SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Here we provide an intuitive explanation of the meta optimization. In the virtual training step, we simply learn a model on the support set (i.e.,  $\phi \rightarrow \phi'$ ). The model  $\phi'$  captures knowledge of the provided set well, yet may suffer from the limited generalization ability when handling novel attributes. Hence, it is critical to adjust the training process to optimize the model in a less biased way. To this end, we add a virtual testing loss term as shown in Eq. 7. Since we intentionally design the support set and query set to be disjoint, the virtual testing loss naturally serves as a regularization (feedback) to penalize the learning objective with second-order gradients (i.e., meta gradients, see Eq. 8) when the model generalizes poorly after virtual training. As a result, the biases of the training set are suppressed and the model turns to learn more generalizable knowledge that can help remove as much action-irrelevant information (including various potential privacy attributes) as possible. Note again, while we illustrate the above virtual training and testing scheme using privacy attributes as an example, this scheme is equally applicable for handling novel privacy attack models. We will discuss how to simultaneously address both aspects in Sec. 4.2.
From the above analysis, we show that the efficacy of our framework lies in incorporating the virtual testing performance to provide the feedback (meta gradients) to optimize the training process, which enables the model to learn how to train itself to exploit the desired general knowledge for generalization to unseen concepts, such as novel privacy attributes and novel attack models. Note that we do not aim to use the query set to simulate the real testing scenario (which is unknown during training) for model to learn. Instead, we only need the query set to contain novel concepts w.r.t. the support set, so as to provide an effective feedback to drive the model's learning to learn more set-generalizable knowledge and less set-specific knowledge.
4.2 Set Construction
Based on the above virtual training and testing scheme, we can achieve the two target objectives: generalizing to novel privacy attributes and novel attack models, in a unified framework by constructing respective support and query sets as follows: Given the training data  $X_{train}$  and a set of privacy attack models (for training)  $f_{train}^{P}$ , we construct a support set  $D_{s}$  and a query set  $D_{q}$  at the beginning of each training iteration. Specifically, for every odd-numbered iteration,  $D_{s}$  and  $D_{q}$  are constructed by splitting the training data  $X_{train}$  to construct two subsets:  $X_{s}$  and  $X_{q}$ , where  $X_{q}$  contains novel privacy attributes w.r.t.  $X_{s}$  (i.e.,  $D_{s} = X_{s}$  and  $D_{q} = X_{q}$  in this case). Thus at each odd-numbered iteration, we train the anonymization model to learn to generalize to novel privacy attributes via the virtual training and testing scheme based on the constructed  $X_{s}$  and  $X_{q}$ . For every even-numbered iteration,  $D_{s}$  and  $D_{q}$  are constructed by splitting the privacy attack models  $f_{train}^{P}$  to construct  $f_{s}^{P}$  and  $f_{q}^{P}$  that contain different attack models (i.e.,  $D_{s} = f_{s}^{P}$  and  $D_{q} = f_{q}^{P}$  in this case). Thus at each even-numbered iteration, we train the anonymization model to learn to generalize to novel attack models based on  $f_{s}^{P}$  and  $f_{q}^{P}$ . In this odd-even way, we alternate the learning of attribute-wise and model-wise generalization iteratively, thus enhancing both generalization capabilities of the model. This means that, due to the unified nature of our scheme, enhancing the model's both generalization abilities has now been reduced to a straightforward designing of their respective set construction methods. Below, we separately discuss each construction method.
A. Constructing sets w.r.t. novel privacy attributes. With respect to the attribute labels, we construct the support set and query set in two steps. Step (A1) At the beginning of each epoch, we intentionally split the training data  $X_{train}$  into two subsets  $\{X_1,X_2\}$ , where  $X_{2}$  contains data with novel privacy attributes w.r.t.  $X_{1}$ . Step (A2) At the start of every odd-numbered training iteration,
we select a batch of data from the first subset  $X_{1}$  to construct a support set  $X_{s}$ , and select a batch of data from the second subset  $X_{2}$  to construct a query set  $X_{q}$ .
B. Constructing sets w.r.t. novel attack models. In a similar manner, we also construct the support and query sets w.r.t. privacy attack models in the following two steps. Step (B1) At the start of each epoch, we split all models in  $f_{train}^{P}$  into two subsets  $\{f_1^P,f_2^P\}$  with different privacy attack models. Step (B2) Then at the start of every even-numbered training iteration, we randomly select one model from  $f_{1}^{P}$  as the support set  $f_{s}^{P}$  and one model from  $f_{2}^{P}$  as the query set  $f_{q}^{P}$ .
Note that at each odd-numbered iteration (for attribute-wise generalization learning), we randomly select one privacy attack model from  $f_{train}^{P}$  for anonymization model's training (all models in  $f_{train}^{P}$  are trained by the adversarial learning algorithm). At each even-numbered iteration (for model-wise generalization learning), we randomly sample a batch of data from  $X_{train}$  to train the anonymization model. Moreover, to help the anonymization model to cover a wide range of possible attribute shift (and attack model shift) from the provided data set (and model set), instead of fixing  $\{X_1,X_2\}$  (and  $\{f_1^P,f_2^P\}$ ) during the whole training process, at the beginning of each training epoch, we re-split the training data  $X_{train}$  (and training attack models  $f_{train}^{P}$ ) to reconstruct  $\{X_1,\bar{X}_2\}$  (and  $\{f_1^P,f_2^P\}$ ). It is worth mentioning that our method is convenient to use, since we only need to construct the corresponding sets via the above strategy and change the model training loss without the need to change model structures.
Notewise, an alternative approach to achieve both generalization objectives in a unified framework is to perform both attribute-wise and model-wise learning simultaneously in each iteration, which is also effective for enhancing model generalization capability w.r.t. the above-mentioned aspects, while our method with odd-even alternation performs slightly better in both training convergence and performance (see Sec. 5.5), since it decouples the twofold generalization problem into two individual ones to solve, and thus eases the model training and obtains better performance.
4.3 Overall Training and Testing
During training, we follow previous works [13, 14] to alternatively update the three models  $(f^{D}, f^{A}$  and  $f^{P})$  by using the adversarial training algorithm. At the start of each iteration for updating the anonymization model  $f^{D}$ , we first construct the support set and query set w.r.t. privacy attributes in odd-numbered iterations and privacy attack models in even-numbered iterations following Sec. 4.2. Note that, here we only focus on the iterations of updating  $f^{D}$ , i.e., we only count the number as odd or even for iterations of updating  $f^{D}$ . After that, the constructed support set and query set are used to train the anonymization model  $f^{D}$  through the virtual training and testing scheme as discussed in Sec. 4.1. Hence, we alternatingly deal with the attribute-wise and model-wise generalization problem over iterations, achieving the tackling of both problems. The training for updating  $f^{A}$  and  $f^{P}$  remains the same as previous works [13, 14], detailed in Supplementary. During testing, we follow the evaluation procedures of [13, 14, 28] to evaluate the model's generalization ability to novel privacy attack models and novel privacy attributes. We additionally provide an algorithm about the overall training scheme in Supplementary.
Previous PPAR works have proposed three evaluation protocols: evaluation on novel privacy attributes only [28]; evaluation on novel attack models only [13, 14]; evaluation on known privacy attributes and attack models [28, 15], and each protocol has its own experimental setting. Following these works, we also evaluate our framework under these three protocols. Besides, to evaluate model generalization capability more comprehensively, we further introduce a new evaluation protocol: evaluation on both novel privacy attributes and novel privacy attack models together. In each of the four protocols: we are given the training data  $X_{train}$  and training (attack) models  $f_{train}^{P}$  for model training; after training, we evaluate the trained anonymization model on the testing data  $X_{test}$  with testing (attack) models  $f_{test}^{P}$ . The difference between these four protocols lies in whether  $X_{train}$  and  $X_{test}$  (or  $f_{train}^{P}$  and  $f_{test}^{P}$ ) contain the same privacy attributes (or attack models).
**Benchmarks.** Following previous works [13, 14, 28], we conduct experiments using two benchmarks. The first benchmark, HMDB51-VISPR, is comprised of HMDB51 [31] dataset and VISPR [30] dataset. HMDB51 [31] is a collection of videos from movies and the Internet. It has 6,849 videos with 51 action categories. VISPR [30] is a collection with a diverse set of personal privacy information. Following [13, 14, 28], we use PA-HMDB [13] that contains 515 video samples with both human action and privacy attribute labels to serve as the testing set of HMDB51-VISPR. The second
Algorithm 1: Overall Training Scheme
1 Given  $X_{train}$  and  $f_{train}^{P}$  for training;  $X_{test}$  and  $f_{test}^{P}$  for testing.  
2 Initialize  $\phi$ .  
3 for E epochs do  
4 Process  $X_{train}$  and  $f_{train}^{P}$ , following Step (A1) and Step (B1) in Sec. 4.2, respectively.  
5  $T = 0$ .  
6 for iterations I in adversarial training do  
7 if I is for updating anonymization model  $f^{D}$  then  
8 if  $T$  is odd then  
9 | Construct  $X_{v\_tr}$  and  $X_{v\_te}$  from  $X_{train}$ , following Step (A2) in Sec. 4.2.  
10 else  
11 | Construct  $f_{v\_tr}^{P}$  and  $f_{v\_te}^{P}$  from  $f_{train}^{P}$ , following Step (B2) in Sec. 4.2.  
12 end  
13 Calculate the virtual training loss  $L_{v\_tr}$  on  $D_s$  (i.e.,  $X_{v\_tr}$  or  $f_{v\_tr}^{P}$ ) using Eq. 4:  $L_{v\_tr}(\phi) = L(\phi, D_{v\_tr})$ .  
14 Calculate an updated version of anonymization model  $(\phi')$  using Eq. 5:  $\phi' = \phi - \alpha \nabla_{\phi} L_{v\_tr}(\phi)$ .  
15 Calculate the virtual testing loss  $L_{v\_te}$  on  $D_q$  (i.e.,  $X_{v\_te}$  or  $f_{v\_te}^{P}$ ) using Eq. 6:  $L_{v\_te}(\phi') = L(\phi', D_{v\_te})$ .  
16 Update using Eq. 8:  $\phi \gets \phi - \beta \nabla_{\phi} \left(L_{v\_tr}(\phi) + L_{v\_te}(\phi - \alpha \nabla_{\phi} L_{v\_tr}(\phi))\right)$ .  
17  $T = T + 1$ .  
18 else if I is for updating action recognition model  $f^{A}$  then  
19 | Randomly sample a batch of data from  $X_{train}$  to update  $f^{A}$  using Eq. 2.  
20 else  
21 | Randomly sample a batch of data from  $X_{train}$  to update  $f^{P}$  using Eq. 3.  
22 end  
23 end
benchmark, UCF101-VISPR, consists of UCF101 [29] dataset and VISPR [30] dataset. UCF101 [29] has 13,320 videos taken from 101 action categories. Following [13, 14, 28], we use the testing sets of UCF101 [29] and VISPR [30] for evaluation in this benchmark. In all protocols,  $X_{train}$  (or  $X_{test}$ ) is created by sampling from the training set (or the testing set) of the benchmark.
Evaluation Method. In all protocols, we follow previous works [13, 14] to evaluate methods in two folds: (1) action recognition performance – whether the anonymous videos still contain the action clues to enable the action recognition model to maintain satisfactory performance; (2) privacy preservation performance – whether the anonymous video can lead to poor performance of the privacy attack models. As for the evaluation of action recognition, we directly apply the trained  $f^{D}$  and  $f^{A}$  to the testing data set  $X_{test}$  (i.e.,  $f^{A}(f^{D}(X_{test}))$ ) and compute the action classification accuracy: the higher the better. As for the evaluation of privacy preservation, to empirically verify that  $f^{D}$  prohibits reliable privacy prediction (attack) for each model in
Figure 2: The frames before and after our anonymization. More results are in Supplementary.
the testing model set  $f_{test}^{P}$ , we conduct the evaluation as follows: before evaluation, we train each model in  $f_{test}^{P}$  for privacy attribute classification; during evaluation, we apply each trained model in  $f_{test}^{P}$  to perform privacy attribute classification on anonymous videos  $f^{D}(X_{test})$  (anonymized by  $f^{D}$ ) and compute the classification accuracy. The highest accuracy achieved among all models of  $f_{test}^{P}$  will be by default used to indicate the privacy leakage risk of  $f^{D}$ , where a lower value denotes better privacy preservation.
5.1 Protocol A: Evaluation on Both Novel Privacy Attributes and Novel Attack Models
Experimental Setting. In this evaluation protocol, we follow previous work [28] to set up the training data
$X_{train}$  and testing data  $X_{test}$ , making  $X_{train}$  have no overlapped privacy attributes with  $X_{test}$ . Besides, we follow [13, 14] to set up the training models  $f_{train}^{P}$  and the testing models  $f_{test}^{P}$  with totally different privacy attack models. This means in this protocol, we need to simultaneously handle novel privacy attributes and novel privacy attack models. The detailed list of training/testing attributes and attack models can be found in Supplementary.
Table 1: Results on generalization to both novel privacy attributes and attack models.
Methods	HMDB51-VISPR	UCF101-VISPR
Action (Top-1 ↑)	Privacy (cMAP ↓)	Action (Top-1 ↑)	Privacy (cMAP ↓)
Raw Data	68.5	66.3	67.4	42.4
Downsample 2x [28]	59.0	63.1	50.2	36.1
Downsample 4x [28]	52.5	61.9	43.3	32.6
Obf-Blackening [28]	40.4	61.2	48.3	32.0
Obf-StrongBlur [28]	41.7	59.4	49.2	29.6
Obf-WeakBlur [28]	43.8	60.8	49.5	32.5
VITA [13]	67.9	54.5	66.5	30.2
SPAct [28]	67.6	53.8	65.7	29.3
Basic Model	67.3	55.2	65.6	31.7
Ours (full)	68.1	47.4	67.0	21.8
Implementation Details. Following [13, 14], we use the Image Transformation model [37] as  $f^{D}$ , the action recognition model C3D [32] as  $f^{A}$  and a set of privacy classification models from MobileNet-V2 [33] family as  $f_{train}^{P}$ . Since we use C3D [32], we need to split the videos into clips with a fixed frame number. We use the clip with of 16 frames with skip rate of 2. The spatial resolution of each video is resized into  $112 \times 112$ . For a fair comparison, our method and compared methods use the same model architectures. On each benchmark, we construct the support set with the videos containing  $60\%$  of the privacy attributes in the training data  $X_{train}$ , and use the remaining training data to construct the query set. We set  $\gamma$  (in Eq. 1) as 0.4, the learning rate  $\alpha$  for virtual training (in Eq. 5) as  $5e - 4$ , and the learning rate  $\beta$  for meta-optimization (in Eq. 8) as  $1e - 4$ .
Experimental Results. As shown in Tab. 1, after applying our virtual training and testing scheme to the basic model, our framework, i.e., Ours (full), improves the model performance by a large margin, which demonstrates the effectiveness of our framework in generalizing to novel privacy attributes and novel attack models simultaneously. "Raw Data" denotes directly using raw (clean) videos for testing. Moreover, compared to existing methods, Ours (full) achieves significantly better privacy performance while keeping the best action performance, demonstrating the superiority of our framework. Qualitative results are shown in Fig. 2.
5.2 Protocol B: Evaluation on Novel Privacy Attributes Only
Experiment Setting. In this experiment, we follow the evaluation protocol in [28], which focuses on the generalization to novel privacy attributes, to set up  $X_{train}$  and  $X_{test}$  containing different attributes, and use the same privacy classification model for both training and testing.
Implementation Details. Following [28], we utilize UNet [34] as  $f^D$ , R3D-18 [36] as  $f^A$ , and ResNet-50 [35] as  $f^P$ . Other implementation details remain the same as in Protocol A.
Experimental Results. For a fair comparison, our method removes the virtual training and testing iter
ations w.r.t. model-wise generalization and only carries out the attribute-wise iterations, which is denoted as Ours (only attribute) in Tab. 2. Compared to other methods, Ours (only attribute) brings obvious performance improvement, demonstrating our method's effectiveness in tackling privacy-attribute generalization problem individually. Ours (full) denotes the model trained under Protocol A, and here we also directly evaluate its performance under the current protocol. As shown, this model also achieves remarkable trade-offs, demonstrating our method trained for both generalizations can also well handle the generalization scenario where only the attributes are novel.
Table 2: Results on generalization to novel privacy attributes.
Methods	HMDB51-VISPR	UCF101-VISPR
Action (Top-1 ↑)	Privacy (cMAP ↓)	Action (Top-1 ↑)	Privacy (cMAP ↓)
Raw Data	47.8	61.7	62.9	58.3
Downsample 2x [28]	38.5	58.8	54.1	52.2
Downsample 4x [28]	32.4	58.2	39.7	41.5
Obf-Blackening [28]	20.7	57.0	53.1	53.6
Obf-StrongBlur [28]	21.3	56.9	55.6	53.7
Obf-WeakBlur [28]	23.5	57.3	61.5	55.8
VITA [13]	45.1	53.4	62.1	49.6
SPAct [28]	44.7	45.3	62.0	47.1
BDQ [15]	46.6	52.2	62.3	48.8
Basic Model	44.5	54.0	61.8	50.1
Ours (only attribute)	47.2	43.5	62.5	32.2
Ours (full)	47.5	43.2	62.6	32.0
5.3 Protocol C: Evaluation on Novel Privacy Attack Models Only
Experiment Setting. We follow the protocol used in [13, 14], which focuses on the generalization to novel privacy attack models, to set up the training and testing models  $f_{train}^{P}$  and  $f_{test}^{P}$  containing totally different privacy attack models. The training data  $X_{train}$  and testing data  $X_{test}$  contain the same privacy attributes.
Implementation Details. For a fair comparison, we use the same model architectures as [13, 14] (Sec. 5.1). Other implementation details are same as Protocol A.
Experimental Results. For a fair comparison, in this experiment, our method only adopts virtual training
and testing iterations w.r.t. model-wise generalization, which is denoted as Ours (only model). As shown in Tab. 3, compared to existing methods and the basic model, Ours (only model) can reduce the privacy leakage by a large margin, showing our method's effectiveness in model-wise generalization. Furthermore, Ours (full) can also outperform existing methods on the privacy performance while maintaining the best action performance, demonstrating our framework trained for both generalizations can also well handle the generalization where only the attack models are novel.
Table 3: Results on generalization to novel privacy attack models.
Methods	HMDB51-VISPR	UCF101-VISPR
Action (Top-1 ↑)	Privacy (cMAP ↓)	Action (Top-1 ↑)	Privacy (cMAP ↓)
Raw Data	67.9	76.5	67.4	46.3
Downsample 2x [28]	58.9	73.2	50.2	38.3
Downsample 4x [28]	52.6	72.9	43.3	34.7
Obf-Blackening [28]	40.2	70.4	48.3	31.1
Obf-StrongBlur [28]	41.8	71.6	49.2	30.8
Obf-WeakBlur [28]	43.3	71.7	49.5	35.2
VITA [13]	66.6	64.8	66.5	34.2
SPAct [28]	66.3	66.7	65.7	35.0
Basic Model	66.1	66.9	65.2	35.3
Ours (only model)	67.3	53.9	66.9	27.7
Ours (full)	67.4	53.6	67.0	27.3
5.4 Protocol D: Evaluation on Known Privacy Attributes and Attack Models
Experiment Setting. We follow the protocol used in [28], which also proposes to conduct evaluation on known privacy attributes and privacy attack models, to use  $X_{train}$  and  $X_{test}$  that contain the same attributes and adopt the same privacy classification model for both training and testing.
Implementation Details. For a fair comparison, we follow the previous work [28] using the same model architectures (see Sec. 5.2). Other implementation details are the same as in Protocol A.
Experimental Results. In this protocol, since we only have one privacy classification model, we cannot
perform the virtual training and testing iterations w.r.t. model-wise generalization, but we can still carry out attribute-wise iterations, as  $X_{train}$  contains multiple privacy attributes. Therefore, in this protocol, we adopt Ours (only attribute) to fairly compare with others. As shown in Tab. 4, the downsampling-based methods bring obvious performance drop in action recognition. In contrast, our method achieves the closest action recognition performance to Raw Data, and meanwhile outperforms other learning-based methods [13, 28, 15] in privacy preservation. This can be attributed to that by training the model to capture more general knowledge, our framework can help the model to better understand the given video and find its privacy information, which thus can generally improve model performance. We can also see that Ours (full) shows comparable results with Ours (only attribute).
Table 4: Results on generalization to known privacy attributes and privacy attack models.
Methods	HMDB51-VISPR	UCF101-VISPR
Action (Top-1 ↑)	Privacy (cMAP ↓)	Action (Top-1 ↑)	Privacy (cMAP ↓)
Raw Data	43.8	70.6	62.9	64.6
Downsample 2x [28]	36.1	61.2	54.1	57.2
Downsample 4x [28]	25.8	41.4	39.7	50.1
Obf-Blackening [28]	34.2	63.8	53.1	56.4
Obf-StrongBlur [28]	36.4	64.4	55.6	55.9
Obf-WeakBlur [28]	41.7	69.4	61.5	63.5
VITA [13]	42.3	62.3	62.1	55.3
SPAct [28]	43.1	62.7	62.0	57.4
BDQ [15]	43.3	61.8	62.3	53.5
Basic Model	42.1	62.8	62.0	55.7
Ours (only attribute)	43.4	61.0	62.5	53.2
Ours (full)	43.5	61.2	62.6	53.2
Impact of alternate learning with odd and even numbered iterations. To enhance model generalization abilities to both novel privacy attributes and novel privacy attack models, we perform the attribute-wise virtual training and testing and model-wise virtual training and testing for odd-numbered iterations and even-numbered iterations, respectively. In this alternate way, the model can learn to improve both abilities in the whole training process, simultaneously. To investigate the impact of alternate learning, we evaluate the variant by using both virtual training and testing strategies at each single iteration, denoted as attri+model learning. As shown in Tab. 5 and Fig. 3, alternate learning outperforms the variant and shows faster convergence, which demonstrates its effectiveness. More ablation studies are in Supplementary
Table 5: Ablation results of attri+model learning and alternate learning.
Methods	HMDB51-VISPR	UCF101-VISPR
Action ↑	Privacy ↓	Action ↑	Privacy ↓
attr+model learning	67.9	47.9	66.8	22.4
alternate learning	68.1	47.4	67.0	21.8
Loss	3000	6000	9000	Iterations
Figure 3: The loss curves of attri+model learning and alternate learning.
In this paper, we have proposed a unified framework that improves the generalization ability of anonymization model, through simultaneously improving its performance for handling novel privacy attributes and novel privacy attack models. By carefully constructing the support set and query set with different attributes and attack models, our framework trains the anonymization model with a virtual training and testing scheme and guides it to learn knowledge that is general to scenarios where the privacy attributes and attack models are novel. Extensive experiments have shown the efficacy of our framework under different settings.
This work was supported in part by the National Key Research and Development Program of China under Grant 2022YFA1004100, National Research Foundation, Singapore under its AI Singapore Programme (AISG Award No: AISG2-PhD-2022-01-027), Singapore Ministry of Education (MOE)
AcRF Tier 2 under Grant MOE-T2EP20222-0009, National Research Foundation Singapore through AI Singapore Programme under Grant AISG-100E-2023-121, and SUTD SKI Project under Grant SKI 2021_02_06.