Research map / Federated learning and privacy / Privacy attacks and secure learning
Balancing Privacy and Performance: A Many-in-One Approach for Image Anonymization
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Feature Recombining for Obfuscation (FRO), a many-in-one image anonymization method that reassembles id-related features from a pretrained knowledge pool into new protected samples, then trains models on them via knowledge replay.
Problem
Instance-wise perturbation-based anonymization trades off privacy protection against downstream identity-task utility, since added noise erases useful features.
Approach
Instead of adding external noise to each image one-to-one, optimize randomly initialized inputs with KL divergence (temperature-scaled, label-softened) against a pretrained identity classifier so each protected sample recombines features from many identities; train a student on these soft-labeled samples via knowledge replay.
Key results
- On Market-1501, FRO with ResNet-50 reaches 61.8% mAP / 80.3% Rank-1 versus 57.7% / 77.6% for the De-ID perturbation baseline, and 65.7% mAP with ResNet-101.
- Visual anonymization: SSIM of 0.07 for FRO versus 0.84 for face-blur and 0.35 for Adv-DeID; 10 volunteers recognized 2% of FRO samples versus 65% for Adv-DeID and 100% for face-blur.
- Face verification on CASIA-trained anonymized data gives LFW 69.0 vs 78.3 for the ResNet baseline, an accuracy loss under 10% across four datasets.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use FRO instead of De-ID | ResNet-50 person re-identification · Market-1501 | mAP: 57.7 -> 61.8 | Helped |
| Use FRO instead of Face-blur PCB | ResNet-50 person re-identification · Market-1501 | mAP: 72.9 -> 61.8 | Hurt |
| Use FRO instead of Face-blur PCB | ResNet-50 person re-identification · DUKEMTMC-REID | mAP: 65.4 -> 51.4 | Hurt |
| Use FRO instead of ResNet-50 trained on real CASIA data | Face verification · LFW, CFP-FF, CFP-FP, and AgeDB | verification accuracy: 78.3 -> 69.0; 79.3 -> 69.8; 63.9 -> 57.6; 64.6 -> 55.0 | Hurt |
| Use FRO rather than Adv-DeID | Market-1501 anonymization · Market-1501 | SSIM: 0.35 -> 0.07 | Helped |
| Use FRO rather than Adv-DeID | Market-1501 anonymization · Market-1501 | Human recognition rate: 65% -> 2% | Helped |
| Use FRO with ResNet-101 rather than ResNet-50 (ablation) | FRO person re-identification · Market-1501 | mAP: 61.8 -> 65.7 | Helped |
| Use FRO with ResNet-101 rather than ResNet-50 (ablation) | FRO person re-identification · DUKEMTMC-REID | mAP: 51.4 -> 50.9 | Hurt |
| Replace FRO with pixel-level PRO patch recombination (ablation) | many-in-one anonymization · Market-1501 | utility performance | No clear effect |
| Replace FRO with pixel-level PRO patch recombination (ablation) | many-in-one anonymization · Market-1501 | visual privacy | Hurt |
| Replace FRO with pixel-level mix-up (ablation) | many-in-one anonymization · Market-1501 | identity privacy: 0.9387 -> 0.0443 | Hurt |
| Vary mix-up ratio from 0.9 to 0.5 (ablation) | pixel-level mix-up · Market-1501 | ARI: 0.9097 -> 0.0443 | Hurt |
Surprising findings
- Mix-up pixel blending at ratio 0.7 still lets the original-trained model cluster the mixed samples well, so pixel-level mixing does not hide identity.
- On DukeMTMC-reID, the FRO ResNet-101 variant (50.9 mAP) scores lower than the ResNet-50 variant (51.4 mAP).
Limitations
- Visually anonymized samples still retain some implicit identity-related textures on face data.
- Verification accuracy drops by up to about 10 points relative to the baseline on face datasets.
- Results rely on a single-run setup with a fixed data scale matched to the original set.
Experimental setup
Datasets: Market-1501 DukeMTMC-reID CASIA LFW CFP-FF CFP-FP AgeDB
Benchmarks: Market-1501 DukeMTMC-reID CASIA-based face verification (LFW, CFP-FF, CFP-FP, AgeDB)
Metrics: mAP Rank-1 SSIM human perception recognition rate Silhouette Score Adjusted Rand Index verification accuracy
Baselines: SE-Net ResNet-50 ResNet-101 DP-SGD Federated-Camera Face-blur MuDeep PIS Face-blur HACNN Face-blur PCB Adv-DeID
Builds on: Adv-DeID Hinton knowledge distillation DeepInversion BN regularization mix-up
Closest papers by meaning
- Disguise without Disruption: Utility-Preserving Face De-identification (AAAI 2024 · similarity 0.86)
- PerceptAnon: Exploring the Human Perception of Image Anonymization Beyond Pseudonymization for GDPR (ICML 2024 · similarity 0.86)
- Privacy-Preserving Face Recognition Using Trainable Feature Subtraction (CVPR 2024 · similarity 0.84)
- MultiPriv: Benchmarking Individual-Level Privacy Reasoning in Vision-Language Models (ICML 2026 · similarity 0.84)
- PID: Prompt-Independent Data Protection Against Latent Diffusion Models (ICML 2024 · similarity 0.84)
- Validating Privacy-Preserving Face Recognition under a Minimum Assumption (CVPR 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.