Balancing Privacy and Action Performance: A Penalty-Driven Approach to Image Anonymization

TL;DR

The paper tackles the privacy-utility trade-off in action recognition from video by introducing a penalty-driven minimax anonymization framework. It jointly optimizes an anonymizer $f_A$ with a utility branch $f_T$ and a self-supervised privacy branch $f_B$, using a penalty term $L_{ ext{penalty}}$ with threshold $B$ to preserve action features while obfuscating private attributes. The approach is model-agnostic and validated with cross-dataset experiments across multiple action and private-attribute datasets, showing strong action performance with nearly constant privacy leakage across penalty settings and good generalization to novel attributes. These results suggest practical applicability for privacy-preserving vision systems that must meet regulatory standards while maintaining task effectiveness.

Abstract

The rapid development of video surveillance systems for object detection, tracking, activity recognition, and anomaly detection has revolutionized our day-to-day lives while setting alarms for privacy concerns. It isn't easy to strike a balance between visual privacy and action recognition performance in most computer vision models. Is it possible to safeguard privacy without sacrificing performance? It poses a formidable challenge, as even minor privacy enhancements can lead to substantial performance degradation. To address this challenge, we propose a privacy-preserving image anonymization technique that optimizes the anonymizer using penalties from the utility branch, ensuring improved action recognition performance while minimally affecting privacy leakage. This approach addresses the trade-off between minimizing privacy leakage and maintaining high action performance. The proposed approach is primarily designed to align with the regulatory standards of the EU AI Act and GDPR, ensuring the protection of personally identifiable information while maintaining action performance. To the best of our knowledge, we are the first to introduce a feature-based penalty scheme that exclusively controls the action features, allowing freedom to anonymize private attributes. Extensive experiments were conducted to validate the effectiveness of the proposed method. The results demonstrate that applying a penalty to anonymizer from utility branch enhances action performance while maintaining nearly consistent privacy leakage across different penalty settings.

Figures (8)

• Figure 1: A penalty-driven two-step training framework for balancing action performance and privacy leakage. In Step 1, the weights of $f_A$ are updated by optimizing the gradient through $\mathcal{L_A}$ loss, while keeping the weights of $f_T$ and $f_B$ frozen. In Step 2, the weights of $f_A$ kept frozen, while the weights of $f_T$ and $f_B$ are updated using the cross-entropy loss $L_T$ and the NT-Xent contrastive loss $L_B$.
• Figure 2: Anonymized frames of two different actions from the HMDB51 dataset across different penalty settings. Top to bottom: raw image, followed by $B = 0.3$, $B = 0.5$, $B = 0.7$, and $B = 0.9$.
• Figure 3: Performance based on different settings of $B$. $\downarrow$ and $\downarrow$ indicate the performance drop of action and privacy from the raw data respectively.
• Figure 4: A contrastive learning approach to train the privacy budget task $f_B$. To anonymize the private attribute of the input data, the distance between the same samples of input data has been maximized, while the distance between the different samples has been minimized.
• Figure 5: Training loss curves for different functions: (a) Anonymizer $f_A$, (b) Budget task $f_B$, and (c) Utility task $f_T$ for $B = 0.5$, $B = 0.7$, and $B = 0.9$.