RadVeil

Fast, verified face and ear anonymization for volumetric head imaging.
MRI and CT · NIfTI / DICOM / raw arrays · Rust core, Python API, C bindings, CLI

Website · Documentation · Browser demo · Quickstart · Examples · Legal notes

_{3D Slicer's public "MRHead" sample: input · adaptive · face + ears (ears cut) · the voxels that changed · the region (amber) vs the extracted brain (blue), 5 mm apart.}

RadVeil finds the face the way an attacker would — by rendering the volume as a 3D portrait and running a face detector on it — removes it, and accepts the result only when the detector fails on the output. Ears are removed on request and located by measuring the surface, not by assuming an offset. Every voxel outside the anonymized region is preserved bit-exact: same datatype, same scaling, same header.

Quick start

pip install radveil                        # prebuilt wheels, no model download, no compiler
cargo install radveil-cli                  # or: the single-binary CLI

import radveil

report = radveil.deface_auto("t1.nii.gz", "t1_defaced.nii.gz", mode="adaptive")
# {'views_detected': 3, 'residual_detections': 0, 'eye_dist_mm': 63.1, ...}

# the pinna is biometric too — opt in (face-only remains the default)
report = radveil.deface_auto("t1.nii.gz", "t1_defaced.nii.gz",
                             region="face+ears", mode="adaptive", ear_mode="cut")
# rois: [{'label': 'ear_left', 'detected': True, 'protrusion_mm': 14.0}, ...]

radveil auto t1.nii.gz t1_defaced.nii.gz --report report.json

The face detector is built in: the MediaPipe BlazeFace and Face Mesh models (Apache-2.0) are embedded in the library and run by RadVeil's own small pure-Rust SIMD inference engine. There is no ML framework, Bazel or TensorFlow in the build, and no Python is needed for the CLI or C API. dlib is available in Python as an optional second detector or fallback (fallback_detector="dlib"); either way, the output is verified against the built-in detector too.

Why RadVeil

• Attacker-model localization — no atlas, no registration. A 2D face detector on CPU-rendered surface views pinpoints the face, and per-pixel position maps lift the 2D landmarks into scanner space. Detections must agree in 3D across views (shape consensus) before anything is modified.
• Closed-loop verification — the output is re-rendered and re-attacked from the detection views and a grid around them (verify_effort: fast, balanced, thorough). Blur escalates, and an opaque fill guarantees termination. If no plausible face exists (non-head data, already-defaced scans, a "face" on a field-of-view cut) it refuses loudly instead of modifying anything.
• Skin-deep and auditable — the face region follows the measured skin (~4.5 mm deep, skin_depth_mm, chosen to stay above the skull). Only voxels inside the exported binary mask change.
• Brain-aware — on the public SynthStrip evaluation set (201 scans processed, the rest refused) the face region touched the expert brain mask on none; median clearance 6.6 mm. The opt-in brain guard (brain_guard=True, --brain-guard) never modifies the brain or anything within 3 mm of it.
• Zero tuning — geometric parameters auto-scale from the detected inter-eye distance; works across sequences, resolutions, storage orientations (LPS/RAS/oblique/wrong affines), head sizes, MRI and CT.
• Fast, CPU-only — ~0.3 s per volume in a warm process, ~11 volumes/s batched on a laptop CPU (deployment, performance). SIMD kernels with runtime dispatch and a portable fallback.

Modes and regions

The ear is a stable biometric identifier that survives most defacers, but no landmark model emits ear points. RadVeil ray-marches the volume into a surface height map, derives the scalp baseline by morphological opening, and detects each pinna as a protrusion blob of the right shape and position. Every ear ROI reports detected and protrusion_mm; an ear outside the field of view is flagged, never silently missed.

Opt-in refinements (all off by default):

Details, measurements and every knob: parameters & tuning.

Interfaces

• Python — deface_auto (file → file), deface_volume (in memory: DICOM series via any reader, raw arrays via Volume.from_array, uploads via Volume.from_bytes / to_bytes), deface_batch (multi-threaded cohorts), plus a step-by-step API (render / detect_landmarks / lift_landmarks / Volume.deface). anonymization_mask returns the region without modifying anything, for callers who process it themselves.
• CLI — radveil auto (one step, --report JSON), radveil deskull (brain extraction), radveil conform, plus info | render | deface.
• C — libradveil + radveil.h: radveil_deface_auto, radveil_anonymization_mask, radveil_deskull, and the low-level load / render / deface / save calls.
• Bring your own detector — any callable returning 68 landmarks (detector=f(rgb, try_rotations)).

Brain extraction

radveil deskull / radveil.deskull() / radveil_deskull() write a binary brain mask, the skull-stripped volume, or both:

radveil deskull t1.nii.gz -o t1_brain.nii.gz --mask-out brain_mask.nii.gz

• synthstrip (default) — the SynthStrip network (Hoopes et al., NeuroImage 2022) reimplemented in pure Rust with embedded weights (MIT). Works on any MRI contrast, CT and PET. Masks match the reference mri_synthstrip at Dice 0.992–1.000, in ~3.5 s on a 1 mm 256³ MPRAGE on a laptop CPU.
• classical — model-free; a BET-style deformable surface for MRI (optionally anchored by the detected face), bone-enclosed soft tissue for CT.
• rvbrain — experimental; loads your own smaller .rvb network (format in rvbrain.rs). No trained weights ship yet.

radveil auto --brain-check reports how many brain voxels the anonymization touched and how close it came; the CLI exits with status 3 if any were modified, so a batch can stop on it.

If you publish results from the synthstrip method, please cite Hoopes et al., NeuroImage 260 (2022) 119474.

Guarantees and limits

• Voxels outside the mask are bit-identical to the input (tested in CI on synthetic phantoms).
• Output keeps the input datatype, scl_slope / scl_inter, affine and header. Header metadata is deliberately not scrubbed — that is your de-identification pipeline's job (legal notes).
• Verification demonstrates resistance to the embedded detector class, not to every conceivable attack; the exported mask supports independent audit.
• 3D volumes only (split 4D series first). CT is validated on synthetic Hounsfield phantoms; multi-subject CT evaluation is pending.

Building from source

cargo build --release                                   # core + CLI (+ C lib: -p radveil-capi)
pip install maturin && maturin develop --release        # Python module
cargo test --workspace --release && pytest tests/       # phantoms only, no data needed

Releases are automated from version tags: wheels, the CLI and the C library for Linux, macOS and Windows, with SBOMs and checksums (release.yml, RELEASING.md, SBOM). Contributions are welcome — see CONTRIBUTING.md; report vulnerabilities via SECURITY.md.

Citing

If RadVeil is part of your anonymization pipeline, please cite it — it makes your de-identification reproducible.

@software{radveil,
  author  = {Gródek, Piotr},
  title   = {{RadVeil: CPU-only face and ear anonymization for volumetric head imaging}},
  url     = {https://github.com/rAum/radveil},
  version = {0.1.0},
  year    = {2026}
}

A methods sentence you can adapt: "Facial and auricular surfaces were removed with RadVeil v0.1.0 (region="face+ears", mode="adaptive"), which verifies each output by re-rendering the volume and re-running the face detector; all voxels outside the anonymization mask are unchanged." Machine-readable metadata: CITATION.cff.

License

Copyright 2026 Piotr Gródek and the RadVeil contributors. Licensed under the Apache License, Version 2.0; see also NOTICE.

Bundled third-party components keep their own licenses (THIRD_PARTY_LICENSES.txt):

• MediaPipe BlazeFace and Face Mesh model weights — © Google LLC, Apache-2.0, embedded in a converted format (provenance).
• SynthStrip weights — Hoopes et al., MIT.
• dlib (optional, Boost license) — defaults to dlib's CC0 5-point model; its research-only 68-point models are used only if you pass one explicitly.

A default install contains only permissively licensed components; see the commercial-use summary. No imaging data is contained in this repository: tests use synthetic phantoms, and the only rendered face (site/img/) is 3D Slicer's public "MRHead" sample, regenerated by tools/make_site_images.py.

Disclaimer

RadVeil is a personal, open-source project developed in the author's spare time, on personal equipment. It is not affiliated with, sponsored or endorsed by, and does not represent any current or former employer of the author; the views and code here are the author's own. Names of third-party projects (MediaPipe, SynthStrip, dlib, 3D Slicer) are used only to identify the components and data RadVeil uses and do not imply endorsement by their owners.

Generative AI tools were used in developing this project, including code, documentation and the website. All of it was reviewed by the author, who remains responsible for it.

RadVeil is provided "as is", without warranty of any kind (see the license). It is not a medical device, is not intended for diagnosis or treatment, and does not by itself make data compliant with any privacy regulation. You are responsible for validating it for your use case.