Sanitizing personally identifiable information (PII) in audio and visual data

Techniques for sanitizing personally identifiable information (PII) from audio and visual data are provided. For instance, in a scenario where the data comprises an audio signal with speech uttered by a person P, these techniques can include removing/obfuscating/transforming speech-related PII in the audio signal such as pitch and acoustic cues associated with P's vocal tract shape and/or vocal actuators (e.g., lips, nasal air bypass, teeth, tongue, etc.) while allowing the content of the speech to remain recognizable. Further, in a scenario where the data comprises a still image or video in which a person P appears, these techniques can include removing/obfuscating/transforming visual PII in the image or video such as P's biological features and indicators of P's location/belongings/data while allowing the general nature of the image or video to remain discernable. Through this PII sanitization process, the privacy of individuals portrayed in the audio or visual data can be preserved.

BACKGROUND

Unless otherwise indicated, the subject matter described in this section is not prior art to the claims of the present application and is not admitted as being prior art by inclusion in this section.

Audio and visual data that is captured via microphones, still image cameras, video cameras, and the like can contain a variety of different types of information that permit the direct or indirect identification of individuals portrayed in the data (known as personally identifiable information or PII). For example, a captured audio signal can include speech, which exhibits certain acoustic characteristics such as pitch and higher-order frequency components (e.g., formants F1, F2, and F3 as well as characteristics of the glottal excitation) that can be used to trace the identity of the speaker because of their unique vocal tract characteristics. Similarly, a captured still image or video can include the biological appearance of a person (e.g., facial features, skin texture/tone, etc.) and/or visual cues pertaining to the person's location, belongings, data, and so on that can be used to trace the identity of that person.

When audio or visual data which contains PII is used to build machine learning (ML) models that perform inference (i.e., generate predictions) on similar data, there is typically a need at some point in the model creation process for another person to manually inspect the data and annotate it with appropriate labels so that the ML model can be informed about what the data represents for training purposes. In the case of biometric identification models, these labels relate to the identities of individuals appearing in the data. However, for many other types of ML models that act upon audio or visual data, there is no need for the person performing the labeling task (i.e., labeler) to know anything regarding the identities of those individuals.

For example, speech recognition—which involves identifying the speech uttered in an audio signal—does not require the labeler to know who uttered the speech; the labeler need only be able to recognize the words/sentences spoken. As another example, liveness detection—which involves determining whether a person appearing in an image or video is a live person rather than a facsimile—does not require the labeler to know who is appearing in the image/video. Instead, the labeler need only be able to determine whether that person (whoever it is) is real and not a photograph, 3-D printed head, etc.

DETAILED DESCRIPTION

Embodiments of the present disclosure are directed to techniques for sanitizing (or in other words, removing, obfuscating, or transforming) PII in audio or visual data while keeping the data's non-PII elements intact. For instance, in a scenario where the data comprises an audio signal with speech uttered by a person P, these techniques can include removing/obfuscating/transforming speech-related PII in the audio signal such as pitch, formants F1-F3, and acoustic cues associated with P's vocal tract shape and/or vocal actuators (e.g., lips, nasal air bypass, teeth, tongue, etc.) while allowing the content of the speech to remain recognizable. Further, in a scenario where the data comprises a still image or video in which a person P appears, these techniques can include removing/obfuscating/transforming visual PII in the image or video such as P's biological features and indicators of P's location/belongings/data while allowing the general nature of the image or video to remain discernable.

Through this PII sanitization process, the techniques of the present disclosure can preserve the privacy of individuals portrayed in the audio or visual data while retaining the statistics and correlations within the data, which is useful for various use cases and applications. For example, in one set of embodiments, the sanitized (and thus, identity-neutral) version of the data can be provided to an ML training/inference system which includes a supervised ML model that is capable of operating on identity-neutral information (e.g., a speech recognition model, a liveness detection model, etc.) and a labeler or other similar persona that is tasked with manually inspecting and labeling the data for model training purposes. In these embodiments, the labeler can carry out their task without learning anything regarding the identities of individuals appearing in the data, thereby allaying potential privacy concerns. In another set of embodiments, the sanitized data can be used for model training and inference in unsupervised ML settings. The foregoing and other aspects of the present disclosure are described in further detail below.

2. Example Environment and High-Level Design

FIG.1depicts an example environment100in which embodiments of the present disclosure may be implemented. As shown, environment100includes an audio/visual (A/V) capture module102such as a microphone, still camera, video camera, etc. that is communicatively coupled with an ML training/inference system104. In one set of embodiments, A/V capture module102may be part of a client device that is operated by an end-user (e.g., a smartphone, smart home appliance, etc.) and ML training/inference system104may run on one or more remote servers, such as a cloud server. In other embodiments, some or all of the functionality of ML training/inference system104may be co-located with A/V capture module102.

In operation, ML training/inference system104can receive audio or visual data captured by A/V capture module102(e.g., audio signals or still images/videos) and use this data for various machine learning purposes. For instance, in the scenario where ML training/inference system104includes a supervised ML model108, system104may provide the data to a labeler106that is tasked with manually inspecting and annotating the data with appropriate labels for training model108. Alternatively, in the scenario where ML training/inference system104includes an unsupervised ML model110, the data may be used to directly build model110. Further, if supervised ML model108or unsupervised ML model110has already been trained, the data can be provided as input to the model for inference, resulting in a predicted output. Yet further, the data can be written to a storage component112of ML training/inference system104for future training or inference with respect to supervised ML model108, unsupervised ML model110, or a different model.

As noted in the Background section, although some types of ML models such as biometric identification models may require labeler106to identify, or at least determine identifying characteristics of, individuals appearing in the captured data in order to carry out the labeling task, many other types of ML models do not. Examples of these other types of ML models (referred to herein as identity-neutral models) include speech recognition models, object recognition models, liveness detection models, and so on. For identity-neutral models, it would be useful to have techniques for enabling model training and inference without revealing the identities of the individuals appearing in the captured data to labeler106or anyone else, as this would mitigate privacy concerns arising out of such data collection and use.

To achieve this,FIG.2depicts an enhanced version of environment100ofFIG.1(i.e., environment200) that includes a novel PII sanitizing module202between A/V capture module102and ML training/inference system104. PII sanitizing module202is coupled with A/V capture module102via a secure communication channel204and runs within a secure execution environment206that cannot be tampered with by attackers and does not have any long-term storage capabilities.

In one set of embodiments, PII sanitizing module202may be co-located with A/V capture module102on, e.g., an end-user client device. In these embodiments, PII sanitizing module202may be implemented in client device hardware (e.g., as a standalone integrated circuit or a region of an integrated circuit) or in client device software and secure communication channel204may be a local hardware or software link. In other embodiments, PII sanitizing module202may run one or more servers remote from A/V capture module102and secure communication channel204may be a network link that is encrypted via TLS (Transport Layer Security) or some other network security protocol.

As shown inFIG.2, at a high level PII sanitizing module202can receive audio or visual data captured by A/V capture module202over secure communication channel204(step (1); reference numeral208) and can remove, obfuscate, or transform PII found in that audio/visual data, resulting in identity-neutral data that is usable by ML training/inference system104for performing ML training and/or inference on ML models108and110but does not reveal anything regarding the identities of individuals appearing in the data to system104(including labeler106) (step (2); reference numeral210). In particular, the sanitization performed at step (2) can strip out PII while preserving the statistics and correlations within the data that are needed for ML training/inference purposes. The specific mechanisms that module202can employ to perform this sanitization with respect to visual data and audio data comprising speech and are detailed in sections (3) and (4) respectively below.

Then, upon completing its sanitization process, PII sanitizing module202can forward the identity-neutral data to ML training/inference system104(or some other downstream system) for further processing (step (3); reference numeral212). For example, upon receiving the identity-neutral data, labeler106of system104can inspect and annotate the data with labels for training supervised ML model108. Alternatively, the identity-neutral data can be applied to directly train (or re-train) unsupervised ML model110without labeling. Significantly, because the data stream forwarded by module202has been sanitized of all PII, system104will not be able to learn anything regarding the individuals appearing in that data, thereby preserving the privacy of those individuals.

It should be appreciated atFIGS.1and2are illustrative and not intended to limit embodiments of the present disclosure. For example, the various entities shown in these figures may be organized according to different arrangements/configurations or may include subcomponents or functions that are not specifically described. One of ordinary skill in the art will recognize other variations, modifications, and alternatives.

3. Sanitizing PII in Visual Data

FIG.3depicts a flowchart300that may be executed by PII sanitizing module202ofFIG.2for sanitizing PII from visual data received from A/V capture module102according to certain embodiments.

Starting with steps302and304, PII sanitizing module202can receive a visual data sample (e.g., an image or video) and attempt to identify PII in that sample. In one set of embodiments, the identification performed at step304can involve using an ML model (e.g., neural network, decision tree, support vector machine, etc.) that reads pixel values of the visual data sample and outputs region proposals (e.g., bounding boxes or segmentation maps) indicating regions in the visual data sample that are likely to contain PII of a given type. For example, for a region R1with pixel values that the ML model has determined are indicative of eyes, nose, and/or mouth features, the ML model may output a region proposal indicating that R1is likely to contain a face belonging to a person or a depiction of a person. And for a region R2with pixel values that the ML model has determined are indicative of a street sign or some other location indicator, the ML model may output a region proposal indicating that R2is likely to contain that street sign/location indicator.

In addition to (or in lieu of) the ML model above, the identification performed at step304can involve using optical character recognition (OCR) to recognize sequences of numbers, letters, and/or symbols in the visual data sample. These numbers, letters, or symbols can then be processed via a sequence template matching system or language model to identify text sequences or phrases which are known to constitute, or be revealing of, PII. For example, in the case where a sequence of numbers matching a template of the form ###-###-#### is found, PII sanitizing module202can conclude that this sequence likely represents a phone number. Further, in the case where a sequence of characters and symbols matching the template *@*.* is found, PII sanitizing module202can conclude that this sequence likely represents an email address.

At step306, PII sanitizing module202can check whether any PII was found in the visual data sample per the identification performed at block304. If the answer is no, PII sanitizing module202can output the visual data sample without modifications (step308) and flowchart300can end.

However, if the answer at step306is yes, PII sanitizing module202can sanitize (i.e., remove, obfuscate, or transform) the identified PII, thereby converting the visual data sample into a sanitized/identity-neutral form (step310). The specific manner in which model202performs this sanitization can differ based on the types of PII found. For example, for PII constituting biological features (e.g., a face), PII sanitizing module202can obfuscate the biological features by either (1) blurring the features while retaining their general shape and position, or (2) replacing the features with a random pattern, a generic placeholder (e.g., a face icon), or a constant color value. Alternatively, PII sanitizing module202can use a generative ML model to transform the biological features into those of an entirely different person (e.g., a random or a default person), or replace the entire data sample with one or more embedding vectors (i.e., low-dimensional representations) of the biological features via an ML model that has been trained to construct such embedding vectors in an identity-neutral manner.

For PII constituting location features such as street signs, geographic landmarks, house numbers, and the like, PII sanitizing module202can use a semantic segmentation model to retain the features of interest in the foreground of the visual data sample (e.g., people and/or objects) while replacing all other pixels with a constant “green screen” value (or some other value), thereby removing location features that may appear in the sample's background. Alternatively, PII sanitizing module202can use a generative model to retain the features of interest in the foreground and replace all other pixels with some neutral/synthetic environment, thereby transforming the background location depicted in the original sample into a completely different location.

And for PII constituting text, PII sanitizing module202can obfuscate the text by either blurring/censoring the text or replacing it with a generic template representative of the type of information the text was meant to convey (e.g., 555-555-5555 in the case of a phone number).

Finally, upon completing the sanitization at step310, PII sanitizing module202can output the sanitized version of the visual data sample (step312) and flowchart300can end.

4. Sanitizing PII in Audio Data with Speech

FIG.4depicts a flowchart400of a first approach that may be implemented by PII sanitizing module202ofFIG.2for sanitizing PII from audio data comprising speech that is received from A/V capture module102according to certain embodiments. This first approach involves extracting standard speech features from the speech, which will typically remove most types of significant PII (e.g., pitch). Note that these extracted speech features can be used directly for inference, however, the removed PII components should be re-inserted in some form for labeling. Accordingly, flowchart400also includes steps for resynthesizing the original speech from the extracted features. This permits, e.g., a labeler to listen to and transcribe the resynthesized speech for ML model training purposes. Generally speaking, resynthesizing the speech from the extracted speech features will remove enough PII to make it unidentifiable to humans.

Starting with steps402and404of flowchart400, PII sanitizing module202can receive an audio data sample (e.g., an audio signal/recording) that includes speech and can extract standard speech features from the speech using one or more known methods. Examples of these standard speech features include filterbank energies, mel-scaled cepstral coefficients, and perceptual linear prediction features. As noted above, the extraction of these features will generally remove significant PII from the audio data sample without negatively affecting speech recognition accuracy.

At step406, PII sanitizing module202can resynthesize the speech in the original audio data sample from the extracted features via an ML resynthesis model that is trained on the speech of the original speaker or one or more other speakers (e.g., random speakers or a default speaker). In other words, the resynthesis model is trained by receiving speech features as input and learning to output speech fragments uttered the by the original speaker or the one or more other speakers that correspond to the input speech features. As mentioned previously, performing this resynthesis from the extracted speech features will likely remove enough PII to make the resynthesized speech unidentifiable to humans (although it may be identifiable by speaker identification systems that have access to reference recordings of the original speaker).

Finally, at block408, PII sanitizing module202can output a sanitized audio sample comprising the resynthesized speech and flowchart400can end.

FIG.5depicts a flowchart500of a second approach that may be implemented by PII sanitizing module202for sanitizing PII from audio data comprising speech that is received from A/V capture module102according to certain embodiments. This second approach involves using an ML remapping model to directly remap the speech included in the audio data sample to the speech of one or more other speakers (e.g., random speakers or a default speaker), without performing speech feature extraction.

In the case where the remapping model is designed to remap speech to a specific/default speaker, the remapping model can be trained by receiving training data from many different speakers speaking certain sentences or words and training the model to output the same sentences/words as spoken by that specific/default speaker. Upon completing this training, the remapping model will remap the speech of any speaker to sound like the specific/default speaker.

In the case where the remapping model is designed to remap speech to some random speaker target, the remapping model can be trained by receiving training data from many different speakers speaking certain sentences or words and training the model to output the same sentences/words as spoken by any one of a number of random speakers. Upon completing this training, the remapping model will remap the speech of any speaker to sound like some other random speaker.

Starting with block502, PII sanitizing module202can receive an audio data sample (e.g., an audio signal/recording) comprising speech from A/V capture module102.

At blocks504and506, PII sanitizing module202can identify (using, e.g., a voice activity detector (VAD)) speech regions in the audio data sample and can provide the identified speech regions as input to the remapping model, resulting in one or more audio samples of those speech regions as spoken by another speaker S. As mentioned above, speaker S may be a specific/default speaker or a randomly chosen speaker.

At block508, PII sanitizing module202can combine the one or more audio samples output by the remapping model and generate a new, sanitized audio data sample with this remapped speech. Finally, PII sanitizing module202can output the sanitized audio data sample (block510) and flowchart500can end.

It should be noted that in certain embodiments, the approaches ofFIGS.4and5can be combined into a hybrid approach whereby (1) standard speech features are first extracted from the audio data sample received from A/V capture module102(in order to remove most PII), and (2) those extracted speech features are subsequently remapped to standard speech features extracted from the speech of another speaker S (either a specific/default speaker or a random speaker). This hybrid approach has the effect of removing any remaining PII that may still be present in the speech features extracted from the original audio data sample.

Because the output of the hybrid approach is a set of sanitized speech features (rather than sanitized speech) corresponding to some different speaker S, speech resynthesis is needed in order to allow a labeler to listen to and label that output. This resynthesis can be performed in a manner similar to step406of flowchart400(i.e., via an ML resynthesis model). Note that resynthesizing speech from the sanitized speech features output by the hybrid approach (rather than from the “un-sanitized” features extracted via the approach shown inFIG.4) has the advantage of preventing speaker identification systems from identifying the original speaker using the resynthesized speech.

5. Example Computing Device

FIG.6is a simplified block diagram of an example computing device600according to certain embodiments. Computing device600may be used to implement, either in hardware, software, or a combination thereof, any of the techniques described in the foregoing sections. As shown, computing device600includes one or more processors602that communicate with a number of peripheral devices via a bus subsystem604. These peripheral devices include a storage subsystem606(comprising a memory subsystem608and a file storage subsystem610), input devices612, output devices614, and a network interface subsystem616.

Bus subsystem604can provide a mechanism for letting the various components and subsystems of computing device600communicate with each other as intended. Although bus subsystem604is shown schematically as a single bus, alternative embodiments of the bus subsystem can utilize multiple buses.

Network interface subsystem616can serve as an interface for communicating data between computing device600and other computing devices or networks. Embodiments of network interface subsystem616can include wired (e.g., coaxial, twisted pair, or fiber optic Ethernet) and/or wireless (e.g., Wi-Fi, cellular, Bluetooth, etc.) interfaces.

Input devices612can include a camera, a touch-screen incorporated into a display, a keyboard, a pointing device (e.g., mouse, touchpad, etc.), a microphone, and/or other types of input devices. In general, use of the term “input device” is intended to include all possible types of devices and mechanisms for inputting information into computing device600.

Output devices614can include a display subsystem (e.g., a flat-panel display), an audio output device, and/or the like. In general, use of the term “output device” is intended to include all possible types of devices and mechanisms for outputting information from computing device600.

Storage subsystem606includes a memory subsystem608and a file/disk storage subsystem610. Subsystems608and610represent non-transitory computer-readable storage media that can store program code and/or data that provide the functionality of various embodiments described herein.

Memory subsystem608can include a number of memories including a main random access memory (RAM)618for storage of instructions and data during program execution and a read-only memory (ROM)620in which fixed instructions are stored. File storage subsystem610can provide persistent (i.e., non-volatile) storage for program and data files and can include a magnetic or solid-state hard disk drive, an optical drive along with associated removable media (e.g., CD-ROM, DVD, Blu-Ray, etc.), a removable flash memory-based drive or card, and/or other types of storage media known in the art.

It should be appreciated that computing device600is illustrative and not intended to limit embodiments of the present disclosure. Many other configurations having more or fewer components than computing device600are possible.

The above description illustrates various embodiments of the present disclosure along with examples of how aspects of the present disclosure may be implemented. The above examples and embodiments should not be deemed to be the only embodiments and are presented to illustrate the flexibility and advantages of the present disclosure as defined by the following claims. For example, although certain embodiments have been described with respect to particular process flows and steps, it should be apparent to those skilled in the art that the scope of the present invention is not strictly limited to the described flows and steps. Steps described as sequential may be executed in parallel, order of steps may be varied, and steps may be modified, combined, added, or omitted.

Further, although certain embodiments have been described using a particular combination of hardware and software, it should be recognized that other combinations of hardware and software are possible, and that specific operations described as being implemented in software can also be implemented in hardware and vice versa.

The specification and drawings are, accordingly, to be regarded in an illustrative rather than restrictive sense. Other arrangements, embodiments, implementations, and equivalents will be evident to those skilled in the art and may be employed without departing from the spirit and scope of the disclosure as set forth in the following claims.