—In FaceID era, large number of facial images could be used to breach the FaceID system, which demands effective FaceID privacy protection of the facial images for widespread adoption of FaceID technique. In this paper, to our best knowl- edge, we take the ﬁrst step to systematically study such important FaceID privacy issue, under the framework of Compressed Sensing (CS) for fast facial image transmission. Speciﬁcally, we develop the Face-IDentiﬁcation Privacy (FaceIDP) approach to protect the facial images from being used by the adversary to breach some FaceID system. First, a Dictionary Learning neural Network (DLNet) has been developed and trained with facial images database, to learn the common dictionary basis of the facial image database. Then, the encoding coefﬁcients of the facial images are obtained. After that, the sanitizing noise is added to the encoding coefﬁcients, which obfuscates the FaceID feature vector that is used to identify the FaceID. We have also proved that the FaceIDP is "-differentially private. More importantly, optimal noise scale parameters have been obtained via the Lagrange Multiplier (LM) method to achieve better data utility for a given privacy budget ". Finally, substantial experiments have been conducted to validate the efﬁciency of the FaceIDP with two real-life facial image databases, i.e., the LFW (Labeled Faces in the Wild) database and the PubFig database, and the results show that it outperforms other commonly used Differential Privacy (DP) approaches. Index Terms —FaceID, Face Identiﬁcation Privacy (FaceIDP), Differential Privacy (DP), Compressed Sensing (CS), Dictionary Learning Neural Network (DLNet). I. I NTRODUCTION FACE recognition has been extensively used as a biometric authentication method in many ﬁelds such as public safety, ﬁnance, e-commerce, etc., due to its super convenience [1]. Also, in the 5G and beyond era where images and videos on the internet clouds can be transmitted and shared in real time and faster speed than ever [2], [3]. This poses great threat to the FaceID identiﬁcation systems since the adversaries This work is partially supported by the National Natural Science Foundation of China under Grant Nos. 61772191, 61976087, 61972058, and 61902123, National Key R&D Projects (2018YFB0704000, 2017YFB0902904), Science and Technology Key Projects of Hunan Province (2019GK2082, 2015TP1004, 2018TP1009, 2018TP2023, 2018TP3001), Transportation Science and Tech- nology Project of Hunan Province (201819), Science and Technology Chang- sha City (kq1804008, kq2004027). ( *Corresponding author: Shaolin Liao .) Lu Ou (e-mail: oulu9676@gmail.com), Zheng Qin (e-mail: zqin@hnu.edu.cn) and Dafang Zhang (e-mail: dfzhang@hnu.edu.cn) are with the College of Computer Science and Electronic Engineering, Hunan University, Changsha, 410082, China. Shaolin Liao (e-mail: liaoshlin@mail.sysu.edu.cn) is with School of Elec- tronics and Information Technology (SEIT) of Sun Yat Sun University (SYSU). He contributes equally as the ﬁrst author. Yuan Hong (e-mail: yuan.hong@iit.edu) is with the Department of Com- puter Science of Illinois Institute of Technology, Chicago, IL 60616, USA.could combine a user’s multiple facial images to form the 3D feature point cloud and breaches the FaceID system to identify the user of interest. This is especially true in the era of Artiﬁcial Intelligence (AI): through training large number of facial images of the users, face feature vectors could be learned accurately; then the face identiﬁcation of the user is carried out through deep learning, leading to privacy leakage from mining information of the publicly shared facial images [4], [5], [6], [7]. Thus the FaceID systems face the real risk of being breached and FaceID is forbidden in many cities, such as San Francisco and Boston, in USA. Therefore, effective FaceID privacy protection technique is urgent for widespread adoption of FaceID applications. However, there is lack of research on the privacy problem of FaceID protection from falsiﬁed 3D feature cloud points from machine learning of publicly released facial images. However, research on other privacy problems other than the FaceID privacy of publicly shared facial images exist. For example, in order to protect the facial image privacy, image obfuscation [8], [9], [10] such as pixelization and blurring, is adopted to protect image features. Unfortunately, these meth- ods could be re-identiﬁed. To ﬁx this problem, a differentially private pixelization is proposed [11]. Furthermore, under the deep learning environment, adversarial perturbation generative network is proposed to preserve image features [12], [13]. However, these privacy protection methods do not protect the FaceID privacy. What’s more, when facial images are released to the third party such as cloud for public downloads, usually some kind of compression technique is used to achieve fast image trans- mission. The existing methods have to be optimized for the particular image compression framework. One emerging image compression technique is Compressed Sensing (CS), which is an effective technique to increase the image transmission speed through exploring the sparse property of the images [14]. The CS technique can be implemented in both software and hardware, and has already been widely used in optics [15], [16], millimeter wave and terahertz imaging [2], [17], [18], [19], [20], [21], [22], as well as wireless communication [23], [24], [25], [26]. What’s more, since the total number of signiﬁcant sparsifying basis of the images database determines the compression ratio of the CS technique, the facial image basis has to be known to achieve the optimal CS image transmission speed. Also, the facial image database is updated in real time. Thus the sparsifying basis has to be learned adaptively. All of these call for the Dictionary Learning neural Network (DLNet), which can learns the sparsifying basis SUBMITTED TO IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, 2021 2 adaptively in real time [27], [28]. To deal with the FaceID privacy problem under the CS framework, we propose a novel Face-IDentiﬁcation Privacy (FaceIDP) approach under the CS framework. Without loss of generality, the 2D face identiﬁcation, instead of the 3D FaceID identiﬁcation, is used to present the FaceIDP approach. Our major contributions are summarized as follows, To our best knowledge, under the CS image transmis- sion application scenario, we propose a novel FaceIDP approach through adding the sanitizing noise at the face encoding coefﬁcients to protect the FaceID privacy, i.e., to prevent the adversary from using users’ facial images to breach some FaceID systems. To achieve the optimal DP performance, a Dictionary Learning neural Network (DLNet) has been developed to adaptively learn the common dictionary facial image basis of the facial image database so that only sanitizing noise is added to those face encoding coefﬁcients that correspond to the important dictionary facial image basis. The Lagrange Multiplier (LM) method has been used to obtain the mathematical formula of the optimized noise scale parameters of the face encoding coefﬁcients for the constrained optimization problem of maximizing the data utility for a given Differential Privacy (DP) budget ". Extensive experiments have been conducted to test the proposed FaceIDP approach with the Labeled Faces in the Wild (LFW) database [29], and the result shows that the FaceIDP approach outperforms other DP approaches without optimization. II. R ELATED WORK FaceID as an important technology, has been widely used. Meanwhile, its privacy problem is also very important and challenging. Works have been done on the cryptography-based FaceID problems [1], [10]. These cryptography-based methods can deal with facial image data securely. But the facial image data collection center and the third party need to exchange secrets/keys in a secure channel. It does not ﬁt into our non- interactive setting. To the best of our knowledge, little research has been conducted on the privacy problem of FaceID protection. However, research on other privacy problems of the facial images have been conducted. For example, to protect image privacy, researchers used pixelization [8] and blurring methods to achieve image obfuscation. Unfortunately, McPherson et al.[9] studied pixelization and YouTube face blurring and concluded that the obfuscated images using those methods can be re-identiﬁed. Furthermore, in order to deal with such prob- lem, Fan [11] proposed the differentially private pixelization method to protect image features. However, it doesn’t focus on differentially private FaceID problem. Furthermore, regarding the deep learning, Tong and Zheng [12] proposed an adversarial perturbation generative network to generate perturbation to preserve image privacy. Yang et al.[13] proposed a facial image privacy protection method by adding perturbation in the principal components of the facial images.TABLE I NOTATIONS AND DEFINITIONS Symbol Description F A facial image. (A;B) A neighboring facial image pair. F fFg: A FaceID that contains a facial image set of an individual. (A;B) Neighboring FaceIDs of a pair of individuals. F0A noisy facial image. FM The 1D coding coefﬁcients vector of length M. F FM : the facial image coding coefﬁcients dataset. FmfFmg: the coding coefﬁcient data subset. DNM TheNMdictionary basis matrix. VL The feature vector of a facial image Fwith lengthL. PN A 1D pixel vector of a facial image Fof lengthN. P A set of facial image 1D pixel vectors PN . f Probability Distribution Function (PDF). Lap Laplace PDF. CDF Cumulative distribution function of Laplace distribution. Probability space. Pr Probability over a probability space U Data utility. S Local sensitivity. bM Laplace noise scale parameter vector of FM. "m Locus privacy budget. " Loci privacy budget. Therefore, it is necessary to study the optimal FaceID privacy approach in order to achieve better data utility while still protecting the FaceID system from being attacked by the adversaries, which is the focus of this paper. Fig. 1. The FaceIDP problem: the cloud server responds to the smartphone clients’ request for face images and starts the CS face images transmission; then the CS app in the smartphone clients receives and reconstructs the face images, which could be used by the adversary to intrude some FaceID identiﬁcation system (left scenario); so the FaceIDP mechanism runs on the cloud server side to sanitize the face images before the CS face images transmission to protect the FaceID privacy of the face images (right scenario). III. P ROBLEM STATEMENT To start, Table I lists some key variables used across this paper with their explanations. A. System Model The typical working scenarios of the FaceIDP problem are shown in Fig 1: the smartphone client initiates the request for face images; then the cloud server responds to the request SUBMITTED TO IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, 2021 3 and sends the CS face images, with or without the FaceIDP protection; upon receiving of the CS face images, the CS app on the smartphone client reconstructs the 3D feature point cloud from the face images, which could be used to intrude some FaceID identiﬁcation system by the adversary; without the FaceIDP protection, the adversary could break the FaceID identiﬁcation system; while with the FaceIDP protection, the FaceID identiﬁcation system is intact. B. Facial Images and FaceID A facial image is any facial image of any individual, which is characterized by its 1D pixel vector denoted as PNof length N. Deﬁnition III.1 (Facial Image Set) .The facial image set P consists of all individuals’ facial images, P= PNjN= 0;1; : (1) Deﬁnition III.2 (FaceID) .The FaceIDFis the unique identi- ﬁcation of an individual: it consists of a set of an individual’s facial images F, F= F:PN : (2) C. The Facial Images CS Under the CS framework, sparse facial images can be decomposed in some basis D. So only partial measurements of the image are required for transmission, greatly increasing the image transmission speed. 1) Facial Image Decomposition: A facial image can be decomposed into some NMdictionary basis DNMwith its coding coefﬁcient vector FMof lengthM, PN=DNMFM: (3) 2) The CS Framework: Assuming the basis Dis known or learned through the DL-NN, the CS performs the following partial measurements, yM=MNPN=MNDNMFM; (4) wherePNis a facial image pixel vector and an MNmea- surement matrix MNis used to generate the measurement vectoryMof lengthM. Also, the NMdictionary basis matrixDNMhas a coefﬁcient coding vector FMof length M. D. Facial Image Data 1) Facial Image Data Records: A facial image data record is a set of facial images of an individual deﬁned as Deﬁnition III.3. Deﬁnition III.3 (Data Record) .A data record of the FaceIDP is for all facial images Fof an individual, identiﬁed by the FaceIDFand represented by the coding coefﬁcients vector FM,  FM :F2F: (5)2) FaceID Datasets: A FaceID dataset of the FaceIDP consists of facial image sets of all users, Deﬁnition III.4 (Dataset) .The dataset of the FaceIDP is given by, F=fFg: (6) Fig. 2. Feature vector spaces for FaceID A: all FaceIDs other than FaceID A are neighboring face images sets of FaceID A; also, the closest neighboring FaceID is the FaceID with the minimum separation distance dfrom the FaceID A,i.e., FaceIDB; Finally, the closest face images pair is the face images in the closest FaceID pair that has the minimum separation distance, i.e., the face pair (A;B). 3) The Neighboring Data Records: The neighboring data records are a user’s facial image set and all other users’ facial image set, represented by their coding coefﬁcients vectors, Deﬁnition III.5 (The Neighboring Facial Image Sets) .The neighboring facial image sets are the face image set of a user (A2A) and the face image set of all other users ( B2B), n F(A) M:A2Ao ;n F(B) M:B =2Bo :B[A =?:(7) 4) The Closest Neighboring Face Image Pair: The closest neighboring face images are a pair of most similar face images of the neighboring face image sets in Deﬁnition III.5 , under the measure ofM, Deﬁnition III.6 (The Closest Neighboring Face Images) .The cloest neighboring face image pair is, (A;B) :argmin BfjM (A)M (B)jg: (8) E. The FaceIDP under the CS Framework In this paper, we study the privacy problem of the FaceID under the CS framework: to protect the user’s FaceID from being attacked by the adversary while still providing the SUBMITTED TO IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, 2021 4 optimal data utility for the face image CS application to achieve fast face image transmission. F . The DP Framework Deﬁnition III.7 (Differential Privacy) .LetMbe a random- ized query measure function, Abe any output ofM,AandB be two neighboring datasets. Mwill be"-differential private, if the following is satisﬁed exp(")Pr(M(A)2A) Pr(M(B)2A)exp("): Under the scenario of FaceID, we are interested only in whether the FaceID system can distinguish between two closest face images, the neighboring datasets are the the closest neighboring face images given in Deﬁnition III.6 . 1) The FaceID Query Measure Function: The FaceID query measure function Mis to identify a user’s identiﬁcation based on all noisy face images of the user. The measured outcomes are either “1” if the measure function Mcan identify the user’s identiﬁcation or “0” if the measure func- tionMcannot identify the user’s identiﬁcation, above some conﬁdence probability level. G. Adversary Model The goal of the FaceIDP is to prevent the adversary from using a set of sanitized facial images of a user to pass the FaceID identiﬁcation system. Thus the sanitizing noise has to be added in such a way that the FaceID identiﬁcation system cannot distinguish if a set of noisy facial images belong to a user or not, with some conﬁdence probability level. IV. C ONCEPTS In this section, some basic concepts are given. A. The Locus Differential Privacy The Locus Differential Privacy (Locus-DP) is deﬁned at each locus of a loci [4], [5], [6], Deﬁnition IV .1 (The Locus Differential Privacy) .The random obfuscating measure function M0for a data subset Fmof a given data set FM:Fm2FM;m= 1;M, is said to be "m-deferentially private if the following probability condition is satisﬁed after the sanitizing noise is added to Fm, exp ("m)Prn M0 F(i) mo =F0 m Prn M0 F(j) mo =F0mexp ("m); where in this paper, the random obfuscating measure function M0is the Euclidean norm distance measure Mgiven below that is sanitized by the Laplace noise, M F(A) MF(B) M  F(A) MF(B) M 2 =vuutLX `=1 F(A) mF(B) m2 : (9)B. The Loci DP or DP The loci DP or simply DP [30], [31] is deﬁned on the data setFM:fFmjm= 1;;Mgin such as way that the sanitizing noise added to Fmaccording to Deﬁnition III.7 will satisfy the following probability relation, Deﬁnition IV .2 (Loci DP or DP) . exp (")Pr M FM =F0 M Pr M FM =F0 Mexp ("): C. Joint Probability Bounds From Deﬁnition IV .2 , it is clear that the privacy budget  is closely related to the lower and upper bounds of numerator and denominator. The joint Probability Distribution Function (PDF) of multivariate random variables vector FMof length M, denoted as f(FM), has its lower and upper bounds on a domain given as follows, Lemma IV .1 (Bounds of the Joint Probability) .The lower and upper bounds of the joint probability of f(FM)on a domain is given by Pr(FN2 )8 < :max FmMQ m=1Pr(Xm2 Fm) , Pr(FM2 )minmfPr(Fm2 )g, where =I is the complementary domain with Ibeing the entire domain of interest; and Fmis the sub-domain in which allFMbelongs to . Proof: The joint probability distribution can be expressed in terms of the conditional probability distribution, f(F) =f(Fm)f(Fm1;Fm+1;jFm)f(Fm); where the following conditional probability property has been used, f(Fm1;Fm+1;jFm)1: from which the probability in domain is given by, Pr(F2 ) =Z F1Z FMf(F)dF1dFM (10) Z F1Z FMf(Fm)dF1dFM=Pr(Fm2 ); and the upper bound on the right hand side of Lemma IV .1 is proved, Pr(F2 )min mfPr(Fm2 )g: (11) The lower bound of the left hand side of Lemma IV .1 can be obtained by ﬁnding the sub-domains of all Fn, denoted as Fm, in which all FMbelongs to and the probability is given by, Pr(FM2 )min m Pr(Fm2 ) ; (12) SUBMITTED TO IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, 2021 5 from which the lower bound of the probability in domain is given by, Pr(F2 )Z F1Z FNf(F)dF1dFM Z F1Z FMf(Fm)dF1dFM=MY n=1Pr(Fm2 Fm); where independence has been assumed for all elements of FM and the lower bound is thus obtained as, Pr(F2 )max Fm(MY m=1Pr(Fm2 Fm)) ; from which Lemma IV .1 is proved.  D. Data Utility in the CS Framework When the coding coefﬁcients noise nMis added to a face image’s coding coefﬁcients FM, the noisy image is thus obtained as, P0 N=PN+DNMnM: (13) Then, the data utility under the CS framework is thus deﬁned as follows, Deﬁnition IV .3 (Data Utility) .The data utility is deﬁned as the visual quality of the image [12]: here the expectation of the variance of the reconstructed noisy image from the original image, U=E P0 NPN 2 2 : (14) Substituting Eq. (13) into Eq. (14), the data utility is obtained, U=E nT M DT NMDNM nM =MX m=1Wm2 m; Wm=NX n=1D2 n;m; (15) wheremis the standard deviation of the noise component nm, which is assumed to be independent from each other. E. Differential Privacy for FaceID FaceID can be considered as a special classiﬁcation method. FaceID takes the human face as input and extract the feature vector, denoted by F, of the human face and then adopts some judgement metrics, denoted by M, to identify which individual the human face will be assigned to, denoted by A. The privacy budget "for FaceID is deﬁned as follows, Deﬁnition IV .4 (Privacy Budget) .The privacy budget for the DP problem of FaceID is deﬁned as the negative logarithmic value of the maximum ratio between the probabilities of the assigned FaceIDAof any pair of human face images (A;B)that belong to two different FaceIDs A2A;B2B after the sanitizing noise is added, "=ln0 B@max8 >< >:Pr P(B0) N:B02A Pr P(A0) N:A02A9 >= >;1 CA; (16) whereP(B0) N is the noisy face image B0that belongs to the FaceIDBandP(A0) N is the noisy face image A0that belongs to the FaceIDA. F . Optimal Noise Scale Parameters The data utility in Deﬁnition IV .3 and the privacy budget inDeﬁnition 16 are a balanced pair: if the data utility is high (Uis low), the privacy is low ( "is high) and vice versa. Also they are both functions of the noise scale parameter of nM, denoted asbM. So it is desire to optimize the data utility U for the given privacy budget "="0, which is the constraint optimization problem, Lemma IV .2. The constraint optimization of the data utility U for a given privacy budget "can be done through the Lagrange Multiplier (LM) method, @ @bML(bM) = 0;"(bM) ="0; (17) L(bM) =U(bM) + "(bM)"0 ; Proof: The constraint optimization problem can be expressed as follows, min U(b) ; s:t: " (b) ="0; (18) The optimization is achieved when the derivatives of L(bN) with respect to both bNand the Lagrange multiplier and Lemma IV .2 is proved.  Fig. 3. The working principle of the DLNet to learn the sparse dictionary basis of the face images. V. O URAPPROACH In this section, we present the details of our proposed FaceIDP approach. Under the CS framework, the face images are represented as the coding coefﬁcients vectors under some face images’ dictionary basis. So we ﬁrst build the DLnet to learn the face images’ dictionary basis. Then the sanitizing SUBMITTED TO IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, 2021 6 noise is added to the coding coefﬁcients vectors. After that, the probabilities of the noisy neighboring face image pair (A;B) that are assigned the FaceID Aare calculated. Finally, the privacy budget’s lower and upper bounds are obtained. A. The DLNet Fig. 3 shows the working principle of the DLNet for face images’ dictionary basis learning [28]: the DLNet consists of multiple layers with their basis denoted as D(k) Mi+1Mk;k= 1;K and the corresponding coding coefﬁcients denoted as F(k) Mk; Both the dictionary basis and the coding coefﬁcients can be trained through minimizing the two error functions, i.e., the mean square error of the reconstructed image E, E= P0 NPN 2 ; (19) as well as the `1norm of the sparse codes F(k) Mk 1. The DLNet is trained through two sequential steps: 1) updat- ing of the parameters through the Stochastic Gradient Descent (SGD) method; and 2) performing the `1norm operation on the updated parameters. 1) The SGD Updating: First, the gradient of parameter x, denoted asrxE, can be obtained through the train rule, rxE=NX n=1(PnP0 n)rxP0 n; (20) and the parameter xis updated as follows x=xrxE; (21) withbeing the learning rate and the parameter xis either the dictionary bases or the coding coefﬁcients, x= DMkM;F(k) Mk : (22) 2) The`1-norm Operation: Then, the`1-norm Operation is performed on the SGD updated coding coefﬁcients F(k) Mk through the Iterative Soft Thresholding Algorithm (ISTA) to achieve the sparsity of the coding coefﬁcients, F(k) Mk=sign F(k) Mk max 0;F(k) Mk ; (23) whereis the thresholding value. Finally, after the training of the DLNet, the total dictionary basisDNMis obtained as follows, DNM=DNMK KY k=1DMk+1Mk! DM1M: (24) B. Data Utility For joint Laplace distribution of FM, the data utilityUin Deﬁnition IV .3 is reduced to the following, U=MX m=12Wmb2 m; (25) where the variance of the Laplace distribution 2 m= 2b2 mhas been used. Fig. 4. PDF spaces and sensitivities of the FaceIDP shows the relation between the PDF space of the feature vector and the PDF space of the coding coefﬁcients vector for the closest neighboring face image pair (A2A;B2 B). Both the origin of the feature vector space and the coding coefﬁcients space are set to the center of FaceID A. C. Privacy Budget According to the deﬁnition of the privacy budget in Deﬁni- tion 16 , the lower bound and upper bound of two probabilities have to be computed: 1) the probability that a noisy face image B0of FaceIDBis mistakenly assigned to FaceID A; and 2) the probability that a noisy image A0of FaceIDA2A is still assigned the correct FaceID A. These probabilities are related to two inter-correlated provability spaces, as shown in Fig. 4: 1) the FaceID feature vector space; and 2) the face coding coefﬁcients space. First, the FaceID Ais assigned to a face image Fthrough the Euclidean norm measure Mon the feature vector VLof lengthL, F2A:M VL = VL 22 A= VL 2R; VL 2vuutLX `=1(VL)2; (26) whereRis the radius of FaceID Aas shown in Fig. 4. Then, the probability of a face Fassigned FaceIDAis given by, PF=Pr M VL 2 A : (27) Also, the feature vector space VLis related to the face coding coefﬁcients vector FM. For example, when the change of a single face coding coefﬁcients element Fmcorresponds to a provability curve VL 2in the feature vector space VL, as shown in Fig. 4. Deﬁnition V .1 (Probability Boundary Edges) .The probability boundary edges deﬁne the probability space within which the noisy image B0is assigned the FaceID A, while other coefﬁcients elements are set to zeros, i.e., F(B0) m0= 0;m06=m,  s m;s+ m F(B0) m2 s m;s+ m 2 A: (28) SUBMITTED TO IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, 2021 7 1) Probability of the Noisy Face BAssigned FaceIDA: The probability that a noisy face image from its original face imageBof FaceIDBis mistakenly assigned to FaceID Ais given by, PBPr F(B0) M:B02A bM =Pr Mn F(B0) Mo 2 A =Z Z Mn F(B0) Mo 2 AfbM F(B0) 1;;F(B0) M dF(B0) M; wherefbMis the joint Laplace PDF of F(B0) M with the noise scale parameter vector of bM, fbM F(B0) 1;;F(B0) M =Lap F(B0) M bM ; (29) Lap F(B0) M bM =MY m=1Lap F(B0) m bm ; where independence has been assumed for FM. Now look at the lower bound and upper bound of the probability according to Lemma IV .1 . First, the probability upper bound is given by, P+ Bmaxn Pr Mn F(B0) Mo 2 Ao (30) = min mZ Z Fm2 ALap F(B0) mF(B) m bm dF(B0) m; = min mn CDF s+ mF(B) m CDF s mF(B) mo ; whereCDF is the cumulative distribution function of the Laplace distribution; and s mands+ mare the left and right probability boundary edges of coding coefﬁcients element m in Agiven in Deﬁnition V .1 . Similary, according to according to Lemma IV .1 , the prob- ability lower bound is given by, P Bminn Pr Mn F(B0) Mo 2 Ao = max A;m(MY m=1Pr F(B0) m2 A;m) ; (31) where the local probability space A;mcan be obtained as follows, Deﬁnition V .2 (Local Probability Domain) .The local prob- ability domain is deﬁned as the maximum linear scaling of space bounded by the probability boundary edges such that the noisy image B0is assigned the FaceID A, A;m=  s m;s+ m : =argmax fB0!Ag; (32) for all coding coefﬁcients elements m= 1;Mand is the linear scaling parameter. Now the probability lower bound in Eq. (31) reduces to the following, P B=MY m=1n CDF s+ mF(B) m CDF s mF(B) mo : (33)2) Probability of the Noisy Face AAssigned FaceIDA: Similarly, the probability that a noisy image A0from a FaceID A2A is still assigned the correct FaceID Ahas the following uppper bound and lower bound, PAPr Mn F(A0) Mo 2 A P+ Amaxn Pr Mn F(A0) Mo 2 Ao = min m CDF s+ m CDF s m ; P Aminn Pr Mn F(A0) Mo 2 Ao =MY m=1 CDF s+ m CDF s m : (34) 3) Privacy Budget Bounds: With the above probability bounds, the privacy budget bounds can be obtained. Lemma V .1. The privacy budget has the lower bound and upper bound of " bM " bM "+ bM ; (35) where"and"+are the lower bound and upper bound given below. Proof: The privacy budget "is obtained from Deﬁnition 16 , " bM =ln max (A;B)PB PA : (36) From Eq. (30) and Eq. (34), the lower bound of the privacy budget is given by, "= max (A;B) lnP A P+ B = max (A;B)( ln P A min P+o B;P+i B !) ; (37) where P A=Y m8 < :1exp  s+ m bm + exp s m bm 29 = ;; P+o B= min FBm=2(s m;s+ m)8 < : exp S+ m bm exp S m bm 29 = ;; P+i B= 1 max FBm2(s m;s+ m)8 < :exp S+ m bm + exp S m bm 29 = ;; andS mandS+ mare the distances from the left and right probability boundary edges given below, S m= FB ms m ;S+ m= FB ms+ m : (38) Similarly, from Eq. (33) and Eq. (34), the upper bound of the privacy budget is given by, "+= max (A;B) lnP+ A Pi BPo B ; (39) SUBMITTED TO IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, 2021 8 where P+ A= min m8 < :1exp S+ m bm + exp S m bm 29 = ;; (40) Po B=Y FBm=2(s m;s+ m)8 < : exp ~S+ m bm exp ~S m bm 29 = ;; Pi B=Y FBm2(s m;s+ m)8 < :1exp ~S+ m bm + exp ~S m bm 29 = ;; where ~S+ mand~S mare deﬁned as follows, ~S+ m= FB m s+ m ;~S m= FB m s m : After some mathematics calculation, the upper bound of the privacy budget can be expressed as follows, "+=+X FBm=2(s m;s+ m)Sm bm; with = max (A;B)( ln P+ AQPi BQ~Po B!) ~Po B=Y FBm=2(s m;s+ m)8 >>< >>: 1exp j~S+ m~S mj bm 29 >>= >>;; where the local sensitivity Smis deﬁned as follows, Deﬁnition V .3 (Local Sensitivity) .The local sensitivity is de- ﬁned as closest distance from the coding coefﬁcients elements to their probability boundary edges, Sm= minn ~S m;~S+ mo : (41)  VI. A NALYSIS In this section, the FaceIDP noise mechanism is proved to satisfy the"-deferentially private guarantee. Theorem VI.1. The noise mechanism of the FaceIDP satisﬁes "-differential privacy, exp (")Pr F(B0) M:B2A Pr F(A0) M:A2Aexp ("); with "=+X FBm=2(s m;s+ m)Sm bm: Proof: From Lemma V .1 , the privacy budget has its upper bound of " bM +X FBm=2(s m;s+ m)Sm bm; from which Theorem VI.1 is proved. VII. O PTIMAL NOISE FOR BETTER DATA UTILITY From Lemma IV .2 , the data utilityUcan be optimized to obtain the optimal noise scale parameter bM, for a given privacy budget ", min bM( U=MX m=12Wmb2 m "(bM) ="0) : (42) With the probabilities given in Eq. (40), the LM optimiza- tion problem in Eq. (42) can be solved numerically. Under the approximation that P+ A,Pi BandPi Bare constants, the privacy budget factor is also a constant and an effective privacy given budget "0 0can be deﬁned according to Theorem VI.1 "0 0="0=X FBm=2(s m;s+ m)Sm bm; (43) and the LM optimization problem in Eq. (42) reduces to the following, @ @bML(bM) = 0;X FBm=2(s m;s+ m)Sm bm="0 0="0; (44) L(bM) =X FBm=2(s m;s+ m)2Wmb2 m+2 64X FBm=2(s m;s+ m)Sm bm"0 03 75: Theorem VII.1 (Optimal Noise Scale Parameters) .The opti- mal noise scale parameters vector b mis given by, b m=Sm "0m; (45) with "0 m=pm"0 0 pm=W1=3 mS2=3 mP FBm=2(s m;s+ m)W1=3 mS2=3 m: Proof: From Eq. (44), @ @bML(bM) = 0!bm=Sm 4Wm1=3 ; (46) from which the constraint of the privacy budget is given by, X FBm=2(s m;s+ m)S2=3 m(4Wm)1=3 ()1=3="0 0; (47) and =0 BBB@P FBm=2(s m;s+ m)S2=3 m(4Wm)1=3 "0 01 CCCA3 : (48) Substituting Eq. (48) into Eq. (46), the noise scale param- eters are obtained and Theorem VII.1 is proved.  VIII. A LGORITHM The algorithm for the FaceIDP is shown in Algorithm 1. SUBMITTED TO IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, 2021 9 Algorithm 1 FaceIDP Input: Face images Pand privacy budget ". Output: Sanitized face images P0satisfying DP. 1:P0=? 2:Learn the sparse dictionary basis Dof the face images data set through the DLNet. 3:foreach face image PN2Pdo 4: Decompose the face image PNinto the product of the selected dictionary basis DNMand coding coefﬁcients vectorFM. 5: Compute the weight vector WMaccording to Eq. (15). 6: Calculate the sensitivity vector SMaccording to Eq. (41). 7: Compute the optimal noise scale parameters bMac- cording to Theorem VII.1 . 8: Obtain the coding coefﬁcients noise through the joint Laplace distribution: M=QM m=1Lap(Fmjbm). 9: Obtain the sanitized noisy image P0 Naccording to Eq. (13). 10: Update the sanitized image dataset: P0=P0[P0 N. 11:return P0. IX. E XPERIMENTAL RESULTS During the FaceIDP experiment, the pre-trained model of Dlib, a ResNet based neural network, is used in Python 3.7 to perform the face recognition. The has been trained and tested with two databases: 1) LFW database [29] and 2) PubFig database [32]. On one hand, LFW is a database of face photographs designed for studying the problem of unconstrained face recognition. On the other hand, unlike most other existing face databases, these images of the PubFig database are taken in completely uncontrolled situations with non-cooperative subjects. The face recognition consists of 4 common stages: face detection, face align, face encodings representation and face veriﬁcation. The facial landmark detector ﬁle is “shape predictor 68face landmarks.dat” and the ResNet model ﬁle is “dlib face recognition resnet model v1.dat” [33]. The face encoding feature vector VLhas a dimension of L= 128 and the Euclidean distance is used to recognize the faces with a threshold of 0.6. To show the efﬁciency of our optimal FaceIDP method, we compared it to the standard-DP method and the partial- DP method where sanitizing noise is added to partial coding coefﬁcients that lie outside of the Probability Boundary Edges according to Deﬁnition V .1 :FB m=2(s m;s+ m),i.e., sanitizing noise is added to coding coefﬁcients that have the most signiﬁcant effect on the face encoding feature vectors, as shown in Theorem VI.1 . A. The DLNet First, the common bases of the face images DNMare learned through the DLNet in Section V-A . 1000 face images of the LFW database are used to train the DLNet to obtain 100 face dictionary bases. During the training, the learning Fig. 5. (LFW Database) The closest neighboring Face Aand FaceBfor a given data utilityU= 13 : 1st column) original faces; 2nd column) Standard- DP noisy faces; 3rd column) Partial-DP noisy faces; and 4th column) the optimal FaceIDP noisy faces. Fig. 6. (PubFig Database) The closest neighboring Face Aand FaceBfor a given data utilityU= 13 : 1st column) original faces; 2nd column) Standard- DP noisy faces; 3rd column) Partial-DP noisy faces; and 4th column) the optimal FaceIDP noisy faces. rate of the SGD and the ISTA thresholding value are set as follows, = 0:01;= 0:01 max F(k) Mk ; k= 1;2;;K: B. The Sanitized Face Images Then, we obtained the closest neighboring face image pair according to Deﬁnition III.6 ,i.e., the minimum Euclidean distance difference. For the LFW database, the obtained closest neighboring face images are shown in the 1st column of Fig. 5, which are labeled as Face Aand FaceB. Next, the sanitizing noise for a given data utility U= 13 in Eq. (25) is added to the closest neighboring face images with the 3 DP methods, i.e., the Standard-DP sanitized face images in the 2nd column; the Partial-DP sanitized face images in the 3rd column; and the optimal FaceIDP sanitized face images in the 4th column. To show the difference clearly, Fig. 7 zooms in the left eye of FaceAand mouth of Face B, from which we can see that the optimal FaceIDP method obtain the most signiﬁcant difference from the original face images, providing better protection for the FaceID privacy or smaller privacy budget , for a given data utilityU. Similarly, for the PubFig database, Fig. 6 shows original and noisy face images of the 3 approaches, for a data SUBMITTED TO IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, 2021 10 Fig. 7. (LFW Database) The zoom-in view of (left) eye and mouth of the closest neighboring Face Aand FaceBof Fig. 5, for a given data utility U= 13 : 1st column) original (left) eye and mouth; 2nd column) Standard- DP noisy (left) eye and mouth; 3rd column) Partial-DP noisy (left) eye and mouth; and 4th column) the optimal FaceIDP noisy (left) eye and mouth. Fig. 8. (PubFig Database) The zoom-in view of (left) eye and mouth of the closest neighboring Face Aand FaceBof Fig. 5, for a given data utility U= 13 : 1st column) original (left) eye and mouth; 2nd column) Standard- DP noisy (left) eye and mouth; 3rd column) Partial-DP noisy (left) eye and mouth; and 4th column) the optimal FaceIDP noisy (left) eye and mouth. utilityU= 15 . Also, Fig. 8 shows the zoom in views of the left eye and mouth respectively, from which one can see that the privacy budget is smaller for the optimal FaceIDP method, as expected. In particular, it can be noticed that the quality of the facial images of the PubFig database (Fig. 8) is not as good as those of the LFW database (Fig. 7) due to the uncontrolled situations with non-cooperative subjects. C. The Sanitized Coding Coefﬁcients and Feature Vectors After that, to show the quantiﬁed results of the privacy protection, both the sanitized coding coefﬁcients and the feature vectors are calculated. For the LFW database, the coding coefﬁcients difference (dimension of 100) between FaceAand FaceBis obtained, as shown in Fig. 12. Also, the feature vector difference (dimension of 128) between Face Aand FaceBis obtained, as shown in Fig. 10, from which we can see that the sum of the feature vector difference of the optimal FaceIDP (red triangles) is the smallest for a given data utilityU, indicating better FaceID privacy protection or smaller. Similarly, for the PubFig database, Fig. 9 and Fig. 11 show the the coding coefﬁcients differences and the feature vector differences for the original face images and noisy face images of the 3 approaches respectively, from which one can see better FaceID privacy protection has been achieved for the optimal FaceIDP method. D. The Privacy Budget and Data Utility To show the performance of the optimal FaceIDP, the privacy budgets for different data utilities have been obtained. Fig. 9. (PubFig Database) The coding coefﬁcients difference between Face A and FaceB: original value, Standard-DP noisy value, Partial-DP noisy value and the optimal FaceIDP noisy value. Fig. 10. (LFW Database) The feature vector difference between Face Aand FaceB: original value, Standard-DP noisy value, Partial-DP noisy value and the optimal FaceIDP noisy value. For the LFW database, is calculated forU= [5;30] and the result is shown on the left plot of Fig. 13, from which it can be seen that the FaceID privacy protection of the FaceIDP method is the best among all methods, i.e., it has the smallest privacy budget (green stars). Also, the Partial- DP method is better than the Standard-DP method, which is because that only the most signiﬁcant coding coefﬁcients are used in the Partial-DP method to achieve better privacy protection with smaller data utility U. Also, on the right plot of Fig. 13, the data utility Uis plotted against the privacy budget, which again shows that the optimal FaceIDP has the smallest data utility (the best data utility) for a given privacy budget= (2:2;2:9). Also, the Partial-DP method shows better performance than the Standard-DP method, i.e., for a given privacy budget , the data utilityUis smaller (better). Similarly, for the PubFig database, the left and right plots of Fig. 13 show the privacy budget for different data utility Uand vice versa respectively, from which again it can be seen that the optimal FaceIDP outperforms the other 2 approaches. X. C ONCLUSION In this paper, the differential privacy problem of FaceID, i.e., the FaceIDP, has been studied. Under the CS framework, a DLNet is built to learn the dictionary basis of the face images. After that, the sanitizing noise is added to the coding coefﬁcients of the face images. Then the FaceIDP is proved to SUBMITTED TO IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, 2021 11 Fig. 11. (PubFig Database) The feature vector difference between Face A and FaceB: original value, Standard-DP noisy value, Partial-DP noisy value and the optimal FaceIDP noisy value. Fig. 12. (LFW Database) The coding coefﬁcients difference between Face A and FaceB: original value, Standard-DP noisy value, Partial-DP noisy value and the optimal FaceIDP noisy value. be"-differentially private and the lower and upper bounds of the privacy budget are obtained. What’s more important, the formulas of the optimal noise parameters to achieve better data utility have been derived. Also, experiment has been carried out with 2 facial images database, i.e., the LFW and the PubFig databases, to conﬁrm the efﬁciency of the FaceIDP to protect the FaceID privacy while still achieving good data utility. Although only 2D face identiﬁcation privacy problem is studied in this paper, the FaceIDP approach can be readily extended to the 3D FaceID privacy problem. At last, the FaceIDP can be deployed in many scenarios, including face images transfer between the cloud server and the smartphones, point-to-point face images transmission, as well as face-to-face real-time video chat.