medRxiv (Medicine)
2026-06-25
DOI: HASH:f8f000bf58e5d110e62563da98b5513c
Purpose: To determine whether disease-aware adversarial perturbations can reduce demographic recoverability encoded in color fundus photographs (CFPs) while preserving glaucoma-related diagnostic features. Design: Retrospective analysis of a single-institution retinal imaging dataset using adversarial machine-learning experiments. Participants: A total of 4,271 patients contributing 13,959 CFPs from Massachusetts Eye and Ear. Methods: Vision Transformer (ViT) was trained for glaucoma detection and for prediction of race, sex, and ethnicity. Standard and disease-aware (DA) variants of four adversarial attacks–Fast Gradient Sign Method (FGSM), Projected Gradient Descent (PGD), Carlini & Wagner (C&W), and a diffusion-based attack–were applied to suppress demographic prediction; DA attacks augmented the adversarial objective with a disease-preservation term. Cross-architecture transferability was assessed by generating perturbations on ViT and applying them to ResNet50 and EfficientNetB0. Main Outcome Measures: Area under the receiver operating characteristic curve (AUC) and accuracy for glaucoma and demographic classification before and after perturbation, and disease-preservation and attack transferability across architectures. Results: At baseline, CFPs encoded both glaucoma-related and demographic information. Glaucoma detection AUCs were 0.958 (95% CI, 0.949-0.967), 0.960 (95% CI, 0.951-0.967), and 0.963 (95% CI, 0.955-0.971) in the race, sex, and ethnicity analysis cohorts, respectively. Demographic prediction performance was also high, with AUCs of 0.955 (95% CI, 0.945-0.963) for race, 0.983 (95% CI, 0.977-0.988) for sex, and 0.992 (95% CI, 0.987-0.996) for ethnicity. Standard attacks substantially reduced demographic AUC but often degraded glaucoma detection. Disease-aware optimization improved disease preservation while maintaining demographic suppression. Using a prespecified success criterion of at least 90% disease AUC preservation and demographic AUC reduction to 30% or less of baseline, DA-PGD and DA-Diffusion succeeded across race, sex, and ethnicity; DA-C&W succeeded for sex and ethnicity. Cross-architecture transferability experiments demonstrated that disease preservation transferred more robustly than demographic suppression. Conclusions: Disease-aware adversarial perturbations reduced the recoverability of demographic information in CFPs under white-box conditions while preserving glaucoma-relevant features, suggesting these representations are partially separable. Reduced demographic recoverability did not fully transfer across architectures, highlighting the need for architecture-agnostic methods.