ML Security PapersAMIF: Authorizable Medical Image Fusion Model with Built-in Authentication
Jie Song 1,2, Jun Jia 2, Wei Sun 3, Wangqiu Zhou 4, Tao Tan 1,2, Guangtao Zhai 2
Published on arXiv
2603.24296
Model Theft
OWASP ML Top 10 — ML05
Output Integrity Attack
OWASP ML Top 10 — ML09
Key Finding
Achieves flexible copyright protection with strong robustness against watermark removal attacks while maintaining fusion quality for authorized users
AMIF
Novel technique introduced
Multimodal image fusion enables precise lesion localization and characterization for accurate diagnosis, thereby strengthening clinical decision-making and driving its growing prominence in medical imaging research. A powerful multimodal image fusion model relies on high-quality, clinically representative multimodal training data and a rigorously engineered model architecture. Therefore, the development of such professional radiomics models represents a collaborative achievement grounded in standardized acquisition, clinical-specific expertise, and algorithmic design proficiency, which necessitates protection of associated intellectual property rights. However, current multimodal image fusion models generate fused outputs without built-in mechanisms to safeguard intellectual property rights, inadvertently exposing proprietary model knowledge and sensitive training data through inference leakage. For example, malicious users can exploit fusion outputs and model distillation or other inference-based reverse engineering techniques to approximate the fusion performance of proprietary models. To address this issue, we propose AMIF, the first Authorizable Medical Image Fusion model with built-in authentication, which integrates authorization access control into the image fusion objective. For unauthorized usage, AMIF embeds explicit and visible copyright identifiers into fusion results. In contrast, high-quality fusion results are accessible upon successful key-based authentication.
Key Contributions
- First authorizable medical image fusion model with built-in copyright protection via controllable watermarking
- Content-Conditioned Watermark Memory (CCWM) mechanism that embeds watermarks as model-internal capability rather than external post-processing
- Key-based authentication system enabling authorized users to obtain watermark-free fusion results while unauthorized users receive watermarked outputs
🛡️ Threat Analysis
The paper addresses model intellectual property protection through watermarking embedded in the MODEL to prevent unauthorized use and model distillation attacks. The watermark proves ownership and prevents IP theft of the fusion model itself.
The paper also watermarks the OUTPUT (fused medical images) to trace provenance and enable copyright protection of the generated content. The watermark is controllable - visible for unauthorized use, removable with valid authentication keys.