Image Registration is a crucial task in medical imaging applications, allowing to spatially align imaging features between two or multiple scans. Registration methods are today a central component of state-of-the-art methods for atlas-based segmentation (Shattuck et al., 2009, Cardoso et al., 2013), morphological and functional analysis (Dale et al., 1999, Ashburner and Friston, 2000), multi-modal data integration (Heinrich et al., 2011), and longitudinal analysis (Reuter et al., 2010, Ashburner and Ridgway, 2013). Typical registration paradigms are based on a given transformation model (e.g. affine or non-linear), a cost function and an associated optimization routine. A large number of image registration approaches have been proposed in the literature over the last decades, covering a variety of assumptions on the spatial transformations, cost functions, image dimensionality and optimization strategy (Schnabel et al., 2016). Image registration is the workhorse of many real-life medical imaging software and applications, including public web-based services for automated segmentation and labeling of medical images. Using these services generally requires uploading and exchanging medical images over the Internet, to subsequently perform image registration with respect to one or multiple (potentially proprietary) atlases. Besides these classical medical imaging use-cases, emerging paradigms for collaborative data analysis, such as Federated Learning (FL) (McMahan et al., 2017), have been proposed to enable analysis of medical images in multicentric scenarios for performing group analysis (Gazula et al., 2021) and distributed machine learning (Kaissis et al., 2021, Zerka et al., 2020). However, in these settings, typical medical imaging tasks such as spatial alignment and downstream operations are generally not possible without disclosing the image information.

Due to the evolving juridical landscape on data protection, medical image analysis tools need to be adapted to guarantee compliance with regulations currently existing in many countries, such as the European General Data Protection Regulation (GDPR)1, or the US Health

Insurance Portability and Accountability Act (HIPAA)2. Medical imaging information falls within the realm of personal health data (Lotan et al., 2020) and its sensitive nature should ultimately require the analysis under privacy preserving constraints, for instance by preventing to share the image content in clear form.

Advanced cryptographic tools hold great potential in sensitive data analysis problems (e.g., Lauter (2021)). Examples of such approaches are Secure-Multi-Party-Computation (MPC) (Yao, 1982) and Homomorphic Encryption (HE) (Rivest et al., 1978). While MPC allows multiple parties to jointly compute a common function over their private inputs and discover no more than the output of this function, HE enables computation on encrypted data without disclosing either the input data or the result of the computation.

This work presents privacy-preserving image registration (PPIR), a new methodological framework allowing image registration under privacy constraints. To this end, we reformulate the image registration problem to integrate cryptographic tools, namely MPC or FHE, thus preserving the privacy of the image data. Due to the well-known scalability issues of such cryptographic techniques, we investigate strategies for the practical use of PPIR. In our experiments, we evaluate the effectiveness of PPIR on a variety of registration tasks and medical imaging modalities. Our results demonstrate the feasibility of PPIR and pave the way for the application of secured image registration in sensitive medical imaging applications.