Towards Privacy-Preserving Visual Recognition via Adversarial Training: A Pilot Study

By Zhenyu Wu, Zhangyang Wang, Zhaowen Wang, Hailin Jin. 2018

172 citations recorded by the source corpus.

This paper aims to improve privacy-preserving visual recognition, an increasingly demanded feature in smart camera applications, by formulating a unique adversarial training framework. The proposed framework explicitly learns a degradation transform for the original video inputs, in order to optimize the trade-off between target task performance and the associated privacy budgets on the degraded video. A notable challenge is that the privacy budget, often defined and measured in task-driven contexts, cannot be reliably indicated using any single model performance, because a strong protection of privacy has to sustain against any possible model that tries to hack privacy information. Such an uncommon situation has motivated us to propose two strategies, i.e., budget model restarting and ensemble, to enhance the generalization of the learned degradation on protecting privacy against unseen hacker models. Novel training strategies, evaluation protocols, and result visualization methods have been designed accordingly. Two experiments on privacy-preserving action recognition, with privacy budgets defined in various ways, manifest the compelling effectiveness of the proposed framework in simultaneously maintaining high target task (action recognition) performance while suppressing the privacy breach risk. The code is available at https://github.com/wuzhenyusjtu/Privacy-AdversarialLearning.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

Citations in the corpus

NoPeek: Information leakage reduction to share activations in distributed deep learning (2020, background): “…loss based privacy: These can be categorized into hiding speciﬁc sensitive attributes using adversarial training that reaches an equilibrium based on information theoretic loss functions optimized under minimax settings through learning weights of deep learning models [29, 30, 31, 32, 33, 34, 35].”
Privacy in Deep Learning: A Survey (2020, background): “There is a body of work studying information-theoretic based methods for both privacy and fairness, where privacy and fairness are provided through information degradation, through obfuscation or adversarial learning and demonstrated by mutual information reduction [67, 68, 48, 69, 70, 71, 72, 73, 7”
A Study of Face Obfuscation in ImageNet (2021, background): “Researchers have tried to protect sensitive image regions against attacks, e.g., by perturbing the image adversarially to reduce the performance of a recognizer (Oh et al., 2017; Ren et al., 2018; Sun et al., 2018; Wu et al., 2018; Xiao et al., 2020).”
Adversarial representation learning for synthetic replacement of private attributes (2020, background): “Wu et al. (2018), Ren et al. (2018), and Wang et al. (2019) learn transformations of video that respect a privacy bud-get while maintaining performance on a downstream task.”
Adversarial Removal of Gender from Deep Image Representations (2018, unknown): “search in this domain has focused on facial analysis – where there is generally more well aligned features. This general area of work is also related to efforts in building privacy preserving methods [31, 26, 33, 13], where the objective is to obfuscate the input while still being able to perform a ”
Obfuscation via Information Density Estimation (2019, background): “This quantity is at the heart of most information-theoretic measures of privacy (Asoodeh et al., 2018; Issa et al., 2018; Hsu et al., 2018) as well as differential privacy (DP) (Bun and Steinke, 2016; Dwork and Rothblum, 2016; Balle and Wang, 2018; Chaudhuri et al., 2011).”
Balanced Datasets Are Not Enough: Estimating and Mitigating Gender Bias in Deep Image Representations (2018, background): “This general area of work is also related to efforts in building privacy preserving methods [31, 26, 33, 13], where the objective is to obfuscate the input while still being able to perform a recognition task.”
A Survey on Differential Privacy for Unstructured Data Content (2022, methodology): “Since we target applying DP directly to image content on users’ sides, we will not include the work [93, 110, 111], in which differential privacy is guaranteed in the Machine Learning training process.”