Measuring the potential risk of re-identification of imaging research participants from open-source automated face recognition software

In recent years facial recognition software has gone from an area of research to widespread adoption and broad public availability. Open-source face recognition packages are freely available on the internet for anyone to download, and several public websites allow users to run facial recognition on photos without needing any technical knowledge or equipment beyond internet access, making facial recognition accessible for anyone to use for any purpose. Previous research has demonstrated the ability of commercial software to identify a person based on facial content in brain imaging. In this study we tested two commercial facial recognition programs and a variety of popular open-source computer vision and facial recognition software packages to measure how accurately they could be used for reidentification of research participants in brain imaging studies. We tested a "population to sample" threat model, measuring the rates of success for which face recognition software selected the correct MRI-based face reconstruction from a set of 182 participants as its top-scoring match for input facial photographs. We found that the freely available open-source software packages we tested can reidentify a research participant with up to 59 % accuracy. This was less than the commercial packages, which were able to achieve much higher accuracies in the ranges of 92 % and 98 % in identical testing scenarios, but it demonstrates the feasibility of re-identifying faces in research MRI even by individuals with access to only freely available software. As the trust and confidence of potential participants is essential to brain imaging research, especially with widespread and mandated data-sharing of brain scans, this further supports the need to replace identifiable face imagery in brain images to protect the privacy of research participants.