# Heron triangles and a family of elliptic curves with rank zero

Vinodkumar Ghale  Department of Mathematics
BITS-Pilani, Hyderabad campus
Hyderabad, INDIA<EMAIL_ADDRESS>,  Shamik Das
Department of Mathematics and Computation
IIT Guwahati
Guwahati, INDIA<EMAIL_ADDRESS>and  Debopam Chakraborty  Department of
Mathematics
BITS-Pilani, Hyderabad campus
Hyderabad, INDIA<EMAIL_ADDRESS>
###### Key words and phrases:

Elliptic curve; Heron triangle; Diophantine equation; Class number

###### 2010 Mathematics Subject Classification:

Primary 11D25, 51M04, 11G05; Secondary 11R11, 11R27, 11R29

## Abstract

Given any positive integer $n$, it is well-known that there always exists a
triangle with rational sides $a,b$ and $c$ such that the area of the triangle
is $n$. For a given prime $p\not\equiv 1$ modulo $8$ such that $p^{2}+1=2q$
for a prime $q$, we look into the possibility of the existence of the
triangles with rational sides with $p$ as the area and $\frac{1}{p}$ as
$\tan\frac{\theta}{2}$ for one of the angles $\theta$. We also discuss the
relation of such triangles with the solutions of certain Diophantine
equations.

##  1\. Introduction

A triangle with rational side lengths and the rational area is called a Heron
triangle. For a given integer $n$, the celebrated congruent number problem is
the problem of identifying a right angle triangle with $n$ as the area. The
existence of $n$ as the area of a right angle triangle is equivalent to the
rank of the congruent elliptic curve $E_{n}:y^{2}=x(x-n)(x+n)$ being positive.
A glimpse of the extensive study of the congruent number problem can be found
in [3], [4], [9]. In [6], the authors have proved that the existence of
rational points of order greater than $2$ for a similar elliptic curve
$E_{\Delta}:y^{2}=x(x-n\tau)(x+n\tau^{-1})$ is equivalent to the existence of
a Heron triangle with the area as $n$. The elliptic curve associated with the
Heron triangle appears in the works of various authors.
For a given integer $n$, the existence of infinitely many Heron triangle with
area $n$ has been studied in [11]. The work of Buchholz and Ratbun in [1] has
proved the existence of infinitely many Heron triangles with two rational
medians. Later in [2], the authors have looked into the existence of Heron
triangles with three rational medians. In [8], the authors have shown the
existence of elliptic curves associated with Heron triangle of rank at least
three. Similar work has also been done to show the said rank to be at least
four or five. In [7], the authors have shown the existence of elliptic curves
of rank at least two associated with Heron triangles.
The existence of prime pairs $(p,q)$ such that $p^{2}+1=2q$ is equivalent to
the existence of a right-angled triangle with $p$ being one of the legs whose
hypotenuse is also a prime number, namely $q$. It is conjectured that there
are infinitely many such triangles. In this paper, we look into the Heron
triangles with the area $p\equiv 5$ modulo $8$ such that $p^{2}+1=2q$ for some
prime $q$. Moreover, we also assume the triangle to have one of the angles
$\theta$ such that $\tau=\tan\frac{\theta}{2}=p^{-1}$. Using an explicit
$2$-descent method, we calculate the rank of the elliptic curve
$E_{\Delta_{\tau,p}}:y^{2}=x(x-n\tau)(x+n\tau^{-1})$ associated to the above
mentioned Heron triangle and then prove the following main result.

######  Theorem 1.1.

Let $p\equiv 5$ modulo $8$ be an odd prime such that $p^{2}+1=2q$ for a prime
$q$. Then the elliptic curve

$E_{\Delta_{\tau,p}}:y^{2}=x(x-n\tau)(x+n\tau^{-1})$

has rank always zero for $n=p$ and $\tau=\frac{1}{p}$. Hence, there exists no
Heron triangle with area $p$ and one of the angles $\theta$ such that
$\tan\frac{\theta}{2}=\frac{1}{p}$ whenever $p\equiv 5$ modulo $8$. Moreover,
if $p\equiv 3,7$ modulo $8$, then the rank of $E_{\Delta_{\tau,p}}$ will be at
most one.

The works of Kramer and Luca in [10] showed a pathway towards the
understanding of a Diophantine equation arising from different Heron
triangles. We conclude this paper with a few observations towards the
solvability of certain Diophantine equations associated to the above mentioned
Heron triangles. In [13], X. Yan has shown that for fixed coprime positive
integers $m$ and $n$ with different parity, the Diophantine equation
$(m^{2}+n^{2})^{x}+(2mn)^{y}=(m+n)^{2z}$ has no solutions with $y\geq 2$.
Here, we prove a one-one correspondence between a Heron triangle with area $p$
and $\tau=\frac{1}{p}$ and the Diophantine equation
$(x^{2}+y^{2})^{2}+(2pxy)^{2}=z^{2}$.

##  2\. Heron Triangle and Elliptic Curve

We start this section with the relation between a Heron triangle and an
elliptic curve. In [6], Goins and Maddox had shown that any triangle
$\Delta_{n}$ with rational sides $a,b,c$, area $n\in\mathbb{Z}$ and one angle
$\theta$ is associated with the following elliptic curve:

$E_{\Delta_{\tau,n}}:y^{2}=x(x-n\tau)(x+n\tau^{-1})$

where $\tau$ denotes $\tan\frac{\theta}{2}$. Moreover, they have shown that
the torsion group of $E_{\Delta_{\tau,n}}$ will be either
$\mathbb{Z}/2\mathbb{Z}\times\mathbb{Z}/2\mathbb{Z}$ or
$\mathbb{Z}/2\mathbb{Z}\times\mathbb{Z}/4\mathbb{Z}$, $\Delta$ being an
isosceles triangle for the latter case. Using their result, for any pair
$(p,q)$ of odd primes such that $p^{2}+1=2q$, one can identify the elliptic
curve $E_{\Delta_{\tau,p}}$ with a Heron triangle $\Delta$ of area $p$ with
one angle $\theta$ such that $\tau=\tan\frac{\theta}{2}=p^{-1}$ where

$E_{\Delta_{\tau,p}}:y^{2}=x(x-1)(x+p^{2}).$

By the method of 2-descent (see [12]), there exists an injective homomorphism
$b$ such that

$b:E_{\Delta_{\tau,p}}(\mathbb{Q})/2E_{\Delta_{\tau,p}}({\mathbb{Q}})\longrightarrow\mathbb{Q}(S,2)\times\mathbb{Q}(S,2)$

where
$\mathbb{Q}(S,2)=\\{b\in\mathbb{Q}^{*}/(\mathbb{Q}^{*})^{2}\text{ :
}ord_{v}(b)\equiv 0\text{ (mod 2) for }v\neq 2,p,q\\}=\\{\pm 1,\pm 2,\pm p,\pm
q,\pm 2p,\pm 2q,\pm pq,\pm 2pq\\}$. The map is defined by

$\displaystyle b(x,y)=\begin{cases}(x,x-1)&\text{if}\text{ }x\neq 0,1.\\\
(-1,-1)&\text{if}\text{ }x=0.\\\ (1,2q)&\text{if}\text{ }x=1.\\\
(1,1)&\text{if}\text{ }x=\infty\text{ }i.e.\text{ }P=\mathcal{O}.\end{cases}$

Moreover, if $(b_{1},b_{2})\in\mathbb{Q}(S,2)\times\mathbb{Q}(S,2)$ is a pair
that is not in the image of one of the three points $O,(0,0),(1,0)$, then
$(b_{1},b_{2})$ is the image of a point $P=(x,y)\in
E_{\Delta_{\tau,p}}(\mathbb{Q})/2E_{\Delta_{\tau,p}}(\mathbb{Q})$ if and only
if the equations

(2.1) $\displaystyle b_{1}z_{1}^{2}-b_{2}z_{2}^{2}=1$ (2.2) $\displaystyle
b_{1}z_{1}^{2}-b_{1}b_{2}z_{3}^{2}=-p^{2}$

have a solution $(z_{1},z_{2},z_{3})\in K^{*}\times K^{*}\times K$. If
$(z_{1},z_{2},z_{3})$ is solution to the equations (2.1) and (2.2), then the
pre-image $P=(x,y)\in E_{\Delta_{\tau,p}}$ of a point $(b_{1},b_{2})$ under
the map $b$ is given by $x=b_{1}z_{1}^{2},\quad y=b_{1}b_{2}z_{1}z_{2}z_{3}$.
Reducing $E_{\Delta_{\tau,p}}$ modulo $3$ for $p\neq 3$ while simultaneously
noticing the fact $q\not\equiv 0$ (mod $3$), one can immediately observe that
$|\tilde{E}_{\Delta_{\tau,p}}(\mathbb{F}_{3})|=4$. Since $E[2]\subset
E(\mathbb{Q})_{tors}$ and $E(\mathbb{Q})_{tors}$ injects into
$\tilde{E}(\mathbb{F}_{3})$ for any elliptic curve $E$, one can see that
$E_{\Delta_{\tau,p}}(\mathbb{Q})_{tors}=E_{\Delta_{\tau,p}}[2]\text{ whenever
p}\neq 3$. A similar approach shows that
$E_{\Delta_{\tau,3}}(\mathbb{Q})_{tors}\cong\mathbb{Z}/2\mathbb{Z}\times\mathbb{Z}/2\mathbb{Z}$
too. Hence we can start with the following observation:

$E_{\Delta_{\tau,p}}(\mathbb{Q})_{tors}\cong\mathbb{Z}/2\mathbb{Z}\times\mathbb{Z}/2\mathbb{Z}.$

We first start with the following result regarding the modifications of the
equations (2.1) and (2.2).

######  Lemma 2.1.

Let $(b_{1},b_{2})\in\mathbb{Q}(S,2)\times\mathbb{Q}(S,2)$ is a pair that is
not in the image of points of $E_{\Delta_{\tau,p}}(\mathbb{Q})_{tors}$. Then
$(b_{1},b_{2})$ is the image of a point $P=(x,y)\in
E_{\Delta_{\tau,p}}(\mathbb{Q})/2E_{\Delta_{\tau,p}}(\mathbb{Q})$ if and only
if the equations

(2.3) $b_{1}r_{1}^{2}-b_{2}r_{2}^{2}=s^{2},$ (2.4)
$b_{1}r_{1}^{2}-b_{1}b_{2}r_{3}^{2}=-p^{2}s^{2},$

have a solution
$(r_{1},r_{2},r_{3},s)\in\mathbb{Z}^{*}\times\mathbb{Z}^{*}\times\mathbb{Z}^{\ast}\times\mathbb{Z}^{*}$
with $(r_{1},s)=(r_{2},s)=(r_{3},s)=1$.

Proof: Assuming $z_{i}=\dfrac{r_{i}}{s_{i}}$ for $i=1,2,3$ where
$r_{i},s_{i}\in\mathbb{Z}$ and $(r_{i},s_{i})=1$ for $i=1,2,3$, the result
follows immediately if one assumes
$(b_{1},s_{1})=(b_{2},s_{2})=(b_{1}b_{2},s_{3})=1$ in addition. In case the
additional assumption of $(b_{1},s_{1})=(b_{2},s_{2})=(b_{1}b_{2},s_{3})=1$ is
not true, a simple calculation for each of the three cases here will yield
into contradiction. We show the proof for one of those three cases, the other
two follow a similar approach towards their solution. If $(b_{1},s_{1})\neq 1$
then there exists a prime number $t_{1}$ such that $t_{1}|b_{1}$ and
$t_{1}|s_{1}$. Now, from the equation (2.1), we have $r_{1}^{2}s_{2}^{2}\equiv
0\ (mod\ t_{1})$ as $b_{1}$ is square-free. This in turn implies that
$s_{2}\equiv 0\ (mod\ t_{1})$ as $(r_{1},s_{1})=1$ and $t_{1}|s_{1}$. If
$t_{1}\nmid b_{2}$, then $b_{1}r_{1}^{2}s_{2}^{2}$ is divisible by an odd
power of $t_{1}$ whereas $b_{2}r_{2}^{2}s_{1}^{2}+s_{1}^{2}s_{2}^{2}$ is
divisible by an even power of $t_{1}$, a contradiction because
$b_{1}r_{1}^{2}s_{2}^{2}=b_{2}r_{2}^{2}s_{1}^{2}+s_{1}^{2}s_{2}^{2}$.
Similarly if $t_{1}|b_{2}$, then an odd power of $t_{1}$ divides
$b_{1}r_{1}^{2}s_{2}^{2}-b_{2}r_{2}^{2}s_{1}^{2}$ whereas an even power of
$t_{1}$ divides $s_{1}^{2}s_{2}^{2}$, a contradiction again. $\hfill\square$

In total there are $256$ different possibilities of
$(b_{1},b_{2})\in\mathbb{Q}(S,2)\times\mathbb{Q}(S,2)$. The next result shows
that it is sufficient to focus only on $16$ of those pairs. Before we state
our next result, for the sake of brevity we will assume $A$ is the image of
the set $E_{\Delta_{\tau,p}}(\mathbb{Q})_{tors}$ under the map $b$ that is,

$A=\\{(-1,-1),(1,2q),(1,1),(-1,-2q)\\}.$

######  Lemma 2.2.

Suppose $(b_{1},b_{2})\in\mathbb{Q}(S,2)\times\mathbb{Q}(S,2)$ such that
$(b_{1},b_{2})$ is image point of the group $E_{\Delta_{\tau,p}}(\mathbb{Q})$
modulo $2E_{\Delta_{\tau,p}}(\mathbb{Q})$. Then:
$[a]$ $b_{1}b_{2}>0$ always.
$[b]$ $b_{1}$ is odd always.
$[c]$ If $(b_{1},b_{2})\in Im(b)$ modulo $A$, then $b_{i}\in\\{1,p,q,pq\\}$
for $i=1,2$.

Proof: $b_{1}b_{2}<0$ together with equations (2.3) and (2.4) implies either
$p^{2}<0$ or $s^{2}<0$, a contradiction in either case. This immediately
proves $[a]$.
We now show that $b_{1}$ always has to be odd. Because $p$ is an odd prime,
from the equation (2.4) one can get
$p^{2}s^{2}=b_{1}b_{2}r_{3}^{2}-b_{1}r_{1}^{2}\equiv 0\ (mod\ 2)\implies
s\equiv 0$ $(mod\ 2)$ if $b_{1}$ is even. Then from the equation (2.3) we get,
$b_{1}r_{1}^{2}-b_{2}r_{2}^{2}=s^{2}\equiv 0\ (mod\ 4)$, which in turn implies
$b_{2}\equiv b_{1}\equiv 0\ (mod\ 2)$. This is because $(r_{1},s)=1=(r_{2},s)$
and $s\equiv 0\ (mod\ 2)$. So, $r_{1}\equiv r_{2}\equiv 1\ (mod\ 2)$. Now from
the equation (2.4) we get,

$b_{1}r_{1}^{2}=b_{1}b_{2}r_{3}^{2}-p^{2}s^{2}\equiv 0\ (mod\ 4)\\\ \implies
r_{1}\equiv 0\ (mod\ 2)$

as $b_{1}$ is square-free. This contradicts the fact that $(r_{1},s_{1})=1$.
Hence, $b_{1}\not\equiv 0\ (mod\ 2)$ and the assertion of part $[b]$ holds.
Now for part $[c]$, using the fact that $b$ is a homomorphism, we can now
immediately say that any pair $(b_{1},b_{2})\in Im(b)$ if and only if
$(b_{1},b_{2})\times(a_{1},a_{2})=(a_{1}b_{1},a_{2}b_{2})\in Im(b)$ where
$(a_{1},a_{2})\in A$. Hence without loss of generality, one can only focus on
examining the possibility of $(b_{1},b_{2})\in Im(b)$ where both $b_{1}$ and
$b_{2}$ belong to $Im(b)/A=\\{1,p,q,pq\\}$. This proves the statement of part
$[c]$. $\hfill\square$

We now systematically look into the rest of the sixteen possibilities for
$(b_{1},b_{2})$ as potential image points under the map $b$. The next result
shows there will be only one point to be concerned with.

######  Lemma 2.3.

Let $(b_{1},b_{2})$ be a pair such that $b_{i}\in\\{1,p,q,pq\\}$ for $i=1,2$.
If $(b_{1},b_{2})\neq(1,q)$ then $(b_{1},b_{2})\not\in Im(b)$ whenever
$p\equiv 5$ (mod $8$).

Proof: Suppose gcd $(b_{1},b_{2})\neq 1$ for some $(b_{1},b_{2})\in Im(b)$.
Then gcd $(b_{1},b_{2})$ is $p,q$ or $pq$. If $p$ divides gcd $(b_{1},b_{2})$
then $s\equiv 0$ (mod $p$) from equation (2.3). Also from equation (2.4), one
can observe that $b_{1}b_{2}r_{3}^{2}-p^{2}s^{2}=b_{1}r_{1}^{2}\equiv 0$
modulo $p^{2}$. Hence, $r_{1}\equiv 0$ modulo $p$ as $b_{1}$ is square-free.
This leads us to a contradiction as then $p$ divides gcd $(r_{1},s)=1$. So
$(b_{1},b_{2})\not\in Im(b)$ if gcd $(b_{1},b_{2})=p$ or $pq$. A very similar
argument proves that $q$ can also not divide gcd $(b_{1},b_{2})$ if
$(b_{1},b_{2})\in Im(b)$. So $(b_{1},b_{2})\in Im(b)$ implies that gcd
$(b_{1},b_{2})=1$. Now we are left with eight possible pairs of
$(b_{1},b_{2})$, i.e. $(1,p),(1,q),(1,pq),(p,1),(p,q),(q,1),(q,p)$ and
$(pq,1)$ (ignoring $(b_{1},b_{2})=(1,1)$ which is the image of $\mathcal{O}$
under the map $b$).
If $(b_{1},b_{2})=(1,pq)\in Im(b)$ then from equation (2.4), one gets that
$pqr_{3}^{2}-p^{2}s^{2}=r_{1}^{2}\equiv 0\ (mod\ p)$. But then from equation
(2.3), $p$ also divides $r_{1}^{2}-pqr_{2}^{2}=s^{2}$, a contradiction as gcd
$(r_{1},s)=1$. So $(1,pq)\not\in Im(b)$. A very similar argument shows that
$(pq,1)\not\in Im(b)$ either.
$(p,q)\not\in Im(b)$ as $(p,q)\in Im(b)$ implies
$pr_{1}^{2}-pqr_{3}^{2}=-p^{2}s^{2}$ from equation (2.4). This in turn implies
that $2r_{1}^{2}\equiv 2qr_{3}^{2}\equiv r_{3}^{2}$ (mod $p$), hence either
$\Big{(}\frac{2}{p}\Big{)}=1$ or $r_{1}\equiv r_{3}\equiv 0$ (mod $p$), a
contradiction either way as $p\equiv 5$ (mod $8$) and $(r_{1},s)=1$. If
$(q,p)\in Im(b)$, then from equation (2.4), we have
$qr_{1}^{2}-pqr_{3}^{2}=-p^{2}s^{2}\implies r_{1}^{2}\equiv 0\ (mod\ p)$. This
leads to a contradiction because from equation (2.3),
$s^{2}=qr_{1}^{2}-pr_{2}^{2}\implies s\equiv 0$ (mod $p$), hence $p$ divides
both $r_{1}$ and $s$. So $(q,p)\not\in Im(b)$. Now we are left with only four
possible image points for the homomorphism $b$. Those point are $(p,1)$
$(1,p),(q,1)$ and $(1,q)$.
$(q,1)\not\in Im(b)$ because otherwise $s\equiv 0$ (mod $q$) from equation
(2.4) and then $r_{2}\equiv 0$ (mod $q$) from equation (2.3). This leads to a
contradiction as gcd $(r_{2},s)=1$. Now $(1,p)\in Im(b)$ implies that
$r_{1}\equiv 0\ (mod\ p)$ from equation (2.4). Then from equation (2.3) one
can observe that $r_{1}^{2}-pr_{2}^{2}=s_{2}^{2}\equiv 0\ (mod\ p)$ which
implies $s\equiv 0\ (mod\ p)$, a contradiction, as $(r_{1},s)=1$. Similarly
$(p,1)\in Im(b)$ implies $pr_{3}^{2}-r_{2}^{2}=2qs^{2}\implies
pr_{3}^{2}\equiv r_{2}^{2}$ (mod $q$) from equations (2.3) and (2.4), a
contradiction if $r_{2}\not\equiv 0$ (mod $q$) as
$\Big{(}\frac{p}{q}\Big{)}\neq 1$ from Gauss’ quadratic reciprocity law and
the fact $p^{2}+1=2q$. But if $r_{2}\equiv r_{3}\equiv 0$ (mod $q$), then
again from the above equation, $2qs^{2}=pr_{3}^{2}-r_{2}^{2}\equiv 0$ (mod
$q^{2}$) which implies $s\equiv 0$ (mod $q$), a contradiction as gcd
$(r_{2},s)=1$. Hence $(1,p),(p,1)\not\in Im(b)$ and the result follows.
$\hfill\square$
We have excluded the possibility of every non-trivial pair $(b_{1},b_{2})$
being in the image of the homomorphism $b$, apart from the point $(1,q)$. now
we prove the following lemma which essentially proves the Theorem 1.1.

######  Lemma 2.4.

$(1,q)\not\in Im(b)$ if $p\equiv 5$ (mod $8$).

Proof: From the equations (2.3) and (2.4) we know that if $(1,q)\in Im(b)$,
then

(2.5) $\displaystyle r_{1}^{2}-qr_{2}^{2}=s^{2},$ (2.6) $\displaystyle
r_{1}^{2}-qr_{3}^{2}=-p^{2}s^{2}.$

for some
$(r_{1},r_{2},r_{3},s)\in\mathbb{Z^{*}}\times\mathbb{Z^{*}}\times\mathbb{Z}^{*}\times\mathbb{Z^{*}}$.
This in turn implies $r_{3}^{2}-r_{2}^{2}=qs^{2}$. From equation (2.6), we get
that either $\Big{(}\frac{q}{p}\Big{)}=1$ or $r_{1}\equiv r_{3}\equiv 0$ (mod
$p$). But $p\equiv 5$ (mod $8$) and $2q=p^{2}+1$ implies that
$\Big{(}\frac{q}{p}\Big{)}\neq 1$ and hence $r_{1}\equiv r_{3}\equiv 0$ (mod
$p$). But from equation (2.5), $r_{1}\equiv 0$ (mod $p$) implies either
$-q\equiv 0$ (mod $p$) or $r_{2}\equiv s\equiv 0$ (mod $p$), a contradiction
in either way as $\Big{(}\frac{-q}{p}\Big{)}\neq 1$ and gcd $(r_{2},s)=1$.
Hence $(1,q)\not\in Im(b)$. $\hfill\square$

Now for $p\equiv 5$ (mod $8$), the result of the Theorem 1.1 follows directly
from the observation that $(b_{1},b_{2})\in Im(b)$ only when they are the
images of one of the four torsion points. Hence the rank of the elliptic curve
$E_{\Delta_{\tau,p}}$ is zero when $p\equiv 5$ modulo $8$. We enlist a table
of few such curves and their corresponding rank below in support of our claim.
(Corresponding elliptic curve is $E:y^{2}=x^{3}+(p^{2}-1)x^{2}-p^{2}x$ and the
rank is verified @ http://magma.maths.usyd.edu.au/calc/ ).
For $p\equiv 3,7$ (mod $8$), we first observe that the same proof for $p\equiv
5$ (mod $8$) works, except for the image points $(b_{1},b_{2})=(1,q),(p,q)$
and $(p,1)$ where we have used the fact $p\equiv 5$ (mod $8$). In the
following lemma we prove that two of those three points can not appear as
image points even for the cases $p\equiv 3,7$ (mod $8$).

######  Lemma 2.5.

If $p\equiv 3$ (mod $4$), then $(p,q),(p,1)\not\in Im(b)$.

Proof: First let us suppose that $p\equiv 3$ (mod $8$). Then $(p,q)\not\in
Im(b)$ as $(p,q)\in Im(b)$ implies $pr_{1}^{2}-pqr_{3}^{2}=-p^{2}s^{2}$ from
equation (2.4). This in turn implies that $2r_{1}^{2}\equiv 2qr_{3}^{2}\equiv
r_{3}^{2}$ (mod $p$), hence either $\Big{(}\frac{2}{p}\Big{)}=1$ or
$r_{1}\equiv r_{3}\equiv 0$ (mod $p$), a contradiction either as
$\Big{(}\frac{2}{p}\Big{)}=-1$ whenever $p\equiv 3$ (mod $8$) and $r_{1}\equiv
r_{3}\equiv 0$ implies that $-p^{2}s^{2}\equiv 0$ (mod $p^{3}$) from equation
(2.4) which in turn implies $s\equiv 0$ (mod $p$), a contradiction as gcd
$(r_{1},s)=1$. Similarly, when $p\equiv 7$ (mod $8$), because from equation
(2.3), one gets $r_{2}^{2}\equiv-2s^{2}$ (mod $p$) which implies $r_{2}\equiv
s\equiv 0$ (mod $p$) or $\Big{(}\frac{-2}{p}\Big{)}=1$, contradiction either
way as gcd $(r_{2},s)=1$ and $\Big{(}\frac{-2}{p}\Big{)}=-1$ when $p\equiv 7$
(mod $8$). Hence $(p,q)\not\in Im(b)$ if $p\equiv 3$ (mod $4$).
Now $(p,1)\in Im(b)$ implies that $pr_{1}^{2}-r_{2}^{2}=s^{2}$ from equation
(2.3). This in turn implies $r_{2}^{2}\equiv-s^{2}$ (mod $p$). Hence either
$\Big{(}\frac{-1}{p}\Big{)}=1$ or $r_{2}\equiv s\equiv 0$ (mod $p$), again
contradiction either way as $p\equiv 3$ (mod $4$) and gcd $(r_{2},s)=1$. So
$(p,1)\not\in Im(b)$ when $p\equiv 3$ (mod $4$). $\hfill\square$
Now we can conclude the Theorem 1.1 by observing that for the cases $p\equiv
3,7$ (mod $8$), there exists only one possible image point (modulo the image
of the torsion group), that is $(1,q)$. Hence, when $p\equiv 3,7$ (mod $8$),
the rank of $E_{\Delta_{\tau,p}}$ is at most $1$. We enlist a few examples
below of such curves with rank one.

p | p mod 8 | q | Rank | p | p mod 8 | q | Rank
---|---|---|---|---|---|---|---
3 | 3 | 5 | 1 | 61 | 5 | 1861 | 0
5 | 5 | 13 | 0 | 71 | 7 | 2521 | 1
11 | 3 | 61 | 1 | 79 | 7 | 3121 | 1
29 | 5 | 421 | 0 | 739 | 3 | 273061 | 1

##  3\. Diophantine Equation and Heron Triangle

Given a Heron triangle with area $p$ and one of the angles $\theta$ such that
$\tau=\tan\frac{\theta}{2}=\frac{1}{p}$, in this section we show that the
Diophantine equation $(x^{2}+y^{2})^{2}+(2pxy)^{2}=z^{2}$ with gcd $(x,y)=1$
is solvable if and only if there exists a Heron triangle $\Delta_{\tau,p}$ of
the form mentioned above. We then conclude that there is no solution to the
aforementioned Diophantine equation when $p\equiv 5$ modulo $8$ with the help
of the Theorem 1.1 from the previous section. The main result of this section
is as follows:

######  Theorem 3.1.

For every fixed odd prime $p$, there is a one-one correspondence between the
solvability of the Diophantine equation $(x^{2}+y^{2})^{2}+(2pxy)^{2}=z^{2}$
with gcd $(x,y)=1$ and the existence of a Heron triangle with area $p$ and one
of the angles $\theta$ such that $\tan\frac{\theta}{2}=\frac{1}{p}$. Moreover,
if $p\equiv 5$ modulo $8$, then $(x^{2}+y^{2})^{2}+(2pxy)^{2}=z^{2}$ has no
solution if $p^{2}+1=2q$ for some prime $q$.

Proof of Theorem 3.1: We first notice that both $\sin\theta$ and $\cos\theta$
will be rational. From the laws of sines and cosines for a triangle, we get
the following;

(3.1) $\cos\theta=\frac{a^{2}+b^{2}-c^{2}}{2ab},\text{
}\sin\theta=\frac{2p}{ab},\text{
}\tan\frac{\theta}{2}=\frac{4p}{(a+b)^{2}-c^{2}}.$

From the equation (3.1) and the fact that we have assumed
$\tan\frac{\theta}{2}=\frac{1}{p}$, we arrived at the following conclusion;

(3.2) $(a+b)^{2}-c^{2}=4p^{2}\implies(a+b)^{2}=c^{2}+(2p)^{2}.$

Also from the equation (3.1) and the fact that
$\sin^{2}\theta+\cos^{2}\theta=1$, we get the following;

(3.3)
$\Big{(}\frac{a^{2}+b^{2}-c^{2}}{2ab}\Big{)}^{2}+\Big{(}\frac{2p}{ab}\Big{)}^{2}=1\implies
ab=1+p^{2}.$

Equations (3.2) and (3.3) together implies that
$(a-b)^{2}=(a+b)^{2}-4ab=c^{2}-4$. Assuming $a-b=u=\frac{u_{1}}{u_{2}}$ and
$c=w=\frac{w_{1}}{w_{2}}$, where both the representations are in their lowest
forms, we observe that
$\frac{w_{1}^{2}-4w_{2}^{2}}{w_{2}^{2}}=\frac{u_{1}^{2}}{u_{2}^{2}}$. Because
gcd $(w_{1}^{2}-4w_{2}^{2},w_{2}^{2})=1$, we can write $u_{2}^{2}=w_{2}^{2}$
and $u_{1}^{2}=w_{1}^{2}-4w_{2}^{2}$ which then implies
$w_{1}^{2}=u_{1}^{2}+4w_{2}^{2}$. From the fact that gcd $(w_{1},w_{2})=1$, it
can immediately be seen $w_{1},2w_{2}$ and $u_{1}$ are all pairwise coprime
and they form a Pythagorean primitive triplet. Hence, there exist integers
$m,n$ with $m>n$ such that gcd $(m,n)=1$ and $u_{1}=m^{2}-n^{2},\text{
}2w_{2}=2mn\text{ and }w_{1}=m^{2}+n^{2}.$ This implies
$c=\frac{w_{1}}{w_{2}}=\frac{m^{2}+n^{2}}{mn}=\frac{m}{n}+\frac{n}{m}$.
Similarly from the fact that $(a-b)^{2}=\frac{u_{1}^{2}}{w_{2}^{2}}$, one can
observe that $a-b=\frac{m}{n}-\frac{n}{m}$, under the assumption $a\geq b$
which implies that $b=a-(\frac{m}{n}-\frac{n}{m})$. If $b\geq a$, one can
change $a-b$ suitably. Now from the equation (3.2), we know that
$(a+b)^{2}=4p^{2}+c^{2}=4p^{2}+(\frac{m}{n}+\frac{n}{m})^{2}$, where replacing
$b$ as in the previous line, we get the following;

(3.4)
$a=\frac{\frac{m}{n}-\frac{n}{m}\pm\sqrt{(\frac{m}{n}+\frac{n}{m})^{2}+4p^{2}}}{2}=\frac{m^{2}-n^{2}\pm\sqrt{(m^{2}+n^{2})^{2}+(2pmn)^{2}}}{2mn}.$

This immediately gives us a solution to the Diophantine equation
$z^{2}=(x^{2}+y^{2})^{2}+(2pxy)^{2}$ with gcd $(x,y)=1$ in the form of

(3.5) $z=2mna-(m^{2}-n^{2}),\text{ }x=m\text{ and }y=n.$

For the converse implication, we start with the assumption that there exists
positive integers $x,y$ and $z$ such that gcd $(x,y)=1$ and
$z^{2}=(x^{2}+y^{2})^{2}+(2pxy)^{2}$. Define

(3.6)
$a=\frac{\frac{x}{y}-\frac{y}{x}+\sqrt{(\frac{x}{y}+\frac{y}{x})^{2}+4p^{2}}}{2}=\frac{\frac{x}{y}-\frac{y}{x}+\frac{z}{xy}}{2},\text{
}b=a-(\frac{x}{y}-\frac{y}{x})\text{ and }c=\frac{x}{y}+\frac{y}{x}.$

Then $a,b,c$ are all positive integers. Also, $ab=1+p^{2}\text{ and
}a-b=\frac{y}{x}-\frac{x}{y}.$ Now suppose we have a triangle with sides $a,b$
and $c$ and the angle $\theta$ between the sides of the length $a$ and $b$.
Then by the law of cosines,

$\cos\theta=\frac{a^{2}+b^{2}-c^{2}}{2ab}=\frac{(a-b)^{2}-c^{2}}{2ab}+1=\frac{p^{2}-1}{p^{2}+1}\in\mathbb{Q}.$

Similarly, from the formula of $\sin\theta=\sqrt{1-\cos^{2}\theta}$ we get,
$\sin\theta=\frac{2p}{p^{2}+1}=\frac{2p}{ab}$. This implies that the triangle
have area $\frac{1}{2}ab\sin\theta=p$. Substituting the values of $a,b$ and
$c$ in terms of $x,y$ and $z$ and observing the fact that
$z^{2}=(x^{2}+y^{2})^{2}+(2pxy)^{2}$, one can easily observe that
$\tan\frac{\theta}{2}=\frac{4p}{(a+b)^{2}-c^{2}}=\frac{1}{p}$ too. This
concludes the proof of the statement. $\square$

The following result looks into the solution of the Diophantine equation
$x^{2}+y^{2}+x^{2}y^{2}=p^{2}$ for some odd prime number $p$. The result
follows directly from Theorem 3.1.

######  Corollary 3.2.

For an odd prime $p$, there exists a Heron triangle with area $p$ and one
rational angle $\theta$ such that $\tan\frac{\theta}{2}=\frac{1}{p}$ whenever
the Diophantine equation $p^{2}=x^{2}+y^{2}+x^{2}y^{2}$ is solvable.

Proof: By Pythagoras’ primitive element theorem, any solution $(m,n,l)$ of
$(x^{2}+y^{2})^{2}+(2pxy)^{2}=z^{2}$ with gcd $(m,n)=1$ implies that there
exists co-prime natural numbers $r$ and $s$ such that
$m^{2}+n^{2}=r^{2}-s^{2}$, $2pmn=2prs$ and $l=r^{2}+s^{2}$. Hence $r=p$ and
$s=mn$ will be a possible solution if
$r^{2}-s^{2}=p^{2}-m^{2}n^{2}=m^{2}+n^{2}$. This concludes the proof of the
statement.

######  Example 3.3.

For $p=3$, one can notice that $x=2,y=1$ satisfies $x^{2}+y^{2}+x^{2}y^{2}=9$.
Using the explicit formula for $a,b,c$ from the Theorem 3.1, one can easily
obtain $a=4$, $b=\frac{5}{2}$ and $c=\frac{5}{2}$ to be the sides of a
triangle with area $3$ and one angle $\theta$ such that
$\sin\theta,\cos\theta\in\mathbb{Q}$ and $\tan\frac{\theta}{2}=\frac{1}{3}$.
$\square$

## Acknowledgement

The authors would like to thank Prof. Anupam Saikia for providing valuable
suggestions throughout this work. The first author would like to acknowledge
the fellowship and amenities provided by the Council of Scientific and
Industrial Research, India (CSIR) and BITS-Pilani, Hyderabad. The second
author would like to thank IIT-Guwahati for providing the fellowship and
amenities. The third author was supported by BITS-Pilani, Hyderabad.

## References

  * [1] Buchholz RH, Rathbun RL. An infinite set of Heron triangles with two rational medians. The American mathematical monthly. 1997 Feb 1;104(2):107-15.
  * [2] Buchholz RH, Stingley RP. Heron triangles with three rational medians. Rocky Mountain Journal of Mathematics. 2019 Apr;49(2):405-17.
  * [3] Chahal JS. Congruent numbers and elliptic curves. The American Mathematical Monthly. 2006 Apr 1;113(4):308-17.
  * [4] Coates JH. Congruent number problem. Pure and Applied Mathematics Quarterly. 2005 Jan;1(1):14-27.
  * [5] Conrad K. The congruent number problem. The Harvard College Mathematics Review. 2008;2(2):58-74.
  * [6] Goins EH, Maddox D. Heron triangles via elliptic curves. The Rocky Mountain Journal of Mathematics. 2006 Jan 1:1511-1526.
  * [7] Halbeisen L, Hungerbühler N. Heron triangles and their elliptic curves. Journal of Number Theory. 2020 Aug 1;213:232-53.
  * [8] Izadi FA, Khoshnam F, Nabardi K. A new family of elliptic curves with positive ranks arising from the Heron triangles. arXiv preprint arXiv:1012.5835. 2010 Dec 28.
  * [9] Johnstone JA, Spearman BK. Congruent number elliptic curves with rank at least three. Canadian Mathematical Bulletin. 2010 Dec;53(4):661-6.
  * [10] Kramer AV, Luca F. Some remarks on Heron triangles. Az Eszterházy Károly Tanárképző Főiskola tudományos közleményei (Új sorozat 27. köt.). Tanulmányok a matematikai tudományok köréből= Acta Academiae Paedagogicae Agriensis.. 2000:25-38.
  * [11] Rusin DJ. Rational triangles with equal area. New York J. Math. 1998;4(1):15.
  * [12] Silverman JH. The arithmetic of elliptic curves. Springer Science and Business Media; 2009 Apr 20.
  * [13] Yan XH. The Diophantine equation $(m^{2}+n^{2})^{x}+(2mn)^{y}=(m+n)^{2z}$. International Journal of Number Theory. 2020 Sep 23;16(08):1701-1708.


11institutetext: Friedrich-Alexander-Universität Erlangen-Nürnberg, Erlangen,
Germany
11email<EMAIL_ADDRESS>
# Deep Learning-based Anonymization of Chest Radiographs: A Utility-preserving
Measure for Patient Privacy

Kai Packhäuser  Sebastian Gündel  Florian Thamm  Felix Denzinger  Andreas
Maier

###### Abstract

Robust and reliable anonymization of chest radiographs constitutes an
essential step before publishing large datasets of such for research purposes.
The conventional anonymization process is carried out by obscuring personal
information in the images with black boxes and removing or replacing meta-
information. However, such simple measures retain biometric information in the
chest radiographs, allowing patients to be re-identified by a linkage attack.
Therefore, there is an urgent need to obfuscate the biometric information
appearing in the images. We propose the first deep learning-based approach
(PriCheXy-Net) to targetedly anonymize chest radiographs while maintaining
data utility for diagnostic and machine learning purposes. Our model
architecture is a composition of three independent neural networks that, when
collectively used, allow for learning a deformation field that is able to
impede patient re-identification. Quantitative results on the ChestX-ray14
dataset show a reduction of patient re-identification from 81.8 % to 57.7 %
(AUC) after re-training with little impact on the abnormality classification
performance. This indicates the ability to preserve underlying abnormality
patterns while increasing patient privacy. Lastly, we compare our proposed
anonymization approach with two other obfuscation-based methods (Privacy-Net,
DP-Pix) and demonstrate the superiority of our method towards resolving the
privacy-utility trade-off for chest radiographs.

###### Keywords:

Image Anonymization Patient Privacy Data Utility.

##  1 Introduction

Deep learning (DL) [19] has positively contributed to the development of
diagnostic algorithms for the detection and classification of lung diseases in
recent years [11, 20]. This progress can largely be attributed to the
availability of public chest X-ray datasets [4, 5, 14, 15, 27]. However, as
chest radiographs inherently contain biometric information (similar to a
fingerprint), the public release of such data bears the risk of automated
patient re-identification by DL-based linkage attacks [22]. This would allow
patient-related information, e. g., age, gender, or disease findings to be
revealed. Therefore, there is an urgent need for stronger privacy mechanisms
for chest X-ray data to alleviate the risk of linkage attacks.

Perturbation-based anonymization approaches [16] – such as differential
privacy (DP) [7, 8] – have become the gold standard to obfuscate biometric
identifiers from sensitive data. Such approaches are based on the postulate
that the global statistical distribution of a dataset is retained while
personal information is reduced. This can be realized by applying randomized
modifications, i. e. noise, to either the inputs [2, 6, 8], the computational
results, or to algorithms [1, 28]. Although originally proposed for
statistical data, DP has been extended to image data with the differentially
private pixelization method (DP-Pix) [9, 10]. This method involves pixelizing
an image by averaging the pixel values of each $b\times b$ grid cell, followed
by adding Laplace noise with 0 mean and $\frac{255m}{b^{2}\epsilon}$ scale.
Parameter $\epsilon$ is used to determine the privacy budget (smaller values
indicate greater privacy), while the $m$-neighborhood represents a sensitivity
factor. However, one major drawback of perturbation-based anonymization is the
potential degradation of image quality and an associated reduction in data
utility.

In recent years, DL has emerged as a prominent tool for anonymizing medical
images. In this context, synthetic image generation with privacy guarantees is
currently actively explored, aimed at creating fully anonymous medical image
datasets [21, 24]. Furthermore, adversarial approaches – such as Privacy-Net
[17] – have been proposed, which focus on concealing biometric information
while maintaining data utility. Privacy-Net is composed of a U-Net encoder
that predicts an anonymized image, an identity discriminator, and a task-
specific segmentation network. Through the dual process of deceiving the
discriminator and optimizing the segmentation network, the encoder acquires
the ability to obfuscate patient-specific patterns, while preserving those
necessary for the downstream task. However, while originally designed for
utility preservation on MRI segmentation tasks, the direct applicability and
transferability of Privacy-Net to other image modalities and downstream tasks
(e. g. chest X-ray classification) is limited. As we will experimentally
demonstrate in our study, more sophisticated constraints are required for the
utility-preserving anonymization of chest radiographs in order to successfully
maintain fine-grained abnormality details that are crucial for reliable
classification tasks.

In this work, we aim to resolve the privacy-utility trade-off by proposing the
– to the best of our knowledge – first adversarial image anonymization
approach for chest radiography data. Our proposed model architecture
(PriCheXy-Net) is a composition of three independent neural networks that
collectively allow for the learning of targeted image deformations to deceive
a well-trained patient verification model. We apply our method to the publicly
available ChestX-ray14 dataset [27] and evaluate the impact of different
deformation degrees on anonymization capability and utility preservation. To
evaluate the effectiveness of image anonymization, we perform linkage attacks
on anonymized data and analyze the respective success rates. Furthermore, to
quantify the extent of data utility preservation despite the induced image
deformations, we compare the performance of a trained thoracic abnormality
classification system on anonymized images versus the performance on real
data. Throughout our study, we utilize Privacy-Net [17] and DP-Pix [9, 10] as
baseline obfuscation methods.

Figure 1: PriCheXy-Net: Proposed adversarial image anonymization architecture.

##  2 Methods

###  2.1 Data

We use X-ray data from the ChestX-ray14 dataset [27], a large-scale collection
of $112{,}120$ frontal-view chest radiographs from $30{,}805$ unique patients.
The 8-bit gray-scale images are provided with a resolution of 1024$\times$1024
pixels. We resize the images to a size of 256$\times$256 pixels for further
processing. On average, the dataset contains $\approx$ 3.6 images per patient.
The corresponding 14 abnormality labels include Atelectasis, Cardiomegaly,
Consolidation, Edema, Effusion, Emphysema, Fibrosis, Hernia, Infiltration,
Mass, Nodule, Pleural Thickening, Pneumonia, and Pneumothorax. A patient-wise
splitting strategy is applied to roughly divide the data into a training,
validation, and test set by ratio 70:10:20, respectively. Based on this split,
we utilize available follow-up scans to randomly construct positive image
pairs (two unique images from the same patient) and negative image pairs (two
unique images from two different patients) – 10,000 for training, 2,000 for
validation, and 5,000 for testing. The resulting subsets are balanced with
respect to the number of positive and negative samples.

###  2.2 PriCheXy-Net: Adversarial Image Anonymization

The proposed adversarial image anonymization approach is depicted in Fig. 1.
It is composed of three trainable components: (1) A U-Net generator $G$ that
predicts a flow field $F$ used to deform the original image $x_{1}$ of
abnormality class $y_{c}$, (2) an auxiliary classifier that takes the modified
image $F(x_{1})$ resulting in corresponding class predictions $\hat{y}_{c}$,
and (3) a siamese neural network (SNN) that receives the deformed image
$F(x_{1})$ as well as another real image $x_{2}$ of either the same or a
different patient and yields the similarity score $\hat{y}_{v}$ for patient
verification. The U-Net serves as an anonymization tool aiming to obfuscate
biometric information through targeted image deformations, while the auxiliary
classifier and the patient verification model contribute as guidance to
optimize the flow field generator.

####  2.2.1 U-Net.

The U-Net [26] architecture is implemented according to Buda et al. [3]. Its
last sigmoid activation function is replaced by a hyperbolic tangent
activation function to predict a 2-channel flow field $F$, bounded by
$[-1,1]$. During training, especially in early stages, the raw output of the
U-Net may lead to random deformations that destroy the content of the original
images, thus revoking the diagnostic utility. To circumvent this issue, the
following constraints are imposed for $F$. First, to ensure that the learned
flow field $F$ does not substantially deviate from the identity $F_{id}$, it
is weighted with factor $\mu$ and subsequently subtracted from the identity
according to

$F=F_{id}-\mu F\enspace.$ (1)

Factor $\mu$ controls the degree of deformation, with larger values allowing
for more deformation. Note that the exclusive use of $F_{id}$ would result in
the original image, i. e., $x=F(x)$, assuming the deformation factor is being
set to $\mu=0$. The resulting flow field $F$ is Gaussian filtered (kernel size
$9$, $\sigma=2$) to ensure smooth deformations in the final image. The
corresponding parameters were selected manually in preliminary experiments.

####  2.2.2 Auxiliary Classifier.

To ensure the preservation of underlying abnormality patterns and image
utility during deformation, PriCheXy-Net integrates an auxiliary classifier
using CheXNet [25], a densely connected convolutional network (DenseNet) [13]
consisting of 121 layers. It outputs a 14-dimensional probability vector
$\hat{y}_{c}$ indicating the presence or absence of each abnormality appearing
in the ChestX-ray14 dataset. Its parameters $\theta_{aux}$ are initialized
using a pre-trained model that achieves a mean AUC of 80.5 %.

####  2.2.3 Patient Verification Network.

The incorporated patient verification model is represented by the SNN
architecture presented by Packhäuser et al. [22], consisting of two ResNet-50
[12] branches that are merged using the absolute difference of their resulting
128-dimensional feature vectors. A fully-connected layer with a sigmoid
activation function produces the final verification score $\hat{y}_{v}$ in the
value range of $[0,1]$, indicating the probability of whether or not the two
input images belong to the same patient. For initializing the network
parameters $\theta_{ver}$, we employ a pre-trained network that has been
created according to [22] yielding an AUC value of $99.4$ % for a patient
verification task.

###  2.3 Objective Functions

Similar to most adversarial models, our system undergoes training through the
use of dual loss functions that guide the model towards opposing directions.
To enforce the U-Net not to eliminate important class information while
deforming a chest radiograph, we introduce the auxiliary classifier loss
$L_{aux}(\theta_{G},\theta_{aux})$ realized by the class-wise binary cross
entropy (BCE) loss according to Eq. 2

$L_{aux}(\theta_{G},\theta_{aux})=-\sum_{i=1}^{14}[y_{c,i}\log(\hat{y}_{c,i})+(1-y_{c,i})\log(1-\hat{y}_{c,i})]\enspace,$
(2)

where $i$ represents one out of 14 abnormality classes. Conversely, to guide
the U-Net with deceiving the incorporated patient verification model, we
utilize its output as an additional verification loss term
$L_{ver}(\theta_{G},\theta_{ver})$ (see Eq. 3):

$L_{ver}(\theta_{G},\theta_{ver})=-\log(1-\hat{y}_{v})\enspace,\enspace\text{with
}\hat{y}_{v}=\text{SNN}\big{(}F(x_{1}),x_{2}\big{)}\enspace$ (3)

The total loss to be minimized (see Eq. 4) results from the sum of the two
partial losses $L_{aux}(\theta_{G},\theta_{aux})$ and
$L_{ver}(\theta_{G},\theta_{ver})$:

$\operatorname*{arg\,min}_{\theta_{G}}L(\theta_{G},\theta_{aux},\theta_{ver})=L_{aux}(\theta_{G},\theta_{aux})+L_{ver}(\theta_{G},\theta_{ver})$
(4)

Lastly, both the auxiliary classifier and the verification model are updated
by minimizing the loss terms in Eq. 5 and Eq. 6, respectively. Note that the
similarity labels for positive and negative pairs are encoded using $y_{v}=1$
and $y_{v}=0$.
$\operatorname*{arg\,min}_{\theta_{aux}}L(\theta_{G},\theta_{aux})$ (5)
$\operatorname*{arg\,min}_{\theta_{ver}}\left[-y_{v}\log\hat{y}_{v}-(1-y_{v})\log(1-\hat{y}_{v})\right]$
(6)

##  3 Experiments and Results

###  3.1 Experimental Setup

For all experiments, we used PyTorch (1.10.2) [23] and Python (3.9.5). We
followed a multi-part experimental setup consisting of the following steps.

####  3.1.1 Pre-training of the flow field generator.

The incorporated U-Net architecture was pre-trained on an autoencoder-like
reconstruction task for 200 epochs using the mean squared error (MSE) loss,
Adam [18], a batch size of 64 and a learning rate of $10^{-4}$ to enable
faster convergence. The model that performed best on the validation set was
then used for weight initialization in step 2.

####  3.1.2 Training of PriCheXy-Net.

After pre-training, PriCheXy-Net was trained in an end-to-end fashion for 250
epochs using the Adam optimizer [18], a batch size of 64 and a learning rate
of $10^{-4}$ using the objective functions presented above. To evaluate the
effect of the deformation degree $\mu$ on anonymization capability and image
utility, we performed multiple training runs with various values
$\mu\in\\{0.001,0.005,0.01\\}$. For each configuration, the U-Net that
performed best on the validation set was then used for further evaluations in
steps 3 and 4.

####  3.1.3 Re-training and evaluation of the verification model.

To assess the anonymization capability of PriCheXy-Net and to determine if the
anonymized images can reliably deceive the verification model, we re-trained
the incorporated SNN for each model configuration by using deformed images
only. We then simulated multiple linkage attacks by comparing deformed images
with real ones. Training was conducted until early stopping (patience $p=5$)
using the BCE loss, the Adam optimizer [18], a batch size of 32 and a learning
rate of $10^{-4}$. For each model configuration, we performed 10 independent
training and testing runs. We report the means and standard deviations of the
resulting AUC values.

####  3.1.4 Evaluation of the classification model on anonymized data.

To assess the extent to which underlying abnormalities, and thus data utility,
were preserved during the anonymization process, each individually trained
anonymization network was used to perturb the images of our test set. Then,
the pre-trained auxiliary classifier was evaluated using the resulting images.
We report the mean of the 14 class-wise AUC values. To quantify the
uncertainty, the 95 % confidence intervals (CIs) from $1{,}000$ bootstrap runs
were computed.

####  3.1.5 Comparison with other obfuscation-based methods.

To compare our proposed system with other obfuscation-based methods, we
additionally analyzed the anonymization capability and utility preservation of
Privacy-Net [17] and DP-Pix [9, 10]. Since Privacy-Net was originally proposed
for segmentation tasks, we replaced its segmentation component with the
auxiliary classifier. Then, the network was trained and evaluated in the exact
same setting as PriCheXy-Net. For DP-Pix, we investigated the effect of
different cell sizes $b\in\\{1,2,4,8\\}$ at a common privacy budget
$\epsilon=0.1$. The $m$-neighborhood was set to the smallest possible value
($m=1$) to prevent the added Laplace noise (mean: 0; scale:
$\frac{255m}{b^{2}\epsilon}$) from destroying the complete content of the
images.

Table 1: Quantitative comparison of all examined methods. The baseline performance results from leveraging non-anonymized real data. Verification: AUC (mean $\pm$ std) over 10 independent training and testing runs; Classification: mean AUC + 95 % CIs. Performance scores of 50 % indicate random decisions. |  Baseline |  Privacy-Net | PriCheXy-Net (Ours)
---|---|---|---
Task |  (real data) |  [17] |  $\mu=0.001$ |  $\mu=0.005$ |  $\mu=0.01$
Ver. $\downarrow$ |  $81.8\pm 0.6$ |  $49.8\pm 2.2$ |  $74.7\pm 2.6$ |  $64.3\pm 5.8$ |  $57.7\pm 4.0$
Class. $\uparrow$ |  $80.5\enspace_{80.1}^{80.9}$ |  $57.5\enspace_{56.9}^{58.1}$ |  $80.4\enspace_{79.9}^{80.8}$ |  $79.3\enspace_{78.9}^{79.7}$ |  $76.2\enspace_{75.8}^{76.6}$
|  |  DP-Pix [9, 10]
|  |  $b=1$ |  $b=2$ |  $b=4$ |  $b=8$
Ver. $\downarrow$ |  $81.8\pm 0.6$ |  $50.0\pm 0.7$ |  $50.4\pm 0.6$ |  $51.8\pm 1.3$ |  $52.5\pm 3.2$
Class. $\uparrow$ |  $80.5\enspace_{80.1}^{80.9}$ |  $50.0\enspace_{49.4}^{50.6}$ |  $50.3\enspace_{49.7}^{51.0}$ |  $52.7\enspace_{52.0}^{53.3}$ |  $52.9\enspace_{52.2}^{53.5}$

###  3.2 Results

####  3.2.1 Baseline and comparison methods.

The results of all conducted experiments are shown in Table 1. Compared to
real (non-anonymized) data, which enables a successful re-identification with
an AUC of 81.8 %, the patient verification performance desirably decreases
after applying DP-Pix (50.0 % - 52.5 %) and Privacy-Net (49.8 %). However,
while the classification performance on real data indicates a high data
utility with a mean AUC of 80.5 %, we observe a sharp drop for images that
have been modified with DP-Pix (50.0 % - 52.9 %) and Privacy-Net (57.5 %).
This suggests that relevant class information and specific abnormality
patterns are destroyed during the obfuscation process. Resulting example
images for both comparison methods are provided in Suppl. Fig. 1.

Figure 2: Visual illustration of the results and the associated privacy-
utility trade-off. The patient verification performance (y-axis) measures the
amount of privacy, whereas the abnormality classification performance (x-axis)
represents the level of data utility.

(a) real

(b) $\mu=0.001$

(c) $\mu=0.005$

(d) $\mu=0.01$

Figure 3: Chest radiographs resulting from PriCheXy-Net when using different
deformation degrees $\mu$. Images were cropped to better highlight the
diagnostically relevant area.

####  3.2.2 PriCheXy-Net.

The results of our proposed PriCheXy-Net (see Table 1) show more promising
behavior. As can be seen, increasing deformation degrees $\mu$ lead to a
successive decline in patient verification performance. Compared to the
baseline, the AUC decreases to 74.7 % ($\mu=0.001$), to 64.3 % ($\mu=0.005$),
and to 57.7 % ($\mu=0.01$), indicating a positive effect on patient privacy
and the obfuscation of biometric information. In addition, PriCheXy-Net hardly
results in a loss of data utility, as characterized by the constantly high
classification performance with a mean AUC of 80.4 % ($\mu=0.001$), 79.3 %
($\mu=0.005$), and 76.2 % ($\mu=0.01$). These findings are further visualized
in the privacy-utility trade-off plot in Fig. 2. In contrast to the examined
comparison methods, the data point corresponding to our best experiment with
PriCheXy-Net (green) lies near the top right corner, highlighting the
capability to closely satisfy both objectives in the privacy-utility trade-
off. Examples of deformed chest radiographs resulting from a trained model of
PriCheXy-Net are shown in Fig. 3. More examples are given in Suppl. Fig. 1.
Difference maps are provided in Suppl. Fig. 2.

##  4 Discussion and Conclusion

To the best of our knowledge, we presented the first adversarial approach to
anonymize thoracic images while preserving data utility for diagnostic
purposes. Our proposed anonymization approach – PriCheXy-Net – is a
composition of three independent neural networks consisting of (1) a flow
field generator, (2) an auxiliary classifier, and (3) a patient verification
network. In this work, we were able to show that collective utilization of
these three components enables learning of a flow field that targetedly
deforms chest radiographs and thus reliably deceives a patient verification
model, even after re-training was performed. For the best hyper-parameter
configuration of PriCheXy-Net, the re-identification performance drops from
$81.8$ % to $57.7$ % in AUC for a simulated linkage attack, whereas the
abnormality classification performance only decreases from $80.5$ % to $76.2$
%, which indicates the effectiveness of the proposed approach. We strongly
hypothesize that the promising performance of PriCheXy-Net can be largely
attributed to the constraints imposed on the learned flow field $F$. The
limited deviation of the flow field from the identity (cf. Eq. 1) ensures a
realistic appearance of the resulting deformed image to a considerable extent,
thereby avoiding its content from being completely destroyed. This idea has a
positive impact on preserving relevant abnormality patterns in chest
radiographs, while allowing adequate scope to obfuscate biometric information.
Such domain-specific constraints are not integrated in examined comparison
methods such as Privacy-Net (which directly predicts an anonymized image
without ensuring realism) and DP-Pix (which does not contain any mechanism to
maintain data utility). This is, as we hypothesize, the primary reason for
their limited ability to preserve data utility and the overall superiority of
our proposed system. Interestingly, PriCheXy-Net’s deformation fields
primarily focus on anatomical structures, including lungs and ribs, as
demonstrated in Fig. 3, Suppl. Fig. 1, and Suppl. Fig. 2. This observation
aligns with Packhäuser et al.’s previous findings [22], which revealed that
these structures contain the principal biometric information in chest
radiographs.

In future work, we aim to further improve the performance of PriCheXy-Net by
incorporating additional components into its current architecture. For
instance, we plan to integrate a discriminator loss into the model, which may
positively contribute to achieving perceptual realism. Furthermore, we also
consider implementing a region of interest segmentation step into the pipeline
to ensure not to perturb diagnostically relevant image areas. Lastly, we
hypothesize that our method is robust to variations in image size or
compression rate, and posit its applicability beyond chest X-rays to other
imaging modalities as well. However, confirmation of these hypotheses requires
further exploration to be conducted in forthcoming studies.

####  4.0.1 Data use declaration.

This research study was conducted retrospectively using human subject data
made available in open access by the National Institutes of Health (NIH)
Clinical Center [27]. Ethical approval was not required as confirmed by the
license attached with the open-access data.

####  4.0.2 Code availability.

The source code of this study has been made available at
https://github.com/kaipackhaeuser/PriCheXy-Net.

####  4.0.3 Acknowledgments.

The research leading to these results has received funding from the European
Research Council (ERC) under the European Union’s Horizon 2020 research and
innovation program (ERC Grant no. 810316). The authors gratefully acknowledge
the scientific support and HPC resources provided by the Erlangen National
High Performance Computing Center (NHR@FAU) of the Friedrich-Alexander-
Universität Erlangen-Nürnberg (FAU). The hardware is funded by the German
Research Foundation (DFG). The authors declare that they have no conflicts of
interest.

## References

  * [1] Abadi, M., Chu, A., Goodfellow, I., McMahan, H.B., Mironov, I., Talwar, K., Zhang, L.: Deep Learning with Differential Privacy. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. pp. 308–318 (2016)
  * [2] Bu, Z., Dong, J., Long, Q., Su, W.J.: Deep Learning with Gaussian Differential Privacy. Harvard Data Science Review 2020(23) (2020)
  * [3] Buda, M., Saha, A., Mazurowski, M.A.: Association of genomic subtypes of lower-grade gliomas with shape features automatically extracted by a deep learning algorithm. Computers in Biology and Medicine 109 (2019)
  * [4] Bustos, A., Pertusa, A., Salinas, J.M., de la Iglesia-Vayá, M.: PadChest: A large chest x-ray image dataset with multi-label annotated reports. Medical Image Analysis 66, 101797 (2020)
  * [5] Cohen, J.P., Morrison, P., Dao, L., Roth, K., Duong, T.Q., Ghassemi, M.: COVID-19 Image Data Collection: Prospective Predictions Are the Future. arXiv preprint arXiv:2006.11988 (2020)
  * [6] Dong, J., Roth, A., Su, W.J.: Gaussian Differential Privacy. arXiv preprint arXiv:1905.02383 (2019)
  * [7] Dwork, C.: Differential Privacy: A Survey of Results. In: International Conference on Theory and Applications of Models of Computation. pp. 1–19. Springer (2008)
  * [8] Dwork, C., McSherry, F., Nissim, K., Smith, A.: Calibrating Noise to Sensitivity in Private Data Analysis. In: Theory of Cryptography Conference. pp. 265–284. Springer (2006)
  * [9] Fan, L.: Image Pixelization with Differential Privacy. In: IFIP Annual Conference on Data and Applications Security and Privacy. pp. 148–162. Springer (2018)
  * [10] Fan, L.: Differential Privacy for Image Publication. In: Theory and Practice of Differential Privacy (TPDP) Workshop. vol. 1, p. 6 (2019)
  * [11] Gündel, S., Grbic, S., Georgescu, B., Liu, S., Maier, A., Comaniciu, D.: Learning to Recognize Abnormalities in Chest X-Rays with Location-Aware Dense Networks. In: Iberoamerican Congress on Pattern Recognition. pp. 757–765. Springer (2018)
  * [12] He, K., Zhang, X., Ren, S., Sun, J.: Deep Residual Learning for Image Recognition. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. pp. 770–778 (2016)
  * [13] Huang, G., Liu, Z., Van Der Maaten, L., Weinberger, K.Q.: Densely Connected Convolutional Networks. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. pp. 4700–4708 (2017)
  * [14] Irvin, J., Rajpurkar, P., Ko, M., Yu, Y., Ciurea-Ilcus, S., Chute, C., Marklund, H., Haghgoo, B., Ball, R., Shpanskaya, K., et al.: CheXpert: A Large Chest Radiograph Dataset with Uncertainty Labels and Expert Comparison. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 33, pp. 590–597 (2019)
  * [15] Johnson, A.E., Pollard, T.J., Berkowitz, S.J., Greenbaum, N.R., Lungren, M.P., Deng, C.y., Mark, R.G., Horng, S.: MIMIC-CXR, a de-identified publicly available database of chest radiographs with free-text reports. Scientific Data 6(1), 1–8 (2019)
  * [16] Kaissis, G.A., Makowski, M.R., Rückert, D., Braren, R.F.: Secure, privacy-preserving and federated machine learning in medical imaging. Nature Machine Intelligence 2(6), 305–311 (2020)
  * [17] Kim, B.N., Dolz, J., Jodoin, P.M., Desrosiers, C.: Privacy-Net: An Adversarial Approach for Identity-Obfuscated Segmentation of Medical Images. IEEE Transactions on Medical Imaging 40(7), 1737–1749 (2021)
  * [18] Kingma, D.P., Ba, J.: Adam: A Method for Stochastic Optimization. arXiv preprint arXiv:1412.6980 (2014)
  * [19] LeCun, Y., Bengio, Y., Hinton, G.: Deep learning. Nature 521(7553), 436–444 (2015)
  * [20] Maier, A., Syben, C., Lasser, T., Riess, C.: A gentle introduction to deep learning in medical image processing. Zeitschrift für Medizinische Physik 29(2), 86–101 (2019)
  * [21] Packhäuser, K., Folle, L., Thamm, F., Maier, A.: Generation of Anonymous Chest Radiographs Using Latent Diffusion Models for Training Thoracic Abnormality Classification Systems. arXiv preprint arXiv:2211.01323 (2022)
  * [22] Packhäuser, K., Gündel, S., Münster, N., Syben, C., Christlein, V., Maier, A.: Deep learning-based patient re-identification is able to exploit the biometric nature of medical chest X-ray data. Scientific Reports 12(1), 1–13 (2022)
  * [23] Paszke, A., Gross, S., Massa, F., Lerer, A., Bradbury, J., Chanan, G., Killeen, T., Lin, Z., Gimelshein, N., Antiga, L., et al.: PyTorch: An Imperative Style, High-Performance Deep Learning Library. Advances in Neural Information Processing Systems 32, 8026–8037 (2019)
  * [24] Pinaya, W.H., Tudosiu, P.D., Dafflon, J., Da Costa, P.F., Fernandez, V., Nachev, P., Ourselin, S., Cardoso, M.J.: Brain Imaging Generation with Latent Diffusion Models. In: Deep Generative Models: Second MICCAI Workshop, DGM4MICCAI 2022, Held in Conjunction with MICCAI 2022, Singapore, September 22, 2022, Proceedings. pp. 117–126. Springer (2022)
  * [25] Rajpurkar, P., Irvin, J., Zhu, K., Yang, B., Mehta, H., Duan, T., Ding, D., Bagul, A., Langlotz, C., Shpanskaya, K., et al.: CheXNet: Radiologist-Level Pneumonia Detection on Chest X-rays with Deep Learning. arXiv preprint arXiv:1711.05225 (2017)
  * [26] Ronneberger, O., Fischer, P., Brox, T.: U-Net: Convolutional Networks for Biomedical Image Segmentation. In: International Conference on Medical Image Computing and Computer-Assisted Intervention. pp. 234–241. Springer (2015)
  * [27] Wang, X., Peng, Y., Lu, L., Lu, Z., Bagheri, M., Summers, R.M.: ChestX-ray8: Hospital-Scale Chest X-ray Database and Benchmarks on Weakly-Supervised Classification and Localization of Common Thorax Diseases. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. pp. 2097–2106 (2017)
  * [28] Ziller, A., Usynin, D., Braren, R., Makowski, M., Rueckert, D., Kaissis, G.: Medical imaging deep learning with differential privacy. Scientific Reports 11(1), 1–8 (2021)

Suppl. Fig. 1: Example images resulting from different obfuscation-based
anonymization techniques at various hyper-parameter configurations. Row 1:
Real chest X-rays. Rows 2-4: PriCheXy-Net (ours). Row 5: Privacy-Net. Rows
6-9: DP-Pix. Suppl. Fig. 2: Visualizations of difference maps computed
according to $|x-F(x)|$ , with $F$ being the learned deformation field that is
applied to an image $x$. As shown, PriCheXy-Net targets anatomical structures,
such as lungs and ribs, which contain the principal biometric information in
chest radiographs.

Input : Images $\mathcal{X}_{1}$,

Images $\mathcal{X}_{2}$,

Class labels $\mathcal{Y}_{c}$,

Similarity labels $\mathcal{Y}_{v}$

Output : Network parameters $\theta_{G}$

/* Network initialization */

Initialize network parameters $\theta_{G}$, $\theta_{aux}$, $\theta_{ver}$;

/* Main loop */

for  _$\text{epoch}=1,...,E_{\text{max}}$_ do

for  _$\text{iter}=1,...,I_{\text{max}}$_ do

/* Random batch selection */

Randomly select batch $\mathcal{B}$;

/* Update flow field generator */

Update $\theta_{G}$ according to Eq. 4;

/* Update auxiliary classifier */

Update $\theta_{aux}$ according to Eq. 5;

/* Update verification network */

Update $\theta_{ver}$ according to Eq. 6;

end for

end for

return _$\theta_{G}$ ;_

Algorithm 1 Training procedure.

Input : Image $x$,

Network parameters $\theta_{G}$

Output : Anonymized image $F(x)$

/* Network initialization */

Initialize flow field generator $G$ with learned network parameters
$\theta_{G}$;

/* Flow field prediction */

Predict the flow field $F$ for image $x$ by applying the flow field generator
$G$;

/* Image anonymization */

Generate anonymized image $F(x)$ by applying the predicted flow field $F$ to
image $x$;

return _$F(x)$ ;_

Algorithm 2 Inference procedure.

Suppl. Fig. 3: Pseudocode that outlines the training procedure (Algorithm 1)
and the inference procedure (Algorithm 2), respectively.