## 7 Discussion  
Our system uses noise and other lightweight methods as deterrents to adversarial image reconstruction. It could be argued that the scope of threats to DNN-based object-tracking and detection models extends beyond reconstruction. For example, adversarial training methods such as FGSM [22] and PGD [23] can be used to craft malicious inputs that jeopardize the model. However, based on our trust model, the adversary has no control over the input video feed to the drone. Furthermore, the adversary cannot access gradients or any intermediate information other than the feature maps transmitted from the drone. Thus, the scope of the attack is limited to image reconstruction attacks. Although autoencoders are commonly used for image reconstruction, adversaries could alternatively employ generative adversarial networks (GANs) [24] to train adversarial decoders. In our future research, we plan to assess how effectively our defensive strategies can mitigate attacks using GANs. For Secure SSDLite, our proposed object detection model, the key hyperparameters are the annulment factor \(\lambda\) and the variance of noise \(\sigma^{2}\). There is typically a trade-off between precision and recall. As shown in Figure 10(a)-c, increasing \(\lambda\) enhances privacy protection against the cloudlet but compromises recall. If the \(\lambda\) value is too low, the cloudlet can reconstruct sensitive information; conversely, if it is too high, recall suffers, resulting in unblurred individuals in the video frame. Figure 10(b) demonstrates that with \(\sigma^{2}=0.4\), the impact on recall is minimal, allowing for more robust privacy protection without significantly affecting recall. Although a similar trend is observed with precision, our focus remains on preserving recall. Qualitatively, not only are we able to provide complete obfuscation of faces, but we are also able to obfuscate the vast majority of information in the image background and other secondary characteristics that the cloudlet may try to learn. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Model** & **Precision** & **Recall** \\ \hline SSD-MobileNetV3 & 72.5 & 57.9 \\ Secure SSDLite (Ours) & 70.2 & 55.8 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Performance of object-tracking algorithm using the detection model + SORT. For the Secure SSDLite, with \(\lambda=0.3\) and \(\sigma^{2}=0.4\), \(1\) in every \(5\) frames is used to generate a new set of predictions from the cloudlet. \begin{table}
\begin{tabular}{c c} \hline \hline
**Process** & **Execution Time** \\ \hline Onboard Feature Extraction & 8.20 ms \\ Noise Addition and Feature Map Selection & 2.01 ms \\ PNG Encoding & 55 ms \\ Cloudlet Processing & 17 ms \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Breakdown of overall execution time on the drone and cloudlet. Significant penalty incurred when encoding feature maps as PNG images. Our proposed scheme is geared toward an edge-computing scenario in which cloudlets support the drones by processing computationally intensive workloads. In a traditional cloud computing scenario, multiple drones live-streaming video footage can quickly saturate network bandwidth, and thus, relying only on centralized cloud infrastructure is not scalable. As discussed earlier, another issue is poor latency, which is unsuitable for real-time analytics. Thus, edge computing solutions that involve cloudlets alleviate this bottleneck. While our proposed method has been discussed in the context of edge-computing, it can trivially be extended to a cloud-computing scenario where the adversary is the cloud instead of the cloudlet. In future work, we will aim to explore whether a more fine-grained approach through model pruning can protect against reconstruction while minimizing the impact on model utility. Additionally, we will broaden our definition of PII and consider other potentially sensitive attributes such as addresses, documents, homes, cars, clothing, and peripheral objects in the scene, as well as study how to address the leakages of such features.