Privacy Beyond Pixels: Latent Anonymization for Privacy-Preserving Video Understanding
Authors: Joseph Fioresi
Ishan Rajendrakumar Dave
Mubarak Shah
Venue: ICLR 2026 Poster (2026)
Keywords: Privacy Preservation
Video Understanding
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: We propose a plug-and-play latent anonymization adapter for video foundation models that substantially reduces private-attribute leakage while preserving performance across multiple downstream video tasks and also mitigates gender bias.

Abstract: We introduce a novel formulation of visual privacy preservation for video foundation models that operates entirely in the latent space. While spatio-temporal features learned by foundation models have deepened general understanding of video content, sharing or storing these extracted visual features for downstream tasks inadvertently reveals sensitive personal information like skin color, gender, or clothing. Current privacy preservation methods focus on input-pixel-level anonymization, which requires retraining the entire utility video model and results in task-specific anonymization, making them unsuitable for recent video foundational models. To address these challenges, we introduce a lightweight Anonymizing Adapter Module (AAM) that removes private information from video features while retaining general task utility. AAM can be applied in a plug-and-play fashion to frozen video encoders, minimizing the computational burden of finetuning and re-extracting features. Our framework employs three newly designed training objectives: (1) a clip-level self-supervised privacy objective to reduce mutual information between static clips, (2) a co-training objective to retain utility across seen tasks, and (3) a latent consistency loss for generalization on unseen tasks. Our extensive evaluations demonstrate a significant 35% reduction in privacy leakage while maintaining near-baseline utility performance across various downstream tasks: Action Recognition (Kinetics400, UCF101, HMDB51), Temporal Action Detection (THUMOS14), and Anomaly Detection (UCF-Crime). We also provide an analysis on anonymization for sensitive temporal attribute recognition. Additionally, we propose new protocols for assessing gender bias in action recognition models, showing that our method effectively mitigates such biases and promotes more equitable video understanding.

Published as a conference paper at ICLR 2026
PRIVACY BEYOND PIXELS: LATENT ANONYMIZATION FOR PRIVACY-PRESERVING VIDEO UNDERSTANDING
Joseph Fioresi', Ishan Rajendrakumar Mubarakk Shah "Institute of Artificial Intelligence, University of Central Florida *Adobe joseph. fioresi siuuff..ff... edu, idave@adobe com, shah@crev ucf
ABSTRACT
We introduce novel formulation of visual privacy preservation for video foun- dation models that operates entirely in the latent space. While spatio-temporal features learned foundation models have deepened general understanding of video content, sharing storing these extracted visual features for downstream tasks inadvertently reveals sensitive personal information like skin color, gen- der, or clothing. Current privacy preservation methods focus on input-pixel-evel anonymization, which requires retraining the entire utility video model and results in task-specific anonymization, making them unsuitable for recent video founda- tional models. To address these challenges, we introduce lightweight Anonymiz- ing Adapter Module (AAM) that removes private information from video features while retaining general task utility. AAM can be applied in a plug-and-pha ion to frozen video encoders, minimizing the computational burden of finetuning and re-extracting features. Our framework employs three newly designed training objectives: (1) clip-level self-supervised privacy objective reduce mutual in- formation between static clips, (2) co- co-training objective to retain utility across seen tasks, and (3) latent consistency loss for generalization on unseen tasks. Our extensive evaluations demonstrate significant 35 % reduction in privacy leakage while maintaining near-ban baar-baseline utility performance across various downstream tasks: Action Recognition (Kinetics400,, UCF101, HMDB51), Temporal Action Detection (THUMOS 14), and Anomaly Detection (UCF-Crime), We also provide analysis on anonymization for sensitive temporal attribute recognition. Addi- tionally, we propose new protocols for assessing gender bias action recognition models, showing that our method effectively mitigates such biases and promotes more equitable video understanding.
fash-
Video Encoder
Raw Video Features
Anonymized Features
Rew Videoe Prev. SOTA Ours
Input Clip
77. 45
VideoMAF
62.7
AAM
Tank Accaney
47.2
Lightweight
Anonymizer
2533
24.9
Temporal Action Localizer
Private Attribute Classifier*
Task Heads:
Action
Classifier
*Aterbato cboctfer example is shove using Tie gonder en mttt
Predictions:
Goir
Golf
2s-1.5s
Male
Cannor
Recogmiton
Temporal
Detection
Attibutte Prediction
Detection
Video Understanding Tasks (1)
Privacy (1)
Figure 1: Our proposed latent anonymization setup (red) utilizes large pretrained video encoders, applying lightweight anonymizer that maintains performance on multiple video understanding tasks while strongly reducing performance on private attribute prediction tasks (right).

---

Published as a conference paper at ICLR 2026
INTRODUCTION
Video foundation models (VFMs) capable of addressing multiple video understanding tasks Wang et al. 2002 )023); [arrdes et al. 2024b); Dave et al.] (2024) have been developed, but due to pow- erful modeling capabilities, the visual features extracted by these models reveal sensitive private information such as skin color, clothing, or gender (Figure D The high quality spatio-temporal features have enabled usage in real-world scenarios such as patient monitoring, sports analytics, robotics, and surveillance, where common practice to extract visual features, store them, and utilize them across multiple tasks. However, an attacker can use a classifier on these features to disclose such private attributes Fioresi et al. 2023), making it unsafe to store or share the visual features directly. This raises the question of how to protect an individual's 's private information in the feature space while maintaining the powerful video understanding capabilities of the VFMs.
Prior privacy-preservee methods Wu et al. (2020); Dave al. (202bb); Li et al. (2023b); Fioresi jtt al. (2023) anonymize video models at the expense of utility. These works have primarily focused on input-level (i.e., pixel-level) privacy, which has limited applicability for two main reasons: (1)
Since it alters the input, it requires retraining the utility model on the transformed data, which is im- practical for large pretrained models trained millions of videos with specific training recipes. (2)
Existing methods have only proven efficacy on single downstream tasks. For instance, SPAct (Daee) et al.] (2022b) is suitable only for action recognition, whereas TeD-SPAD Fioresi et al. (2023) is
limited to anomaly detection. Consequently, the existing pixel-level anonymization formulation is
not suitable adopt to new developments in utility video foundation models.
To overcome these limitations, we propose a novel approach for privacy preservation in the latent feature space, demonstrated in Fig. [ This design is well-suited for practical applications where features are stored for video search or analysis tasks. We call our method SPLAVU: Self-supervised pewacy-preservation via Latent Anonymization for general Video Understanding. SPLAVU the first generalizable method to preserve privacy across diverse tasks without requiring task-specific fine-tuning, natively supporting tasks like action recognition, temporal action localization, and video anomaly detection while integrating seamlessly with various video foundation models.
To anonymize the utility model latent space, we introduce a lightweight, learnable Anonymizing Adapter Module (A.M) on frozen VFM. Importantly, in contrast to prior methods Wu et al. 22000;] Dave et al. (002b); Fioresi et al. (2023). AAM is applied to temporal clip-level features in- stead of individual frames, allowing the anonymizer to communicate across the temporal dimension, more naturally aligning with video tasks. Our training framework employs three key objectives: (1) clip-level self-supervised privacy preservation objective to minimize mutual information between two static clips, (2) a co-training utility objective to maintain performance across predetined tasks, and (3) a latent consistency loss to ensure generalization on unseen tasks. SPLAVU integrates seam- lessly with multiple state-of state-of-the oh-the-art methods for downstream tasks, significantly outperforming pre- vious privacy-prees preserving methods. Additionally, SPLAVU is data-efficient; even when trained on a small dataset like HMDB51 Kuehne et al. (2011). it generalizes effectively without compromising the privacy-utility tradeoff. Under the right conditions, can even defend against recognition of motion-based sensitive attributes such as gait. Beyond privacy protection, our work addresses the emerging issue of noman-attribuu bias in video understanding. For instance, models may exhibit gender biases by associating certain actions with specific genders based on stereotypes. For the first time, we introduce protocols to evaluate and mitigate gender bias in action recognition models.
Our contributions can be summarized as follows:
We introduce a novel formulation of privacy preservation for general video understanding applications by anonymizing the latent embedding space.
To enable latent anonymization, we propose a clip-level sulf-supervised privacy budget ob- jective along with latent consistency loss to preserve the utility generalization capability.
Our method is the first to demonstrate privacy preservation across multiple downstream tasks, achieving notable decrease in privacy leakage of over 35 % while preserving per- formance within 1-2% across each utility task. Extensive ablation studies demonstrate the data efficiency of SPLAVU and its applicability across various video backbones.
We additionally propose new protocols to assess gender bias in existing action recognition models and demonstrate that our method effectively mitigates this bias.
2

---

Published as a conference paper at ICLR 2026
2 RELATED WORK
Video understanding spans tasks like action recognition, temporal action localization, and weakly- supervised anomaly detection. Various datasets have been introduced Carreira & Zisserman (2017)
Diba et al. (2020); Goyal et al. (2017b); Zhao et al. (2019), and recent advancements include self- supervised Jenni & Jin (022); Dave al. (2024] b0 Thoker et al. (2023); ; Swetha et al. (2021)
and foundational models Bardes et al. (2024a) Wang et al. (2023 2022): Swetha et al. (2023)
capable of handling multiple video understanding tasks, enhancing versatility and generalizability.
Privacy Preservation in Video Understanding Recent efforts in video action recognition have addressed visual privacy concerns. Many studies protect visual privacy the time of data capture by utilizing non-intrusive sensors such as thermal imaging, depth cameras, and event cameras Luo et al. 2018); HHinojosa al. (2022); Kim et al. (2022); [Ahmad et al. (2022 2023). ) In this study, we focus exclusively on models using standard RGB cameras, Initial approaches involved reducing the resolution of input data Ryoo et al. (2017 ; Dai et al. (2013); Liu & Zhang (2020) employing object detection for targeted obfuscations Ren et al. (2018): Zhang et al. (2021). However, recent research indicates that these methods often fail to balance utility and privacy effectively Wu et al.
(2020); Dave et al. (2022b); Fioresi et al. (2023) Kumawat & Nagahara (2022); Peng et al. (2024). Wu et al. (2020) showcased a U-Net Ronnebererrr et al. all.l.(2)))))) (2015)-based adversarial training framework which modifies input frames to decrease the accuracy of private attribute prediction while preserving action recognition performance. Dave et al. (2022b) proposed a self-supervised variant that focuses on reducing mutual information instead of relying sensitive privacy labels. Fioresi et al. (2023) adapts the self-supervised privacy objective from Dave et al. 2022b) for the anomaly detection task. Compared to the prior input-level anonymization methods our latent-space anonymization method differs in two key aspects: (1) previous methods are tailored to specific downstream tasks, such as action recognition in Dave et al. (2022b) and anomaly detection in Fioresi al. (2023), while our approach aims to preserve privacy across various downstream video understanding tasks, (2) unlike prior methods, our method does not necessitate the retraining of the video model, thus providing computational efficiency for anonymizing even large-scale video foundation models.
Bias Mitigation Computer vision tasks often struggle with spurious correlations Geirhos et al. 2018 2020). where models rely on irrelevant information to make decisions, such as using back- ground cues for action recognition instead of focusing on subjects' movements Ding et al.) (2022);
Zou et al. (003). Unfortunately, biases across a variety of protected demographic attributes, such as perceived gender, skin color, and age age Zhao et al. 20;;;; Stock & Cisse (201 (2017): Buollawwni Ge-
bru (018); Wilson et al. (2019); Prabhu & Birhane (2020); Tong & Kagal (2020)) Steed & Caliskan
(2021): Gustafson et al. (2023): ) Narnaare et al. (025): Kim et al. (022);; Swetha et al. (2025);
Yousaf al. (2025); Sirnam al. (2026) have been found in vision- based tasks. These biases not only skew model performance but can also perpetuate harmful stereotypes. Barbano et al. (2021) ex- I
plored the relationship between debiasing and privacy preservation, finding that there exists subset of privacy preservation methods that are suitable for debiasing, giving promise to privacy preserva- tion form of debiasing. In contrast to the image domain, biases in the video domain have been as extensively studied. While few papers Choi et al. 20 Li et al. (2023a); Fioresi et al. (2025) address and mitigate scene bias in action recognition tasks, they overlook biases related to human attributes. Motivated by this gap, we introduce, for the first time, protocols to assess gender bias in action recognition. Our findings demonstrate that our self-supervised privacy preservation, even without explicit bias-related objective, effectively generalizes in mitigating gender bias.
3 METHOD
3.1 PROBLEM FORMULATION
In this work, we consider handling sensitive issues in video understanding tasks from the dual per- spective of privacy preservation and bias mitigation.
Privacy Preservation We propose novel mnivacy-preserviv framework that handles multiple util- ity tasks across diverse video datasets. Our framework is designed to maintain the high perfor- mance of frozen video encoder across tasks while enforcing robust privacy constraints through the use of an embedding- anonymization model fx- Specifically, we consider video datasets that span action recognition (TD), temporal action detection (DDTAD), and anomaly detection (DAAD)
3

---

Published as a conference paper at ICLR 2026
(i)
Anonymizing Adapter Module
Temporal Clip X
AAM
Pretrained
f
Sampled Static Clips
Video Encoder:
Beit-iann Layer
Ged-Atte
Latent Convitrnoy
NI. Nem Line
Cro (
AAM
fA
Arong prmas terporal
syer cortisantions
Redaces monol information draacly in sideo spece!
trainable frozen
Uhility
Heeass
Classifer
Classifier
fT
Overall Loss
latent space
video model
Cau
LrAn
La
anonymized
repel
Figure 2: Workflow illustrating the SPLAVU training process. The process begins with a video clip x," from which two random frames are sampled to create static clips. All clips are passed through the frozen video encoder fE to extract global latent video features (I (CLS) /average pooled embed- ding), then further processed by our Anonymization Adapter Module (AAM) fA. The temporal clip features are used for the latent consistency loss and given to the set of task-specific classifier heads fr-.
The two static clip features (h h @2
(()) are utilized in the self-superviser mutual information
minimization objective. Gradients from losses are back-propagated through AAM. complete training algorithm is provided in Appendix Sec.
Each dataset D contains N video samples, represented as (x(1), y.(()) J where x(() is video instance, and y (0) is its corresponding task-specific label. We define the set of utility tasks as (TAR; Tra;: TAD} E T" implementation, we can choose a subset of tasks from T for training, then evaluate on held-out tasks. We introduce budget privacy evaluation task, denoted as B, where performance is measured by private attribute prediction. The framework starts with an off-the-shelf
video encoder model fg. left completely frozen. We define fx(x,)) h, the global clip-level embedding, taken as the [CLS] token for transformer encoders or the average- poogeed feature for CNN-based encoders. In all experiments, fA operates only this single clip-level embedding. The overall goal of fA is threefold: (1) to maintain the performance of f across the set of defined utility tasks 7 (2) simultaneously reduce the performance
budget private attribute prediction task B. and (3) to preserve the general capabilities of fø such that performance is maintained on unseen tasks. This privacy preservation framework is outlined via the following criteria:
Criterion-l: Across each utility task, performance should be retained. Specifically, for task 7 E T*, the loss Ly" before and after anonymization should be approximately equal.
ITT LT (fr- (f)(( >ITT TT ((=((
Criterion-2: The anonymized encoded features are directly used to compute budget loss LB for budget task B, which should greatly increase after anonymization.
(B(f)(fe(X)) > Ls(fe(X)).
The anonymization function should maintain the generalization capabilities of fø by drastically altering the latent features. Hence, we define a latent consistency objective (Ctc) as follows:
Criterion-3:
mán
A system that fulfills all of these criterion achieves effective balance between utility and privacy.
4

---

Published as a conference paper at ICLR 2026
Perceived Gender Bias Evaluation In the standard bias evaluation protocol, are given video dataset D AAR {(x(1, y(")) NT where x() is the ith video instance, y(1) is the associated action label, and NIID is the number of dataset instances. After training, performance evaluated on unseen bias test set Dreco-OOL
= {(x(), yf")) ) where NOOD is the number of out-of- distribution instances. The aim of any debiasing technique is to learn generalizable features of DIID such that performance is maximized on DOOD without compromising IID performance.
When considering perceived gender information, our in-distribution video dataset is now formulated as DAR = ((x(*) y(), g g()) N where g( {male, female) is the perceived binary gender label. We acknowledge that this binary formulation not ideal and not inclusive of all gender cate-
gories. The bias evaluation test set also includes label g in order to evaluate subclass performance.
Final evaluation is on a test set with a different label distribution.
3.2 ANONYMIZATION FRAMEWORK
This section describes the full anonymization framework and training. The framework consists of 3 major components: (1) frozen video encoder backbone fE- (2) an anonymization function adapter fA. which modifies the latent features while retaining the original shape, and (3) set of utility classifier heads {fTAn: AT .TAD] E fr- for a predefined set of tasks. Note that f acts solely on the global clip embedding h, used as input to each utility task head.
Network Initialization To start, we initialize fa to act as an identity function. The video encoder model fE is initialized with off-the-shelf weights of Kinetics400| Carreira & Zisserman (2017) pre- training. Each fr classifier head matches a standard architecture for the provided task. For stability, these are initialized through non-anonymized training their respective utility tasks. For action recognition, fIAR is a simple linear layer. For action detection fITAD and anomaly detection fTAD architectures, TriDet Shi et al. (2023) and MGFN Chen et al. (2023) respectively are utilized.
A Anonymization Training
The training process consists of an adversarial optimization between a budget privacy loss LB and a collection of standard utility losses Lr+, regularized by a proposed latent consistency loss LLC-
Collaborative Utility Objectives To retain the action understanding capabilities of the pretrained model, we employ a co-training framework where multiple tasks collaborate to optimize perfor- mance. The action classifier head, STAR. trained using the standard cross-entropy loss. Our latent formulation enables, for the first time, anonymization training using gradients from alternate down- stream utility tasks. As such, integrate training objectives from state-of-the-arr approaches in TAD and AD. More detailed information can be found in Appendix Sec. B The utility losses from these tasks are combined and jointly optimized through the following:
= wi AARAA + ATADLTAD + WADCAD:
where represents hyperparameter controlling the relative weight of each task's loss objective. We set WAR = AD AD = WAD = 1 to balance task contribution. Notably, we ablate the set of tasks chosen for training (ex: WAD = 0, Tab. 55). finding that SPLAVU indeed generalizes to unseen tasks when using our latent consistency loss.
Clip-Level Budget Privacy Objective Our clip-level self-supervised budget privacy objective is the key component for facilitating anonymization without requiring private attribute labels. The intu- ition is that two frames share lot of mutual information, so if we minimize the similarity between them, the shared spatial information gets destroyed. A crucial difference setting SPLAVU apart from prior works is that the anonymizer works across the temporal dimension using 3D clip features instead of a 2D U-Net Wu et al. (2020); Dave et al. (2022b); Fioresi et al. (2023). This way, when combined with utility task losses, the anonymization model learns to remove all spatial information, maintaining only temporal information useful for solving the utility task. We utilize the SimCLR
Ne- Chen et al. 2020) contrastive loss as LB, defined as follows:
C -log
(5)
N Σ
[1
d(
h
+ d(h
j==1
5

---

Published as a conference paper at ICLR 2026
where (0 represents the feature vector of static clip sampled from video x(0) time I, d(u, v) exp(u" v/( ([[[]]]][[T)) computes the similarity between the input vectors with temperature parame- ter T. [0z an indicator function that equals when j * Minimizing this loss increases the similarity between imputs 6 and h over the sum of all other clips in the batch. Instead, opt '1 to maximize the loss, resulting in the objective destroying mutual information between these clips instead. Notably, as opposed to previous works Wu et al. 2020); Dave et al. (2022b); Fioresi et al.)
2023), we do not use disjoint image encoder model to compute h Alternatively, the video encoder model fE itself is used to process clip frames (tiled to match a standard clip shape, see Figure 2. leading to much more natural utility-privace interaction for improved anonymization.
These static clip features are then directly utilized in this budget privacy loss (Eq. (5).
Latent Consistency Objective Early experiments with the privacy and utility losses indicated that the anonymization process tends to overfit to the proxy-utility tasks used in training (see Tab. ( compromising its effectiveness troducing our latent consistency objective is to ensure that the anonymization learned by the model remains generalizable and is not biased toward the specific utility task(s) it is trained on. This can be accomplished by regularizing the anonymization to preserve the general latent structure of the utility encoder fE. To this end, propose a latent consistency loss that encourages the model to preserve important latent features while still achieving privacy preservation:
unseen tasks. Consequently, the primary motivation behind in-
Lhe lx ffa(fexx))
(6)
where x(9 is the input video clip and || 11 is the &2 distance. This key component ensures that the anonymization does not shift SE features completely into new space that is overfit to the utility training tasks, leading to well-generalizing anonymization.
Overall Training Objective fA and fo are jointly optimized utilizing the following compound loss:
( WLC * Lic + wr cl.- wp * =
(7)
where WLC, WT, and WB are weights to control the strength of each objective. The privacy term is maximized via the negative sign in -wg LB and works against L1 and LLC in GAN-style paradigm, until the anonymizer able remove all encoded spatial information except for what is necessary for performance anonymization adapter /A that can be appended to the off-the-shelf video encoder model SE for use in variety of downstream tasks.
the utility tasks. After this training, we are left with a lightweight
Anonymizing Adapter Module (AAM) To carry out latent anonymization, we propose the use an anonymizing adapter module. AAM is applied to clip-level features, allowing for reasoning across the temporal dimension, better aligning with utility tasks. Given latent feature (6) fa (x()),,
AAM is trained to modify (() with the above loss objective. We utilize a multi-head self-attention- based transformer encoder for AAM. A design choice ablation can be found Appendix See. C
EVALUATION PROTOCOLS
To ensure that our anonymization preserves the utility of the off-the-shelf encoder across multiple tasks, we evaluate its performance comprehensively. Existing anonymization methods, which typi- cally use action recognition the sole proxy utility task, significantly degrade performance on alter- nate downstream tasks. However, pretrained models are known to demonstrate strong performance in areas like temporal action detection and anomaly detection. Therefore, we assess the learned features across five distinct tasks to thoroughly evaluate their effectiveness post-anonymizztion.
4.1 PRIVACY EVALUATION
First, we employ an established privacy preservation protocol to ensure that fA removes sensitive- attribute related information. Although we focus action-related video understanding models, private attribute information is still exposed in the latent features of the backbone encoder. The VISPR dataset Orekondy et al. (2017) evaluates privacy-preservation by measuring performance on a multi-class classification problem for various sensitive visual private attributes, with performance measured by mean average precision across classes (cMAP). For evaluation, train a classifier

---

Published as a conference paper at ICLR 2026
static clip representations, adhering to protocols from prior work in video privacy Dave et al. (2022b). Additionally, we evaluate on temporal-based VP-HMDB51 and VP-UCFI01 datasets Li et al. (2023b), which contain both action and private attribute labels. Here, the full clip representa- tions are used for attribute classification with cMAP as the evaluation metric. Since the goal is to enhance privacy, not accurately predict attributes, lower performance indicates better privacy preservation. For further temporal analysis, we evaluate the effect of anonymization on motion- based sensitive attribute, namely gait recognition on Casia-B Yu et (006))
4.2 UTILITY VIDEO TASK EVALUATION
Action Recognition Action recognition involves analyzing spatio-temporal video features to clas- sify actions. In our framework, features are extracted from all videos using a Kinetics-preerained video encoder. Then, a linear classifier trained for evaluation on each dataset D AR namely Ki- neties400CCarriiaa & Zisserman (2017), UCF101 Soomro et al. (2012), and HMDB51 Kuehne et al. (201T). Additional action results are shown on VP-HMDB51 and VP-UCFI01 Li et (202bb).
Evaluation is top-1 accuracy on 5 evenly spaced clips from each test video.
Temporal Action Detection Temporal action detection (TAD) involves identifying the specific time intervals within an untrimmed video where particular actions occur. TAD utilizes features from Xinetics-pretrained video encoder model. Given DADD fA is used to generate anonymized feature
set ATD = { ff (f(e(((()) V E ETAD }. Our TAD evaluation uses THUMOS14 Jiang al. (2014) as DTAD- We choose one of the recent state-of- oftte--f-thh-asdd the-art methods, TriDet Shi et al. (2023) with default hyperparameters to evaluate using mean Average Precision (mAP).
Weakly-Superrised Anomaly Detection Weakly supervised anomaly detection (WSAD) involves localizing timestamps of anomalous (unexpected) events given long. untrimmed videos and only video-level labels. Our evaluation uses CTr-CCrimeSSuttan et al. (2118) as DAD- Given DAD, fA is used to create an anonymized feature set AD = fA(F (X
VX (6) AD J. A recent state- of-the-ane art anomaly detection method MGFN Chen et al. 2023) is used with default hyperparameters.
Final evaluation is given as a frame-level ROC AUC percentage.
4.3 GENDER PRESENTATION BIAS PROTOCOLS
NTU Bias Evaluation We further verify anonymization efficacy by evaluating on our proposed attribute bias protocols. The NTU60 Shahroudy al. (2016) action recognition dataset is curated to have minimal scene and subject biases as each actor performs each action in different scenes. Given that each video is labeled with subject ID, we can introduce artificial bias by controlling the gendered subclass ratios across actions. A ratio of 95% Sagawa et al.) (2019) is set for all but one action, where the typical ratio is inverted to create spurious shorteut for the model. This is done for each gender, resulting in two subsets: NTU-Bias-F and NTU-BiasM.. Detailed protocol creation info found in Appendix Sec. A
Toyota Smarthome Bias Evaluation Unlike NTU, the Toyota Smarthome (TSH) dataset is natu- rally imbalanced and represents a real-world scenario with elderly individuals performing daily ac- tivities. Each video is labeled with a subject ID, allowing for robust evaluation of perceived gender biases without using gender classifier. Here, we look at the performance of each gender subclass. A model is considered less biased if the baseline gap between the subclass accuracies is reduced.
EXPERIMENTS
Further dataset and implementation details can be found in Appendix Sec. A and respectively.
5.1 MAIN EVALUATION: PRIVACY VS TASK TRADEOFFS
Our evaluation of the proposed method covers private attribute prediction protocols and variety of downstream tasks. We observe in Table | that our approach consistently generalizes well across all tasks, closely maintaining the performance of the -on-ynonyd videos. In contrast, previous methods struggle to preserve performance uniformly across tasks, evident in the temporal action detection results of Wu et al. (2020); Dave al. (2022)): Fioresi et al. (023). Table demonsttates
7

---

Published as a conference paper at ICLR 2026
Table Performance of anonymization methods across a downstream task evaluation suite. Method in gray trains using private attribute labels. Our method achieves a strong improvement in privacy- preservation with minimal reduction in task performance.
Action Recegnition
Action
Temporal Action
Anomaly
Privacy
Anonymization Method
Recognition
Detection
Detection
Network
VISPR
Kin400
UCF101
THUMOS14
UCF Crime
cMAP (
Top-1 (1)
Top-1 (t)
mAP(t)
AUC (f)
Raw Vidcos
63.64
62.67
90.30
25.29
77.68
Downsample-22
55.64
81.78
16.94
76.09
Downsample-4x
52.84
66,21
15.72
68.12
Blurring
58.68
83,90
17.65
75.69
Blackening
13D
56,36
68.62
15.72
73.91
VITA TPAMP20
54.72
75.83
16.10
73.74
SPAct cVPR222
55,60
46.93
75.77
16.20
73,93
TeD-SPAD 10CV/23
52.30
47.20
76.64
17.27
74.81
Ours
J1..7335.59
62.11
90.14.0.2%
24.92|115%
75.69
Raw Videos
70.47
74.86
96,80
60.82
85.79
VideoMAF-B
Ours
49.92.28.999
J4.8%
96.11
60.50.00.5%
85.08
Raw Videos
72.44
77.03
97.67
66.66
85.79
VJEPA-H
Ours
51.42,29.005
76.62.j0.5%
97.54_0.11
66.30..o.49
84.8 1.11%
Table 2: Accuracy and privacy evaluation using video-level private attribute protocols VP- VP-HMDB51 and VP- VP-UCF101 al. (2023b), evaluated as top-1 accuracy and cMAP. Our anonymizer success- fully mitigates temporal private attribute prediction, matching the quality of a latent anonymizer trained with supervised privacy loss Wu et al. (020)).
VP-HMDB51
VP-UCFI01
Anonymization Method
Top-1 Acc.1
cMAP]
Top-1 Acc.1
cMAP
Raw Videos
72.6
76.4
96.8
75.9
Supervised
72.4
70.4
96.5
69.5
Ours
72.1
70.5
96.8
69.6
resistance to temporal private attributes and that performance matches that of version trained with supervised attribute labels. Experiments with large VFMs see similar performance trends, confirm- ing the efficacy and scalability of SPLAVU. Results in Table demonstrate the ability of our method to handle temporal private attribute settings.
5.2 GENDER BIAS EVALUATION
The first row of Table shows the performance difference between each gender presentation subclass in the NTU-Bias-F protocol, where the action brush_hair is chosen as the gendered shortcut action label. The baseline performance disparity between perceived gender subclasses an unacceptably large 9,42%. Applying latent anonymization impressively reduces this gap by a relative 42.3 %. The second includes results for the complementary protocol NTU-BiaS-M (also brush_hair shortcut). Interestingly, the baseline subclass performance disparity is less than that of NTU-Bias- (5.00%), but our method is still capable of reducing this unfair split and improving overall performance.
To confirm that these observations hold true in real-world setting, we look at the final row of Table to see the performance on the TSH Das al. (2019) protocol. Notably, our method improves the both the classifier quality and fairness. In this realistic scenario with naturally occurring bias, SPLAVU reduces the gap between perceived gender subclasses by an astonishing relative 39.5%.
5.3 ABLATIONS AND ANALYSIS
We utilize the VideoMAE-B model for all ablations. Further details can found in Appendix Sec. C
Effect of task-specific training: Our important ablation in Table 5 demonstrates the effects of training anonymizer without specific tasks. Notably, the highlighted cells show impressive gen-
8

---

Published as a conference paper at ICLR 2026
Table 3: Bias evaluation across gendered groups; anonymization reduces subclass accuracy gaps.
P. Female
P. Male Acc. (%)
Overall Acc. (%)
A Subclass Acc. (%)
Dataset
Method
Acc. (%)
Bascline
46.78
56.20
51.49
9.42
NTU-Bias-F
Ours
49.91
55.35
52.63
5.44
Baseline
55.23
50.23
52.78
5.00
NTU-Bias-M
Ours
55.07
51.04
53.06
4.03
Baseline 65.15
70.90
67.02
5.75
TSH
Ours
66.51
69.99
67.64
3.48
Table Performance comparison across video understanding protocols using anonymization mod- els pretrained datasets of varying scale (leftmost column). fA is trained using action recognition as the only utility task. Each row shows the anonymization pretraining dataset, while columns show
downstream evaluation tasks. Learning anonymizer small datasets such HMDB51 main-
tains an impressive privacy-utility tradeoff across tasks compared to raw, non-anonymized data.
Pretraining
VISPR
K400
UCF101
HMDB51
ToyotaSH
UCF-Crime
THUM14
Dataset
cMAP (L)
Top-1 (t)
Top-1 (1)
Top-I (1)
Top-1 (1)
AUC
mAP (t)
Raw Data
70.47
74.86
96.80
72.94
65.05
85.79
60.82
K400
52.57
74.74
96.11
71.51
65.34
83.47
56.45
UCFI01
49.64
74.49
97.01
72.68
62.29
84.14
52.18
HMDB51
54.35
74.55
96.56
73.92
65.82
84.52
56,50
Toyota SH
51.58
74.35
96.09
72.42
67.27
74.92
41,30
cralization to unseen tasks with just minor drop in performance compared to training on them. For example, looking at row (c) shows fA training with only action detection, yet the performance on action recognition and anomaly detection remain within 1.3% of the non-anonymizee score. Across the board, thanks to the latent consistency loss, performance is not dependent on having seen the given utility task during training, proving that SPLAVU can effectively generalize to unseen tasks. See Appendix Table 13 for additional generalization results on the video retrieval task.
Table 6: Ablation training losses. Without latent consistency, the anonymizer overfits to the action recognition task.
Table 5: Ablation on tasks seen during anonymiza- tion training. The checkmark (V) labels seen tasks, x x-mark (X) and highlighted cells indicate tasks unseen during training. Performance generalizes to unseen tasks, while directly training further improves results.
VISPR HMDB51
THUM14
CT La CLe
cMAP (L) Top-1 Acc. (1) MAP (%) (t)
X
x
70.47
74.20
60.82
X
/
45.12
4.71
1.32
Training Tasks
Evaluation Tasks
x
70.44
73.17
60.34
THUM14 UCF-Crime MAP (L) Acc. mAP (5) (1) AUC (%) (t)
VISPR
K400
x
51.70
72.88
AR TAD AD
54.35
73.92
56.50
70.47
74.86
60.82
85.79
Table 7:
Gait recognition experiment on Casia-B, Latent consistency (LC) controls
(b)
X
52.57
74.65
56.45
83.47
(C)
/
X
50.17
73.86
58,80
83.67
recognition of temporal private attributes.
(d)
X
X
49.34
73.51
57.34
84.56
(e)
X
48.74
74.30
58.67
83.88
Method
VISPR
Casia-B
(f)
50.77
74,24
58.83
84.28
Baseline
70.47
69.73
(g)
48.01
73.70
60.41
84.77
Ours (w/ I.C)
54.35
53.45
(b)
49.92
74.23
60.50
85.08
Ours (w/o L.C)
51.70
26.67
Effect of training set scale: To evaluate the scaling of our anonymization method, we perform all downstream tasks while varying the size of training datasets as shown in Table ( We see that SPLAVU demonstrates impressive data-efficiency by generalizing to all downstream tasks, even when training on small-scale datasets like HMDB51.
Temporal sensitive attribute recognition: Table 7 shows the performance of model the
retrieval-bast based gait recognition task with no training. Because gait recognition benefits from under- standing temporal signature, latent consistency does not suppress potentially sensitive temporal

---

Published as a conference paper at ICLR 2026
Table 8: Feature inversion attack results. Our model demonstrates strong robustness black-box attacks, where action performance is recovered but not private attribute prediction. Random chance on each dataset is included to contextualize performance.
VP-HMDB51
VP-UCFI01
Method/Attace
Top-1 1 Acc.t
cMAP
Top-1 Acc.t
cMAP
Raw Videos
72.6
76.4
96.8
75.9
Random Chance
2.0
58.3
1.0
58.7
Ours
72.1
70.5
96.8
69.6
Black-Boo Box Inversion
67.3
58.8
96.8
58.4
White-Bo Box Inversion
68.0
73.7
94.5
72.6
attributes. If task overfitting is not concern, not using latent consistency properly defends against private temporal attribute recognition. Otherwise, temporal sensitive attribute prediction task can be additionally included in the budget privacy loss Wu al. (2020) to maintain generalization.
Framework loss component ablation: Our ablation study examines key training losses of the anonymization process Table 6 Action recognition is the only training utility task evaluate task generalization. Unsurprisingly, omitting the utility loss leads to a considerable drop in model performance. Excluding the privacy budget objective results in no privacy gains over the baseline, emphasizing its necessity. Furthermore, removing latent consistency loss affects unseen task per- formance, whereas seen task (action recognition) performance is maintained. This underscores the importance of the latent consistency loss in ensuring generalization of our anonymization method.
Attack resistance: A major concern of any anonymization framework is the potential for an in- version attack. Table 8 includes results from white and black-box attack settings on VP-HMDB51 and VP-UCFI01 101 Li et al. (2033)). In the black-box setting, the attacker observes input-output pairs of the anonymizer and trains separate inversion model where gradients through fa avail- able. In the white-box setting, the attacker has full access to fa and instead performs seudieentbbsse reconstruction by optimizing synthetic embedding match the observed anonymized output. In both cases, recovered embeddings are evaluated by feeding them into downstream models trained on non-anonymized features measure action accuracy and privacy cMAP. Notably, in the black- box setting, the inversion network successfully recovers action classification performance, yet does improve attribute classification performance above random chance. The model is not robust to white box attacks, which are typically unrealistic in deployment scenarios. Robustness to white-bor box attacks promising avenue for future work. See Appendix See. C and Figure 4 for qualitative analysis reconstruction-basee attacks, where our anonymization prevents faithful video recon- struction.
The latent anonymization framework cannot mitigate a threat that may occur if videos must be transmitted before feature extraction. We leave such cases to complementary techniques like secure transmission, to prior anonymization works if optimal accuracy is not concern. Our formulation currently targets dlobal-embeddee tasks (e.g., action recognition, temporal action de- tection, anomaly detection, retrieval). Extending anonymization to dense tasks such as segmentation or captioning that require patch-wise embeddings is an important direction for future work.
Limitations:
CONCLUSION
We propose an innovative privacy-preserving method via a novel formulation of latent space anonymization called SPLAVU. Our method is the first enable generalized anonymization for unprecedented performance across various downstream video understanding tasks, including ac- tion recognition, anomaly detection, and temporal action detection. It employs clip-level self- supervised privacy budget within the latent space, coupled with a latent consistency loss to maintain its powerful generalization capability. Furthermore, our novel protocols for assessing gender bias contribute to the development of more responsible and unbiased video understanding models.
10

---

Published as a conference paper at ICLR 2026
7 ACKNOWLEDGEMENT
This work was supported in part by the National Science Foundation (NSF) and Center for Smart Streetscapes (CS3) under NSF Cooperative Agreement No. EEC-2133516.
REFERENCES
Shafiq Ahmad, Gianluca Scarpellini, Pietro Morerio, and Alessio Del Bue. Event-driven re-id: A new benchmark and method towards prrecvipres person re-identification, In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pp. 459-468, 2022.
Shafiq Ahmad. Pietro Morerio, and Alessio Del Bue. Person re-identification without identification via event anonymization. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 11132-11141, 2023.
Carlo Alberto Barbano, Enzo Tartaglione, and Marco Grangetto. Bridging the gap between debias- ing and privacy for deep learning. In Proceedings of the IEEE/CVF International Conference Computer Vision, pp. 3806-380111 2021.
Adrien Bardes, Quentin Garrido, Jean Ponce, Michael Rabbat, Yann LeCun, Mahmoud Assran, and Nicolas Ballas. Revisiting feature prediction for learning visual representations from video. arXiv preprint, 2024a.
Adrien Bardes, Quentin Garrido, Jean Ponce, Michael Rabbat, Yann LeCun, Mahmoud Assran, and Nicolas Ballas. Revisiting feature prediction for learning visual representations from video. arXiv:2404.08477 08471, 2024b.
Joy Buolamwini and Timnit Gebru. Gender shades: Intersectional accuracy disparities in commer- cial gender classification. Conference on fairness, accountability and transparency, pp. 77-91. PMLR, 2018.
Joao Carreira and Andrew Zisserman. Quo vadis, action recognition? a new model and the kinetics dataset. In proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 6299-6308, 2017.
Ting Chen, Simon Korbblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In ICML, 2020.
Yingxian Chen, Zhengzhe Liu, Baoheng Zhang, Wilton Fok, Xiaojuan Qi. and Yik-Chung Wu. Mgfn: Magritude-contrastivee glance-and-foeus network for weakly-supervised video anomaly detection. In Proceedings of the AAAI Conference on Artificial Intelligence, pp. 387-395, 2023,
Jinwoo Choi, Chen Gao, Joseph CE Messou, and Jia-Bin Huang. Why can't dance in the mall? learning to mitigate scene bias in action recognition. Advances in Neural Information Processing Systems, 32, 2019.
Dai, Behrouz Saghafi, Jonathan Wu, Janusz Konrad, and Prakash Ishwar. Towards privacy- preserving recognition of human activities. In 2015 IEEE international conference on image processing (ICIP), pp. 4238 4242. IEEE, 2015.
Srijan Das, Rui Dai, Michal Koperski, Luca Minciullo, Lorenzo Garattoni, Francois Bremond, and Gianpiero Francesca. Toyota smarthome: Real-world activities of daily living. In The IEEE International Conference Computer Vision (ICCV), October 2019.
Ishan Dave, Rohit Gupta, Mamshad Nayeem Rizve, and Mubarak Shah. Telr: Temporal contrastive learning for video representation. Computer Vision and Image Understanding, 219:103406,, 2022a.
Ishan Dave, Simon Jenni, and Mubarak Shah. No more shorteuts: Realizing the potential of temporal seff-supervision. In Proceedings of the AAAI Conference Artificial Intelligence, 2024.
11

---

Published as a conference paper at ICLR 2026
Ishan Rajendrakumar Dave, Chen Chen, and Mubarak Shah. Spact: Self- sufe-viperi privacy preser- vation for action recogmition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 20164-20173, 2022b.
Ali Diba, Mohsen Fayyaz, Vivek Sharma, Manohar Paluri, Jürgen Gall, Rainer Stiefelhagen, and Lue Van Gool. Large scale holistic video understanding. In European Conference on Computer Vision, pp. 593-610. Springer, 2020.
Shuangrui Ding, Maomao Li, Tianyu Yang, Rui Qian, Haohang Xu, Qingyi Chen, Jue Wang, and Hongkai Xiong. Motion-aware contrastive video representation learning via foreground- background merging. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pp. 9716-9726, 2022.
Joseph Fioresi, Ishan Rajendrakumar Dave, and Mubarak Shah. Ted-spad: Temporal distinctive- ness for self-supervised crivacy-preservatii for video anomaly detection. In Proceedings of the IEEE/CVF International Conference on Computer Vision pp. 13598-13609, 2023.
Joseph Fioresi, Ishan Rajendrakumar Dave, and Mubarak Shah. Albar: Adversarial learning ap- proach mitigate biases in action recognition. In The Thirteenth International Conference on Learning Representations, 2025.
Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A Wichmann, and Wieland Brendel. Imagenet-trained cnns are biased towards texture; increasing shape bias im- proves accuracy and robustness. arXiv preprint arXiv:1811.123// 2018.
Robert Geirhos, Jörn-Henrik Jacobsen, Claudio Michaelis, Richard Zemel, Wieland Brendel, Matthias Bethge, and Felix A Wichmann. Shortcut learning in deep neural networks. Nature Machine Intelligence, 2(1)):655667) 2020.
Priya Goyal, Piotr Dollár, Ross Girshick, Pieter Noordhuis, Lukasz Wesolowski, Aapo Kyrola, An- drew Tulloch, Yangqing Jia, and Kaiming He. Accurate, large minibatch sgd: Training imagenet in 1 hour. arXiv preprint TtXXvv/776.02677777 2017a.
Raghav Goyal, Samira Ebrahimi Kahou, Vincent Michalski, Joanna Materzyíska, Susanne West- phal, Heuna Kim, Valentin Haenel, Ingo Fruend, Peter Yianilos, Moritz Mueller-Freitag, Florian Hoppe, Christian Thurau, Ingo Bax, and Roland Memisevic. The "something something" video database for learning and evaluating visual common sense, 2017b.
Laura Gustafson, Chloe Rolland, Nikhila Ravi, Quentin Duval, Aaron Adcock, Cheng-Yang Fu, Melissa Hall, and Candace Ross. Facet: Fairness in computer vision evaluation benchmark. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 20370-20382, 2023.
Carlos Hinojosa, Miguel Marquez, Henry Arguello, Ehsan Adeli, Li Fei-Fei, and Juan Carlos Niebles. Privhar: Recognizing human actions from privacy- peeerccypreervingg lens. In European Confer- ence on Computer Vision, pp. 314-332. Springer, 2022.
Simon Jenni and Hailin Jin. Tiue-equivariant contrastive video representation learning. In Proceed- ings of the IEEE/CVF International Conference on Computer Vision, pp. 9970-99909 2021.
Y.-G. Jiang, J. Liu, A. Roshan Zamir, G. Toderici, Laptev, M. Shah, and R. Sukthankar. THUMOS challenge: Action recognition with large number of classes. http://crev. wef..eeee............oo.......ee www.uuufffuuuuoeoooooooo.... THUMOS147/ 2014.
Junho Kim, Young Min Kim, Yicheng Wu, Ramzi Zahreddine, Weston A Welge, Gurunandan Kr- ishnan, Sizhuo Ma, and Jian Wang. Privacy visual localization with event cameras. arXiv preprint 12 2022.
Younggun Kim, Sirnam Swetha, Fazil Kagdi, and Mubarak Shah. Safe-Ilava: A privacy-preserving vision-language dataset and benchmark for biometric safety. arXiv preprint arXiv:2509.00192, 2025.
Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convo- lutional neural networks. Advances in neural information processing systems, 25, 2012.
12

---

Published as a conference paper at ICLR 2026
Hildegard Kuehne, Hueihan Jhuang, Estíbaliz Garrote, Tomaso Poggio, and Thomas Serre. Hmdb: large video database for human motion recognition. In 2011 International conference on computer vision, pp. 2556-2565 IEEE, 2011.
Sudhakar Kumawat and Hajime Nagahara. friacc-preserving action recognition via motion differ- ence quantization. In European Conference Computer Vision, pp. 118-534. Springer, 2022.
Haoxin Li, Yuan Liu, Hanwang Zhang, and Boyang Li. Mitigating and evaluating statie bias of action representations in the background and the foreground. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 19911-19923, 2023a.
Ming Li, Xiangyu Xu, Hehe Fan, Pan Zhou, Jun Liu, Jia- Ret Liu, Jiahe Li, Jussi Keppo, Mike Zheng Shou, and Shuicheng Yan. Stprivacy: Spatio-tempont Proceedings of the IEEE/CVF International Conference Computer Vision, pp. 5106-5115, 2023b.
action recognition. In
Jixin Liu and Leilei Zhang. Indoor privacy-preserving action recognition via partially coupled con- volutional neural network. In 2020 International Conference on Artificial Intelligence and Com- puter Engineering (ICAICE), pp. 295. IEEE, 2020.
Ily Loshchilov and Frank Hutter. Decoupled weight decay regularization. arXiv preprint arXiv: 1000 2017.
Zelun Luo, Jun- Linn Hsich, Niranjan Balachandar, Serena Yeung, Guido Pusiol, Jay Luxenberg, Grace Li, Li-Jia Li, N Lance Downing, Arnold Milstein, et al. Computer vision-based descrip- tive analytics of seniors' daily activities for long-term health monitoring. Machine Learning for Healthcare (MLHC), 2(1), 2018.
Vishal Narnaware, Ashmal Vayani, Rohit Gupta, Sirnam Swetha, and Mubarak Shah. Sb-bench: Stereotype bias benchmark for large multimodal models. arXiv preprint 2rXiv:2502.08779, 2025.
Tribhuvanesh Orekondy, Bernt Schicle, and Mario Fritz. Towards a visual privacy advisor: Un- derstanding and predicting privacy risks in images. In Proceedings of the IEEE international conference on computer vision, pp. 3686-3695, 2017.
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high- performance deep learning library. Advances in neural information processing systems, 32, 2019.
Duo Peng, Li Xu, Qiuhong Ke, Ping Hu, and Jun Liu. Joint attribute and model generalization learning for privacy-preserving preserving action recognition. Advances in Neural Information Processing Systems, 36, 2024.
Vinay Uday Prabhu and Abeba Birhane. Large datasets: A pyrrhic win for computer vision. arXiv preprint arXiv:2006. 1020006669993. 16923, 3, 2020.
Zhongzheng Ren, Yong Jae Lee, and Michael S Ryoo. Learning to anonymize faces for privacy pre- serving action detection. In Proceedings of the european conference on computer vision (ECCV), pp. 620-636, 2018.
Hamid Rezatofighi, Nathan Tsoi, Young Gwak, Amir Sadeghian, Ian Reid, and Silvio Savarese. Generalized intersection over union: A metric and loss for bounding box regression. In Pro- ceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 658-6666 2019.
Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomed- ical image segmentation. In Medical Image Computing and Conputer-Assisted Intervention- MICCAI 2015: 18th International Conference, Munich, Germany, October 5-9, 2015, Proceed- ings, Part III 18, pp. 234-241. Springer, 2015.
T-YLPG Ross and GKHP Dollár. Focal loss for dense object detection. In proceedings of the IEEE conference on computer vision and pattern recognition, pp. 2988, 2017.
13

---

Published as a conference paper at ICLR 2026
Michael Ryoo, Brandon Rothrock, Charles Fleming, and Hyun Jong Yang. srivac-prreeevvngg hu- man activity recognition from extreme low resolution. In Proceedings of the AAAl conference on artificial intelligence, 2017.
Shiori Sagawa, Pang Wei Koh, Tatsunori Hashimoto, and Percy Liang. Distributionally robust neural networks for group shifts: On the importance of regularization for worst-case generaliza- tion. arXiv preprint arXiv: /91 1.08731, 2019.
Amir Shahroudy, Jun Liu, Tian-Tsone Ng, and Gang Wang- Ntu rgb+ d: A large scale dataset for 3d human activity analysis. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1010-1019, 2016.
Dingfeng Shi, Yujie Zhong, Qiong Cao, Lin Ma, Jia Li, and Dacheng Tao. Tridet: Temporal ac- tion detection with relative boundary modeling. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 18857-18866, 2023.
Abhishek Singh, Ethan Garza, Ayush Chopra, Praneeth Vepakomma, Vivek Sharma, and Ramesh Raskar. Decouple-and-sampee Protecting sensitive information task agnostic data release. In European Conference Computer Vision, pp. 499-517. Springer, 2022.
Swetha Sirnam, Rui Meng. Shwetha Ram, Tal Neiman, Son Tran, and Mubarak Shah. Smpro: Self-supervised visual preference aligmment via differentiable multi-preference multi-group rank- ing. February 2026. doi: 6tt6:2777eeaarr1.777777996666660
UtLpttpp: //dx. doi.
60964167/v1
Khurram Soomro, Amir Roshan Zamir, and Mubarak Shah. Ucf101: dataset 101 human actions classes from videos in the wild. arXiv preprint arXiv: /212.040 2012.
Ryan Steed and Aylin Caliskan. Image representations learned with unsupervised pre-training con- tain human-like biases. In Proceedings of the 2021 ACM conference on fairness, accountability. and transparency, pp. 701-713, 2021.
Pierre Stock and Moustapha Cisse. Convnets and imagenet beyond accuracy: Explanations, bias detection, adversarial examples and model criticism. arXiv preprint 1rxiv:1711.11443, 2017.
Waqas Sultani, Chen Chen, and Mubarak Shah. Real-world anomaly detection in surveillance videos. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp- 6479-6488, 2018
Sirnam Swetha, Hilde Kuchne, Yogesh S Rawat, and Mubarak Shah. Unsupervised discriminative embedding for sub-action learning in complex activities. In 2021 IEEE International Conference on Image Processing (ICIP), pp. 1588-2552, 2021. doi: 10.
Simam Swetha, Mamshad Nayeem Rizve, Nina Shvetsova, Hilde Kuehne, and Mubarak Shah. Pre- serving modality structure improves modal learning. Proceedings of the IEEE/CVF In- ternational Conference Computer Vision (ICCV), pp. 22993, October 2023.
Sirnam Swetha, Rohit Gupta, Parth Parag Kulkarni, David G Shatwell, Jeffrey A Chan Santiago, Nyle Siddiqui. Joseph Fioresi, and Mubarak Shah. Implicitga: Going beyond frames towards implicit video reasoning. arXiv preprint arXiv:2506.2174. 2025.
Fida Mohammad Thoker, Hazel Doughty, and Cees GM Snoek. Tubelet-contrastive self- self-supervision for video-efficient generalization. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 13812-13822 2023.
Schrasing Tong and Lalana Kagal. Investigating bias in image classification using model explana- tions. arXiv preprint arXiv:2012.05400 2020.
Limin Wang, Bingkun Huang, Zhiyu Zhao, Zhan Tong, Yinan He, Yi Wang, Yali Wang, and Yu Qiao. Videomae v2: Scaling video masked autoencoders with dual masking, In Proceedings of the JEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 14549-14560, 2023.
14

---

Published as a conference paper at ICLR 2026
Yi Wang, Kunchang Li, Yizhuo Li, Yinan He, Bingkun Huang, Zhiyu Zhao, Hongjie Zhang, Jilan Xu, Yi Liu, Zun Wang, et al. Internvideo: General video foundation models via generative and discriminative learning. arXiv preprint 2:X1::2212.03111, 2022
Benjamin Wilson, Judy Hoffman, and Jamie Morgenstern. Predictive inequity in object detection.
arXiv preprint 1rxxiv:900.,0. 1097, 2019.
Zhenyu Wu, Haotao Wang, Zhaowen Wang, Hailin Jin, and Zhangyang Wang. Privacy-preserving deep action recognition: An adversarial learning framework and new dataset. IEEE Transactions on Pattern Analysis and Machine Intelligence, 44(4):2126- 2020.
Adeel Yousaf, Joseph Fioresi, James Beetham, Amrit Singh Bedi, and Mubarak Shah. Safer- clip: Mitigating nsfw content in vision-language models while preserving pre-trained knowledge, 2025.
Da Yu. Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, Sergey Yekhanin, and Huishuai Zhang. Differentially private fine-tuning of language models. In International Conference on Learning Representations, 2022.
Shiqi Yu, Daoliang Tan, and Tieniu Tan. A framework for evaluating the effect of view angle, clothing and carrying condition on gait recognition. 18th international conference on pattern recognition (ICPR '06), volume 4, pp. 441-444. IEEE, 2006.
Zhixiang Zhang, Thomas Cilloni, Charles Walter, and Charles Fleming. Multi-scale, class-generic, privacy-presevvnng video. Electronics, 10(10):112) 2021.
Hang Zhao, Antonio Torralba, Lorenzo Torresani, and Zhicheng Yan. Hacs: Human action clips and segments dataset for recognition and temporal localization. Proceedings of the IEFE International Conference Computer Vision, pp.
2019.
Haodong Zhao, Wei Du, Fangqi Li, Peixuan Li, and Gongshen Liu. Fedprompt: Communication- efficient and privacy-ppeee preserving prompt tuning in federated learning. In ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 1-5. IEEE, 2023.
Jieyu Zhao, Tianlu Wang, Mark Yatskar, Vicente Ordonez, and Kai- Wei Chang. Men also like shopping: Reducing gender bias amplification using corpus-level constraints. arXiv preprint 1707009777 2017.
Yuliang Zou, Jinwoo Choi, Qitong Wang, and Jia-Bin Huang. Learning representational invariances for data-efficient action recognition. Computer Vision and Image Understanding. 227:103597, 2023.
15

---

Published as a conference paper at ICLR 2026
SUPPLEMENTARY OVERVIEW
Appendix Dataset details
Appendix
Implementation details
Appendix
Additional experiment details
Appendix D Training algorithm
A DATASET DETAILS
Kinetics400 Carreira & Zisserman (2117) is a large-scale video action dataset of YouTube videos which includes 400 human action classes with least 400 video clips for each action. Each clip lasts around 10 seconds and is labeled with a single action class. The dataset is widely used for pretraining deep learning models for use many video understanding tasks.
UCF101 Soomro et al. (0122) is an action recognition dataset of realistic action videos consisting of 101 action categories. With over 13,000 videos from various actions and scenes, it provides diverse set of actions and a broad range of variability in terms of actions, viewpoints, appearances,
and backgrounds.
HMDB51 Kuehne et al. 2011 is a collection of 6,766 video clips distributed across 51 human action categories, each containing minimum of 101 clips. The dataset includes wide range of human actions and is designed for the development and evaluation of action recognition methods.
NTU RGB+D 60 [Shhhroudy et al. (2016) is a large-scale multi view human action recognition dataset complete with RGB video, depth maps, and skeleton joints, and IR sequences. This work only uses the RGB frames. Each the 40 subjects are recorded completing 60 daily activities from 3 different cameras.
Toyota Smarthome Das et al. (2019) is a challenging roal-world activity classification dataset cap- tured from 7 independent Kinect v1 cameras. The clips recorded 18 senior subjects performing 31 daily activities in a natural manner. This work only uses the provided RGB frames. The dataset contains high class imbalance, intra-class variation, and duration variance.
THUMOS14 Jiang et al. (2014) focuses on temporal action localization in untrimmed videos. extends the UCF101 dataset with temporal annotations for subset of the action classes, providing detailed temporal annotations for 20 action classes across 200 validation videos and 213 test videos.
UCF-Crime (Sultani et al. (018 is large-scale dataset of surveillance videos designed for anomaly detection. It consists of 1,900 long and untrimmed vidcos for total of 128 hours. The videos contain examples of 13 different real-world anomalies, including burglary, robbery, and fight- ing, among others, making it suitable for training and evaluating video anomaly detection models.
VISPR Orekondy al. (2017) consists of around 22,000 Flickr images annotated with 68 privacy- related attributes such as gender, age group. skin color, and more. It offers multi-class classification protocol for assessing private attribute prediction. Table g shows the VISPR attribute split used,
which we have adopted from Wu et al. (2020): Dave et al. (202b): Fioresi et al. (2023).
Casia-B Yu al. (2066) a gait recognition dataset consisting of 13,640 video clips of 124 sub- jects. We utilize it to evaluate the effect of anonymization on a temporal-basse
sensitive attribute, namely gait. Evaluation is through top-1 retrieval of a gallery video with the same subject. The full dataset is used for evaluation, with the first 4 repetitions of each walk in the gallery and the last 2 per subject used as the probe.
Li al. 2023b) are versions of the base HMDB51 Kuchne et al. (2011) and UCF101 Soomro et al. (012)) datasets annotated with five clip-based visual private attribute labels, following the VISPR label setting.
"P-HMDBSI/P--CK
Proposed NTU Bias Evaluation Details More formal details for the creation of the proposed per- ceived gender NTU bias protocol are described here. While the original dataset is balanced in terms of scene and actor, the distribution of actor/video counts are not balanced with respect to perceived gender. To properly evaluate bias mitigation, it is essential ensure that there are performance
16

---

Published as a conference paper at ICLR 2026
Table
Privacy attributes from subset of VISPR Orekondy et al. (2017) labels as used in previous
works.
VISPRI
Wu al. (2020);
Dave et al.
(2022b); Fioresi et (2023)
Label
Description
a17 color
skin color
a4.gender
gender
a9 a9.face.compler
full face visible
a10 face partial
part of face visible
a12.semi.nudity a64 a64_rel.persona
partial nudity
shows personal relationship shows social relationship
a65_rel.soci
differences stemming from the larger number of male subjects and training videos. The subject IDs are used to first restructure the dataset an effort to maximize fairness across the gender sub- groups. As such, within themselves, the train and test sets should contain both an even number of male and female subjects AND an even number of videos per action. Formally, let's take the Ns set of subjects S = { where Ns is the number of subjects in the dataset. For each sub- ject s; S, there is an associated gender label g(s;) where g(s;) E {male, female). We set Nm .Ny Naa where Nm and N are the number of male and female subjects, respectively. Us- ing the above notation with I abbreviated to D, we define D, = { (x;, V..gi) g:) E Dig, = male) and D, ((,,, Bi) Dig: f Semale]. We set Dml |Dy| Inl. With the dataset balanced across subject counts, subject genders, video count per action/ /ignionn//eerr,,,./e and background representa- tion, the model should not have access to simple bias shortcuts.
To directly measure gender presentation bias, we inject an artificial bias related to perceived gender by creating simple spurious shortcut for the model follow. Specifically, we control the subclass ratios across all actions, setting ((g(s) = male yy 0.95 and P(g(s) = femalely) = 0.05, following the correlation strength in Sagawa al. (201)). However, for one action chosen at random, we flip this ratio, keeping 95% of perceived female videos (P(g(s) [ /emalely)
0.95) and only 5% of perceived male videos (P(g(s) = malely) = 0.05). We refer to this subset as NTU-Bias- repeat this protocol by
F. To ensure that the shorteut taking is gender presentation agnostic, swapping the subclasses, creating NTU-Bias-M. We find that swapping this subclass ratio for one action class reduces overall performance and causes gap in subclass performance.
B IMPLEMENTATION DETAILS
All of our code is implemented in PyTorch Paszke et al. (2019). In this section, we clarify notation and provide implementation details regarding network architecture, input preprocessing, hyperpa- rameters, and training schedules.
B.1 CLARIFYING GLOBAL EMBEDDING NOTATION
In the main paper, duced by the frozen video encoder fg. In standard practice, transformer based video encoders (e.g.. VideoMAE, ViViT) produce sequence of tokens prepended by a special [CLS] token: fr((,) [bLLS; hº: ... h, where hŞLS is the global classification token and hi.... ha de- note patchwise spatio-temporal tokens. In CNN-based video encoders (e.g., I3D, R3D), the encoder processes the input clip through hierarchy of spatiotemporal convolutional blocks, producing feature tensor fæ(x,) F, E I xH' xC" which is then aggregated into global clip-level representation via spatiotemporal average pooling: h, h.m AvgPool(F.) RCC. This pooled fea- ture hooo serves as the analog to the [CLS] token in transformer based encoders. Because our anonymizer operates on the unified notion of single clip-level representation, either the [CLS] token or the globally pooled CNN feature, we simplify notation by writing fx;(), to refer to this global embedding regardless of encoder type.
the notation h, = (x; denote the global clip-level embedding pro-
17

---

Published as a conference paper at ICLR 2026
B.2 NETWORK ARCHITECTURE
Each video encoder fE model is left unchanged from the original implementation. The fTAn clas- sifier head is a simple linear layer Linear (d, N), where d is the feature vector dimension of fE and N is the number of classes in An- In the temporal action detection and anomaly detec- tion task, classifier implementations are unmodified from the original TriDet Shi et al. (2023) and MGFN Chen et al. (2023) works, respectively. For the private attribute prediction task, 2-layer MLP is used: Linear (d, d) + Linear (d, 7) with a ReLU activation after the first layer. For the fa AAM, we ablate different architecture styles (see Table TOP. To break down, we tried standard MLPs of different depths and self- based adapters of different depths. Each MLP layer is composed of Linear (d, d) followed by ReLU activation and a BatchNorm layer, and dropout with probability of 0. during training- The self-attention layers are standard Multi- headAttention blocks with dim d and heads by default, with the head count ablated Table T2
B.3 INPUTS AND AUGMENTATIONS
All imputs consist of 16 frame clips sampled with consecutive frames, resized to spatial resolution of 224 x 224. For training, only random resized crop and random horizontal flip with probability 50% are utilized. In validation, the short edge resized 256, then a center crop of 224 x 224 is taken. Standard ImageNet Krizhevsky et al. (2012) mean and standard deviation based normalization is applicd in both settings. The input and augmentation protocol is consistent for every fE.
B.4 TRAINING DETAILS AND HYPERPARAMETERS
Each AAM variation is trained using an é loss to reconstruct the input features for 100 epochs with the AdamW Loshchilov & Hutter (2017) optimizer and learning rate of 2e-5. Kinetics400 Carreiral & Zisserman (2017) features are used as the train-test set. Privacy evaluation is carried out using supervised training of the predictor MLP for 100 epochs at learning rate of 1c-3. A learning rate scheduler is based on the loss plateau where it decreases the learning rate to 1/5th.
For anonymization training, the base learning is le-4 for both fA and fr-, corresponding size of 512, scaled when necessary according to the linear scaling rule [Goyal et al. (2017a). By default, wLC 100, wt 1, and wB (Main Equation 7 The anonymization training carried out for 100 epochs.
batch
B.5 ADDITIONAL COLLABORATIVE TASK LOSSES
Here we further define the integrated task losses LTAD and LAD referenced in Main Paper Sec- tion 2.
Temporal Action Detection Loss LTAD (TriDet Shi et al. 2023
The overall TriDet loss function combines classification and regression components and is defined as:
LTAD
Σ 1,1
144000 (arati Lets + Loreg) +
ppns
(8)
Σ 1l 10 I.
N
where Npos and Nneg are the numbers of positive and negative samples, respectively; 1ef an indicator function that equals if of > (positive sample) and otherwise; do is the temporal Intersection over Union (IoU) between the predicted segment and the ground truth, serving as a weighting factor; Cets is the classification loss, implemented as the focal loss Ross & Dollar (217)); and Lreg is the regression loss, implemented the IoU loss Rezatofighi et al. (2019). The weighting factor rou emphasizes predictions with higher temporal loU, ensuring that higher- quality predictions contribute more significantly during training. Positive samples are determined
18

---

Published as a conference paper at ICLR 2026
using center sampling, where instants near the center of an action instance labeled positive, and others are considered negative.
Anomaly Detection Loss CAD (MGFN Chen et al. (2023));
The full MGEN loss function is defined as:
CAD = Lece + M + X2Cep + X3Cme:
(9)
where )2 and 03 0.001. The base loss Lace is the standard sigmoid cross-entropy loss:
S y log(s"*) - (1 y) y) log(lg1111 8²)),
(10)
with y as the video-level label (y for anomaly, y for normal) and s²D as the computed anomaly score for frame i in segment j. Following Sultani et al. (2018), it incorporate a temporal smoothness term Lts and sparsity term Capi
Lis -
(11)
1=1
Lup Σ S(V.).
(12)
where ((V)) represents the extracted features for segment of an anomalous video V.- These terms encourage smooth transitions between sequential segments and promote sparsity in detections.
MGFN introduces a feature amplification mechanism and a magnitude contrastive loss Lm to en- hance feature separability within and between videos, formulated as:
B/2 (D-M) Mg)
Lm Σ (1
Σ
11-D
P.q=0
u,v=B/2
(13)
B/2 B
(M MW) +
Σ l(Margin DDagggn-DMMM... M)),,
p=0
where B is the batch size, M denotes the feature magnitude of the corresponding segment, I is indicator function, and ((..) is distance function. Refer to Chen et al. (2023) for more details.
C ADDITIONAL EXPERIMENTS
Different Architectures for Anonymizing Adapter Module (AAM): Our ablation study evaluates different AAM architectures Table TO with the baseline showing standard performance without anonymization. The multi-layer perception (MLP) adapter demonstrates moderate privacy enhance- ment, particularly with increased capacity, while nearly maintaining utility performance. However, the self-attention-basee module is superior across the board, finely balancing privacy and utility, making it our Anonymizing Adapter Module of choice. The difference between the encoder having 3 and 5 layers is negligible, as performance appears to plateau with the larger capacity. As such, for more efficient compute without sacrificing performance, we adopt the 3 encoder layer self-attention AAM for the majority of experiments. Self-attention's 's efficacy likely due to its ability to prioritize crucial features for anonymization, refining the privacy preservation process.
Relative weightage latent consistency objective: To further investigate the importance of latent consistency loss, we consider varying weights w.r.t. the overall training objective in Table [1] Since we want to ensure generalization across unseen tasks, action recognition is the only training utility task in this experiment. We found more solid support that with increasing the weightage of the latent consistency loss, performance maintains on the action-related utility, however, it significantly increases performance the unseen anomaly detection task.
19

---

Published as a conference paper at ICLR 2026
Table 10: Ablation for different AAM architectures. Self-attention beats out standard MLPs.
Anonymizer
VISPR
K400
UCF Cr.
THUM14
Architecture
cMAP (4)
Acc. (1)
AUC (1)
mAP (T)
None
70.47
74.86
85.79
60.82
MLP (1 layer)
67.51
73.39
82.13
59,42
MLP layers)
62.92
64.84
79.63
54.60
MLP (5 layers)
61.92
70.03
83.47
57.34
Self-Attn (1 layer)
50.59
72.57
82.12
58.17
Self-Attn (3 layers)
49.92
74.23
84.33
60.50
Self-Attn (5 layers)
48.56
74.08
83.54
57.46
Table 11: Ablation for weight of LLC.
VISPR
HMDB51
UCF Crime
WLC
cMAP
Topl Acc. (1)
AUC (%) (t)
0
51.7
72.88
65.62
48.96
73.27
72.19
10
52.5
73.4
72.58
100
54.35
73.92
84.52
1000
59.2
73.33
83.57
Ablation with Attention head counts in AAM: We show here in Table 12] the effect of changing the number of heads in the MHSA layer of our transformer based AAM. The performance for each variation was very similar, with the middle heads beating out the other variations, providing solid tradeoff for compute and performance. Our default experiment setup utilizes 8 MHSA heads.
Table 12: Ablation with different number MHSA Heads.
Num MHSA
VISPR
HMDB51
UCF Crime
Heads
cMAP (L)
Top1 Ace. (t)
AUC (%) (f)
54.78
73.79
83.73
8
54.35
73.92
84.52
16
56.74
73.73
83.99
Figure follows Singh al. (2022) to plot privacy-utility curve (NHV=0.6833) using PA-HMDB test set. Varying task weights leads to controllable trade-off curve.
80
Utiliyy (AR Top-1 Acc. %
60
40
SPLAVU (lly veried)
20
Baseline (Raw Features) Oracle
56
58
60
62
64
66
68
70
Privacy Leakage (Attacker cMAP 4
Figure 3: Privacy-utility trade-off on PA-HMDB51. Privacy measured by attacker cMAP (L), utility by AR acc. (t). Different points show varied privacy/utility weights wr, SPLAVU achieves favorable trade-off.
20

---

Published as a conference paper at ICLR 2026
Original
Video
(a) Full-Patch Reconstruction
(b) Ours:
Anonymized
Full-Patch
Reconstruction
(c) CLS Token Reconstruction
(d) Ours: Anonymized
CLS Token Reconstruction
Figure 4: Qualitative reconstruction analysis using the VideoMAE decoder. We evaluate four input configurations: (a) reconstruction from non-anonymized full patch tokens, (b) reconstruction from patch tokens after applying our fA. (c) reconstruction using repeated CLS tokens, and (d) recon- struction using anonymized CLSS tokens. As shown, meaningful spatial structure is recoverable only when full patch tokens are provided; anonymized patches and CLS-only variants fail to reconstruct identifiable content.
21

---

Published as a conference paper at ICLR 2026
Table 13: UCFI01 retrieval results (query: test set, gallery: train set). Evaluation uses Recall
@5 Recall @ 10, and mAP. Our anonymizer faithfully maintains retrieval performance.
Method
R@1
R@5
R@ 10
mAP
Baseline (Raw Videos)
95.3
97.6
98.7
84.9
Ours
94.9
97.6
98.6
84.7
UCF101 retrieval performance using anonymizer trained solely on Kinetics400, demonstrating cross-dataset and cross-tase tasss-taskkn generalization without any retrieval- specific supervision.
Video Retrieval: Table [ [3
Reconstruction Attack Mitigation: Figure illustrates our reconstruction test protocol, designed to evaluate whether approach mitigates reconstruction-bbssed attacks and if CLS embeddings contain sufficient information for pixel-space recovery. Using the official VideoMAE decoder, we compare four conditions: (a) reconstruction from the full set of patch tokens, which recovers the scene faithfully; (b) reconstruction after applying our fA to the patchwise tokens, which severely disrupts spatial content; (c) reconstruction when the decoder is retrained to operate on a repeated CLS token, which produces only faded scenes; and (d) reconstruction from our anonymized CLS embeddings, which similarly fails to yield meaningful structure. Each setting finetunes the decoder for 10 epochs on the UCF101 training set, ensuring fair comparison. Impressively, despite being trained to remove private attributes from CLS tokens, our method prevents reconstruction attacks from recovering the original video, even when provided patch-level tokens. We also confirm that CLS features lack the spatial detail necessary for reconstructing privacy-revealing video content.
C.I COMPARISON WITH OTHER PRIOR METHOSS
Previous work Wu et al. 2020): Dave al. (202bb) Fioresi al. (2023) has already shown that the learnable anonymization techniques outperform methods such as downsampling, blurring, and blackening. Main Table [ shows a comparison these techniques using the I3D Carreira Zisser- man (2017) model. In Downsample-25 and Downsample-4x, the input frames have their resolution reduced by factor of (112 112) and (56 56). In Blackening and Blurring, subjects are detected using an object detector to detect human subjects and obfuscated using the same methods as described in Wu al. 22200) Dave al. (20226); (ioresi et al. (2023). We see that none of these techniques achieve an acceptable level of anonymization, and almost all reduce utility more than our SPLAVU method, further demonstrating the capability of our framework.
Table 14 shows the results of our proposed method on PA-HMDB Wu et al. 2020 compared to the
bascline model on raw data.
Table 14: PA-HMDB51 results, using VideoMAE as fE-
Privacy cMAP (L)
Action
Method
Top-I Ace (t)
Baseline (Raw Videos)
69.9
80.19
Ours
62.6
84.47
C.2 ADDITIONAL EXPERIMENTS WITH LARGE FOUNDATION MODELS
Due to the low compute cost and focus on maintaining the capabilities of powerful models, our SPLAVU framework is able to scale up to the largest video foundational models currently available. Table 15 demonstrates the high privacy-utility tradeoff achieved by our method using InternVideo- Wang et al. 2002). and Main Paper Table | shows results using VideoMAEv2-G |Wang et al. 2023). In these experiments, action recognition performance
exactly maintained, and private attribute prediction was dropped more than for the smaller models, with only a modest reduction in temporal action detection performance.
22

---

Published as a conference paper at ICLR 2026
Table 15: Performance when scaling SPLAVU up larger models.
Anonymization
VISPR
HMDB51
UCF101
THUMOS14
Model
Method
cMAP (U)
Top I Acc. (1) Top I Acc. (1) mAP (%) (1)
Baseline
74.62
79.48
98.84
62.45
Ours-HMDBSI
InternVideo-H
54.74
79.87
56.35
Ours-UCFI01
50.29
99.21
53.28
Baseline
75.69
81.05
97.81
70.09
Ours-HMDBSI
VideoMABv2-G
53.39
80.85
65.21
Ours-UCF101
51.10
97.91
62.69
Combined Performance Over Time
10
SPAct
TeD-SPAD
Overall Score
Ours
3
5000
23603
15:00
20040
25000
Time
Figure 5: Graph showcasing the overall runtime and accuracy privacy-preserving methods. The x-axis shows time in seconds and the y-axis has an overall score for accuracy/privacy computed in Equation 14
C.2.1 TRAINING COMPUTE
One of the many benefits of our SPLAVU framework is its very low compute/training cost. Table 16 shows the overall count trainable parameters for previous frameworks compared to our AAM. For VideoMAE-Basee
SPLAVU framework with the self-attention AAM has 88.7% less trainable parameters when compared to existing approaches. This difference is even greater when scaling to larger models. Training less parameters reduce the tendency overfit on the proxy task and al- low for learning an effective anonymization on limited training data (see Main Paper Table Also, in federated learning, these parameters are communicated between the server and clients, so the reduced learnable parameters are useful in efficient and
federated learning Zhao
al. (203)): Yu al. (2022).
Table Trainable parameters for each framework/model..
Method
Model
Trainable Params (M)
SPACtD
55.2
I3D
SPLAVU
25.6
SPAct/T.D-SPAD
129.4
VideoMAE-B
SPLAVU
14.6
SPAct/TeD-SPAD
694.2
V-JEPA
SPLAVU
39.8
SPAct/T:D-SPAD
675.0
InterVideo-.A
SPLAVU
39.8
SPAct/TeD-SPAD
1055.5
VideoMAEx2-G
SPLAVU
48.0
23

---

Published as a conference paper at ICLR 2026
Table 17: Results comparison between AAM trained on HMDB51 using imput videos precom- puted features. Experiment was done using VideoMAE-B model.
Training Data
PAP
AR
TAD
AD T14 UCF-CH -r.
Training Time (min)
VISPR
HMDB51
Raw Videos
50.59
75.10
58.15
82.71 84.52
185.3
Precom. Feats
54.35
73.92
56.50
4.0+1.4
The efficiency of our method is further demonstrated using Figure 5 In this instance, our method did not make use of precomputed features, yet it still completed ==3.5x faster than the next fastest method. The combined accuracy/privacy metric is simply defined as follows:
(14) where t is the current time, Yt is the performance score, and acc; and priv, are the top-1 accuracy scores and privacy prediction score using the current fa model, respectively. Privacy inverted as lower private attribute prediction score is considered better. Each method was trained for 50 epochs using the same hyperparameters. The SPLAVU latent anonymization framework achieves a higher, more stable performance only fraction of the runtime when compared input-based methods.
(ace; + - prive)) 0.5,
C.2.2 PRECOMPUTING FEATURE EMBEDDINGS
Since we are using completely frozen video encoder model fg. the latent feature embeddings can be precomputed for much faster training process. In this case, only validation augmentations are used, and each video clip is only ran through the model forward pass once. There is flexibility in clip choice and skip rate. this work, we opt for simple skip rate of (consecutive frames), and take all non-overlapping sequential clips for each video. The computed embeddings are saved for each video, and random clip is sampled during training time. The same evenly-spaced 5 video clips are used for validation. Table 17 shows comparison between using the raw videos and precomputed features. Due to the use of weak augmentations
the raw videos, we see an improvement over using the precomputed. However, using the precomputed features only requires single forward pass over the dataset, which takes 4 minutes (HMDB51), then only 1.4 minutes for training.
D TRAINING ALGORITHM
Algorithm formalizes the SPLAVU workflow notation. We consider anonymizer fa and task heads STAR STTAD: and STAD for the anonymization training and SAR. JTAD. and Sweed for down- stream tasks. In order, these models are parameterized by 0A, OTAR: ÓTTAD. @TADI 0AR, OTAD, and Owsed- AR. AD. and wosdd are all used in the proxy anonymization process, then also for the downstream task evaluation. The downstream ID Ar may be the same or different from during the anonymization process.
24

---

Published as a conference paper at ICLR 2026
Algorithm 1: SPLAVU Framework
Anonymization Training
Inputs:
Datasets: DAR AD. Dusad # of Epochs: anon sepochs
Learning Rates: a OAR, OTAD. QAD
Hyperparaneters: WA, WT, WLO, WAR: WTAD. WAD
Output: Ag OTARI ÓTTAD OTAP
Model Initialization:
Initialize Ls with Kinetics400 weights Carreira Zisserman (0017)
Initialize A A a Ve, (BA)
11 Multitask Anonymization Training:
12 for Eo < 1 to anon-epochs do
0A + 0 a Vo, (WLCLcc(OA) + WT CT. (0A, OTaR: OTrAD: (TAD) - wBLB(0A)) OTAR OTAR a V VORA (CaR(OrAR: Oa)).
13
OTTAD + OTTAD OTAD ATAAD (CTAD(OTrAD:0A)) 0A)),
OTAD t 0TAD AAD Ver (CAD (OTAD: AA)),
14 end
15 Downstream Tasks Evaluation
Inputs:
17 Datasets: DAR. DAD, DTAD
# of Epochs: reco -ecoces, anomaly-cpone tad epochs
19 Learning Rates: OAR, Owwadd OTAD
20 Output: OAR, Omsadd OTAD
Privacy-PPres Preserved Action Recognition Training:
22 for Eo <- to reco epochs do
OAR AA VAR (C (OA,
23
24 end
Feature Extraction DAD:
26 AD = (ff(ff( (x (X())) 4X DAD]
Anomaly Detection (WSAD) Training:
28 for Eg f- 1 to anomaly epochs do
Owsad wwsad awsad V Ownnd (Iresad (Owsad FAD))
30 end
31 Feature Extraction on DTAD:
32 ETAD = (A((f((())) (X(() e BTAD]
33 Privacy-Preservee
Temporal Action Detection (TAD) Training:
34 for Eo f- 1 to tad_epol tad-ss do
38 fTAD fRAD aTAD VorAn (FTAD(Or FAD))
36 end
25


Reviews:
[{"review_id": "vlJaUYLty4", "reviewer": "Reviewer_SgKC", "summary": "This manuscript introduces SPLAVU, a latent-space anonymization framework that leaves the video encoder frozen and inserts a lightweight Anonymizing Adapter Module (AAM) to strip private attributes from clip features while preserving utility across tasks. The training couples (1) a clip-level, self-supervised privacy objective that maximizes NT-Xent on static clips to reduce shared spatial information, (2) co-training utility losses for action recognition, temporal action detection, and anomaly detection, and (3) a latent consistency loss to retain the encoder’s generalization on unseen tasks.\nEvaluation measures privacy via VISPR cMAP with a linear attacker on static-clip representations and probes temporal sensitive attributes through Casia-B gait retrieval, while utility is tested on Kinetics-400, UCF101, HMDB51 (AR), THUMOS14 (TAD), and UCF-Crime (WSAD); the paper also proposes gender-bias protocols on NTU-Bias and Toyota Smarthome. Across backbones and tasks, SPLAVU reports 35% lower privacy leakage with ≤1–2% utility drop, and the self-attention AAM outperforms MLP adapters in privacy utility balance; in bias evaluations, it narrows gender-subclass gaps on Toyota Smarthome.", "questions": "Equation (7) shows a notation inconsistency: the objective uses $\\omega_{LC}$, $\\omega_{T}$, $\\omega_{B}$, but the prose immediately refers to $\\omega_{R}$ instead of $\\omega_{LC}$.\n\nUnify the symbol for the latent consistency weight across the manuscript (see lines 340--357).\n\nIn Equation (5) and its explanation, the text first suggests that minimizing increases similarity, but later states that the privacy loss is maximized; this back-and-forth can confuse readers.\n\nPlease clarify explicitly that the privacy term is maximized via the negative sign in (7), i.e., the total objective is minimized with $-\\omega_{B} L_{B}$ (see lines 286--305 and 340--357).\n\n\nIn Criterion-1 (Equation 1), there is an extra argument “, $T_n$” inside $L_{T_n}(\\cdot, T_n)$ on both sides of the approximate equality; this looks like a notation carryover.\n\nClean up the loss signature to avoid ambiguity (see lines 200--215).\n\nIn Appendix B.1 (Architecture), there is a typo: “Mulit-headAttention” should read “Multi-Head Attention.” Fix the spelling of the multi-head attention block (see lines 788--809).\n\nIn Section 5.2 (Bias), “complimentary protocol” should be “complementary protocol.” Adjust the term to the standard usage (see lines 386--399).\n\nIn Appendix A (NTU Bias protocol), “lets” should be “let’s.” Correct the contraction for grammatical accuracy (see lines 780--809).\n\nFigure 1: the right panel (“Overall score / Task Accuracy (%) | Privacy (↓)”) is hard to read due to font size and density. Increase font sizes and clarify how the “overall score” is computed (refer to the corresponding formula; see lines 33--53 and 1026--1045).\n\nFigure 2: label saturation (“AAM”, “MH Self-Attn Layer”, overlapping arrows). Simplify the legend (e.g., a symbol box) and scale typography for readability (see lines 162--215).\n\nVariable naming standardization: Section 3.2 introduces $f_T^{*}$ and variants $f_{TAR}$, $f_{TTAD}$, $f_{TAD}$, while Algorithm 1 later uses $f_{\\text{reco}}$, $f_{\\text{tad}}$, $f_{\\text{wsad}}$. Harmonize head names throughout text and code for traceability (see lines 232--269 and 1100--1133).\n\nDefinitions and units: in Section 4.2, metrics (Top-1, mAP, AUC) are not always paired with units/protocol specifics (e.g., clips per video, IoU thresholds, frame-level vs. segment-level). Add a brief table with metrics, units, and splits per dataset for clarity (see lines 324--377).", "limitations": "", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The manuscript proposes a latent‐space anonymization scheme (SPLAVU) that keeps the encoder frozen and adds a plug-and-play self-attention Anonymizing Adapter Module. This enables practical integration with low computational overhead and no backbone retraining.\n\nThe manuscript demonstrates a consistent privacy utility balance across multiple tasks (AR, TAD, WSAD) and different backbones, achieving sizable reductions in privacy leakage with ≤1–2% utility drop, and providing controllable trade-off curves.\n\nThe manuscript introduces a latent consistency loss that prevents overfitting the privacy budget and supports generalization to unseen tasks; ablations show that removing it degrades privacy and utility.\n\nThe manuscript evaluates temporally sensitive attributes and gender-bias protocols, showing mitigation of subclass gaps without sacrificing downstream performance.", "weaknesses": "The privacy evaluation is limited to VISPR with a linear attacker on static clips, which can overestimate the achieved protection and does not cover realistic threat scenarios (white/black-box, access to $f_E$ or $f_A$). Therefore, the manuscript should make the threat model explicit and test stronger attackers (e.g., MLP/ResNet or margin-based), also reporting ROC/PR curves to characterize risk more fully.\n\nThe choice to maximize NT-Xent as a privacy objective has limited theoretical support: it assumes shared information is “broken,” but it is unclear which attributes are actually removed and which persist. Therefore, the manuscript should expand the justification (e.g., connection to mutual information/subspace suppression) and add diagnostics showing which sensitive signals are effectively attenuated.\n\nThere is a modal mismatch between the problem (video) and the main privacy metric (attributes from static images); although a gait test is included, it remains a singular case. To better align the evaluation with the objective, it would be valuable to incorporate clip-level temporal attackers and to make the threat model explicit.\n\nQualitative visual results are missing, which would help readers interpret the practical effect of anonymization in video understanding. Therefore, the manuscript should include before/after examples, t-SNE projections of latents, activation maps, and representative failure cases to illustrate where privacy is gained and how utility is preserved.\n\nHyperparameter transparency and sensitivity of the composite objective are incomplete: the weights $\\omega_{LC}$, $\\omega_{T}$, and $\\omega_{B}$ steer the privacy–utility balance, but their selection is not centralized. Therefore, the manuscript should consolidate a table with values per task/backbone and report sensitivity sweeps that guide configurations by use case", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "UEC9NEuaOX", "reviewer": "Reviewer_u3Uc", "summary": "The paper proposes a privacy-preserving framework based on video foundation models by introducing a lightweight AAM at the backend of the video encoder. The AAM operates in the feature space to remove privacy-related information, and features a plug-and-play design that maintains task performance across multiple downstream tasks while achieving effective anonymization. Additionally, the method demonstrates potential in mitigating biases related to attributes such as gender.", "questions": "What motivated the choice of a 3-layer multi-head self-attention (MH Self-Attention) structure as the core component of the AAM? Were alternative lightweight architectures or different depths considered and compared through controlled ablation experiments to justify the effectiveness and necessity of this specific configuration?\n\nOn what basis were the weights assigned to the individual terms in the loss function determined? Was a systematic hyperparameter tuning procedure conducted to ensure that the selected weight combinations achieve an optimal trade-off between anonymization performance and task utility across different datasets and tasks?\n\nIn the anomaly detection task (e.g., on UCF-Crime), the reported AUC values do not reach state-of-the-art levels. Could the authors provide an analysis of potential factors contributing to this performance gap? For instance, does the anonymization process inadvertently filter out subtle but critical cues necessary for detecting anomalies?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "The AAM module is designed to be lightweight and modular, enabling seamless integration with various video foundation models. It introduces minimal architectural interference to the original model and ensures efficient inference, reflecting strong modularity and scalability.\n\nExtensive experiments are conducted on diverse datasets, including Kinetics-400 (K400), UCF101, HMDB51, ToyotaSmartHome (ToyotaSH), UCF-Crime, and THUMOS14, covering multiple downstream tasks such as action recognition, temporal action localization, and anomaly detection. This broad evaluation demonstrates the method’s generalizability and reliability, thereby strengthening the validity of the experimental conclusions.\n\nThe work introduces an assessment of gender bias within the context of video-based privacy protection, which adds social relevance and reflects forward-looking consideration of ethical implications in vision systems.", "weaknesses": "The design rationale of the AAM module lacks sufficient elaboration. There is inadequate theoretical justification for key design choices—such as the selection of the module’s architecture and the weighting scheme in the loss function—and insufficient ablation studies to validate their effectiveness and superiority. As a result, the optimality and robustness of the proposed design remain insufficiently supported.\n\nPrivacy preservation performance is primarily evaluated using the VISPR dataset. This evaluation approach is limited in scope and lacks validation under diverse privacy attack benchmarks or against dynamically defined sensitive attributes, which may undermine the comprehensiveness of the privacy analysis.\n\nWhile the paper presents preliminary analysis on gender bias mitigation, it lacks systematic comparison with existing debiasing methods. Consequently, it is difficult to assess the relative advantages or practical efficacy of the proposed approach in addressing algorithmic bias.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "J9OtJOsOsQ", "reviewer": "Reviewer_mpGY", "summary": "This paper studies privacy preserving action recogniton under the umbralle of video foundation models. It suggests adapating the feature output of VFMs with a goal of 1) hidding the privacy information and 2) maintaining the capability of performing well on down-stream tasks. To achieve that, it introduces three objectives to be learnined together to an ANONYMIZE the latent embeddings - contrastive loss to reduce the mutal information, down-stream utiliy loss and latent space regulaization loss. Extensive experiment have been done to demonstrate the success of the method, including both appearance based privacy and motion-based privacy (e.g., gaiting).", "questions": "N/A", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "A. The most notable strengths of the paper is the extensive experiments - testing across benchmarks and domains. The scope is comprehensive enough to prove the point. Works across multiple downstream tasks (action, temporal detection, anomaly detection) using the same anonymized features. The engineer efforts are huge without saying. Hope the code will be released for reproduction purpose.\n\nB. The delivery of the paper is clear -well structured wording, tables and figures.", "weaknesses": "A. The focus on latent space, rather than pixel space, poses a challenge on interpreting the ANONYMIZED video with human-eye level intuition - Can not visually see the privacy hideout anymore. Let's consider a situation where a well-trained VFMs decoder exist (e.g., video generative model that takes VideoMAE-v2 latent embedding as input), is it possible such as generative decoder can still produce privacy revealing outputs in pixel spaces with the adapted embedding as input? This is not necessarily an attack on the paper but an open discussion chat. Wondering how would authors think about the interpretabiliy of the proposed method? \n\nB. Table 5 shows that the L_T is very important to the recogntion performance. And the training of L_T is expensive - it requires labels, and it is concerning how much label it takes for the adapted embedding to be generalized again for a large scope of video understanding tasks, which is the original mission of VFMs. The fact that the method uses multiple downstream tasks as L_T make it hard to draw conclusion on this question. This reviwer has critical objections on this matter. It can be the case that the contrastive loss is too strong so that it destroys the useful information in the embedding space after massive data pre-training, again on the opposite direction to the VFMs. Any thoughts on how to reduce the impact of L_T training, like reduce the amount of label needed, the amount of data needed, etc,  so that the entire method is less data-hungry and by nature maintaining represenatation power with cheap buget?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "G4TjVQyeF6", "reviewer": "Reviewer_dNWy", "summary": "The paper proposes SPLAVU, a lightweight anonymizing adapter placed on top of a frozen video encoder to remove spatially private information from video features while preserving temporal information for downstream tasks. The method is trained with three objectives: a clip-level self-supervised privacy objective to reduce mutual information between static clips, task-specific utility losses, and a latent consistency term to preserve transferability. Experiments on action recognition, temporal detection, and anomaly detection show about a 35% drop in private-attribute predictability with minimal utility loss. Privacy is evaluated on VISPR and CASIA-B, and a bias protocol is included on NTU RGB+D and Toyota Smarthome. The approach is simple and does not require retraining the video backbone.", "questions": "My questions are based on the weakness above. Specifically:\n1. Can the authors please clarify the implementation details of the privacy classifier and provide more information on how privacy was evaluated?\n2. Do the authors evaluate the robustness of their method against feature inversion or reconstruction attacks? Can the anonymized features $h'_t$ be used to approximate or reconstruct the original frames $x_t$?\n3. Does the proposed method actually generalize to unseen tasks such as video retrieval, video object segmentation, captioning, or re-identification?\n4. If there is no adversarial classifier or adversarial optimization during training, how do the authors ensure that the optimization process is actually guided to remove privacy-related attributes rather than destroying useful features? Simply reducing mutual information between frame features does not seem to be a strong proxy for privacy removal.\n5. How does the input of the privacy classifier look like?\n6. How stable is the proposed approach? Since the privacy and utility objectives are inherently competing, I wonder wheter the joint optimization of $f_A$ and $f_T^{*}$, considering $L_B$ and $L_{LC}$, remains stable during training.\n7. Why is the ablation on the latent-consistency loss reported only on HMDB51? Could you extend it to another dataset shown in Table 1?\n8. Did the authors analyze how clip length or sampling strategy affects privacy and utility? Would longer or shorter clips change the results?", "limitations": "", "rating": 4, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "- The paper is well motivated. Privacy preservation in video representations is an important problem, and the community should work more on this topic.\n- The paper introduces the novel idea of anonymizing latent features instead of input pixels or frames.\n- The proposed anonymization adapter (AAM) is lightweight, plug-and-play, and works on top of a frozen video encoder, making the approach simple and efficient to train.\n- The visual explanation in Figure 2 helps readers understand the method.\n- The evaluation includes privacy, fairness, and bias analysis, which broadens the impact and shows awareness of social implications.", "weaknesses": "- The privacy evaluation is not clear. It appears that the authors train a separate classifier on anonymized features f_A(f_E(x)) for VISPR, but the implementation details (e.g., classifier type, training schedule, multi-label setting, etc) are missing. Clarifying this would help assess reproducibility and fairness when comparing to prior privacy-preserving frameworks that integrate the classifier during training.\n\n- The paper enforces a latent-consistency loss to keep anonymized features close to the encoder's latent space, aiming for generalization to unseen tasks. However, this design could also make the anonymized representations vulnerable to feature inversion or reconstruction attacks, since $h'_t=f_A(f_E(x_t))$ may remain close to $h_t=f_E(x_t)$. An attacker with access to the frozen encoder or a decoder trained on its features could potentially approximate the original frames. Specifically, an adversary could learn an approximate inverse $f_E^{-1}$ or a regression model $g: h'_t \\rightarrow x_t$ trained on pairs $(h_t, x_t)$ or $(h'_t, x_t)$, enabling recovery of frames from anonymized features. A discussion of this risk would strengthen the paper's privacy claims.\n\n- The paper claims generalization to \"unseen tasks,\" yet the evaluated ones (action recognition, temporal action detection, and anomaly detection) are all closely related motion-centric problems. Assessing the method on more diverse downstream video understanding tasks, such as video retrieval, video object segmentation, video captioning, or person re-identification, would provide stronger and more convincing evidence of true task-level generalization.\n\n- Unlike prior works such as SPAct, this paper does not include an explicit privacy classifier or adversarial optimization loop. While this design choice simplifies training, it also weakens the link between the training objective and actual privacy protection. The self-supervised \"privacy budget\" loss acts only as an indirect proxy for removing spatial identity information and may not guarantee robustness. It would also be helpful to visualize the input to the privacy classifier model.\n\n- Since the privacy and utility objectives are inherently competing, I wonder if the joint optimization of $f_A$ and $f_T^{*}$, considering $L_B$ and $L_{LC}$, remains stable.\n\n- The ablation on the latent-consistency (cycle-consistency) loss is evaluated only on HMDB51, whereas the main results (Table 1) include multiple datasets and tasks. It would be more convincing to show the same ablation across others.\n\n- The paper fixes the clip sampling and length configuration but does not analyze its impact on privacy or utility. Since privacy leakage and temporal consistency can depend strongly on clip duration and sampling strategy, an ablation on clip length or selection would help clarify whether the proposed method's gains generalize across different temporal windows.\n\n- The structure could be improved for clarity. While $f_A$ appears in the equations of Section 3.1, its definition is only given in Section 3.2. Introducing it earlier would make the methodological flow easier to follow.\n\n- The notation is not clearly defined and is sometimes hard to follow. For example, $T^n$ is used in the loss formulation but never explicitly defined; it's unclear whether n indexes tasks, samples, or temporal segments.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)