PixelFade: Privacy-preserving Person Re-identification with Noise-guided Progressive Replacement

Venue: acmmm_org_ACMMM_2024_Conference
Published: 2024-04-07 10:31:24

Abstract: Online person re-identification services face privacy breaches from potential data leaks and recovery attacks, exposing cloud-stored images to malicious attackers and triggering public concern. The privacy protection of pedestrian images is crucial. Previous privacy-preserving person re-identification methods are unable to resist recovery attacks and compromise accuracy. In this paper, we propose an iterative method (PixelFade) to optimize pedestrian images into noise-like images to resist recovery attacks. We first give an in-depth study of protected images from previous privacy methods, which reveal that the \textbf{chaos} of protected images can disrupt the learning of recovery networks, leading to a decrease in the power of the recovery attacks. Accordingly, we propose Noise-guided Objective Function with the feature constraints of a specific authorization model, optimizing pedestrian images to normal-distributed noise images while preserving their original identity information as per the authorization model. To solve the above non-convex optimization problem, we propose a heuristic optimization algorithm that alternately performs the Constraint Operation and the Partial Replacement operation. This strategy not only safeguards that original pixels are replaced with noises to protect privacy, but also guides the images towards an improved optimization direction to effectively preserve discriminative features. Extensive experiments demonstrate that our PixelFade outperforms previous methods in resisting recovery attacks and Re-ID performance. The code will be released.

Main paper: 
 privacy-preserving person re-identification: 
 Existing PPPR methods can be broadly categorized into two types. First, conventional approaches visually scramble the body in images through techniques such as blurring, mosaic, or adding noise. However, these methods compromise the semantic features of the image, resulting in decreased Re-ID performance. Second, deep learning-based methods [19, 30] achieve a good balance between privacy and utility. PrivacyReID [30] provides a joint learning reversible anonymization framework, capable of reversibly generating full-body anonymous images. AVIH [19] iteratively reduces the correlation information between the protected and original images to protect visual privacy while minimizing their distance in feature space. However, the above methods face the risk of recovery attacks [8, 15, 29, 32] . If malicious adversaries have access to blackbox control of the privacy model, they can launch recovery attacks by training a recovery network on the public dataset to learn the mapping from the protected image to the original image. Recently, Ye et al. [29] proposes Identity-Specific Encrypt-Decrypt architecture to encrypt the images to resist recovery attacks. However, the encrypted images cannot be used for retrieval by any Re-ID models. Our goal is to protect visual privacy of pedestrian images and resist recovery attacks while maintaining the performance of the authorized Re-ID model.Many adversarial attack methods [5, 10, 16] show that deep neural networks (DNN) understand images in a different way from humans. In the TypeI adversarial attack [19, 20] , the process iteratively transforms the image into a visually different one, but the model persists in recognizing it as belonging to the same identity. AVIH [19] strives to hide the visual information of face images while preserving their functional features for face recognition models. In our paper, we employ AVIH for PPPR task as a comparison method.In comparison, our method proposes a novel objective function that explicitly converts images to noise to resist recovery attacks and introduces a heuristic optimization strategy to effectively improve the privacy-utility trade-off. 
pixelfade: 
 In this section, we first introduce our Noise-guided Object Function with feature constraint to optimize pedestrian images to protected images in Section 3.1. Subsequently, we introduce our novel optimization strategy Progressive Pixel Fading in Section 3.2, followed by Constraint Operation in Section 3.3 and Partial Replacement Operation in Section 3.4.Recall the experimental discovery in Section 1: As the pixels of a protected image are more chaotic, the quality of the recovered image deteriorates, suggesting an increase in resistance to recovery attacks. We speculate that the inherent randomness of pixels of protected images can disrupt the recovery network's learning of the mapping from the privacy image to the original image, effectively diminishing the recovery capability of the adversary. Therefore we take a novel perspective to tackle the PPPR task, with the explicit objective of converting pedestrian images to random noise to protect visual information and resist recovery attacks. However, naively converting pedestrian images into noise images severely harms the semantic information and causes Re-ID performance to slip. We therefore introduce a feature constraint for limiting the feature distance between the protected image and the original image to be less than a preset threshold to maintain the Re-ID performance of the protected image.Mathematically, we suppose there is a set of pedestrian images to be protected 𝑋 = {𝑥 1 , . . . , 𝑥 𝑁 }. For each 𝑥 𝑖 , we sample different noise images 𝜂 𝑖 ∼ N , where N is the standard normal distribution. Our objective function is defined as:EQUATIONwhere 𝑥 𝑖 is 𝑖-th original image and 𝑥 𝑝 𝑖 is 𝑖-th protected image. 𝑓 is a pre-trained Re-ID model. For simplicity, we neglect the index 𝑖 of images in subsequent passages.In this subsection, we aim to employ a suitable optimization strategy to optimize images into noise. Since Equation ( 1) is a non-convex optimization problem, simple optimization methods such as Random Perturb or L1 Optimization are not able to find the local optimum point (refer to Section 4.4.2 for more analysis), which seriously affects the Re-ID performance or privacy performance. To solve this problem, we propose a heuristic optimization strategy, named Progressive Pixel Fading, to update protected images.The pipeline of PixelFade is depicted in Figure 2 (a), where for a given pedestrian image 𝑥 requiring protection, we initially generate a random noise image 𝜂 sampled from N along with a set of binary masks M. During optimizations, we iteratively carry out Constraint Operation (detailed in Section 3.3) to update the protected image to narrow the feature distance between the protected image and the original image, aiming to meet the feature constraint. If the feature distance is less than a specific threshold 𝜖, we proceed with one Partial Replacement Operation (detailed in Section 3.4) to replace parts of scattered pixels with noise to protect the privacy of protected images. Note that the replacement operation and the constraint operation are run alternately according to the satisfaction of feature constraints. Discussion. We highlight the advantages of such heuristic optimization over simple optimization in terms of privacy and utility. For privacy, the replacement with noise values ensures that pixellevel information from the original image is discarded rather than merely perturbed, thereby safeguarding privacy. For utility, randomly masking out partially scattered pixels in the image drives the model to capture the intrinsic features from unmasked content, facilitating the preservation of discriminative features within the image during the next Constraint Operation. It helps improve the Re-ID performance of protected images.To satisfy the feature constraints in Equation (1), we aim to minimize feature loss between protected and original images with the Type-I attack [20] . Specifically, we define optimization loss as the feature distance between the protected image and the original image for a particular Re-ID model. Formally,EQUATIONwhere 𝑡 indicates the step of optimization. Motivated by [3, 19] , we calculate momentum gradients 𝑔 𝑡 to stabilize optimization directions as: where 𝛼 indicates the decay factor of momentum computation. By applying backpropagation, we iteratively derive the gradient to update the protected pedestrian image to minimize its feature loss with the original image:EQUATIONEQUATIONEQUATIONIn this subsection, we describe the Partial Replacement Operation to protect privacy. In the person Re-ID task, pedestrian images contain a wealth of coarse-grained appearance including color, contour, texture, etc. The trained Re-ID model would consider such appearance information as important patterns of the pedestrian. Therefore our intuition is to leverage such coarse-grained appearance information as guidance to facilitate protected images to preserve discriminative features during the optimization in Constraint Operation.In each Partial Replacement Operation, we employ a set of nonoverlapping binary masks to replace part of the scattered pixels of the image with random noise. Specifically, we first preset a sequence of binary masks M = {M 1 , . . . , M I }, where I denotes the number of masks. Each mask of different iteration M 𝑗 ∈ {0, 1} has the same shape as the original image. As shown in Figure 2(b) , the template mask M ′ is entirely composed of the value of one. Then the masks for each iteration M 𝑗 are generated by randomly assigning a portion of pixels of M ′ to zero. Notice that each iteration does not select the previously picked pixels in one cycle. Formally, we replace pixels in the original images with noise via these masks:EQUATIONOnce the feature constraint is satisfied, one replacement operation is performed and 𝑗 = ( 𝑗 + 1) mod I + 1 is executed. Until the final mask M I , all pixels have been processed, guaranteeing the entire substitution of all pixels in the original image to safeguard privacy. Such a process leads to the Fade of pixels from the pedestrian image in a progressive manner, where the remaining coarse-grained content would facilitate the model to obtain informative gradients in Equation (4) during backpropagation. It aids in updating the image in the Constraint Operation toward a more optimal direction, contributing to the preservation of discriminative features in the image. The algorithm is summarized in Algorithm 1. Empirically, for better privacy protection, we first perform an initialization stage of a few steps, performing Constraint Operation and Partial Replacement Operation in turn and ensuring that all pixels have been replaced. We then officially perform our Progressive Pixel Fading, where Partial Replacement Operation and Constraint Operation are run alternately according to the satisfaction of feature constraints. Partial Replacement Operations are performed cyclically, meaning that if all pixels have been replaced once, a new round of replacement will continue to be performed. After reaching the pre-set maximum number of optimization steps, protected images instead of original images are saved in the cloud for Re-ID tasks. By feeding query and gallery images from different cameras to the authorized Re-ID model, both unprotected and protected images from the same identity can be correctly matched by the Re-ID model. If the protected images stored in the cloud are leaked and fall prey to a malicious attempt at recovery attacks, our method can robustly prevent the recovery of visual information, underscoring its effectiveness in thwarting recovery attacks. 
experiments 4.1 experiments settings: 
 4.1.1 Datasets. Three widely used datasets are used for experiments: Market-1501 [31] , MSMT17 [25] and CUHK03 [14] . The Market-1501 dataset consists of 32,668 annotated bounding boxes under six cameras. The MSMT17 dataset comprises of 4,101 identities and 126,441 bounding boxes taken by a 15-camera network. The CUHK03 dataset includes 1,467 identities and 14,097 detected bounding boxes. Besides, we adapt our PixelFade to Text-to-Image Re-ID on CUHK-PEDES [13] and ICFG-PEDES [2] , to Visible-Infrared Re-ID on SYSU-MM01 [26] and RegDB [17] to demonstrate PixelFade's scalability.We consider that the adversary can access black-box control of the privacy model and obtain protected images. Following existing recovery attacks [29] , the adversary can obtain protected images as labels by feeding numerous original images from the public dataset (training set of Market-1501 or CUHK03) to the privacy model. Then adversary trains the recovery network to learn the mapping by minimizing the L1 loss between recovered and original images. After training, the adversary can reverse the original images from protected images by the trained recovery network.For Re-ID performance, we use Cumulative Matching Characteristics (a.k.a., Rank-k matching accuracy) [22] , mean Average Precision (mAP) [31] , and a new metric mean inverse negative penalty (mINP) [28] . Higher above metrics represent higher utility of pedestrian images. For resistance to recovery attacks, we adopt two widely used metrics, i.e. PSNR and SSIM [24] to measure the similarity between recovered and original images. Specifically, a lower PSNR and SSIM indicate a lower similarity to original facial images, indicating better privacy protection.We follow the default training of AGW [28] on Re-ID datasets to obtain pre-trained Re-ID models. Unless specified, we use the ResNet50 [6] with non-local [23] block network as the backbone. We set the maximum number of iteration steps of PixelFade 𝑇 to 100 and the number of steps in the initialization phase is 10 out of 100 steps. The number of masks I is set to 5. The threshold of Feature Constraint 𝜖 is 0.03. The decay factor 𝛼 is 0.6. Note that we do not perform any replacement operation in the last 5 steps to ensure that the feature constraint is satisfied.For compared methods, we pick five methods that protect the visual privacy of images while maintaining the performance of models: For (1) FaceBlur [1] , We follow the default parameters in the article to detect and blur the face part. For (2) PrivacyReID [30] ,we follow their open-source code to reproduce that work. For (3) Gaussian blur and (4) Mosaic, we follow the default setting in [30] to set their radius to 12 and 24 respectively. For (5) AVIH, We use their open-source code and follow their default parameters (except the iteration step) to perform the PPPR task. For a fair comparison with our PixelFade, we set the maximum number of iteration steps for both two methods to 100.We follow the relative work [30] to evaluate the Re-ID performance under four test settings with different queries and galleries, which represent four different scenarios: Protected to Protected: Both query and gallery sets are protected images. Original to Protected: Query sets are original images while gallery sets are protected images. Protected to Original: Query sets are protected images while gallery sets are original images. Original to original: Both query and gallery sets are original images. The "Upperbound" implies that an unprotected ReID model trained on the unprotected dataset performs Re-ID retrieval on the unprotected data.Table 1 shows Re-ID performance results under different Re-ID settings. We can see that our PixelFade outperforms other privacy protection methods in all four settings. Our method almost approaches Upperbound, i.e., the differences in Rank1 are only 1.4%, 5.9%, and 4.2% on the three datasets even in the most challenging setting (Protected to Protected). It is worth noting that our method outperforms another iterative method (AVIH) on the mINP metric for all three datasets (i.e., 9.2%, 3.6%, 7.6%). This is because our Progressive Pixel Fading drives the model to maintain the intrinsic features within protected pedestrian images, facilitating the identification of difficult samples across different viewpoints.Here we investigate PixelFade's protection of privacy, which we evaluate in two aspects: resistance to recovery attacks and visual protection.We suppose that the adversary launches recovery attacks on protected images as discussed in Section 4.1.2. We compare PixelFace with previous methods to evaluate its resistance performance against recovery attacks on datasets of Market-1501 and CUHK03. As shown in the "Recovered images" part of Figure 3 , PixelFade's recovered images (column f) are chaotic and almost impossible to recognize the original identity. On the contrary, recovered images of other methods (column b-e) fail to resist the recovery attacks. They still reveal some pedestrian contours, or even almost consistent with the original image. Table 2 shows the qualitative results of resistance to reconstruction attacks. We can see that our method reaches the lowest PSNR and SSIM, indicating PixelFade outperforms other protection methods on resistance performance against recovery attacks. d ) still expose some visual information (e.g., clothing color, contour). In comparison, our PixelFade (column f) effectively hides the visual information of pedestrians, which is almost consistent with noise images, making it difficult for malicious attackers to distinguish the identity.EQUATIONIn this subsection, we would like to demonstrate the superiority of our Noise-guided Objective Function and Progressive Pixel Fading through ablation experiments. All ablation studies are conducted on the Market1501 dataset.4.4.1 Noise-guided Objective Function. First, we would like to verify the conjecture we presented in Section 1: As the pixels of the protected image become more chaotic, its ability to resist recovery attacks increases. We sample a noise image from the Gaussian distribution with the same shape as the pedestrian image, and then we mix it with the original image. We replace the objective images (i.e., 𝜂 in Equation ( 1)) in our objective function in PixelFade with such a mixed noise image. The result is shown in Table 3 . We can observe that as AD values decrease, implying that the pixel chaos degree in protected images is increasing, the quality of the restored image is deteriorating, indicating an increase in resistance to recovery attacks. This suggests that the random property of the pixels disrupts the learning of recovery networks, weakening the threat of recovery attacks. Therefore our PixelFade is dedicated to providing a new perspective to realize the privacy-preserving image recognition tasks that are transforming images into nearly normal-distributed noise images to resist recovery attacks.To further evaluate the effectiveness of our objective function, we replace the objective images with other images instead of noise images. As shown in Table 4 , when the objective images are "images of other identity", it achieves a high SSIM of 0.53 that it completely Perturb" indicates adding random noise of magnitude 𝑎 to pedestrian images. For "L1 Optimization", we optimize the pedestrian image using L1 loss between noise images and original images, where loss is weighted as 𝑤.fails to resist recovery attacks, as natural images are poorly able to disrupt the learning of recovery networks. When the objective images are "Contrastive Images", our goal is to enlarge the difference between protected images and original images, which can be formally defined as:EQUATIONIt achieves a higher PSNR of 2.51 and a higher SSIM of 0.25 compared to ours, indicating a lower resistance to attacks. If we set objective images as "Zero Images", we attempt to optimize protected images to be zero-valued images. It is still weaker than us in resisting recovery, with a difference of 1.84 in PSNR and 0.07 in SSIM. In comparison, our Noise-guided Objective Function explicitly optimizes the image into noise, which effectively disrupts the learning of recovery networks, promoting resistance to reconstruction attacks.4.4.2 Progressive Pixel Fading. We employ other optimization strategies instead of our Progressive Pixel Fading to optimize images to noise shown in Figure 4 . When "Random Perturb" is employed, we randomly generate noise with different amplitudes 𝑎, and add it to the protected image for perturbation. As shown in the left subplot of Figure 4 , As the noise amplitude increases, the SSIM of the recovered image decreases, implying an increase in resistance to attacks. However, the accompanying side effect is that the Re-ID performance is also impaired. When "L1 Optimization" is employed, we minimize the L1 loss between protected images and noise images, where 𝑤 is the weight to balance L1 loss and Equation (2). From the right subplot of Figure 4 we can see that no matter what value of w is taken, the resistance performance and Re-ID performance are still far lower than ours. We suppose that the reason for the poor resistance of the above optimization strategies is that simple perturbation cannot completely remove the original information from pedestrian images. In comparison, our Progressive Pixel Fading completely discards the pixel-level information from the original image to ensure effective privacy protection. Meanwhile, the progressive way can motivate the model to effectively capture the intrinsic features of pedestrian images. The above advantages allow our optimization strategy to achieve the optimal trade-off between privacy and utility.A well-applied PPPR method should generalize to different scenarios and backbones. We transfer our PixelFade to other Re-ID scenarios, namely (1) Text-to-Image person Re-ID, aiming at searching protected images by text, and (2) Visible Infrared person Re-ID, which aims at searching the protected infrared image using the original RGB image. We choose an iterative method AVIH for comparison, and the experiment results are shown in Table 5 and Table 6 .Our method outperforms AVIH in different scenarios with different datasets, and the gap to the upper bound is relatively small, suggesting the superior transferability of PixelFade in different Re-ID scenarios.We then demonstrate the experiment of our PixelFade's generalization to different backbones in Table 7 . We selected three commonly used Re-ID backbones for experiments, which have similarly strong Re-ID performance on Market1501 and MSMT17 datasets under the "Protected to Protected" setting. The above experiments demonstrate the high scalability and practicality of our method. In this subsection, we provide an analysis of the impact of some critical parameters in PixelFade on privacy performance and Re-ID performance as shown in Figure 5 . All experiments of parameter analysis are conducted on the Market1501 dataset. Figure 5 (a) shows the convergence of our PixelFade on both ReID performance and privacy performance. As the number of iterations increases, the Re-ID performance rises and the SSIM decreases. After 100 steps, the two metrics are almost constant, implying that our optimization reaches convergence in both two tasks. Figure 5 (b) verifies the robustness of the choice of step size 𝛽. The default 𝛽 is 0.01, and the result implies that a beta in the range of 0.01 ± 0.005 is robust. Figure 5 (c) demonstrates the influence of different feature thresholds 𝜖 on the results. As the 𝜖 increases, which means that the distance between protected and original images becomes farther, leading to a decrease in Re-ID performance and an increase in privacy performance. PixelFade is robust to the feature threshold 𝜖 when it is less than 0.04. Figure 5(d) shows the influence of different number of masks I on the results. Larger I means sparser pixels are replaced in each Partial Replacement Operation, which offers more remaining information to prompt the model for better optimization. When I is in the range from 2 to 8, the privacy performance and Re-ID performance are stable. Generally, our PixelFade is robust to parameter selection. 
conclusion: 
 In this paper, we propose an iterative method to explicitly optimize pedestrian images into noise-like images to resist recovery attacks while maintaining Re-ID performance for authorized Re-ID models. Extensive experiments demonstrate the superior performance of our PixelFade in resisting recovery attacks and Re-ID performance compared to previous methods. Moreover, we experimentally show that our PixelFade can be easily adapted to diverse Re-ID scenarios and network backbones, highlighting its practicality and applicability.  
: 
 However, potential data leakage [4] raised public concern because pedestrian images contain a large amount of personal information (e.g. facial information, profile, appearance, and texture). Public concerns motivate the development of the privacy-preserving person re-identification (PPPR) task [1, 19, 29, 30] , which aims to protect the visual information of pedestrian images while maintaining their discriminative features for authorized models.Existing PPPR methods can be roughly divided into two categories: First, conventional methods visually scramble the body of images via blurring, mosaic, or noise adding. Such methods injure the semantic features of the image, leading to a drop in Re-ID performance. Second, deep learning-based methods [19, 30] achieve a good balance between privacy and utility by transforming images into visually obfuscated images that can be recognized by the authorized Re-ID model. However, the above methods face the risk of recovery attacks [8, 15, 29, 32] . If malicious adversaries are aware of the principle of protection methods or have access to black-box control of the privacy model, they can launch recovery attacks by training a recovery network on the public dataset to learn the mapping from the protected image to the original image. Then the trained recovery network can reverse the protected image to the original image, leading to privacy leakage.To deal with the above problem, we aim to make the protected image resistant to recovery attacks, while hiding their visual information and maintaining the utility for authorized Re-ID models. We start with the Normality Testing [18] on protected images from previous privacy-preserving methods to measure their pixel chaos degree. Here we measure the chaos degree by calculating the similarity of the protected image to a normal distribution via the Anderson-Darling test [18] , where lower values from the test (AD values) represent more chaotic protected images. As illustrated in Figure 1 (a), the following phenomenon was observed: As the pixels of a protected image are more chaotic, the quality of the recovered image deteriorates, suggesting an increase in resistance to recovery attacks. We speculate that the inherent randomness of pixels of protected images can disrupt the recovery network's learning of the mapping from the privacy image to the original image, effectively diminishing the recovery capability of the adversary. Therefore, this inspires us to consider the privacy-preserving image recognition task from a new perspective: Can a pedestrian image be converted into a nearly normal-distributed noise image to resist recovery attacks as well as protect visual privacy?However, naively converting images to random noise damages semantics information, leading to severe loss of discriminative features. It is a challenge to balance the trade-off between privacy and the utility of images. Fortunately, some works regarding adversarial attacks [5, 10, 16] show that deep neural networks (DNN) understand images in a different way from humans. In the TypeI adversarial attack [19, 20] , the process transforms the image into a visually different one, but the model persists in recognizing it as belonging to the same identity. The above approach gives us a feasible way to preserve the high recognition performance of a Re-ID model for visually dissimilar images.In this paper, we provide a simple yet effective method to iteratively optimize pedestrian images into noise-like images to perform PPPR tasks. We define our Noise-guided Objective Function as approximating pedestrian images to normal-distributed noise images to resist recovery attacks and protect privacy. During optimization, a feature constraint is imposed on the feature distance between protected and original images in the feature space of the pre-trained Re-ID model, thereby preserving the utility of protected images. However, Solving the above objective function is a non-convex optimization problem, simple optimization methods cannot find the local optimal point (refer to Section 4.4.2 for more analysis), which seriously impacts the privacy performance or Re-ID performance.To achieve a good balance between privacy and utility, we propose a heuristics optimization strategy, named Progressive Pixel Fading, to process pixels by replacing them with random noise in a progressive manner. Specifically, we iteratively perform the Constraint Operation and the Partial Replacement Operation alternately according to the satisfaction of feature constraints. In the Constraint Operation, we follow TypeI Attack [19] to derive gradients to update protected images to minimize their feature loss with original images. In the Partial Replacement Operation, only part of scattered pixels are replaced with noise. Our Progressive Pixel Fading offers superior advantages in terms of both privacy and utility. On the one hand, the replacement ensures that pixel-level information from the original image is discarded to safeguard privacy. On the other hand, the unreplaced coarse-grained appearance (e.g. color, texture, and contour) of the pedestrians can effectively guide the optimization direction in Constraint Operation to facilitate the preservation of discriminative features.We present a comprehensive experiment with our method (named PixelFade) on three widely used Re-ID datasets. Compared to previous PPPR methods, our PixelFade achieves the best results in terms of resistance to recovery attacks and Re-ID performance. The visualization of protected images shows that PixelFade effectively protects the visual information of pedestrian images. Moreover, our PixelFade can be easily adapted to a multitude of Re-ID network architectures, and diverse Re-ID scenarios, highlighting its high scalability and applicability.Our main contribution can be summarised as three-fold:( [6] , MobileNet [9] , OSnet [33] ) to extract features from pedestrian images. Some works [7, 11] extract pedestrian features by developing the Transformer architecture [21] . To adapt to more practical scenarios, Text-to-Image Re-ID methods [11] aim to match textual descriptions of individuals with their corresponding images across different camera views, and Visible Infrared [17, 26, 27] Re-ID methods aim to address the challenge of Re-ID across visible light and infrared image modalities. To match pedestrians from different cameras, it is usually necessary to upload images and store them in the cloud. However, potential data leakage [4] can result in images being exposed to malicious attackers, potentially leading to tracking or even criminal incidents. To protect the privacy of pedestrian images, we propose a privacy-preserving method that preserves the discriminative features for Re-ID tasks. 
 
 Appendix:  


Decision: This paper defines a Progressive Pixel Fading scenario to optimize pedestrian images into noise-like images to resist recovery attacks for person re-identification. Pre-rebuttal this paper received diverse ratings, i.e. 1 A, 2 BR, 1 WA. The main concerns were only one Re-ID method for evaluation (R2), missing comparison of different methods of image recovery (R3), and the main contribution is not theoretically or experimentally verified(R4). Post-rebuttal the paper still had diverse ratings: 1 A, 1 WR and 2 BA. Two reviewers downgraded the ratings. The rebuttal addressed some of the concerns. However, concerns remained about no numeric evidence of the main contributions (R4). 
After careful consideration of the rebuttal, AC agrees with R1, R2 and R3’s comments that this paper is dealing with a practical problem and proposing an effective strategy. The remaining issues of reviewers are mainly about more details or experiments, which are difficult to be fully addressed in the rebuttal. However, these issues should be fully considered and addressed in the camera ready. AC tends to accept this paper.

Reviews: review: paper_summary: paper_summary: This paper proposes PixelFade, a novel method for privacy-preserving person re-identification (PPPR) that optimizes pedestrian images into noise-like images. The key idea is to resist recovery attacks while preserving discriminative features for authorized re-id models. The authors introduce a Noise-guided Objective Function with feature constraints to guide the optimization process. They also propose a Progressive Pixel Fading strategy, which alternates between a Constraint Operation to maintain re-identification performance and a Partial Replacement Operation to replace pixels with noise for privacy protection. Experiments on multiple datasets demonstrate the work's superior performance in terms of resistance to recovery attacks and re-identification accuracy compared to state-of-the-art methods.
strength_weakness: strength_weakness: - Progressive Pixel Fading strategy effectively balances privacy and utility by alternating between constraint and replacement operations
- Extensive experiments demonstrating superior performance in resisting recovery attacks and maintaining re-identification accuracy
- Scalability to different re-identification scenarios (e.g., text-to-image, visible-infrared) and network architectures
- Comprehensive ablation studies and parameter analysis provide insights into the method's effectiveness and robustness
-  The reviewer likes the idea that converting normal images into noise-like representations but preserving the the person re-id model's functionality because it also solves the visual privacy concerns. The idea is similar to https://dl.acm.org/doi/10.1145/3524273.3528189 but this work focuses on the image classification only.
limitations: limitations: The reviewer would like to see the discussions on the potential failure cases of the proposed work (or the successful rate). The computation resources and timing performance during the optimization process could be further analyzed and discussed.
paper_summary: paper_summary: This paper focus on the face privacy problem in person re-identification scenario. The authors proposed an iterative method that change the original images into noise-like ones, aims to preserve face privacy and avoid impacting re-identification method too much.
strength_weakness: strength_weakness: 1) Privacy is a practical problem to be solved, especially in visual recognition areas.
2) From the results, the proposed method seems to be effective.
3) The authors promise to release the source code for reproducibility.
limitations: limitations: Although the proposed method seems to be effective from the current results, I think the evaluations are not enough.
1) Only one Re-ID method is adopted for evaluating the influence on Re-ID methods (i.e., results in Table 1). More Re-ID methods should be involved to check the effectiveness. 
2) For the recovery attacks, I suggest applying the Re-ID methods to the recovered images and presenting the results, which will be more valid than image quality metrics. Otherwise, there is a possibility that although the recovered images with low image quality are not recognizable for humans, they are easier to be recognized for Re-ID methods.
paper_summary: paper_summary: The paper studies the pedestrian privacy protection method. To this end, they propose an iterative method to explicitly optimize pedestrian images into noise-like images to resist recovery attacks while maintaining Re-ID performance for authorized Re-ID models.
strength_weakness: strength_weakness: The authors propose PixelFade to optimize pedestrian images into noise-like images to resist recovery attacks. Abundant experiments prove its effectiveness on different tasks.
limitations: limitations: 1、	The authors propose PixelFade to resist recovery attacks. However, there are many ways of image recovery. How to implement image recovery in experimental comparison? Different methods of recovery may have different results.
2、	The bigger the noise, the harder it is to recover. In Table 3, the author conducted experiments. What is the effect if the noise is becoming larger? Is it more difficult to recover? What is the impact on the recognition effect?
3、All comparison methods should have the reference in all tables.
paper_summary: paper_summary: This paper defines a Progressive Pixel Fading scenario to optimize pedestrian images into noise-like images to resist recovery attacks for person re-identification. Specifically, the approach introduces a Noise-guided Optimization Objective with feature constraints to protect visual privacy and resist recovery attacks. Experimental results on several benchmark datasets are reported.
strength_weakness: strength_weakness: 1. The language is concise and easy to understand. 
2. The experiments and ablation studies are extensive.
limitations: limitations: Some concerns and suggestions to improve this work are as follows:
1. The abstract is too long and could benefit from being shortened. I suggest revising the abstract to condense the information and focus on the most essential aspects of the research.
2. The main technology of this paper comes from AVIH [19]. I think the main contribution is Partial Replacement Operation, but the premise of this operation has not been given theoretical or experimental proof, and it is difficult to ensure its authenticity.
3. The model architecture could be included. Especially, the explanation of the architecture is not obvious in Figure 2.
4. Can the model handle any privacy protection in the different pedestrian images? Will any separate Noise-guided Progressive Replacement be useful?
5. The language expression in the manuscript needs improvement. I strongly suggest polishing for clarity and coherence.