A Study of Face Obfuscation in ImageNet

1 INTRODUCTION . Visual data is being generated at an unprecedented scale . People share billions of photos daily on social media ( Meeker , 2014 ) . There is one security camera for every 4 people in China and the United States ( Lin & Purnell , 2019 ) . Even your home can be watched by smart devices taking photos ( Butler et al. , 2015 ; Dai et al. , 2015 ) . Learning from the visual data has led to computer vision applications that promote the common good , e.g. , better traffic management ( Malhi et al. , 2011 ) and law enforcement ( Sajjad et al. , 2020 ) . However , it also raises privacy concerns , as images may capture sensitive information such as faces , addresses , and credit cards ( Orekondy et al. , 2018 ) . Extensive prior research has focused on preventing unauthorized access to sensitive information in private datasets ( Fredrikson et al. , 2015 ; Shokri et al. , 2017 ) . However , are publicly available datasets free of privacy concerns ? Taking the popular ImageNet dataset ( Deng et al. , 2009 ) as an example , there are only 3 people categories1 in the 1000 categories of the ImageNet Large Scale Visual Recognition Challenge ( ILSVRC ) ( Russakovsky et al. , 2015 ) ; nevertheless , the dataset exposes many people co-occurring with other objects in images ( Prabhu & Birhane , 2021 ) , e.g. , people sitting on chairs , walking dogs , or drinking beer ( Fig . 1 ) . It is concerning since ILSVRC is freely available for academic use2 and widely used by the research community . In this paper , we attempt to mitigate ILSVRC ’ s privacy issues . Specifically , we construct a privacyenhanced version of ILSVRC and gauge its utility as a benchmark for image classification and as a dataset for transfer learning . Face annotation . As an initial step , we focus on a prominent type of private information—faces . To examine and mitigate their privacy issues , we first annotate faces in ImageNet using face detectors and crowdsourcing . We use Amazon Rekognition to detect faces automatically , and then refine the results through crowdsourcing on Amazon Mechanical Turk to obtain accurate annotations . We have annotated 1,431,093 images in ILSVRC , resulting in 562,626 faces from 243,198 images ( 17 % of all images have at least one face ) . Many categories have more than 90 % images with faces , 1scuba diver , bridegroom , and baseball player 2https : //image-net.org/request even though they are not people categories , e.g. , volleyball and military uniform . Our annotations confirm that faces are ubiquitous in ILSVRC and pose a privacy issue . We release the face annotations to facilitate subsequent research in privacy-aware visual recognition on ILSVRC . Effects of face obfuscation on classification accuracy . Obfuscating sensitive image areas is widely used for preserving privacy ( McPherson et al. , 2016 ) . We focus on two simple obfuscation methods : blurring and overlaying ( Fig . 1 ) , whose privacy effects have been analyzed in prior work ( Oh et al. , 2016 ; Li et al. , 2017 ; Hasan et al. , 2018 ) . Using our face annotations , we construct face-obfuscated versions of ILSVRC . What are the effects of using them for image classification ? At first glance , it seems inconsequential—one should still recognize a car even when the people inside have their faces blurred . Indeed , we verify that validation accuracy drops only slightly ( 0.1 % –0.7 % for blurring , 0.3 % –1.0 % for overlaying ) when using face-obfuscated images to train and evaluate . We analyze this drop in detail ( identifying categories which are particularly affected ) , but this key result demonstrates that we can train privacy-aware visual classifiers on ILSVRC which remain highly competitive , with less than a 1 % accuracy drop . Effects on feature transferability . Besides a classification benchmark , ILSVRC also serves as pretraining data for transferring to domains where labeled images are scarce ( Girshick , 2015 ; Liu et al. , 2015a ) . So a further question is : Does face obfuscation hurt the transferability of visual features learned from ILSVRC ? We investigate by pretraining models on the original/obfuscated images and finetuning on 4 downstream tasks : object recognition on CIFAR-10 ( Krizhevsky et al. , 2009 ) , scene recognition on SUN ( Xiao et al. , 2010 ) , object detection on PASCAL VOC ( Everingham et al. , 2010 ) , and face attribute classification on CelebA ( Liu et al. , 2015b ) . They include both classification and spatial localization , as well as both face-centric and face-agnostic recognition . In all of the 4 tasks , models pretrained on face-obfuscated images perform closely with models pretrained on original images . We do not see a statistically significant difference between them , suggesting that visual features learned from face-obfuscated pretraining are equally transferable . Again , this encourages us to adopt face obfuscation as an additional protection on visual recognition datasets without worrying about detrimental effects on the dataset ’ s utility . Contributions . Our contributions are twofold . First , we obtain accurate face annotations in ILSVRC , facilitating subsequent research on privacy protection . We will release the code and the annotations . Second , to the best of our knowledge , we are the first to investigate the effects of privacy-aware face obfuscation on large-scale visual recognition . Through extensive experiments , we demonstrate that training on face-obfuscated images does not significantly compromise accuracy on both image classification and downstream tasks , while providing some privacy protection . Therefore , we advocate for face obfuscation to be included in ImageNet and to become a standard step in future dataset creation efforts . 2 RELATED WORK . Privacy-preserving machine learning ( PPML ) . Machine learning frequently uses private datasets ( Chen et al. , 2019b ) . Research in PPML is concerned with an adversary trying to infer the private data . The privacy breach can happen to the trained model . For example , model inversion attack recovers sensitive attributes ( e.g. , gender , genotype ) of an individual given the model ’ s output ( Fredrikson et al. , 2014 ; 2015 ; Hamm , 2017 ; Li et al. , 2019 ; Wu et al. , 2019 ) . Membership inference attack infers whether an individual was included in training ( Shokri et al. , 2017 ; Nasr et al. , 2019 ; Hisamoto et al. , 2020 ) . Training data extraction attack extracts verbatim training data from the model ( Carlini et al. , 2019 ; 2020 ) . For defending against these attacks , differential privacy is a general framework ( Abadi et al. , 2016 ; Chaudhuri & Monteleoni , 2008 ; McMahan et al. , 2018 ; Jayaraman & Evans , 2019 ; Jagielski et al. , 2020 ) . It requires the model to behave similarly whether or not an individual is in the training data . Privacy breaches can also happen in training/inference . To address hardware/software vulnerabilities , researchers have used enclaves—a hardware mechanism for protecting a memory region from unauthorized access—to execute machine learning workloads ( Ohrimenko et al. , 2016 ; Tramer & Boneh , 2018 ) . Machine learning service providers can run their models on users ’ private data encrypted using homomorphic encryption ( Gilad-Bachrach et al. , 2016 ; Brutzkus et al. , 2019 ; Juvekar et al. , 2018 ; Bian et al. , 2020 ; Yonetani et al. , 2017 ) . It is also possible for multiple data owners to train a model collectively without sharing their private data using federated learning ( McMahan et al. , 2017 ; Bonawitz et al. , 2017 ; Li et al. , 2020 ) or secure multi-party computation ( Shokri & Shmatikov , 2015 ; Melis et al. , 2019 ; Hamm et al. , 2016 ; Pathak et al. , 2010 ; Hamm et al. , 2016 ) . There is a fundamental difference between our work and PPML . PPML focuses on private datasets , whereas we focus on public datasets with private information . ImageNet , like other academic datasets , is publicly available to researchers . There is no point preventing an adversary from inferring the data . However , public datasets can also expose private information about individuals , who may not even be aware of their presence in the data . It is their privacy we are protecting . Privacy in visual data . To mitigate privacy issues with public visual datasets , researchers have attempted to obfuscate private information before publishing the data . Frome et al . ( 2009 ) and Uittenbogaard et al . ( 2019 ) use blurring and inpainting to obfuscate faces and license plates in Google Street View . nuScenes ( Caesar et al. , 2020 ) is an autonomous driving dataset where faces and license plates are detected and then blurred . Similar method is also used for the action dataset AViD ( Piergiovanni & Ryoo , 2020 ) . We follow this line of work to obfuscate faces in ImageNet but differ in two critical ways . First , to the best of our knowledge , we are the first to thoroughly analyze the effects of face obfuscation on visual recognition . Second , prior works use only automatic methods such as face detectors , whereas we additionally employ crowdsourcing . Human annotations are more accurate and thus more useful for following research on privacy preservation in ImageNet . Most importantly though , automated face recognition methods are known to contain racial and gender biases ( Buolamwini & Gebru , 2018 ) ; thus using these methods alone is likely to result in more privacy protection to members of majority groups . Including a manual verification step helps partially mitigate these issues . Finally , we note that face obfuscation alone is not sufficient for privacy protection . Orekondy et al . ( 2018 ) constructed Visual Redactions , annotating images with 42 privacy attributes , including faces , names , and addresses . Ideally , we should obfuscate all such information ; however , this may not be immediately feasible . Obfuscating faces ( omnipresent in visual datasets ) is an important first step . Privacy guarantees of face obfuscation . Unfortunately , face obfuscation does not provide any formal guarantee of privacy . Both humans and machines may be able to infer an individual ’ s identity from face-obfuscated images , presumably relying on cues outside faces such as height and clothing ( Chang et al. , 2006 ; Oh et al. , 2016 ) . Researchers have tried to protect sensitive image regions against attacks , e.g. , by perturbing the image adversarially to reduce the performance of a recognizer ( Oh et al. , 2017 ; Ren et al. , 2018 ; Sun et al. , 2018 ; Wu et al. , 2018 ; Xiao et al. , 2020 ) . However , these methods are tuned for a particular model and provide no privacy guarantee either . Further , guarantees in privacy may reduce dataset utility as shown for example by Cheng et al . ( 2021 ) . Therefore , we choose two simple local methods—blurring and overlaying—instead of more sophisticated alternatives . Overlaying removes all information in a face bounding box , whereas blurring removes only partial information . Their effectiveness for privacy protection can be ascertained only empirically , which has been the focus of prior work ( Oh et al. , 2016 ; Li et al. , 2017 ; Hasan et al. , 2018 ) but is beyond the scope of this paper . Visual recognition from degraded data . Researchers have studied visual recognition in the presence of various image degradation , including blurring ( Vasiljevic et al. , 2016 ) , lens distortions ( Pei et al. , 2018 ) , and low resolution ( Ryoo et al. , 2016 ) . These undesirable artifacts are due to imperfect sensors rather than privacy concerns . In contrast , we intentionally obfuscate faces for privacy ’ s sake . Ethical issues with datasets . Datasets are important in machine learning and computer vision . But recently they have been called out for scrutiny ( Paullada et al. , 2020 ) , especially regarding the presence of people . A prominent issue is imbalanced representation , e.g. , underrepresentation of certain demographic groups in data for face recognition ( Buolamwini & Gebru , 2018 ) , activity recognition ( Zhao et al. , 2017 ) , and image captioning ( Hendricks et al. , 2018 ) . For ImageNet , researchers have examined and attempted to mitigate issues such as geographic diversity , the category vocabulary , and imbalanced representation ( Shankar et al. , 2017 ; Stock & Cisse , 2018 ; Dulhanty & Wong , 2019 ; Yang et al. , 2020 ) . We focus on an orthogonal issue : the privacy of people in the images . Prabhu & Birhane ( 2021 ) also discussed ImageNet ’ s privacy issues and suggested face obfuscation as one potential solution . Our face annotations enable face obfuscation to be implemented , and our experiments support its effectiveness . Concurrent work ( Asano et al. , 2021 ) addresses the privacy issue by collecting a dataset of unlabeled images without people . Potential negative impacts . The main concern we see is giving the impression of privacy guarantees when in fact face obfuscation is an imperfect technique for privacy protection . We hope that the above detailed discussion and this clarification will help mitigate this issue . Another important concern is disparate impact on people of different demographics as a result of using automated face detection methods ; as mentioned above , we hope that incorporating a manual annotation step will help partially alleviate this issue so that similar privacy preservation is afforded to all .

Summary: The main concern addressed in this paper is the privacy problem that may result from images in ImageNet databases containing unexpected faces. The authors propose a two-step face filtering method. First, the authors use a detector called Amazon Rekognition to detect the ImageNet database. Then, the authors further optimize the detector output through the crowdsourcing platform Amazon Mechanical Turk (AMT) to reduce false positives and false negatives in automated detection. For the detected faces, the authors took two approaches, distinguishing between blurring and overlaying, and tested their effectiveness on different models separately. The accuracy of the two approaches was reduced by 0.9% on average compared to the original database on the ILSVRC classification challenge. And using the database that has blurred or covered the faces still maintains the transferability of the original database in the tests of downstream tasks. Contribution： 1. The authors perform a very time-consuming and labor-intensive task for accurate labeling and filtering of faces in the ImageNet database and statistical analysis of the classes of faces contained in ImageNet. 2. The authors demonstrate experiments related to classification tasks and pre-trained model training using a database containing blurred or covered faces, proving that the theory is feasible and that the dropped accuracy is acceptable. 3. In terms of ethics, using blurred or covered face data for training can reduce privacy concerns. The study of the ImageNet database in terms of privacy can provide an important reference for subsequent databases