Robust retinal biometrics for patient identity verification and retrieval across age and imaging devices

Jose D. Vargas-Quiros; Dennis Bontempi; Jeroen Vermeulen; Bart Liefers; Sven Bergmann; Caroline C. W. Klaver

Source-linked AI summary

Robust retinal biometrics for patient identity verification and retrieval across age and imaging devices

Jose D. Vargas-Quiros, Dennis Bontempi, Jeroen Vermeulen, Bart Liefers, Sven Bergmann, Caroline C. W. Klaver

arXiv:2608.31094v1Aug 31, 2026cs.CV

TL;DR

Patient identity errors threaten longitudinal medical records and research databases, while prior retinal re-identification evidence left robustness and generalizability uncertain. The paper develops and evaluates a metric-learning retinal biometric system across longitudinal and independent datasets, achieving very high verification and retrieval performance but requiring quality filtering and target-context validation.

Problem
Patient identity errors can compromise longitudinal medical records, research databases, and downstream clinical decisions, while prior retinal re-identification studies did not establish robust generalization across datasets, devices, and longitudinal scenarios.
Method
A metric-learning identity encoder trained on longitudinal Rotterdam Study color fundus images is evaluated for identity verification and retrieval on held-out Rotterdam Study, UK Biobank, and AREDS data.
Results
The system achieved very high verification and retrieval performance across diverse datasets, devices, demographics, and acquisition conditions, with Recall@1 consistently above 0.97 after duplicate removal.
Takeaways & Limitations
Retinal biometrics may help detect assignment errors and retrieve identities, supporting safeguards and retrospective auditing of longitudinal clinical and research records.
Takeaways & Limitations
Performance is limited when retinal anatomy is poorly visible or retinal fields are inconsistent, and autonomous correction is not recommended without rigorous target-context validation.

Abstract

from arXiv · show

Patient identity errors can compromise longitudinal medical records, research databases, and downstream clinical decisions. We present a retinal biometric system for verifying claimed identities and retrieving the correct identity from color fundus images. We trained a 512-dimensional metric-learning encoder combining a ConvNeXtV2 backbone with ArcFace and triplet losses on 227,004 images from 21,851 patient-eye identities in the Rotterdam Study, spanning multiple imaging devices and up to 32.6 years of follow-up. The system was evaluated on held-out Rotterdam Study data and externally on the UK Biobank and Age-Related Eye Disease Study (AREDS). Before evaluation, we used the model to screen for identity inconsistencies and manually adjudicated flagged images, identifying incorrect assignments in 0.588% of Rotterdam Study images, 0.259% of UK Biobank images, and 0.164% of AREDS images. In retrospective-only verification after removing near-duplicate images, the system achieved AUROCs of 0.9998, 0.9997, and 0.9998 in the Rotterdam Study, UK Biobank, and AREDS, respectively. For identity retrieval using only previously acquired images, Recall@1 was 99.7%, 97.2%, and 97.6%, respectively, from galleries averaging 4436-8510 identities; the correct identity appeared among the top five results in at least 98.6% of cases. Performance remained robust across imaging devices and long follow-up intervals, while lower image quality and inconsistent retinal fields accounted for most failures. These findings establish retinal anatomy as a durable biometric signal, useful for safeguarding the integrity of longitudinal imaging records.

Introduction

Patient identity errors threaten longitudinal medical and research records, motivating retinal images as biometric identifiers. This study develops and evaluates an AI system for identity verification and retrieval across longitudinal ophthalmic cohorts.

Motivation: Patient identity errors can fragment records, misattribute findings, pollute research databases, and affect downstream decisions.Medical imaging workflows are vulnerable because identifiers are often entered manually at image capture.
Motivation: Retinal vascular patterns are highly individual, creating an opportunity to detect identity mismatches and recover the correct identity from images.This opportunity is relevant to expanding retinal imaging in screening, teleophthalmology, portable cameras, and primary care.
Research gap: Prior ophthalmic re-identification studies did not comprehensively evaluate transfer to independent datasets, imaging variability, or longitudinal scenarios.Near-duplicate images also raised concerns about whether reported retrieval reflected robust biometric recognition.
Study objective: The study develops and evaluates retinal identity verification and retrieval using longitudinal Rotterdam Study imaging, with external testing in UK Biobank and AREDS.The design spans diverse ages, devices, image-quality levels, and retinal fields.
Potential use: The authors propose retinal verification and retrieval as tools for mitigating human error through retrospective record correction and future safeguards.The system is made available for clinical and research purposes under an End User License Agreement.
System overview: The system uses a metric-learning identity encoder to cluster images from the same patient-eye and separate images from distinct patient-eyes.Its evaluated applications are identity verification and patient identity retrieval.

Training and evaluation databases

The study uses large, longitudinal color fundus imaging databases with varied devices, fields, and follow-up periods. Rotterdam Study data support development and testing, while UK Biobank and AREDS provide external evaluation cohorts.

Rotterdam Study: 327,519 Rotterdam Study images from 15,705 participants span zero to 32.61 years of follow-up.The dataset includes conventional monoscopic and stereoscopic cameras, macula- and optic-disc-centered fields, and averages 2.7 visits per patient.
Rotterdam Study: The Rotterdam Study identity-level split assigns data 70/10/20 to training, validation, and testing or benchmarking.Participant-eye combinations are treated as separate identities because laterality errors can misassign left and right eyes.
External cohorts: UK Biobank and AREDS provide independent population-based and longitudinal clinical databases for external evaluation.UK Biobank includes approximately 500,000 participants, while AREDS was collected across 11 US clinical sites.
External cohorts: UK Biobank external evaluation uses 8,880 macula-centered images from 2,254 patients with repeat imaging.Images were acquired at six assessment centers using a Topcon 3D OCT-1000 Mark II camera.
External cohorts: AREDS external evaluation includes 156,853 images from 4,474 patients and 8,882 patient-eye identities.The cohort has a mean follow-up of 7.2 years, with macula- and optic-disc-centered imaging from a Zeiss FF450 camera.

Identity encoder model development

The identity encoder is a metric-learning model designed to produce embeddings that distinguish patient-eye identities despite imaging differences. Its training combines a ConvNeXtV2 backbone, ArcFace and triplet objectives, identity-aware sampling, and augmentation for acquisition variability.

Model architecture and objective: The encoder combines additive angular-margin softmax loss with triplet loss to shape an identity-separating embedding space.The objective follows practices from face recognition and person re-identification for robustness to imaging differences.
Model architecture and objective: A ConvNeXtV2-Tiny backbone projects fundus images into a 512-dimensional embedding vector.The backbone is initialized with ImageNet-pretrained weights and followed by batch normalization.
Training procedure: PK sampling forms batches with 8 identities and 4 images per identity for metric learning.Hard triplet mining selects challenging examples within these same-identity and different-identity comparisons.
Training procedure: Identity-preserving augmentations simulate cropping, geometric, photometric, blur, noise, and occlusion variability.Random rectangular erasing covers up to 25% of the image area to reduce reliance on localized artifacts.
Training procedure: The backbone is fine-tuned end-to-end with AdamW, and inference compares normalized embeddings for verification and retrieval.Training uses validation mAP for hyperparameter and stopping-criterion selection.

Identity label audit of the evaluation databases

The evaluation databases undergo a model-assisted, expert identity-label audit before final performance testing. Screening prioritizes candidate inconsistencies, while ophthalmic researchers independently determine identity correctness and anatomy visibility.

Audit objectives: The audit targets wrong patient-eye assignments, images without visible anatomy, and reliable evaluation ground truth.It also measures identity mis-adjudication in large ophthalmic databases.
Screening and review: The identity encoder screens images for candidate inconsistencies, but experts—not model outputs—make final labeling decisions.This separates candidate selection from adjudication.
Screening and review: Within each patient-eye identity, pairwise embedding distances form a graph connecting images below a calibrated same-identity threshold.Candidate outliers are identified from the resulting identity-specific graph structure.
Expert adjudication: Reviewers compare each candidate outlier with its main cluster and classify it as incorrect identity, correct identity, anatomy not visible, or undecidable other.Reviewers are blinded to the model score or distance that triggered review.
Iterative audit: Audit rounds use thresholds calibrated for 5, 10, and 20 false alerts per 1,000 validation cases.Progressively permissive thresholds expand candidate review after confirmed errors and unusable images are excluded.

Evaluation of patient verification and identity retrieval performance

The system was evaluated as two related applications: verifying claimed patient identities and retrieving unknown identities from image galleries. Evaluation covered longitudinal scenarios, retinal regions, image quality, and embedding associations with device, demographic, and disease variables.

Patient verification: Verification compares a query embedding with claimed-identity references and flags assignments when the minimum Euclidean distance is large.Small minimum distances indicate consistency with the claimed identity; large distances indicate potentially incorrect assignments.
Evaluation design: Evaluation removes near-duplicate images within each eye and stratifies scenarios by retinal region and image-quality quartiles.Image quality was estimated with a deep-learning model trained on the EyePACS EyeQ dataset.
Identity retrieval: Retrieval ranks patient identities by comparing an unknown query embedding with eligible images in the full gallery.The gallery can include complete databases or only images acquired before the query.
Performance measures: Recall@1, Recall@5, and mAP summarize whether the correct identity ranks first, appears in the top five, and is well ranked across the result list.Recall@1 measures first-ranked accuracy, Recall@5 top-five inclusion, and mAP ranking quality across all results.
Embedding characterization: Embedding analyses tested prediction of imaging device, sex, age, ethnicity, hypertension, smoking, AMD, and glaucoma from Rotterdam Study test-set representations.Each patient-eye identity used its highest-quality CFI, with identity-level training, validation, and test splits.

Identity audit of UKBB, AREDS, and Rotterdam Study CFI databases

Experts audited model-flagged fundus images from the Rotterdam Study, UK Biobank, and AREDS databases by comparing vascular anatomy with reference-image clusters. The audit identified a small proportion of mis-adjudicated images and also recorded cases where anatomy was not visible or retinal regions differed.

Audit procedure: Experts reviewed model-flagged images by comparing vascular patterns in flagged images with those in majority-cluster reference images.Each case was classified as wrong identity, correct identity, or undecidable.
Threshold behavior: Looser thresholds produced more candidate flags, while database cleaning reduced correct flags and low-quality cases until most remaining flags were incorrect or undecidable.Audit thresholds were calibrated at 5, 10, and 20 false positives per 1000 samples.
Audit results: 0.588% of Rotterdam Study evaluation images, 0.164% of AREDS images, and 0.259% of UK Biobank images were identified as mis-adjudicated.In UK Biobank, these cases reflected incorrectly recorded eye laterality rather than patient identity.
Audit results: 0.615% of Rotterdam Study images, 0.224% of AREDS images, and 6.15% of UK Biobank images had no recognizable anatomy.These cases were attributed to acquisition failure or extremely poor image quality.

Patient verification

The retinal biometric system accurately verified patient identities and retrieved correct identities across longitudinal, multi-device datasets, including external cohorts. Performance was strongest with consistent retinal anatomy and higher-quality images, while image quality and field-of-view differences explained many errors.

Generalization: Performance remained strong across imaging devices and external datasets, including UK Biobank with one reference image per query and AREDS with non-standard imaging regions.External performance was near-perfect for disc-centered or higher-quality images, while quality-level differences were larger in UK Biobank and AREDS than in Rotterdam Study.
Identity auditing: 0.6% or less of Rotterdam Study images and 0.2% or less of AREDS and UK Biobank images were estimated to be mis-adjudicated.Expert review of model-flagged images identified a small proportion of incorrect assignments in all three databases.
Scenario effects: 0.2 FP/1000 and 3.3 FN/1000 were observed for retrospective verification of optic-disc-centered images in Rotterdam Study.Disc-centered images performed better than macula-centered images, likely because major retinal vessels were more visible.
Identity retrieval: 99.7% Recall@1 was obtained in Rotterdam Study retrospective-only retrieval from an average gallery of 4,436 identities.The correct identity ranked among the top five results in at least 98.6% of cases across databases, and gallery size did not appear to drive performance.
Failure modes: Lower-quality images, severe occlusion, and non-standard or inconsistent retinal regions accounted for many verification and retrieval failures.The model’s top matches in difficult cases often had similar image characteristics, and anatomy-related differences could challenge human adjudication as well.

A word on privacy

Retinal biometric systems can identify patients but may also enable cross-database de-anonymization if linked reference data are available. These risks create uncertainty around sharing ophthalmic images and motivate controlled access and safeguards.

A retinal identity encoder could cross-reference images across databases and de-anonymize patient information if an attacker possessed a linked reference database.
Public retinal-biometric algorithms may influence policy decisions about sharing ophthalmic images and potentially curtail research progress.

Data Availability

The primary Rotterdam Study dataset is available through a controlled request process rather than a public repository. Access is restricted by privacy regulations and participant consent.

Rotterdam Study data can be obtained upon request through the study management team’s approval protocol.
Privacy regulations and informed consent prevent the dataset from being freely available in a public repository.

Appendix A. AI model development

Model development used color fundus images organized by patient-eye identity, with strong augmentation for training and unmodified images for validation. Stereoscopic images were included.

Each batch row contained color fundus images from the same patient-eye identity.
Training samples underwent heavy augmentations, whereas validation samples were kept as-is.
Stereoscopic color fundus images were included during model development.

Appendix B. Identity label audit of the evaluation databases.

The identity label audits showed how the system’s flagged images were reviewed against identity clusters by human experts. Reviewers classified cases as incorrect, correct, or undecidable, with poor quality and mismatched retinal regions driving uncertainty.

Reviewers compared flagged images with the main identity cluster and classified assignments as incorrect, correct, or undecidable.
Most flagged Rotterdam Study and AREDS images were relatively poor quality, requiring expert comparison of vascular patterns with reference images.
Different-region images were undecidable when they depicted a retinal region different from the reference images.
UK Biobank low-quality images were those too poor for a decision during expert review.

Appendix C. Complimentary retrieval evaluation

The appendix illustrates complementary retrieval and verification evaluations across the Rotterdam Study, UK Biobank, and AREDS databases, including incorrect retrieval cases and verification errors.

Retrospective + prospective retrieval: Supplementary Table 1 reports retrospective + prospective identity retrieval results for the Rotterdam Study, UK Biobank, and AREDS CFI databases.This scenario gives the system access to retrospective and prospective imaging relative to each query’s acquisition date.
Verification error cases: Supplementary Figures 7–12 provide false-positive and false-negative verification examples for the Rotterdam Study, UK Biobank, and AREDS databases.The false-positive examples show same-identity assignments flagged as incorrect, whereas the false-negative examples use queries deliberately sampled from a different eye that the model failed to flag.
Incorrect retrieval cases: Supplementary Figures 13 and 14 show cases where the model retrieved an incorrect patient identity in retrospective-only and retrospective + prospective evaluations.In both figures, the query identity differs from the model’s displayed top match across the RS, UKBB, and AREDS databases.