A Study of Face Obfuscation in ImageNet
Authors: Kaiyu Yang
Jacqueline Yau
Li Fei-Fei
Jia Deng
Olga Russakovsky
Venue: ICLR 2022 Submitted (2022)
Keywords: ImageNet
Privacy
Face Obfuscation

Abstract: Face obfuscation (blurring, mosaicing, etc.) has been shown to be effective for privacy protection; nevertheless, object recognition research typically assumes access to complete, unobfuscated images. In this paper, we explore the effects of face obfuscation on the popular ImageNet challenge visual recognition benchmark. Most categories in the ImageNet challenge are not people categories; however, many incidental people appear in the images, and their privacy is a concern. We first annotate faces in the dataset. Then we demonstrate that face blurring and overlaying---two typical obfuscation techniques---have minimal impact on the accuracy of recognition models. Concretely, we benchmark multiple deep neural networks on face-obfuscated images and observe that the overall recognition accuracy drops only slightly (<= 1.0%). Further, we experiment with transfer learning to 4 downstream tasks (object recognition, scene recognition, face attribute classification, and object detection) and show that features learned on face-obfuscated images are equally transferable. Our work demonstrates the feasibility of privacy-aware visual recognition, improves the highly-used ImageNet challenge benchmark, and suggests an important path for future visual datasets. 

Under review as a conference paper at ICLR 2022
A STUDY OF FACE OBFUSCATION IN IMAGENET
Anonymous authors
Paper under double-blind review
ABSTRACT
Face obfuscation (blurring, mosaicing, etc.) has been shown be effective for privacy protection; nevertheless, object recognition research typically assumes access to complete, unobfuscated images. In this paper, we explore the effects of face obfuscation on the popular ImageNet challenge visual recognition bench- mark. Most categories in the ImageNet challenge are not people categories; how- ever, many incidental people appear in the images, and their privacy is concern. We first annotate faces in the dataset. Then we demonstrate that face blurring and overlaying- two typical obfuscation techniques- have minimal impact on the ac- curacy of recognition models. Concretely, we benchmark multiple deep neural networks on face-obfuscated images and observe that the overall recognition accu- racy drops only slightly (< 1.0%). Further, we experiment with transfer learning 4 downstream tasks (object recognition, scene recognition, face attribute clas- sification, and object detection) and show that features learned on face-obfuscated images are equally transferable. Our work demonstrates the feasibility of privacy- aware visual recognition, improves the highly-used ImageNet challenge bench- mark, and suggests an important path for future visual datasets.
INTRODUCTION
Visual data is being generated at unprecedented scale. People share billions of photos daily on social media (Meeker) 2014). There is one security camera for every people in China and the United States (Linn & Purnell 2019). Even your home can be watched by smart devices taking photos (Butler et al. 2015; Dai et al.] (0015). Learning from the visual data has led to computer vision applications that promote the common good, e.g., better traffic management (Malhi et al. 2011 and law enforcement (Sajjad et al., 2020). However, it also raises privacy concerns, as images may capture sensitive information such as faces, addresses, and credit cards (Orekondy al. 2018).
Extensive prior research has focused on preventing unauthorized access to sensitive information in private datasets (Fredrikson et al., 2015 [hokri et al., 2017). However, are publicly available datasets free of privacy concerns? Taking the popular ImageNet dataset (Deng et al.] 2009) as an example, there are only 3 people categorics in the 1000 categories of the ImageNet Large Scale Visual Recognition Challenge (ILSVRC) (Russakovsky et al. 2015); nevertheless, the dataset ex- poses many people co co-occurring with other objects in images (Prabhu & Birhane 202I), e.g., people sitting on chairs, walking dogs, drinking beer (Fig. D.. It concerning since ILSVRC is freely available for academic usd" and widely used by the research community.
In this paper, we attempt to mitigate ILSVRC's privacy issues. Specifically, construct privacy- enhanced version of ILSVRC and gauge its utility as a benchmark for image classification and as a dataset for transfer learning.
Face annotation. As an initial step, we focus on a prominent type of private information-facee. To examine and mitigate their privacy issues, we first annotate faces in ImageNet using face detectors and crowdsoureing. We use Amazon Rekognition to detect faces automatically, and then refine the results through crowdsourcing on Amazon Mechanical Turk to obtain accurate annotations.
We have annotated 1,431,093 images in ILSVRC, resulting in 562,626 faces from 243,198 images (17% of all images have least one face). Many categories have more than 90% images with faces,
'scuba diver, brieerbbrddeggoooooo and baseball player httt:::://maageeet.tor/////////e

---

Under review as a conference paper at ICLR 2022
NKIT
Figure 1:
Most categories in ImageNet Challenge (Russakovsky et al., 2015) are not people cate- gories. However, the images contain many people co-occurring with the object of interest, posing a potential privacy threat. These are example images (with faces blurred or overlaid) of barber chair, husky, beer bottle, volleyball 1 and mi military uniform.
even though they are not people categories, c.g., volleyball and military uniforn. Our annotations confirm that faces are ubiquitous in ILSVRC and pose a privacy issue. We release the face annotations to facilitate subsequent research in privacy-aware visual recognition on ILSVRC.
Effects of face obfuscation on classification accuracy. Obfuscating sensitive image areas is widely used for preserving privacy (McPherson et al.) 2016). We focus on two simple obfusca- tion methods: blurring and overlaying (Fig. []. whose privacy effects have been analyzed in prior work (Oh et al. 2016: Li et al. 2017; Hasan al. 2018). Using our face annotations, we construct face-obfuscated versions of ILSVRC. What are the effects of using them for image classification? At first glance, it seems inconsequenial-
should still recognize car even when the people inside have their faces blurred. Indeed, we verify that validation accuracy drops only slightly (0.1% 0.7% for blurring, 0.3%-1.0% for overlaying) when using face-obfuscated images to train and evaluate. We analyze this drop in detail (identifying categories which are particularly affected), but this key re- sult demonstrates that we train privacy-aware visual classifiers ILSVRC which remain highly competitive, with less than a 1% accuracy drop.
Effects on feature transferability, Besides a classification benchmark, ILSVRC also serves as pretraining data for transferring to domains where labeled images are scarce (Girshick 2015 Liu al., 2015a). So further question is: Doesface obfuscation hurt the transferabilityy of visual fea- tures learned ILSVRC? We investigate by pretraining models on the original/obfuscated images and finetuning on 4 downstream tasks: object recognition on CIFAR-10 (Krizhevsky et al. 2009). scene recognition on SUN (Xiao et al. 2010), object detection on PASCAL VOC (Everingham et al.) 2010), and face attribute classification on CelebA (Liu et al.) 20156). They include both classifica- tion and spatial localization, as well as both face-centric and face-agnostic recognition. In all of the tasks, models pretrained on face-obfuscated images perform closely with models pretrained on original images. We do not that visual features learned from face-obfuscated pretraining are equally transferable. Again, this encourages to adopt face obfuscation as an additional protection on visual recognition datasets without worrying about detrimental effects on the dataset's utility.
statistically significant difference between them, suggesting
twofold. First, we obtain accurate face annotations in ILSVRC, facilitating subsequent research on privacy protection. We will release the code and the annotations. Second, to the best of our knowledge, we are the first investigate the effects of privacy-awar face obfuscation on large-scale visual recognition. Through extensive experiments, we demonstrate that training on face-obfuscated images does not significantly compromise accu- racy both image classification and downstream tasks, while providing some privacy protection. Therefore, we advocate for face obfuscation to be included ImageNet and to become a standard step in future dataset creation efforts.
Contributions. Our contributions
2 RELATED WORK
Privacy-preserving machine learning (PPML). Machine learning frequently uses private datasets (Chen et al. 2019b). Research in PPML concerned with an adversary trying to infer the private data. The privacy breach can happen to the trained model. For example, model inver- sion attack recovers sensitive attributes (e.g.. gender, genotype) of an individual given the model's output (Fredrikson et al. 2014, 2013) [Hamm] 2017: Li al. 2019 Wu et al. (201)). Membership inference attack infers whether an individual was included in training (Shokri et al.) 2017 Nasr et al. 2019 Hisamoto et al. (020). Training data extraction attack extracts verbatim training data from the model (Carlini et al. [2019] 2020). For defending against these attacks, differential privacy is general framework (Abadi et al. 2016 Chaudhuri & Monteleoni] 2008; McMahan et al. 2018 Jayaraman & Evans| 2019|aagia or not individual in the training data.
et al. 2020). It requires the model to behave similarly whether
2

---

Under review as a conference paper at ICLR 2022
Privacy breaches can also happen in training/inferenee. To address hardware/software vulnerabili- ties, researchers have used enclaves - hardware mechanism for protecting a memory region from unauthorized access-to execute machine learning workloads (Ohrimenko et al.
2016 Tramer & Boneh 2018). Machine learning service providers can run their models on users
private data en-
crypted using homomorphic encryption GGilad-Bachrace
al., 2016 Brutzkus al.
2019 Juvekar
iet al. 2018 Bian et al. [2020] Yonetani et al., 2017). It is also possible for multiple data owners train model collectively without sharing their private data using federated learning (McMahan et al., 2017 Bonawitz et al.,
2017: Li et al. 2020) or secure multi-part, party computation (Shokri &
Shmatikov 2015 Melis al.
2019 Hamm et al.] 2016; P Pathak al., 2010: Hamm et al. 2016).
There is fundamental difference between our work and PPML. PPML focuses on private datasets, whereas we focus on public datasets with private information. ImageNet, like other academic datasets, is publicly available to researchers. There is no point preventing an adversary from in- ferring the data. However, public datasets can also expose private information about individuals, who may not even be aware of their presence in the data. It is their privacy we are protecting.
Privacy in visual data. To mitigate privacy issues with public visual datasets, researchers have attempted to obfuscate private information before publishing the data. Frome et al. (2009) and Uit- lenbogaard et al. (2019) use blurring and inpainting to obfuscate faces and license plates in Google Street View. nuScenes (Caesar et al. (0200) is an autonomous driving dataset where faces and license plates are detected and then blurred. Similar method is also used for the action dataset AViD (Pier-
giovanni & Ryoo| 2020).
We follow this line of work to obfuscate faces in ImageNet but differ in two critical ways. First, to the best of our knowledge, we are the first to thoroughly analyze the effects of face obfuscation on visual recognition. Second, prior works use only automatic methods such as face detectors, whereas we additionally employ crowdsourcing. Human annotations are more accurate and thus more useful for following research on privacy preservation in ImageNet. Most importantly though, automated face recognition methods are known to contain racial and gender biases (Buolamwini & Gebru, 2018); thus using these methods alone is likely to result in more privacy protection to members of majority groups. Including manual verification step helps partially mitigate these issues.
Finally, we note that face obfuscation alone is not sufficient for privacy protection. Orekondy et al. (018) constructed Visual Redactions, annotating images with 42 privacy attributes, including faces, names, and addresses. Ideally, we should obfuscate all such information; however, this may not be immediately feasible. Obfuscating faces (omnipresent in visual datasets) is an important first step.
Privacy guarantees of face obfuscation. Unfortunately, face obfuscation does not provide any formal guarantee of privacy. Both humans and machines may be able to infer individual's 's iden- tity from face-obfuscated images, presumably relying on cues outside faces such as height and clothing (Chang et al. 2006 Oh et al.] 2016). Researchers have tried to protect sensitive image regions against attacks, e.g., by perturbing the image adversarially to reduce the performance of a recognizer (Oh et al. 2017 Ren et al., 2018 [Sun al., 2018 Wu al., 2018 Xiao et al.) 2020). However, these methods are tuned for a particular model and provide no privacy guarantee either.
Further, guarantees in privacy may reduce dataset utility shown for example by [Cheng et al. 2021). Therefore, we choose two simple local methods- and overlaying-insteee of more sophisticated alternatives. Overlaying removes all information in face bounding box, whereas blur- ring removes only partial information. Their effectiveness for privacy protection can be ascertained only empirically, which has been the focus of prior work (Oh et al. 2016 Li et al., 2017 Hasan et al. 2018) but is beyond the scope of this paper.
Visual recognition from degraded data. Researchers have studied visual recognition in the pres- ence of various image degradation, including blurring (Vasiljevic et al.] 20166), lens distortions (Pei) et al. 2018), and low resolution (Ryoo et al. 2016). These undesirable artifacts are due to imperfect sensors rather than privacy concerns. In contrast, we intentionally obfuscate faces for privacy 's sake.
Ethical issues with datasets. Datasets are important in machine learning and computer vision. But recently they have been called out for scrutiny (Paullada et al. 2020). especially regarding the presence of people. A prominent issue is imbalanced representation, e.g., underrepresentation of certain demographic groups in data for face recognition (Buolamwini & Gebru 2018), activity recognition (Zhao al. 2017), and image captioning (Hendricks et al. 2018).
3

---

Under review as a conference paper at ICLR 2022
For ImageNet, researchers have examined and attempted mitigate issues such as geographic diver- sity, the category vocabulary, and imbalanced representation (Shankar et al. 2017 Stock & Cisse, 2018 Dulhanty & Wong 2019 Yang et al.] 2020). We focus
orthogonal issue: the privacy of people in the images. Prabhu & Birhane (2021 also discussed ImageNet's privacy issues and suggested face obfuscation
one potential solution. Our face annotations enable face obfuscation to be implemented, and our experiments support its effectivvnesss Concurrent work (Asano et al., 2021 addresses the privacy issue by collecting dataset of unlabeled images without people.
Potential negative impacts. The main concern we see is giving the impression of privacy guar- antees when fact face obfuscation is an imperfect technique for privacy protection. We hope that the above detailed discussion and this clarification will help mitigate this issue. Another important concern disparate impact on people of different demographics as a result of using automated face detection methods; mentioned above, we hope that incorporating manual annotation step will help partially alleviate this issue so that similar privacy preservation afforded all.
ANNOTATING FACES IN ILSVRC
We annotate faces ILSVRC (Russakovsky al. 2015). The annotations localize an important type of sensitive information in ImageNet, making it possible to obfuscate the sensitive areas for privacy protection.
It is challenging to annotate faces accurately, at ImageNet's scale while under reasonable budget. Automatic face detectors are fast and cheap but accurate enough, whereas crowdsoureing accurate but more expensive. Inspired by prior work (Kuznetsova et al., 2018 Yu et al.] 2015), we devise a two-stage semi-automatic pipeline that brings the best of both worlds. First, we run the face detector by Amazon Rekognition on all images in ILSVRC. The results contain both false positives and false negatives, so we refine them through crowdsourcing on Amazon Mechanical Turk. Workers given images with detected bounding boxes, and they adjust existing boxes or create new ones to cover all faces. Please see (pppendix for detail.
Annotation quality. To amalyze the quality of the face annotations, select 20 categories which the face detector is likely to perform poorly. Then we manually check validation images from these categories; the results characterize upper bound of the overall annotation accuracy.
Concretely, first, we randomly sample 10 categories under the mammal subtree in the ImageNet hierarchy (the left 10 categories in T.. Images in these categories contain many false positives (animal faces detected as humans). Second, we take the 10 categories with the greatest number of detected faces (the right 10 categories Table Images in those categories contain many people and thus are likely to have more false negatives. Each of the selected categories has 50 validation images, and two graduate students manually inspected all face annotations on them, including the face detection results and the final crowdsourcing results.
Table 1: The number of false positives (FPs) and false negatives (FNs) validation images from 20 categories challenging for the face detector. Each category has 50 images. The A columns are after automatic face detection, whereas the columns are human results after crowdsourcing.
Category
#FPs
#FNs
Category
#FPs
#ENs
A
H
A
H
H
A
H
irish setter
12
3
0
maypole
0
7
gorilla
32
7
0
0
basketball
0
0
7
cheetah
3
1
0
0
volleybal1
0
0
10
basset
10
0
0
balance beam
0
9
1ynx
9
1
0
unicycle
0
6
rottweiler
11
4
0
stage
0
0
sorrel
2
1
0
0
torch
2
1
impala
1
0
0
baseball player
0
0
bernese mt.
dog
20
3
0
military uniform
3
2
silky terrier
4
0
0
steel drum
1
1
Average
10.4
2.0
0.0
Average
0.6
0.5
4.3
4

---

Under review as a conference paper at ICLR 2022
Table Some categories grouped into supereategories in WordNet (Miller 1998). For each super-
category, we show the fraction of images with faces. These supercategories have fractions signifi- cantly deviating from the average of the entire ILSVVC (17%).
Supercategory
#Categories
#lmages
With faces (%)
clothing
49
62,471
58.90
wheeled vehicle
44
57,055
35.30
musical instrument
26
33,779
47.64
bird
59
76,536
1.69
insect
27
35,097
1.81
1.00.
150000
Fladiton of images win
0.75
i'mages
0.50
50000
0.25
0.00
106
218
Categories
1000
ffaces per image
8
10
Figure 2: Left: The fraction of images with faces for the 1000 ILSVRC categories. 106 categories have more than half images with faces. 216 categories have more than 25%. Right: A histogram of the number of faces per image, excluding the 1,187,895 images with no face.
The errors are shown in Table I As expected, the left 10 categories (mammals) have some false positives but no false negatives. In contrast, the right 10 categories have very few false positives but some false negatives. Crowdsourcing significantly reduces both error types. This demonstrate that obtain high-quality face annotations using the two-stage pipeline, but face detection alone is less accurate. Among the 20 categories, we have average 1.25 false positives and 0.95 false negatives per 50 images. However, our overall accuracy on the entire ILSVRC is much higher as these categories are selected deliberately to be error-prone.
Distribution faces ILSVRC. Using our two-stage pipeline, we annotated all 1,431,093 im- ages in ILSVRC. Among them, 243,198 images (17%) contain at least one face. And the total number faces adds up to 562,626.
Fig. Left shows the fraction of images with faces for different categories, ranging from 97.5% (bri degroom) to 0.1% (rock beauty, a type of saltwater fish). 106 categories have more than half images with faces. 216 categories have more than 25%. Among the 243K images with faces, Fig. [ Right shows the number of faces per image. 90.1% % images contain less than 5. But some of them contain as many 100 (a cap due to Amazon Rekognition). Most of those images capture sports scenes with a crowd of spectators, e.g., images from baseball player or aooolllybe
Since ILSVRC categories in the WordNet (Miller 1998) hierarchy, we can group them into percategories in WordNet. Table lists a few common ones that collectively cover 215 categories. For each supercategory. we calculate the fraction of images with faces. Results suggests that su- percategories such cl clothin ng and miallcal instrument frequently co-occur with people, whereas bi and insect seldom do.
EFFECTS OF FACE OBFUSCATION ON CLASSIFICATION ACCURACY
Having annotated faces ILSVRC, we now investigate how face obfuscation a widely used tech- nique for privacy preservation Fan 2019 Frome et al. 2009 impacts image classification.
Face obfuscation method. We experiment with two simple obfuscation methods-blurrin and overlaying. For overlaying, we cover faces with the average color in the ILSVRC training data: a gray shade with RGB value (0.485, 0.456, 0.406). For blurring, blurring. achieves better visual quality by removing the sharp boundaries between blurred and unblurred regions (Fig. [. Let / be an image and M be the mask of face bounding boxes. Applying Gaussian blurring to them gives us INurred and Maturred- Then we use Miturred as the mask to composite / and Iuturred' Inew Maturred' I Maturred) I. Due to the use of Maturred instead of M, we avoid sharp boundaries in Inew- Please see AAppendxx B for detail.
use variant of Gaussian
5

---

Under review as a conference paper at ICLR 2022
Table 3: Validation accuracies on ILSVRC using original images, face-blurred images, and face- overlaid images. The accuracy drops slightly but consistently when blurred (the As columns) or overlaid (the An columns), though overlaying leads larger drop than blurring. Each experiment repeated 3 times; we report the mean accuracy and its standard error (SEM).
Model
Top-1 accuracy (%)
Top-5 accuracy (%)
Original
Blurred
A
overlaid
Ao
Original
Blurred
Ab
overlaid
Ao
AlexNet
56.0 + 0.3
55.8 + 0.1
0.2
55.5 + 0.2
0.6
78.8 + 0.1
78.6 + 0.1
0.3
78.2 + 0.2
0.7
SqueezeNet
56.0 + 0.2
55.3 + 0.0
0.7
55.0 + 0.2
1.0
78.6
+ 0.2
78.1
0.0
0.5
77.6 1 0.1
1.0
ShuffleNet
64.7 0.2
64.0++0.
0.6
63.7 + 0.0
1.0
85.9
+ 0.0
85.5 +.1
0.5
85.2 + 0.2
VGG11
68.2 0.1
0.7
67.8
1.1
88.7
+ 0.0
8.1
87.
VGG13
69.9.1....
0.1
68.8100
1.2
89.3
0.1
0.0
8..5
VGGI6
71.7
0.1
0.8
7.1
I.I
90.5
0.1
8.1
8..6
VGG19
0.0
0.0
0.8
7.22
1.2
90.9
0.1
90.3 0.0
0.6
90.1
0.8
MobileNet
6.2
64.4
1.0
64.310.2
1.0
86.7 0.1
86.0 1 0.1
0.7
8..7
0.9
DenseNer121
7.10
0.1
0.8
0.1
1.0
92.4
92.0 0.1
0.4
91.7
0.7
DenseNet201
0.0
76,6
0.4
0.1
0.9
93.5
0.0
0.1
0.2
9..
0.6
ResNet18
0.2
69.0 0.2
0.7
68.9 0.1
0.8
89.2 + 0.0
88.7+ 0.0
0.5
88.7 +81
0.6
ResNet34
0.11
72.3 0.4
0.8
72.4
0.7
91.3
+ 0.0
90.8
+ 0.1
0.5
90.7 9..7
0.6
ResNet50
75.5
+..0
0.4
74.9
0.6
92.5
+ 0.0
92.4
0.1
0.1
9.0
0.3
ResNet101
77.3 0.1
76.7 + 0.1
0.5
76.7
0.1
0.1
0.6
93.6
0.1
93.3
1 0.1
0.3
93.1 03.10.11
0.5
ResNet152
77.9 0.1
77.3 + 0.1
0.6
77.0
+ 0.3
0.9
93.9
+ 0.0
93.7
0.0
0.4
93.3 + 0.3
0.6
Average
70.0
69.4
0.7
69.1
0.9
89.1
88.6
0.4
88.4
0.7
n
Age srop Jacurncy
n-
840
46
[0%, 1%)
[18, 25%)
12% 4%%
14%. 8%) (8%, 12.4%)
10%, 15))
11%
2%)
12%, 4%)
[4%, 6%) [6%, 12.4%)
Fraction of blurred area
Fraction buurred area
Figure 3: The average drop in wategory-wise accuracies vs. the fraction of blurred area in images. Left: Top-1 accuracies. Right: Top-5 accuracies. The accuracies are averaged across all different model architectures and random seeds.
Experiment setup and training details. To study the effects of face obfuscation classification,
we benchmark various deep neural networks including AlexNet (Krizhevsky et al.,,2211 2017). VGG (Si-
monyan & Zisserman| 2015). SqueezeNet (landola al. 2016). ShuffleNet (Zhang et al. 2018).
MobileNet (Howard et al. 2017). ResNet (He et al.) 2016). and DenseNet (Huang et al. 2017 Each model is studied in three settings: (1) original images for both training and evaluation; (2)
face-blurred images for both: (3) face-overlaid images for both.
Different models share uniform implementation of the training/evaluation pipeline. During train- ing, we randomly sample 224 x 224 image crop and apply random horizontal flipping. During evaluation, we always take the central crop and do not flip. All models are trained with a batch size of 256, momentum of 0.9, and a weight decay of 10-4 We train with SGD for 90 epochs, drop- ping the learning rate by a factor of 10 every 30 epochs. The initial learning rate is 0.01 for AlexNet, SqueezeNet, and VGG; 0.1 for other models. Each experiment takes 1-7 days machines with CPUs, 16GB memory, and 1-6 Nvidia GTX GPUs.
Overall accuracy. Table shows the validation accuracies. Each training instance is replicated times with different random seeds, and we report the mean accuracy and standard error (SEM). The A columns are the accuracy drop when using face-obfusccted images (original minus blurred). For both blurring and overlaying, we see a small but consistent drop in top-1 and top-5 accura- cies. For example, with blurring, top-5 accuracies drop 11%%.7%% with average of only 0.4%. Overlaying leads to slightly larger drops averaged at 0.7% since removes more information.
It is expected to incur small but consistent drop. On the one hand, face obfuscation removes information that might be useful for classifying the image. On the other hand, should leave intact most ILSVRC categories since they non-human. Though not surprising, results encouraging. They assure us that we can train privacy-aware visual classifiers on ImageNet with less than 1% accuracy drop.

---

Under review as a conference paper at ICLR 2022
No00ze d:0 300.82011
=
2.00
1.5
n 273
273
683
0.5
- 083
3.00
(0%, 0.5%)
10.5%, 5%)
(6%, 57%)
[0%, 0.5%)
10.5%, 5%%
[6%, 57%)
Fraction of abject covered by faces
Fraction of object covered by taces
Figure 4: The average drop in category- wiiee accuracies caused by blurring vs. the fraction of object area covered by faces. Left: Top-1 accuracies. Right: Top-5 accuracies. The accuracies are averaged across all different model architectures and random seeds.
Category-wise accuracies and the fraction of blur. To gain insights into the effects on individual categories, we break down the accuracy into the 1000 ILSVRC categories. We hypothesize that if category has a large fraction of obfuscated area, will likely incur large accuracy drop.
To support the hypothesis, we focus on blurring and first average the accuracies for each category across different models. Then, we calculate the correlation between the accuracy drop and the frac- tion of blurred area: 0.28 for top-1 accuracy and r = 0.44 for top-5 accuracy. The correlation is not strong but statistically significant, with p-values of 6.31 x 10-20 and 2.69 10-19 respectively.
The positive correlation is also evident in Fig. On the x-axis, we divide the blurred fraction into groups from small to large. On the y-axis, we show the average accuracy drop for categories in each group. Using top-5 accuracy (Fig. 3 Right), the drop increases monotonically from 0.30% to 4.04% when moving from small blurred fraction (0%-1%) to a larger fraction (2 8%).
The pattern becomes less clear in top-1 accuracy (Fig. 3 Left). The drop stays around 0.5% and begins to increase only when the fraction goes beyond 4%. However, top-1 accuracy is a worse metric than top-5 accuracy (ILSVRC's official metric), because top-1 accuracy is ill-defined for im- ages with multiple objects. In contrast, top-5 accuracy allows the model to predict 5 categories for each image and succeed as long one of them matches the ground truth. In addition, top-1 accu- racy suffers from confusion between near- -denticlll categorie (like eskimo dog and s siberin ian husky), artifact discuss further below.
In summary, our analysis of category-wise accuracies aligns with a simple intuition-if too much area is obfuscated, models will have difficulty classifying the image.
Most impacted categories. Besides the size of the obfuscated area, another factor is whether overlaps with the object of interest. Most categories in ILSVRC non-human and should have very little overlap with faces. However, there are exceptions. Mask, for example, is indeed non- human. But masks worn on the face; therefore, obfuscating faces will make masks harder to recognize. Similar categories include sungl asses, ha rmonica etc. Due to their close spatial proximity to faces, the accuracy likely drop significantly in the presence of face obfuscation.
To quantify this intuition, we calculate the overlap between objects and faces. Object bounding boxes are available from the localization task of ILSVRC. Given an object bounding box, we cal- culate the fraction of area covered by face bounding boxes. The fractions are then averaged across different images in a category.
Results in Fig. show that blurring leads to larger accuracy drop for categories with larger fractions covered by faces. Some noteable examples include mask (24.84% covered by faces, 8.71% drop in top-5 accuracy), rmonn ca (29.09% covered by faces, 8.93% drop in top-5 accuracy), and snorkel (30.51% 51% covered, 6.00% drop). The correlation between the fraction and the drop 0.32 for top-1 accuracy and 0.46 for top-5 accuracy.
Fig. 5a showcases images from harmonica ca and mask and their blurred versions. We use Grad- CAM (Selvaraju al. 2017) to visualize where the model is looking at when classifying the image. For original images, the model can effectively localize and classify the object of interest. For blurred images, however, the model fails to classify the object; neither does it attend to the correct region.
In summary, the categorics most impacted by face obfuscation are those overlapping with faces, such mask and harmoni ca. These categories have much lower accuracies when using obfuscated images, as obfuscation removes visual cues necessary for recognizing them.

---

Under review as a conference paper at ICLR 2022
Mask
Hammorica
Palamo
Sberanhusty
(b) Images from eskimo dog and a siberiat husky are very similar. However, eskimo dog has a large accuracy drop when using face-blurred images, whereas siberian husky has a large accuracy increase.
(a) Images from mask and harmonica with Grad-CAM (Selvaraju al. 2017) visualiza- tions of where a ResNet152 (He et (016) model looks at. Original images on the left; face-blurred images on the right.
Disparate changes for visually similar categories. Our last observation focuses categories whose top-1 accuracies change drastically. Intriguingly, they come in pairs, consisting of one cate- gory with decreasing accuracy and another visually similar category with increasing accuracy. For example, eskimo dog and siberian husky are visually similar (Fig. 5b). When using face- blurred images, eskimo dog's top-1 accuracy drops by 12.8%, whereas s siberian husky's increases by 16.9%. It is strange since most images in these two categories do not even contain human faces. More examples are in Table
Eskimo dog and siberian husky images are so similar that the model faces seemingly ar- bitrary choice. We examine the predictions and find that models trained on original images prefer esk imm dog, whereas models trained on blurred images prefer s siberian husky. It is the different preferences over these two competing categories that drive the top-1 accuracies to change in different directions. To further investigate, we include two metries that are less sensitive to com- peting categories: top-5 accuracy and average precision. In Table 4 the pairwise pattern evaporates when these metries. A pair of categories no longer have drastic changes, and the changes do not necessarily go in different directions. The results show that models trained on blurred images are still good recognizing esk mm dog, though s beri an husky has even higher score.
EFFECTS ON FEATURE TRANSFERABILITY
Visual features learned on ImageNet are effective for wide range tasks (Girshick) 2015 Liu al. 2015a). We now investigate the effects of face obfuscation on feature transferability to down- stream tasks. Specifically, we compare models without pretraining and models pretrained on orig- inal/blurred/ovelladd images by finetuning 4 tasks: object recognition, scene recognition, object detection, and face attribute classification. They include both classification and spatial localization, well both face-centric and agnostic recognition. Details are in Appendix E
Object and scene recognition on CIFAR-10 10 and SUN. CIFAR-10 Krizhevsky et al. 2009) con- tains images from 10 object categories such as horse and truck. SUN (Xiao et 2010) contains images from 397 scenes such as bedroom and restaurant. Like ImageNet, they are not people- centered but may contain people.
We finetune models to classify images in these two datasets and show the results in Table For both datasets, pretraining helps significantly; models pretrained on blurred or overlaid images perform closely with those pretrained original images. The results show that visual features learned on face-obfsucated images have no problem transferring to face-agnostic downstream tasks.
Next, we finetune models for object detection on PASCAL VOC (Everingham et al. 2010). We choose it instead of COCO (Lin et al.) (2014) because it is small enough to benefit from pretraining. We finetune FasterRCNN (Ren al. 2015) object detector with a ResNet50 backbone pretrained on original/Muureed/vveladd images. The results do not show a significant difference between them (79.40 + 0.31, 79.29 0.22, and 79.39 0.02 in mAP).
Object detection on PASCAL VOC.
PASCAL VOC includes person one of its 20 object categories. And one could hypothesize that the model detects people relying on face cues. However, we do not observe a performance drop in face-obfuscated pretraining, even considering the AP of the person category (84.40 + 0.14 original, 84.80 0.50 blurred, and 84.47 0.05 overlaid).
8

---

Under review as a conference paper at ICLR 2022
Table 4: Visually similar categories whose top-1 accuracy varies significantly but in opposite di- rections. However, the pattern evaporates when using top-5 accuracy or average precision.
Category
Top-1 accuracy (96)
Top-5 accuracy (%)
Average precision (%)
Original
Blurred
A
Original
Blurred
A
Original
Blurred
A
eskimo dog
50.8
0.4
95.5
0.4
0.2
0.8
0.5
siberian husky
46.3 + 1.8
63.2 + 0.8
16.9
97.0
+ 0.4
97.2 + 0.3
-0.2
29.2
0.3
29.6 + 0.5
0..4
projectilc
35.6 1: 0.9
21.7 1: 1.0
13.9
86.2 1: 0.4
85.5 1: 0.4
0.7
23.1
1: 0.4
22.5 4:
missile
31.6
45.8 + 0.8
14.2
81.5 + 0.7
81.8 + 0,4
0.3
20.4
0.3
21.1 0.6
0.7
tub
38.5 +.5 1.5
27.9 + 0,6
7.6
79.4 + 0.6
75.6 + 0.5
3.8
19.9 + 0.4
18,8 + 0.2
1.1
bathtub
35.4 1: 1.0
42.5 : 0.4
7.1
78.9 1: 0.3
80.8 1 1.2
1.9
27.4 1: 0.8
25.1 1: 0.6
american chameleon
63.0 1: 0.4
12
97.0 0.5
0.5
0.2
39.3
green 1izard
42.0 1: 0.6
45.6 1: 1.2
3.6
91.3 1: 0.3
89.7 1: 0.2
1.6
22.6
0.8
22.4 1 0.1
0.2
Table 5: Top-1 accuracy on CIFAR-10 Krizhevsky et al. 2009) and SUN (Xiao et 2010) of models without pretraining, pretrained on original images, and pretrained on blurred images.
Model
CIFAR-10
SUN
pretrain
Original
Blurred
Overlaid
No pretrain
Original
Blurred
Overlaid
AlexNet
83.3 + 0.2
90.6 1 0.0
90.9 = 0.0
91.1 1 0,0
26.2 = 0.6
46.3 1 0.1
46,5 : 0.1
46.2 + 0.0
ShuffleNet
92.3 + 0.3
95.7 + 0.0
95.4 0.1
95.2
+ 0.1
33.8 0.7
51.2 0.1
50.4
0.3
49.3 0.3
ResNet18
92.8 1
96.1 0.1
0.1
96.1
0.1
4.8
55.0
55.0
0.1
0.1.
ResNer34
90.6
96.9 0.1
97.0 0.0
97.1
0.2
40.3 0.4
57.8
0.0
57.9
0.1
57.8
Face attribute classification on CelebA. what if the downstream task is entirely about un- derstanding faces? Will face-obfuscated pretraining fail? We explore this question by classifying face attributes on CelebA (Liu et al.] 2015b). Given a headshot, the model predicts multiple face attributes such smi 1 ling and eyeglasses
CelebA is too large to benefit from pretraining, so we finetune on a subset of 5K images. Table shows the results in mAP. There is discrepancy between different models, models. But overall, blurred/overlaid pretraining performs competitively. This is remarkable given that the task relies heavily faces. A possible agnostic features during pretraining and learns face features in finetuning.
add few more
is that the model only learns low-level face-
In all of the 4 tasks, pretraining on face-obfuseated images does hurt the transferability of the learned feature. It suggests that one could use face-obfuscated ILSVRC for pretraining without degrading the downstream task, even when the downstream task requires an understanding of faces.
Table 6: mAP of face attribute classification CelebA training images.
Liu al. 2015b), using subset of 5K
Model
No pretrain
Original
Blurred
Overlaid
AlexNet
41.8 0.5
55,5 + 0.7
50.7 0.8
$2.5 1 0.4
ShuffleNet
36.5 1
55.6 1.2
52.5
53.5 1
ResNet18
45.1 1110100 1.0
51.7 = 1.9
51.8 1.0
52.0
ResNet34
4
55.6 - 2.4
56.5 + 1.9
56.4 2.3
ResNet50
42.8 0.9
50.9 2.7
VGG11
48.7
56.0
57.4
58.1
VGG13
47.2
58.4 - 0.6
59.0
0.5
58.2
MobileNet
43.8
49.4 + 0.8
49.9 1.3
49.6 + 13
CONCLUSION
We explored how face obfuscation affects recognition accuracy ILSVRC. We annotated faces in the dataset and benchmarked deep neural networks on images with faces blurred or overlaid. Exper- imental results demonstrate face obfuscation enhances privacy with minimal impact accuracy.

---

Under review as a conference paper at ICLR 2022
REFERENCES
Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, llya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Conference on Computer and Communica- tions Security, 2016.
Yuki Asano, Christian Rupprecht, Andrew Zisserman, and Andrea Vedaldi. Pass: An imagenet replacement for self-supervised pretraining without humans. Advances in Neural Information Processing Systems (Datasets and Benchmarks Track), 2021.
Song Bian, Tianchen Wang, Masayuki Hiromoto, Yiyu Shi, and Takashi Sato. Ensei: Efficient secure inference via frequency-domain homomorphic convolution for privacy- visual recognition. Conference on Computer Vision and Pattern Recognition, 2020.
Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. Practical secure aggregation for privacy- preserving machine learning. In Conference on Computer and Communications Security, pp. 1175-1191, 2017.
Alon Brutzkus, Ran Gilad-Bachrachh and Oren Elisha. Low latency privacy preserving inference. In International Conference on Machine Learning, pp. 812 2019.
Joy Buolamwini and Timnit Gebru. Gender shades: Intersectional accuracy disparities in com- mercial gender classification. In Conference on Fairness, Accountability, and Transparency, pp- 77-91, 2018.
Daniel Butler, Justin Huang, Franziska Roesner, and Maya Cakmak. The privacy-utility tradeoff for remotely teleoperated robots. In International Conference Human-Roth Interaction, 2015.
Holger Caesar, Varun Bankiti, Alex H Lang, Sourabh Vora, Venice Erin Liong, Qiang Xu, Anush Krishnan, Yu Pan, Giancarlo Baldan, and Oscar Beijbom. nuscenes: A multimodal dataset for autonomous driving. In Conference on Computer Vision and Puttern Recognition, pp. 11621- 11631, 2020.
Nicholas Carlini, Chang Liu, Ülfar Brlingsson, Jernej Kos, and Dawn Song. The secret sharer: Eval- uating and testing unintended memorization in neural networks. In USENIX Security Symposium, pp. 267-284, 2019.
Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert- Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. Extracting training data from large language models. arXiv preprint arXiv:2012.07805, 2020.
Yi Chang, Rong Yan, Datong Chen, and Jie Yang. People identification with limited labels in privacy-protected video. International Conference Multimedia and Expo, pp. 1005-1008, 2006.
Kamalika Chaudhuri and Claire Monteleoni. preseeinn logistic regression. In Advances in Neural Information Processing Systems, 2008.
Kai Chen, Jiaqi Wang, Jiangmiao Pang, Yuhang Cao, Yu Xiong, Xiaoxiao Li, Shuyang Sun, Wansen Feng, Ziwei Liu, Jiarui Xu, Zheng Zhang, Dazhi Cheng. Chenchen Zhu, Tianheng Cheng, Qijie Zhao, Buyu Li, Xin Lu, Rui Zhu, Yue Wu, Jifeng Dai, Jingdong Wang, Jianping Shi, Wanli Ouyang, Chen Change Loy, and Dahua Lin. MMDetection: Open mmlab detection toolbox and benchmark. arXiv preprint arXiv: 07155, 2019a.
Mia Xu Chen, Benjamin N Lee, Gagan Bansal, Yuan Cao, Shuyuan Zhang, Justin Lu, Jackie Tsay, Yinan Wang, Andrew M Dai, Zhifeng Chen, et al. Gmail smart compose: Real-time assisted writing. In International Conference on Knowledge Discovery and Data Mining, pp. 2287-2295, 2019b.
Victoria Cheng, Vinith M Suriyakumar, Natalie Dullerud, Shalmali Joshi, and Marzych Ghassemi. Can you fake until you make it? impacts of differentially private synthetic data on downstream classification fairness. In Conference Fairness, Accountability, and Transparency, 2021.
10

---

Under review as a conference paper at ICLR 2022
Ji Dai, Behrouz Saghafi, Jonathan Wu, Janusz Konrad, and Prakash Ishwar. Towards privacy- preserving recognition human activities. In International Conference on Image Processing, 2015.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei, Imagenet: A large-scale hierarchical image database. In Conference on Computer Vision and Paltern Recognition, 2009,
Chris Dulhanty and Alexander Wong. Auditing imagenet: Towards model-driven frame- work for annotating demographic attributes of large-scale image datasets. arXiv preprint arXiv:1905.01344,, 2019.
Mark Everingham, Lue Van Gool, Christopher KI Williams, John Winn, and Andrew Zisserman. The pascal visual object classes (voc) challenge. International Journal of Computer Vision, 88 (2):303-338, 2010.
Liyue Fan. Practical image obfuscation with provable privacy. In International Conference Multi- media and Expo, 2019.
Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confi- dence information and basic countermeasures. In Conference on Computer and Communications Security, pp. 1322-1333, 2015.
Matthew Fredrikson, Eric Lantz, Somesh Jha, Simon Lin, David Page, and Thomas Ristenpart. Privacy in pharmacogenetics: An end-to-end case study of personalized warfarin dosing. In USENIX Security Symposium, pp. 17-32, 2014.
Andrea Frome, German Cheung, Ahmad Abdulkader, Marco Zemnaro, Bo Wu, Alessandro Bissacco, Hartwig Adam, Hartmut Neven, and Lue Vincent. Large-scale privacy protection in google street view. In International Conference on Computer Vision, 2009.
Ran Gilad-Bachrach, Nathan Dowlin, Kim Laine, Kristin Lauter, Michael Nachrig, and John Werns- ing. Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy. In International Conference on Machine Learning, pp. 201-210, 2016.
Ross Girshick, Fast r-cnn. In International Conference on Computer Vision, pp. 1440-1443 2015.
Jihun Hamm. Minimax filter: learning to preserve privacy from inference attacks. Journal of Machine Learning Research, 18(1):4004473333 2017.
Jihun Hamm, Yingjun Cao, and Mikhail Belkin. Learning privately from multiparty data. In Inter- national Conference Machine Learning, pp. 555-563, 2016.
Rakibul Hasan, Eman Hassan, Yifang Li, Kelly Caine, David J Crandall, Roberto Hoyle, and Apu Kapadia. Viewer experience of obscuring scene elements in photos to enhance privacy. In Con- ference on Human Factors in Computing Systems, 2018
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Conference on Computer Vision and Pattern Recognition, 2016.
Lisa Anne Hendricks, Kaylee Burns, Kate Saenko, Trevor Darrell, and Anna Rohrbach. Women also snowboard: Overcoming bias in captioning models. In European Conference on Computer Vision, pp. 793-811, 2018.
Sorami Hisamoto, Matt Post, and Kevin Duh. Membership inference attacks on sequence-to sequence models: my data your machine translation system? Trunsactions of the Association for Computational Linguistics, 8:49 64,,,33,6 2020.
Andrew G Howard, Menglong Zhu, Bo Chen, Dmitry Kalenichenko, Weijun Wang, Tobias Weyand, Marco Andreetto, and Hartwig Adam. Mobilenets: Efficient convolutional neural networks for mobile vision applications. arXiv preprint 1XX4:1704.04861. 2017.
Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In Conference Computer Vision and Pattern Recognition, 2017.
11

---

Under review as a conference paper at ICLR 2022
Forrest N landola, Song Han, Matthew W Moskewicz, Khalid Ashraf, William J Dally, and Kurt Keutzer. Squeezenet: Alexnet-level accuracy with 50x fewer parameters and; 0.5 mb model size. arXiv preprint arXiv: 2016.
Matthew Jagielski, Jonathan Ullman, and Alina Oprea. Auditing differentially private machine learning: How private is private sgd? Advances in Neural Information Processing Systems, 33, 2020.
Bargav Jayaraman and David Evans. Evaluating differentially private machine learning in practice. In USENIX Security Symposium, pp. 1912- 2019.
Chiraag Juvekar, Vinod Vaikuntanathan, and Anantha Chandrakasan, {GAZELLE]: low latency framework for secure neural network inference. In USENIX Security Symposium, pp. 1651-1669, 2018.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convo- lutional neural networks. Commanications of the ACM, 60(6):84 90, 2017.
Alina Kuznetsova, Hassan Rom, Neil Alldrin, Jasper Uijlings, Ivan Krasin, Jordi Pont-Tuset, Shahab Kamali, Stefan Popov, Matteo Malloci, Tom Duerig, et al. The open images dataset v4: Unified image classification, object detection, and visual relationship detection at scale. arXiv preprint (xXiv:8111.0082, 2018.
Ang Li, Jiayi Guo, Huanrui Yang, and Yiran Chen. Deepobfuscator: Adversarial training framework for frivacy-preservinn image classification. arXiv preprint UrXiv:/909.041260 2019.
Tian Li, Anit Kumar Sahu, Ameet Talwalkar, and Virginia Smith. Federated learning: Challenges, methods, and future directions. IEEE Signal Processing Magazine, 37(3):50-60, 2020.
Yifang Li, Nishant Vishwamitra, Bart Knijnenburg, Hongxin Hu, and Kelly Caine. Effective- ness and users' experience of obfuscation as privacy-enhancing technology for sharing photos. Proceedings of the ACM on Human- Human-Computer Interaction, 1:1-24, 2017.
Liza Lin and Newley Purnell. A world with a billion cameras watching you is just around the corner, December 2019.
Tsung-Y Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In European Conference on Computer Vision, 2014.
Fayao Liu, Chunhua Shen, and Guosheng Lin. Deep convolutional neural fields for depth estimation from single image. In Conference on Computer Vision and Pattern Recognition, pp. 5162-5170, 2015a.
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In International Conference on Computer Vision, December 2015b.
Muhammad Hassam Malhi, Muhammad Hassan Aslam, Faisal Saeed, Owais Javed, and Muhammad Fraz. Vision based intelligent traffic management system. In 2011 Frontiers of Information Technology, pp. 141, 2011.
Brendan McMahan, Fider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication-eficienn learning of deep networks from decentralized data. In International Conference on Artificial Intelligence and Statistics, pp. 1273-1282, 2017.
H Brendan McMahan. Daniel Ramage, Kunal Talwar, and Li Zhang. Learning differentially private
recurrent language models. In International Conference on Learning Representations, 2018.
Richard McPherson, Reza Shokri, and Vitaly Shmatikov. Defeating image obfuscation with deep learning. arXiv preprint arXiv: 100,:000000000 2016.
12

---

Under review as a conference paper at ICLR 2022
Mary Meeker. 2014 internet trends, May 2014. OBLLsttoss//w....leeeeeeerrzrr.
Luca Melis, Congzheng Song, Emiliano De Cristofaro, and Vitaly Shmatikov. Exploiting unintended feature leakage in collaborative learning. In Symposium on Security and Privacy, pp. 691-706.
IEEE, 2019.
George A Miller. WordNet: An electronic lexical database. 1998.
Milad Nasr, Reza Shokri, and Amir Houmansadr. Comprchensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In Symposium on Security and Privacy, pp. 739-755 IEEE, 2019.
Seong Joon Oh, Rodrigo Benenson, Mario Fritz, and Bernt Schiele. Faceless person recognition: Privacy implications in social media. In European Conference Computer Vision, 2016.
Seong Joon Oh, Mario Fritz, and Bernt Schiele. Adversarial image perturbation for privacy protec- tion a game theory perspective. In International Conference on Computer Vision, 2017.
Olga Ohrimenko, Felix Schuster, Cédric Fournet, Aastha Mehta, Sebastian Nowozin, Kapil Vaswani, and Manuel Costa. Oblivious multi-party machine learning on trusted processors. In USENIX Security Symposium, pp. 619-636, 2016.
Tribhuvanesh Orekondy, Mario Fritz, and Bernt Schiele. Connecting pixels to privacy and utility: Automatic redaction of private information images. In Conference on Computer Vision and Puttern Recognition, 2018.
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high- performance deep learning library. In Advances in Neural Information Processing Systems, 2019.
Manas A Pathak, Shantanu Rane, and Bhiksha Raj. Multiparty differential privacy via aggregation of locally trained classifiers. In Advances in Neural Information Processing Systems, pp. 1876- 1884, 2010.
Amandalynne Paullada, Inioluwa Deborah Raji, Emily M Bender, Emily Denton, and Alex Hanna. Data and its (dis) contents: A survey of dataset development and use in machine learning research. arXiv preprint arXiv:2012.05344 2020.
Yanting Pei, Yaping Huang. Qi Zou, Hao Zang. Xingyuan Zhang, and Song Wang. Effeets of image degradations to enn-based image classification. arXiv preprint arXiv:1810.05552 2018.
AJ Piergiovanni and Michael Ryoo. Avid dataset: Anonymized videos from diverse countries. In Advances in Neural Information Processing Systems, 2020.
Vinay Uday Prabhu and Abeba Birhane. Large image datasets: A pyrrhic win for computer vision? In Winter Conference Applications Computer Vision, 2021.
Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. Faster r-cnn: Towards real-time object detection with region proposal networks. In Advances Neural Information Processing Systems, 2015.
Zhongzheng Ren, Yong Jae Lee, and Michael S Ryoo. Learning to anonymize faces for privacy preserving action detection. In European Conference Computer Vision, 2018.
Olga Russakovsky, Jia Deng. Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang. Andrej Karpathy, Aditya Khosla, Michael Bernstein, al. Imagenet large scale visual recognition challenge. International Journal of Computer Vision, 115(3):211-255 2015.
Michael S Ryoo, Brandon Rothrock, Charles Fleming, and Hyun Jong Yang. human activity recognition from extreme low resolution. arXiv preprint arXiv: 1600.v/60400.. (604003/96 2016.
13

---

Under review as a conference paper at ICLR 2022
Muhammad Sajjad, Mansoor Nasir, Khan Muhammad, Siraj Khan, Zahoor Jan, Arun Kumar Sanga- iah, Mohamed Elhoseny, and Sung Wook Baik. Raspberry pi assisted face recognition framework for enhanced owwenforcemment services in smart cities. Future Generation Computer Systems, 108:995-1007, 2020.
Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based local- ization. In International Conference on Computer Vision, pp. 618-628 2017.
Shreya Shankar, Yoni Halpern, Eric Breck, James Atwood, Jimbo Wilson, and Sculley. No classi- fication without representation: Assessing geodiversity issues in open data sets for the developing world. arXiv preprint arXiv: 2017.
Reza Shokri and Vitaly Shmatikov. Privacy-preservie deep learning. In Conference on Computer and Communications Security, pp. 1310-1321, 2015.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference tacks against machine learning models. In Symposimm on Security and Privacy, pp. 3-18, 2017.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. International Conference on Learning Representations, 2015.
Pierre Stock and Moustapha Cisse. Convnets and imagenet beyond accuracy: Understanding mis- takes and uncovering biases. In European Conference on Computer Vision, 2018.
Qianru Sun, Liqian Ma. Scong Joon Oh, Luc Van Gool, Bernt Schiele, and Mario Fritz. Natural and effective obfuscation by head inpainting. In Conference on Computer Vision and Pattern Recognition, 2018.
Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Du- mitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In Conference on Computer Vision and Pattern Recognition, 2015.
Christian Szegedy, Vincent Vanhoucke, Sergey loffe, Jon Shlens, and Zbigniew Wojna. Rethinking the inception architecture for computer vision. In Conference Computer Vision and Pattern Recognition, 2016.
Mingxing Tan, Bo Chen, Ruoming Pang, Vijay Vasudevan, Mark Sandler, Andrew Howard, and Quoe V Le. Mnasnet: Platform-awe neural architecture search for mobile. In Conference on Computer Vision and Pattern Recognition, 2019.
Florian Tramer and Dan Bonch. Slalom:
Fast, verifiable and private execution neural networks in trusted hardware. In International Conference Learning Representations, 2018.
Ries Uittenbogaard, Clint Sebastian, Julien Vijverberg, Bas Boom, Dariu M Gavrila, et al. Pri- vacy protection in street-view panoramas using depth and multi-view imagery. In Conference Computer Vision and Pattern Recognition, 2019.
Igor Vasiljevic, Ayan Chakrabarti, and Gregory Shakhnarovich. Examining the impact of blur on recognition by convolutional networks. arXiv preprint arXiv: 1.05760, 2016.
Bingzhe Wu, Shiwan Zhao, Guangyu Sun, Xiaolu Zhang, Zhong Su, Caihong Zeng, and Zhihong Liu. P3sgd: Patient privacy preserving sgd for regularizing deep cnns in pathological image classification. In Conference on Computer Vision and Pattern Recognition, 2019.
Zhenyu Wu, Zhangyang Wang, Zhaowen Wang, and Hailin Jin. Towards recognition via adversarial training: A pilot study. In European Conference Computer Vision, 2018.
visual
Jianxiong Xiao, James Hays, Krista A Ehinger, Aude Oliva, and Antonio Torralba. Sun database: scrge-scale scene recognition from abbey to zoo. In Conference on Computer Vision and Pattern Recognition, pp. 3485-34929 2010.
14

---

Under review as a conference paper at ICLR 2022
Yanru Xiao, Cong Wang, and Xing Gao. Evade deep image retrieval by stashing private images in the hash space. Conference on Computer Vision and Pattern Recognition, 2020.
Saining Xie, Ross Girshick, Piotr Dollár, Zhuowen Tu, and Kaiming He. Aggregated residual trans- formations for deep neural networks. In Conference on Computer Vision and Pattern Recognition, 2017.
Kaiyu Yang, Klint Qinami, Li Fei-Fei, Jia Deng, and Olga Russakovsky. Towards fairer datasets: Filtering and balancing the distribution the people subtree in the imagenet hierarchy. Con- ference Fairness, Accountability, and Transparency. 2020.
Ryo Yonetani, Vishnu Naresh Boddeti, Kris M Kitani, and Yoichi Sato. Privacy-preservee visual learning using doubly permuted homomorphic encryption. In International Conference on Com- puter Vision, 2017.
Fisher Yu, Ari Seff, Yinda Zhang, Shuran Song, Thomas Funkhouser, and Jianxiong Xiao. Lsun: Construction of large-scale image dataset using deep learning with humans in the loop. arXiv preprint arXiv: 03366,, 2015.
Sergey Zagoruyko and Nikos Komodakis.
Wide residual networks.
arXiv preprint
arXiv:1605.07146, 2016.
Xiangyu Zhang, Xinyu Zhou, Mengxiao Lin, and Jian Sun. Shufflenet: An extremely efficient convolutional neural network for mobile devices. In Conference on Computer Vision and Pattern Recognition, 2018.
Jieyu Zhao, Tianlu Wang, Mark Yatskar, Vicente Ordonez, and Kai- Wei Chang. Men also like shopping: Reducing gender bias amplification using corpus-level constraints. arXiv preprint 1rXiv:/707.09455 2017.
15

---

Under review as a conference paper at ICLR 2022
A SEMI-AUTOMATIC FACE ANNOTATION
We describe our face annotation method in detail. It consists of two stages: face detection followed by crowdsoureing.
Figure 6: Face detection results on ILSVRC by Amazon Rekognition. The first row shows correct examples. The second row shows false positives, most of which are animal faces. The third row shows false negatives.
Stage Automatic face detection. First, we run the face detection API provided by Amazon Rekognitior on all images in ILSVRC, which can be done within one day and $1500. We also explored services from other vendors but found Rekognition to work the best, especially for small faces and multiple faces in one image (Fig. 6 Top).
However, face detectors are not perfect. There are false positives and false negatives. Most false positives, as Fig. 6 Middle shows, are animal faces incorrectly detected as humans. Mcanwhile, false negatives are rare; some of them occur under poor lighting or heavy occlusion. For privacy preservation, small number of false positives acceptable, but false negatives undesirable. In that respect, Rekognition hits a suitable trade-off for our purpose.
Stage 2: Refining faces through crowdsourcing. After running the face detector, we refine the results through crowdsourcing Amazon Mechanical Turk (MTurk). In each task, the worker is given an image with bounding boxes detected by the face detector (Fig.7 Left). They adjust existing bounding boxes create ones to cover all faces and not-safe-for-wont (NSFW) areas. NSFW areas may not necessarily contain private information, but just like faces, they are good candidates for image obfuscation (Prabhu & Birhane 2021).
For faces, we specifically require the worker to cover the mouth, nose, eyes, forehead, and cheeks. For NSFW areas, we define them include nudity, sexuality, profanity, etc. However, do not dic- tate what constitutes, e.g., nudity, which is deemed to be subjective and culure-dependent. Instead, we encourage workers follow their best judgment.
The worker has to go over 50 images in each HIT (Human Intelligence Task) to get rewarded. However, most images do not require the worker's action since the face detections are already fairly accurate. The 50 images include 3 gold standard images for quality control. These images have verified ground truth faces, but we intentionally show incorrect annotations for the workers to fix. The entire HIT resembles action game. Starting with 2 lives, the worker will lose life when making a mistake on gold standard images. that case, they will see the ground truth faces (Fig.
https::/ amazon. www.annccco//eeeogiittttiiie
16

---

Under review as a conference paper at ICLR 2022
P'lcase draw noctangles on the image to cover all
Them en riter di Imagee You taers alae Ory
human fices
content that NSFW (nudity, sesualiyy profanity, violence, etc)
You
There exislin restangles
enough, them the You have adjust them rectangles existing fail all
draw
The carrec somper
left basing to scnach.
PREVIOUS
COI-TIALE
RESTAAT
How much anca cover? For face, the roctangle you draw should coree at Jeest the mouth, nose, eyes, forchoad and checks. For NSFW area, use your best jodgement.
Figure The for face annotation on Amazon Mechanical Turk. Left: The worker is given an image with inaccurate face detections. They correct the results by adjusting existing bounding boxes or creating new ones. Each HIT (Human Intelligence Task) have 50 images, including 3 gold standard images for which we know the ground truth answers. Right: The worker loses life when making a mistake on gold standard images. They will have to start from scratch after losing both lives.
Right) and the remaining lives. If they lose both lives, the game over, and they have start from scratch at the first image. We found this strategy to improve annotation quality. We spent about $2500 on worker compensation. At this point, it is impossible to estimate the hourly wage accurately, since we have only the submit time of HITs but not the start time.
We did not distinguish NSFW areas from faces during crowdsourcing. Still, we conduct study demonstrating that the final data contains only tiny number of NSFW annotations compared to faces. The number of NSFW areas varies significantly across different ILSVRC categories. Bikini likely to contain much more NSFW areas than the average. We examined all 1,300 training images and 50 validation images bikini. We found only 25 images annotated with NSFW areas (1.85%). The average number for the entire ILSVRC is expected to be much smaller. For example, we found NSFW images among the validation images from the categories in Table 1.
B FACE BLURRING METHOD
As illustrated in Fig. we blur human faces using a variant of Gaussian blurring to avoid sharp boundaries between blurred and unblurred regions.
Let 00 be the range of pixel values; E D is an RGB image with height h and width (Fig. Middle). We have m face bounding boxes annotated
((x))
(4) 90 .111
(0
(I)
First, we enlarge each bounding box to be
d
(4)
d
(6)
d
de
30
(2)
10
10"
10
10
where d; is the length of the diagonal. Out-of-range coordinates are truncated to 0, h 1, or w 1.
Next, we represent the union of the enlarged bounding boxes as mask M D with value 1 inside bounding boxes and value () outside them (Fig. g Bottom). We apply Gaussian blurring to
WWe follow the convention for coordinate system in PIT..
17

---

Under review as a conference paper at ICLR 2022
USA
4
phurred
USA 4
nnw
M Miturred Inbrredd (1 Maturred )
M
Moturred
Gaussian blurring
Figure 8: The method for face blurring. avoids sharp boundaries between blurred and unblurred regions. I: the original image; M: the mask of enlarged face bounding boxes; Inew the final face-blurred image.
both M and T:
dmmax 10
Maturred = Gaussian
M,
(3)
dmaa
Isturrdd
=
Gaussian
(4)
10
where dmaz the maximum diagonal length across all bounding boxes on image J. Here dmaz
10
serves the radius parameter of Gaussian blurring; it depends on dmaz so that the largest bounding box can be sufficiently blurred.
Finally, we use Maturred the mask to composite I and Inturedd:
Jnew Maturred Jsturved (1 Mbturred) T.
(5)
Ine is the final face-blurred image. Due to the use of Maturred instead of M, we avoid sharp boundaries Inew-
C ORIGINAl IMAGES FOR TRAINING AND OBFUSCATED IMAGES FOR EVALUATION
We use obfuscated images evaluate PyTorch models (Paszke al. 2019 trained on original im-
ages. We experiment with 5 different methods for face obfuscation: (1) blurring; (2) overlaying with the average color the ILSVVRC training data: gray shade with RGB value (0.485, 0.456, 0.406); (3-5) overlaying with red/green/blue patches.
Results in top-5 accuracy are in Table 7 Not surprisingly, face obfuscation lowers the accuracy, which is due to not only the loss of information but also the mismatch between data distributions in training and evaluation. Nevertheless, all obfuscation methods lead to only small accuracy drop (0.7%-1.5% on average), and blurring leads to the smallest drop. The reason could be that blurring does not conceal all information in a bounding box compared to overlaying.
htm
18

---

Under review as a conference paper at ICLR 2022
Table Top-5 accuracies of models trained original images but evaluated on images obfuscated using different methods. Original: original images for validation; Mean: validation images overlaid with the average color in the ILSVRC training data; Red/Green/Blue: images overlaid with different colors; Blurred: face-blurred images; As: Original minus blurred.
Model
Original
Red
Green
Blue
Mean
Blurred
Ab
AlexNet Krizhevsky ct al.
2017
76.7
77.1
76.7
77.8
78.2
0.8
GoogL.eNet SSzeedy et al.
2015
89.5
87.9
88.2
87.9
88.3
88.7
0.9
Inception v3 [Szegedy ct al
2016
88.7
86.7
87.0
86.6
87.2
87.7
0.9
SqueezeNet [Tandola
2016
80.6
78.6
79.0
78.5
79.4
79.7
0.9
ShuffleNet (Zhang el al.]
2018)
86.6
86.8
86.6
87.0
87.4
1.0
VGG11
(imonyyn & Zisserman
2015
88.6
87.1
87.4
87.0
87.6
87.8
0.8
VGG13
89.3
87.9
88.1
87.9
88.2
88.5
0.8
VGG16
90.4
89.1
89.1
88.9
89.3
89.7
0.7
VGG19
90.9
89.4
89.5
89.2
89.7
0.8
MobileNet (Hwwadd
2017
88.9
89.1
88.9
89.2
89.5
0.8
MNASNet Tan ct al.
2019
91.5
90.0
90.2
90.2
90.4
90.8
0.7
DenseNet12T (Huang al.
2017
92,0
90.7
90.8
90.7
91.0
91.3
0.7
DenseNet161
93.6
92.5
92.5
92.3
92.8
93.0
0.6
DenseNet169
92.8
91.6
91.7
91.6
92.2
0.6
DenseNet201
93.4
92.2
92.3
92.0
92.3
92.7
0.7
ResNet18 (He ct al. 2016
89.1
87.5
87.6
87.5
87.8
88.3
0.8
ResNet34
91.4
89.8
90.0
89.8
90.2
90.7
0.8
ResNet50
92.9
91.7
91.8
91.5
91.8
92.2
0.7
ResNet101
93.6
92.3
92.4
92.3
92.9
0.7
ResNet152
94.1
92.9
93.0
92.9
93.1
93.4
0.6
ResNeX150
Xie al.
2017
93.7
92.5
92.6
92.4
92.8
93.0
0.7
ResNeXt101
94.5
93.5
93.5
93.3
93.5
93.9
0.6
Wide ResNet50 Zagoruyko & Komodakis
2016
94.1
92.9
93.0
92.9
93.4
0.7
Wide ResNet101
94.3
93.2
93.3
93.1
93.4
93.7
0.6
Average
89.3
89.4
89.2
89.6
89.9
0.7
D OBFUSCATED IMAGES FOR TRAINING AND ORIGINAL IMAGES FOR EVALUATION
Vice versa, also experiment with training blurred images while evaluating original images. This setting is practically relevant because models used in real-world products may be trained on privacy-presee rrvaac-preserved data but deployed in the wild without any obfuscation. Results are shown in Table 8 Similarly, training on blurred images lowers the accuracy by only small amount (0.25%- 1.04% in top-5 accuracy, with an average of 0.67%).
E DETAILS OF TRANSFER LEARNING EXPERIMENTS
Image classification on CIFAR-10, SUN, and CelebA. Object recognition on CIFAR- 10 (Krizhevsky et al.) 2009). scene recognition on SUN (Xiao et al.) 2010), and face attribute clas- sification on CclebA Liu al. 2015b) are all image classification tasks. For any model, we simply replace the output layer and finetune for 90 epochs. Hyperparameters are almost identical to those in Sec. 4, except that the learning rate is tuned individually for each model on validation data. Note that face attribute classification on CelebA is multi-label classification task, so we apply binary cross-entropy loss to each label independently.
We adopt FasterRCNN (Ren et al. 2015) object detector with a ResNet50 backbone pretrained on original or face-obfuscated ILSVRC The detector fine- tuned for 10 epochs the trainval set of PASCAL VOC 2007 and 2012 (Everingham al. 2010 is then evaluated on the test set of 2007.
Object detection PASCAL VOC.
The system is implemented in MMDetection (Chen et al.) 2019a). We finetune using SGD with momentum of 0.9, a weight decay of 10-4, a batch size of 2, and a learning rate of 1.25 x 10-3 The learning rate decreases by factor of 10 in the last epoch.
19

---

Under review as a conference paper at ICLR 2022
Validation accuracies on original ILSVRC images of models trained on original/blurred images. Training on blurred images lead small but consistent accuracy drop.
Table 8:
Model
Top-1 accuracy (%)
Top-5 accuracy (%)
Original training
Blurred training
A
Original training
Blurred training
A
AlexNet
56.0 + 0.3
55.3 + 0.0
0.7
78.8 + 0.1
78.0 + 0.1
0.9
SqueezeNet
56.0 0.2
54.9
1.1
78.6 + 0.2
77.6 0.1
ShuffleNet
64.7 + 0.2
63.7 + 0.0
1.0
85.9 + 0.0
85.1 + 0.0
0,9
VGGII
68.9 + 0.0
+
1.0
88.7 0.0
87.9 + 0.1
0.8
VGG13
69.9 0.1
69.0
1.0
0.1
8.1
0.7
VGG16
0.1
1.1
0.1
8.1
0.7
VGG19
7.04
0.1
1.2
90.9
9..1
MobileNet
6.24
6.2
1,4
86.7
8.1
1.0
DenseNet121
75.0
7.01
0.9
0.0
91.8
0.6
DenseNet201
77.0 0.0
7.1
0.5
93.5
9.0
0.3
ResNet18
69.8 0.2
6.2
1.1
0.0
8.1
0.7
ResNet34
0.1
7.4
1.1
9.0
9..6
ResNet50
75.5 0.2
7.19
0.6
92.5
9.12
0.3
ResNet101
77.3 0.1
76.6 + 0.0
0.7
93.6
93.2 0.0
0.4
ResNet152
77.9 0.1
77.2 + 0.2
0.7
93.9 0.0
93.6
0.4
Average
70.0
69.1
0.9
89.1
88.4
0.7
20


Reviews:
[{"review_id": "muaJz2tXtFF", "reviewer": "Reviewer_7itG", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n* The main contribution of this work is that it provided empirical evidence on the effect of face obfuscation on the ImageNet dataset. Through comprehensive experiment, the authors showed that face obfuscation does not decrease the utility of the dataset.\n* Another contribution that should not be overlooked is that the authors annotated all faces in ImageNet in a semi-automatic manner and promised that they will make the annotations publicly available to other researchers.\n* The paper is very well written and includes a lot of details on the experiment protocol. Thus It should be straightforward for other researchers to reproduce the results and to extend the study.\n\nWeaknesses:\n* Since blur and cutout are commonly used data augmentation techniques, it is to be expected that face obfuscation would not have a big impact to visions tasks that have little to do with faces. Although it is commendable that this is now shown empirically though the study, this work also does not bring interesting new insights into the topic.\n* The authors showed that categories that are closely related to faces are indeed affected more by face obfuscation. This paper would be more interesting (from a technical point of view) if the authors could additionally investigate into methods for alleviating such impact.", "summary_of_the_paper": "This paper presents an empirical study on the effect of face obfuscation in the ImageNet dataset. The main conclusion is that face obfuscation does not decrease the utility of the dataset. Specifically, the authors showed that various networks trained on the obfuscated dataset only experienced small accuracy drop on the image classification task. The authors also discussed the impact on different categories, showing that face obfuscation hurt more to the object categories that are more closely related to faces (i.e., the bounding boxes of which overlap more with faces). Last but now least, experiments has been conducted to show that face obfuscation also does not have a significant impact on the transferability of the features learned from the new dataset. All these conclusions are inline with intuitions since ImageNet is not primarily focused on human activities / faces.", "summary_of_the_review": "This paper is very well written and it provides empirical evidences to support the intuition that face obfuscation does not decrease the utility of the ImageNet dataset. However, my main concern is that the paper has no technical novelty and it also does not bring sufficiently new insights to the community.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "1: The contributions are neither significant nor novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "Y-UbKxlTgxo", "reviewer": "Reviewer_6ZXN", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The main strength of the paper is to address the privacy issues of ImageNet and is to provide an alternative face obfuscated version.\nIn addition, the authors conduct very thorough experiments across different tasks and different architecture for the study of the performance influence with the obfuscated dataset. It shows new dataset still is effective for transfer learning for various vision task with few performance drop. However, the weakness is that the main part of the paper is to examine the performance influence of different settings and is of limited technical novelty. For the verification of some downstream tasks, the coverage of tasks is not enough.", "summary_of_the_paper": "The paper mainly discuss the privacy issue for human for the widely used ImageNet dataset and how to handle them.\nIn addition, the paper does a very detailed empirical experiments to study the performance influence for various tasks, including object recognition, scene recognition, face attribute, and object detection if all the faces in the ImageNet are obfuscated.", "summary_of_the_review": "Although the paper mainly focuses on providing plenty of empirical results to evaluate the influence of using the face obfuscated ImageNet dataset and is of limited novelty, it provides a lot of insights to show the effectiveness and feasibility of privacy preserving ImageNet.\n\nI have few concerns of the selection of transferring tasks. For example, the resolution of CIFAR-10 is only 32x32 and only for 10 classes. Similarly, Pascal VOC is also relatively small and easy dataset as compared with COCO or other recently released object detection dataset.\nMost of the images in the CelebA dataset are in frontal pose and have much fewer variations than other unconstrained face dataset, like IJB-C, etc. Since these datasets are relatively simpler than others which are more close to real-world scenarios, I wonder if the same experimental results and findings are still valid for harder datasets with more variations.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "6m-g0uRpct-", "reviewer": "Reviewer_U3FW", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The main weakness:\n1. I was confused by the statement in section (Part III, second paragraph) as to whether the face annotation process was manually filtered only for faces that were successfully detected (generated prediction boxes5) by Amazon Rekognition. Although I can infer from Appendix A Stage1 that only the data with successful detector predictions should be put into the AMT platform. Perhaps it would be better to include a brief description of Amazon Rekognition in the text. \n2. And if some faces are not detected by Amazon Rekognition, how do you tackle this problem? This is an important problem for the privacy issue in this paper because this paper focuses on the privacy issue.\n3. The novelty of this paper is limited reference to the proposed method in the paper.\n\nThe main strengths:\n1. The experimental part of the paper is depicted in great detail and completely. Rigorous validation of the obfuscation approach is done on two different methods on 15 different models. And in the appendix, the detailed method of blurring, and the problems that may happen in the process of labeling are under clearer explanation.\n2. The ethics of machine learning has been widely debated, with the issue of face privacy being of particular concern. There are many similar discussions, for example, there are some papers proposing to remove images associated with people from the database. The feasibility of obfuscation processing of faces proposed in this paper is a good way to minimize privacy issues without reducing the number of databases at the same time.", "summary_of_the_paper": "The main concern addressed in this paper is the privacy problem that may result from images in ImageNet databases containing unexpected faces. The authors propose a two-step face filtering method. First, the authors use a detector called Amazon Rekognition to detect the ImageNet database. Then, the authors further optimize the detector output through the crowdsourcing platform Amazon Mechanical Turk (AMT) to reduce false positives and false negatives in automated detection. For the detected faces, the authors took two approaches, distinguishing between blurring and overlaying, and tested their effectiveness on different models separately. The accuracy of the two approaches was reduced by 0.9% on average compared to the original database on the ILSVRC classification challenge. And using the database that has blurred or covered the faces still maintains the transferability of the original database in the tests of downstream tasks.\nContribution：\n1. The authors perform a very time-consuming and labor-intensive task for accurate labeling and filtering of faces in the ImageNet database and statistical analysis of the classes of faces contained in ImageNet.\n2. The authors demonstrate experiments related to classification tasks and pre-trained model training using a database containing blurred or covered faces, proving that the theory is feasible and that the dropped accuracy is acceptable.\n3. In terms of ethics, using blurred or covered face data for training can reduce privacy concerns. The study of the ImageNet database in terms of privacy can provide an important reference for subsequent databases", "summary_of_the_review": "This paper has some contributions in exploring the ethicality of datasets, especially in the current very popular ImageNet database, but it exists some flaws (see weakness). The solutions and results in this paper are open sources and feasible, and this work will inspire subsequent exploration of privacy protection in publicly available datasets. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper received 3 quality reviews, with 2 rated 5 and 1 rated 6. While the reviewers recognize the various contributions and insights made by this work, it was also pointed out that this work lacks technical novelty. The authors agreed with this concerns and argued that this work provides a service to the community, citing imageNet and COCO papers. The AC agrees with the contribution and major concerns. Furthermore, the AC would like to point out that in term of the level of efforts, this work might not be on par with the imageNet and COCO. All things considered, the AC believes that this work is not ready for publication at its current form, and hence recommend rejection.
Decision: Reject