# Image Obfuscation for Privacy-Preserving Machine Learning

arXiv: https://arxiv.org/abs/2010.10139 · HTML: https://mlsanity.com/paper/2010.10139/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 20 Oct 2020.

## Built on by (most cited first, 7 of 7)

- [A Fusion-Denoising Attack on InstaHide with Data Augmentation](https://mlsanity.com/paper/2105.07754/) (2021)
- [Decouple-and-Sample: Protecting sensitive information in task agnostic data release](https://mlsanity.com/paper/2203.13204/) (2022)
- [On Mask-based Image Set Desensitization with Recognition Support](https://mlsanity.com/paper/2312.08975/) (2023)
- [Synthetic Dataset Generation for Privacy-Preserving Machine Learning](https://mlsanity.com/paper/2210.03205/) (2022)
- [PARMESAN: Parameter-Free Memory Search and Transduction for Dense Prediction Tasks](https://mlsanity.com/paper/2403.11743/) (2024)
- [Privacy-Preserving Medical Image Classification through Deep Learning and Matrix Decomposition](https://mlsanity.com/paper/2308.16530/) (2023)
- [FairDeFace: Evaluating the Fairness and Adversarial Robustness of Face Obfuscation Methods](https://mlsanity.com/paper/2503.08731/) (2025)

## Abstract (arXiv)

Privacy becomes a crucial issue when outsourcing the training of machine learning (ML) models to cloud-based platforms offering machine-learning services. While solutions based on cryptographic primitives have been developed, they incur a significant loss in accuracy or training efficiency, and require modifications to the backend architecture. A key challenge we tackle in this paper is the design of image obfuscation schemes that provide enough privacy without significantly degrading the accuracy of the ML model and the efficiency of the training process. In this endeavor, we address another challenge that has persisted so far: quantifying the degree of privacy provided by visual obfuscation mechanisms. We compare the ability of state-of-the-art full-reference quality metrics to concur with human subjects in terms of the degree of obfuscation introduced by a range of techniques. By relying on user surveys and two image datasets, we show that two existing image quality metrics are also well suited to measure the level of privacy in accordance with human subjects as well as AI-based recognition, and can therefore be used for quantifying privacy resulting from obfuscation. With the ability to quantify privacy, we show that we can provide adequate privacy protection to the training image set at the cost of only a few percentage points loss in accuracy.