Model-Specific Disruption of Demographic Prediction in Retinal Fundus Images

Purpose: To test whether disease-aware adversarial attacks can disrupt demographic classification in color fundus photographs (CFPs) while retaining glaucoma classification and whether effects transfer across model architectures. Methods: This retrospective study included 13,959 CFPs from 4,271 patients. Vision Transformer (ViT) models classified glaucoma, race, sex, and ethnicity. Standard and disease-aware FGSM, PGD, C&W, and diffusion attacks changed demographic predictions; disease-aware attacks added a glaucoma classification loss term. Fixed ViT-generated perturbations were tested on ResNet50 and EfficientNetB0. Performance was measured using area under the receiver operating characteristic curve (AUC), accuracy, and image-similarity metrics. Results: Baseline glaucoma AUCs were 0.958-0.963 and demographic AUCs were 0.955-0.992. Disease-aware attacks better preserved glaucoma classification while strongly altering demographic predictions. Disease-aware PGD preserved sex-cohort glaucoma AUC at 0.909 (95% CI, 0.894-0.922) while sex AUC fell to 0.000 (95% CI, 0.000-0.000). Disease-aware diffusion preserved ethnicity-cohort glaucoma AUC at 0.946 (95% CI, 0.936-0.956) while ethnicity AUC was 0.001 (95% CI, 0.000-0.002). Demographic changes transferred poorly to ResNet50 and EfficientNetB0. Conclusions: For PGD, C&W, and diffusion, disease-aware attacks retained more glaucoma classification performance than standard attacks while strongly disrupting targeted demographic prediction. Weak cross-architecture transfer indicates model-specific effects rather than demographic information removal. Translational Relevance: Methods intended to reduce sensitive information in retinal images could support multicenter AI development, but failure of one demographic classifier does not establish de-identification. Cross-model evaluation while preserving disease classification may provide a more reliable framework for clinical data sharing.