In order to evaluate the performance of the CNN model, we use the mean average precision (MAP). An output of the CNN is binary (“male” or “female”) while the output of the crowdsourcing is ternary (“male”,
“female” and “I don’t know”). Therefore, in order to fairly compare the results of the gender recognition based on CNN and crowdsourcing, we assume that 50% of answers “I don’t know” registered during the crowdsourcing had been correct if the response would have been selected randomly.
The Figure 3.3illustrates the results of the CNN-based gender recognition as well as the ones of the crowdsourcing for original (i.e., no filter) and altered images (application of the privacy filters with different parameter values). CNN shows results close to those by crowdsourcing for Gaussian blurring, K-means and morphing (less than∼10% of differences except for Kmeans 8). CNN is more robust to pixelization (∼10% better than human vision). In the case of masking, the human vision is∼15% better than CNN.
Protection of the masking filter really depends on the brightness of the display and its environment.
Indeed, some crowdsourcing participants might have increased the luminosity of their computer screens making the test images more visible, whereas the CNN works with values of pixels regardless of the display method. In addition, the human vision adapts to the change of brightness.
In this study, we demonstrated the impact of privacy filters on gender recognition by machine vision algorithms (using a CNN) and by human vision (using a crowdsourcing approach). One might expect the human vision to be more robust to privacy filters than computer vision. Nevertheless, our results show that humans and automatic gender recognition systems perform almost equally.
Chapter 4
Common face anonymization in visual data: are they really protecting our
privacy?
4.1 Introduction
Broadcasting, printed media and some surveillance systems apply standard obfuscation methods to corrupt the pixel data and achieve anonymity. These methods are either a masking by a solid colored rectangle, a blurring 1, a pixelization 2, or a noise addition. A detailed description of these popular approaches is given in the section2.3. In this Chapter, face images where we apply privacy filters, are referred as obscured face images.
The level of privacy protection is controlled by varying parameters. The experiments in [79] demonstrate that, in general, an increase in strength of privacy filters leads to an increase in privacy (i.e., reduction in terms of recognition rate). We illustrate, in the Figure4.1, the methods that we selected for this study, and we sum up the name of their associated tuning parameters in the Table4.1.
Even if the application of a privacy filter appears efficient at first sight, we demonstrate in this Chapter that as soon as the category and the strength of this filter are identified, there exist in the literature, current powerful approaches (e.g., by super-resolution techniques [22,23], by parrot attack [24]), enable to partially cancel the impact of such filters with regards to automatic face recognition. Hence, evaluation is expressed in terms of face recognition rate associated with original, obscured and de-obscured face images.
The domain of image restoration allows to partially recover original face images, referred as de-obscured face images later in this Chapter. Indeed, image restoration improves quality of images or reconstructs
1smoothing the image with, e.g., a Gaussian filter with large variance
2image subsampling
34
Chapter 4.Common face anonymization in visual data: are they really protecting our privacy? 35
FIGURE 4.1: From left to right, on the top: original faces, black masking, pixelization, Gaussian blur, Gaussian noise; on the bottom: average blur, motion blur, Speckle noise, Salt and Pepper noise.
Filter Parameter Strength
Black masking opacity 0.1, 0.2, 0.3
Pixelization size of squares 3-10
Gaussian Blur standard deviation 2-5, 8
Gaussian Noise standard deviation 0.001, 0.005, 0.01-0.1, 0.3 A circular averaging neighbouring square matrix of size 2*radius+1 11, 21, 31
Motion Blur length and angle of the motion [15, 45], [20, 130]
Speckle noise [101] standard deviation 0.1, 0.3
Salt and Pepper Noise noise density 0.1, 0.3, 0.5
TABLE4.1: Privacy filters with the strength used and the name of their associated parameter. The four last ones are dedicated only for the testing.
corrupted images. Several methods like de-blurring [102], de-noising [103–105], super-resolution [106, 107] are potentially efficient, but require an a priori knowledge about the exact corruption.
To the best of our knowledge, there is no method that detects the category of the filter from obscure face images. Therefore, the key step of this Chapter consists of automatically identifying the category and the associated strength of the filter that have been used to obscure faces. Concerning this preliminary, but mandatory step, we propose the following approach. First, we select a method to classify obscured faces from not obscured faces. Then, a second approach classifies the type of filter. As soon as the filter is identified, a last step would consist of defining the strength. Supposing an a priori knowledge of the category and the strength of the filter, found in the previous steps, we finally demonstrate, in this Chapter, that a de-obscured face operation (i.e., image restoration methods) can be efficiently performed and therefore privacy filters become much less effective.
The rest of the Chapter is organized as follows: in the next section, we explain the proposed obscured face detection against the original face following by the categorization of the filter and the estimation of the filter strength. Then, we describe image restoration methods used to de-obscured face images. In the last section, we evaluate our proposed filter classification, and we demonstrate that the knowledge
Chapter 4.Common face anonymization in visual data: are they really protecting our privacy? 36 of the category in addition to the one of the strength of the privacy filter improves the image restoration.
Therefore, the performance of identity recognition on/of recovered faces increases significantly.