DeepBlur: A Simple and Effective Method for Natural Image Obfuscation

Abstract

Figure 1. We propose a simple yet effective method for image obfuscation by blurring in latent space (i.e., DeepBlur). Comparing to existing methods (e.g., Gaussian blur, pixelation, masking, and adversarial noise), our approach preserves high perceptual quality while preventing unauthorized face recognition from both automatic systems and human adversaries.

SoK: Anti-Facial Recognition Technology

“…To anonymize face images, the leading proposals use generative adversarial networks (GANs) [129] and differential privacy [130]. Several proposals use GANs to first transform face images into latent space vectors, modify those vectors to remove identity information, and reconstruct the images from the modified vectors [102], [17], [103]. The modified faces still look human but are anonymized to prevent accurate identification.…”

“…In the last 12 months, more than a dozen AFR tools have been proposed (e.g., [17], [18], [19], [20], [21], [22], [23], [24], [25], [26], [27], [28], [29], [30], [31], [32]). While most are constrained to research prototypes, a few of these tools have produced public software releases and gained significant media attention [19], [22], [33].…”

Preserving Privacy in Image Database through Bit-planes Obfuscation

“…A naive approach towards preserving V-PII is via obfuscation such as face blurring [3] while uploading on a cloud database. By scaling this idea from face to entire image, prior studies adopted down-sampling [4][5][6][7] and pixelation [8] to conceal V-PII which otherwise is apparent in high-resolution images. Rajput et al [6] added Gaussian noise into the underlying image before applying down-sampling for obfuscation.…”

“…First, though the prior privacy-preserving schemes [9], [12] offer good security by minimizing or breaking the pixels' inter-correlation, the generated obfuscated images do not contain enough information for training deep neural networks (DNNs) to achieve adequate accuracy. Second, the blurred [3], down-sampled images [7] have high usability to train highly DNNs, but they are vulnerable to reconstruction and de-identification attacks. Third, the obfuscation schemes such as [7] assume that the server is trustworthy because the server designs the underlying obfuscation function for the user, using data-driven DNNs prone to reverse training, thus posing a risk of image reconstruction [13] by the server.…”

“…Second, the blurred [3], down-sampled images [7] have high usability to train highly DNNs, but they are vulnerable to reconstruction and de-identification attacks. Third, the obfuscation schemes such as [7] assume that the server is trustworthy because the server designs the underlying obfuscation function for the user, using data-driven DNNs prone to reverse training, thus posing a risk of image reconstruction [13] by the server.…”