Privacy in Image Datasets: A Case Study on Pregnancy Ultrasounds

AI summary

Overview

• Research area: Computer vision dataset auditing, image privacy, and the ethics of web-scraped training data.
• Technical level: Intermediate. The methods (CLIP embeddings, shallow classifiers, OCR, named entity recognition, clustering) are individually familiar, but the study spans machine learning, privacy law, and medical sociology.
• Scope in one sentence: The paper audits the LAION-400M image-text dataset for pregnancy ultrasound images and the private information they contain, finding 833 unique ultrasound images and 677 instances of private information.

What This Paper Is About

Large image datasets are built by scraping the web, usually with little or no curation, so they can contain sensitive personal material without the subjects' consent. This paper asks two questions: are pregnancy ultrasound images present in datasets used to train computer vision models, and if so, do they contain private information that could identify people. The authors answer both by searching LAION-400M, confirming the images are there, and showing that many carry names, locations, dates, times, and phone numbers.

Key Contributions

1. A detection pipeline for pregnancy ultrasound images that combines CLIP embedding similarity retrieval with classifier-based detection (random forest, SVM, and neural network trained on CLIP features), evaluated on a purpose-built dataset.
2. The PIU (Pregnancy Image Ultrasound) dataset, a custom 9,900-image dataset balanced between positive and negative examples, split into 3,960 training, 990 validation, and 990 test images, built with active learning and a CLIP similarity filter of 0.95 to prevent leakage.
3. A private information identification method that chains image super-resolution and rotation preprocessing, Tesseract OCR, LLaVa-Next text correction, and the Presidio entity recognizer, producing four entity categories: Name, Location, Date Time, and Phone Number.
4. An empirical audit of LAION-400M, yielding 833 unique pregnancy ultrasound images, a themed cluster analysis of what those images actually look like, and a quantification of linked private information within them.

Main Findings

• Detection performance: On the PIU test set, the SVM classifier reached 97.27 accuracy with a 1.41 false positive rate and 4.04 false negative rate. Random forest reached 94.64 / 5.05 / 5.65, the neural network 96.67 / 3.23 / 3.43, image-based retrieval 77.17 / 10.55 / 34.75, and text-based retrieval 83.03 / 8.52 / 25.05. Retrieval thresholds were 0.7 for image queries and 0.3 for text queries.
• Scale of the problem: Applying the SVM to all of LAION-400M returned 1,364 images, reduced to 1,045 by SSCD copy detection at a 0.92 similarity threshold, and finally to 833 unique images after manual inspection.
• False positive check: Running the classifier on a 1-million-image partition and reviewing images whose negative scores fell within 2 standard deviations of the decision boundary surfaced 1,872 images, none of which were pregnancy ultrasounds. Only 38 images fell within 1 standard deviation, which the authors judged too few for meaningful analysis.
• What the images actually look like: Clustering the 833 images with UMAP (512 dimensions to 5) followed by HDBSCAN (minimum cluster size 20) produced 8 clusters. Applying HDBSCAN directly to the raw CLIP features found no clusters. The largest cluster, "expecting parents," holds 120 images (14.4%), followed by "life's milestones display" at 82 images (9.8%) and "baby shower invitation" at 67 images (8%). The remaining clusters are "ultrasound machine" (33), "prenatal care" (55), "clinical ultrasound" (33), "pregnancy announcement" (40), and "ultrasound keepsake" (27). 376 images fell into no cluster. The stereotypical clinical black-and-white film is a minority.
• Private information counts: Presidio found 1,193 instances in all images and 677 in unique images. By type in unique images: Date Time 299, Name 228, Location 120, Phone Number 30. In all images the counts were Date Time 513, Name 387, Location 238, Phone Number 55.
• Accuracy of the private information method: Manual evaluation on 200 randomly selected images by two author-annotators gave F1 scores of 0.65 for Date Time, 0.63 for Phone Number, 0.57 for Location, and 0.45 for Name. Precision and recall were 0.70 / 0.60 (Date Time), 0.58 / 0.70 (Phone Number), 0.50 / 0.67 (Location), and 0.62 / 0.35 (Name). Name detection is the weakest link; the authors note the model recognized "Chole" but failed on "Jessica."
• Linked information raises the risk: 22.9% (191 images) contain at least one type of private information, 10.3% (86 images) contain more than one type, and 2.1% (18 images) contain all four types. The most common overlap, in 3% (25 images), is Name plus Location plus Date Time. Some single images contain up to 13 distinct instances of private information.
• Why the combination matters: Citing Sweeney's work, the paper notes that the mix of gender, birth date, and postal code can identify 87% of individuals in the United States, which is exactly the kind of combination that baby shower invitation cards tend to display.

Methodology in Plain English

The authors started by defining "private information" broadly rather than by any single national law, using Nissenbaum's theory of contextual integrity: information shared in one context (a pregnancy announcement to friends) becomes a privacy violation when moved to another (a training dataset). They then built two ways to find ultrasound images in a large collection. The retrieval approach encodes a set of 22 example ultrasound images and 100 text descriptions with CLIP and flags any dataset image whose cosine similarity to a query exceeds a threshold. The classifier approach trains a simple model on top of CLIP features using the PIU dataset. The PIU data was built by scraping the web with tools like easy-image-scraping, covering not just clinical scans but baby shower invitations and family photos holding scans, with negatives deliberately drawn from hard cases such as non-pregnancy ultrasounds. Active learning was used to iteratively add difficult examples.

For private information, each detected image is first upscaled four times with Real-ESRGAN if one dimension is under 200 pixels, and rotated between 5 and 90 degrees in both directions to make tilted text readable. Tesseract reads the text, LLaVa-Next corrects OCR errors, and Presidio extracts entities. To check reliability, the authors manually annotated 200 images and counted two strings as matching if their Levenshtein distance was under 2 or their similarity exceeded 70%. They then mapped the 833 images into a 5-dimensional space with UMAP, clustered them with HDBSCAN, visualized them in 2D with t-SNE, and named each cluster using the five most frequent words in its captions.

Why This Matters

• For research: Dataset auditing has focused heavily on toxicity, bias, and copyright. This paper shows that privacy exposure in image datasets is a measurable, concrete risk, and that even a small number of affected images represents real people with real medical histories.
• Real-world applications and stakeholders:
  • Dataset curators and model trainers can adopt the detection-and-filtering pipeline before releasing or training on scraped corpora.
  • Generative model developers face a direct risk: diffusion models have been shown to memorize training examples, so private medical images in a corpus could be reproduced.
  • Medical and health privacy practitioners get evidence that sensitive health information leaks out of clinical settings through voluntary social media sharing.
  • Policy and platform governance teams get a concrete case for consent protocols and stronger handling of medical imagery posted by users.
• Industry relevance: LAION-400M is a widely used, publicly available dataset, and its derivative LAION-5B underpins widely used generative systems. The finding that uncurated corpora carry identifiable medical data is directly relevant to anyone training or deploying vision-language or image generation models on web-scraped data.
• Caveat on the paper's own text: the provided content is truncated inside the Recommendations section, so the full set of recommended practices is not available here.

Future Directions

• Build better private information detectors. The paper reports weak Name recognition and asks for a more accurate, customized name recognizer rather than an off-the-shelf one.
• Expand beyond one modality and dataset. The study covers LAION-400M only; whether the same patterns hold in LAION-2B, LAION-5B, or other corpora such as DataComp CommonPool is an open question the authors gesture toward.
• Move past CLIP features for the detection task. The authors note that generic CLIP semantics confuse babies, pregnant people, and ultrasounds, and state that more specialized models are needed.
• Turn detection into curation standards. The paper calls for more robust data privacy and consent protocols for large-scale image collections, particularly for images carrying sensitive personal information, and notes that such practices are rarely applied outside medical datasets.

Target Audience

This paper is most useful to dataset creators and maintainers, machine learning ethics and fairness researchers, privacy and technology policy scholars, and computer vision practitioners who train or fine-tune models on web-scraped image collections. Medical informatics researchers and platform trust-and-safety teams will also find the concrete case study valuable, and its accessible framing makes it readable for graduate students entering privacy research in machine learning.

Authors’ abstract

The rise of generative models has led to increased use of large-scale datasets collected from the internet, often with minimal or no data curation. This raises concerns about the inclusion of sensitive or private information. In this work, we explore the presence of pregnancy ultrasound images, which contain sensitive personal information and are often shared online. Through a systematic examination of LAION-400M dataset using CLIP embedding similarity, we retrieve images containing pregnancy ultrasound and detect thousands of entities of private information such as names and locations. Our findings reveal that multiple images have high-risk information that could enable re-identification or impersonation. We conclude with recommended practices for dataset curation, data privacy, and ethical use of public image datasets.