Source-linked AI summary
Towards a Visual Privacy Advisor: Understanding and Predicting Privacy Risks in Images
Tribhuvanesh Orekondy, Bernt Schiele, Mario Fritz
TL;DR
The paper addresses how privacy preferences can be enforced for visual content, where users often misjudge privacy-relevant information. It builds a 68-attribute image dataset, studies user preferences, and predicts user-specific privacy risk from images. The resulting model outperforms human judgment on the same images, while experiments use user profiles rather than individual users.
Problem
Visual privacy lacks a mechanism that makes implicit image information available for enforcing users’ preferences, which people frequently misjudge.
Method
The paper builds a 22k-image dataset with 68 privacy attributes, studies users’ preferences, and combines predicted attributes with those preferences to estimate image-specific privacy risk.
Results
The model predicts user-specific privacy risk and outperforms users’ image-based judgment on the same images.
Takeaways & Limitations
A Visual Privacy Advisor can provide feedback based on privacy preferences and help detect images that conflict with a user’s privacy.
Takeaways & Limitations
Experiments use previously introduced user profiles instead of individual users.
Abstract
from arXiv · showhide
With an increasing number of users sharing information online, privacy implications entailing such actions are a major concern. For explicit content, such as user profile or GPS data, devices (e.g. mobile phones) as well as web services (e.g. Facebook) offer to set privacy settings in order to enforce the users' privacy preferences. We propose the first approach that extends this concept to image content in the spirit of a Visual Privacy Advisor. First, we categorize personal information in images into 68 image attributes and collect a dataset, which allows us to train models that predict such information directly from images. Second, we run a user study to understand the privacy preferences of different users w.r.t. such attributes. Third, we propose models that predict user specific privacy score from images in order to enforce the users' privacy preferences. Our model is trained to predict the user specific privacy risk and even outperforms the judgment of the users, who often fail to follow their own privacy preferences on image data.
1. Introduction
The paper extends privacy settings from explicit information to visual content, where privacy-relevant information is implicit and users frequently misjudge it. It introduces a Visual Privacy Advisor that predicts image attributes and user-specific privacy risk to help enforce preferences.
- Visual privacy settings must address information implicit in images rather than only explicit or textual content.
- Users frequently misjudge privacy-relevant information in images, causing failures to enforce their own preferences.
- The proposed advisor categorizes personal information into 68 image attributes and combines attribute predictions with user preferences to infer privacy scores.
- The user-specific privacy-risk model outperforms users’ judgment on the same images.
- The paper contributes a dataset of 22k images annotated with 68 privacy attributes and a user study of privacy preferences and preference-following.
2. Related Work
Prior work addresses privacy in text, social networks, leakage, and individual visual attributes, but image privacy requires richer, preference-sensitive modeling. The paper responds with privacy-attribute recognition and user-specific risk estimation supported by a dedicated dataset.
- Identifying Personal Information: Existing work recognizes personal information in documents and email, while image-focused work has often classified images as public or private.
- Identifying Personal Information: The paper argues that differing user notions of privacy make binary public-versus-private image classification insufficient.
- Leakage and De-anonymization: Related research studies privacy leakage, including disclosure through HTTP requests, Android applications, and aggregated social-network data.
- Privacy Preferences and Social Networks: Work on privacy preferences and social networks studies disclosed information and privacy settings, whereas this paper also trains image-based models from those preferences.
- Privacy and Computer Vision: Computer-vision research detects individual attributes and investigates privacy challenges such as adversarial perturbations, video capture, and re-identification.
- Datasets for Privacy Tasks: Existing privacy datasets are too small, unrepresentative, or focused on people recognition, motivating a real-life dataset covering diverse privacy-relevant attributes.
3. The Visual Privacy (VISPR) Dataset
VISPR defines a broad image-privacy vocabulary and constructs a multi-label dataset for studying and recognizing privacy attributes. The final collection contains 22,167 images annotated with 68 attributes after sourcing, balancing, pruning, curation, and splitting.
- Privacy Attributes: The dataset formalizes visual privacy through 68 attributes, including gender, tattoos, email addresses, and fingerprints.
- Privacy Attributes: Because no standard attribute list exists, the authors combine legal guidelines, social-network rules, and manual image examination.
- Data Collection and Annotation Procedure: Annotation is multi-label: annotators select multiple applicable attributes, mark uncertainty, and label images without applicable labels as safe.
- Data Collection and Annotation Procedure: Rare attributes are supplemented through targeted OpenImages and Flickr searches, with 50 credit-card images obtained from Twitter.
- Data Collection and Annotation Procedure: The final dataset contains 22,167 images with one or more of 68 privacy attributes after discarding and merging unsuitable labels.
- Data Collection and Annotation Procedure: The dataset uses a random 45-20-35 split: 10,000 training, 4,167 validation, and 8,000 test images.
4. Understanding Privacy Risks
The studies examine users’ privacy preferences across attributes and whether they can consistently assess equivalent privacy risks in images. Preferences vary widely, while image-based judgments often diverge from desired privacy levels.
- 4.1. Understanding Users’ Privacy Preferences: Users answered randomized privacy questions covering 67 attributes plus a control question, rating potential violations from 1 to 5.The survey collected responses from 305 unique AMT workers.
- 4.1. Understanding Users’ Privacy Preferences: Figure 2 plots the number of images for each dataset label, while Figure 3 orders 30 profile rows by the number of users assigned to each profile.Darker colors in Figure 3 indicate higher privacy sensitivity.
- 4.1. Understanding Users’ Privacy Preferences: 30 clustered user profiles reveal wide preference diversity, including minorities especially sensitive to political view, sexual orientation, or religion.Most profiles share similar sensitivity ordering, while some are uniformly sensitive across attributes.
- 4.2. Users and Visual Privacy Judgment: The second study compares users’ visual privacy scores for attribute images with their explicit privacy preference scores for the same attributes.Participants rated image-sharing comfort and attribute-based privacy violation on separate 1-to-5 scales.
- 4.2. Users and Visual Privacy Judgment: Off-diagonal results show inconsistent judgments: users underestimate risks for natural scenes such as family photographs and cars with license plates.Users overestimate risks for some photographs showing birthplace or names; credit cards, passports, and national identification documents are closer to the diagonal.
5. Predicting Privacy Risks
The paper predicts privacy attributes from images and combines them with user-specific preferences to estimate privacy risk. A direct risk model performs better than intermediate attribute-based prediction and slightly better than users’ image-based judgments on average.
- 5.1. Privacy Attribute Prediction: Privacy Attribute Prediction treats recognizing one or more of 68 image attributes as a multilabel classification problem.The task makes personal information explicit despite image diversity, subtle cues, and high-level semantics.
- 5.1. Privacy Attribute Prediction: Methods use CNN features with linear SVMs or fine-tuned CNNs, evaluated by per-class Average Precision and overall C-MAP.C-MAP averages AP across all 68 attributes.
- 5.2. Personalizing Privacy Risk Prediction: The privacy risk score combines predicted user-independent attributes with user-specific privacy preferences to represent image-level leakage risk.The score is defined by the most sensitive attribute likely to be present and is comparable to the 1-to-5 preference scale.
- 5.2. Personalizing Privacy Risk Prediction: AP-PR computes risk from attribute predictions and profile preferences, whereas PR-CNN directly predicts risk through additional fully connected layers.PR-CNN addresses errors in intermediate attribute predictions and is fine-tuned from the GoogLeNet attribute-prediction network.
- 5.2. Personalizing Privacy Risk Prediction: PR-CNN performs better than intermediate attribute prediction, averages less than one 1-to-5 scale step from true risk, and improves recall for high-risk images.Precision-recall curves are evaluated across sensitivity thresholds, with MAP reported over user profiles.
- 5.3. Comparing Human and Model Risk Judgments: AP-PR achieves consistently better precision-recall than users’ image-based judgments, while PR-CNN has L1 error 1.03 versus 1.1 for users and 1.27 for AP-PR.The comparison evaluates human judgment alongside both proposed risk-estimation methods.
6. Conclusion
The paper presents a Visual Privacy Advisor for visual content, combining privacy-attribute recognition, user preferences, and privacy-risk prediction. Its final comparison shows improved model performance over human judgment on image privacy risks.
- 6. Conclusion: The proposed direction extends privacy settings to images and provides feedback based on users’ privacy preferences.The conclusion frames this as work toward a Visual Privacy Advisor.
- 6. Conclusion: The user study finds that people often fail to enforce their own privacy preferences when judging image content.The survey also identifies diverse privacy-preference profiles.
- 6. Conclusion: VISPR supports models that recognize privacy attributes, predict privacy-risk scores, and detect images conflicting with users’ privacy.The conclusion links these capabilities to feedback for users.
- 6. Conclusion: The final human-versus-machine comparison reports improved model prediction of image privacy risks over human judgment.The authors present this as evidence of feasibility and future opportunity for a Visual Privacy Advisor.
Changelog
The paper documents user-study materials, privacy-attribute definitions, and dataset annotation details, covering 67 preference-rated attributes and the resulting 68-attribute image dataset.
- Changelog: The supplementary materials include additional user-study information, a project webpage link, and revised writing or related-work content.
- Privacy attributes: The definitions apply to subjects in foreground or background and allow attributes to be inferred from explicit or visual evidence.
- User study: Users rated privacy violation on a 1–5 scale after considering unintentionally posting personal information on a public platform.
- User study: The preference questionnaire covered 67 privacy attributes, excluding the safe attribute, with one verbal description per attribute.
- Privacy attributes: The attribute inventory defines image cues spanning documents, health, employment, relationships, opinions, whereabouts, identity, and personal status.
- Privacy attributes: Examples include names, dates and places of birth, passports, medical treatment, occupations, religion, relationships, landmarks, and GPS-related location text.
C. Additional Qualitative Examples for Privacy Attribute Prediction
Additional qualitative examples show that privacy-attribute predictions rely on distinctive visual cues but remain vulnerable to contextual confusion, fine-grained distinctions, and relational reasoning.
- Qualitative examples: Rows in the qualitative results group images by privacy attribute and distinguish true positives, false positives, and false negatives.
- Visual cues: The method uses clothing, exposed skin, metallic objects with wheels, and text as cues for several privacy attributes.
- Errors: These cues can cause confusions, such as classifying card-shaped identification documents as drivers licenses or cars as license plates.
- Limitations: Performance is challenged by context changes, text-based distinctions, interactions between people, and fine-grained recognition.
D.1. Qualitative Results
Qualitative personalized-risk results compare AP-PR and PR-CNN across examples with reliable, noisy, or difficult attribute predictions, revealing generally favorable but non-uniform PR-CNN behavior.
- Visualization: The qualitative visualization plots ground-truth against predicted privacy-risk scores for each image and user profile.
- Comparison: PR-CNN and AP-PR perform equally well when attribute predictions are correct and high-confidence.
- Comparison: PR-CNN outperforms AP-PR when intermediate attribute predictions are noisy.
- Difficult images: Both methods face difficult images involving low contrast, unnatural angles, low lighting, or occlusion, although PR-CNN is often slightly better.
- Comparison: AP-PR performs better in examples where its attribute predictions are correct.
D.2. Precision-Recall Curves for User Profiles
The profile analysis evaluates privacy-risk detection across quartiles of user profiles and multiple sensitivity thresholds, with PR-CNN generally strongest for high-risk images and private-image score errors.
- Evaluation setup: Risk detection treats images above selected risk scores as private for each user profile and evaluates Precision-Recall curves.
- Profile groups: Profiles are divided into four equal-sized quartiles, and Precision-Recall curves are computed separately for each quartile and additional thresholds.
- Results: PR-CNN performs better for high-risk images across all quartiles of the 30 user profiles, contributing to better overall performance.
- L1 error: For private images, PR-CNN has L1 error 0.67 versus AP-PR’s 0.84.
- L1 error: For safe images, AP-PR has L1 error 0.34 versus PR-CNN’s 0.58.
E. Additional Results for Humans vs. Machine
The evaluation compares human visual risk judgments with two proposed privacy-risk approaches using Precision-Recall curves and per-attribute L1 errors. PR-CNN slightly outperforms users on average and is especially stronger for several privacy-relevant attributes.
- The evaluation compares users’ visual risk assessment with AP-PR and PR-CNN using Precision-Recall curves and L1 distance.L1 measures the absolute difference between predicted and ground-truth privacy scores on a 1–5 scale.
- 1.03 L1 error: PR-CNN slightly outperforms users’ image-based judgment at predicting privacy risk.Users’ average L1 error is 1.1.
- PR-CNN better evaluates risks in natural-looking images, including cars with visible license plates and family photographs depicting relationships.Users often misjudge the privacy risk in these cases.
- PR-CNN outperforms AP-PR on attributes where AP-PR has high errors, including relationships, addresses, usernames, signatures, and credit cards.The comparison indicates that PR-CNN can outperform despite incorrect attribute predictions.