CRISP: Constrained Refinement via Iterative Squeezing Process for Robust Medical Image Segmentation under Domain Shift
Source: arXiv:2607.15231 · Published 2026-07-16 · By Yizhou Fang, Pujin Cheng, Yixiang Liu, Xiaoying Tang, Longxi Zhou
TL;DR
This paper tackles the critical problem of distribution shift in medical image segmentation, a key barrier to reliable clinical deployment of AI. Existing methods either rely on adaptation with access to target (test) data or predefined assumptions about shifts, which fail to generalize well to unpredictable real-world domain shifts. The authors introduce the "Rank Stability of Positive Regions" assumption—that the relative ordering of predicted probabilities for true foreground voxels remains largely stable under domain shift. Building on this, they propose CRISP, a source-only, model-agnostic refinement framework that requires no target data or test-time parameter updates. CRISP leverages latent feature perturbations to identify stable high-precision core and high-recall support spatial hints from ensemble predictions under simulated noise. An iterative "squeezing" training and inference process then recursively refines these dual spatial constraints toward a final segmentation.
Extensive experiments on multi-center cardiac MRI and CT lung vessel datasets representing multi-center, demographic, and modality shifts demonstrate that CRISP outperforms state-of-the-art domain generalization and deployment-time adaptation methods. For example, CRISP reduces volumetric segmentation boundary error HD95 by up to 8.39 pixels (38.9%) under severe modality shift compared to baselines, without accessing any target data. The method also eliminates catastrophic worst-case failures, bolstering clinical robustness. Thus, CRISP provides a practical and scalable source-only strategy by exploiting relative prediction rank stability rather than absolute probabilities to robustly segment in unseen domains.
Key findings
- CRISP reduces HD95 boundary error by 0.14 pixels (7.0%) on multi-center shift, 1.90 pixels (13.1%) on demographic shift, and 8.39 pixels (38.9%) on modality shift over state-of-the-art domain generalization and adaptation methods.
- CRISP outperforms target-informed adaptation methods (IPLC, TEGDA) on all evaluated metrics despite using no target-domain data or parameter updates at test time.
- Iterative refinement with Uncertainty Squeezing Loss accelerates convergence of Dice and HD95 metrics, reaching stable performance by the third refinement generation.
- Recursive Self-Evolution (RSE) contributes the majority of improvement, lifting baseline Dice scores by +4.40 (multi-center), +18.19 (modality), and +2.27 (demographic) shifts.
- Uncertainty Squeezing Loss adds additional gains of +0.58 to +8.01 Dice and decreases HD95 by up to 6.61 pixels on modality shift, concentrating improvements on ambiguous boundary regions.
- CRISP eliminates near-total segmentation failures (Dice < 0.30) on the severe modality shift dataset, reducing failure cases from 36.4% to 0%.
- CRISP preserves or improves segmentation quality on source domain data, confirming no degradation despite focus on target shifts.
- Latent feature perturbation with Gaussian noise (σ = 0.35) effectively simulates domain shifts to extract stable spatial priors without target data.
Threat model
The adversary is the unknown distribution shift occurring between training (source domain) and deployment (target domain) medical image data. The adversary causes changes in patient demographics, scanner vendors, imaging protocols, or modalities that degrade segmentation performance. The method assumes no access to target-domain data or labels during training or inference, and no possibility to update model weights at test time. The adversary cannot directly manipulate model weights or inputs at inference, only the data distribution changes inherently due to acquisition or population differences.
Methodology — deep read
The paper addresses source-only domain generalization for volumetric medical image segmentation under distribution shift. The setting assumes a labeled source domain and no access to target domain data during training or inference. The only data available is a source dataset with 2D slice volumes X_sl ∈ R^{H×W}, labels Y_sl ∈ {0,...,C} per voxel, across multiple foreground classes.
CRISP's core technical assumption is the Rank Stability of Positive Regions: under domain shift, the relative rank ordering of positive voxels remains stable even if absolute probabilities drift. Leveraging this, CRISP derives robust spatial hints for target-free refinement.
Architecture-wise, CRISP uses a standard segmentation model (DeepLabv3+ with MobileNetV2 backbone). The input to this model is extended beyond the original image slice to additionally include spatial hint maps for each class: a high-precision (HP) core and a more inclusive high-recall (HR) support, each of shape H×W. The first convolutional layer is widened to accept the added channels. No new modules or parameters beyond this are introduced.
The training is generational and iterative. Generation 1 is trained with trivial hints (HP = empty, HR = full image) and standard Dice loss alone. Next generations (k≥2) fine-tune from previous generation weights but are trained on a balanced mixture of hint depths (hint sets obtained by applying the perturbation-refinement procedure d times, for d in [0,k-1]). This mixes coarse and refined hints, allowing a single network to refine its own predictions recursively.
The key data augmentation simulates distribution shift by injecting Gaussian noise into the model's latent bottleneck features (after the encoder, before the decoder). Multiple (N=10) noisy samples produce stochastic softmax probability maps, converted to log-odds and quantized into discrete grades representing confidence bands.
Across perturbations, the high-precision core mask M_HP retains voxels graded maximal in all N perturbations (intersection), giving a conservative, high-precision positive region. The high-recall mask M_HR retains voxels graded as foreground in at least one perturbation (union), yielding an inclusive support region. The difference between HR and HP is an uncertainty band where the network focuses refinement.
At training-time, the standard Dice loss is augmented with an Uncertainty Squeezing Loss applied only within the uncertainty band. This loss encourages prediction consistency under perturbations, forcing the network to produce stable and decisive foreground/background decisions in ambiguous boundary regions. The squeezing loss weight is zero for depth-0 (trivial) hints and positive thereafter.
At inference, only the final generation model is used with frozen weights. Starting from trivial hints, the perturbation-based spatial prior extraction and model refinement process iterates until HP and HR masks converge, usually within ~3 steps. This produces a refined segmentation without any parameter updates or target data.
For evaluation, the authors test on three datasets covering three distribution shifts: M&Ms multi-center cardiac MRI dataset (4 vendors: Siemens source, Philips/GE/Canon targets), a CT lung vessel dataset for modality shift (contrast-enhanced source, non-contrast target), and a CT lung dataset for demographic shift (normal source, COVID-19 target). They use volumetric Dice Score and Hausdorff Distance (HD95) metrics. All target evaluation is zero-shot, i.e., no target domain supervision or adaptation.
Baselines include standard source-only models, state-of-the-art domain generalization methods (FedDG, DDG-Med), and deployment-time adaptation approaches (IPLC, TEGDA) that require target data or parameter tuning at test time. Some methods are trained on joint labeled data (source+target) for upper bound reference.
CRISP consistently surpasses all source-only and even target-informed methods on various target datasets. Ablations isolate contributions from Recursive Self-Evolution (RSE) hint generation and Uncertainty Squeezing Loss, confirming both strongly contribute to metrics. The authors also provide detailed convergence curves and qualitative examples. Reproducibility is supported by fixing random seeds and detailed hyperparameters. However, code release or pretrained weights are not explicitly mentioned.
A concrete example: On the M&Ms dataset, generation 1 is trained with trivial hints and Dice loss only. Then predictions from this frozen model are perturbed N=10 times in latent space to obtain stable M_HP and M_HR hints. These are used as inputs to generation 2, fine-tuned on a balanced batch mixing trivial and depth-1 hints with added squeezing loss. Iterating this process produces increasingly refined spatial constraints and more accurate segmentations robust to the multi-center domain shift.
Technical innovations
- Introduction of the Rank Stability of Positive Regions assumption to derive spatially stable segmentation priors under unknown distribution shift.
- Model-agnostic latent feature perturbation to simulate domain shifts and extract high-precision and high-recall spatial hints via rank-based operations rather than absolute probabilities.
- Recursive Self-Evolution training framework that iteratively refines dual spatial prior masks (high-precision core and high-recall support) by training on a balanced mixture of hint tightness levels.
- Uncertainty Squeezing Loss applied selectively within the uncertainty band between high-precision and high-recall masks to accelerate convergence and enforce perturbation invariance at ambiguous boundaries.
Datasets
- M&Ms cardiac MRI dataset — 694 volumes total across 4 vendors (192 Siemens, 252 Philips, 150 GE, 100 Canon) — public
- CT-based lung vessel dataset (modality shift) — 93 contrast-enhanced CT volumes (source), 101 non-contrast CT volumes (target) — private
- CT-based lung vessel dataset (demographic shift) — 98 Normal cohort (source), 74 COVID-19 cohort (target) — private
Baselines vs proposed
- Baseline (source only): Multi-center HD95 = 2.64 (mean), CRISP HD95 = 2.06 (pixel) for LV on target domain C
- IPLC (target-informed adaptation): Modality shift Dice = 41.33%, CRISP source-only Dice = 59.46%
- TEGDA (target-informed adaptation): Demographic shift Dice = 66.65%, CRISP source-only Dice = 70.61%
- FedDG (domain generalization): Multi-center Dice LV on target B = 86.97%, CRISP = 88.92%
- CRISP improves worst-case Dice on Non-contrast CT from 0.07 to 0.33 and eliminates near-total failures (Dice<0.3) from 36.4% to 0%
Figures from the paper
Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.15231.
Fig 1: Overview of CRISP, a rank-based segmentation framework rather than probability-driven prediction: predict →
Fig 2 (page 3).
Fig 3 (page 3).
Fig 4 (page 3).
Fig 5 (page 3).
Fig 6 (page 3).
Fig 7 (page 3).
Fig 8 (page 3).
Limitations
- CRISP currently operates on 2D axial slices independently for volumetric segmentation, which may limit 3D spatial context utilization.
- The latent Gaussian perturbation is a simplified simulation and may not capture all real-world domain shifts.
- Evaluation lacks adversarial or worst-case distribution shift stress tests beyond natural clinical variations.
- The method requires multiple forward passes (~6×) at inference due to iterative refinement, increasing compute cost compared to single-pass baselines.
- No public release of code or pretrained models is mentioned, limiting reproducibility outside fixed-seed controlled environment.
- Application is limited to medical image segmentation; generalization to other modalities or tasks remains to be seen.
Open questions / follow-ons
- How well does the Rank Stability assumption hold under extreme or adversarial domain shifts beyond those tested?
- Can latent feature perturbation be improved or diversified to better simulate complex real-world shifts?
- How can CRISP be extended to fully exploit 3D volumetric context rather than slice-wise processing?
- What are the trade-offs in computational efficiency versus segmentation quality in clinical deployment scenarios?
Why it matters for bot defense
For bot-defense and CAPTCHA practitioners focused on robust segmentation and detection under domain shift, CRISP provides an insightful approach by leveraging the relative stability of prediction rankings rather than absolute confidence scores. This is analogous to focusing on invariant relative ordering of response signals to improve robustness against input variations or adversarial changes. The idea to extract high-precision and high-recall spatial hints from perturbation-consistent regions and iteratively refine ambiguous boundaries could inspire defenses that emphasize stable decision regions under uncertainty. Crucially, CRISP's source-only, no target-data, and no test-time adaptation design aligns well with operational constraints in bot detection where retraining or target data acquisition may be infeasible. However, the iterative inference cost trade-off and reliance on model cooperation with spatial hints should be carefully assessed when applying similar principles in low-latency, high-throughput bot defense systems.
Cite
@article{arxiv2607_15231,
title={ CRISP: Constrained Refinement via Iterative Squeezing Process for Robust Medical Image Segmentation under Domain Shift },
author={ Yizhou Fang and Pujin Cheng and Yixiang Liu and Xiaoying Tang and Longxi Zhou },
journal={arXiv preprint arXiv:2607.15231},
year={ 2026 },
url={https://arxiv.org/abs/2607.15231}
}