“…Much prior work on achieving privacy with such data, especially with images and videos, has relied on domain knowledge and hand-crafted approaches-such as pixelation, blurring, face/object replacement, etc.-to degrade sensitive information [1,2,4,6,13,27]. These methods can be effective in many practical settings when it is clear what to censor, and some variants are even able to make the resulting image look natural and possess chosen attributese.g., replacing faces with generated ones [3,5,17] of different individuals with the same expression, pose, etc. However, we consider the general case when all cues in an image towards the private attribute can not be enumerated, and that an adversary seeking to recover that attribute will learn an estimator specifically for our encoding.…”