PaperlayerView exact revision on arXiv

Source-linked AI summary

Adversarial Image Perturbation for Privacy Protection -- A Game Theory Perspective

Seong Joon Oh, Mario Fritz, Bernt Schiele

arXiv:1703.09471v2cs.CVcs.CRcs.GT

TL;DR

The paper addresses whether adversarial image perturbations can protect privacy when recognisers use unknown countermeasures. It formulates the interaction as a game, evaluates existing and new AIPs against recognition strategies, and derives privacy guarantees for the user. The case study shows that the framework can analyse robust AIPs and countermeasure-dependent recognition outcomes.

  • Problem

    AIPs may be weakened by countermeasures, and the user’s best strategy is unclear when the recogniser’s countermeasure is unknown.

  • Method

    The paper formulates user-recogniser interactions as a game with explicit payoffs, strategy spaces, information, and assumptions, then studies existing and new AIPs.

  • Results

    The case study derives user privacy guarantees and finds that the novel GAMAN variant dominates other methods against all tested processing strategies except noise.

  • Takeaways & Limitations

    Game theory provides a framework for analysing user-recogniser dynamics and deriving privacy guarantees independent of the recogniser’s countermeasure.

  • Takeaways & Limitations

    The framework’s current additive AIP restriction excludes non-additive perturbations, while non-fixed models and unknown strategy spaces remain extensions or open questions.

Abstract

from arXiv · show

Users like sharing personal photos with others through social media. At the same time, they might want to make automatic identification in such photos difficult or even impossible. Classic obfuscation methods such as blurring are not only unpleasant but also not as effective as one would expect. Recent studies on adversarial image perturbations (AIP) suggest that it is possible to confuse recognition systems effectively without unpleasant artifacts. However, in the presence of counter measures against AIPs, it is unclear how effective AIP would be in particular when the choice of counter measure is unknown. Game theory provides tools for studying the interaction between agents with uncertainties in the strategies. We introduce a general game theoretical framework for the user-recogniser dynamics, and present a case study that involves current state of the art AIP and person recognition techniques. We derive the optimal strategy for the user that assures an upper bound on the recognition rate independent of the recogniser's counter measure. Code is available at https://goo.gl/hgvbNK.

1. Introduction

The paper frames privacy-preserving photo sharing as a game between users seeking to disable recognition and recognisers seeking to enable it. It proposes game-theoretic analysis and robust, recogniser-selective adversarial image perturbations to provide privacy guarantees despite unknown countermeasures.

  • Personal photos contain private information, while computer vision enables malicious entities to extract information from visual data.
  • Classical face blurring and pixellisation are unpleasant and ineffective against convnet-based recognisers.
  • Adversarial image perturbations can confuse convnets while remaining nearly invisible to human eyes.
  • Unknown countermeasures make the user’s best AIP strategy unclear, because image processing can reduce AIP effectiveness.
  • The proposed framework models antagonistic user-recogniser strategies and derives privacy guarantees independent of the recogniser’s countermeasure.
  • The paper contributes effective aesthetic person obfuscation, robust recogniser-selective AIPs, and an empirical case study yielding user privacy guarantees.

2. Related Work

Prior work shows that simple obfuscation can be resisted, motivating adversarial perturbations for identity protection. This paper places AIPs in a broader user-recogniser game that includes processing-based countermeasures and social-media recognition conditions.

  • Earlier visual-privacy studies found that current recognisers can adapt to obfuscation and remain robust against simple methods such as blurring.
  • Adversarial image perturbations provide a stronger obfuscation type for disabling recognition than simple face-obfuscation methods.
  • Test-time translation, Gaussian noise, blurring, and resizing can neutralise AIPs without retraining the recogniser.
  • Robustification methods optimise perturbations across image sets or jittered inputs to defend against processing strategies.
  • Unlike earlier fixed-pose, fixed-strategy work, this case study covers large-scale social-media user-recogniser dynamics.
  • The social-media recognition setting involves diverse viewpoints, poses, clothing, and events rather than only frontal faces or fixed-context pedestrians.

3. User-Recogniser Game

The paper models privacy protection and recognition as an antagonistic game in which each player knows the other's strategy space but not the chosen strategy. The framework formalizes payoffs, mixed strategies, assumptions, and extensions for deriving privacy guarantees against recogniser countermeasures.

  • Game setup: The user perturbs an image to thwart recognition, while the recogniser processes that perturbed image to neutralise the perturbation before prediction.The resulting prediction depends on both players' strategies, which are selected without knowledge of the opponent's chosen strategy.
  • Payoffs: Recognition rate is the recogniser's payoff, while the user's payoff is the complementary mis-recognition rate.These payoffs form a constant-sum game because they always sum to one.
  • Optimal strategies: Mixed minimax strategies provide a user strategy that guarantees a mis-recognition rate of 1 −v regardless of the recogniser's strategy.The game value v is the recognition payoff under optimal strategies, and the optimal strategies can be obtained by linear programming.
  • Information: Knowledge of a suboptimal recogniser strategy can improve the user's payoff, whereas knowledge that the recogniser uses its optimal strategy brings no improvement.This result distinguishes the no-knowledge guarantee from gains available against a non-optimal countermeasure.
  • Assumptions and strategy spaces: The framework assumes fixed, known models, additive nearly invisible perturbations, and mutually known strategy spaces whose selected strategies remain hidden.The recogniser's strategy space includes image processing such as translation, Gaussian noise, blurring, and cropping or resizing.
  • Extensions: The framework extends to multiple recognisers and can generate selective AIPs that enable recognition by one system while disabling it for another.The paper also identifies extensions involving unknown models, non-constant-sum games, non-additive perturbations, non-fixed models, and unknown strategy spaces.

4. Adversarial Image Perturbation Strategies

The paper reviews first-order adversarial image perturbation strategies and introduces variants designed to improve robustness against image processing and target selected recognisers.

  • Existing AIP methods: AIPs are computed as additive transformations constrained by an L2 norm, using loss maximisation over the perturbation.The optimisation maximises L(f(x + t), y) subject to ||t||2 ≤ ϵ, with x as the input image and y as its ground-truth label.
  • Existing AIP methods: Different loss functions and first-order optimisation schemes recover established methods including FGV, FGS, BI, and DeepFool.Universal perturbations are a special case when the loss is computed over an entire test set and one perturbation is shared across images.
  • Existing AIP methods: DeepFool seeks the minimal perturbation that changes the prediction, using the nearest linearised decision boundary and iterative steps toward it.The paper relates DeepFool to gradient ascent by setting L = f_c − f_y, with step sizes minimised to induce an incorrect prediction.
  • Existing AIP methods: The norm and RGB-value constraints are enforced through projections after each iteration, while grayscale images use averaged channel gradients.The constraints are ||·||2 ≤ ϵ and RGB values in [0, 255].
  • Our AIP methods: GAMAN extends gradient ascent beyond the decision boundary toward a wrong-label region, aiming for greater robustness than stopping at the boundary.It approximates the costly nearest-boundary class with the most likely wrong label y⋆, then uses a fixed step size for K iterations.
  • Our AIP methods: Vaccination incorporates the recogniser’s image-processing operation into the loss, while selective AIPs optimise a mixed loss for chosen recognisers.Vaccination can average gradients over multiple samples for random processing; selective AIPs aim to prevent recognition by M while authorising recognition by B.

5. Empirical Studies

The empirical study evaluates adversarial image perturbations, recogniser countermeasures, and user vaccination strategies in a person-recognition game. AIP methods improve obfuscation over classical perturbations, while processing countermeasures motivate game-theoretic strategy selection and privacy guarantees.

  • Study setup: The study evaluates existing and newly proposed AIPs within a game between a user seeking to thwart recognition and a recogniser seeking to neutralise perturbations.The case study specifies strategy spaces, payoffs, and information for both players.
  • AIP performance: Under an L2 perturbation limit of 1000, noise, blur, and eye bar have nearly no impact at small distances, whereas DeepFool and GAMAN reduce recognition rates to zero.Gradient Ascent reaches 0.2 versus 1.2 for Basic Iterative on AlexNet; Fast Gradient Vector reaches 13.3 versus 23.6 for Fast Gradient Sign.
  • Robustness of AIPs: Proc alone raises GoogleNet recognition from zero to 8.6 for Gradient Ascent and 51.8 for DeepFool, while further processing makes AIPs less effective.Blurring and cropping are generally more harmful to AIPs than translation and noise, and GAMAN performs best except against noise.
  • Vaccination strategies: Vaccination improves GAMAN’s robustness against its corresponding processing strategy: against blur, recognition falls from 22.2 to 5.8 with /B./B is most effective across processing strategies except noise, for which /N gives the best user payoff.
  • User-recogniser games: Randomising between /B at 61% and /TNBC at 39% guarantees at most 7.3 recognition, improving on the deterministic /B guarantee of 8.6.If the recogniser commits to blur, /B yields 5.8; under uniform recogniser randomisation, /B yields 3.4.
  • Selective AIPs: Selective AIPs confuse designated malicious recognisers while preserving benign recognition, but the malicious-recogniser rate remains 8.7 in the single-model case and 17.7 in the multi-model case.Increasing the perturbation budget from 1000 to 2000 lowers the multi-model malicious-recogniser rate to 3.8.

6. Discussion & Conclusion

The paper frames user-recogniser interaction as a game under uncertainty, where randomisation can provide payoff guarantees independent of the opponent’s strategy. It concludes that the framework and case study support broader analysis of privacy-preserving recognition dynamics.

  • Discussion: Game theory addresses uncertainty in player choices and suggests randomising techniques when no single technology handles every adversarial technology best.The framework provides payoff guarantees independent of the opponent’s strategy.
  • Discussion: The framework can be extended to other setups with fewer resource constraints on the players.The authors present the paper as a first step toward analysing user-recogniser dynamics more broadly.
  • Conclusion: The paper constructs a two-player game-theoretical framework and applies it to privacy guarantees for social-media users using current AIP and person-recognition strategy spaces.The user and recogniser have antagonistic goals: disabling and enabling recognition.

Supplementary Materials

The supplementary materials provide auxiliary experiments on AIP losses, norms, architectures, and qualitative behavior. They report that loss-function choice has little effect, with softmax-log loss only marginally better against image processing.

  • The supplementary materials cover score loss, varying L2 norms, non-GoogleNet architectures, and additional qualitative results.
  • The authors mark optimal user and recogniser entries with orange and blue, respectively.
  • Single-iteration AIPs are significantly outperformed by multi-iteration AIPs, motivating the main paper’s focus on multi-iteration methods.
  • The choice of loss function makes little difference, although softmax-log loss performs marginally better against image-processing techniques.

C. AIP Performance at Different L2 Norms

AIP performance is evaluated under increasing L2-norm constraints. AIP variants outperform conventional perturbations, and GAMAN achieves nearly zero recognition at ϵ = 2000.

  • The experiments vary the L2 constraint ϵ over {100, 200, 500, 1000, 2000} while plotting average perturbation norms.
  • AIP variants achieve the same degree of obfuscation as Noise, Blur, or Eye Bar with 1 ∼2 orders of magnitude smaller perturbations.
  • At equal norm levels, multi-iteration BI and GA outperform single-iteration FGS and FGV variants.
  • Gradient signs reduce obfuscation at small L2 norms ≤1000, but performance converges at ϵ = 2000.
  • GAMAN performs best across norm levels, achieving nearly zero recognition at ϵ = 2000.

D. Non-GoogleNet Experiments

The experiments extend the AIP robustness analysis from GoogleNet to AlexNet, VGG, and ResNet152.

  • Experiments extend the GoogleNet-focused analysis to AlexNet, VGG, and ResNet152.

D.1. Robustness Analysis

Across four architectures and several image-processing strategies, GAMAN shows the strongest overall robustness, though the most effective neutralisation method varies by architecture.

  • D.1. Robustness Analysis: GAMAN shows the best overall robustness across image-processing techniques and all four evaluated architectures.
  • D.1. Robustness Analysis: Cropping is most powerful for AlexNet and ResNet, whereas blurring is most powerful for VGG and GoogleNet.
  • D.1. Robustness Analysis: For ResNet, cropping raises recognition against GAMAN from 0.0 to 31.8.

D.2. Game Analysis for Various Networks

The section summarizes optimal user strategies and recognition-rate guarantees across four network architectures. Against all but AlexNet, the optimal strategy is a mixture of /B and /TNBC.

  • D.2. Game Analysis for Various Networks: Table 8 reports optimal user strategies and corresponding guaranteed upper bounds on recognition rates for different networks.The bound notation is written as ≤·.
  • D.2. Game Analysis for Various Networks: Against all but AlexNet, the optimal user strategy θu⋆ is a mixture of /B and /TNBC.

E. Additional Qualitative Results

The additional material extends the robustness and game analyses across four network architectures and supplies qualitative examples of perturbed images and predictions. The figures emphasize that GA and GAMAN can confuse GoogleNet with little aesthetic cost, while larger L2 norms make artifacts more visible.

  • Qualitative Results: The additional qualitative results include original, blurred, GA, DF[21], and GAMAN image variants across several perturbation levels.The listed examples include GAMAN settings with L2 values from 0 through 3000.
  • Game Analysis: Table 8 lists optimal strategies and guaranteed upper bounds on recognition rates for different networks.The table uses ≤· to denote the upper bound.
  • Robustness Analysis: The extended robustness analysis covers various convnet architectures with AIPs restricted to || · ||2 ≤1000.Additional AIP entries are marked as gray cells, and the countermeasures include Translate, Noise, Blur, and Crop.
  • Game Analysis: The extended payoff table reports recogniser payoffs pij for all four network architectures.The user’s payoff is defined as 100 −pij.
  • Qualitative Results: GA and GAMAN reliably confuse GoogleNet at almost no aesthetic cost in the qualitative examples.The perturbed images are shown with corresponding GoogleNet predictions, using green for correct and red for wrong predictions.
  • Qualitative Results: As the L2 norm increases, perturbation artifacts become more visible.Some perturbations may be too small to see in print and are recommended for electronic zooming.
Loading 1703.09471v2…