## 2 Related Work  
Privacy-preserving computer vision models can be broadly categorized into models that (i) extract features from encrypted data (ii) extract secure features from raw data through the use of secure protocols, etc.  
Ref. [2] presents a method for performing object tracking and motion detection on compressed, encrypted videos that leverages cloud computing for fast video processing. In this approach, a feature (called DNRC) is directly extracted from the encrypted bitstream to preserve privacy. In our system, we extract features from unencrypted video footage but make the transmitted data non-invertible to prevent data leakage.  
Similar to our original problem, Ref. [3] addresses the issue of secure image feature extraction in a cloud-computing scenario using a secure feature extraction algorithm based on SIFT. The algorithm extracts \"descriptors\" from encrypted images, which can only be processed by the data owner. While this is interesting in the context of secure video processing in cloud-computing systems, it does not apply to modern computer vision models based on DNNs.  
Ref. [4] presents a scheme for privacy-preserving video surveillance based on the Chinese Remainder Theorem. In this method, each video frame is transformed into seemingly random images on which further processing can be done. However, the video processing techniques are limited to traditional methods such as background subtraction and are not trainable like object detection neural networks.  
In [5], a secure neural network inference framework called Gazelle is presented and it utilizes a combination of homomorphic encryption and garbled circuits to deliver secure inference. The focus of this work is on secure two-party communication, ensuring that users do not learn about the model while sensitive user data are protected from leakage. Our work is similar in that it provides secure inference, but our approach does not rely on encryption techniques. Instead, we leverage the inherent information loss in neural network processing to deliver secure inference. Lastly, while Gazelle is a low-latency framework, it was not designed for use on edge devices with limited computing power.  
Ref. [6] discussed an end-to-end cloud-based security framework called \"DroneNet-Sec\". The authors considered drones used for video analytics where a cloud and edge infrastructure supports the drones. However, their trust model includes the cloud infrastructure and the threats include man-in-the-middle attacks, denial of service, replay attacks, etc. We assume the cloudlet to be a semi-honest entity and, thus, adopt a fundamentally different approach to privacy protection by focusing on the information transmitted through the computer vision pipeline.  
Ref. [7] presented a secure variant of the FasterRCNN object detection model with a focus on medical images. The framework also uses edge centers to minimize result latency. A key difference is that SecRCNN uses operations such as secure ReLU, secure convolution, etc., to perform secure feature map extraction. In our system, we refrain from modifying the fundamental operations on which the building blocks of the neural network are built in order to make the framework applicable to a variety of models. While our system works best with fast object detection models such as SSD-MobileNetV3, the system architecture can be extended to other models without loss of generality.