# Facial Privacy Protection with Dynamic Multi-User Access Control for Online Photo Platforms
## 5 Experiments
### Experiment Design
#### 5.1.5 Evaluation Scenario  
The system facilitates interaction between two primary roles: the image owner and the consumer. Image owners can upload images, view associated facial data, and manage access privileges by granting or revoking permissions for consumers. Conversely, consumers can request access to view facial data within images shared by image owners, with their access dependent on the owner's approval. During evaluation tests, users were assigned to one of the following roles:  
* **Owner:** The image owner can view facial data in their shared images. * **Without Access:*
* Unauthorized users cannot view facial data in shared images. * **After Grant:** Authorized users can view facial data in shared images after the owner grants access. * **After Revoke:** Previously authorized users lose access to facial data in shared images after the owner revokes access. In the evaluation phase, consumer roles--without access, after grant, and after revoke--were dynamically assigned. Meanwhile, the owner role was fixed and assigned to a single user. This fixed assignment ensured consistency in testing the system's functionalities and facilitated a streamlined evaluation process. The scenario focused on assessing the system's access control mechanisms for facial data protection, with particular emphasis on the visibility of facial regions in shared images across different user roles. For this scenario, a single image owner, [PERSON], and multiple consumers (e.g., [PERSON], [PERSON], etc.) were defined. The number of consumers varied depending on the number of faces detected in each image. Specifically, in the \"Single\" category, there was one consumer per image, whereas in the \"Small\", \"Medium\", and \"Large\" categories, the number of consumers corresponded to the number of detected faces in the images within each category. Across all face categories, the total number of consumers was 6607 users, which matched the total number of faces detected across all images. The distribution of consumers across the face categories is presented in Table 4.  
In evaluating the system's performance, we employed automated testing to quantify the visibility of facial regions. This was achieved by calculating the average correlation values across horizontal, vertical, and diagonal directions. The image \(I(x,y)\) was compared with its shifted versions, including horizontally shifted \(I_{H}(x,y)=I(x,y+1)\), vertically shifted \(I_{V}(x,y)=I(x+1,y)\), and diagonally shifted \(I_{D}(x,y)=I(x+1,y+1)\). The correlation values across these directions were calculated using Equations (1), (2), and (3), respectively. \[\rho_{H}=\frac{\sum_{x,y}(I(x,y)-\bar{I})(I_{H}(x,y)-\bar{I_{H}})}{\sqrt{\sum_{ x,y}(I(x,y)-\bar{I})^{2}\sum_{x,y}(I_{H}(x,y)-\bar{I_{H}})^{2}}} \tag{1}\]  
\[\rho_{V}=\frac{\sum_{x,y}(I(x,y)-\bar{I})(I_{V}(x,y)-\bar{I_{V}})}{\sqrt{\sum_{ x,y}(I(x,y)-\bar{I})^{2}\sum_{x,y}(I_{V}(x,y)-\bar{I_{V}})^{2}}} \tag{2}\]  
\[\rho_{D}=\frac{\sum_{x,y}(I(x,y)-\bar{I})(I_{D}(x,y)-\bar{I_{D}})}{\sqrt{\sum_{ x,y}(I(x,y)-\bar{I})^{2}\sum_{x,y}(I_{D}(x,y)-\bar{I_{D}})^{2}}} \tag{3}\]  
where \(\bar{I}\), \(\bar{I_{H}}\), \(\bar{I_{V}}\), and \(\bar{I_{D}}\) are the mean values of \(I\), \(I_{H}\), \(I_{V}\), and \(I_{D}\), respectively. Figure 8 compares original and encrypted face image pixel correlations. The original image exhibits strong spatial correlations in the horizontal, vertical, and diagonal directions, as shown by clustered scatter plots. In contrast, the encrypted image shows a uniform distribution, indicating the removal of spatial correlations by the encryption process. We used the average correlation values across all directions to quantify the visibility of facial regions in shared images, as shown in Equation (4). \[\rho_{\text{avg}}=\frac{\rho_{H}+\rho_{V}+\rho_{D}}{3} \tag{4}\]  
A threshold value of 0.1 was used to determine facial region visibility. If \(\rho_{\text{avg}}\) was below the threshold, the facial region was considered visible; otherwise, it was considered protected.