MRI data tries to identify the associated individual from photographs found on social networks.

Fig. 2 .

 2 Fig. 2. Landmarks detected by GEO on both photographs and reconstruction.

Fig. 3 .

 3 Fig. 3. Hair removal technique makes the reconstruction closer to the photograph (i.e., a smaller L2 distance).

TABLE II ACCURACY

 II OF AGE, GENDER, AND ETHNICITY INFERENCE IN ID IMAGES AND MRI RECONSTRUCTIONS FOR THE SAME SUBJECTS

	Type	Age Gender	Ethnicity
	ID images	0.4	1.0	0.4
	MRI reconstruction	0.6	0.4	0.8

https://aws.amazon.com/fr/rekognition/

http://deepvisionai.in/

https://www.faceplusplus.com/

https://azure.microsoft.com/en-gb/products/cognitive-services/face

https://www.upguard.com/blog/biggest-data-breaches-in-healthcare

ACKNOWLEDGMENT

This work has been supported by the ANR 22-PECY-0002 IPOP (Interdisciplinary Project on Privacy) project of the Cybersecurity PEPR and by the FIL RIVIERA project.