EgoPrivacy: What Your First-Person Camera Says About You?
Authors: Yijiang Li
Genpei Zhang
Jiacheng Cheng
Yi Li
Xiaojun Shan
Dashan Gao
Jiancheng Lyu
Yuan Li
Ning Bi
Nuno Vasconcelos
Venue: ICML 2025 poster (2025)
Keywords: egocentric vision
privacy
retrieval
Primary area: social_aspects->privacy
TL;DR: We present EgoPrivacy, a comprehensive large-scale benchmark for evaluating the privacy issues in egocentric videos. We further propose Retrieval Augmented Attack, a novel attack that leaks the camera wearer's privacy information.

Abstract: While the rapid proliferation of wearable cameras has raised significant concerns about egocentric video privacy, prior work has largely overlooked the unique privacy threats posed to the camera wearer. This work investigates the core question: How much privacy information about the camera wearer can be inferred from their first-person view videos? We introduce EgoPrivacy, the first large-scale benchmark for the comprehensive evaluation of privacy risks in egocentric vision. EgoPrivacy covers three types of privacy (demographic, individual, and situational), defining seven tasks that aim to recover private information ranging from fine-grained (e.g., wearer's identity) to coarse-grained (e.g., age group). To further emphasize the privacy threats inherent to egocentric vision, we propose Retrieval-Augmented Attack, a novel attack strategy that leverages ego-to-exo retrieval from an external pool of exocentric videos to boost the effectiveness of demographic privacy attacks. An extensive comparison of the different attacks possible under all threat models is presented, showing that private information of the wearer is highly susceptible to leakage. For instance, our findings indicate that foundation models can effectively compromise wearer privacy even in zero-shot settings by recovering attributes such as identity, scene, gender, and race with 70–80% accuracy. Our code and data are available at https://github.com/williamium3000/ego-privacy.

EgoPrivacy: What Your First- Camera Says About You?
Yijiang Li
Genpei Zhang?
Jiacheng Cheng' Yi Xiaojun Shan Dashan Gao Jiancheng Lyu
Yuan Li Ning Bi Nuno Vasconcelos
Abstract
1. Introduction
The growing adoption of wearable cameras and egocen- tric (first-person view) videos, driven by advances in hard- ware and computer vision (Betancourt et al., 2015; Pliz- zari et al., 2024; Sigurdsson et al., 2018a; Grauman et al., 2022; 2024), enables innovative applications like activity recognition (Nguyen et al., 2016). human behavior analy- sis (Cazzato et al., 2020), or life logging (Bolanos et al., 2016; Del Molino et al., 2016). However, it also raises sig- nificant privacy concerns (Hoyle et al., 2014; 2015b). An already popular concern the privacy of people captured by egocentric cameras (Farringdon & Oni, 2000; Krishna et al., 2005; Mandal et al., 2014; Chakraborty al., 2016; Templeman et al., 2014; Korayem et al., 2016; Dimiccoli et al., 2018; Hasan et al., 2017: Fergnani et al., 2016). This concern, however, is not specific to egocentric video. Third- person cameras are already common public environments, e.g. surveillance networks, and many private environments, e.g. TV sets with user facing cameras, motivating a line of research privacy preserving cameras (Hinojosa et al., 2021; 2022; Cheng et al., 2024a; Khan al., 2024) and post-hoc privacy techniques, e.g. methods to delete ob- fuscate faces in images (Criminisi et al., 2003; 2004; Bitouk et al., 2008; Ren et al., 2018). While sharing all these issues, egocentric video introduces a new set of privacy concerns of its own, namely the privacy implications for the camera wearers, which have been much less studied (Hoshen & Peleg, 2016; Thapar et al., 2020a:b; Tsutsui et al., 2021).
While the rapid proliferation of wearable cameras has raised significant concerns about egocentric video privacy, prior work has largely overlooked the unique privacy threats posed to the camera wearer. This work investigates the core ques- tion: How much privacy information about the camera wearer can inferred from their first- person view videos? We introduce EgoPrivacy, the first large-scale benchmark for comprehen- sive evaluation of privacy risks in egocentric vi- sion. Egoprivacy covers three types of privacy (de- mographic, individual, and situational) defining seven tasks that aim to recover private information ranging from fine- fine-graine -ra-irr (e.g.. wearer's s identity) to paars--grained (e-g-. age group). To further emphasize the privacy threats inherent to egocen- tric vision, propose eetrieval-Augmentie Ar- tack, a novel attack strategy that leverages ego- to-exo retrieval from an external pool of exocen- tric videos to boost the effectiveness of demo- graphic privacy attacks. An extensive compar- ison of the different attacks possible under all threat models is presented, showing that private information of the wearer is highly susceptible leakage. For instance, our findings indicate that foundation models can effectively compromise wearer privacy even in zero-shot settings by re- covering attributes such as identity, scene, gender, and race with 70-80% accuracy. Our code and data are available https: / /ttp::///tttttt com/ wi. 11: amí um30000000mmmmmmmm wew::00/ee-rriieeeeee
Wearer-centric privacy is particularly concerning because egocentric videos are highly personal, captured continuously to document the day-to-day experience and surroundings of the camera wearer, and to keep track of their activities (Pliz- zari et al., 2024). The availability of this information will create pressures for its sharing, c.g. free vidco storage in exchange for video mining access, analysis by third parties, e.g. insurance companies collecting health information, and cross-referencing of egovideo with publicly available third- person video of the wearer, e.g. on social media platforms. All privacy problems currently posed by location location-tracking apps will be magnified by the ability to know not only where people are but also what they are doing (Hoyle et al., 2014; Price et al., 2017: Speciale et al., 2019). All of this can lurk under a false sense of privacy, due to the fact that the
'University of California, San Diego "Carnegie Mellon Uni- versity 'Qualcomm AI Research, initiative of Qualcomm Technologics. Inc. Correspondence to: Jiacheng Cheng <ji- schheng.henngee gmail.com>.
Proceedings of the 4nnd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

EgoPrivacy: What Your First-Person Camera Says About You?
ftft
Demographic Privacy
Male
Female
White
Block
Asian
Mapsee Lario
Young
Middle aged
Senior
Attacker
Gender?
Ethricty?
Age?
Classification-bbeee
Individual Privacy
Figett-Eig
Retrieval based
First-person video
Situational Privacy
Wherr?
Whin
Figure 1. Overview of the proposed EgoPrivacy benchmark. What you tell about the camera wearer from egocentric videos alone? It may come as a surprise that a fair amount of information about the user, such as demographics, identity, time and location of recording, be inferred from their first-person view footages, despite not revealing their faces or full body.
camera is not framing its user. Given the limited attention to the problem, is currently not even well understood how much of a privacy problem egocentric video poses to camera wearers. Questions such as what type of private informa- tion and how much of it can be recovered remain largely unanswered.
to compromise demographic privacy. This implies that even an adversary with no additional data or information about the wearer, can simply use open source models to recover attributes like race and gender. Fine-tuning these models annotated exocentric or egocentric datasets extends this ability to recover attributes like wearer identity or scene location.
This work is first attempt to define the range of wearer- centric privacy problems arising from egocentric recordings. In essence, we ask: What can be told aboul the camera wearer by watching egocentric videos? Figure 1 illustrates a variety of personal information that can be inferred from the video: hand appearance and pose can give away the gender, race and age of the wearer; egocentric videos can be matched to exocentric views of the wearer to fully re- veal identity or activities; background settings and objects can give away location and activity; video clips can be matched to reason about location and time, and so forth. We group these privacy issues into three broad categories: demographic privacy for recognizing demographic groups of the wearer, individual privacy for uniquely identifying the wearer, and situational privacy for recognizing when and where the recording took place.
The gap between privacy attacks on egocentric and exocen- tric video largely owes to a key advantage of egocentric footage: it naturally hides the wearer's 's face and most parts of the body which can easily give away the privacy informa- tion of a subject. However, in practice, as almost everyone is increasingly exposed to all kinds of cameras in public, it is entirely possible that the camera wearer of an exocentric video will also be filmed in exocentric videos by third part (e.g. suveilance systems, vloggers) simultaneously. If an adversary could get access to a repository of third-person view videos and successfully recover those miir--pesoon view corresponding to the ego video query, the risk of pri- vacy leakage in egocentric vision will be elevated another level. Motivated by this, introduce the novel Retrieval- Augmented Attack (RAA): With access to a repository of third-person videos that may feature the target user, an at- tacker first conducts ego-to-exo retrieval, then launches the privacy attack from the exocentric perspective. Experiments show that merging cues from the egocentric stream with the retrieved exocentric clip markedly raises the success rate of demographic-priive
To comprehensively study the problem of egovideo privacy, we propose novel large-scale benchmark, EgoPrivacy, annotated to allow the quantification of privacy risks under each of these categories. EgoPrivacy covers seven tasks rep- resentative of the three privacy categories, each formulated as either a problem of video classification or retrieval. We then propose a of threat models with increasing levels of access to wearer data and perform an extensive evaluation of their ability to recover private information, using various types of foundation models.
attacks.
The gap between privacy attacks on egocentric and exocen- tric video can be attributed to key advantage of egocentric footage: it naturally obscures the wearer's face and much of their body, that typically reveal private information. How- ever, in practice, individuals are increasingly exposed to various public-facing cameras, making it highly plausible that the wearer of an egocentric camera is simultaneously captured in third-person view footages, e.g. by surveillance
Extensive experiments reveal significant privacy challenges, as all threat models are able to extract surprisingly high amounts of private information. For example, zero-shot foundation models are shown to have a remarkable ability
2

---

EgoPrivacy: What Your First-Person Camera Says About You?
systems bystanders recording with personal devices. This scenario is far from hypothetical. For instance, consider case where someone uploads a series of egocentric videos to social media. An attacker could potentially obtain the ' IP address and retrieve surveillance footage from nearby locations. Motivated by this, we propose a novel Retrieval- -Arimeee- Attack (RAA): the adversary first per- forms ego-to-exo retrieval identify third-person clips con- taining the target, then launches a privacy attack from the exocentric perspective. Our experiments demonstrate that incorporating cues from retrieved third- person views into the analysis of egocentric footage significantly improves the effectiveness of demographic privacy attacks.
with privacy-preserving representation of the egocentric videos/images (e.g. extremely downsampled video (Ryoo et al., 2017), text description (Qiu et al., 2023)) instead of the raw RGB data. Despite abundant research, they primar- ily focus on third-person subjects appearing in egocentric videos. Our work distinguishes itself from them by taking a new perspective, i.e. privacy concerns around the camera wearer.
poster's
Egocentric Person Identification. Person identification has been well-studied in third-person video settings but re- mains less explored in egocentric scenarios, where the sub- ject can be either individuals in the camera's 's field of view or the camera wearer. For the former, the identification usually relies patterns of the face (Farringdon & Oni, 2000; Krishna et al., 2005; Mandal et al., 2014; Chakraborty et al., 2016) or body part (Fergnani et al., 2016). The identification of the wearer typically depends on head motion signature (Hoshen & Peleg, 2016; Thapar al., 2020a), hand gesture (Tha- par et al., 2020b; Tsutsui al., 2021), and photographer style (Thomas & Kovashka, 2016). Some cross-view wearer identification approaches are proposed with additional third- person view (Yonetani et al., 2015; Poleg et al., 2015; Zhao et al., 2024) or top-view videos (Ardeshir & Borji, 201 8b;a) as auxiliary data.
Overall, this paper makes four key contributions. First, we develop the first comprehensive large-scale benchmark for studying privacy in egocentric videos, which covers risks at the demographic, individual, and situational levels. Sec- ond, we formulate various threat models based attacks with varying levels of access to video of the wearer and instantiate concrete attacker models for each of them. Third, we present an empirical analysis of the success of these attacks, revealing that even the use of zero-shot founda- tion models can suffice to expose significant amounts of private information. Last but not least, we further derive novel privacy attack by ego-to-exo retrieval augmentation and demonstrate its effectiveness at exposing demographic attributes. We hope that our work can lay the foundation for future investigations into both offensive and defensive strategies concerning egocentric privacy.
Relationship Between Egocentric and Exocentric Videos. The relationship between egocentric and exocentric videos has been investigated in applications such as knowl- edge transfer (Li al., 2021), cross-view genera- tion/translation (Liu et al., 2020; 2021; Luo et al., 2024b;e) and retrieval (Elfeki et al., 2018; Yu et al., 2020; Xu et al., 2024). The application of cross-view retrieval to the wearer privacy attack has yet to be thoroughly investigated.
2. Related Works
Visual Privacy Benchmarks. Large-scale public bench- marks are indispensable for successful computer vision re- search. Multiple benchmarks with privacy annotations (e.g. PIPA (Zhang et al., 2015), VISPR (Orekondy et al., 2017), VizWiz-Priv (Gurari et al., 2019)) have been established, but their source data are mostly social media images (e.g. Twitter), not egocentric. Some egocentric video datasets with wearer identity annotations (e.g. FPSI (Fathi et al., 2012), EVPR (Hoshen & Peleg, 2016), HTTM (Thapar et al., 2020a)) can be employed for wearer identification evaluation, but their potential is limited by the insufficient participants and scene diversity.
3. Benchmarking Privacy in First-Person View
Most privacy-preserving vision addresses third-person video, equating privacy to (in)ability to recognize faces or other features that reveal personal information, like ad- dresses or phone numbers. While this is concerning for egocentric videos, fails capture the full range of privacy risks posed by the latter, which can also expose informa- tion about the camera wearer's identity, demographics, and surroundings. To address this problem, we propose EgoPri- vacy, a multidimensional privacy benchmark for egocentric vision.
Privacy Preservation in Egocentric Vision. A straight- forward solution is to disable the camera when sensitive information are detected (Templeman et al., 2014; Korayem et al., 2016). Beyond this, a line of work proposes to redact sensitive information in an egocentric video using processing techniques such as image degradation (Dimiccoli et al., 2018), object replacement (Hasan et al., 2017), and anonymization transformation (Thapar et al., 2021). An- other line of work investigates how to perform utility tasks
3.1. Privacy Definition
We consider three types of privacy information and their potential of leakage in egocentric videos.
Demographic privacy. These attacks aim to recover de- mographic groups to which the camera wearer belongs. We
3

---

EgoPrivacy: What Your First-Person Camera Says About You?
Benchmark
Modality
#Subjects
#Scenes
Identity
Demographies
OOD Data
(Fathi et al., 2012)
Ego
X
EVPR (Hoshen & Poleg, 2016)
Ego
32
x
/
x
X
HIMD WFP (Thupar et al., 2020a)
Ego
31
x
/ x
X
ITTD-WTP (Thapar al,, 2020n)
Ego-Exo
12
X
EgoPrivacy (Ours)
Ego-Exo
123
Table 1. Comparison of existing egocentric privacy benchmarks.
consider three such groups: gender, race, and age. While not fully identifying a person, these attributes can be leveraged to build user profiles for unwanted solicitation, e.g. targeted advertising, or discriminatory practices, e.g. misuse of race or gender information within health applications (Hoyle et al., 201 5a; Price et al., 2017). Since they are categori- cal variables, we formulate demographic attacks as classi- fication problems, where a predictor f(-) aims to infer a demographic attribute a gender, race, and age) of the camera wearer from egocentric video x. This is illustrated in Figure 1. Privacy risk measured by the demographic attribute classification accuracy
that because egocentric videos depict scenes similarly to ex- ocentric videos, they have similar risk of exposing private scene information (Chen et al., 2024). scene retrieval seeks to identify the location where the egocentric video was cap- tured. Conversely, moment retrieval considers both, location (where) and the timing (when) of the footage, striving to pinpoint precise moment in a corresponding exocentric clip, e.g. a clip captured by a different camera (Liu et al., 2024b; Luo et al., 2024a). As illustrated in Figure 1, both types of privacy are formulated as retrieval problems and evaluated with (2). Scene retrieval replaces Ty with Ts, the set of video clips from D that recorded in the scene of the query. For moment retrieval, Ty is replaced by T, the set of exocentric video clips from D that are synchronized with the query video, e.g. footage from different third-person camera perspectives.
Ac = D
Σ (X.o)ED
1[ʃ(x) = a].
(I)
where [[-] is the indicator function. Higher Acc(D; f) indi- cates that dataset D is more vulnerable privacy attacks.
3.2. Benchmark Design
We provide a brief description of the EgoPrivacy benchmark here, further details on the datasets and annotation process can be found in Appendix A. EgoPrivacy is benchmark of synchronized ego-exo video, built upon Ego-Exo4D (Grau- man et al., 2024) and Charades-Fgo (Sigurdsson et al., 2018a)'. It includes high-quality annotations for the three privacy categories discussed above: demographic labels (gender, age, and race) for each participant, as well as scene and identity annotations for each egocentric video clip. EgoPrivacy is composed of 5,625 video clips from Ego-Exo4D, captured by 839 diverse participants across 131 distinct scenes, and 4,000 clips of daily indoor activities from Charades-Ego, recorded by 112 participants in their homes.
Individual Privacy. These attacks directly aim to recover the camera wearer identity I. As shown in Figure 1, this is formulated as retrieval problem. A latent embedding is first learned, and retrieval operation is performed to identify the nearest neighbors of the query EgoPrivacy considers both the settings where the retrieved video is ego or exocentric. Privacy risk is measured by the hit rate at k (HR@k) for retrieval of videos from the wearer of query x
HR@k(D:g)
1
Σ (X.J)D
(x) n Tr, 0]
(2)
D
where g is the retrieval operator, g² the top-k retrieved videos and Ty the set of videos of identity| (the wearer) in dataset D. Depending on the composition of the retrieval set D. we further categorize the Individual Privacy into two tasks. If the retrieved videos are egocentric, the problem is formulated as ego-to-ego retrieval, where both the query gx(xx and the retrieval set D consist solely of egocentric videos. Conversely, if the retrieved videos are exocentric, the task becomes ego-to-exo retrieval, where given an ego- centric query 9* (x), the goal is to retrieve the exocentric videos from D with the same identity.
All Ego- Ego-Exo4D and Charades-Ego clips include time- synchronized egocentric and exocentric videos along with identity annotations for each clip. However, demographic annotations are sparse since they are self-reported by cam- era wearers, and many were not collected. We lever- aged the availability of exocentrie videos to manually annotate the demographics of all participants. Camera wearer race, gender, and age labels were collected for all clips using Amazon Mechanical Turk. The label sets of the privacy classification problems were defined to reflect the make-up of the dataset. Gender classes
Situational privacy. Centering on situational awareness, these attacks aim to determine where or when an egocentric video clip was recorded. We consider two tasks: scene and moment retrieval. Scene retrieval motivated by the fact
'All datasets used in the paper were solely downloaded and evaluated by UC San Diego

---

EgoPrivacy: What Your First-Person Camera Says About You?
are (Female, Ma Race's are {Asian, Black, White)", Age's are (Young, Middle-aged, Senior). For individual and situational privacy, we utilize the provided identity and scene annotations from the datasets. For moment retrieval, the location and timing labels are approximated based on clip footage, where each clip is treated as a distinct space- time instance.
Capability Diidenttt--eeel attack): In addition to the ca- pabilities above, the adversary further ascertains whether two egocentric videos share the same identity, without nec- essarily identifying the individuals depicted.
We justify Capability 3 and Capability 4 in Appendix C, by outlining realistic threat scenarios in which they arise.
The combination of videos from Ego-Exo and Charades- Ego facilitates the formulation of in-distribution (ID) and out-of-distribution (OOD) problem evaluations. Following the train/test split proposed in (Grauman et al., 2024), we split the Ego-Exo4D videos into a training set Dirains that can be used for model finetuning, and test set Diest for ID) evaluation. Charades-Ego is then solely used as a test set for OOD evaluation.
4.2. Implementation
In this section, we discuss the implementation of the threat models with different capabilities for each of the three pri- vacy categories.
Demographic Privacy is modeled as a classification prob- lem, as discussed in Section 3.1. Here, the classifier s(.) is implemented with a multi-modal foundation model. Ca- pability ①: f(-) is applied to Drest in a zero-shot man- ner. Capability (:f(-) is finetuned on Duain and tested on Drest- We consider the in-distribution (ID), i.e. both Durain and Desse are from Ego-Exo4D and the out-of-distribution (OOD) where Dtrain are from Ego-Exo4D and Drest from Charades-Fgo. For the combination of capability ! 2 and the additional 3 both query x and retrieval dataset Dieir are fed to the identity retriever obtain feature vectors and RAA is performed, as discussed in Sec 5.
Table 1 compares EgoPrivacy with previous egocentric pri- vacy benchmarks (Fathi et al., 2012; Hoshen& & Peleg, 2016; Thapar et al., 2020a), which are significantly smaller, focus solely on identity privacy, lack scene and demographic anno- tations, do not support OOD testing, and primarily consist of egocentric video data.
4. Egocentric Privacy Attack
In this section, we will propose our privacy attack to inves- tigate the privacy concern of camera wearer in first-person views. We start by defining set of threat models in Section 4.1 and then propose the attacker models in 4.2.
Individual & Situational Privacy formulated as re- trieval problem, with suitable embedding model. Both query x and videos in Diest are mapped into the embedding to create feature vectors and those from Prest ranked by sim- ilarity to x, using the cosine similarity metric. Capability i is implemented by the embedding of the foundation model directly in a zero-shot manner. Capability 2: the embed- ding is fine-tuned on Dusin. as diseussed in Sec 5.1. The capability 33) is only for demographic privacy and is thus omitted here.
4.1. Attack Capability
We consider an adversary with the goal of obtaining one of the types of privacy information of the camera wearer from an egocentric query video x. We delineate a spectrum of capabilities ranging from minimal to extensive.
Capability ① (zero-shot); The adversary has no access to training data. This is the simplest class of attack, imple- mentable by anyone with access to foundation model.
5. Cetrrevall-uugmetted Attack
We present a deeper dive into ego-to-exo retrieval under a novel attrieval-aggment attack, to highlight its potential to boost the efficacy of inlificctiion-basele attack models.
Capability ② (finetuned): The adversary has access to labeled training dataset Durin to fine-tune the model for attack purposes. Drain can include either egocentric videos, if Dres is egocentric, exocentric videos, if Dres is exocen- tric, or both in the case of moment and ego-to-exo identity retrieval.
5.1. Ego-exo Embedding
To perform ego-to-exo retrieval, a joint embedding space of ego and exo video clips is required. We follow recent progress on cross-modal metric learning (Morgado et al., 2021; Radford et al., 2021) and perform the ego-to-exo retrieval with an embedding learned by contrastive learn- ing (Oord et al., 2018). A pair of egocentric xf and ex- ocentric x examples is mapped into a pair of feature vectors (z,",z)) using joint embedding .z."z,²) xxx) = (g(xF), ( (xx)) where the mappings g.g6 are learned with a contrastive loss function. This uses ego-exo video pairs from the same person (demographic or individual privacy) or space-time (situational) as positive pairs.
Capability 3 (retrieval-augmenteel The adversary has access to an identity labeled ego-exo paired training set (for ego-to-exo identity retriever) and an external pool of unlabeled exocentric videos Drer, which potentially includes the identity of the target egocentric query video x.
We note that these are perceived gender classes by the annota- tors
'Other racial categories omitted due to the low represen-
tation in the dataset.
5

---

EgoPrivacy: What Your First-Person Camera Says About You?
Formally, RAA is two-stage privacy attack under the "re- trieve, then predict" methodology, illustrated in Figure 2. RAA assumes the availability of an external pool of exo- centric data D*x which includes the individual behind the egocentric video. Given an egocentric query example x the attacker first uses an ego-to-exo retrieval module g to rank all examples x E DD by their similarity to x the embedding space $g.o/ (xx ,x) = (g(x"), ). (xxx)); sup- port set {x C DD is then formed by the top-M most similar examples. The final output of RAA is the aggrega- tion of the direct egocentric attack / f(x B and the exocentric attacks on the retrieved examples {f ))
Ego-to-exo Retrieval
Top K
Attack
Atlack
DD X
Database
A
Prediction
Figure 2. Retrieval-Augmentedd Privacy Attacks.
fRAA (XTM))) = A (x f'
In general, several exocentric samples are associated with a single egocentric sample, either because the exocentric video is collected from multiple viewpoints or by definition of the retrieval task. For example, in individual privacy attacks all exocentric videos of the same camera wearer are considered successful retrievals, independently of whether they were shot at the same location time. To account for this, we formulate the learning of the embedding supervised contrastive learning (SupCon) (Khosla et al., 2020). This is a relaxed version of contrastive learning that distributes the loss evenly over all positive pairs
(4) where f. are classification-based privacy attacks, such as gender predictors, on egocentric and exocentric inputs, 4 and A is an aggregation function that can be as simple as major- ity voting (hard voting) or weighted pooling (soft voting), By employing the simple voting ensemble, RAA without bells and whistles demonstrates significant effectiveness, improving the attack rate by a large margin.
6. Results
6.1. Experimental Setup
exp 2 \/) EjEN(E exp( ( 2 //))
Objectives. We begin with a set of research questions and objectives of the experiments:
L(g,g')= = P())
log
kEP())
Are egocentric videos threat to the privacy of the camera wearer?
where P(i) is the set of exocentric feature vectors that are
positive pairs of z." and (ii) set of negative pairs. Sup-
To what extent do egocentric videos expose private infor-
Con allows the unification of privacy types, individual and
mation with different capabilities of the threat model?
situational, simply by varying the definition of positive set
How effective is RAA in enhancing privacy attacks?
P(i). For individual privacy, P(i) contains all exocentric examples z containing the camera wearer of zz" For sit- uational privacy, Pii) is restricted to the single exocentric video clip (single take in Ego-Exo4D) recorded in syne with x In both cases, the negative set N(i) is formed by all other exocentric examples in the same minibatch as well as cached from past iterations of training.
What factors contribute to privacy vulnerabilities in ego-
centric videos?
Do privacy attacks remain effective for out-of-distribution samples?
Dataset. All experiments are performed on the EgoPrivacy benchmark discussed in Section 3.2.
Models & Baselines. We consider a variety of models for launching the privacy attack, ranging from generalist -asion-language models like CLIP (Radford et al., 2021; Fang al., 2023) vidco-centric models such as Video- MAE (Tong et al., 2022) and EgoVLPv2 (Pramanick et al., 2023) pre-trained on egocentric data, and large multimodel models (LMMs), such as LLLVA-115 (Liu et al., 2024a) and VideoLLaMA2 (Cheng et al., 2024b).
5.2. Retrieval as Augmentation
Egocentric video inherently offers greater privacy protection for the subject compared to exocentric video, as faces and most of the body are obscured. However, an adversary has access to the identity mapping between egocentric and exocentric videos, they can easily infer private information from the exocentric footage. We further notice that the ego-to-exo retrieval attack model as discussed in Section 4.2 performs this task exactly. Motivated by this, we pro- pose Retrieval Augmented Attack (RAA) by exploiting an additional ego-to-exo retrieval model to retrieve exocentric videos for augmented prediction.
For exocentric demographic attacks, we also consider a straightforward face-based baseline. ie. run face detection and demographic classification. Given the discovery that biometrics can be leveraged for inferring demo-
*One can use the same attack model for both views (f = f
6

---

EgoPrivacy: What Your First-Person Camera Says About You?
OOD
Capubility
Gender
Race
Age
(Chandees
3
RA
Exo
kgo
RAA
Exs
Egoo
KAA 3
Random Chance
50000
33.33
23.33
Prior
60.74
54.37
79.48
based
NIA
Face- based
NIA
70.98
69.57
/
78:64
57.89
67.35
9.46
60.04
45.21
60.98
15.77
73.51
72,02
76.25
4.21
CLIPpots
96.03
85.04
90.74
5.70
88.57
60.14
46.09
55.00
59,42
2.18
69.28
48.02
20.25
58.5
63.89
5.39
5.67
x
83.56
56.74
62.44
5.70
87.39
73.22
77.01
3.79
29.90
29.70
29,92
0.22
/ 76:97
63,18
67.11
3.93
64.85
57.14
64.29
7.15
52.25
47.85
49.67
1.79
V2
92.00
K3.90
87.25
86.86
85.95
M6.57
0.62
64.05
55.12
3.21
x
76.97
51.84
59:42
7.78
76.97
69.77
73.00
3.26
46.15
34.17
5.91
VideoMiAEgge
x
x 72:42
07:99
42.09
63.69
55.40
70.65
13.31
6.96
75.16
72.05
66.73
46.50
57.42
73.49
10:92
6.76
73.21
30.57
29.70
79.73
81.70
30.33
0.65
1.97
VideoMAEUr1
N7:34
63.87
78.95
16.08
74.36
70.30
72.65
2.55
77.15
79.73
0.00
80:67
54.63
13.81
72.37
46.02
57:42
29,90
29.70
29.92
0.22
LLaVA-1-5
7
X
91.52
90:42
66.90
71.59
77.16
75.60
10:26
4.01
60.05
71.10
57.34
48.95
59.32
57.52
10.57
0.18
79.29
50.35
35,007
79.66
47.26
79.55
12.19
0.09
L1aVA-1-5pa
/
90.37
65:45
78.55
72.61
13.30
10:34
06.64
46.42
62281
69.33
59.32
6.52
51.56
73.55
69.33
37.44
72.55
3.25
Ladeo
<
7
85.34
90.60
71.31
77.64
82.05
76.16
4.41
4.85
67.00
75.56
58.57
62.39
64.20
68.48
5.72
6.009
64.99
53.36
57.11
44.93
59,01
47.99
2.46
1.92
Videol.aMMA2aa
90.52
67.81
77.89
72.33
01.99
55.88
52.51
46.57
32.93
-0.89
Table 2. Results on Demographic Privacy. Accuracy is calculated on a per-video basis. A indicates the accuracy increase brought by RAA (3) over 1
graphics such as gender and race (Matkowski et al., 2019; Matkowski & Kong, 2020), we also employed a hand-based demographics classifier as a baseline for egocentric demo- graphic attacks.
ing zero-shot foundation models (i), we observe a really high demographic attack accuracy in Table 2, as illustrated by the highest 15%, 65.36% and 79.64% for gender, race and age respectively. This leads the conclusion that even with minimum capabilities, the adversary can still perform successful attack with up to 80% success rate. However, zero-shot models perform significantly worse on situational and identity attacks (Table 3), leaving these two privacy protected against capability D.
Training. We add to the top of the foundation models with one layer of MLP for classification (demographic privacy) and use its representation layer for retrieval (individual and situational privacy). All models are trained with 1 Ax0100 with a batch size of 8. We use a learning rate of 1e-5 and adopt the AdamW optimizer with cosine learning rate decay. The default number of frames for one video is 8.
When equipped with a training dataset (2), race and age results can be further improved to 72.01% % and 80.72%, and retrieval-based attacks reach the highest of 81.2%, 50.31% 89.21 % and 15.43% top-1 hit rate on ego-to-ego, ego-to- exo identity, scene and moment retrieval tasks respectively. This suggests that, with access to some training data, an adversary could further extract more private information about the camera wearer from egocentric videos, thereby posing an even greater threat to privacy.
6.2. Main Results
Are egocentric videos a threat to the privacy of the cam- era wearer? We answer this by comparing different mod- els with chance-level (lower bound) and exocentric perfor- mance (upper bound). As per Tables 2 and 3, we can clearly observe that 1) despite some lower than exocentric perfor- mance, all attack models in Tables 2 are higher than random chance by a large margin (more than 15%) for both De- mographic, Identity and Situational Privacy; 2) except for zero-shot models, all fine-tuned models in Table achieve significantly higher results compared to chance-level per- formance. The unsatisfactory performance of the zero-shot retrieval model is attributed to the fact that some of these models have not been trained on egocentric videos before, and hence fail to construct a meaningful ego-view represen- tation. These results suggest that the risk of privacy leakage a significant concern in egocentric vision.
Effectiveness of RAA. With the additional capability 3 adversary is now able to perform the RAA attack. We demonstrate the delta after and before applying the RAA in Table 2. We can see a consistent improvement over all the models across all three tasks, with some even surpassing the exocentric baseline (e.g. VLP v2). The most significant improvement is observed with the VideoMAE model on the gender classification task, achieving an increase in accuracy of over 16% This result has demonstrated the effeectvvnness of RAA in most scenarios. We also observe some minimal improvement cases. These cases can be attributed to the small gap between egocentric and exocentric performance, leading to a minimal increase. We believe this is reasonable, as the performance exocentric is generally seen as the upper bound of an egocentric privacy attack.
To what extent do egocentric videos expose private infor- mation under different capabilities of the threat model? We evaluate the attack performance under a threat model with different capabilities outlined in Section 4.1. First, us-
7

---

EgoPrivacy: What Your First-Person Camera Says About You?
Idenney
Sinotiional
Ego--Fgg Egn HIR05
Egg--
Eso HR
Scome
Moment HR
HR
HR
HR
HR
Ramdom Chance
N/A
0.57
2,87
0.57
2,87
8.83
30.66
0.09
0:45
ID (6goEuoo2 testxet)
v
X
0.92
1.10
0.89
1,07
24.98
29.07
1.78
7.91
x
86. .0.52
97.66
51.52
66.31
89.25
90.05
12.72
41.85
EgoVLP v2
x
4.85
8.31
7:31
18.38
28.64
28,88
1,96
7:34
84.65
96.69
57.96
11.56
37.10
VidosMAFs
v.
x
0.49
76
95.12
1,35
0.68
1,00
85.75
14.32
16.37
13,80
0.09
39.25
0.71
VideoMAK
x
0.88
1.74
0.91
1,07
13.60
15.98
0.00
0:45
x
78.52
95,70
42.74
$7.97
83.62
89.61
17.74
47.13
CDD
(Charader Ago testiet)
CLIP
x
x
$3.07
0.59
76.24
1,04
37.33
0.90
49.69
1.89
NA
8.22
1.49
26.89
6.53
E2
/
x
5,03
9.90
6.74
17.44
N/A
1.77
6.53
x
42.63
66.42
54.87
46.57
7,79
28.74
VideoMAEE
VidooMAFs
v.
x
x
44.25
47.55
0.69
68 08.87
73.11
1.58
1.89
36.51
36.08
0.80
50.09
48.78
1.95
NAA
0.42
8,07
9.82
27.33
31.68
0.99
Table 3. Results on Identity and Situational Privacy. The hit rate is calculated on per-video basis. Scene retrieval results are omitted for OOD (Charades- Ego test set) due to the absence of ground-truth labels in Charades-Ege Ego datasct.
Gender
Race
Age
Videol.LaMAR3
73.15
53.97
47.08
hard voting
78.32
65.82
43.23
0.5
76,90
64.90
51.12
voting
1/(k 1)
77.16
66.45
41.97
Figure 3. Performance of Retrieval Augmented Attack versus k.
Table 5. Different voting mechanisms for the Retrieval Augmented Attack, u: the weight over the egocentric prediction.
We also notice that, even when the exocentric performance lower than egocentric, RAA still offers improvements in some cases. We derive hypothesis that RAA does not need the retrieval model to select the correct identity necessary to improve, but rather the retrieval model will cluster and group identities of similar attributes (of same gender, age and race, etc). To validate such a hypothesis, we conduct an experiment to see whether the ego-to-cxo model groups identities of similar gender, race and age together. Specifically, we test how many top-1 and top-5 retrieved identities are of the same gender, age and race, shown in Table 4. We can see that these retrieval models group people with similar gender, age and race together at chance of over 82%, much higher than the chance it selects the correct identity (which is 50.31%). As long as the retrieval selects the identities with the correct demographic attributes, RAA can be improve the demographic classification.
strategies and conduct ablation studies on various hyper- parameters. Hard voting, the simplest approach, involves voting on the predicted category and selecting the majority class. Given + predictions fi,' "
R+1
Σ 1[A())= = cc-
= arg max CEY
We also consider weighted soft voting, where we weighted sum the predicted probabilities from the k + 1 views (soft- max over logits) and use the category with the highest ag- gregated probability as the final prediction.
k++
i = arg MAX CE
where w) is the weight for prediction from view i As shown in Table 5, both hard and soft voting improve performance compared to the egocentric baselines. Hard voting generally yields better results for gender prediction, while soft vot- ing consistently outperforms across all three demographic attributes. Therefore, we adopt soft voting the default en- semble method. We further ablate the effect of the choice of w in the soft voting ensemble, as shown in Table 5. Specif- ically, we compare two approaches: assigning evenly dis- tributed weights (w *+1 and assigning a weight of 0.5 to the egocentric prediction (w = 0.5). We also ablate the effect of the in top-k retrieval in Figure 3, where
Gender
Age
Race
Top-1
Top-5
Top-1
Top-5
Top-1
Top-5
82.22
89.83
84,51
90.74
82.95
87.53
Table 4. Exo-to-cgo identity retrieval as demographic classifier.
Ablation study voting parameters. As discussed in Section 5.2, RAA retrieves the top & exocentric views to augment the egocentric view for prediction. Given these exocentric predictions and one egocentric prediction, an ensemble method required to effectively combine them into a final output. In this Section, we explore two ensemble
8

---

EgoPrivacy: What Your First-Person Camera Says About You?
leads to the optimal performance for Gender and Age. For Race, we observe that larger k leads to increasing performance.
attention
mlp
Gender
Ethnicity
77.5
75.0
Accuracy
72.5
Can privacy attacks remain effective against out-of- distribution samples? This question is practical, pri- vacy attacks often occur in real-world scenarios where in- distribution data is difficult to obtain. We use CharadesEgo as the OOD test set and evaluate all the attacker models described above, as presented in Table and Table We observe consistent performance drop on the OOD data for all fine-tuned models, whereas the zero-shot foundation model maintains its original performance. This indicates degree of overfitting during the fine-tuning stage and fur- ther underscores the privacy challenges inherent to egocen- tric videos: even with minimal attack capabilities (i.e.. a zero-shot foundation model), an adversary can still launch effective attacks across varying data distributions.
70.0
65
60
16
Num
76
Accurscy (ha
16 18 80
(E30)
Num of Frames
Num of Frames
Figure 4. Performance CLIP model with MIP,, RNN, and atten- tion head on Demographic Privacy.
mask ratio
0%
10%
30%
50%
70%
90%
Gender
Capability 4 As discussed Section 4.1, Capability 4 further assumes the ability of adversary to ascertain whether two egocentric videos share the same identity, therefore enabling ensemble the predictions over all the videos and infer the demographic attributes of the identity more effectively. We repeat the demographic privacy attacks of Table 2, but assume the additional Capability 4 of the ad- versary. We present the result in Appendix due to limited space. Equipped with Capability 4 despite an improved performance on Gender egocentric and all exocentric videos, the performance drops on the rest of the tasks, surprisingly.
Ego
Exo
Race
Egg
Table 7. Progressive masking of ego- and exo-video frames. sualize the attention of L.LVV when it makes the prediction in Table 6. To further understand which patches contribute most to the prediction of privacy properties, we introduce a progressive masking method that incrementally masks the most important patches, as shown in Table 7. We refer to Appendix D for details of this method. Both visualizations reveal that significant attention is given to the wearer's hand or other biometric markers.
What factors influence aftacker models? A preliminary comparison in Table 2 and Table 3 shows that EgoVLPv2 Fine-tuned consistently outperforms CLIP Fine-tuned, sug- gesting that temporal modeling aids adversaries in revealing private information. To investigate this effect, we evalu- ated models with MLP, Attention, and RNN layers atop the CLIP backbone, controlling for the number of parameters in each head. MLP layers map features to categories without temporal modeling, while Attention and RNN layers incor- porate temporal information (temporal position embedding in Attention and recurrent nature of RNN). As shown in Figure 4: (1) Increasing the number of frames improves performance (4 = 8), but saturates beyond or 16 frames; (2) Temporal modeling (Attention or RNN) consistently outperforms MLP. This effect is more pronouneed. These findings are further validated for Identity and Situational Privacy in Appendix F.
7. Conclusion
In this work, introduced EgoPrivacy, a multidimensional benchmark of privacy in egocentric computer vision. By exploring demographic, individual, and situational privacy issues, we demonstrated that privacy information about the camera wearer can be extracted from first-person video data, even with off-the-shelf models in zero-shot. We proposed a retrieval- aaggreetd attack, which further amplifies these threats by linking egocentric and exocentric footage of the same subjects. These results highlight the urgent need for -wrrcy-preserving techniques in wearable cameras. We hope EgoPrivacy will drive future research on safeguarding privacy in egocentric vision while maintaining its utility.
Age
Race
Ego
Ego
Ego
Exo
Table Attention Visualization LLaVa model. What leaks the privacy in the egocentric videos? We vi-
9

---

EgoPrivacy: What Your First-Person Camera Says About You?
Acknowledgments
Cansik. Yolo-hand-dettcttion. https: com/
cansik/yoll--hand-deeece--- 2020.
This work was partially funded by NSF awards IIS-2303153 and NAIRR-240300, the NVIDIA Academic grant, and a gift from Qualcomm. We also acknowledge the NRP Nautilus cluster, used for some of the experiments discussed above.
Cazzato, D., Leo, M.. Distante, C., and Voos, H. When i look into your eyes: survey on computer vision contributions for human gaze estimation and tracking. Sensors, 20(13): 3739, 2020.
Chakraborty, A., Mandal, B., and Galoogahi, H. K. Per- son re-identification using multiple tist-person-viess on wearable devices. In WACV, 2016.
Impact Statement
This research reveals a significant vulnerability in wear- able camera systems, demonstrating that egocentric privacy attacks can be effectively executed even using readily avail- able, unmodified models. Although the introduced privacy attack methods, such as RAA, are designed as red-teaming instruments aimed at enhancing privacy defenses, there ex- ists a concerning potential for their misuse in unauthorized mass surveillance. Consequently, our findings highlight an urgent need for the development and implementation of robust privacy safeguards and proactive intervention mecha- nisms to mitigate risks associated with wearable technology. Furthermore, as EgoPrivacy builds upon Ego-Exo4D and Charades- Egoo it inherits their imbalances in geographic, gender, ethnic, and age representation, which raise concerns about the fairness problem. This emphasizes the need for future efforts to curate more equitable datasets in egocentric vision and privacy research, which will be the next step of work.
Chen, J., Barath, D., Armeni, I., Pollefeys, M., and Blum, H. "where am i?" scene retrieval with language. In European Conference on Computer Vision, pp. 201-220. Springer, 2024.
Cheng, J., Dai, X., Wan, J., Antipa, N., and Vasconcelos, N. camera robust to
Learning a dynamic inversion attacks. In ECCV, 2024a.
Cheng, Z., Leng, S., Zhang, H., Xin, Y., Li, X., Chen, G., Zhu, Y., Zhang, W., Luo, Z., Zhao, D., et al. Videollama 2: Advancing spatial-temporal modeling and audio under- standing in video-Ilms. arXiv preprint #XXv:2406.004777 2024b.
Criminisi, A., Perez, P., and Toyama, K. Object removal by exemplar-based inpainting. CVPR, 2003.
Criminisi, A., Pérez, P., and Toyama, K. Region filling and object removal by exemplar-based image inpainting. IEEE Transactions on image processing (TIP), 13(9): 1200-1212, 2004.
References
Affi, M. 11k hands: gender recognition and biometric identification using a large dataset of hand images. Mul- timedia Tools and Applications, 78(15):20835-22 2019.
Del Molino, A. G., Tan, C., Lim, J.-H., and Tan, A.-H. Summarization of egocentric videos: A comprehensive survey. IEEE Transactions on -tahinnMachine Systems, 47(1):65-76. 2016.
Ardeshir, S. and Borji, A. Egocentric meets top-view. IEEE transactions on pattern analysis and machine intelligence (TPAMI), (1(6):1353-1333 1366, 2018a.
Deng, J.. Guo, J., Zhou, Y., Yu, J., Kotsia, and Zafeiriou, S. Retinaface: Single-stage dense face localisation in the wild, 2019. URL https: http::////axvvorrr/e org/ /bs/ 1905. 00641.
Ardeshir, S. and Borji, A. Integrating egocentric videos in top-view surveillance videos: Joint identification and temporal alignment. In ECCV, 2018b.
Betancourt, A., Morerio, P., Regazzoni, C. S., and Rauter- berg, M. The evolution first person vision methods: A survey. IEEE Transactions on Circuits and Systems for Video Technology (TCSVT), 25(5):744-760, 2015.
Dimiccoli, M., Marín, J., and Thomaz, E. Mitigating by- stander privacy concerns in egocentric activity recogni- tion with deep learning and intentional image degradation. ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies (IMWUT), 2018
Bitouk, D., Kumar, N., Dhillon, S., Belhumeur, P., and
Nayar, S. K. Face Swapping: Automatically Replacing Faces in Photographs. ACM Transactions Graphics (ToG), 2008.
Elfeki, M., Regmi, K., Ardeshir, S., and Borji, A. From third person to first person: Dataset and baselines for synthesis and retrieval. arXiv preprint arXiv:1812.00100 2018.
Bolanos, M., Dimiccoli, M., and Radeva, P. Toward sto- rytelling from visual lifelogging: An overview. JEEE Transactions on 2016.
Fang, A., Jose, A. M., Jain, A., Schmidt, L., Toshev, A., and Shankar, V. Data filtering networks. arXiv preprint arXiv:2309. 17425, 2023.
Systems, 47(1)777-90
10

---

EgoPrivacy: What Your First-Person Camera Says About You?
Farringdon, J. and Oni, V. Visual augmented memory (vam).
Gurari, D., Li, Q., Lin, C., Zhao, Y., Guo, A., Stangl, A., and Bigham, J. P. Vizwiz-priv: A dataset for recognizing the presence and purpose of private visual information in images taken by blind people. In CVPR, 2019.
In Digest of Papers. Fourth International Symposium Wearable Computers, pp. 167-168. IEEE, 2000.
Fathi, A., Hodgins, J. K., and Rehg, M. Social interactions: A first-person perspective. In CVPR, 2012.
Hasan, R., Shaffer, P., Crandall, D., Apu Kapadia, E. T., et al. Cartooning for enhanced privacy in lifelogging and streaming videos. In CVPR Workshops, pp. 29-38, 2017.
Fergnani, F., Alletto, S., Serra, G., De Mira, J., and Cue- chiara, R. Body part based re-identification from egocentric perspective. In CVPR Workshops, 2016.
Hinojosa, C., Niebles, J. C., and Arguello, H. Learning privacy-preserving optics for human pose estimation. In ICCV, 2021.
Grauman, K., Westbury, A., Byrne E., Chavis, Z., Furnari, A., Girdhar, R., Hamburger, J., Jiang, H., Liu, M., Liu, X., Martin, M.. Nagarajan, T.. Radosavovic, I., Ramakrish- nan, S. K., Ryan, F., Sharma, J., Wray, M., Xu, M., Xu, E. Z., Zhao, C., Bansal, S., Batra, D., Cartillier, V., Crane, S., Do, T., Doulaty, M.. Erapalli, A., Feichtenhofer, C., Fragomeni, A., Fu, Q., Gebreselasie, A., González, C.,, Hillis, J., Huang, X., Huang, Y., Jia, W., Khoo, W., Kolář, J. Kottur, S., Kumar, A., Landini, F., Li, C.,, Li, Y., Li, Z., Mangalam, K., Modhugu, R., Munro, J., Murrell, T., Nishiyasu, T., Price, W., Ruiz, P., Ramazanova, M., Sari, L., Somasundaram, K., Southerland, A., Sugano, Y., Tao, R., Vo, M., Wang, Y., Wu, X., Yagi, T., Zhao, Z.,, Zhu, Y., Arbeláez, P., Crandall, D., Damen, D., Farinella, G. M., Fuegen, C., Ghanem, B., Ithapu, V. K., Jawahar, C. V., Joo, H., Kitani, K., Li, H., Newcombe, R., Oliva, A., Park, H. S., Rehg. J. M., Sato, Y., Shi, J., Shou, M. Z., Torralba, A., Torresani, L., Yan, M., and Malik, J. Ego4d: Around the world in 3,000 hours of egocentric video. In CVPR, 2022.
Hinojosa, C., Marquez, M., Arguello, H., Adeli, E., Fei- Fei, L.., and Niebles, J. C. Privhar: Recognizing human actions from privacy-preserving lens. ECCV, 2022.
Hoshen, Y. and Peleg, S. An egocentric look at video pho- tographer identity. In CVPR, 2016.
Hoyle, R., Templeman, R., Armes, S., Anthony, D., Cran- dall, D., and Kapadia, A. Privacy behaviors of lifeloggers using wearable cameras. In Proceedings of the 2014 ACM international joint conference on pervasive and ubiqui- tous computing, pp. 571-58712 2014.
Hoyle, R., Templeman, R., Anthony, D., Crandall, D., and Kapadia, A. Sensitive Lifelogs: A Privacy Analysis of Photos from Wearable Cameras. In Conference on Human Factors in Computing Systems, 2015a.
Hoyle, R., Templeman, R., Anthony, D., Crandall, D., and Kapadia, A. Sensitive lifelogs: A privacy analysis of pho- tos from wearable cameras. In Proceedings of the 33rd Annual ACM conference on human factors in computing systems, pp. 1645-1648, 2015b.
Grauman, K., Westbury, A., Torresami, L., Kitani, K., Ma- lik, J., Afouras, T., Ashutosh, K., Baiyya, V., Bansal, S., Boote, B., Byrne, E., Chavis, Z., Chen, J., Cheng, F. Chu, F.J.,, Crane, S., Dasgupta, A., Dong, J., Escobar, M. Forigua, C., Gebreselasie, A., Haresh, S., Huang, J. Islam, M. M., Jain, S., Khirodkar, R., Kukreja, D., Liang, K. J., Liu, J., Majumder, S., Mao, Y., Martin, M., Mavroudi, E., Nagarajan, T., Ragusa, F., Ramakr- ishnan, S. K., Seminara, L., Somayazulu, A., Song, Y., Su, S., Xue, Z., Zhang, E., Zhang, J.. Castillo, A., Chen, C., Fu, X., Furuta, R., Gonzalez, C., Gupta, P., Hu, J., Huang, Y., Huang, Y., Khoo, W., Kumar, A., Kuo, R., Lakhavani, S., Liu, M., Luo, M., Luo, Z., Meredith, B., Miller, A., Oguntola, O.. Pan, X., Peng, P., Pramanick, S., Ramazanova, M., Ryan, F., Shan, W., Somasundaram, K., Song, C., Southerland, A., Tateno, M., Wang, H., Wang. Y., Yagi, T.. Yan, M.. Yang, X., Yu, Z.. Zha, S. C., Zhao, C., Zhao, Z., Zhu, Z., Zhuo, J., Arbelaez, P., Bertasius, G., Damen, D., Engel, J., Farinella, G. M., Furnari, A., Ghanem, B., Hoffman, J., Jawahar, C., Newcombe, R., Park, H. S., Rehg, J. M., Sato, Y., Savva, M., Shi, J.. Shou, M. Z., and Wray, M. Ego-exo4d: Understanding skilled human activity from first- and third- third-person perspectives. In CVPR, 2024.
Karkkainen, K. and Joo, J. Fairface: Face attribute dataset for balanced race, gender, and age for bias measurement and mitigation. In Proceedings of the IEEE/CVF Winter Conference Applications of Computer Vision, pp. 1548- 1558, 2021.
Khan, S. S., Yu, X., Mitra, K., Chandraker, M., and Pittaluga, F. Opencam: Lensless optical encryption camera. IEEE Transactions on Computational Imaging, 2024.
Khosla, P., Teterwak, P.,, Wang, C.. Sama, A., Tian, Y., Isola, P., Maschinot, A., Liu, C., and Krishnan, D. Supervised contrastive learning. NeurlPS, 2020.
Korayem, M., Templeman, R., Chen, D., Crandall, D., and
Kapadia, A. Enhancing lifelogging privacy by detecting screens. In Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems, pp. 4309 4314, 2016.

---

EgoPrivacy: What Your First-Person Camera Says About You?
Krishna, S., Little, G., Black, J., and Panchanathan, S. A wearable face recognition system for individuals with visual impairments. In Proceedings of the 7th interna- tional ACM SIGACCESS conference on Computers and accessibility, pp. 106-113, 113, 2005.
Nguyen, T.-H.-.., Nebel, J.-C., and Florez-Revuelta, F. Recognition of activities of daily living with egocentric vision: A review, Sensors, 16(1):72, 2016.
Oord, A. v. d., Li, Y., and Vinyals, O. Representation learn- ing with contrastive predictive coding. arXiv preprint urXiv:1877.0377 03744, 2018.
Li, Y., Nagarajan, T., Xiong, B., and Grauman, K. Ego-exo: Transferring visual representations from third-person to first-person videos. In CVPR, 2021.
Orekondy, T., Schiele, B., and Fritz, M. Towards a visual privacy advisor: Understanding and predicting privacy risks in images. ICCV, 2017.
Liu, G., Tang, H., Latapie, H., and Yan, Y. Exocentric to egocentric image generation via parallel generative adversarial network. In ICASSP, 2020.
Plizzari, C., Goletto, G., Furnari, A., Bansal, S., Ragusa, F, Farinella, G. M., Damen, D., and Tommasi, T. An outlook into the future of egocentric vision. International Journal of Computer Vision, pp. 1-57, 2024.
Liu, G., Tang, H., Latapie, H. M., Corso, J. J., and Yan, Y. Cross-view exocentric to egocentric video synthesis. In ACM International Conference on Multimedia, 2021.
Poleg, Y., Arora, C., and Peleg, S. Head motion signatures from egocentric videos. In ACCV, 2015.
Liu, H., Li, C., Wu, Q., and Lee, J. Visual instruction tun- ing. Advances in neural information processing systems, 36, 2024a.
Pramanick, S., Song, Y., Nag. S., Lin, K. Q., Shah, H., Shou, M. Z., Chellappa, R., and Zhang. P. Egovipv2: Egocentric video-language pre-training with fusion the backbone. In ICCV, 2023.
Liu, Z., Li, J., Xie, H., Li, P., Ge, J., Liu, S.-A., and Jin, G. Towards balanced alignment: Modal-enhanced semantic modeling for video moment retrieval. In AAAI, 2024b.
Price, B. A., Stuart, A., Calikli, G., Mccormick, C., Mehta, V., Hutton, L., Bandara, A. K., Levine, M., and Nuseibeh, B. Logging you, Logging me: A Replicable Study of Privacy and Sharing Behaviour in Groups of Visual Lifel- oggers. ACM on Interactive, Mobile, Wearable and Ubiq- uitous Technologies, 1(2):1-18, 2017.
Luo, D., Huang, J., Gong, S., Jin, H., and Liu, Y. Zero- shot video moment retrieval from frozen vision-language models. In Proceedings of the IEEE/CVF Winter Confer- ence on Applications of Computer Vision, pp. 5464-5473, 2024a.
Luo, H., Zhu, K., Zhai, W., and Cao, Y. Intention- driven ego-to-cxo video generation. arXiv preprint arXiv:2403.09194, 2024b.
Qiu, J., Lo, F. P.WW,, Gu, X., Jobarteh, M. L.,, Jia, W., Baranowski, T., Steiner-Asiedu, M., Anderson, A. K., McCrory, M. A., Sazonov, E., et al. Egocentric image captioning for privacy-preserved passive dietary intake monitoring. IEEE Transactions on Cybernetics, 54(2): 679-692, 2023.
Luo, M., Xue, Z., Dimakis, A., and Grauman, K. Put myself in your shoes: Lifting the egocentric perspective from exocentric videos. arXiv preprint arXiv:2403.06351, 2024c.
Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., al. Learning transferable visual models from natural language supervision. In ICML, 2021.
Mandal, B., Chia, S.-C., Li, Li, L., Chandrasekhar, V., Tan, C., and Lim, J.-H. A wearable face recognition system google glass for assisting social interactions. In ACCV Workshops, 2014.
Ren, Z., Lee, Y.J., and Ryoo, M. S. Learning to anonymize faces for privacy preserving action detection. ECCV, 2018.
Matkowski, W. M. and Kong, A. W. Gender and ethnicity classification based palmprint and palmar hand images from uncontrolled environment, In IJCB. IEEE, 2020.
Ryoo, M., Rothrock, B., Fleming, C., and Yang, H. J. Privacy-presse preserving human activity recognition from ex- treme low resolution. In AAAI, 2017.
Matkowski, W. M., Chai, T., and Kong, A. W. K. Palmprint recognition in uncontrolled and uncooperative environ- ment. IEEE Transactions on Information Forensics and Security (TIFS), 15:1601-16155 2019.
Sigurdsson, G. A., Gupta, A., Schmid, C., Farhadi, A., and Alahari, K. Actor and observer: Joint modeling of first and third-person videos. In CVPR, 201 8a.
Morgado, P., Vasconcelos, N., and Misra, Audio-visual instance discrimination with cross cross-modal modal agreement. In CVPR, 2021.
Sigurdsson, G. A., Gupta, A., Schmid, C., Farhadi, A., and Alahari, K. Charades-ego: large-scale dataset
12

---

EgoPrivacy: What Your First-Person Camera Says About You?
of paired third and first person videos. arXiv preprint 1804. 2018b.
Speciale, P., Schönberger, J. L., Kang, S. B., Sinha, S. N., and Pollefeys, M. Privacy Preserving Image-Bases Lo- calization. CVPR, 2019.
Templeman, R., Korayem, M., Crandall, D. J., and Kapadia, A. Placeavoider: Steering first-person cameras away from sensitive spaces. In NDSS, 2014.
Thapar, D., Arora, C., and Nigam, A. Is sharing of ego- centric video giving away your biometric signature? In ECCV, 2020a.
Thapar, D., Nigam, A., and Arora, C. Recognizing cam- era wearer from hand gestures in egocentric videos. In International Conference on Multimedia, 2020b.
Thapar, D., Nigam, A., and Arora, C. Anonymizing egocen- tric videos. In ICCV, 2021.
Thomas, C. and Kovashka, A. Sceing behind the camera: Identifying the authorship of a photograph. In CVPR, 2016.
Tong, Z., Song, Y., Wang, J., and Wang, Videomae: Masked autoencoders are data-efficient learners for self- supervised video pre-training. Advances in neural infor- mation processing systems, 15078-110099,, 2022.
Tsutsui, S., Fu, Y., and Crandall, J. Whose hand is this? person identification from egocentric hand gestures. In WACV, 2021.
Xu, J., Huang, Y., Hou, J., Chen, G., Zhang, Y., Feng, R., and Xie, W. Reurieeal-augmented egocentric video captioning. CVPR, 2024.
Yonetani, R., Kitani, K. M., and Sato, Y. Ego-surfing first- person videos. In CVPR, pp.
2015.
Yu, H., Cai, M., Liu, Y., and Lu, F. First-and third-person video co-analysis by learning spatial-temporrl joint atten- tion. IEEE Transactions Pattern Analysis and Machine Intelligence (TPAMI). 45(6):6631 0a0e6666316666,, 2020.
Zhang. N., Paluri, M.. Taigman, Y., Fergus, R., and Bourdev, L. Beyond frontal faces: Improving person recognition using multiple cues. In CVPR, 2015.
Zhao, Z. Wang, Y., and Wang, C. Fusing personal and environmental cues for identification and segmentation of first-person camera wearers in third-person views. In CVPR, 2024.
13

---

EgoPrivacy: What Your First-Person Camera Says About You?
A. Dataset
Gender
Race
Age
4.7%
1.1%
39.8%
38.1%
30.2%
48.9%
56.1 %
56.5%
5.4%
2.8%
60.2%
61.9%
65.2%
41.1%
45.7%
42.4%
ID
0OD
ID White
OOD
OOD
Male
Female
Young
Middle
Senior
Figure A.I. Distributions of demographic labels in EgoPrivacy (ID). and EgoPrivacy (OOD).
Data sources. We build our EgoPrivacy upon two prior datasets with egocentric and exocentric annotation-Fgo- Exo4D (Grauman et al., 2024) and Charades-Ego (Sigurdsson et al., 2018b). Ego-Exo4D comprises paired egocentric and exocentric videos capturing skilled activities performed by 740 participants across more than distinct scenes in cities worldwide. The dataset's diversity and extensive annotations enable privacy research an unprecedented scale, making this study feasible for the first time. In Ego-Exo4D, each recording contains with each take spanning 2.6 minutes average. The dataset released with labels of participant IDs associated with each video as well as self-reported demographies of some of the participants, making it an ideal candidate for studying privacy in egocentric vision. Ego-Exo4D dataset also provides redundant exocentric recordings, where each egocentric video is paired exocentric view footage. Following the official dataset split, each participant is assigned exclusively to one of the train/val/test sets, preventing leakage of identity or demographic information in learning the attack models. The other dataset we adopt for EgoPrivacy is the Charades-Fgo dataset. Charades-Fgo is dataset featuring 7,860 videos of daily indoor activities recorded from both third-person and first-person perspectives, comprising 68,536 temporal annotations across 157 action classes. Both videos possess paired egocentric and exocentric videos fulfilling the first requirement. To further satisfy the second requirement, we undergo annotation process to label each identity of its gender, race and age. We note here that both the Ego-Exo4D and Charades-Egs dataset comes with identity labels. This is beneficial as it can reduce not only the annotation for identity but also the annotation cost of demographics for each video (since we can now annotate at the identity level).
multiple trials ("takes") of an activity,
Annotation Process. All videos and participant data used this study come from publicly released datasets where participants consented data collection. For participants who did not voluntarily disclose demographic information, we use crowd-sourced annotations of perceived attributes based their video appearances. We employ Amazon Mechanical Turk for demographic annotation. For each identity, we display 3 to (depending on the availability) exocentric videos to the annotator and request the annotator to answer three multi-choice questions regarding gender, race and age respectively. For each identity, we hire five Turker to annotate and filter any annotation with confidence less than 80%. These perceived demographics do not necessarily reflect individuals' self-identities. All collected data are used solely for academic research on privacy risks in egocentric vision, and we take measures to safeguard the confidentiality of participant information.
B. Identity-level Privacy Attacks (Capability 4
We repeat the demographic privacy attacks of Table 2, but assume the additional capability 4 of attackers, i.e. the ability to ascertain whether two egocentric videos share the same identity. We expect the attacker to further improve the attack performance with this extra information, which is the case for gender egocentric and all exocentric videos, as shown in Table B.I. However, the performance on egocentric age and race surprisingly drops.
C. Justification of Threat Model Capabilities
We discuss capabilities 3 and 4 and justify their necessity by illustrating their relevance to real-world scenarios. For capability 3) consider a case where the target individual student who shares egocentric videos online, and an adversary
14

---

EgoPrivacy: What Your First-Person Camera Says About You?
What the genser the person deptcted the wideos?
Fanale Mal Linaa
2. What the race of the person depicted in videcs?
Please give rough astimaation age person depicted videos. Feel free select "Unaure" you dificcat to
Figure A.2. Amazon Mechanical Turk web user interface for demographic annotation.
000 (Chandees-BB Egos
Capability
Gender
race:
Age
Exo
Epo
RAA O
Exo
Ego
RAA 3
Eso
RAA <+ 3
Chance
50.00
x
84:97
62.17
71.25
9.39
62.84
59.17
62.13
2,56
73.01
67.63
73.99
6.36
CLIP
76.19
69.54
77.59
8.05
75.68
70.41
72.19
5.38
1.78
54.65
74.34
76.30
82.08
5.78
V2
3
78.06
89.54
71.84
55.32
68.02
77.57
12,70
5.73
77.30
37.00
61.77
72.19
73.54
78.70
11.77
6.51
29.20
73.00
78.00
28.30
28.57
78.03
0.37
0.00
L1a
x 92.71
71.43
71.26
77.59
6.16
67.55
72.33
52.90
56.50
13.60
79.61
52.88
37.48
41.48
4,00
1.16
LLaVA 15
x
97:39
67.24
74.14
6.50
70.95
59.76
64.50
4.74
78.95
64..22
76.88
16.76
95.35
71.43
73.55
7.33
70.24
52.69
52.42
9.73
52.85
36.72
42.38
5.66
90:46
77.03
x
72. 56
27.01
6.58
LaMeoL
X
98.04
72:41
83.33
10.92
72.97
63.91
71.60
7.69
60.25
76.30
82.08
5.78
95.33
74.54
79.00
5.36
77.90
68.22
70.35
2.13
57.01
33.68
47.09
13.32
Table B.I. Results on Demographic Privacy. Accuracy is calculated on per-identity basis with the assumption of capability ④
pervasive: here, the target posts multiple egocentric videos on social media, allowing adversary to infer that all videos associated with the same account belong to a single individual. The objective of the adversary is then, given all the egocentric videos in the same account, infer the privacy attributes and information of the account owner. These examples highlight the practical relevance and necessity of these capabilities within our threat model.
gains access to surveillance cameras in public areas of the student's school. Capability 4 is
D. Details of Progressive Masking Method
In order to explore what features exactly in the video and frames that leaks the privacy information. We derive progressive masking method that incrementally masks the most important patches. Specifically, we initialize a mask with values between and and perform gradient ascent on the mask with respect to the privacy property prediction loss. By gradually increasing the number of masked patches and employing early stopping once predefined threshold reached, we constrain the masking process to reveal the patches most critical to the model's decision.
E. Biometric Classifier
For the hand-basd based model, we trained ResNet50 classifier on the publicly available 11K Hands dataset (Afifi, 2019), which contains gender and age labels (but lacks annotation). During inference, hand regions first detected and cropped from egocentric video frames using YOLO-based hand detection model (Cansik, 2020). The resulting hand crops were then passed to the trained ResNet50 classifier to predict demographic attributes. To aggregate predictions across multiple hand regions, we applied majority voting.
For the face-based model, we employed the FairFace model, pretrained on the FairFace dataset (Karkkainen & Joo, 2021). together with RetinaFace for robust face detection (Deng et al., 2019). Faces were detected and cropped from exocentric video frames using RetinaFace, after which the cropped images were input to the FairFace model to predict demographic attributes such as gender and age. As shown the second section of Table 2, these biometric methods perform substantially worse than even the zero-shot foundation model, likely due to a pronounced distribution gap between the small, curated
15

---

EgoPrivacy: What Your First-Person Camera Says About You?
datasets (hand/palm and face images) used for training and the more diverse, in-the-wild images in EgoPrivacy.
F. Effect of Temporal Modeling in Identity and Situational Privacy
We validate the observation in Section 6.2 that temporal modeling is effective for adversary to reveal egocentric privacy, as shown in Figure F.1
mip
:igo
Ego-Exo
78
Scene
HB0 1450
23.0
Num Frames
Num of frames
Figure F.1. Performance of Clip model with mlp, mn and attention head on Identity and Situational Privacy.
16


Reviews:
[{"review_id": "GDfuWZdbQM", "reviewer": "Reviewer_DYc1", "summary": "This paper introduces EgoPrivacy, a benchmark and study on the privacy risks associated with egocentric (first-person) videos, revealing that substantial personal information about the camera wearer—such as demographics (gender, race, age), identity, and location/time—can be inferred even when the wearer’s face is not visible. The authors propose a novel Retrieval-Augmented Attack (RAA) that boosts privacy attacks by retrieving matching exocentric (third-person) videos, significantly improving inference accuracy. Through experiments with both zero-shot and fine-tuned models (like CLIP, LLaVA, and EgoVLPv2), they show that even minimal attacker capabilities can lead to effective privacy breaches, raising serious concerns about the use of wearable cameras and highlighting the urgent need for privacy-preserving approaches in egocentric vision.\n\n### update after rebuttal\n\nI have raised my score.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "```>>> Q1``` Calculation of random accuracy\n\n```>>> A1``` Thank you for the insightful question. We present the prior accuracy \n\n|               | Variant | Gender |        |       | Race   |        |       | Age    |        |       | \n|---------------|---------|--------|-------|-------|--------|-------|-------|--------|-------|-------|\n|               |        | Exo    | Ego   | RAA   | Exo    | Ego   | RAA   | Exo    | Ego   | RAA   |\n| Random Chance |        | 50.00  |       |       | 33.33  |       |       | 33.33  |       |       |\n|  Priored      |       | 60.74      |       |       | 54.17      |       |       | 79.48      |       |       |\n| **Zero-shot (ID)**|        |       |       |        |       |       |        |       |       |\n| CLIP (DFN)    |ViT-H/14| 78.64  | 57.89  | 67.35  | 60.04  | 45.21  | 60.98  | 73.51  | 72.02  | 76.23  |\n| SigLIP       |S0400M/14| 84.01  | 57.63  | 70.56  | 65.46  | 54.97  | 66.27  | 72.90  | 68.25  | 78.03  |\n| LLaVA-1.5     | 7B     | 91.52  | 66.90  | 77.16  | 60.06  | 57.34  | 57.52  | 79.29  | 79.46  | 79.55  |\n| Video-LLaMA2  | 7B     | 90.96  | 73.15  | 79.48  | 71.53  | 53.97  | 69.10  | 52.99  | 47.08  | 56.14  |\n|               | 72B    | 91.59  | 70.03  | 78.41  | 69.25  | 65.36  | 67.82  | 82.46  | 79.64  | 81.62  |\n|**Fine-tuned (ID)**|    |        |        |        |        |        |            |        |        |\n| CLIP (DFN)    |ViT-H/14| 88.33  | 68.87  | 76.98  | 73.93  | 70.92  | 71.92  | 77.15  | 79.73  | 79.73  |\n| EgoVLP v2     | 7B     | 84.85  | 71.81  | 77.88  | 71.46  | 72.01  | 75.57  | 77.11  | 80.72  | 81.88  |\n| VideoMAE      |ViT-B/14| 72.42  | 63.69  | 70.65  | 75.16  | 66.73  | 73.49  | 78.21  | 79.73  | 81.70  |\n|               |ViT-T/14| 87.14  | 63.87  | 78.95  | 74.36  | 70.10  | 72.65  | 77.15  | 79.73  | 79.73  |\n\nHowever, imbalance also poses challenges during training. Thus, we also perform additional studies that merge / remove the extremely imbalance category in the age / race demongraphic attacks. Specifically, we merge the old with the middle age in age and remove the black in the race, as these two categories are extremely minority in the dataset. We present additional results below:\n|               | Variant | Race   |        |       | Age    |        |       | \n|---------------|--------|--------|-------|-------|--------|-------|-------|\n|               |        | Exo    | Ego   | RAA   | Exo    | Ego   | RAA   | Exo    | Ego   | RAA   |\n| Random Chance |        | 50.00  |       |       | 33.33  |       |       | 33.33  |       |       |\n| Priored      |        | 55.93      |       |       | 79.48      |       |       | -      |       |       |\n| **Zero-shot (ID)**|        |       |       |        |       |       |        |       |       |\n| LLaVA-1.5     | 7B     |61.93|58.60|68.22|80.10|80.47|81.56|\n| Video-LLaMA2  | 13B    |71.53|53.97|69.10|52.99|47.09|56.14|   |  |\n| **Fine-tuned (ID)**|     |       |       |        |       |       |\n| CLIP (DFN)    | ViT-H/14|69.06|67.91|69.37|76.04|79.73|79.91|\n| EgoVLP v2     | 7B     |64.90|65.36|69.28|76.03|78.65|79.91|\n\nIn general, we observe that gender and race attacks outperform prior accuracy by large margins, while the improvement of age attacks is less significant due to heavy imbalance in age demographics. We leave for future work the collection of more balanced egocentric video datasets for an unbiased evaluation of demographic privacy.", "claims_and_evidence": "All claims are well supported.", "methods_and_evaluation_criteria": "Yes.", "theoretical_claims": "N/A", "experimental_designs_or_analyses": "### Calculation of Random Accuracy \n\nThe authors claim that the random accuracy for predicting race is 33.3%. However, the distribution of the demographic is unbalanced per the appendix.", "relation_to_broader_scientific_literature": "The paper builds meaningfully on prior work in visual privacy and egocentric vision by addressing gaps left by earlier datasets and studies. While prior egocentric datasets like FPSI and EVPR were limited in scale and scope, this work introduces a large-scale, richly annotated benchmark (EgoPrivacy) that uniquely targets privacy risks faced by the camera wearer. It builds on prior work by contributing a structured taxonomy of privacy types—demographic, individual, and situational—that had not been comprehensively studied together. The proposed Retrieval-Augmented Attack also builds on cross-view retrieval work (e.g., Elfeki et al., 2018), but repurposes it to demonstrate novel privacy vulnerabilities.", "essential_references_not_discussed": "N/A", "other_strengths_and_weaknesses": "N/A", "other_comments_or_suggestions": "Missing Appendix letter (line 437)", "questions_for_authors": "1- Can the authors clarify the issue with random accuracy and then update the results and discussion if necessary? \n\n\nOverall, the work is novel and well motivated. I will update my score upon addressing the critical issue above.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "vIfDPbqOi5", "reviewer": "Reviewer_iyPv", "summary": "This paper investigates the privacy risks associated with egocentric videos. In particular, the authors introduce EgoPrivacy, a large-scale benchmark to evaluate privacy vulnerabilities across three axes: demographic privacy (gender, race, age), individual privacy (identity re-identification), and situational privacy (time and location). They further propose a novel Retrieval-Augmented Attack method, which boosts demographic attribute inference by retrieving relevant exocentric video footage associated with the egocentric clip. The paper evaluates zero-shot and fine-tuned models (CLIP, LLaVA, VideoMAE, and EgoVLPv2) on the proposed benchmark. The benchmark and findings are intended as red-teaming tools to inform and stimulate future privacy-preserving methods for egocentric vision.", "questions": "", "limitations": "", "rating": 1, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "```>>> Q1``` Although the authors effectively demonstrate demographic leakage using general-purpose foundation models (e.g., CLIP, LLaVA), the reported performance likely underestimates the actual privacy risks.  \n```>>> A1```  Thanks for the suggestion. While models tailored to privacy attacks may have an advantage, there's a significant gap between datasets used for facial attribute prediction—typically high-quality, cropped facial images (e.g., CelebA, UTKFace, FairFace)—and EgoPrivacy, which uses raw, distant egocentric video (see [image](https://bashify.io/i/fQwScK) left). *We argue that SOTA models perform well in ideal conditions, but their metrics aren't directly comparable to results on EgoPrivacy.*\n\nWe also agree that current vision-language foundation models, despite performing surprisingly well, aren’t optimized for egocentric privacy tasks. Their performance could improve with more egocentric training data. This motivates our benchmark: to drive research, enable objective progress tracking, and advance attack and defense methods in the egocentric privacy domain.\n\n```>>> Q2``` For egocentric classification, the authors do not explore hand-based biometric models.  \n```>>> A2``` Just as exocentric video frames with faces do not resemble images from high-quality facial attribute datasets (see A1 above), the distribution gap between hand/palmprint identification data and egocentric videos is even more dramatic, as shown in [image](https://bashify.io/i/fQwScK) (right). The vast majority of egocentric video frames do not show clear pictures of the hands of the camera wearer; even those that do tend to show the back of hands from first-person view, which contains far less identifiable information than the palm. This makes it very challenging to apply hand biometric methods to egocentric privacy tasks directly without nontrivial modifications or retraining. We will include a thorough discussion of specialized approaches to egocentric privacy attacks in the final version of the paper, as well as empirical comparisons to hand-based baselines.\n\nRegarding additional baselines in exocentric (face-based) and egocentric (hand-based), we have invested effort to reproduce the results of the suggested papers on our benchmark. However, due to the limited time and computation, as well as the unavailability of pretrained models in public and the scale of our evaluation set (over 5000 exo- and ego videos), we are unable to offer results at the moment, but hopeful can share results during the discussion phase and final version of the paper.\n\n```>>> Q3``` Limited novelty in terms of data collection.  \n```>>> A3``` While we do repurpose Ego-Exo4D and Charades-Ego dataset for egocentric privacy, additional effort has been made on the annotation of demographic labels, on an unprecedented scale, which is a nontrivial task. This annotation further facilitates the significant research on the egocentric privacy that has received limited attention in prior egocentric vision literature.\n\n```>>> Q4``` The proposed Retrieval-Augmented Attack (RAA) closely resembles earlier cross-view retrieval methods, such as those by Fan et al. (2017) and Ardeshir et al. (2018), and does not introduce significant algorithmic innovation.   \n```>>> A4``` Thank you for your comment. As discussed in Section 2, \"Related Work on Egocentric Person Identification,\" we acknowledge the contributions of earlier cross-view retrieval methods [1, 2, 3, 4]. However, previous work has largely overlooked the impact they have on the demographic privacy of camera users, i.e. how cross-view retrieval techniques might facilitate security breaches of egocentric demographic privacy, which is the primary focus of our study.\n\nFor instance, [1, 2] focus on identifying first-person camera wearers in third-person videos, but they do not explore the potential of these methods in enhancing demographic attacks. Similarly, [3] investigates cross-view techniques for retrieving motion features, while [4] uses cross-view retrieval to improve action and motion captioning at the semantic level, neither of which are designed with privacy concerns in mind. In the final version of the paper, we will include a more detailed discussion of the novelty of RAA in relation to these prior works.\n\n[1] Fan, Chenyou, et al. \"Identifying first-person camera wearers in third-person videos.\" Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. 2017.\n[2] Elfeki, Mohamed, et al. \"From third person to first person: Dataset and baselines for synthesis and retrieval.\" arXiv preprint arXiv:1812.00104 (2018).\n[3] Ardeshir, Shervin, Krishna Regmi, and Ali Borji. \"Egotransfer: Transferring motion across egocentric and exocentric domains using deep neural networks.\" arXiv preprint arXiv:1612.05836 (2016).\n[4] Xu, Jilan, et al. \"Retrieval-augmented egocentric video captioning.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024.", "claims_and_evidence": "**EgoPrivacy Benchmark**\n\nThe paper introduces EgoPrivacy, the first large-scale benchmark explicitly designed to evaluate privacy risks in egocentric video across demographic, individual, and situational dimensions. This contribution is well-supported: EgoPrivacy is constructed from two large datasets—Ego-Exo4D and Charades-Ego—and annotated for demographic attributes (gender, race, age), individual identity, and situational context (location and moment). The benchmark includes seven tasks, framed as classification and retrieval problems, to comprehensively assess these privacy risks.\n\n**Benchmark Evaluation**\n\nThe paper offers a thorough empirical evaluation of the EgoPrivacy benchmark, revealing notable privacy vulnerabilities in egocentric video data. This claim is moderately well-supported: Although experimental results do show that general-purpose foundation models can reliably infer demographic, identity, and situational attributes at rates well above chance, the reported performance likely underestimates real privacy risks, as SoTA models specialized for these tasks would likely achieve significantly higher accuracy.\n\n**Retrieval-Augmented Attack**\n\nThe paper proposes a novel privacy attack that leverages ego-to-exo retrieval augmentation to enhance demographic inference. This contribution is well-supported: Augmenting predictions with exocentric views significantly improves demographic classification performance across multiple models.", "methods_and_evaluation_criteria": "**Benchmark**\n\nThe data collection strategy is appropriate and well-grounded. The authors utilize two large-scale egocentric datasets—Ego-Exo4D and Charades-Ego—as sources of raw video data. To support demographic analysis, they augment these datasets, where necessary, with additional annotations via Amazon Mechanical Turk. The suite of proposed privacy tasks is well-motivated and reflects real-world concerns: demographic attribute classification (gender, race, age), identity re-identification, and situational inference (time and location prediction). These tasks collectively provide a comprehensive framework for evaluating wearer-centric privacy risks in egocentric video.\n\n**Retrieval-Augmented Attack (RAA)**\n\nThe threat model for the RAA is well-founded, as an attacker could plausibly exploit both egocentric and exocentric videos to carry out a privacy attack.", "theoretical_claims": "The paper does not present any theoretical claims.", "experimental_designs_or_analyses": "The experimental evaluation of the benchmark, while suggestive, is incomplete. Although the authors effectively demonstrate demographic leakage using general-purpose foundation models (e.g., CLIP, LLaVA), the reported performance likely underestimates the actual privacy risks.\n\nNotably, exocentric classification results (e.g., ~90% accuracy for gender, ~75% for race) fall significantly below the ceiling performance of task-specific state-of-the-art models, which routinely exceed 98% for gender and 90–95% for race and age (e.g., FairFace, DEX).\n\nLikewise, for egocentric classification, the authors do not explore hand-based biometric models, despite their relevance for predicting demographic and identity attributes in the absence of facial visibility. Prior work in biometric vision has demonstrated that hands carry sufficient cues to support identity and demographic inference with high accuracy (Matkowski et al., 2019), (Matkowski et al., 2020)\n\nSeveral publicly available datasets could be leveraged to develop stronger baseline models or better contextualize the benchmark's difficulty:\n\n- **PolyU-IITD-v3:** ~12k hand images with identity and ethnicity labels\n- **11K Hands:** ~11k hand images annotated with identity, age, gender, and ethnicity\n- **NTU-PI-v1:** ~8k palm and dorsal hand images with identity, age, gender, and ethnicity labels\n- **CASIA:** ~5.5k hand images labeled with identity\n\nIncorporating hand-based SoTA models or at least referencing their performance as upper bounds would strengthen the benchmark's credibility and offer a clearer picture of the limits of wearer privacy in egocentric settings.", "relation_to_broader_scientific_literature": "The paper sits at the intersection of computer vision, privacy, and egocentric video analysis, and introduces the first large-scale benchmark specifically designed to evaluate wearer-centric privacy risks across both egocentric and exocentric perspectives.", "essential_references_not_discussed": "References to hand-based biometric models and datasets are missing. See **Experimental Designs Or Analyses** section.", "other_strengths_and_weaknesses": "Aside from the demographic annotations added to Charades-Ego, the benchmark primarily repurposes existing datasets (Ego-Exo4D and Charades-Ego), and thus offers limited novelty in terms of data collection. The core insight—that identity and demographic information can be extracted from egocentric video—is not particularly surprising, especially given prior work showing that such attributes can be inferred from hand images alone. The proposed Retrieval-Augmented Attack (RAA) closely resembles earlier cross-view retrieval methods, such as those by Fan et al. (2017) and Ardeshir et al. (2018), and does not introduce significant algorithmic innovation. Finally, the benchmark evaluation is not thoroughly conducted: it primarily relies on general-purpose models for the privacy attacks, rather than leveraging state-of-the-art models specifically trained for demographic or identity recognition, which would offer a stronger and more realistic assessment of privacy risks.", "other_comments_or_suggestions": "NA", "questions_for_authors": "NA", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "q9KL1cMAT4", "reviewer": "Reviewer_i91u", "summary": "This paper examines the privacy implications of first-person (egocentric) video data, highlighting how demographic, individual, and situational information (e.g., age, identity, or time/location) may be inferred by combining egocentric footage with external exocentric (third-person) data. \n\nThe authors propose a new benchmark, “EgoPrivacy,” to systematically measure privacy leakage across various tasks, and introduce a method called Retrieval-Augmented Attack (RAA). In essence, they learn an embedding for cross-view retrieval:\n$$\ns\\bigl(x^E, x^X\\bigr) = \\langle g(x^E), g'(x^X)\\rangle,\n$$\nwhere $x^E$ is an egocentric video clip, $x^X$ is an exocentric clip, and $g, g'$ are learned transformations. \n\nBy finding exocentric clips that match an egocentric query, the method can enhance classification-based inferences (e.g., recognizing a camera wearer’s demographic attributes) through an aggregator that fuses outputs of both egocentric and exocentric predictions. The paper reports improved accuracy and retrieval hit rates on tasks such as demographic classification and identity/scene retrieval, arguing that egocentric data can expose more sensitive information than expected.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "```>>> Q1``` Theoretical guarantees or formal proofs of retrieval Bound\n\n```>>> A1``` \nThanks for the insightful comment. This paper indeed focuses more on empirical evidence of egocentric privacy risks, where measured by *hit rate* among top $K$ retrievals. This means we do *not* predefine thresholds for matching videos of the same identity, but use the k-th largest score among the candidate examples as an adaptive threshold. This implies a larger threshold as the number of idendidites in the test set increase, and hence a lower hit rate (equivalently, higher probability of false matches).\n\nConcretely, assuming a retrieval setting with $N$ individuals and $M$ candidate examples per identity, the chance-level hit rate @ $K$ is given by \n$$\\textrm{HR}_\\textrm{chance}@K = 1 - \\frac{\\binom{M(N-1)}{K}}{\\binom{MN-1}{K}}.$$\nThis approaches $1 - (1 - \\frac{1}{N})^K$ when $M$ is large and $\\frac{K}{N}$ when $N \\gg K$, as is usually the case for large-scale datasets.\n\n\n```>>> Q2``` How do false matches (collisions) impact method performance after aggregation? False-Match Considerations: Do you have any observations on how often RAA might retrieve irrelevant exocentric videos when the embedding space has many visually similar but semantically mismatched samples?\n\n```>>> A2``` Great question! Yes, it is entirely possible that RAA may be misled by false positives in retrieval. The retriever used in RAA is based on the ego-exo retrieval model from EgoVLP v2. As shown in Table 3, this model achieves a 50.31% HR@1 and 66.82% HR@5. However, we empirically find that this relatively low retrieval rate does not significantly impact the demographic prediction accuracy, as discussed in the second paragraph of the \"Effectiveness of RAA\" section (Section 6.2).\n\nDespite the lower retrieval accuracy, RAA still enhances the attack's effectiveness. We hypothesize in L376-427 that even with imperfect retrieval, the process helps cluster and group identities with similar demographics (such as gender, age, and race) closer in its learned embedding space. This is evidenced in Table 4, where, despite a 50% retrieval accuracy, 82.22%, 84.51%, and 82.95% of the top-1 retrieved exo-videos share the same gender, age, and race as the ego-video, respectively. This suggests that even negative retrievals can *benefit* RAA if they are semantically close to the query.\n\n\n```>>> Q3``` Minor typographical error at line 437 in the main text.\n\n```>>> A3``` Thank you for pointing this out. We will revise the paper and fix this typographical error.\n\n```>>> Q4``` What is the aggregation mechanism?\n\n```>>> A4``` Thanks for this good question. In fact, we explore various aggregation mechanisms in Appendix B and Figure 6. The default mechanism involves a weighted sum of both the ego and exo predictions (referred to as soft voting), where the ego weight is set to 0.5, and the remaining 0.5 is evenly distributed across the exo predictions. In addition to this, we also examine hard voting (direct majority voting) and soft voting with equal weights assigned to all predictions. Our experiments show that, overall, soft voting with \n𝑤=0.5 yields the best performance, improving all three demographic tasks consistently compared to the ego-only baseline (denoted by the dashed line).\n\nAdditionally, we investigate the impact of varying the number of top-k retrieved exo-predictions used in RAA. Our findings reveal that there is a key pivot point around \n𝑘=3 or 𝑘=5, beyond which increasing k does not improve performance. This is because additional retrieved exo-views often introduce noise due to their potential inaccuracy. We also perform an ablation study on the role of the ego prediction in RAA, showing that including the ego prediction generally enhances the attack's effectiveness. We also experiment with using the retrieved similarity as a confidence measure to weigh each prediction, however, this empirically fial to improv over even the majority voting.", "claims_and_evidence": "The main claim is that first-person video alone reveals sensitive information about the camera wearer—specifically demographics (age, gender, race), unique identity (via a retrieval task), and situational context (scene or moment in time). Evidence is shown by comparing baseline classifiers (or retrieval models) to the new RAA approach on tasks like:\n\n1. **Demographic Privacy**: predicting a wearer’s attributes from short egocentric clips.\n2. **Individual Privacy**: retrieving the same user’s other egocentric or exocentric clips.\n3. **Situational Privacy**: identifying which place or time segment a clip belongs to by matching with exocentric footage.\n\nReported numbers exceed random-chance baselines. In classification tasks, accuracy improves once the external exocentric data is leveraged via:\n$$\nf^{\\mathrm{RAA}}\\bigl(x^E\\bigr) = \\mathcal{A}\\Bigl(\n   f \\bigl(x^E\\bigr),\n   \\{ f'(x^X)\\}_{x^X  \\in \\text{top-}k \\text{retrievals}}\n\\Bigr).\n$$\nThe authors display performance gains when the aggregator combines predictions from both egocentric and exocentric sources. These empirical findings appear coherent with their overall contention that first-person data, especially when matched to exocentric footage, can substantially reveal private information.", "methods_and_evaluation_criteria": "The work sets up multiple classification and retrieval tasks on the authors’ new benchmark, EgoPrivacy, which combines labeled egocentric-exocentric pairs from different sources. Classification accuracy and retrieval hit rates (HR@k) are the key metrics for privacy “attacks”.  \n\nDefining classification-based tasks for demographics, along with retrieval-based tasks for identity or situational context, matches the privacy categories described. The aggregator function itself is not elaborated in detail regarding weighting or potential variations, but the main idea follows standard voting or ensemble approaches and is shown to yield a quantitative boost in identifying private attributes.", "theoretical_claims": "There are no extensive derivations or formal proofs regarding the retrieval process or classification bounds. The authors primarily rely on empirical demonstrations and do not present additional materials that formally analyze potential retrieval mismatches or performance guarantees.\n\nWithout more formal exploration of retrieval accuracy, one might question how robust the method is to large-scale collisions in the space of embeddings:\n$$\n\\langle g(x^E), g'(x^X)\\rangle >\\delta.\n$$\nThe paper does not provide a separate proof or theoretical section addressing these concerns. However, the experimental evidence still suggests that in practice, the method succeeds at matching relevant exocentric clips for the tasks at hand.", "experimental_designs_or_analyses": "The paper’s experiments cover zero-shot usage of large pretrained models (e.g., CLIP) versus fine-tuned models, and finally show that supplementing with cross-view retrieval (RAA) can further heighten the privacy leakage metrics. The evaluation on multiple tasks (demographic classification, identity retrieval, location/time retrieval) is displayed with tables comparing results from these different approaches.\n\nThe design is clear, and the tables illustrate how the RAA method surpasses baseline performance. The authors also compare results across different model architectures (Vision Transformers, specialized egocentric models, etc.). That said, there is little discussion of possible embeddings that fail to find meaningful matches, or of whether the aggregator function might occasionally be misled by false matches (though the final numbers still reflect improved average success).", "relation_to_broader_scientific_literature": "The paper draws on established techniques of cross-view retrieval, person re-identification, and multi-modal vision-language modeling. It merges these techniques to focus on wearer-centric privacy leakage. The authors refer to prior references dealing with first-person privacy concerns and cross-modal retrieval, indicating that they build on known frameworks while extending them in the context of privacy threat modeling.", "essential_references_not_discussed": "No specific omitted references stand out as critical. The authors cite a variety of prior works about egocentric data and privacy, as well as multi-modal retrieval strategies. Most fundamental ideas from cross-view embedding and large-scale pretrained vision models are mentioned.", "other_strengths_and_weaknesses": "- **Strength**: The paper addresses a focused set of privacy tasks with consistent metrics, demonstrating that even off-the-shelf large pretrained models—when paired with cross-view retrieval—can significantly reveal personal attributes from seemingly “private” first-person footage. This underscores the potential privacy threat in a straightforward manner.  \n- **Weakness**: The authors do not delve into an analytical framework for explaining how often retrieval collisions or false matches might occur in large datasets. One could write a probability-based expression for unintended collisions\n  $$\n  \\mathrm{Pr}\\bigl(\\langle g(x^E), g'(x^X)\\rangle > \\delta\\bigr)\n  $$\n  in the presence of many extraneous $x^X$ samples, but the paper remains mostly empirical. Nevertheless, the reported experiments indicate robust performance in the tested scenarios.", "other_comments_or_suggestions": "I have no additional remarks regarding clarity or style. The overall presentation is straightforward, and the major claims are supported by numerical results.\nTypographical Note: There appears to be a minor typographical error at line 437 in the main text (“Apeendix??”).", "questions_for_authors": "1. **Exact Aggregation Mechanism**  \n   - How precisely is the aggregator $\\mathcal{A}$ combining predictions from $f(x^E)$ and those from the retrieved exocentric clips $\\{f'(x_i^X)\\}$? Is it a simple average, or are there confidence-based weights?\n\n2. **False-Match Considerations**  \n   - Do you have any observations on how often RAA might retrieve irrelevant exocentric videos when the embedding space has many visually similar but semantically mismatched samples?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "V0ZjQZvoxx", "reviewer": "Reviewer_Laqt", "summary": "This paper addresses the privacy risks associated with egocentric video and introduces EgoPrivacy, a new benchmark for evaluating privacy in egocentric computer vision. The authors categorize privacy risks into three types: demographic, individual, and situational privacy. Their study demonstrates that private information about the camera wearer can be extracted, highlighting serious concerns. Additionally, the paper proposes a enhanced way of privacy attack called Retrieval-Augmented Attack (RAA), which leverages an external pool of exocentric data to enhance privacy retrieval from egocentric data, further intensifying privacy risks.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "```>>> Q1``` I would also like to see a short discussion on potential mitigation strategies to counteract this type of privacy attack, based on the insights gained from these experiments.\n\n```>>> A1``` This is a great suggestion. While we intend to leave the study of privacy risk mitigation for future research, we will include additional discussion on the potential direction to solving this problem. First, we expect methods designed to protect third-person privacy (e.g., face blurring [1]) to be less effectve, as it does not address the privacy of camera wearer. Second, segmenting and obfuscating body parts (e.g., hand and feet) can reduce privacy risk, but also  makes utility tasks such as egocentric action recognition much harder. As such, an adaptive method for processing the egocentric vidoes is needed for the optimal trade-off between privacy and utility. \n\nIn addition to the post-hoc techniques for software-level privacy preservation, another promising direction is to design cameras that can achieve hardware-level privacy-preservation, which further eliminate the privacy risk caused by the leak of raw camera measurements. The concept of privacy-preserving cameras has attracted attentions in the community [2,3,4], but their application in the egocentric setting remains to be investigated.\n\n[1]EgoBlur: Responsible Innovation in Aria. Arxiv 2308.13093.\n[2]Learning privacy-preserving optics for human pose estimation. ICCV'21.\n[3]Learning a Dynamic Privacy-Preserving Camera Robust to Inversion Attacks. ECCV'24.\n\n```>>> Q2``` Could the authors clarify which models in Tables 2 and 3 correspond to these four threat models? A clearer way to distinguish and denote different types of models would improve readability.\n\n```>>> A2``` Thanks for the question and the advice. We will first clarify the correspondence between threat models and the results in Table 2 and 3. Then, following your suggestion, we will introduce a new table that compares the performance across different threat models. This new table will replace part of Table 2 to enhance clarity, and we will split Table 2 into smaller, more focused tables in the camera ready version.\n\nTo clarify:\n\n- **Zero-shot** results correspond to **Capability 1**. These results are shown in the first sections of Table 2 (excluding the RAA results). In Table 3, the rows marked with \"ZS\" correspond to the **Capability 1**.\n\n- **Fine-tuned** models belong to both **Capability 1** and **Capability 2**. Keep in mind that **Capability 1** is the basic capability, as all attacks require some form of query and model. In Table 2, the \"Fine-tuned\" section (second section) represents results related to **Capability 1 and 2** (excluding RAA results). In Table 3, these results are marked with \"FT.\"\n\n- **RAA results**:\n\n    - In the **Zero-shot section** (first section) of Table 2, RAA corresponds to a composite of **Capabilities 1 and 3**, as it combines a base non-finetuned model with the ego-exo retriever and a pool of exo-videos.\n\n    - In the **Fine-tuned section** (second section) of Table 2, RAA is a composite of **Capabilities 1, 2, and 3**, since it involves fine-tuning in addition to the ego-exo retriever and exo-video pool.\n\nWe hope this clarifies the relationship between threat models and their corresponding results in the tables.\n\nHere, we present the new table directly compares all the threat models. Due to space limit, only the results for the CLIP model is displayed here. \n\n|            | 1    | 2 | 3    | Model | Gender    | Race | Age   |\n|---------------|--------|--------|-------|-------|--------|-------|-------|\n| **ID (EgoExo4D)** | ✔️   | ❌ | ❌    | CLIP$_{H/14}$ | 57.89    | 45.21 | 72.02 |\n| | ✔️   | ❌ |✔️    | CLIP$_{H/14}$ |   67.35    |  60.98   |    76.23      |\n| | ✔️   | ✔️ |❌    | CLIP$_{H/14}$ |   68.87    |  70.92    |  79.73  |\n| | ✔️   | ✔️ |✔️    | CLIP$_{H/14}$ |    76.98   |   71.92  |     79.73     |\n|**OOD (CharadesEgo)** | ✔️   | ❌ | ❌    | CLIP$_{H/14}$ |  70.00   | 46.09 | 20.75 |\n| | ✔️   | ❌ |✔️    | CLIP$_{H/14}$ |77.31|  59.42   |    26.42      |\n| | ✔️   | ✔️ |❌    | CLIP$_{H/14}$ |   54.70    |   63.68   |  29.70  |\n| | ✔️   | ✔️ |✔️    | CLIP$_{H/14}$ |    69.65   |   74.09  |    29.92      |\n\n\n```>>> Q3``` In Table 2 that for Gender and Race, \"Exo\" consistently outperforms \"Ego\" before and after fine-tuning. However, for Age, after fine-tuning, \"Exo\" performs worse than \"Ego\". Could the authors provide insights into why this occurs?\n\n```>>> A3``` We believe this occurs due to the inherent subjectivity and complexity of age recognition. Unlike gender and race, which often have more distinct visual cues, age estimation is influenced by various factors such as lighting, facial expressions, and individual aging patterns. The fine-tuning process may have led the model to overfit to certain biases present in the egocentric data, resulting in better performance for ‘Ego’ compared to ‘Exo’ after fine-tuning.", "claims_and_evidence": "This paper claims that egocentric videos can leak private information about the camera wearer. To support this claim, the authors develop the EgoPrivacy benchmark and conduct a comprehensive evaluation, demonstrating that a threat attack model significantly outperforms a random guess model. This finding suggests that privacy risks are indeed present in egocentric vision.", "methods_and_evaluation_criteria": "Yes, this paper proposes a new benchmark, EgoPrivacy, and introduces three types of privacy attacks: demographic privacy, individual privacy, and situational privacy. It also defines the corresponding evaluation metrics for assessing these privacy risks.", "theoretical_claims": "I reviewed the validity of the privacy attack claims in egocentric video. The experimental setups and results appear reasonable and correctly support the authors' conclusions.", "experimental_designs_or_analyses": "Yes, the authors have established a comprehensive experimental framework to compare the proposed privacy attack model against a random choice baseline. The results demonstrate that even without fine-tuning, off-the-shelf foundation models can already retrieve or classify the camera wearer and situational information with notable accuracy.", "relation_to_broader_scientific_literature": "The findings underscore the urgent need for privacy-preserving techniques in wearable cameras.", "essential_references_not_discussed": "N/A", "other_strengths_and_weaknesses": "1. I appreciate the authors’ efforts in advancing the “attack” side of egocentric video privacy research. However, I would also like to see a short discussion on potential mitigation strategies to counteract this type of privacy attack, based on the insights gained from these experiments.\n2. The notation of “1,” “2,” “3,” and “4” with circles in Section 4.1 is somewhat confusing. Could the authors clarify which models in Tables 2 and 3 correspond to these four threat models? A clearer way to distinguish and denote different types of models would improve readability.\n3. It is interesting to observe in Table 2 that for Gender and Race, \"Exo\" consistently outperforms \"Ego\" before and after fine-tuning. However, for Age, after fine-tuning, \"Exo\" performs worse than \"Ego\". Could the authors provide insights into why this occurs?", "other_comments_or_suggestions": "N/A", "questions_for_authors": "Please address my comments on the weakness section above.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "i2thyG5rDE", "reviewer": "Reviewer_qJjA", "summary": "The paper proposes a new benchmark, EgoPrivacy, which focuses on the privacy issues of first-person view videos and quantifies the related privacy risks. The EgoPrivacy benchmark encompasses three types of privacy issues: Demographic privacy, Individual privacy, and Situational privacy. Moreover, based on the EgoPrivacy benchmark, the author proposes the Retrieval-Augmented Attack (RAA), a two-stage privacy attack of retrieval-prediction, and verifies the effectiveness of RAA and the privacy attack capabilities of off-the-shelf foundation models on the EgoPrivacy benchmark.\n\n## update after rebuttal\nI thank the authors for their reply. All my concerns have been addressed. I will keep my original rating.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "First of all, we sincerely thank the reviewer for the valuable feedback and for acknowledging that our work haspromoted privacy protection in the first-person perspective. We will address the concern below.\n\n```>>> Q1``` There is a missing comma in Equation 4. At the end of line 253, \"but as aa video\" should be \"but as a video\". \"Appendix ??\" in line 438 needs to be corrected. The parentheses in image (d) of Figure 1 need to be fixed.  \n```>>> A1``` Thanks for your comment. We will revise the paper and fix all typos in the final version.\n\n```>>> Q2``` The author defines three types of privacy: Demographic privacy, Individual privacy, and Situational privacy. Regarding whether there are other privacy issues in the EgoPrivacy benchmark, for example, the videos shot by users may contain some privacy-leaking information such as bank card numbers.   \n```>>> A2``` Thanks for the insightful comments. This is absolutely a significant privacy concern. However, our paper focuses specifically on demographic, situational, and individual privacy, which are directly related to the person in the context of egocentric videos.  Thus, the mentioned privacy issue, such as bank card numbers in egocentric videos, falls out of the scope of this paper. However, we cite relevant papers [1] for the reviewer's reference and consider this as a potential and important direction for future research.\n\n[1] Raina, Nikhil, et al. \"Egoblur: Responsible innovation in aria.\" arXiv preprint arXiv:2308.13093 (2023).\n\n```>>> Q3``` Figure 1 is difficult to understand. Most of the images are from the egocentric perspective, and there are a few from the exocentric views. It's unclear what information the images are trying to convey. It is recommended that the author polish Figure 1.  \n```>>> A3``` Thanks for the comment. Figure 1 is indeed a bit misleading. The goal of this figure was to illustrate different types of privacy risks: (a)-(c) represent demographic privacy, (d)-(e) represent identity privacy, and (f)-(g) represent situational privacy, as defined in Section 3.1. All input examples are presented in the egocentric view since the primary focus of this work is to investigate egocentric privacy. For retrieval-based privacy tasks (identity and situational), we consider both ego-to-ego retrieval (where both the query and target are in the first-person view) and ego-to-exo retrieval (where the target is in the third-person view).\n\nTo improve clarity, we will annotate the two perspectives in the figure and include a more detailed explanation in the introduction.\n\nAgain, thank you for the valuable suggestions, and we hope that our rebuttal has addressed all the concerns proposed. Please do not hesitate if you have any further questions or concerns. We look forward to your response and valuable opinions!", "claims_and_evidence": "Yes.", "methods_and_evaluation_criteria": "Yes.", "theoretical_claims": "None.", "experimental_designs_or_analyses": "Yes.", "relation_to_broader_scientific_literature": "The contributions of this paper have promoted privacy protection in the first-person perspective.", "essential_references_not_discussed": "None.", "other_strengths_and_weaknesses": "None.", "other_comments_or_suggestions": "1. There is a missing comma in Equation 4.\n2. At the end of line 253, \"but as aa video\" should be \"but as a video\".\n3. \"Appendix ??\" in line 438 needs to be corrected.\n4. The parentheses in image (d) of Figure 1 need to be fixed.\n5. The author defines three types of privacy: Demographic privacy, Individual privacy, and Situational privacy. Regarding whether there are other privacy issues in the EgoPrivacy benchmark, for example, the videos shot by users may contain some privacy-leaking information such as bank card numbers.\n6. Figure 1 is difficult to understand. Most of the images are from the egocentric perspective, and there are a few from the exocentric views. It's unclear what information the images are trying to convey. It is recommended that the author polish Figure 1.", "questions_for_authors": "None.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "TBvKG5c99l", "reviewer": "Reviewer_Nstm", "summary": "This paper presents an egocentric benchmark, termed EgoPrivacy, to analyze the potential information leakage in egocentric videos. The authors evaluate several vision-language models on EgoPrivacy to demonstrate that private information can be easily compromised by these models, highlighting the necessity of privacy-preserving techniques.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "```>>> Q1``` Key factors that affect the performance of RAA.   \n```>>> A1``` Thanks. In fact, we do provide an analysis of these factors in Appendix B and Figure 6, due to limited space. We show that, overall, soft voting with 𝑤=0.5 yields the best performance, and varying the top‑k retrieved exo-predictions in RAA shows a performance plateau around k=3 or k=5 due to inaccurate additional exo-views, and including the ego prediction improves the attack.\n\n```>>> Q2``` Comparisons with different input frames are not fair.  \n```>>> A2``` Thanks. We agree that comparing with the frame number is not entirely fair. Our original intention was not to make direct comparisons, but rather to showcase the best attack performance of each model within the same computational constraints (8xRTX 4090 for training). We here provide a more equitable comparison by using the same number of frames across all models.\n|               | Variant | Frames | identity | | | |situational ||        |       | \n|---------------|--------|--------|--------|-------|-------|-------|-------|--------|-------|-------|\n|               |         |        |EgoEgo     || EgoExo||Scene||Moment|\n|               |         |        |HR@1   |HR@5   |HR@1|HR@5|HR@1|HR@5|HR@1|HR@5|\n| CLIP (DFN)    | ViT-H/14|  8     |79.37|96.97|49.69|63.51|89.21|89.56|13.21|39.57|\n| EgoVLP v2     | 7B      |  8     |73.49|90.86|44.58|57.32|78.95|85.28|2.23|7.05|\n| VideoMAE      | ViT-B/14|  8     |54.41|77.47|22.78|31.52|57.47|63.84|6.97|20.33|\n\nAlthough EgoVLPv2 performs worse than CLIP with 8 frames, it offers better computational efficiency due to its early fusion, allowing for improved performance with more frames, thus achieving the best attack results while balancing performance and memory consumption. We will also discuss this point in response to Q7. We will add theresults to Table 3. \n\nRegarding temporal modeling, we acknowledge it is not sufficiently rigorous. As noted in Section 6.2, we position this as only a preliminary observation due to the limited time and space. We present a more thorough investigation by applying RNN, Attention (with pos emb) and MLP of similar param size on top of CLIP (see https://imgur.com/a/YMXXZMx). We show that both gender and race attack benefits from temporal modeling, while age is the exception.\n\n```>>> Q3``` Only 4 to 5 vision-language models are included for comparison, which is insufficient.  \n```>>> A3``` Thanks for the comments. While we appreciate your concern, we believe that 4 to 5 models are sufficient for a comprehensive study in this context. To address your concern within the time constraint, we additionally add Qwen2.5-VL [1] results below:\n\n|               | Variant| Gender |        |        | Race   |       |       | Age    |       |       | \n|---------------|--------|--------|--------|--------|--------|-------|-------|--------|-------|-------|\n|               |        | Exo    | Ego    | RAA    | Exo    | Ego   | RAA   | Exo    | Ego   | RAA   |\n| Qwen2.5-VL    | 7B     | 82.00  | 86.50  | 87.50  | 74.00  | 70.00  | 71.50  | 58.00  | 60.50  | 60.50  |\n\n```>>> Q4``` Missing related work [1,2,3,4]\n\n```>>> A4``` While cross-view retrieval work [2, 4] exists, its application to egocentric demographic privacy is limited—[1] emphasizes semantic retrieval for action captioning, and EgoTransfer [3] and ObjectRelator focus on motion and object recognition, whereas our method targets instance-level retrieval for privacy attacks; we will include a detailed comparison in the final version.\n\n```>>> Q5``` typos  \n```>>> A5```  Thanks! We will revise all typos in the final version of the paper.\n\n```>>> Q6``` How is zero-shot eval employed in VLM-based models (LLaVA and VideoLLaMA2)?  \n```>>> A6``` We leverage the ability of VLM to output free-form texts and format the privacy attack as open-ended VQA.  \nAn example of the prompt:\n\n---\n\nThis is a video taken by a wearable camera. What is the gender of the wearer?\nA. Female\nB. Male\nAnswer with the letter of the correct option.\n\n---\n\nWe use template matching to extract the answer, as all VLMs reliably follow instructions, making it sufficient for result extraction.\n\n```>>> Q7``` EgoVLPv2 is trained using 4/16 frames, while the authors adopted 128 frames for evaluation.   \n```>>> A7``` Indeed, EgoVLPv2 we adopt only accepts 4 frames as input, but videos in the EgoPrivacy benchmark contain 1000+ frames. To address this, we split the 128-frame input into 32 chunks of 4 frames, processed independently by EgoVLPv2. The results are then aggregated via a classification/retrieval head. For zero-shot evaluation, we score and ensemble all 32 chunks' outputs to generate the prediction. We found 128 frames to offer the best balance of performance and efficiency. Following the suggestion, we perform the experiment as mentioned above with only 8 frames to provide a fair comparison. This resulted in a slight decrease in performance, which supports our choice of 128 frames for evaluation.", "claims_and_evidence": "YES", "methods_and_evaluation_criteria": "YES", "theoretical_claims": "N/A", "experimental_designs_or_analyses": "YES", "relation_to_broader_scientific_literature": "This paper provides insights into the implications of first-person camera data for personal privacy and security.", "essential_references_not_discussed": "This paper studies ego-to-exo cross-view retrieval, and propose a retrieval-augmented attack technique. \n\nHowever, [1] also adopted a cross-view retrieval augmentation technique in egocentric vision, but it is not discussed in this paper.\n\n[1] Retrieval-Augmented Egocentric Video Captioning. CVPR 24", "other_strengths_and_weaknesses": "Advantages:\n1. This paper provides insights into the implications of first-person camera data for personal privacy and security.\n\n2. The proposed retrieval-augmented attack enhances the performance of vision-language models across different tasks.\n\nWeaknesses:\n1. The authors demonstrated the effect of retrieval augmentation in grouping similar gender, age, and race. In my opinion, key factors that affect the performance of retrieval augmentation also include: (1) the number of retrieved samples; (2) the retrieval mechanism; and (3) the method of integrating retrieved samples into the final prediction.\n\n2. In Table 5, the comparisons are somewhat confusing. The authors utilized various models with different sizes and numbers of input frames. I do not see a fair comparison among these approaches. Additionally, in Line 409, the authors claimed that modeling temporal information helps reveal privacy information. I think this conclusion is not sufficiently solid, as CLIP only uses 8 frames while EgoVLPv2 uses 128 frames. It is unclear to me whether the improvement is due to the number of input frames or the model architecture.\n\n3. The authors claimed that EgoPrivacy is a multimodal benchmark; however, only 4 to 5 vision-language models are included for comparison, which is insufficient.\n\n4. Some related works regarding cross-view retrieval are missing [1,2,3,4]. Furthermore, it seems that the proposed Retrieval-Augmented Attack (RAA) shares a similar idea with [2], and I wonder what the differences are between them.\n\n[1] Objectrelator: Enabling cross-view object relation understanding in ego-centric and exo-centric videos. Arxiv 24.\n\n[2] Retrieval-Augmented Egocentric Video Captioning. CVPR 24\n\n[3] EgoTransfer: Transferring Motion Across Egocentric and Exocentric Domains using Deep Neural Networks. Arxiv 16.\n\n[4] First- And Third-Person Video Co-Analysis By Learning Spatial-Temporal Joint Attention. TPAMI 20.", "other_comments_or_suggestions": "There are several typos, e.g. \n(1) Line 147, 'In this work' should be 'in this work'; \n(2) Line 253 'but as aa'; \n(3) Line 365, 'the moels'; \n(4) Line 437 'Appendix ??'.", "questions_for_authors": "1. The authors adopted several vision-language models as baseline methods, including embedding-based models (CLIP and VideoMAE) and VLM-based models (LLaVA and VideoLLaMA2). It is straightforward to add a classification/retrieval head on top of the embedding-based models. However, regarding VLM-based models, it is not very clear to me where to place the classification/retrieval head and how zero-shot evaluation is conducted using VLMs. For example, did you use the output embedding from the language model? Did you input any language instructions?\n\n2. As far as I know, EgoVLPv2 is trained using 4/16 frames, while the authors adopted 128 frames for evaluation. Are there any specific concerns regarding this? It would be fair to report the results using 4/16 frames, especially for zero-shot evaluation.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: I'd like to thank the authors and reviewers for great efforts writing reviews, rebuttals, and subsequent discussion, particularly with 6 reviewers assigned to this paper eventually.

Nevertheless, there's an overall consensus towards acceptance. There is one reviewer on the rejection side. 

The reviewer is in fact an expert in ML privacy and their opinion should not be taken lightly. However, the reviewer has not engaged in subsequent discussion and the AC deems most of the initial concerns by the reviewer were addressed by the rebuttal. AC also deems the score of 1 (firm reject) does not match with the verbal assessment of the paper, where the weakness of the paper cannot be considered critically strong enough to overturn the positive assessment of the other 5 reviewers.

The AC recommends a solid acceptance for the paper.
Decision: Accept (poster)