提出隐私与效用平衡的新图像脱敏方法，打破传统模糊的隐私漏洞。
Privacy Blur: Quantifying Privacy and Utility for Image Data Release
- 对比四种图像脱敏方法，发现高斯模糊在实际中可逆性高
- 像素化加噪声在适度粒度下兼具隐私保护与模型训练效用
- 开源工具Privacy Blur提供参数建议，适合数据发布场景
野外采集的图像常包含人脸、车牌等隐私信息，负责任的数据发布需确保隐私不泄露，同时保持数据对模型训练的有效性。当前主流的隐私信息模糊方法是高斯模糊。本文表明，高斯模糊的实际低精度实现具有足够可逆性，难以保障隐私。我们进一步评估了三种其他模糊算法——像素化、像素化加噪声（DP-Pix）和裁剪在隐私-效用权衡上的表现。隐私通过逆向攻击和辨识攻击评估，效用则通过在含模糊人脸数据上训练模型所获表示质量衡量。结果表明，最常用的行业标准方法高斯模糊在四项方法中隐私性最差，其低精度实现易受逆向攻击。相反，像素化及像素化加噪声在合适粒度下，可在多个计算机视觉任务中同时实现隐私保护与数据可用性。我们已将所提方法及推荐参数整合至名为Privacy Blur的软件包中。
原文摘要 · Abstract (English)
Image data collected in the wild often contains private information such as faces and license plates, and responsible data release must ensure that this information stays hidden. At the same time, released data should retain its usefulness for model-training. The standard method for private information obfuscation in images is Gaussian blurring. In this work, we show that practical implementations of Gaussian blurring are reversible enough to break privacy. We then take a closer look at the privacy-utility tradeoffs offered by three other obfuscation algorithms -- pixelization, pixelization and noise addition (DP-Pix), and cropping. Privacy is evaluated by reversal and discrimination attacks, while utility by the quality of the learnt representations when the model is trained on data with obfuscated faces. We show that the most popular industry-standard method, Gaussian blur is the least private of the four -- being susceptible to reversal attacks in its practical low-precision implementations. In contrast, pixelization and pixelization plus noise addition, when used at the right level of granularity, offer both privacy and utility for a number of computer vision tasks. We make our proposed methods together with suggested parameters available in a software package called Privacy Blur.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。