# Towards Privacy-Preserving Visual Recognition via Adversarial Training: A Pilot Study

arXiv: https://arxiv.org/abs/1807.08379 · HTML: https://mlsanity.com/paper/1807.08379/

## Key facts

- Cited by 48 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 22 Jul 2018.

## Built on by (most cited first, 30 of 48)

- [Learning to Optimize: A Primer and A Benchmark](https://mlsanity.com/paper/2103.12828/) (2021)
- [A Study of Face Obfuscation in ImageNet](https://mlsanity.com/paper/2103.06191/) (2021)
- [SPAct: Self-supervised Privacy Preservation for Action Recognition](https://mlsanity.com/paper/2203.15205/) (2022)
- [PASS: Protected Attribute Suppression System for Mitigating Bias in Face Recognition](https://mlsanity.com/paper/2108.03764/) (2021)
- [Undistillable: Making A Nasty Teacher That CANNOT teach students](https://mlsanity.com/paper/2105.07381/) (2021)
- [STPrivacy: Spatio-Temporal Privacy-Preserving Action Recognition](https://mlsanity.com/paper/2301.03046/) (2023)
- [How Privacy-Preserving are Line Clouds? Recovering Scene Details from 3D Lines](https://mlsanity.com/paper/2103.05086/) (2021)
- [Balancing Biases and Preserving Privacy on Balanced Faces in the Wild](https://mlsanity.com/paper/2103.09118/) (2021)
- [PrivHAR: Recognizing Human Actions From Privacy-preserving Lens](https://mlsanity.com/paper/2206.03891/) (2022)
- [Data synthesis and adversarial networks: A review and meta-analysis in cancer imaging](https://mlsanity.com/paper/2107.09543/) (2021)
- [Privacy-Preserving Action Recognition via Motion Difference Quantization](https://mlsanity.com/paper/2208.02459/) (2022)
- [SOAR: Scene-debiasing Open-set Action Recognition](https://mlsanity.com/paper/2309.01265/) (2023)
- [Analysis and Mitigations of Reverse Engineering Attacks on Local Feature Descriptors](https://mlsanity.com/paper/2105.03812/) (2021)
- [A Privacy-Preserving Hybrid Federated Learning Framework for Financial Crime Detection](https://mlsanity.com/paper/2302.03654/) (2023)
- [LDP-Feat: Image Features with Local Differential Privacy](https://mlsanity.com/paper/2308.11223/) (2023)
- [GANonymization: A GAN-based Face Anonymization Framework for Preserving Emotional Expressions](https://mlsanity.com/paper/2305.02143/) (2023)
- [PATROL: Privacy-Oriented Pruning for Collaborative Inference Against Model Inversion Attacks](https://mlsanity.com/paper/2307.10981/) (2023)
- [Selective, Interpretable, and Motion Consistent Privacy Attribute Obfuscation for Action Recognition](https://mlsanity.com/paper/2403.12710/) (2024)
- [Gradient Attention Balance Network: Mitigating Face Recognition Racial Bias via Gradient Attention](https://mlsanity.com/paper/2304.02284/) (2023)
- [Modeling the Trade-off of Privacy Preservation and Activity Recognition on Low-Resolution Images](https://mlsanity.com/paper/2303.10435/) (2023)
- [Uncertainty-Autoencoder-Based Privacy and Utility Preserving Data Type Conscious Transformation](https://mlsanity.com/paper/2205.01950/) (2022)
- [Decouple-and-Sample: Protecting sensitive information in task agnostic data release](https://mlsanity.com/paper/2203.13204/) (2022)
- [Balancing Privacy and Action Performance: A Penalty-Driven Approach to Image Anonymization](https://mlsanity.com/paper/2504.14301/) (2025)
- [Black-Box Diagnosis and Calibration on GAN Intra-Mode Collapse: A Pilot Study](https://mlsanity.com/paper/2107.12202/) (2021)
- [Syfer: Neural Obfuscation for Private Data Release](https://mlsanity.com/paper/2201.12406/) (2022)
- [Activity Recognition on Avatar-Anonymized Datasets with Masked Differential Privacy](https://mlsanity.com/paper/2410.17098/) (2024)
- [Learning Robust and Privacy-Preserving Representations via Information Theory](https://mlsanity.com/paper/2412.11066/) (2024)
- [Video-DPRP: A Differentially Private Approach for Visual Privacy-Preserving Video Human Activity Recognition](https://mlsanity.com/paper/2503.02132/) (2025)
- [Training Domain-invariant Object Detector Faster with Feature Replay and Slow Learner](https://mlsanity.com/paper/2105.14693/) (2021)
- [Sparse and Privacy-enhanced Representation for Human Pose Estimation](https://mlsanity.com/paper/2309.09515/) (2023)

## Abstract (arXiv)

This paper aims to improve privacy-preserving visual recognition, an increasingly demanded feature in smart camera applications, by formulating a unique adversarial training framework. The proposed framework explicitly learns a degradation transform for the original video inputs, in order to optimize the trade-off between target task performance and the associated privacy budgets on the degraded video. A notable challenge is that the privacy budget, often defined and measured in task-driven contexts, cannot be reliably indicated using any single model performance, because a strong protection of privacy has to sustain against any possible model that tries to hack privacy information. Such an uncommon situation has motivated us to propose two strategies, i.e., budget model restarting and ensemble, to enhance the generalization of the learned degradation on protecting privacy against unseen hacker models. Novel training strategies, evaluation protocols, and result visualization methods have been designed accordingly. Two experiments on privacy-preserving action recognition, with privacy budgets defined in various ways, manifest the compelling effectiveness of the proposed framework in simultaneously maintaining high target task (action recognition) performance while suppressing the privacy breach risk.