Towards a Visual Privacy Advisor: Understanding and Predicting Privacy Risks in Images

Orekondy, Tribhuvanesh; Schiele, Bernt; Fritz, Mario

doi:10.1109/iccv.2017.398

Cited by 99 publications

(71 citation statements)

References 48 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Privacy, Security and Computer Vision. Privacy has been largely addressed within the computer vision community by proposing models [28,30,31,42,49,50] which recognize and control privacy-sensitive information in visual content. The community has also recently studied security concerns entailing real-world usage of models e.g., adversarial perturbations [2,20,25,26,29,34] in black-and whitebox attack scenarios.…”

Section: Related Workmentioning

confidence: 99%

Knockoff Nets: Stealing Functionality of Black-Box Models

Orekondy

Schiele²,

Fritz

2019

2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

Self Cite

392

355

View full text Add to dashboard Cite

Machine Learning (ML) models are increasingly deployed in the wild to perform a wide range of tasks. In this work, we ask to what extent can an adversary steal functionality of such "victim" models based solely on blackbox interactions: image in, predictions out. In contrast to prior work, we present an adversary lacking knowledge of train/test data used by the model, its internals, and semantics over model outputs. We formulate model functionality stealing as a two-step approach: (i) querying a set of input images to the blackbox model to obtain predictions; and (ii) training a "knockoff" with queried image-prediction pairs. We make multiple remarkable observations: (a) querying random images from a different distribution than that of the blackbox training data results in a well-performing knockoff; (b) this is possible even when the knockoff is represented using a different architecture; and (c) our reinforcement learning approach additionally improves query sample efficiency in certain settings and provides performance gains. We validate model functionality stealing on a range of datasets and tasks, as well as on a popular image analysis API where we create a reasonable knockoff for as little as $30.

show abstract

Section: Related Workmentioning

confidence: 99%

Knockoff Nets: Stealing Functionality of Black-Box Models

Orekondy

Schiele²,

Fritz

2019

2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

Self Cite

392

355

View full text Add to dashboard Cite

show abstract

“…Zhong et al [2017] proposed a Group-Based Personalized Model for image privacy classification in online social media sites that learns a set of archetypical privacy models (groups) and associates a given user with one of these groups. Orekondy et al [2017] defined a set of privacy attributes, which were first predicted from the image content and then used these attributes in combination with users' preferences to estimate personalized privacy risk. Although there is evidence that individuals' sharing behavior is unique, Zhong et al [2017] argued that personalized models generally require large amounts of user data to learn reliable models, and are time and space consuming to train and store models for each user, while taking into account possible sudden changes of users' sharing activities and privacy preferences.…”

Section: Related Workmentioning

confidence: 99%

“…Although there is evidence that individuals' sharing behavior is unique, Zhong et al [2017] argued that personalized models generally require large amounts of user data to learn reliable models, and are time and space consuming to train and store models for each user, while taking into account possible sudden changes of users' sharing activities and privacy preferences. Orekondy et al [2017] tried to resolve some of these limitations by clustering users' privacy profiles and training a single classifier that maps the target user into one of these clusters to estimate the personalized privacy score. However, the users' privacy profiles are obtained using a set of attributes.…”

Section: Related Workmentioning

confidence: 99%

Image Privacy Prediction Using Deep Neural Networks

Tonge

Caragea

2020

ACM Trans. Web

View full text Add to dashboard Cite

Images today are increasingly shared online on social networking sites such as Facebook, Flickr, Foursquare, and Instagram. Image sharing occurs not only within a group of friends but also more and more outside a user's social circles for purposes of social discovery. Despite that current social networking sites allow users to change their privacy preferences, this is often a cumbersome task for the vast majority of users on the Web, who face difficulties in assigning and managing privacy settings. When these privacy settings are used inappropriately, online image sharing can potentially lead to unwanted disclosures and privacy violations. Thus, automatically predicting images' privacy to warn users about private or sensitive content before uploading these images on social networking sites has become a necessity in our current interconnected world.In this paper, we explore learning models to automatically predict appropriate images' privacy as private or public using carefully identified image-specific features. We study deep visual semantic features that are derived from various layers of Convolutional Neural Networks (CNNs) as well as textual features such as user tags and deep tags generated from deep CNNs. Particularly, we extract deep (visual and tag) features from four pre-trained CNN architectures for object recognition, i.e., AlexNet, GoogLeNet, VGG-16, and ResNet, and compare their performance for image privacy prediction. Among all four networks, we observe that ResNet produces the best feature representations for this task. We also fine-tune the pre-trained CNN architectures on our privacy dataset and compare their performance with the models trained on pre-trained features. The results show that even though the overall performance obtained using the fine-tuned networks is comparable to that of pre-trained networks, the fine-tuned networks provide an improved performance for the private class as compared to models trained on the pre-trained features. Results of our experiments on a Flickr dataset of over thirty thousand images show that the learning models trained on features extracted from ResNet outperform the state-of-the-art models for image privacy prediction. We further investigate the combination of user tags and deep tags derived from CNN architectures using two settings: (1) SVM on the bag-of-tags features; and (2) text-based CNN. We compare these models with the models trained on ResNet visual features obtained for privacy prediction. Our results show that even though the models trained

show abstract

“…Although current social networking sites allow users to change their privacy preferences, this is o en a cumbersome task for the vast majority of users on the Web, who face di culties in assigning and managing privacy se ings [30]. Even though users change their privacy se ings to comply with their personal privacy preference, they o en misjudge the private information in images, which fails to enforce their own privacy preferences [35]. us, new privacy concerns [13] are on the rise and mostly emerge due to users' lack of understanding that semantically rich images may reveal sensitive information [1,35,47,57].…”

Section: Introductionmentioning

confidence: 99%

“…Even though users change their privacy se ings to comply with their personal privacy preference, they o en misjudge the private information in images, which fails to enforce their own privacy preferences [35]. us, new privacy concerns [13] are on the rise and mostly emerge due to users' lack of understanding that semantically rich images may reveal sensitive information [1,35,47,57]. For example, a seemingly harmless photo of a birthday party may unintentionally reveal sensitive information about a person's location, personal habits, and friends.…”

Section: Introductionmentioning

confidence: 99%

Dynamic Deep Multi-modal Fusion for Image Privacy Prediction

Tonge

Caragea

2019

The World Wide Web Conference

View full text Add to dashboard Cite

With millions of images that are shared online on social networking sites, e ective methods for image privacy prediction are highly needed. In this paper, we propose an approach for fusing object, scene context, and image tags modalities derived from convolutional neural networks for accurately predicting the privacy of images shared online. Speci cally, our approach identi es the set of most competent modalities on the y, according to each new target image whose privacy has to be predicted. e approach considers three stages to predict the privacy of a target image, wherein we rst identify the neighborhood images that are visually similar and/or have similar sensitive content as the target image. en, we estimate the competence of the modalities based on the neighborhood images. Finally, we fuse the decisions of the most competent modalities and predict the privacy label for the target image. Experimental results show that our approach predicts the sensitive (or private) content more accurately than the models trained on individual modalities (object, scene, and tags) and prior privacy prediction works. Also, our approach outperforms strong baselines, that train meta-classi ers to obtain an optimal combination of modalities. CCS CONCEPTS•Security and privacy → Social network security and privacy; KEYWORDS Image privacy prediction; fusion of modalities; decision-level fusion ACM Reference format:

show abstract

Towards a Visual Privacy Advisor: Understanding and Predicting Privacy Risks in Images

Cited by 99 publications

References 48 publications

Knockoff Nets: Stealing Functionality of Black-Box Models

Knockoff Nets: Stealing Functionality of Black-Box Models

Image Privacy Prediction Using Deep Neural Networks

Dynamic Deep Multi-modal Fusion for Image Privacy Prediction

Contact Info

Product

Resources

About