Gaussian Differentially Private Human Faces Under a Face Radial Curve Representation
Authors: Carlos J Soto
Matthew Reimherr
Aleksandra Slavkovic
Mark Shriver
Venue: ICLR 2025 Poster (2025)
Keywords: differential privacy
shape analysis
functional data analysis
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: We develop a representation for 3D faces, extend Gaussian differential privacy to function space, and employ the latter on the former.

Abstract: In this paper we consider the problem of releasing a Gaussian Differentially Private (GDP) 3D human face. The human face is a complex structure with many features and inherently tied to one's identity.  Protecting this data, in a formally private way, is important yet challenging given the dimensionality of the problem. We extend approximate DP techniques for functional data to the GDP framework. We further propose a novel representation, face radial curves, of a 3D face as a set of functions and then utilize our proposed GDP functional data mechanism. To preserve the shape of the face while injecting noise we rely on tools from shape analysis for our novel representation of the face. We show that our method preserves the shape of the average face and injects less noise than traditional methods for the same privacy budget. Our mechanism consists of two primary components, the first is generally applicable to function value summaries (as are commonly found in nonparametric statistics or functional data analysis) while the second is general to disk-like surfaces and hence more applicable than just to human faces.

Published as a conference paper at ICLR 2025
GAUSSIAN DIFFERENTIALLY PRIVATE HUMAN FACES UNDER A FACE RADIAL CURVE REPRESENTATION
Carlos Soto
Matthew Reimherr Department of Statistics Pennsylvania State University University Park, PA 16802, USA m1r360psu. edu
Department of Mathematics and Statistics University of Massachusetts Amherst Amherst, MA 01003, USA
carlosscto@umase edu
Aleksandra Slavkovic Department of Statistics
Mark Shriver
Department of Anthropology Pennsylvania State University
Pennsylvania State University University Park, PA 16802, USA abs ebs12@psu.edu
University Park, PA 16802, USA mds1 70psu.
ABSTRACT
In this paper we consider the problem of releasing a Gaussian Differentially Pri- vate (GDP) 3D human face. The human face is a complex structure with many features and inherently tied to onc's identity. Protecting this data, in a formally private way, is important yet challenging given the dimensionality of the problem. We extend approximate DP techniques for functional data to the GDP framework. We further propose a novel representation, face radial curves, of 3D face as a set of functions and then utilize our proposed GDP functional data mechanism. To preserve the shape the face while injecting noise we rely on tools from shape analysis for novel representation of the face. We show that our method pre- serves the shape of the average face and injects less noise than traditional methods for the same privacy budget. Our mechanism consists of two primary components, the first is generally applicable to function value summaries (as are commonly found in nonparametric statistics functional data analysis) while the second is general to disk-like surfaces and hence more applicable than just to human faces.
INTRODUCTION
In statistical analyses, data and parameters appear in varying degrees of complexity, from simpler forms such scalars and vectors to more complex such spherical or hyperbolic. for instance. The structural constraints inherent to data need to be respected throughout any analysis as has been shown in the "intrinsic statistics" frameworks (Pennec (0066) [Bhattacharya & Patrangenaru 2003) for accurate estimation and to preserve said structure. Complex data structures tend to come hand in hand with complex statistical computations and hence the techniques for handling such data have not been widely studied outside of specific scenarios. Further, the sheer amount of data that is captured from individuals has increased significantly, and of course, this produces growing concern for one's s "privacy".. . In this paper, to support broader sharing of confidential data, we propose releasing a Gaussian Differentially Private, GDP, average 3D human face.
Motivation and Related Literature: Data that live in nonlinear spaces can be challenging to work within the DP framework, as shown in the context of manifolds Reimheer al. ): /Soto et al. (022): ; Utpala et al. (2022), private Riemannian optimization in Han et al. (2022). and Gaussian DP on manifolds Jiang et al. (2023). Preservation of structure has also been considered in the context of private covariance estimation for linear regression in Sheffet (2019) and private principal component analysis in Chaudhuri et al. (2013) which is connected to the Stiefel manifold. For privacy, our proposed "face radial curve" representation of a human face functions extracted from a disk and hence lends itself to be examined under the lens of private functional data analysis (FDA) which has been considered in Wasserman & Zhou (2010) and Mirshani al, (2017), and references therein.

---

Published as a conference paper at ICLR 2025
With our faces constantly being captured (e.g., at a grocery store self-checkout), one could question the privacy protections in place of the collected data. Further, there is a vast amount of literature on identification of individuals from facial data in the area of "face recognition," see, for instance, the expansive literature review in Kortli et al. (2020). Also, perhaps quite surprisingly, Venkatesaramani et al. (202T) and Klimentidis & Shriver ( 2009) showed that could identify genomic information from person's 's 2D face image; the former study further showed that adding noise to said 2D im- ages can help protect this re-identification. For 2D images, two common practices to attain privacy of faces are blurring and pixelation (Li & Choi 202T Vishwamitra et al. 2017). A major goal in these previous works is privacy form of anonymity which is usually measured by re identification of individuals; our work, however, defines privacy by satisfying the conditions of disferential pri- vacy. This distinction necessary as the former, generally, considers successful privacy by lack of re identification while preserving utility while for the latter differential privacy is a property of our mechanism. We do not work with 2D images here, however, the need for privacy is still present. The need for privacy for 3D faces is similar to that in 2D images. Anthropological studies are often in- terested in identification of DNA using labeled 3D faces (Sero et al. 2019), the connections between al.) [222] Weinberg
DNA genotype and the associated facial phenotype (White et al.] 2021][Naqy 2019) and average faces for demographics such as age and race classification (Tokola et al., 2015 In such studies, one might want release the data, or may even be required to, so offering provable confidentiality guarantees for people in the studies becomes an important task.
et al.
To generate our representation we rely on tools from shape analysis. The carlier forms of shape analysis, such as Kendall's shape space (Kendall (184).. are limited to only representing shape as a finite point cloud. The field has expanded since consider more complex data structures such as continuous curves, both planar and space, as in Trouvé & Younes (2005) | Klassen et al.) (2004); [Srivastava et al.] (2010), and surfaces as in [Jermyn et al. (2017); [uu al. (2020). Human faces have been considered in this space in a similar, yet subtly different, manner such as in (Saiir jet al. (2006); Drira et al. (2010) in which faces are represented as a set of curves "facial curves" and "radial curves", respectively. These methods represent face with curves that are generated independently of each other while we use an entire disk paaa-aaaatttiiziiionnn to capture features across all faces simultaneously.
Main Contributions: We develop a novel representation for a collection of 3D faces via a set of curves which extract from disk parameterizations and refer to these as face radial curves. We construct the face radial curves using tools from statistical shape analysis in the interest of preserving the shape of an average face during the data sanitization process. Further, we extend existing approx- imate DP FDA tools into the Gaussian DP framework (Dong et al., 2019). recent notion of privacy with attractive properties including "tight" composition. Under our FDA Gaussian DP mechanism, we generate a private average face of collection of faces under our representation. While we use our mechanism and representation for faces address the inherent data privacy concerns, this same methodology can be applied to any surfaces diffeomorphic to unit disk such as terrain models and additionally any settings where one wants private functional statistical summaries.
2 NOTATION AND BACKGROUND ON FACE REPRESENTATION
We require a diss-paaraeterrized representation of each face from which we extract a set of func- tions. We parameterize each face independently but "align" and "register" each face to a template. Here, we broadly describe these relevant techniques from shape analysis including their necessity. To the best of our knowledge, the use of parameterized surfaces in the context of DP has not been explored. The software to accomplish parameterization, registration, and alignment are fully de- scribed in (Jermyn et al., 2017), with accompanying implementation at GitHub repository (Laga) 2022). Further, in Figure 10 we display the entire pipeline for our methodology.
2.1 PARAMETERIZATION
Each face is realized as point cloud, set of p many points in R3, We describe the data collection process in A.4 A point cloud does not explicitly relay structural information; i.e., there is no natural relationship between points. Connectivity can be difficult to
ordering nor explicit connectivity infer since if two points are close in space. they may not be neighboring points, e.g., two points near the tip of the nose, or any concave feature, can be close in R3, but based measuring distance
2

---

Published as a conference paper at ICLR 2025
Figure 1: Left: triangulated mesh face. Middle: A disk parameterized face, the center of the disk being the left nostril. Right: A pisa-tarameterized face after Möbius transformation forcing the center of the disk to be the tip of the nose.
on the surface of the face they may be relatively far apart. So. rather than treat face as set of independent points, we can jointly model each face by imposing a parameterization. Specifically,
we represent each face as a disk-parameterizer surface (Jermyn et al. 2017 Sun et al. 2022 Drira al. 2010).
We first compute Delaunay triangulation using the MeshLab software (Cignoni et al.
2008 yield-
ing a triangulated mesh. Given a point cloud X E RPx3 the triangulated mesh, M (V. E. T), an object which consists of set of vertices V (the original points), edges E, and triangles T com- posed of said vertices and edges. The triangles meet at edges, do not overlap, and jointly represent mesh surface. The left panel of Figure displays face triangulated mesh. We generate disk conformal map of M as in Choi & Lui (2018); a disk conformal map of the triangulated mesh mapping from said mesh to disk which preserves the angles of the triangles or, more generally, the local geometry the mesh.
Lastly, we generate disk- parameterized surface in Jermyn al. (2017); Laga al. (2018) via the disk conformal mapping. Figure I displays two task-parameterized surfaces in the middle and right panels; we expand the differences between these two panels in A.7 Each face, S. is thus map [
R3 with D = 0/0 <r 1,0 < < 2 the unit disk.
2.2 SIIAPE ANALYSIS OF SURFACES
Figure I displays different representations of face while retaining its shape. In setting, the shape of an object is that which is not affected by its scale, location, rotation, or parameterization. The analysis we intend to do should not be dependent any of these parameters. Next, we describe how to remove this dependence.
Let F be the space of all parameterized surfaces, F f D D R where D is the unit disk. We assume all surfaces are smooth and genus-0, that is, they are differentiable and have no holes. We first remove scale and location differences by forcing each face have unit surface area and be centered at the origin. That is, we scale the surface area to be one by setting f + f/ SD Ifr x fol d0 where fr. So are the partial derivatives of f with respect to r and 0, respectively. To center the surface, set f denote surface which has unit surface area and the origin as its centroid.
where f is the centroid of the surface. For notational simplicity, let f
Location and scale characteristics that are intrinsic each surface, so we achieve their removal on each face independently. Rotational alignment and parametric registration, however, are relative. Each face must be aligned and registered to a template face Let ftemp be template face of unit area and origin centroid; in practice one could either choose an arbitrary surface from the dataset, training set, or some representative surface such as the mean surface..
Let O {O det((O) = }} be the set of all 3 x rotation matrices and let I' = {>/y D + D} be the set of diffeomorphisms. Each 7 a reparameterization of surface which acts on surface on the right ff a y; we fully describe this action in A.3 Rotations, O, act on the left as O and do not effect scale nor centroid.
In shape analysis it is more typical to do pairwise alignment and registration (Wallace al. 2014 Cho
2019 Klassen al. 2004) however our goal not pairwise comparisons we forego this approach.
3

---

Published as a conference paper at ICLR 2025
Figure 2: Left: A point cloud representation of face. Right: A surface representation of the face with an overlay of radial curves.
We optimally align each face to the template, fiemp. by considering the optimization
(5, Ö) argmin 10fo7- - -Stmpple 112-
To accomplish this task we appeal to elastic shape analysis (ESA) (Jermyn et al. 2017). In short, rather than solve the above minimization, ESA defines a metric which replaces the above L norm and transforms each surface using the square-rool normal field representation. For each face we compute this minimization such that the registered and aligned face is f == Of o ý. We elaborate on this process A.3
NOVEL FACE RADIAL CURVES REPRESENTATION
We parameterize the entire face using a disk, however, our goal is to work with what we refer to as "face radial curves." " This concept is similar that of facial curves (Samir al. 2006) and radial curves (Drira et al., 2010). In the facial recognition literature, for instance, to construct a radial curve representation one picks a focal point, typically the tip of the nose, and overlays curves on the surface of the face with the nose as the center and each point of the curve being equidistant from the tip of the nose. That is, given a focal point p each radial curve g førr dp(p, xr)} for given 2 0 and where dF is distance measured the surface of the face.
These previously mentioned methodologies do not take into account that the distribution of features on faces is not uniform for everyone. That is, let Púj represent the jth radial curve of the ith face, then 9ty may be the curve which goes directly on the middle the eyes for individual but grz may be directly on the forehead of individual i' for the same j. Features, such eyes and the mouth, being disproportionately farther or closer to the focal point or each other hence causes issues. These methodologies do, however consider registration within each but not across all js simultaneously. We propose a new method to have an entire global alignment and registration across all sets of curves and faces.
In the previous section, we set up a way to compute faces ( jim,... that are registered and aligned to a template face ftemp- Each face is a mapping f(i) D + R3 and we note disk is an infinite collection of concentric circles, and thus each f()) is a collection of curves f!!) D, + R3, where D, D is the circle of radius r. By construction, the alignment and registration to template implies these curves f(()) capture the same features across all faces; these curves are what we refer to face radial curves.
We apply our proposed method to data described in Sero et al. 2019); more details are available in A.4 The left panel of Figure 2 displays face point cloud and the right panel is the same face but with the disk parameterization and some of the face radial curves overlain. While the disk parameterization is infinite collection of these curves, pick some number of these curves to represent the face. The number of curves is a tuning parameter where more curves implies, to an extent, more definition in the face. We discuss this further in 5
4

---

Published as a conference paper at ICLR 2025
4 GAUSSIAN DIFFERENTIAL PRIVACY FOR FUNCTIONAL DATA
Since the conception of DP (Dwork et al. 2006), noise calibration has been considered from different perspectives leading to many variants. For instance, "zero concentrated differential privacy" (Bun) & Steinke, 2016) and "Rényi differential privacy" (Mironov] (017)) are notions of DP from the perspective of divergence of the distribution of the mechanism. In the present paper we utilize "Gaussian DP" (GDP, Dong et al. (2019)), which considers DP from the perspective of particular set of hypothesis tests. As one of our key contributions in this paper, we extend GDP to functional data analysis (FDA) in Section 4.2 We begin with brief overview of DP for FDA.
4.1 BACKGROUND ON DIFFERENTIAL. PRIVACY FOR FUNCTIONAL. DATA
In this section and in A.5 we describe approximate DP, (c, 5)-DP, in the context of FDA. This is
needed background for our proposed extension of GDP into the space of functional data. For more thorough exposition on DP, see Blum al. (2005 Dwork & Roth (2014); Dwork et al. (2006).
Let D denote dataset of a size n, D {-r, 22, .nn.... and D be the space of all such datasets. An adjacent dataset, D', is a dataset which differs from D in exactly one element which, without loss of generality, we can choose as the last element, D' = { .2....,,T,, J. We write D ~ D' to denote adjacency. Here IDD denotes the statistical summary we aim to release, and a private random version of the summary as (D), which we will refer to as a privacy mechanism.
J.
We consider releasing an estimate of private mean function. To sanitize functions we rely on tools and foundations of functional data analysis in the domain of privacy as in Hall et al. (2013); Alda & Rubinstein| (2017); Mirshani et al. (217)), with the latter considering spaces more extensive than functions. The infinite dimensional nature of function valued summaries presents a critical challenge in establishing formal privacy. In particular, traditional probability densities become much more complicated as there is no default or baseline measure in infinite dimensions (unlike Lehesgue measure in ) To overcome this challenge, there are currently two approaches. The first, taken by Hall et al. (2013) is to work in finite dimensions and then take careful limits. The second approach, introduced in Mirshani et al. (2017) and which we follow here, is to utilize carefully constructed infinite dimensional densities so that the probability inequalities can be worked out directly (and avoid having to take limits).
Let H. denote a real separable Hilbert space in which we aim to release a summary statistic h(D) e HI, e.g., ([0, 1)). R.,, or a reproducing kernel Hilbert space. We consider a Gaussian process in HI to add noise to hDD). Let X be a Gaussian process in HH parameterized by its mean 1) E HH and covariance operator
H' + IHI where HH* is the dual space of HI. A stochastic process is said to be Gaussian if any linear functional
E HI of X is Gaussian in R. We note that technically a E H. however since H H we avoid this distinction unless necessary. Further, we have that E[a(X)] a(n) and C(a, Cov(a(X), b(X)) with a, b H. We write that X ~ (n C) and 7 ~ (O0 C). In this setting we can achieve approximate DP via Theorem A.2 A critical requirement is that our summary be compatible with the noise Z which, roughly stated, means that while the noise lives in H. we require our summary to exists in a smaller space H C H. In our case H. is a reproducing kernel Hilbert space (RKHS) so the eigenfunctions arise from C and thus are determined by our choice of kernel k(s, t).
Now that we have well defined noise, we consider releasing a specific summary statistic: a private mean function with sample mean hDD)= = X = 1 E, Z4. To have some control on the smoothness of this estimate, we enforee smoothness by relying on an optimization problem with a penalty. That is, we let h(D)= argminmen Σ: ||= m l|a + & mill with ø being smoothness penalty parameter. This approach ensures the required noise compatibility. For our summary statistic, the
sensitivity, supp- [I - -h(D))2 can be shown to be bounded as A < 442/(n2 (Mirshani ct al. 2017), where T is a finite bound on the norm in the HH space of the elements of all D E D.
4.2 EXTENSION OF GDP TO FUNCTIONAL DATA
One especially useful interpretation of approximate DP comes from Wasserman & Zhou 2010)) which relates DP to hypothesis testing. In particular, for a sanitized output, h( (D), one can consider statistical tests for determining if the true underlying data source is D or some adjacent data set D'.
5

---

/P(DD)] where Q is the Published as a conference paper at ICLR 2025
In these simple cases, the optimal test is well known Nlyyann-Pearson Lemma), about the optimal type error (1-power) of a statistical test for given type error rate. It turns out that DP gives bound for the type 2 error relative to the type error, which Dong al. (2019) took a step further to define Gaussian DP. In particular, Dong et al. (019) show a mechanism is JDG if its entire type 1typpe error tradeoff curve is bounded by that of curve coming from comparing a N (O, 1) to N (p, 0), meaning it is harder to distinguish and from N N0, 1) than it is ((D) from ((D)) from h(D). We provide the formal definition below.
talk
Definition 4.1. A mechanism h(D) is said to satisfy μ GaGasssian differential privacy (μ-GDP) Dong et al. 2019) if for all adjacent datasets D D~a D'.
((h(=; D), h(x; DJ) Gu:: where T is a trade-off function and G₁, (O, [0. 1] + [0, 1] for two probability distributions U1 and U2 is T(U1, (2)(())))))) inf 9g S a} with ç being a rejection rule, a being the type 1 error, and 8g the type 2 error forç.
1)). Here trade-off function T'
In our main Theorem we prove that the DP framework for functions as defined in Theorem A.2 GDGDP; we utilize the following corollary to achieve this.
Corollary 4.2 (Dong al. (2019)). A mechanism is μ GDP if and only if is (e,)(e))-DP for all 2 0, where d(e) 2 4
+ - e (-
Corollary 4.2 also appears in Balle & Wang (2018) in the context of the calibrating the Gaussian mechanism, but in the presented form the corollary is more readily applicable for our setting.
Theorem 4.3. The mechunism i(D) h(D) + o Z as defined in Theorem A.2 is μ-GDP with A/p. Here A the same global sensitivity as before.
Proof. We need to show that the distribution induced by our Gaussian process in of D) is (..2 as in Corollary 4.2, The key here is the use of H., as H-GDP by bounding the 5(e) in Theorem A.2
our function space is mnfinit-dimensionn and hence it is not possible to define a measure analogous to that of the Lebesgue measure.
Mirshani et al. (2017) provide the framework to define a useful density of h(D) over H. however they do not consider bounding the tail probabilities nor the privacy loss random variable as we do next. We first define the privacy loss random variable as PL = log dP(D) di
probability measure induced by our noise Z and P(D) the family of measures of our mechanism h(D). By construction we have that (DD) is compatible with and hence the above is well defined:
dP(D) (v) cxpp exp { 2o [IA(D)] - 2TaD)
dQ
Here T((D) is linear operator and thus Th(D) (f())) (D)) is normally distributed.
From Mirshani al. (2017), we have that Tu (K())) Using this, we can show that
N(O, (NO,)))))))
PPP 2 ()
P
-c)
-c)
E0
A
DE
+
(2)
A
20
A
2x
é
e
2
/
The last equality is reparametrization setting μ A/a and the rest of the details are in the A.8
For facial radial curves and other disc-like surfaces, by construction, we need to sanitize many mean curves, so we require composition of a multitude of mechanisms with their respective budgets , s. Composition in the GDP framework is "tight." Given two mechanisms h, hg with privacy parameters μ1 and μ2, their composition (h, h2) is Vn4 + 42 DDP (Dong et al. 2019 Corallary 3.3).

---

Published as a conference paper at ICLR 2025
02
53
00
20
Figure 3: Left: The same face represented using 16, 27, and 80 face radial curves, respectively.
Right: The z, y, and coordinate curves, respectively, for a particular face radial curve.
5 FACE RADIAL CURVE EXAMPLE
Here, we apply our proposed methods from sections 3 and 4.2 on data described in Sero et al. (2019) A.d Figure displayss from left to right the same face with Larger values of ./ add definition to the face, but J need not be too large to encapsulate the facial structures. Based on that, we represent the n 1000 faces with / 23 face radial curves; one could pick J in data driven way as well. We treat the J sets of curves across the faces independently.
16, 27, and 80 face radial curves.
We note an important subtle strength in our construction. Each face radial curve has three coordi- nates, F, y. and by our construction y are effectively circle and encode facial features. The right panel Figure 3 displays
coordinate curves of an example face radial curve. The first two coordinates are quite simple and are roughly one period of a sine curve. We leverage this simplicity in these two coordinate curves to conserve privacy budget by enforcing a larger smoothing param- eter compared to the last coordinate curve and also treat the coordinate curves separately each radial curve.
Let {ff} be the of radial curves for specific coordinate at the jth position and being the index of for particular face. For simplicity one can imagine j = being the curve nearest the tip of the and j 23 the curve nearest the border of the face. Each curve /i is closed parameterized curve, f S - IR where St is the unit circle, as in the right panels of Figure 3 In general, we drop the j as we treat each set independent of each other. We parameterize the curve with unit circle but for simplicity we say f: [0, 1] + R with f() f(1).
By design we have closed curves, so retain this structure use a periodic kernel that takes the form k(s, t) = exp (- [dga (w(t), (ss))/p)*) (Gneiting) (003)) with f, E [0, I]. The distance of two points a, on S! arccos(a, b). however, the previous f, s are parameters on the unit interval, so we first "wrap" the interval around the circle to compute this distance hence the need for w(),, a wrapping function. This kernel is a powered exponential on spheres with kernel range parameter and smoothness parameter E (0, 1]. For our experiments we set = 1 as we can control smoothness instead via Φ in the mean estimation as in 4.1
We compute kernel matrix K of the the unit interval [0, 1] with [K]i k(w((k((/))))) (im(mi//) (((//)) where m = 80 is an integer defining the fineness the uniform grid on the unit interval and i,j = 0, 0,
Let the eigenvalues, of K, and their associated eigenfunctions be denoted as (A,, by). can be shown that non-private mean in the RKHS space h(D) Since we are sanitizing the coordinates independently, we have a smoothness parameter for each coordinate, dh., &y. and Φz. The left panel of Figure 4 displays the mean face constructed from mean face radial curves with Φr = Øy = 0.01 and Φ 0.005.
Σ, a by)by-
5.1 EXPERIMENTAL RESULTS
To highlight the difficulty of working with such complex data we present some preliminary results. We have 1000 faces each with 7150 points; we fully describe the data in A.4 The points
7

---

Published as a conference paper at ICLR 2025
Figure 4: Left: Two angles of the average face constructed of average face radial curves with Φ2
dy = 0.01 and Φ = 0.005. Right: Two angles of the point-wise mean.
Figure 5: Left: Two angles of a private face sanitized with point wise Gaussian noise with total MT 2. Right: Two angles of differentially private face constructed from private mean face radial curves with pr 2.9961 Φ₂ = By 0.01 and Φ₂ 0.005.
"registered", via the data collection method, across all the faces. Without this registration, the following would not be immediately feasible. Let D = {X;} and X; 7 We first compute the point-wise mean of the faces, X = 1/n Σ; X, and display this in the right panel of Figure
Suppose we have total budget of pr and we wish to sanitize, independently. the 7150 points each of which has coordinates. To split the budget evenly, each point's coordinate allocated 11p = //t//(7150 3) of the budget. For each point and each coordinate we compute sensitivity as Ak.i = max,,; [X (k, 2] (,(k; Z]]. That is, among all faces this measures the variability at each point. We note that this sensitivity calculation does violate privacy, as it is data driven, and that an entirely private form of this calculation is strictly larger. That is, sensitivity calculation is smaller, so a private method would lead to noisier estimates. We add noise to each coordinate of each point as X k I] Ak.1/1p Mpp where ~ (0, 1). Figure dissplyy two angles of point-wise private face in the left panel with total privacy budget prr = 3 with more results in A.9
Next apply approach using face radial curves. We have J many sets of curves, {fi), each of which has three coordinate curves, fi = (fiz, fig, We sanitize the regularized mean, in- dependently, for each coordinate and each radial curve, using our mechanism which satisfies GDP with sensitivity is 2 < 47 4r²/(n²<) Earlier we saw that the I and coordinate curves, at every J, effectively one period of sinusoidal curve, we take advantage of this construction conserve budget. We thus spend less budget sanitizing the and y coordinate curves and spend more on 2 as they contain more feature information.
We need to determine the т. an upper bound on the norm of the curves, in our A. We determine this т, in similar way as the point-wise wise approach of computing sensitivity, through the data at each set of radial curves and each coordinate. That is, for each j and at each coordinate max, [lff(w)) use shape analysis to do our processing, all the faces are scaled to have unit surface area, and hence all the curves are scaled. Thus, individually none of these norms hold any meaningful size information. Further, our analysis is entirely scale invariant, meaning that if face is much larger or smaller than average, that information completely removed when we scale. This is a strength of shape analysis the emphasis is the shape of the face and not the nuisance parameters.
T. Again, we have a sensitivity that is partially data driven. However we note since
8

---

Published as a conference paper at ICLR 2025
Table I: Mean Squared Error between private estimates and the point-wise mean. The last column is the point-wise MSE between our method and the RKHS mean. All values are at E-04.
PT
2
3
2.9961 (Ours)
Ours
MSE
14
7,5807
5.2989
3.6365
Figure 6: Blue points are the point-wise mean. Left: The red points are the point-wise private mean with por = 3. Right: The red points are our private mean with prr = 2.9961.
We choose budget for each of the coordinates Juny curves; i.c., at each j for the w coordinate curve fi(fiw)) = h((fiw)) + Aw Z with A < Mi
Mayyyy Mys Mz which are the same at all levels j of
4r (n2 and Z is standard normal Gaussian process. The right panel of Figure displays an example private mean face with pr 2.9661 where PT v J(2 n2 + μ2) with J/ 23, Me My 0.2 and μæ= = 0.55. For each coordinate we have separate smoothing parameters we display results with Φ₂ o, 0.01 and Φ. 0.005. Comparing our private mean to left panel of Figure 4 we see there is some clear smoothing in the lips area and some subtle smoothing in the eyes as well.
Lastly, we quantify the amount of injected noise by computing mean squared error. We let the point-wise mean our baseline non non-private estimate, the right panel of Figure 4 For the point- wise private estimate the M = N E, X; - X212 where N 7150 is the number points. Table I displays these eπrоrs in the first two columns. Our sanitized mean, however, is a set of functions we first discretize into 1863 points (23 curves at 81 points) and denote this V. We let MSF M E, min; X;; - 1 with M = 1863. Since the two point clouds have different number of points, this MSE finds the nearest point the non-private face that of the private face V. We further scale V -> aV to align to X as X is not processed data. Table [ displays the error in the third column of 5.2989, less than both of the point-wise private faces. This MSE does incur an inflation, though, as the point-wise mean is not a surface and thus lacks a registered point at the location of our private mean. We can clearly see this in Figure 6 in both panels the blue points are the point-wise mean, the left panel has the point-wise private mean in red, and the right panel has our private (discretized) mean in red. We see that our method has points that seem lie on the "surface" of the face but the non private mean may not have a point there. We also clearly see that the point-wise private mean adds noise in the ambient space and thus creates rough, fuzzy estimate not entirely resembling a smooth face; i.e., the facial structures are distorted. Also, the MSE of our facial radial curve based GDP method less than the MSE of the point-wise sanitized estimate which has slightly larger privacy budget. To even further emphasize this point, the last column of Table ] the MSE between our private mean and the RKHS mean, we see it is less than half in comparison to the point-wise sanitization.
6 CONCLUSIONS
We have developed framework for releasing μ-GDP human face with our novel face radial curve representation. We extended (c, 6DD FDA (Mirshani et al. 2017) techniques into the G-GDP framework (Dng et al. 2019) to take advantage of its tight composition of budgets. We utilized the new GDGDP FDA framework specifically for faces but note this is applicable for other FDA applications. Further, utilize the shape analysis techniques of [amirr et al. (2066); Drira et al.

---

Published as a conference paper at ICLR 2025
2010) Jermyn al. (2017) to create novel curve representation of face. We focus on human faces, however, one can use our framework to samitize other surfaces which are diffcomorphie to a disk. Our representation changes the problem of sanitization from needing thousands of point-wise estimations to a few dozen functional estimates. We discuss the limitations of our methods in A.
A persons face contains information of ones identity and, noted earlier, its image contains ge- nomic information (Venkatesaramani et al. 202T), thus, the need to protect this information while sharing these data (e.g., anthropological studies) is crucial. We demonstrate via empirical and quan- titative results that our methodology adds less noise and preserves the structure of the face. We chose the number of face radial curves needed for our representation, but one could develop a pri- vate cross- vross-validation method to do so.
In A.4 we describe how the data is collected by /Sero et al. (2019), so here we mention some limita- tions in our experimental results as well as in A.1 In sense, our data is very clean, and hence our methodology only tested in this circumstance. All faces in the dataset have neutral expression, so to handle other expressions would require additional processing or extending the methodology. Expression variation is complex source variability which critical in areas such as face recog- nition (Smeets et al. 2012). It is not entirely clear how to handle such variability for estimation of an average. The parametrization requires a genus-0 surface, i.e. no holes, so if a face has missing data this would need to be rectified. For instance, preprocessing by patching "holes" or missing data has been considered by [Passalis et al. (2011) which leverage the symmetry of the face for interpolation. There is vast amount of survey papers in the face cognition literature such as ZZhao et al. (2003); Jafri & Arabnia (2009); [i et al. (2020). to name a few, which encounters similar issues all to say these problems are trivial and are potential future research opportunities.
ACKNOWLEDGMENTS
The authors would also like thank the anonymous reviewers which provided constructive feed- back. CS would also like to thank Gary Choi for guidance on conformal maps. This work was in part supported by NSF Award No. SES-1853209 to the Pennsylvania State University, and by Huck Institutes of the Life Sciences at the Pennsylvania State University through the Dorothy Foehr Huck and J. Lloyd Huck Chair in Data Privacy and Confidentiality, Content is the responsibility of the authors and does not represent the views of the Huck Institutes.
REFERENCES
Francesco Alda and Benjamin Rubinstein. The bernstein mechanism: Function release under dif- ferential privacy. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 31, 2017.
Borja Balle and Yu-Xiang Wang. Improving the gaussian mechanism for differential privacy: Ana- lytical calibration and optimal denoising. In International Conference on Machine Learning, pp. 394-403. PMLR, 2018
Rabi Bhattacharya and Vic Patrangenaru. Large sample theory of intrinsic and extrinsic sample means on manifolds. The Annals of Statisties, 31(1):1-29, 2003.
Avrim Blum, Cynthia Dwork, Frank McSherry, and Kobbi Nissim. Practical privacy: the SulQ framework. In Proceedings of the wontt--ourth ACM STGMOD-SIGACTTSIGAART symposium on Principles of database systems, pp. 128-138, 2005.
Mark Bun and Thomas Steinke. Concentrated differential privacy: Simplifications, extensions, and lower bounds. In Theory of Cryptography Conference, pp. 635-658 Springer, 2016.
Kamalika Chaudhuri, Anand D Sarwate, and Kaushik Sinha. A near-optimal algorithm for differentially-privaal principal components. Journal of Machine Learning Research, 14, 2013.
Min Ho Cho, Sebastian Kurtek, and Steven N MacEachem. Aggregated pairwise classification of statistical shapes. arXiv preprint 1901.0097 2019.
Gary P.T. Choi. look-cofformal-man
map 2020.
10

---

Published as a conference paper at ICLR 2025
Gary PT Choi, Yusan Leung-Liu, Xianfeng Gu, and Lok Ming Lui. Parallelizable global conformal parameterization of simply-commected surfaces via partial welding. SIAM Journal on Imaging Sciences, 13(3):009-11883, 2020.
Gary Pui-Tung Choi and Lok Ming Lui. A linear formulation for disk conformal parameterization of simply-connected open surfaces. Advances in Computational Mathematics, 44:87-114, 2018.
Pui Tung Choi and Lok Ming Lui. Fast disk conformal parameterization of simply-connected open surfaces. Journal of Scientific Computing, 65(3):1065-110 1090, 2015.
Paolo Cignoni, Marco Callieri, Massimiliano Corsini, Matteo Dellepiane, Fabio Ganovelli, and Guido Ranzuglia. MeshLab: an Open-Source Mesh Processing Tool. In Vittorio Scarano, Rosario De Chiara, and Ugo Erra (eds.), Eurographics Italian Chapter Conference. The Eu- rographics Association, 2008 ISBN 778-3-905673-68-5
doi: 10.211//ooalChapptereeees
Jinshuo Dong, Aaron Roth, and Weijie Su. Gaussian differential privacy. arXiv preprint arXiv: 2019.
Hassen Drira, Boulbaba Ben Amor, Mohamed Daoudi, and Anuj Srivastava. Pose and expression- invariant 3d face recognition using elastic radial curves. In British machine vision conference, pp- 1-11,2010
Cynthia Dwork and Aaron Roth. The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science, 933-4):211-407, 2014.
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. Theory of cryptography conference, pp. 265-284. Springer, 2006.
Tilmann Gneiting. Strictly and non-strictly positive definite functions on spheres. Bernoulii, 19(4): 1327-1349, 2013.
Rob Hall, Alessandro Rinaldo, and Larry Wasserman. Differential privacy for functions and func- tional data. The Journal of Machine Learning Research, (4(1):733-727,000
Andi Han, Bamdev Mishra, Pratik Jawanpuria, and Junbin Gao. Differentially private riemannian optimization. Xrviv preprint arXiv:2205.09490 2022.
Rabia Jafri and Hamid R Arabnia. A survey of face recognition techniques. journal of information processing systems, 5(2):41-68 -6,, 2009.
lan Jermyn, Sebastian Kurtek, Hamid Laga, and Anuj Srivastava. Elastic shape analysis of three- dimensional objects. Springer, 2017.
Yangdi Jiang, Xiaotian Chang, Yi Liu, Lei Ding, Linglong Kong, and Bei Jiang. Gaussian differen- tial privacy on riemannian manifolds. arXiv preprint arXiv:2311.10101, 2023.
David G Kendall. Shape manifolds, procrustean metrics, and complex projective spaces. Bulletin of the London mathematical society, 16(2):81-12,, 1984.
Eric Klassen, Anuj Srivastava, M Mio, and Shantanu H Joshi. Analysis of planar shapes using geodesic paths on shape spaces. IEEE Iransactions on patlern analysis and machine intelligence, 26(3):372-383, 2004.
Yann C Klimentidis and Mark D Shriver. Estimating genetic ancestry proportions from faces. PLoS One, 4(2))e4460, 2009.
Yassin Kortli, Maher Jridi, Ayman Al Falou, and Mohamed Atri Face recognition systems: A survey. Sensors, 20(2):342, 2020.
Hamid Laga. Smff. htttp:///
whwaaaaiillaaaaann 2022.
Hamid Laga, Yulan Guo, Hedi Tabia, Robert Fisher, and Mohammed Bennamoun. 3D Shape analysis: fundamentals, theory, and applications. John Wiley & Sons, 2018
11

---

Published as a conference paper at ICLR 2025
Lixiang Li, Xiaohui Mu, Siying Li, and Haipeng Peng. A review of face recognition technology. IEEE access, 1739110-1391111 2020.
Tao Li and Min Soo Choi. Deepblur: A simple and effective method for natural image obfuscation. arXiv preprint arXiv:2104.02653 1:3, 2021.
Ilya Mironov. Rényi differential privacy. In 2017 IEEE 30th computer security foundations sympo- sium (CSF), pp. 263-275. IEEE, 2017.
Ardalan Mirshani, Matthew Reimherr, and A Slavkovic. Establishing statistical privacy for func- tional data via functional densities. arXiv preprint arXiv:1711.0666 2017.
Sahin Naqvi, Yoeri Sleyp, Hanne Hoskens, Karlijne Indencleef, Jeffrey P Spence, Rose Bruffaerts, Ahmed Radwan, Ryan Eller, Stephen Richmond, Mark D Shriver, et al. Shared heritability of human face and brain shape. Nature genetics, 53(6):300-839, 2021.
Georgios Passalis, Panagiotis Perakis, Theoharis Theoharis, and Ioannis A Kakadiaris. Using facial symmetry to handle pose variations in real-world 3d face recognition. IEEE Transactions on Pattern Analysis and Machine Intelligence, 33(10):1938-1955 2011.
Xavier Pennec. Intrinsic statisties riemannian manifolds: Basic tools for geometric measure- ments. Journal of Mathematical Imaging and Vision 25:127-154, 2006.
Matthew Reimherr, Karthik Bharath, and Carlos Soto. Differential privacy over riemannian mani- folds. In M. Ranzato, A. Beygelzimer, Y. Dauphin, P.S. Liang, and J. Wortman Vaughan (eds.), Advances in Neural Information Processing Systems, volume 34, pp. 12292-12303. Curran As- sociates, Inc., 2021. URL http:////w.ppeeee...eeeeeeeeee.s
capper.di.
Chafik Samir, Anuj Srivastava, and Mohamed Daoudi. Thrce-dimensional face recognition using shapes of facial curves. IEEE Transactions on Pattern Analysis and Machine Intelligence, 28(11): 1858-1863, 2006.
Dzemila Sero, Arslan Zaidi, Jiarui Li, Julie White, Tomás González Zarzar, Mary Marazita, Seth M Weinberg, Paul Suetens, Dirk Vandermeulen, Jennifer K Wagner, et al. Facial recognition from dna using face-to-dna classifiers. Nature communications, 10(1):2557, 2019.
Or Sheffet. Old techniques in differentially private linear regression. In Algorithmic Learning Theory, pp. 789-82777777 PMLR, 2019.
Dirk Smeets, Peter Claes, Jeroen Hermans, Dirk Vandermeulen, and Paul Suetens. A compar- ative study of 3-d face recognition under expression variations. IEEE Transactions on Sys- tems, Man, and Cybernetics, Part C (Applications and Reviews), 42(5):710-727, 2012. doi: 10. 11010//TMMC.2221121222222
Carlos Soto, Karthik Bharath, Matthew Reimherr, and Aleksandra Slavković. Shape and structure preserving differential privacy. Advances in Neural Information Processing Systems, 35:24693- 24705, 2022.
Anuj Srivastava, Eric Klassen, Shantanu Joshi, and Ian Jermyn. Shape analysis of elastic curves in euclidean spaces. IEEE transactions pattern analysis and machine intelligence, 33 (7):1415-1428, 2010.
Zhe Su, Martin Bauer, Stephen C Preston, Hamid Laga, and Eric Klassen. Shape analysis of surfaces using general elastic metrics. Journal of Mathematical Imaging and Vision, 12:1087-1 2020.
Wenyuan Sun, Ping Zhou, Yangang Wang, Zongpu Yu, Jing Jin, and Guangquan Zhou. 3d face parsing via surface parameterization and 2d semantic segmentation network. arXiv preprint (rXiv:22006002211. 2022.
Ryan Tokola, Aravind Mikkilineni, and Christopher Bochnen. 3d face analysis for demographic biometrics. In 2015 International Conference on Biometrics (ICB), pp. 201-207. IEFE, 2015.
12

---

Published as a conference paper at ICLR 2025
Alain Trouvé and Laurent Younes. Local geometry of deformable templates. SIAM journal mathematical analysis, 37(1):17-55, 2005.
Saiteja Utpala, Praneeth Vepakomma, and Nina Miolane. Differentially private fr', e'chet mean on the manifold of symmetric positive definite (spd) matrices. arXiv preprint 2404: 2022.
Rajagopal Venkatesaramani, Bradley A Malin, and Yevgeniy Vorobeychik. Re-identification of individuals in genomic datasets using public face images. Science advances, 7(47):eabg3296, 2021.
Nishant Vishwamitra, Bart Knijnenburg, Hongxin Hu, Yifang P Kelly Caine, al. Blur block: Investigating the effectiveness of privacy-enhanceo obfuscation for images. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, pp. 39-47, 2017.
William E Wallace, Anuj Srivastava, Kelly H Telu, and Y Simón-Manso. Pairwise alignment of chromatograms using an extended fisher-rao metric. Analytica Chimica Acta, 841:10-16, 2014.
Larry Wasserman and Shuheng Zhou. A statistical framework for differential privacy. Journal of the American Statistical Association, 105(489):355-38, 2010.
Seth M Weinberg, Jasmien Roosenboom, John R Shaffer, Mark D Shriver, Joanna Wysocka, and Peter Claes. Hunting for genes that shape human faces: Initial successes and challenges for the future. Orthodontics & craniofacial research, 22:207-212, 2019.
Julie D White, Karlijne Indencleef, Sahin Naqvi, Ryan J Eller, Hanne Hoskens, Jasmien Roosen- boom, Myoung Keun Lee, Jiarui Li, Jaaved Mohammed, Stephen Richmond, et al. Insights into the genetic architecture of the human face. Nature genetics, 53(1):45-553 2021.
Wenyi Zhao, Rama Chellappa, P Jonathon Phillips, and Azriel Rosenfeld. Face recognition: A literature survey. ACM computing surveys (CSUR), 35(4):3999445) 2003.
A
APPENDIX
A.1 LIMITATIONS
We do not collect any data, however, A.4 we describe the data and how it was collected. In many regards our data is clean, so we did not test our methods on noisy data. sense, we can consider our data as processed data, noisy data would require some processing which we do not consider in this work. It is possible that if the data is more noisy then it would require further smoothing which method does allow. We further have an assumption of genus-0 surface (a face with no holes) which may be an issue if there are missing data points. This type of data would require additional pre- rre-processing. We also only test our method one dataset; one could encounter the issue of variability of noise other datasets but this can be overcome with the smoothness parameters in our method.
A limitation which we have already mentioned in 5.1 is the method for computing sensitivity, A, in both our method and the point-wise method which compare ourselves to. This, however, is an inherent issue in differential privacy rather than our method. That is, for both our method and the point-wise private estimate, we use the data estimate the sensitivity. Ideally one could use second dataset or a training set to estimate the many sensitivity values needed in private way.
In terms of limitations of privacy and fairness, these are the exact problems we address. As men- tioned in I one may want to release private average faces for demographics. Our methods are intended for facilitate this goal although we do consider variability of sample sizes by demo- graphics.
A.2 EXPERIMENTS COMPUTE RESOURCES
We ran experiments almost exclusively on a desktop computer with an Intel i7 processor and 32GB of RAM Windows 11. Creating triangulated mesh for face takes about 5 seconds the
13

---

Published as a conference paper at ICLR 2025
desktop. this was done locally for each face. Parameterizing each face costs about 20 seconds on the desktop, this was also done locally. Reparameterizing, however, each face to a template costs upwards of 3 minutes the desktop, since have 1000 faces did this on a supercomputer.
Computing the mean and privatization with our method costs about 3 total minutes on the desktop computer. The mean computation and privatization of the point-wise method only requires about minute of computational time on the desktop.
A.3 REPARAMETERIZATION
To optimally register two surfaces use the methods as described in Jermyn et al. (017)) which we summarize next. Suppose we have two surfaces / 2 E F which we wish to optimally register over the parameterization group r. Here F is as in 2.2 F 3 S D R3 where D is the unit disk. The action of I' on surface is right composition, f for y I, and reparameterizes the surfaces but does not change image which in our case is the face. The authors in [ermyn et al. 2017) leverage a transformation of referred to as the square-root normal field (SRNF) defined as n///2 where is the normal vector n au x
8f 85 The corresponding action of I on is then
dv.
(g, 7) J(T)q 7. This transformation is necessary for an isometric action of I but the details of this are lengthy and not necessary for our application.
The authors define an energy function Ereg I' + R20 to implement iterative gradient descent method for the registration. The energy is defined as E7) || (02, ?)1 where Ø is the "current" stage of the surface being reparameterized. Here y the incremental reparameterization with (g2,7). Here Yi would be our template surface from 2.2 and we register all surfaces to this template.
Since the reparameterization is done in an iterative manner it results in incrementally improved registration. This method is iterative as the gradient is taken about the identity I, Tidentity and thus lives in the tangent space of this element. Suppose we have an orthonormal basis B = {b} for the tangent space of the (T). The full gradient is given by Ev.en (91 92, d(b,, r))2b; and we use the implementation mentioned in 2.2 and refer the interested reader to the cited materials.
the identity, (T) where each b a unit "vector" in the tangent space
This reparameterization is costly due the dimension, iterative construction, and reliance basis. To alleviate some expense, we set the center of the surface as the tip of the nose as noted in A..7 with the triangulated mesh before we impose the disk parameterization. The reparameterization iterative method thus has to search over smaller space as the center of the disk is pre-registered.
A.4 DATA DETAILS
For full description of how the data is collected we refer to Sero et (209)) but summarize and emphasize the relevant points. All participants have the same neutral face expressions, so the data is not heterogeneous which the authors refer to as lundi-landdarks. Further, these landmarks are registered across all individuals which (Sero al. (2019) refer to as "homologous." This registration is a point-wise correspondence across faces while the registration in in/33] is an entire disk correspondence. Similar to our approach the faces are aligned using Procrustes Analysis, which finds the optimal rotation but again considering the faces set of points not a disk-like surface.
terms of facial expression. Each face captured with 7150 points
A.5 SUPPLEMENTAL NOTES ON DP
We first present the definition for approximate differential privacy.
Definition A.1 (Dookk et al. 2006)) Let D D' and h(D) be random privacy mechanism, the mechanism is said to achieve approximate differential privacy, (e, 6).P) for some e 0 and 0 8 < 1, if it satisfies the probabilistic inequality
P(N(D) e A) s e P(((D') e 8
for any measurable set A.
14

---

Published as a conference paper at ICLR 2025
Both and ò are pre-specified parameters referred to the privacy budget. When å O, this is referred to as pure differential privacy. Differential privacy is an attribute of the random mechanism and roughly states that the distributions over adjacent datasets not too different. To achieve approximate DP for functional data Mirshani et al. (2017) establish the following mechanism.
Theorem A.2 (Mirshani et al. (017)). Let h(D) be a functional summary of a dataset D that is compatible with standard Gaussian process noise and c S 1. We have that h(D) == h(D) + oZ achieves (e, 8) -DP over H where 2lox A? Here A is the global sensitivity of the summary h(D) and A sup ny [[([D) - h(D") where the norm is over the space of the noise Z.
Assuming compatibility, let Q denote the probability measure induced by Z over H. and (P(D) D E D) denote the family of measures over H induced by h h(D) in Theorem A.2 h(D) over IHI with respect to Q, which exists if compatability holds, takes the form
The density of
dP(D) dQ (v) = exp {
[II
2a
Q almost everywhere with T) (v) = (h(D). y. The inner product on H. can be defined in terms of cigenvalues (A₂) and eigenfunctions (b,), as (I, v)n = Σ, XT (x, ( by)er but can generally be expressed using any basis.
A.6 PRIVATE POINT- WISE FACE
Here we have more details on the benchmark method. We have n 1000 faces each with 7150 points. Let D = {X+} and X; E R715003 be the set of faces; further let [, (] be the Ith coordinate, (z. y, 2), of the kth point of the ith face, E (1,2,3), E {1..... ..... 7150), and {1...., 10003. The points are "registered" across all the faces i.e. (k( -] and Xy(k, represent the
same facial feature e.g. the tip of the nose.
We compute the point-wise mean of D, the faces, x= 1/n X; and display this in the right panel of Figure 4 We have a total budget of μr for the entire face which we need to split across all points, X[k: -]. We sanitize, independently, the 7150 points, X X(k, each of which has 3 coordinates [ 1j.
To split the budgetevenly. each point's coordinate is allocated H4p v (7150 3) of the
budget. That is, we require (7150- 3) many mechanisms and their budget composition is / P.
since we are using μ-GDP, For each coordinate of each point of the average. _[k: []. we compute sensitivity as Ag. = max,, [k, 2] x, Z]]. We add noise to each coordinate of each point as X [k, 1] + AkI/Hp z where ~ (0, 1).
A.7 MÖBIUS TRANSFORMATION
The reparameterization defined in 2.1 is computationally expensive. To make the repameterization less expensive, we leverage the Möbius transformation of conformal maps. We give high level idea of this transformation with more details available in Choi & Lui (0015 2018); Choi et al. (2020)
and implementation available GitHub repository Choi 2020).
The left most panel of Figure 7 displays triangulated mesh of a face. The next step in our pre- processing is to generate disk conformal map. The middle column of Figure 7 displays two differ- ent disk conformal maps of the same triangulated mesh in the left panel. It is, admittedly, difficult to discern features, but each panel of the middle column one can see approximately four dense areas of which the middle corresponds to the nose. Recall that this disk conformal map embeds the triangulated mesh onto the disk while attempting to locally preserve all angles.
The panels in the right column of Figure 7 are the disk parameterized surface corresponding to the adjacent middle column disk conformal map. The center of the disk conformal disk, and hence the disk parameterized surface, is not known priori. Either of these disk parameterized surfaces will suffice in our construction as we can optimally register it to a template as explained in 2.2 However, since reparameterization is costly, the template and each face. A natural choice is to designate the center of the disk with feature such the tip of the nose.
can save cost by prespecifying the center of the disk of both
15

---

First we show the bound on the upper bound on the Published as a conference paper at ICLR 2025
Figure 7: Left column: A triangulated mesh of face. Middle column: Two disk conformal maps of the triangulated mesh the left. Right column: The disk parameterized surface resulting from the adjacent middle column conformal map.
The bottom panel of the middle row is constructed using the Möbius transformation on the disk conformal map of the top panel of the middle row. We note that the Möbius transformation is for the disk conformal map and not the disk paramterized surface. This Möbius transformation costs effec- tively no time, but reparameterization of the bottom right disk parameterized surface much faster than reparameterizing the top right to the template. This is because the methodology in A.3 looks the gradient about the identity, so shifting the center of the disk requires a lot of energy. Having prespecified the nose the center of the disk, though, the search space for reparamterization is much smaller. We lastly also note that all from the left and right columns the figure have the same shape but have different representations; that is say, shape is not effected by its parameterization nor representation.
A.8 PROOF DETAILS
We include details to the proof of Theorem privacy loss random variable.
expl
(II(D)) (Tn(x))}
P(PL 2 ()=
log
27
(IIN(D') 2Tm()))) 2()
exp(
= P
log
expl
(Ih(D)))
-I((D)) 2(TD - Tb. 20)
20
20 (IM()))&>11((())))) -
2 -b-)=T)-)(=)) 20)
16

---

Published as a conference paper at ICLR 2025
Figure 8: Left: private face sanitized with Gaussian noise point-wise with total pr 2. Right: A private face sanitized with Gaussian noise point-wise with total PT = 3.
Note that we have [I(D')ll |I(D)]| = [I(D) M(D'Il 2(M(D) h(D"), h(D)) and (h(D) - ((D'), h D) H (TD TD.) Thus follows that,
P
20 (1) |IA(D') 2(TD (xx)
P
20 ((D))) 2(TD TD. - M(D)) 20)
P
20t (-A2- - 2(T, - TT:)(x (xx)(x-((D)) 20)
(TD (D.)(z R(D)) 2 dc A2
A
P oAZ > 0²
2
A 2x
A
P(Z
20
This is the upper bound needed of the privacy loss random variable. We similar need lower bound on the privacy loss random variable. The steps are very similar, we have that,
exp(
(IA(D)) - 2Tx(z))}
P(PL 5e)
log
2n
2TD (x))H Se)
exp(
(I)((D))
06 A
P
A
20
A
20
This completes the proof.
A.9 ADDITIONAL RESULTS
In 5.1 we describe how to privatize point-wise average face. Figure 3 displays a comparison of two private faces with μt and μt 3, each from two angles. The two faces look fairly similar, but this is an artifact of the noise making the face rough and fuzzy. The face the right column has a smoother outline as compared to the face on the left. In Table 1 we see that the MSE of the face on the right is nearly half of that of the face the left.
In the right panel of Figure we show the coordinate curves one face radial curve for one face; In Figure 9 we show the coordinate curves of one face radial curve for one hundred faces. We
17

---

Published as a conference paper at ICLR 2025
Figure 9; The y, and coordinate curves, from left to right, of one face radial curve for one hundred individuals.
in Figure 9 that the curves (and hence the features) are aligned across individuals; this empirically shows the alignment and registration achieved by the methodology in Section 2.2
18

---

Published as a conference paper at ICLR 2025
Raw Data; Point Clouds
MeshLab
Triangulated
A
Linear disk conformal mapping
Disk Conformal
Parametertiation
Mobius Transformation
Parameterized Surface
Disk Reparameterization
Curve Extraction
Face Radial Curve Representation
Sanitization
Gaussian DP
Private Average Face
Figure 10: A pipeline diagram of our methodology. We generate disk parameterized surfaces which we register and align to a template face. We extract the face radial curves from the disk parametriza- tion and produce sanitized mean via our GDP functional data mechanism.
19


Reviews:
[{"review_id": "qzvC6Ni5nu", "reviewer": "Reviewer_nNYC", "summary": "This paper introduces a method for creating Gaussian Differentially Private (GDP) representations of 3D human faces using a novel face radial curve representation. The proposed approach aims to address privacy concerns associated with sharing 3D facial data by employing differential privacy (DP) mechanisms. This method leverages statistical shape analysis to represent faces in a disk-parameterized structure, ensuring minimal noise addition while preserving the facial structure. The approach is specifically designed for applications that involve facial data but could extend to other disk-like surface data. The paper also presents experimental results demonstrating that the method injects less noise compared to point-wise differential privacy approaches while effectively preserving facial features.", "questions": "Please refer to the weaknesses.", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 1, "contribution": 2, "strengths": "1. The paper presents a novel approach to 3D face representation for privacy preservation using face radial curves, which is innovative and highly relevant to privacy concerns in biometric data.\n\n2. The GDP mechanism integrated into this method ensures that facial features are preserved with minimal noise injection, enhancing privacy while maintaining utility.\n\n3. The manuscript includes thorough experiments comparing the proposed method with traditional point-wise differential privacy techniques, demonstrating superior noise reduction and structure preservation.", "weaknesses": "1. **Manuscript Organization**: The paper would benefit from a more structured organization aligned with the standard conference paper layout in AI. The current structure is challenging to follow, and the clarity could be enhanced by including diagrams that illustrate the overall pipeline of the proposed method. Guiding sentences that introduce and connect sections and paragraphs would also help readers navigate the content more effectively.\n\n2. **Assumptions on Data Structure**: The proposed approach assumes a genus-0 surface with no missing data points, which may not be realistic in practical settings. This limitation necessitates additional pre-processing for noisy or incomplete data. Expanding the discussion on how the method could handle such cases would improve its practical applicability.\n\n3. **Limited Dataset and Generalizability**: The evaluation is conducted on a limited dataset without a detailed description of its statistics, raising concerns about the method’s generalizability. While the authors suggest that this approach could extend to applications such as terrain models, no experiments support this claim. More comprehensive testing, including diverse or noisy datasets, is recommended to validate the method’s broader applicability.\n\n4. **Computational Efficiency and Benchmarking**: Although the algorithm's methodology is well-described, the computational cost is not evaluated, which limits the ability to assess its practical performance. Additionally, the benchmark methods used for comparison are not clearly described, which could be clarified to provide a more comprehensive context for evaluating the proposed approach.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "OYfPgbXRgr", "reviewer": "Reviewer_rDcW", "summary": "This paper proposes to extend  existing approximate Differentially Private (DP) Functional Data analysis (FDA) tools into the Gaussian DP framework. These idea have been applied to the protection of 3D face data, where each face is represented by a collection of a set of curves.", "questions": "Does the contributions of this paper concern the extension of GDP to functional data analysis, or the application to 3D face protection?\nIn Appendix B.3 refers to the SRNF  representation of surfaces but how this representation is used in this paper ?", "limitations": "", "rating": 3, "confidence": 2, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "The idea of using Functional Data Analysis  Gaussian  mechanism  Differentially Private to protect 3D face is interesting.", "weaknesses": "- The writing of this paper should be improved,  it does not facilitate the understanding of the contributions in this paper. \n- The approximation of 3D face by a set of radial curves has been published ins several papers related to 3D face recognition.  Hassen (1) Drira, Boulbaba Ben Amor, Mohamed Daoudi, and Anuj Srivastava. Pose and expression invariant\n3d face recognition using elastic radial curves. In British machine vision conference, pp.\n1–11, 2010. (2) Chafik Samir, Anuj Srivastava, and Mohamed Daoudi. Three-dimensional face recognition using\nshapes of facial curves. IEEE Transactions on Pattern Analysis and Machine Intelligence, 28(11):\n1858–1863, 2006.\n- The contributions of this paper are not clear. Does the contributions of this paper concern the extension of GDP to functional data analysis, or the application to 3D face protection?\n- The authors talk about functional data analysis which is a very general term, they should be more precise and discuss the representation of 3D faces by functions?\n- In Appendix B.3 refers to the SRNF  representation of surfaces but how this representation is used in this paper ?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "JLRW6tdKei", "reviewer": "Reviewer_y1vv", "summary": "The paper introduces a new representation termed \"face radical curves\" for a set of 3D faces. It then utilizes the Gaussian Differential Privacy (DP) framework on this representation to create a private average face. The empirical and quantitative results from the experiments show that this method not only maintains the shape of the average face but also introduces less noise compared to traditional methods for the same privacy budget.", "questions": "The paper needs to provide additional evidence to substantiate the usability of the proposed representation.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "(1) This paper proposes a novel privacy-preserving representation method for 3D faces. According to the authors, this approach is also applicable to other disk-like surfaces.\n(2) The paper presents the mean squared error between private estimates and the point-wise mean, showing that this method outperforms the conventional point-wise method.", "weaknesses": "（1) While the article effectively demonstrates the privacy capabilities of the representation through mean squared error metrics for 3D faces, it does not address the usability of the representation for practical applications, such as age estimation and expression analysis of faces. This aspect of usability verification is missing from the paper. \n（2）The authors suggest that the method described in the paper could be applicable to domains beyond 3D facial data. It would strengthen the paper if the authors could include experimental results demonstrating this method's effectiveness in other applications as well.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)