Who owns the pixels

Patient radiographs ended up under a software licence, and every person in the chain behaved reasonably.

On 23 August I audited the public datasets I was about to train a medical imaging model on, then followed one of them downstream. One board-certified oral and maxillofacial radiologist, five minutes per dataset, no legal training.

The dataset is 598 dental radiographs from a university clinic in Paraguay, released under an attribution licence with the patients' consent documented in the source paper. Re-annotated and republished, the same images became public domain. Aggregated into a larger collection, they became MIT, a software licence. Consumed once more, they were redistributed on the strength of a claimed Apache licence. Along the way three published papers recorded three different countries of origin, none of them Paraguay. And a systematic review written specifically about dataset licensing listed the same 598 images twice, as two unrelated datasets, with two different licences and two opposite ethics assessments, double counted in its own total.

Nobody in that chain was careless. The original team documented their ethics and their scanner. The annotators named their source in their first paragraph. The reviewers were domain experts writing specifically about licensing. The chain still ended with patient images under a software licence and an origin off by a continent, because the one link that mattered was a sentence on a web page instead of a field in the metadata, and citation tooling cannot read a sentence.

Provenance that lives in prose does not survive.

For anyone building on public data the lesson is mechanical. Do not audit the licence field. Re-derive the provenance from the data itself, because the record that ships beside it is downstream of the same broken link. In my case the proof was the files themselves: every one of the 598 images in the relicensed copy was byte for byte identical to the original deposit. A checksum, five minutes, no lawyer.

What I would do differently: hash first, read the licence second, on every dataset, before the download finishes.

The check

The five-minute provenance check:

1. Open the files, not the licence. Hash the images and search the hashes and the original file names. Bytes and names survive every republication, licences do not.
2. Search the earliest name or matching deposit you find. The first paper that mentions it is the origin.
3. Compare the licence in the origin paper with the licence on the page you downloaded from. If they differ, the page is wrong, not the paper.
4. Record the origin in a metadata field, not a sentence, before you train on it.