Defeating Image Obfuscation with Deep Learning

By Richard McPherson, Reza Shokri, Vitaly Shmatikov. 2016

195 citations recorded by the source corpus.

We demonstrate that modern image recognition methods based on artificial neural networks can recover hidden information from images protected by various forms of obfuscation. The obfuscation techniques considered in this paper are mosaicing (also known as pixelation), blurring (as used by YouTube), and P3, a recently proposed system for privacy-preserving photo sharing that encrypts the significant JPEG coefficients to make images unrecognizable by humans. We empirically show how to train artificial neural networks to successfully identify faces and recognize objects and handwritten digits even if the images are protected using any of the above obfuscation techniques.

Subfields: Computer Vision and Pattern Recognition

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Vision and Pattern Recognition

Citations in the corpus

Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning (2017, background): “The authors of [50] use deep learning to infer and reveal the identity of subjects behind blurred images.”
A Hybrid Model for Identity Obfuscation by Face Replacement (2018, methodology): “The performance of these methods in concealing identity against machine recognition systems has been studied in [7] and [8].”
A Study of Face Obfuscation in ImageNet (2021, background): “Obfuscating sensitive image areas is widely used for preserving privacy (McPherson et al., 2016).”
Obfuscation via Information Density Estimation (2019, methodology): “We apply the obfuscation mechanism in Section 2 for image obfuscation (McPherson et al., 2016; Oh et al., 2017; Wu et al., 2018) with GENKI-4k (MPLab, 2009) and Celebrity Attributes (CelebA) (Liu et al., 2015) datasets, and for identifying politically-charged terms in Tweets collected from online…”
Adversarial Image Perturbation for Privacy Protection A Game Theory Perspective (2017, background): “While there exists a bulk of research on user privacy traditionally led by the security community [22, 39, 23, 19], studies on private content in visual data began only recently [37, 28, 18].”
Olympus: Sensor Privacy through Utility Aware Obfuscation (2018, unknown): “Rather than considering all powerful attackers, we limit the ML attacker to be one from a known hypothesis class (e.g. a DNN with a known structure).”
Assisting Users in a World Full of Cameras: A Privacy-Aware Infrastructure for Computer Vision Applications (2017, background): “Here, denaturing is achieved by replacing faces with black boxes, since other techniques like blurring are not resistant against machine learning attacks [44].”
Towards Privacy-Preserving Visual Recognition via Adversarial Training: A Pilot Study (2018, background): “However, extensive research showed that such an empirical means can be easily hacked too [37,32].”
A Survey on Differential Privacy for Unstructured Data Content (2022, background): “Since the popular obfuscation methods of mosaicing and blurring have been tested to lose functionality against convolutional neural network (CNN) attacks, with original images recovered in remarkably high accuracies up to 96% [63], DP obfuscation is evaluated by benchmarking with them, assuming an a”
Adversarially Learned Representations for Information Obfuscation and Inference (2019, background): “There is significant prior work in related topics such as visual privacy through image obfuscation (McPherson et al., 2016; Oh et al., 2016; 2017; Brkic et al., 2017; Raval et al., 2017; Wu et al., 2018) and inpanting (Sun et al.”
When Machine Learning Meets Privacy (2020, background): “Second, traditional protection schemes such as obfuscation no longer work effectively [96, 109].”
Natural and Effective Obfuscation by Head Inpainting (2017, background): “[15] have analyzed the obfuscation performance of blacking or blurring faces against automatic recognizers.”