DentPriv-Bench3D: An Adversarial Security Benchmark for Adaptive Re-Identification Attacks and Privacy–Utility Trade-Offs in 3D Intraoral Scan Release

Three-dimensional (3D) intraoral scans (IOS) retain patient-specific morphology after removal of direct identifiers, creating privacy risks when geometric records are released. We introduce DentPriv-Bench3D, an adversarial security benchmark evaluating identity leakage under fixed and mechanism-aware attackers alongside segmentation-based utility. Using 1800 scans from 900 patients, we established patient-disjoint training, development-validation, and locked-test cohorts (600/100/200 patients). We evaluated classical registration, Dynamic Graph Convolutional Neural Network (DGCNN), PointNet++, adaptive retraining, semantic-only linkage, and source-independent standardization. On the locked test, raw-geometry Rank-1 identification reached 67.00%, 12.00%, and 64.50%, respectively, against 0.50% chance. For the learned protected release, Rank-1 increased from 14.08% under fixed DGCNN to 99.25% under mechanism-aware adaptive DGCNN, a paired difference of 85.17 percentage points (95% confidence interval, 81.50–88.58), while segmentation-label agreement was 95.92%. In supplementary development-validation analysis (100 patients), ground-truth tooth-segmentation macro-F1 was 0.8142 for clean and 0.8097 for protected geometry, a 0.45-percentage-point decrease. Coarse dental semantics yielded 32.00% Rank-1. Source-independent standardization yielded worst-case Rank-1 values of 0.75% and 1.50% across two gallery scenarios, but missed one pre-specified confidence-bound criterion; synthetic-label macro-F1 was 0.3714. These findings show that fixed-attacker assessments can substantially underestimate recoverable identity information and motivate mechanism-aware privacy auditing.