BLINDSPOT: Enabling Bystander-Controlled Privacy Signaling for Camera-Enabled Devices

TL;DR

BlindSpot tackles the bystander privacy problem in camera-enabled devices by enabling direct, real-time signaling from bystanders to the capture device. It proposes three on-device signaling modalities—gesture, VLC beacon, and UWB tag—each paired with geometric validation to bind signals to the correct bystander face, and evaluates them on commodity hardware. The work shows trade-offs among latency, range, and robustness, with gesture offering low latency at close range, VLC providing a balanced indoor solution, and UWB delivering robust, scalable signaling at higher latency. This modular, on-device approach closes the agency gap, eliminates cloud dependence, and lays groundwork for multi-modal, bystander-controlled privacy in real-world settings.

Abstract

Camera-equipped mobile devices, such as phones, smart glasses, and AR headsets, pose a privacy challenge for bystanders, who currently lack effective real-time mechanisms to control the capture of their picture, video, including their face. We present BlindSpot, an on-device system that enables bystanders to manage their own privacy by signaling their privacy preferences in real-time without previously sharing any sensitive information. Our main contribution is the design and comparative evaluation of three distinct signaling modalities: a hand gesture mechanism, a significantly improved visible light communication (VLC) protocol, and a novel ultra-wideband (UWB) communication protocol. For all these modalities, we also design a validation mechanism that uses geometric consistency checks to verify the origin of a signal relative to the sending bystander, and defend against impersonation attacks. We implement the complete system (BlindSpot) on a commodity smartphone and conduct a comprehensive evaluation of each modality's accuracy and latency across various distances, lighting conditions, and user movements. Our results demonstrate the feasibility of these novel bystander signaling techniques and their trade-offs in terms of system performance and convenience.

Figures (10)

• Figure 1: Overview of our system. (0) In the Real World View, bystanders can use different (1) modalities to signal their (2) privacy preference (e.g., 'Blur' or 'Unblur'). (0.a) Device-free hand gesture, (0.b) Arduino Stella w/ LED Diode in SWO pin, (0.c) Arduino Stella w/ UWB chip. They communicate this choice using one of three Privacy Signaling Modalities: (1.a) Modality 1 (Hand Gesture), (1.b) Modality 2 (VLC, LED Beacon), or (1.c) Modality 3 (UWB + BLE). (3) These signals are detected by nearby Camera-Enabled Devices (e.g., smart glasses, smartphones). (4) Frame processing is done in real-time. (5) Regardless of modality chosen, the devices perform Face Detection, Tracking, and Blurring to track all individuals in real-time. The detected faces data is passed to (6) a module that Analyzes the Signal Depending on Modality, which waits for a specific trigger. For example, (6.a) a hand swipe gesture, (6.b) a modulated LED message, or (6.c) a UWB/BLE data update. (7) This analysis determines the final action, resulting in the Camera View - BlindSpot, where each individual's respective privacy preference (Blur or Unblur) is applied. This system empowers individuals with direct control over their visual privacy in ubiquitous sensing environments.
• Figure 2: Illustration of the "Hand Gesture" signaling modality. Top (1): (a) A bystander's initial state. (b) The bystander performs a 'blur' gesture, swiping from their left to right, which is captured and processed by a camera's Field of View (FOV). (c) The system then blurs the bystander's face in the camera's view. Bottom (2): (a) The bystander's face is initially blurred. (b) The bystander performs an 'unblur' gesture, swiping from their right to left. (c) The system removes the blur.
• Figure 3: Illustration of the privacy preference signaling process using visible light communication (VLC). Top (1): (a) A bystander's initial unblurred state. (b) The bystander's device (represented by the LED) modulates a 'blur' message into a light wave, transmitted by rapidly switching the LED ON/OFF according to a predefined bit sequence (e.g., preamble, body, CRC), which is then captured and processed by a camera's Field of View (FOV). (c) The system applies the 'blur' preference to the bystander's face. Bottom (2): (a) The bystander's face is initially blurred. (b) The device transmits an 'unblur' message via VLC. (c) The system removes the blur.
• Figure 4: Illustration of the privacy signaling process using Ultra-Wideband (UWB) and Bluetooth. Top (1): (a) A bystander's initial unblurred state. (b) The bystander sends a 'blur' command thorugh the UWB tag and then transmits its precise location (Distance, Azimuth, Elevation) to the camera-enabled device (e.g., "Update GATT with blur code"). (c) The system processes this information and applies a blur filter to the bystander's face. Bottom (2): (a) The bystander's face is initially blurred. (b) The device transmits its location and sends an 'unblur' command. (c) The system removes the blur.
• Figure 5: State machine for the hybrid UWB+BLE protocol's power management. The system distinguishes between a Disconnected (Unbound) and a Connected (Bound) state. A device is initially Unbound, where a GATT trigger forces a Full UWB Verification. A successful verification creates a binding between the device's MAC address and a FaceID, transitioning the system to the Bound state. Subsequent GATT triggers in this state use the low-power Fast Path. Crucially, the system reverts to the Unbound state via the Face Track Lost event. This transition invalidates the binding the moment the associated face is no longer visible, ensuring stale associations are purged and forcing re-verification for any future interaction.