## 6 Results
### Evaluation for Object Detection  
Table 1 shows the object detection results. The noise variance and the mean used in our model are 0.4 and 0.1, respectively. We choose to annuli 30% of the feature maps (i.e., \(\lambda=0.3\)) in the noise selector module. We observe 3% and 7% decreases in AP @ 0.5 and AR, respectively compared to the baseline. The decrease in recall is because the addition of noise prevents the model from detecting small-scale objects. A typical example is shown in Figure 10(2(b)), where 5 pedestrians on both sides of the camera view missed detection because they are very far away from the camera and, hence, become very small in the view. However, these missed human detections are small enough that they will barely leak sensitive information, even though they are exposed in the frame, as shown in Figure 10(2(c)). Figure 10: Comparison between SSD-MobileNetV3 (first column) and Secure SSDLite (ours, second column) bounding box predictions for samples from the PennFudan dataset. The yellow bounding boxes are the ground truth and the red boxes are the predicted boxes. The third column blurs the sensitive regions based on the predictions from the Secure SSDLite model with \(\alpha=0.11\). Subfigures 1(a)–3(c) are examples of predicted bounding boxes with varying subjects and sizes. Figure 9: Comparison of privacy protection offered by different annulment values (\(k\)) for the variance threshold (\(\sigma^{2}=0.4\)), annulment factor (\(\lambda=0.3\)), and noise mean (\(\mu=0.1\)) for the CelebA dataset. In Figure 11, we study the effect of varying the annulment factor at different variance thresholds for the PennFudan dataset. Upon exploration of the hyperparameter space, we find that our object detection model is far more robust to feature map annulment when \(\sigma^{2}=0.4\), as shown in Figure 11,c. We find the ideal balance between performance and privacy is when \(\lambda=0.3\) and \(\sigma^{2}=0.4\). Furthermore, the choice of Gaussian annulment (i.e., \(\mathrm{k}\sim\mathcal{N}(0,1)\)) during feature map selection is confirmed by the results shown in Figure 12.  
In Figure 10, we show some example bounding boxes generated using our proposed scheme. We qualitatively evaluate the performance and discuss the privacy implications. In the first row, we consider an image with objects at multiple scales for comparison. \begin{table}
\begin{tabular}{c c c} \hline
**Model** & **[EMAIL_ADDRESS]** & **[EMAIL_ADDRESS]:0.95** \\ \hline SSD-MobileNetV3 & 97.4 & 83.2 \\ Secure SSDLite (Ours) & 94.2 & 76.8 \\ \hline \end{tabular}
\end{table} 
Table 1: Comparison of Secure SSDLite (our model) against the baseline model for object detection on the PennFudan dataset. Our model uses \(\lambda=0.3\) and \(\sigma^{2}=0.4\). Figure 11: Performance of Secure SSDLite ([EMAIL_ADDRESS], AP, AR) vs. annulment factor \(\lambda\) for different variance thresholds. Here, the variance threshold refers to the variance, \(\sigma^{2}\), of the Gaussian distribution from which the additive noise is sampled. Similarly, the mean, \(\mu\), is the mean of the aforementioned Gaussian distribution. (**a**) Performance of Secure SSDLite ([EMAIL_ADDRESS], AP, AR) vs. annulment factor \(\lambda\) for variance threshold \(\sigma^{2}=0.1\). (**b**) Performance of Secure SSDLite ([EMAIL_ADDRESS], AP, AR) vs. annulment factor \(\lambda\) for variance threshold \(\sigma^{2}=0.2\). (**c**) Performance of Secure SSDLite ([EMAIL_ADDRESS], AP, AR) vs. annulment factor \(\lambda\) for variance threshold \(\sigma^{2}=0.4\). Figure 12: Performance of Secure SSDLite (AP, AR, [EMAIL_ADDRESS]) vs. annulment value (\(k\)) for variance threshold \(\sigma^{2}=0.4\). Despite incorporating Gaussian noise and feature map annulment, the pedestrians are localized well in Figure 10(1(b)), but the bounding boxes are larger in 1(b) compared to 1(a). Consequently, the IoU score for 1(b) (bounding boxes generated using Secure SSDLite) is worse than 1(a) (baseline).