Subverting Privacy-Preserving GANs: Hiding Secrets in Sanitized Images

Abstract

Unprecedented data collection and sharing have exacerbated privacy concerns and led to increasing interest in privacy-preserving tools that remove sensitive attributes from images while maintaining useful information for other tasks. Currently, state-of-the-art approaches use privacy-preserving generative adversarial networks (PP-GANs) for this purpose, for instance, to enable reliable facial expression recognition without leaking users' identity. However, PP-GANs do not offer formal proofs of privacy and instead rely on experimentally measuring information leakage using classification accuracy on the sensitive attributes of deep learning (DL)-based discriminators. In this work, we question the rigor of such checks by subverting existing privacy-preserving GANs for facial expression recognition. We show that it is possible to hide the sensitive identification data in the sanitized output images of such PP-GANs for later extraction, which can even allow for reconstruction of the entire input images, while satisfying privacy checks. We demonstrate our approach via a PP-GAN-based architecture and provide qualitative and quantitative evaluations using two public datasets. Our experimental results raise fundamental questions about the need for more rigorous privacy checks of PP-GANs, and we provide insights into the social impact of these.

DP Patch: ROI-Based Approach of Privacy-Preserving Image Processing With Robust Classification

“…Adding random noise directly to the image is one of the most substantial ways to guarantee its privacy by making it utterly unrecognizable to the human eye. The incorporation of DP into the training process of generative models has been actively studied by researchers, resulting in variations of differentially private GANs [10]- [12]. Also, B.Liu et al proposed a novel way of generating differentially private images by perturbating the feature space [13], while L. Fan proposed methods of differentially private image pixelization [14] and differentially private image singular value decomposition to obfuscate the images [15].…”