A Scanner Darkly: Protecting User Privacy from Perceptual Applications

By Suman Sekhar Jana, Arvind Narayanan, Vitaly Shmatikov. 2013

159 citations recorded by the source corpus.

Perceptual, "context-aware" applications that observe their environment and interact with users via cameras and other sensors are becoming ubiquitous on personal computers, mobile phones, gaming platforms, household robots, and augmented-reality devices. This raises new privacy risks. We describe the design and implementation of DARKLY, a practical privacy protection system for the increasingly common scenario where an untrusted, third-party perceptual application is running on a trusted device. DARKLY is integrated with OpenCV, a popular computer vision library used by such applications to access visual inputs. It deploys multiple privacy protection mechanisms, including access control, algorithmic privacy transforms, and user audit. We evaluate DARKLY on 20 perceptual applications that perform diverse tasks such as image recognition, object tracking, security surveillance, and face detection. These applications run on DARKLY unmodified or with very few modifications and minimal performance overheads vs. native OpenCV. In most cases, privacy enforcement does not reduce the applications' functionality or accuracy. For the rest, we quantify the tradeoff between privacy and utility and demonstrate that utility remains acceptable even with strong privacy protection.

Subfields: Artificial Intelligence, Information Systems

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

Citations in the corpus

I-Pic: A Platform for Privacy-Compliant Image Capture (2016, background): “In [36, 37, 38], the authors address privacy concerns in untrusted perceptual and augmented reality applications, by partially processing media stream within the trusted platform, thus denying apps access to the raw media streams.”
Protecting Visual Information in Augmented Reality from Malicious Application Developers (2019, background): “presented the Darkly system which hides visual information from the developer by using opaque handles to operate on rather than the actual camera frame [12].”
Olympus: Sensor Privacy through Utility Aware Obfuscation (2018, unknown): “Many methods of protecting secrets are specifically designed for certain types of private attribute [11, 26, 28] or data types [12, 23, 24].”
MarkIt: privacy markers for protecting visual secrets (2014, background): “The “least privilege” approach allows an application to access only those information which are absolutely required for its functionality [7, 8].”
Enabling Fine-Grained Permissions for Augmented Reality Applications with Recognizers (2013, background): “Darkly [18] transforms output from computer vision algorithms (such as contours, moments, or recognized objects) to blur the identity of the output.”
DEEProtect: Enabling Inference-based Access Control on Mobile Sensing Applications (2017, background): “in [41], [42] presented novel approaches to add a privacy-protection layer to mobile systems where untrusted applications have access to camera resources.”
Assisting Users in a World Full of Cameras: A Privacy-Aware Infrastructure for Computer Vision Applications (2017, background): “explore image transformations that preserve privacy but at the same time allow many perceptual applications to operate accurately [38].”
FlowFence: Practical Data Protection for Emerging IoT Application Frameworks (2016, background): “built the recognizer OS abstraction and Darkly [39, 40]—systems that enable apps to compute on perceptual data while protecting the user’s privacy.”
Enhancing Lifelogging Privacy by Detecting Screens (2016, background): “In the embedded system security domain, Scanner Darkly [18] and OS Recognizers [17] control how image data is released to untrusted apps to protect against leaks.”
What You Mark is What Apps See (2016, background): “One fine-grained approach is to apply the principle of least privilege to visual content and give applications access to only the visual information required for their functionality [9, 10].”