Paper Info Reviews Author Feedback Meta-Review Back to top
List of Papers Browse by Subject Areas Author List

Abstract

The release of public 3D medical image segmentation (MIS) datasets accelerates clinical research but simultaneously heightens risks of unauthorized AI model training. While Unlearnable Examples (UE) offer protection by injecting imperceptible perturbations to prevent effective model learning, existing methods primarily target 2D scenarios. They neglect the volumetric spatial correlations and inter-slice anatomical consistency inherent in 3D medical volumes, which serve as critical learning priors for 3D segmentation networks. To bridge this gap, we propose VoxShield, a UE framework that explicitly targets the volumetric inductive biases of 3D networks. Our core insight is that by systematically dismantling the cross-slice continuity that 3D architectures rely on, we can fundamentally impair their spatial aggregation process. Specifically, we introduce an Inter-Slice Frequency Consistency Disruption mechanism that maximizes the spectral divergence between adjacent slices, injecting structural incoherence along the z-axis.Complementing this structural attack, a Semantic Prediction Disruption module is incorporated. By maximizing the L1 divergence between clean and perturbed logits, it forces the injected noise to penetrate the entire network and corrupt the final semantic mapping. Experiments on BraTS19 and FLARE21 demonstrate that VoxShield successfully degrades 3D segmentation performance, reducing the DSC from 80.0% to near 0.0% and from 88.6% to 6.8%, respectively. All protections are achieved with minimal perturbation (epsilon = 4/255) while preserving high visual fidelity. The code is available at https://github.com/KK266299/VoxShield

Links to Paper and Supplementary Materials

Main Paper (Open Access Version): https://papers.miccai.org/miccai-2026/paper/3104_paper.pdf

SharedIt Link: Not yet available

SpringerLink (DOI): Not yet available

Supplementary Material: Not Submitted

Link to the Code Repository

https://github.com/KK266299/VoxShield

Link to the Dataset(s)

BraTS19 dataset: https://www.med.upenn.edu/cbica/brats-2019/ FLARE21 dataset: https://flare.grand-challenge.org/

BibTex

@InProceedings{LiuXin_VoxShield_MICCAI2026,
        author = { Liu, Xinyao AND Deng, Zhipeng AND Jiang, Wenhan AND Wang, Haolin AND Lin, Xun AND Ou, Yafei AND Zheng, Yefeng},
        title = { { VoxShield: Protecting 3D Medical Datasets from Unauthorized Training via Frequency-Aware Inter-Slice Disruption } },
        booktitle = {Medical Image Computing and Computer Assisted Intervention -- MICCAI 2026},
        year = {2026},
        publisher = {Springer Nature Switzerland},
        volume = {LNCS 16896},
        month = {September},
        page = {pending}
}

Reviews

Review #1

  • Please describe the contribution of the paper

    The paper introduces VoxShield, a novel framework for generating unlearnable examples (UE) specifically designed for 3D medical image segmentation, addressing a gap where prior UE methods only work well for 2D data. Its main contribution is that 3D segmentation models rely heavily on cross-slice (volumetric) consistency, and that disrupting this property can effectively prevent models from learning.

    1.Inter-Slice Frequency Consistency Disruption perturbs adjacent slices to break their spectral continuity, undermining the spatial coherence that 3D models depend on. 2.Semantic Prediction Disruption forces divergence between predictions on clean vs. perturbed data, ensuring the perturbation propagates through the network and corrupts semantic learning.

  • Please list the major strengths of the paper: you should highlight a novel formulation, an original way to use data, demonstration of clinical feasibility, a novel application, a particularly strong evaluation, or anything else that is a strong aspect of this work. Please provide details, for instance, if a method is novel, explain what aspect is novel and why this is interesting.
    • a lot of baselines considered for evaluations, which are strong baselines.
    • the method is well motivated and easy to read and the equations are clear.
    • targets the problem of un-learnable examples for 3d data for which there is gaps in research.
    • anonymized code is shared which is much appreciated.
    • good ablation on the different components of the proposed loss.
  • Please list the major weaknesses of the paper. Please provide details: for instance, if you state that a formulation, way of using data, demonstration of clinical feasibility, or application is not novel, then you must provide specific references to prior work.
    • The work does not mention the use of augmentations used during training. Can the authors please share the augmentation used if any? If no augmentation were used can you please comment, either from your own experiments or previous work in the field, on the effectiveness of your method (and compared baselines) when augmentations are used [3, 4, 5]. I am mostly gearing this question towards the idea that augmentation can be seen as a “defence” against the attacked dataset just like in adversarial learning. As a simple test, does mean / median filtering make the examples learnable again (even if at a lower performance) or perhaps using a 3D nnUNet instead [5].
    • The work is quite related to the field of analysis computer vision models through frequency sensitivity [1]. The work essentially utilises this failure mode for their method which is great. However, there has been a lot of work in making models less frequency sensitive too. Have you considered performance with such models / training [2]? Can you share your intuition of how effective it will be?
    • The proposed method explicitly uses the segmentation masks of the training data. This opens up two questions: a. Is it a simple reversible process to make the dataset learnable again? For instance, if I suspect the data is made unlearnable, can I analyse the mask areas in the training images and since I would likely see a different frequency profile than the rest of the image (hypothetically), can I somehow remove these additional frequency response areas? b. Do you have any intuition or results for only a subset of classes has VoxShield applied to them and some subset does not? Does it make the overall image unlearnable or only the specific classes on which the VoxShield was applied.

    [1] Yin, D. , Lopes, R. G. , Shlens, J. , Cubuk, E. D. , & Gilmer, J. (2019). A Fourier Perspective on Model Robustness in Computer Vision. arXiv, 1906.08988.Retrieved from https://arxiv. org/abs/1906.08988v3 [2] Vaish, P. , Wang, S. , & Strisciuglio, N. (2024). Fourier-basis Functions to Bridge Augmentation Gap: Rethinking Frequency Augmentation in Image Classification. arXiv, 2403.01944.Retrieved from https://arxiv. org/abs/2403.01944v2 [3] Hendrycks, D. , Mu, N. , Cubuk, E. D. , Zoph, B. , Gilmer, J. , & Lakshminarayanan, B. (2019). AugMix: A Simple Data Processing Method to Improve Robustness and Uncertainty. arXiv, 1912.02781.Retrieved from https://arxiv. org/abs/1912.02781v2 [4] Vaish, P. , Meister, F. , Heimann, T. , Brune, C. , & Wolterink, J. M. (2025). Data-Agnostic Augmentations for Unknown Variations: Out-of-Distribution Generalisation in MRI Segmentation. arXiv, 2505.10223.Retrieved from https://arxiv. org/abs/2505.10223v1 [5] Isensee, F. , Wald, T. , Ulrich, C. , Baumgartner, M. , Roy, S. , Maier-Hein, K. , & Jaeger, P. F. (2024). nnU-Net Revisited: A Call for Rigorous Validation in 3D Medical Image Segmentation. arXiv, 2404.09556.Retrieved from https://arxiv. org/abs/2404.09556v2

  • Please rate the clarity and organization of this paper

    Good

  • Please comment on the reproducibility of the paper. Please be aware that providing code and data is a plus, but not a requirement for acceptance.

    The submission has provided an anonymized link to the source code, dataset, or any other dependencies.

  • Based on your review and your understanding of the MICCAI Scientific Code of Ethics, do you believe this submission may involve a potential ethics concern or violation?

    N/A

  • Optional: If you have any additional comments to share with the authors, please provide them here. Please also refer to our Reviewer’s guide on what makes a good review and pay specific attention to the different assessment criteria for the different paper categories: https://conferences.miccai.org/2026/en/REVIEWER-GUIDELINES.html

    N/A

  • Rate the paper on a scale of 1-6, 6 being the strongest (6-4: accept; 3-1: reject). Please use the entire range of the distribution. Spreading the score helps create a distribution for decision-making.

    (4) Weak Accept — marginally above the acceptance threshold, but would not mind if rejected, dependent on rebuttal

  • Please justify your recommendation. What were the major factors that led you to your overall score for this paper?
    • I agree this is a novel contribution to the field of 3D unlearable examples.
    • my main questions are on how effective the VoxShield method is in face of attempts to defend against it. I do not expect all the issues to be solved by VoxShield, but it is good to know when does this shield fail to further the research in this field.
  • Reviewer confidence

    Confident but not absolutely certain (3)

  • [Post rebuttal] After reading the authors’ rebuttal, please state your final opinion of the paper.

    N/A

  • [Post rebuttal] Please justify your final decision from above.

    N/A



Review #2

  • Please describe the contribution of the paper

    This paper proposes VoxShield, a novel approach to guard against unauthorized learning from 3D medical image segmentation data via the injection of imperceptible perturbations. The method optimizes for Inter-Slice Frequency Consistency Disruption and Semantic Prediction Disruption to prevent unauthorized models from extracting useful knowledge from a protected dataset. Evaluation on BraTS19 and FLARE21 demonstrates protection efficacy and cross-architecture transferability.

  • Please list the major strengths of the paper: you should highlight a novel formulation, an original way to use data, demonstration of clinical feasibility, a novel application, a particularly strong evaluation, or anything else that is a strong aspect of this work. Please provide details, for instance, if a method is novel, explain what aspect is novel and why this is interesting.

    (1) The methodology is well-motivated and sound. The inter-slice frequency consistency disruption module maximizes spectral divergence between adjacent slices, directly targeting the volumetric continuity prior assumed by most 3D segmentation models. This is complemented by a semantic prediction disruption module that maximizes the ℓ1 distance between clean and perturbed logits. The two components address distinct and complementary vulnerabilities, and their individual contributions are validated by the ablation study. (2) Evaluation on BraTS19 and FLARE21 confirms strong protective efficacy. (3) Cross-architecture transferability is demonstrated across common architectures (3D-UNet, Attention UNet, UNet++, and TransUNet). Ablations are clean and sufficient, clearly isolating the contribution of each loss component.

  • Please list the major weaknesses of the paper. Please provide details: for instance, if you state that a formulation, way of using data, demonstration of clinical feasibility, or application is not novel, then you must provide specific references to prior work.

    (1) It would strengthen the evaluation to include experiments against purification-based defenses (e.g., Invisible Image Watermarks Are Provably Removable Using Generative AI). Even if attack efficacy is not fully preserved after purification (which is fine and does not negate this work’s contribution), characterizing the method’s behavior under naive filtering or generative purification defenses would deepen understanding of its failure modes and help inform future defense-aware design.

    (2) It would be interesting to explore whether the perturbations transfer to tasks beyond segmentation, such as classification, detection, registration, reconstruction, or clinical regression (e.g., age prediction). I understand that the method is explicitly designed around segmentation, but the semantic disruption component may transfer well to other tasks, and the inter-slice frequency consistency disruption component may offer advantages in other volumetric learning settings as well.

    (3) It would be worth examining whether protection efficacy differs between normal anatomy / body parts segmentation and abnormality/lesion segmentation, as these tasks differ substantially in the nature of the learned features. The authors may also consider extending evaluation to additional imaging modalities or body regions to assess generalizability.

    (4) Would there be benefits from replacing logit divergence with divergence at intermediate feature layers?

  • Please rate the clarity and organization of this paper

    Good

  • Please comment on the reproducibility of the paper. Please be aware that providing code and data is a plus, but not a requirement for acceptance.

    The submission has provided an anonymized link to the source code, dataset, or any other dependencies.

  • Based on your review and your understanding of the MICCAI Scientific Code of Ethics, do you believe this submission may involve a potential ethics concern or violation?

    N/A

  • Optional: If you have any additional comments to share with the authors, please provide them here. Please also refer to our Reviewer’s guide on what makes a good review and pay specific attention to the different assessment criteria for the different paper categories: https://conferences.miccai.org/2026/en/REVIEWER-GUIDELINES.html

    N/A

  • Rate the paper on a scale of 1-6, 6 being the strongest (6-4: accept; 3-1: reject). Please use the entire range of the distribution. Spreading the score helps create a distribution for decision-making.

    (4) Weak Accept — marginally above the acceptance threshold, but would not mind if rejected, dependent on rebuttal

  • Please justify your recommendation. What were the major factors that led you to your overall score for this paper?

    I tentatively recommend acceptance given the well-motivated approach and empirical results. My final recommendation would be further solidified by a strong rebuttal.

  • Reviewer confidence

    Somewhat confident (2)

  • [Post rebuttal] After reading the authors’ rebuttal, please state your final opinion of the paper.

    N/A

  • [Post rebuttal] Please justify your final decision from above.

    N/A



Review #3

  • Please describe the contribution of the paper

    The paper proposes VoxShield, an Unlearnable Examples (UE) framework designed explicitly to target the volumetric inductive biases of 3D networks.It introduces an Inter-Slice Frequency Consistency Disruption mechanism that maximizes the spectral divergence between adjacent slices to inject structural incoherence along the z-axis.It incorporates a Semantic Prediction Disruption module that maximizes the L1 divergence between clean and perturbed logits to corrupt the final semantic mapping.

  • Please list the major strengths of the paper: you should highlight a novel formulation, an original way to use data, demonstration of clinical feasibility, a novel application, a particularly strong evaluation, or anything else that is a strong aspect of this work. Please provide details, for instance, if a method is novel, explain what aspect is novel and why this is interesting.

    Novel approach to 3D data protection: The methodology addresses a critical gap by explicitly targeting the volumetric spatial correlations and inter-slice anatomical consistency inherent in 3D medical volumes. Existing methods primarily target 2D scenarios and neglect these 3D priors.

    Strong empirical performance: The experiments clearly demonstrate that VoxShield successfully degrades 3D segmentation performance, dropping the DSC from 80.0% to near 0.0% on BraTS19 and from 88.6% to 6.8% on FLARE21. Cross-architecture transferability: The protective perturbations transfer effectively across various victim architectures. Protection successfully generalizes from a UNet surrogate to Attention UNet, UNet++, and TransUNet models.

    Preserved visual fidelity: The protection is achieved using a minimal perturbation budget of 4/255, ensuring that the visual quality of the medical scans is maintained.

  • Please list the major weaknesses of the paper. Please provide details: for instance, if you state that a formulation, way of using data, demonstration of clinical feasibility, or application is not novel, then you must provide specific references to prior work.

    Reliance on a single surrogate architecture: The study strictly uses a 3D UNet implemented in MONAI for both the surrogate model and the noise generator. The paper does not investigate whether using a different surrogate architecture (such as a Transformer-based model) during the generation phase would yield stronger or weaker cross-architecture transferability.

    Lack of perturbation budget ablation: The evaluation employs a strict, fixed perturbation budget set to 4/255.The submission lacks a sensitivity analysis to demonstrate how varying this threshold impacts the trade-off between imperceptibility and the degradation of segmentation performance.

    Limited loss weight justification: The optimization relies on fixed loss weights set to 0.2 and 0.05.The paper does not provide an ablation or explanation on how these specific hyperparameters were chosen or how sensitive the framework is to them.

  • Please rate the clarity and organization of this paper

    Good

  • Please comment on the reproducibility of the paper. Please be aware that providing code and data is a plus, but not a requirement for acceptance.

    The submission has provided an anonymized link to the source code, dataset, or any other dependencies.

  • Based on your review and your understanding of the MICCAI Scientific Code of Ethics, do you believe this submission may involve a potential ethics concern or violation?

    N/A

  • Optional: If you have any additional comments to share with the authors, please provide them here. Please also refer to our Reviewer’s guide on what makes a good review and pay specific attention to the different assessment criteria for the different paper categories: https://conferences.miccai.org/2026/en/REVIEWER-GUIDELINES.html

    N/A

  • Rate the paper on a scale of 1-6, 6 being the strongest (6-4: accept; 3-1: reject). Please use the entire range of the distribution. Spreading the score helps create a distribution for decision-making.

    (4) Weak Accept — marginally above the acceptance threshold, but would not mind if rejected, dependent on rebuttal

  • Please justify your recommendation. What were the major factors that led you to your overall score for this paper?

    The paper tackles a highly relevant and growing issue concerning the unauthorized AI model training on publicly released 3D medical image datasets.

    VoxShield provides a well-motivated and technically sound solution by systematically dismantling the cross-slice continuity that 3D architectures rely on.

    The results strongly support the claims, showing drastic performance drops on victim models while retaining high image quality.

    But there exists incomplete ablation of the noise generation pipeline: The study lacks essential experiments justifying its generation setup. It relies on fixed hyperparameters (e.g., a 4/255 perturbation budget and rigid loss weights) without providing a sensitivity analysis, and exclusively uses a single 3D-UNet surrogate without exploring how different surrogate architectures (such as Transformers) might influence the effectiveness and cross-architecture transferability of the generated noise.

  • Reviewer confidence

    Confident but not absolutely certain (3)

  • [Post rebuttal] After reading the authors’ rebuttal, please state your final opinion of the paper.

    N/A

  • [Post rebuttal] Please justify your final decision from above.

    N/A



Review #4

  • Please describe the contribution of the paper

    This paper extends the UE methodology to 3D segmentation tasks, by using interslice frequency interruption and adversarial semantic attack. Results on Brats and Flare demonstrate strong compression on segmentation metrics while preserving image similarity.

  • Please list the major strengths of the paper: you should highlight a novel formulation, an original way to use data, demonstration of clinical feasibility, a novel application, a particularly strong evaluation, or anything else that is a strong aspect of this work. Please provide details, for instance, if a method is novel, explain what aspect is novel and why this is interesting.

    This paper is well-organized and easy to read with enough details to follow. The insight of preventing unautohrized used of medical data is important in this AI age. The core idea of disruption slice-wise correlation is intuitive in the projection of 3d medical segmentation. Good results on the degradation of dice and HD on the two datasets using many victim models.

  • Please list the major weaknesses of the paper. Please provide details: for instance, if you state that a formulation, way of using data, demonstration of clinical feasibility, or application is not novel, then you must provide specific references to prior work.

    1.Sun, Y., Zhang, H., Zhang, T., Ma, X., Jiang, Y.G.: UnSeg: One universal unlearnable example generator is enough against all image segmentation. In: Advances in Neural Information Processing Systems (NeurIPS). vol. 37 (2024) the authors cited this NIPs 2024 paper, while the comparsion experiment is expected. 2.The performance of reducing dice to 0 is impressive, however, the visualization of the dice performance between [0,0.8] would be interesting to demonstrate the protection mechanism to the model predictions. 3.Since the ISC method is the key component, along with the alabtion study, the segmentation performance between consecutive slices is also important to validate the mechanism of the ISC. 4.nnUnet is missing in the victim models, and also may need experiments on the robustness of the method against strong preprocessing methods, for example, filtering and data augmentation methods. 5.In the ablation study, the ROI mask is also needed. Could the annotation-derived ROI mask introduce label-dependent shortcuts, since the perturbation location is directly correlated with the ground-truth labels?

  • Please rate the clarity and organization of this paper

    Good

  • Please comment on the reproducibility of the paper. Please be aware that providing code and data is a plus, but not a requirement for acceptance.

    The submission has provided an anonymized link to the source code, dataset, or any other dependencies.

  • Based on your review and your understanding of the MICCAI Scientific Code of Ethics, do you believe this submission may involve a potential ethics concern or violation?

    N/A

  • Optional: If you have any additional comments to share with the authors, please provide them here. Please also refer to our Reviewer’s guide on what makes a good review and pay specific attention to the different assessment criteria for the different paper categories: https://conferences.miccai.org/2026/en/REVIEWER-GUIDELINES.html

    N/A

  • Rate the paper on a scale of 1-6, 6 being the strongest (6-4: accept; 3-1: reject). Please use the entire range of the distribution. Spreading the score helps create a distribution for decision-making.

    (2) Reject — should be rejected, independent of rebuttal

  • Please justify your recommendation. What were the major factors that led you to your overall score for this paper?

    The experimental validation is not sufficient to support the paper’s very strong claims, especially the near-zero DSC results under extremely high similarity. Overall, the idea is interesting, but the current validation is not solid enough for MICCAI.

  • Reviewer confidence

    Confident but not absolutely certain (3)

  • [Post rebuttal] After reading the authors’ rebuttal, please state your final opinion of the paper.

    N/A

  • [Post rebuttal] Please justify your final decision from above.

    N/A



Author Feedback

We sincerely thank the meta reviewer and the reviewers for their time and constructive comments. We are committed to revising our manuscript according to the suggestions, which we believe will significantly improve the quality and clarity of our work. Below we address the main concerns.

1.Defenses and robustness (Meta-R#2, R#2, R#3, R#5). In our experiments, we evaluated mean/median filtering as a potential defense; these results were omitted due to page constraints. Filtering acts locally and cannot reconstruct the spectral coherence between adjacent slices that VoxShield deliberately destroys, and VoxShield maintained strong protection under these conditions. Due to page constraints, we were unable to include a more comprehensive defense evaluation; a broader assessment covering frequency augmentation during training and generative purification is an important direction we plan to pursue in future work.

2.Surrogate architecture and hyperparameters (R#4). We chose 3D UNet as the surrogate as it is a classic and well-performing architecture widely adopted in 3D medical segmentation. In addition, we conducted cross-architecture experiments, and the results show that perturbations transfer effectively to Attention UNet, UNet++, and TransUNet, showing that the attack targets the inter-slice continuity prior shared across all 3D architectures rather than any UNet-specific feature. Most existing UE methods operate at ε = 8/255, whereas VoxShield achieves strong protection at the stricter ε = 4/255, reflecting higher perturbation efficiency. The loss weights were determined via grid search, and Table 3 confirms both components contribute meaningfully.

3.Reversibility and partial-class protection (R#2). Regarding reversibility, we implemented a simple filtering-based defense and found it did not meaningfully restore the protected data, as filtering cannot reconstruct the inter-slice spectral coherence VoxShield destroys. We acknowledge that generative purification methods represent a more fundamental challenge and plan to investigate this in future work. Regarding partial-class protection, we thank the reviewer for raising this interesting point and view it as a worthwhile direction to explore in future work.

4.ROI mask and label shortcuts (R#5). We agree that the annotation-derived ROI mask may introduce label-correlated perturbation locations and that this deserves clarification. In our threat model, the ROI mask is used only by the data owner to concentrate the perturbation budget on anatomically meaningful regions, while the exploiter evaluates on clean test images without perturbations. Thus, such a perturbation-location cue cannot be directly relied upon at test time.

5.UnSeg comparison (R#5). We appreciate this suggestion. UnSeg is designed for 2D segmentation and relies heavily on SAM, making a faithful reimplementation for 3D volumetric segmentation non-trivial as it would require substantial architectural modifications. We believe the existing baseline suite including UMed, which is specifically designed for medical segmentation, already provides a representative comparison. That said, we agree that a comparison with UnSeg would further strengthen the evaluation and look forward to including it in future work.

We are genuinely grateful for the additional suggestions. On per-slice analysis, we conducted cross-slice comparisons and noise visualizations; per-slice performance differences were modest and inter-slice spectral variation was not visually prominent, consistent with the disruption operating at the volumetric feature level. We thank all reviewers once more for their constructive engagement.



Meta-Review

Meta-review #1

  • Your recommendation

    Provisional Accept

  • Please justify your decision. In case you deviate from the reviewers’ recommendations, explain in detail the reasons why. In case of an invitation for rebuttal, clarify which points are important to address in the rebuttal.

    For the camera-ready version, I would recommend that the authors discuss how VoxShield behaves under common preprocessing and defense strategies, including data augmentation, mean/median filtering, and purification-based defenses, and clarify whether augmentations were used during the victim model training.



back to top