AnonyNoise: Anonymizing Event Data with Smart Noise to Outsmart Re-Identification and Preserve Privacy

TL;DR

This paper presents the first event anonymization pipeline to prevent re-identification not only by humans but also by neural networks, and effectively introduces learnable data-dependent noise to cover personally identifiable information in raw event data.

Abstract

The increasing capabilities of deep neural networks for re-identification, combined with the rise in public surveillance in recent years, pose a substantial threat to individual privacy. Event cameras were initially considered as a promising solution since their output is sparse and therefore difficult for humans to interpret. However, recent advances in deep learning proof that neural networks are able to reconstruct high-quality grayscale images and re-identify individuals using data from event cameras. In our paper, we contribute a crucial ethical discussion on data privacy and present the first event anonymization pipeline to prevent re-identification not only by humans but also by neural networks. Our method effectively introduces learnable data-dependent noise to cover personally identifiable information in raw event data, reducing attackers' re-identification capabilities by up to 60%, while maintaining substantial information for the performing of downstream tasks. Moreover, our anonymization generalizes well on unseen data and is robust against image reconstruction and inversion attacks. Code: https://github.com/dfki-av/AnonyNoise

Figures (5)

• Figure 1: Visualization of re-identification and target accuracy for different noise applied to DVS-Gesturedvsgesture. The arrow is pointing from the result without to the result with a denoise network used. Our approach AnonyNoise is very robust against inversion.
• Figure 2: Our approach addresses all involved interests simultaneously. The target network (green) aims to optimize performance on the given target task, while a potential attacker (red) seeks to re-identify individuals from the input data. Our anonymization network (blue) tries to prevent this attack while still allowing for good performance of the target network. These two concurrent objectives the ethical trade-off between privacy and utility. The different losses of \ref{['sec:method:pipeline']} are employed to train each network according to its specific objective (indicated by dotted lines).
• Figure 3: Example visualizations of the raw and anonymized events for DVS-Gesturedvsgesture and SEEsee. Subfigure c) depicts the result of grayscale image reconstruction from the anonymized data using E2VID rebecq2019high. The images are visually enhanced for human perception.
• Figure 4: For the inversion attack, we insert a denoising network (orange) between the frozen anonymization network (blue) and the classification network (red/green) for the post-training.
• Figure 5: Visualized examples of a) the original event data, b) the anonymized event, c) original events with Gaussian noise, d) grayscale image reconstruction based on the original event data and e) grayscale image reconstruction based on the anonymized events for DVS-Gesture dvsgesture, SEE see, and EventReId ahmad2022event. The image reconstruction is based on E2VID rebecq2019high. We apply Gaussian noise with a standard deviation of 32 for DVS-Gesture and of 1 for the other datasets. The images are visually enhanced for human perception.