You Can Use But Cannot Recognize: Preserving Visual Privacy in Deep Neural Networks

You Can Use But Cannot Recognize: Preserving Visual Privacy in Deep Neural Networks

Speakers: Qiushi Li

Conference: NDSS Symposium

YouTube: Not publicly available

Overview

The proliferation of Deep Neural Networks (DNNs) has ushered in an era of transformative advancements across diverse domains, from powering autonomous vehicles to revolutionizing medical diagnostics. However, the insatiable demand of these powerful models for vast quantities of image data has simultaneously exacerbated critical privacy concerns. Personal and sensitive information, including facial characteristics, license plate numbers, and confidential patient data, can be inadvertently exposed or reconstructed from the data used in DNN training and inference. Existing privacy-preserving techniques, while well-intentioned, often prove inadequate for the unique challenges posed by visual data, either by degrading model performance, incurring prohibitively high computational costs, or failing to truly obscure visual features from human perception.

This talk introduces VisualMixer, a novel and robust privacy-preserving framework designed to address this fundamental dilemma: how to safeguard the visual privacy of image data within DNN workflows without compromising model accuracy or performance. Unlike traditional methods that inject external noise (which can often be filtered by human eyes) or rely on computationally intensive encryption, VisualMixer employs a unique strategy of spatially and chromatically shuffling pixels within images. This "noise-free" approach effectively obfuscates visual features, rendering them unrecognizable to both human observers and reconstruction attacks, while maintaining the underlying data utility essential for DNN tasks.

A cornerstone of VisualMixer is the introduction of Visual Feature Entropy (VFE), a new, task-agnostic metric that quantifies the level of visual features and privacy from both biological and machine vision perspectives. VFE dynamically guides VisualMixer's adaptive pixel shuffling, allowing for precise control over obfuscation intensity. Furthermore, to ensure stable and efficient model training with this shuffled data, the framework integrates ST-Adam, a specially tailored optimizer designed to mitigate the gradient oscillations that can arise from data obfuscation. VisualMixer represents a significant step forward in practical visual privacy, demonstrating effective protection with an average accuracy loss of only 2.35 percentage points across diverse DNN models and datasets.

Background

[▶ Watch: Introduction: DNN privacy concerns and existing solution gaps. (0:00)]()

The increasing reliance on image data for Deep Neural Network (DNN) training and inference has brought privacy to the forefront of security research. The talk details a specific threat model where clients upload image data (either plain or obfuscated) to a semi-honest server for model training. This server, while executing its designated tasks, is assumed to actively seek to compromise client data. The adversaries' potential actions include: directly accessing uploaded images to recover original features; reconstructing DNN-trained data through techniques like membership inference attacks or GAN-based reconstruction; and recovering visually distinguishable images from intermediate gradients and feature maps during training and inference. Critically, the image label is considered non-private, as it is essential for the utility of the training task.

To counter these threats, VisualMixer was designed with three core goals. First, to create a quantifiable task-agnostic visual privacy metric that can effectively balance utility and privacy in complex visual data, given the interpretability challenges of many DNNs. Second, to develop a visual-semantic obfuscation method that prevents adversaries from extracting meaningful visual information without injecting external noise, thus preserving data utility for diverse vision tasks. Third, to design a tailored optimizer capable of handling the abrupt gradient changes and oscillations introduced by data obfuscation, ensuring stable and fast model convergence.

Existing privacy-preserving techniques largely fall short in addressing these specific challenges for visual data. Differential Privacy (DP), while offering strong mathematical guarantees for statistical data, struggles with images. DP injects external noise, often in the high-frequency domain, which human eyes can easily filter, thus failing to truly obscure visual features. As demonstrated in the research, increasing noise for stronger DP guarantees (e.g., σ²=100) can plummet model accuracy to a mere 40.5%, rendering datasets practically useless. The fundamental flaw of DP in this context is its lack of a direct metric for visual privacy, leading to inefficient noise injection that severely degrades utility. Other obfuscation methods like blurring or blocking often require precise knowledge of private information locations, which is costly and often infeasible. k-anonymity is similarly challenging to apply to complex visual data. Even Federated Learning (FL), while keeping data local, remains vulnerable to gradient leakage. On the encryption front, Fully Homomorphic Encryption (FHE) offers rigorous security but imposes an extreme computational overhead, with arithmetic operations potentially incurring 10x to 10,000x additional time, making it impractical for large-scale image processing. Trusted Execution Environments (TEEs), such as Intel SGX, provide hardware-level protection but suffer from limited resources and evolving compatibility with DNN accelerators like GPUs, significantly impacting performance. These limitations underscore the necessity for VisualMixer's novel approach, which focuses on visual-semantic obfuscation without noise injection or excessive computational burden.

Key Findings

[▶ Watch: Introducing Visual Feature Entropy (VFE) for visual privacy. (1:10)]()

VisualMixer demonstrates a groundbreaking capability to preserve visual privacy in Deep Neural Network (DNN) workflows with minimal impact on model performance and robust defense against sophisticated attacks. A central finding is that VisualMixer achieves effective visual privacy preservation with an average accuracy loss of only 2.35 percentage points compared to training on plain, unobfuscated data across a diverse range of models and datasets. This negligible degradation stands in stark contrast to Differential Privacy (DP) or Homomorphic Encryption (FHE) methods, which often lead to substantial accuracy drops or impractical computational overheads.

The ST-Adam optimizer, a key component of the framework, consistently outperformed the standard Adam optimizer in terms of both accuracy and convergence speed during training with obfuscated data. Experiments on MNIST, CIFAR-10, and ImageNet-100 datasets visually confirmed ST-Adam's superior optimization performance, effectively mitigating the gradient oscillations introduced by pixel shuffling.

VisualMixer proved highly resilient against various privacy attacks. For instance, the adaptive window sizing strategy ensures that for a window size of 6 pixels or greater, the total number of permutations exceeds 2^128, rendering exhaustive search attacks practically impossible. Furthermore, heuristic attacks like the Shredder Challenge Algorithm and JigsawNet showed limited efficacy against VisualMixer-processed images, as the spatial and chromatic shuffling effectively destroys structural and visual features. Crucially, GAN-based reconstruction attacks on models trained with VisualMixer-obfuscated data were unable to recover identifiable facial features, unlike attacks on models trained with raw data or even DP-noised data. Similarly, membership inference attacks against VisualMixer-trained models yielded ROC curves closely resembling random guessing, indicating strong protection against identifying whether a specific data sample was part of the training set.

In terms of performance, VisualMixer exhibited comparable training throughput to plain data. For example, on the ShuffleNet model, VisualMixer incurred a mere 0.8% decrease in throughput (1080.3 images/sec vs. 1088.9 images/sec for plain), whereas DP-based methods suffered an 80.5% drop, and FHE methods an astonishing 99.9% drop. While Transformer-based models like ViT-B and Swin-T required an additional 50% of epochs for convergence with VisualMixer, other Convolutional Neural Network (CNN) models did not.

The versatility of VisualMixer extends to other DNN paradigms. It effectively enhances data privacy in Federated Learning (FL) schemes, maintaining good accuracy with minimal loss when applied to client data before local training. It also successfully protected data privacy during teacher model training in Knowledge Distillation, demonstrating its adaptability without significant accuracy compromise in the student model.

Finally, while VisualMixer demonstrated strong precision in object detection tasks (e.g., YOLO v5, SSD, EfficientDet on the VOC dataset), maintaining precision levels close to baselines (YOLO v5: 0.601 plain vs. 0.602 VIM), it experienced a decline in recall and mean average precision (mAP) (YOLO v5: 0.562 mAP@50 plain vs. 0.441 VIM). This indicates that while the model can accurately classify objects within established bounding boxes, the obfuscation might make it harder to initially identify and delineate all object instances, suggesting an area for future refinement in specific vision tasks.

Technical Deep Dive

[▶ Watch: Threat Model: Adversary's attempts to steal client data. (2:00)]()

The technical core of VisualMixer is built upon two novel contributions: Visual Feature Entropy (VFE), a metric for quantifying visual privacy, and the VisualMixer obfuscation algorithm itself, complemented by the ST-Adam optimizer for stable training.

Visual Feature Entropy (VFE)

A fundamental challenge in visual privacy is the absence of a robust metric to quantify the "privacy" of visual features. VisualMixer introduces Visual Feature Entropy (VFE) to address this. VFE measures the uncertainty or disorder of visual features within an image; a higher VFE signifies greater disorder, making features harder to discern and thus implying higher visual privacy.

The definition of VFE is rooted in the local intensity changes within an image. For a pixel at (x, y) with RGB value I(x, y), horizontal and vertical gradients are defined as:

• xI(x, y) = I(x + 1, y) - I(x, y)
• yI(x, y) = I(x, y + 1) - I(x, y)

For a specific region R1 of width w and height h (top-left at (x0, y0)), the VFE for that region is calculated as:

• VFER(R1) = Σ (from x=x0 to x0+w-1) Σ (from y=y0 to y0+h-1) (xI(x, y)² + yI(x, y)²)

For an entire image I composed of sub-regions R1, the VFE is aggregated:

• VFE(I) = (F / (N1 N2)) Σ (over R1 in R) VFER(R1)

where N1 and N2 are image width and height, and F is a scaling factor (typically 1).

For multi-channel images (e.g., RGB), the VFE is averaged across channels:

• VFEM(I) = (1 / C) * Σ (over Ic in I) VFE(Ic)

where C is the number of channels and Ic is a single channel.

The intuition behind this gradient-based approach is that the gradient directly captures the absolute difference between adjacent pixels, providing a robust measure of local variation. This method effectively characterizes the uncertainty that high-frequency signals convey but without being misled by phase differences, making it superior to Fourier transform for this specific purpose.

VisualMixer Methodology

VisualMixer operates primarily during data preprocessing. Its goal is to eliminate visual semantics while preserving the trainable information necessary for DNNs.

1. VFE-Guided Window Sizing: VisualMixer adaptively determines the optimal window size (WS) for pixel shuffling based on the VFE of different image regions. Regions with lower VFE (more discernible features) are subjected to larger WS to increase disorder, while regions with higher VFE use smaller WS to preserve utility.
2. Pixel Shuffling: Within each determined window, pixels are randomly shuffled both spatially and across chromatic channels (e.g., R, G, B values). This dual obfuscation disrupts both structural and color features simultaneously.
3. Inference Compatibility: Crucially, during inference, input images are also shuffled using VisualMixer, but no decryption is ever required. The model architecture remains unchanged, making VisualMixer highly adaptable.

To ensure a balance between privacy and utility, VisualMixer mathematically derives bounds for the window size:

• Lower Bound of Window Size (WS_l): To guarantee a minimum level of privacy, WS_l is established. Assuming pixel values within a region follow a normal distribution and become independently and identically distributed after shuffling, the VFE of a region, VFER(R1), follows a chi-square distribution. For the entire image, the sum of VFER(R1) values also follows a chi-square distribution, which can be approximated by a normal distribution for large degrees of freedom. This probabilistic relationship allows for an offline computation of WS_l to meet a desired VFE. For instance, an ImageNet-100 image (224x224 pixels) with a window size of 8 yields a mean VFE(I) of approximately 112.
• Upper Bound of Window Size (WS_u): To optimize accuracy, WS_u is determined by analyzing the maximum output bias (diff_max) between original and shuffled images, serving as an indicator of data utility. Through mathematical induction and Monte Carlo simulations on a Convolutional Neural Network (CNN) module (convolutional layer + max-pooling), a probabilistic relationship for P(diff_max ≤ d) (Equation 17) is derived. This WS_u controls the maximum acceptable deviation in model output, preventing excessive accuracy loss.

The VisualMixer algorithm (Algorithm 1 in the paper) functions as follows:

1. Initialization: WS_u and WS_l are calculated offline.
2. Adaptive Window Sizing: The initial WS is scaled down to the nearest power of two less than or equal to WS_u.
3. Region Processing Loop: The image is divided into regions. For each region Ri:

• If Ri's WS is below WS_l, it's shuffled using the WS closest to WS_l.
• If Ri's WS is between WS_l and WS_u, its VFE is compared to the median VFE (VFEm) of the initial segmented set.
• If VFE(Ri) < VFEm, the region is shuffled with a smaller WS (Size(Ri)/2) to increase its VFE.
• If VFE(Ri) ≥ VFEm, the region is partitioned into smaller blocks, which are then re-added to the processing queue for further VFE checks.

This dynamic process ensures all sub-images are shuffled within the desired privacy-utility bounds.

ST-Adam Optimizer

The random pixel shuffling introduced by VisualMixer can cause abrupt gradient changes and oscillations during Deep Neural Network (DNN) training, making convergence difficult for standard optimizers like Adam. The core problem with Adam (Equations 21 in the paper) is its time-dependent rescaling of momentum and adaptive learning rate terms. While beneficial for typical data, this flexibility becomes detrimental with VisualMixer's chaotic gradients, potentially trapping the model in suboptimal local minima.

ST-Adam addresses this by maintaining the core principles of momentum optimization and adaptive learning rates but removes Adam's time-dependent rescaling factors. This ensures stable update steps, preventing the model from getting stuck due to oscillating gradients. The update rules for ST-Adam are:

1. Gradient Calculation: gt = f(wt), where f(wt) is the loss function.
2. Momentum Update: mt = β mt-1 + (1 - β) gt.
3. Adaptive Learning Rate Update: vt = γ vt-1 + (1 - γ) gt².
4. Parameter Update: wt+1 = wt - η mt / ((vt) + ε)*.

Here, η is the initial learning rate, and ε is a small smoothing term.

ST-Adam's dual adaptivity ensures stable convergence: large gradients lead to larger steps, accelerating convergence, while small gradients result in smaller, more stable steps. The optimizer also incorporates weight decay to prevent overfitting, further enhancing its robustness for training with obfuscated data. Visualizations (Figure 5) clearly show that ST-Adam is designed to effectively handle the more chaotic gradients generated by VisualMixer, leading to faster and more stable convergence compared to traditional optimizers.

Demo / Proof of Concept

[▶ Watch: Three Design Goals for effective visual privacy preservation. (3:00)]()

While the talk did not feature a live, interactive demonstration, the extensive experimental results presented serve as a comprehensive proof of concept for VisualMixer's effectiveness and robustness. These empirical validations rigorously evaluated the framework's ability to preserve privacy, maintain accuracy, and defend against various attacks across diverse datasets and DNN architectures.

The research established that VisualMixer successfully defends against exhaustive search attacks. By ensuring window sizes (WS) of 6 pixels or greater, the number of possible pixel permutations within a region exceeds 2^128, making brute-force recovery computationally infeasible. Furthermore, heuristic attacks, such as those implemented by the Shredder Challenge Algorithm and JigsawNet, were shown to have limited efficacy against VisualMixer-processed images. The spatial and per-channel pixel shuffling effectively destroys the visual features and structural information that these algorithms rely on for reconstruction, effectively reducing the "fragment size" to 1 pixel.

Crucially, VisualMixer demonstrated strong resilience against sophisticated GAN-based reconstruction attacks. Experiments (Figure 9) showed that while GANs could accurately reconstruct identifiable facial features from models trained on raw data, and even partially from models trained with Differential Privacy (DP)-noised weights, they were nearly incapable of recovering any identifiable features from models trained with VisualMixer-obfuscated data. This highlights VisualMixer's ability to prevent the leakage of sensitive visual information from model weights.

Similarly, VisualMixer proved highly effective in protecting against membership inference attacks. ROC curves (Figure 10) for such attacks on CIFAR-10 and MNIST datasets showed that VisualMixer's protection curve closely mirrored a random guess, indicating that an adversary would gain almost no advantage in determining if a specific data sample was part of the training set. This performance significantly surpassed that of other methods like DP and Homomorphic Encryption (FHE), which exhibited higher leakage.

Beyond security, the proof of concept extended to performance and versatility. VisualMixer achieved an average accuracy loss of only 2.35 percentage points across models like ViT-B, Swin-T, AlexNet, VGG, ResNet, DenseNet, MobileNet, and ShuffleNet on datasets including ImageNet-100, CIFAR-10, MNIST, and the AT&T (ORL) face database. For instance, on ViT-B for MNIST, VisualMixer achieved 99.14% accuracy compared to 99.87% for plain data, while DP and InstaHide showed significantly lower performance. Throughput measurements further underscored its practicality, with ShuffleNet training throughput experiencing a mere 0.8% decrease with VisualMixer compared to plain data, drastically outperforming DP (80.5% drop) and FHE (99.9% drop).

The framework's adaptability was demonstrated by its integration into Federated Learning (FL) and Knowledge Distillation paradigms. In FL, VisualMixer-enhanced schemes maintained good accuracy with minimal loss, showcasing its value in decentralized privacy. For knowledge distillation, a VisualMixer-processed teacher model allowed a student MobileNet to achieve an accuracy of 62.4%, almost identical to the 62.4% without VisualMixer, proving its ability to protect data during teacher training without compromising the distillation process.

Finally, the talk demonstrated VisualMixer's applicability to object detection tasks using YOLO v5, SSD, and EfficientDet on the VOC dataset. While VisualMixer maintained high precision (e.g., YOLO v5: 0.602 with VIM vs. 0.601 plain), there was a noticeable decline in recall and mean average precision (mAP) (YOLO v5: 0.441 mAP@50 VIM vs. 0.562 plain). This indicates that while classification within established bounding boxes remains accurate, the obfuscation challenges the models in initially identifying and precisely delineating all object instances, an acknowledged trade-off and area for future work.

Defensive Implications

[▶ Watch: Limitations of Differential Privacy for visual data protection. (4:00)]()

VisualMixer offers several critical implications for defenders seeking to enhance visual privacy in Deep Neural Network (DNN) ecosystems.

First and foremost, organizations and individuals who upload sensitive image data to cloud-based DNN services for training or inference should consider integrating VisualMixer into their data preprocessing pipelines. By obfuscating images using VisualMixer before transmission, clients can significantly protect their visual privacy against semi-honest servers or potential data breaches, even if the server attempts to reconstruct or directly access the data. This provides a practical and effective layer of defense where traditional encryption might be too cumbersome or where noise-injection methods like Differential Privacy (DP) fall short in visual perceptibility.

For DNN model developers and trainers, VisualMixer presents an opportunity to handle sensitive image datasets more securely. Integrating the framework means adopting a VFE-guided, noise-free obfuscation strategy that ensures privacy without drastically impacting model utility. The accompanying ST-Adam optimizer is a crucial component, as it enables stable and efficient training on these obfuscated datasets, mitigating the gradient oscillations that would otherwise destabilize convergence with standard optimizers. This allows developers to train robust models on private data with confidence in both privacy preservation and performance.

VisualMixer can also serve as a powerful enhancement for existing privacy-preserving techniques. Its demonstrated compatibility and effectiveness with Federated Learning (FL) mean that FL deployments can achieve even stronger data privacy guarantees. By shuffling data on individual client devices using VisualMixer before local training, the risk of gradient leakage and other attacks on shared model parameters is further reduced, providing a more comprehensive privacy solution. Similarly, its application in Knowledge Distillation allows for the secure training of teacher models on sensitive data, ensuring that privacy is maintained throughout the knowledge transfer process.

Defenders should also be aware of the specific trade-offs identified by the research. While VisualMixer excels in image classification and provides robust protection against various reconstruction and inference attacks with minimal accuracy loss, its performance in object detection tasks shows a nuanced picture. The high precision indicates that once an object is bounded, its classification is accurate. However, the observed decline in recall and mean average precision (mAP) suggests that the obfuscation makes it more challenging for models to initially identify and delineate all object instances. This implies that for applications where precise object localization and comprehensive detection are paramount, further research or alternative strategies might be necessary, or a careful balance between privacy and detection robustness needs to be configured.

Ultimately, VisualMixer encourages a paradigm shift from purely noise-injection or computationally heavy encryption methods to a more visually-semantic and structural obfuscation approach for image data. This framework equips defenders with a practical tool to navigate the complex landscape of visual privacy in the age of deep learning, offering a robust, efficient, and versatile solution for safeguarding sensitive information within DNN workflows.

Key Takeaways

• Novel Privacy Framework: VisualMixer is a pioneering, noise-free framework for Deep Neural Networks (DNNs) that effectively protects visual data privacy through adaptive pixel shuffling, avoiding the pitfalls of noise injection or high computational overhead.
• Quantifiable Visual Privacy: The introduction of Visual Feature Entropy (VFE) provides a crucial, task-agnostic metric to quantify visual features and privacy, enabling precise and dynamic control over the level of image obfuscation.
• Stable Training with ST-Adam: The custom-designed ST-Adam optimizer addresses the challenge of gradient oscillation caused by data obfuscation, ensuring stable, fast, and efficient convergence of DNN models even with shuffled input data.
• High Performance and Robust Security: VisualMixer achieves strong visual privacy against various attacks (e.g., exhaustive search, GAN-based reconstruction, membership inference) with minimal impact on model accuracy (average 2.35% loss) and comparable training throughput to plain data.
• Versatile and Adaptable: The framework seamlessly integrates with and enhances other DNN paradigms like Federated Learning (FL) and Knowledge Distillation, demonstrating its broad applicability across diverse machine learning workflows.
• Task-Specific Trade-offs: While highly effective in classification, VisualMixer may introduce trade-offs in specific tasks like object detection, where it maintains high precision but can lead to reduced recall and mean average precision (mAP), indicating areas for future optimization in object delineation.

About the Speaker(s)

The talk was presented by Qiushi Li at the NDSS Symposium. No further biographical details, such as title or affiliation, were provided in the transcript or metadata.