SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Duo Peng
duo_peng@mymail.sutd.edu.sg
Li Xu
li_xu@mymail.sutd.edu.sg
Qiuhong Ke
Qiuhong.Ke@monash.edu
Ping Hu
chinahuping@gmail.com
Jun Liu*
jun_lio@sutd.edu.sg
Privacy-Preserving Action Recognition (PPAR) aims to transform raw videos into anonymous ones to prevent privacy leakage while maintaining action clues, which is an increasingly important problem in intelligent vision applications. Despite recent efforts in this task, it is still challenging to deal with novel privacy attributes and novel privacy attack models that are unavailable during the training phase. In this paper, from the perspective of meta-learning (learning to learn), we propose a novel Meta Privacy-Preserving Action Recognition (MPPAR) framework to improve both generalization abilities above (i.e., generalize to novel privacy attributes and novel privacy attack models) in a unified manner. Concretely, we simulate train/test task shifts by constructing disjoint support/query sets w.r.t. privacy attributes or attack models. Then, a virtual training and testing scheme is applied based on support/query sets to provide feedback to optimize the model's learning towards better generalization. Extensive experiments demonstrate the effectiveness and generalization of the proposed framework compared to state-of-the-arts.
Recently, smart home cameras such as Amazon Echo and Google Nest Cam, have been widely used in millions of families to provide intelligent monitoring services to enhance security (e.g., detecting unusual behaviors and alerting householders remotely) [1, 2]. However, the widespread use of such cameras has raised privacy concerns and even pressured changes in the regulations/laws in Europe and US [13], as it generally requires uploading device-captured visual data that often contains rich privacy information (such as face, gender and skin color, etc) to the intelligent system deployed on cloud or public servers for analysis, which leads to the risk of privacy leakage [3, 4]. While traditional cryptographic solutions can provide video encryption during transmission between the local camera and the intelligent system, they would struggle with preventing authorized agents (e.g., the system administrator) from misusing the privacy information [13, 14].
Therefore, there is an urgent need to find an appropriate anonymization transformation to erase privacy information from the captured raw visual data at the local camera end (before the upload), while still enabling certain target tasks required by the intelligent system [5, 6, 7]. Meanwhile, since action recognition is a fundamental video understanding task with wide applications (such as the above-mentioned smart home cameras), there is a growing interest in studying anonymization transformation for privacy preservation in video action recognition, i.e., Privacy-Preserving Action
*CorrespondingAuthor
Recognition (PPAR) [8, 9, 10, 11, 12, 13, 14, 15]. The goal of PPAR is to train an anonymization model to transform the captured raw videos, so that the transformed (anonymous) videos not only avoid undesired privacy disclosure but also enable performing the specified action recognition task.
Not that while using skeleton-based models could naturally handle the privacy concerns in action recognition, the research regarding privacy preservation in RGB-based models still remains important and practical. Here are the reasons: In many scenarios, it is sometimes also necessary to incorporate information beyond action into the action recognition model. For instance, in the kitchen scenario [18] which contains many fine-grained actions, there are many actions that can be similar, such as wash dishes and cut vegetables (both require one hand to hold onto the object while the other hand performs periodic shaking motions). In this case, accurately recognizing the action requires richer contextual information from the background and surroundings. In such a scenario, simply using the skeleton to remove all other information will lead to performance degradation [19]. This indicates that in many scenarios, we still require RGB videos to provide reliable action recognition. Therefore, In RGB-based action recognition, learning how to remove privacy information while retaining both action information and related visual cues for accurate action recognition becomes extremely important. Recently, it has attracted increasing attention and a series of works [13, 15, 28] has been proposed, reflecting the significance of tackling privacy concerns within RGB-based action recognition. Furthermore, RGB-based action recognition has already been extensively deployed in many household applications [20], such as Amazon Echo and Google Nest Cam. Therefore, the privacy preservation for RGB-based action recognition (i.e., PPAR) is of utmost urgency.
In PPAR, some video downsampling-based methods [8, 9, 10] propose to produce extremely low-resolution videos to create privacy-preserving "anonymous videos". Besides, there exist some obfuscation-based methods [11, 12] that propose to produce "anonymous videos" by blurring videos. Although these video processing-based methods have shown promising results, simply discarding visual content without end-to-end learning often cannot provide a good trade-off between action recognition and privacy preservation. To handle this issue, recent methods [13, 14, 15] propose to explicitly optimize the action-privacy trade-off by training an anonymization model to remove privacy information through an adversarial learning framework. Specifically, the adversarial learning framework incorporates the action recognition model and the privacy classification model, to train the anonymization model using a minimax optimization strategy where the action recognition loss is minimized while the privacy classification loss is maximized, ultimately achieving a good trade-off between action recognition and privacy preservation. However, despite the progress, these methods still struggle in real-world applications due to their limited generalization ability, which can manifest in the following two aspects:
- In real-world applications, video data often contains very rich personal information that are difficult to be exhaustively enumerated, such as palm prints, fingerprints, faces, credit cards, cellphone screen information, etc. This makes it almost impossible to ensure that all potential privacy information has been comprehensively labeled in the training data. Existing works focusing on locating and removing privacy attributes through labeled supervision do not explicitly deal with the novel (unseen) privacy attributes, which can be unsuitable to handle the real-world applications where the video data can include a broad range of potential privacy attributes.
- On the other hand, an ideal privacy-preserving framework should also be model-agnostic, i.e., preventing various possible privacy attack (i.e., privacy classification) models from stealing privacy information [13, 14]. However, previous studies often use specified privacy attack models for privacy-preserving training, which might limit their privacy-preserving performance when facing novel privacy attack models. Furthermore, due to the rapid development and evolution of privacy classification models [16, 17], it is impractical to collect all possible privacy attack models for privacy-preservation training to ensure the attack model during testing is always seen before.
Thus in this paper, we aim to build a privacy-preserving action recognition framework with better generalization abilities in terms of both the above-mentioned aspects: handling novel privacy attributes as well as novel privacy attack models. We observe that these two aspects both require the anonymization model to learn generalizable knowledge about identifying and removing privacy information, that can generalize beyond the given dataset (with limited labeled privacy attributes) and specified attack models. Despite the conceptual simplicity, how to guide anonymization models to learn such generalizable knowledge is challenging. Here from the perspective of meta learn
ing, we propose a novel framework, Meta Privacy-Preserving Action Recognition (MPPAR), to simultaneously improve both generalization abilities of the anonymization model.
Meta learning, also known as learning to learn, aims to enhance the model generalization capability by performing virtual testing during model training [21, 22]. Inspired by this, to improve the generalization capability of the anonymization model, our framework incorporates a virtual training and testing scheme that consists of three steps: virtual training, virtual testing and meta optimization. Specifically, we first construct a support set for virtual training, and a query set for virtual testing. Since we aim to improve the model generalization capability w.r.t. both novel privacy attributes and novel privacy attack models, we construct the support set and query set accordingly as follows. For handling novel privacy attributes, we split the training data to construct a support set and a query set where the videos of the query set contain labeled privacy attributes that are unseen in the support set. Similarly, for handling novel privacy attack models, we split a collection of privacy attack models (for training) into a support set and a query set, which contain different attack models.
Based on the constructed sets, we design a novel virtual training and testing scheme. Specifically, we first train the model over the support set (i.e., virtual training), and then test the trained model on the query set (i.e., virtual testing). Based on the testing performance (loss) on the query set, we perform the meta optimization to update the model for better generalization capability. Since the query set contains novel privacy attributes (and novel attack models) w.r.t. the support set, by improving the model's testing performance on the query set after training on the support set via virtual training and testing, the model is driven to learn more generalizable knowledge that can help remove potentially unseen privacy attributes (and defend against unknown privacy attackers), during virtual training. In this way, we can effectively improve the model generalization capability, even when handling samples with novel privacy attributes and facing attacks from novel privacy attack models.
Privacy-Preserving Action Recognition (PPAR). Existing PPAR methods can be broadly classified into three main categories: (1) downsampling-based methods, (2) obfuscation-based methods, and (3) adversarial-learning-based methods. Generally, downsampling-based methods [8, 9, 10] propose to down-sample each video frame into a low-resolution frame to anonymize the privacy information. Obfuscation-based methods [11, 12] mainly use off-the-shelf object detectors to first detect privacy regions, and then blur the detected regions. Recently, in order to achieve a better action-privacy tradeoff, adversarial-learning-based methods [13, 14, 15, 28] adopt a minimax optimization strategy (i.e., adversarial learning) to simultaneously optimize the action recognition and the privacy preservation. Specifically, Sudhakar et al. [15] proposed a BDQ anonymization model to preserve privacy in a spatio-temporal manner. While effective in dealing with seen privacy attributes and attack models, this method may struggle in handling the generalization problem (e.g., novel attributes or novel attack models). Although Wu et al. [13, 14] have proposed a model-ensemble strategy to enhance the model generalization ability to novel attack models, such a strategy might make the trained anonymization model biased towards the attack models used for training. Dave et al. [28] proposed a novel contrastive learning approach to train a visual encoder for attribute-generalizable privacy preservation. Nevertheless, due to its focus on generalization learning without utilizing labeled data, it may lead to sub-optimal privacy protection performance when compared to supervised methods on the labeled attributes. Differently, in this paper, we propose a novel framework that not only retains the benefits from learning with labeled data, but also simultaneously improves the privacy-preserving performance on both novel privacy attributes and novel privacy attack models, in a unified manner.
Meta Learning. The paradigm of learning to learn, known as meta learning, has emerged primarily to tackle the problem of few-shot learning [21, 22, 23, 24]. Specifically, MAML [21] and its subsequent works [22, 23] aim to learn a good initialization of network parameters to achieve fast test-time updates and adapt to new few-shot learning tasks. More recently, meta learning has also been explored in other domains [25, 26, 27] to enhance model performance without requiring test-time updates. Different from typical meta learning methods for few-shot learning, our method aims to address the challenging PPAR problem involving novel attributes and unknown attack models. To this end, we propose a novel framework to optimize the PPAR model via a virtual training and testing scheme over the carefully constructed support and query sets.
3 Basic Model
Here we first introduce an adversarial-learning-based PPAR model and its training strategy, which has shown promising performance and served as the basis of many state-of-the-art methods [13, 14, 15]. In this paper, we also adopt this model as the basis of our framework. In this basic model, the original video data  $X$  is sent into the anonymization model  $f^{D}$  to generate the anonymous video  $f^{D}(X)$ . To train the anonymization model  $f^{D}$ , its output (i.e., the anonymized video  $f^{D}(X)$ ) is sent into an action recognition model  $f^{A}$  and a privacy classification (attack) model  $f^{P}$ , respectively. The action recognition model predicts the class of the action presented in the anonymized video, while the privacy classification model predicts the existence of each related privacy attribute in the video. The three models  $(f^{D}, f^{A},$  and  $f^{P})$  are all learnable neural networks, and are trained under an adversarial learning algorithm. Specifically, the optimization objective for updating the anonymization model  $f^{D}$  is defined as:
$$
\min _ {f ^ {D}} L, \quad \text {w h e r e :} \quad L = L _ {\text {a c t i o n}} (f ^ {A} (f ^ {D} (X)), Y ^ {A}) - \gamma L _ {\text {p r i v a c y}} (f ^ {P} (f ^ {D} (X)), Y ^ {P}), \qquad (1)
$$
where  $Y^{A}$  denotes the action recognition label,  $L_{action}$  denotes the classification (cross-entropy) loss,  $Y^{P}$  represents privacy attribute labels,  $L_{privacy}$  is the multiple binary cross-entropy loss for multiple privacy labels and  $\gamma$  is a weight coefficient to balance these two terms. By minimizing  $L_{action}$  and  $-L_{privacy}$  (i.e., maximizing  $L_{privacy}$ ), the anonymization model  $f^{D}$  is optimized to learn to retain the video content that can maintain the action recognition accuracy while removing privacy attribute information as much as possible to lower the privacy classification accuracy, thus to fulfill the goal of privacy-preserving action recognition.
The optimization objective for updating the action recognition model  $f^{A}$  is defined as:
$$
\min  _ {f ^ {A}} L _ {\text {a c t i o n}} \left(f ^ {A} \left(f ^ {D} (X)\right), Y ^ {A}\right). \tag {2}
$$
The optimization objective for updating the privacy classification model  $f^{P}$  is defined as:
$$
\min  _ {f ^ {P}} L _ {\text {p r i v a c y}} \left(f ^ {P} \left(f ^ {D} (X)\right), Y ^ {P}\right). \tag {3}
$$
Eq. 2 and 3 are used to maintain the reliable performance of the action recognition model and the privacy classification model, respectively. The total learning algorithm is handled as a competition (adversarial) game [13, 14] among Eq. 1, 2 and 3. Thus after competition with each other, the capabilities of all three models (i.e.,  $f^{D}$ ,  $f^{A}$  and  $f^{P}$ ) can be gradually enhanced.
4 Proposed Framework
In PPAR, existing state-of-the-art models: (1) generally focus on removing privacy information based on given privacy attribute labels seen by the model during training, and (2) typically handle the privacy preservation task by fooling the predefined privacy classification (attack) models. As a result, after training with the given attribute labels and attack models, these methods often struggle when encountering new privacy attributes or new attack models that are unseen during training. To handle this issue, we aim to guide the model to learn more generalizable knowledge that can be applied for privacy preservation in an attribute
agnostic and model-agnostic manner, which however is non-trivial. Here from the perspective of meta learning, we propose a novel MPPAR framework to improve generalization abilities of the anonymization model w.r.t. the above two aspects in a unified manner.
Figure 1: Illustration of our virtual training and testing scheme. This scheme is handled by three steps: Virtual Training (marked in blue), Virtual Testing (green), and Meta Optimization (red).
As mentioned before, our framework is based on the Basic Model that contains three training objectives for updating  $f^{D}$ ,  $f^{A}$  and  $f^{P}$ , respectively. Since we aim to improve  $f^{D}$  for better generalization, in our framework, we only modify the training of  $f^{D}$  (Eq. 1), while the updates of  $f^{A}$  (Eq. 2) and  $f^{P}$  (Eq. 3) remain the same. More specifically, our framework incorporates a virtual training and testing scheme for training  $f^{D}$ . In this scheme, taking the procedures for handling novel privacy attributes as an instance, we intentionally split the original training set to construct a support set  $D_{s}$ , and a query set  $D_{q}$ , where  $D_{q}$  contains novel privacy attribute labels w.r.t.  $D_{s}$ . Then, we first train the anonymization model  $f^{D}$  using the support set  $D_{s}$  (virtual training), and then test the model's performance on the query set  $D_{q}$  (virtual testing). As the query set contains novel privacy attributes w.r.t. the support set, if the model can still achieve good testing performance on the query set after being trained on the support set, it indicates that the trained model has learned more generalizable knowledge about removing various potential privacy information (including the novel privacy attributes) that are irrelevant to action recognition. With the virtual testing performance as a feedback, we can optimize the virtual training process to drive the model's learning behavior towards learning more attribute-generalizable knowledge. Via similar process, we can also optimize the model to handle novel privacy attack models. Below, we first describe the virtual training and testing scheme, and then discuss how we construct the support set and query set.
4.1 Virtual Training and Testing
- Virtual Training. As shown in Fig. 1 (blue), during virtual training, we train the anonymization model via conventional gradient descent with the support set  $D_{s}$ . Specifically, we denote the parameters of the anonymization model as  $\phi$ , and calculate the virtual training loss  $L_{v\_ tr}$  as:
$$
L _ {v \_ t r} (\phi) = L (\phi , D _ {s}) \tag {4}
$$
where  $L$  is the loss function (defined in Eq. 1) for updating the anonymization model. After calculating the virtual training loss, we can update our anonymization model's parameters  $\phi$  via gradient descent:
$$
\phi^ {\prime} = \phi - \alpha \nabla_ {\phi} L _ {v _ {t r}} (\phi) \tag {5}
$$
where  $\alpha$  is the learning rate for virtual training. In this way, the model may be easy to learn the knowledge specific to the support set  $D_{s}$  (e.g., removing privacy attributes labeled in the support set  $D_{s}$ ). However, it might not be beneficial for the model performance on the query set (e.g., the query set contains novel privacy attributes). Therefore, in this step, we do not actually update the anonymization model to be  $\phi^{\prime}$  (hence the term "virtual"). Instead, the virtually updated model parameters  $\phi^{\prime}$  merely serve as an intermediary to calculate the virtual testing loss  $L_{v\_te}$ , which is described in the next step.
— Virtual Testing. As shown in Fig. 1 (green), after virtual training, we then evaluate the performance of the virtually trained model on the query set  $D_{q}$ :
$$
L _ {v \_ t e} \left(\phi^ {\prime}\right) = L \left(\phi^ {\prime}, D _ {q}\right) \tag {6}
$$
As we intentionally make the query set contain novel attributes w.r.t. the support set, this virtual testing loss  $L_{v\_te}(\phi')$  can indicate the model's generalization capability to handle the privacy attributes beyond the support set after virtual training. The lower the virtual testing loss is, the better the model (after training) generalizes to unseen attributes. Thus,  $L_{v\_te}(\phi')$  can serve as a feedback to drive the model to adjust its training on the support set towards learning more generalizable knowledge via the following meta optimization step.
Meta Optimization. As discussed above, we aim to optimize the initial model  $\phi$ , so that after learning (update) on the support set (i.e.,  $\phi \rightarrow \phi'$ ), it can also obtain good testing performance (i.e., low  $L_{v\_te}(\phi')$ ) on the query set that contain novel privacy attributes against the training data. To this end, we draw inspirations from MAML [21] and formulate the meta optimization objective as:
$$
\begin{array}{l} \min  _ {\phi} L _ {v \_ t r} (\phi) + L _ {v \_ t e} (\phi^ {\prime}) \\ = \min  _ {\phi} L _ {v \_ t r} (\phi) + L _ {v \_ t e} \left(\phi - \alpha \nabla_ {\phi} L _ {v \_ t r} (\phi)\right) \tag {7} \\ \end{array}
$$
where the first term  $L_{v\_ tr}(\phi)$  indicates the model's training performance, and the second term  $L_{v\_ te}(\phi')$  represents the model's testing performance (on novel privacy attributes) after virtual updating. Note that instead of optimizing  $\phi$  and  $\phi'$  sequentially, the meta optimization mentioned
above is performed solely on the initial model  $\phi$ , while  $\phi'$  merely serves as an intermediary for evaluating the model's generalization performance on novel privacy attributes. Intuitively, the objective in Eq. 7 is to learn how to train  $\phi$  on the support set (i.e., lower  $L_{v\_tr}(\phi)$ ) for better generalization performance (i.e., lower  $L_{v\_te}(\phi')$ ). Based on Eq. 7, we actually update the model with respect to  $\phi$  as:
$$
\phi \leftarrow \phi - \beta \nabla_ {\phi} \left(L _ {v _ {t r}} (\phi) + L _ {v _ {t e}} \left(\phi - \alpha \nabla_ {\phi} L _ {v _ {t r}} (\phi)\right)\right) \tag {8}
$$
where  $\beta$  denotes the learning rate for meta-optimization. The above process of meta optimization is illustrated in Fig. 1 (red). As both  $L_{v\_ tr}(\cdot)$  and  $L_{v\_ te}(\cdot)$  in Eq. 8 are based on loss  $L(\cdot)$  (Eq. 1), which is proposed to learn to keep the action recognition accuracy while removing privacy attribute information, thus by learning the meta optimization updating rule in Eq. 8, the anonymization model can be guided to learn more generalizable knowledge about retaining action clues while removing other irrelevant visual content that includes various potentially unseen privacy attributes.