A Privacy Enhancing Technique to Evade Detection by Street Video Cameras Without Using Adversarial Accessories

TL;DR

The paper identifies a vulnerability in AI-based pedestrian detection: detector confidence systematically depends on a pedestrian’s position and lighting, creating blind spots in real-world street scenes. It introduces Location-based Privacy Enhancing Technique (L-PET), which computes confidence/detection heatmaps and finds low-confidence paths through a scene, enabling pedestrians to evade detection without adversarial accessories. To counter this, the authors propose Location-Based Adaptive Threshold (L-BAT), a dynamic, location-aware reweighting scheme that improves detection performance and reduces L-PET effectiveness, demonstrated across multiple detectors, locations, and lighting conditions. The work highlights privacy risks in surveillance systems while offering a practical defense to ensure more stable and robust pedestrian detection in varied real-world environments. These contributions have implications for privacy-preserving practices and the resilience of surveillance technologies in public spaces.

Abstract

In this paper, we propose a privacy-enhancing technique leveraging an inherent property of automatic pedestrian detection algorithms, namely, that the training of deep neural network (DNN) based methods is generally performed using curated datasets and laboratory settings, while the operational areas of these methods are dynamic real-world environments. In particular, we leverage a novel side effect of this gap between the laboratory and the real world: location-based weakness in pedestrian detection. We demonstrate that the position (distance, angle, height) of a person, and ambient light level, directly impact the confidence of a pedestrian detector when detecting the person. We then demonstrate that this phenomenon is present in pedestrian detectors observing a stationary scene of pedestrian traffic, with blind spot areas of weak detection of pedestrians with low confidence. We show how privacy-concerned pedestrians can leverage these blind spots to evade detection by constructing a minimum confidence path between two points in a scene, reducing the maximum confidence and average confidence of the path by up to 0.09 and 0.13, respectively, over direct and random paths through the scene. To counter this phenomenon, and force the use of more costly and sophisticated methods to leverage this vulnerability, we propose a novel countermeasure to improve the confidence of pedestrian detectors in blind spots, raising the max/average confidence of paths generated by our technique by 0.09 and 0.05, respectively. In addition, we demonstrate that our countermeasure improves a Faster R-CNN-based pedestrian detector's TPR and average true positive confidence by 0.03 and 0.15, respectively.

Figures (19)

• Figure 1: Left: A stationary scene observed by an automatic pedestrian detector. Right: A heatmap indicating varying average confidence in the automatic pedestrian detector depending on the pedestrian's location in the frame.
• Figure 2: Observed scenes from (left to right): Shibuya Crossing, Broadway, and Castro Street.
• Figure 3: Faster R-CNN.
• Figure 4: YOLOv3.
• Figure 5: SSD.