Adversarial Image Perturbation for Privacy Protection A Game Theory Perspective

By Seong Joon Oh, Mario Fritz, Bernt Schiele. 2017

169 citations recorded by the source corpus.

Users like sharing personal photos with others through social media. At the same time, they might want to make automatic identification in such photos difficult or even impossible. Classic obfuscation methods such as blurring are not only unpleasant but also not as effective as one would expect [28, 37, 18]. Recent studies on adversarial image perturbations (AIP) suggest that it is possible to confuse recognition systems effectively without unpleasant artifacts. However, in the presence of counter measures against AIPs [7], it is unclear how effective AIP would be in particular when the choice of counter measure is unknown. Game theory provides tools for studying the interaction between agents with uncertainties in the strategies. We introduce a general game theoretical framework for the user-recogniser dynamics, and present a case study that involves current state of the art AIP and person recognition techniques. We derive the optimal strategy for the user that assures an upper bound on the recognition rate independent of the recogniser’s counter measure. Code is available at https://goo.gl/hgvbNK.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Electrical and Electronic Engineering

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Electrical and Electronic Engineering

Citations in the corpus

A Hybrid Model for Identity Obfuscation by Face Replacement (2018, methodology): “ term which measures the distance between 66 ducial landmarks [13] in the input image with the corresponding landmarks on the output of the parametric decoder, E land(p) = X66 i=1 jjl i u x(p)jj2 2 : (2) l i is the ith landmark’s image position and xis the index of the corresponding landmark vertex ”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, background): “[132] took a ‘Game Theory’ perspective on adversarial attacks and derived a strategy to counter the countermeasures taken against adversarial attacks on deep neural networks.”
A Study of Face Obfuscation in ImageNet (2021, background): “Researchers have tried to protect sensitive image regions against attacks, e.g., by perturbing the image adversarially to reduce the performance of a recognizer (Oh et al., 2017; Ren et al., 2018; Sun et al., 2018; Wu et al., 2018; Xiao et al., 2020).”
6G Internet of Things: A Comprehensive Survey (2021, background): “• In the future, it is desired to develop lightweight on-device hardware platforms to meet service computation demands, e.g., on-device edge intelligence in mobile 6G networks.”
Adversarially Learned Representations for Information Obfuscation and Inference (2019, background): “There is significant prior work in related topics such as visual privacy through image obfuscation (McPherson et al., 2016; Oh et al., 2016; 2017; Brkic et al., 2017; Raval et al., 2017; Wu et al., 2018) and inpanting (Sun et al., 2018a;b; Orekondy et al., 2018), domain adaptation (Tzeng et al.,…”
Olympus: Sensor Privacy through Utility Aware Obfuscation (2018, unknown): “In [36], the authors proposed an approach of learning adversarial perturbations based on a user-recognizer game.”
Knockoff Nets: Stealing Functionality of Black-Box Models (2018, background): “h recognize and control privacy-sensitive information in visual content. The community has also recently studied security concerns entailing real-world usage of models e.g., adversarial perturbations [2,20,25,26,29,34] in black- and whitebox attack scenarios. In this work, we focus on functionality ”
Live Face De-Identification in Video (2019, unknown): “Minimally changing the image is important for the method to be video-capable, and is also an important factor in the creation of adversarial examples [35].”
Towards Privacy-Preserving Visual Recognition via Adversarial Training: A Pilot Study (2018, background): “A latest work [38] described a game-theoretical system in which the photo owner and the recognition model strive for antagonistic goals of dis-/enabling recognition, and better obfuscation ways could be learned from their competition.”
When Machine Learning Meets Privacy (2020, background): “[110] set up a game-theoretical framework and studied the effectiveness of adversarial image perturbations for privacy protection.”
Natural and Effective Obfuscation by Head Inpainting (2017, methodology): “Unlike some prior work [23, 18], our obfuscation scheme is target generic – it is designed to actually change the identity, instead of fooling speciﬁc clas-siﬁers.”
Adversarial representation learning for synthetic replacement of private attributes (2020, methodology): “In the current work, we propose a novel solution for utility-preserving privacy-enhancing transformations of data: we use privacy-preserving representation learning to obfuscate information in the input data, and output results that retain the information and structure of the input.”
Obfuscation via Information Density Estimation (2019, methodology): “We apply the obfuscation mechanism in Section 2 for image obfuscation (McPherson et al., 2016; Oh et al., 2017; Wu et al., 2018) with GENKI-4k (MPLab, 2009) and Celebrity Attributes (CelebA) (Liu et al., 2015) datasets, and for identifying politically-charged terms in Tweets collected from online…”
Towards Reverse-Engineering Black-Box Neural Networks (2017, methodology): “t a black-box model can be useful in other scenarios. E.g. there has been work on utilising adversarial examples for protecting private regions (e.g. faces) in photographs from automatic recognisers (Oh et al., 2017). In such scenarios, gaining more knowledge on the recognisers will increase the cha”
ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models (2018, background): “On the other hand, researchers have recently shown that adversarial examples can also help to protect users’ privacy in online social networks [22], [31], [46].”
Improving DNN Robustness to Adversarial Attacks using Jacobian Regularization (2018, background): “In [24], a game theoretical framework is used to study the relationship between attack and defense strategies in recognition systems in the context of adversarial attacks.”