# DP-Image: Differential Privacy for Image Data in Feature Space

arXiv: https://arxiv.org/abs/2103.07073 · HTML: https://mlsanity.com/paper/2103.07073/

## Key facts

- Cited by 23 papers in the map (data through 14 Oct 2026).
- Builds on 26 of its 55 references that are in the map.
- First posted on arXiv 12 Mar 2021.

## Builds on (most cited first, 26 of 26)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks](https://mlsanity.com/paper/1506.01497/) (2015)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [A Style-Based Generator Architecture for Generative Adversarial Networks](https://mlsanity.com/paper/1812.04948/) (2018)
- [Rethinking the Inception Architecture for Computer Vision](https://mlsanity.com/paper/1512.00567/) (2015)
- [Fully Convolutional Networks for Semantic Segmentation](https://mlsanity.com/paper/1411.4038/) (2014)
- [Going Deeper with Convolutions](https://mlsanity.com/paper/1409.4842/) (2014)
- [Auto-Encoding Variational Bayes](https://mlsanity.com/paper/1312.6114/) (2013)
- [Analyzing and Improving the Image Quality of StyleGAN](https://mlsanity.com/paper/1912.04958/) (2019)
- [Conditional Generative Adversarial Nets](https://mlsanity.com/paper/1411.1784/) (2014)
- [Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learning](https://mlsanity.com/paper/1602.07261/) (2016)
- [Encoding in Style: a StyleGAN Encoder for Image-to-Image Translation](https://mlsanity.com/paper/2008.00951/) (2020)
- [Renyi Differential Privacy](https://mlsanity.com/paper/1702.07476/) (2017)
- [Certified Robustness to Adversarial Examples with Differential Privacy](https://mlsanity.com/paper/1802.03471/) (2018)
- [FaceShifter: Towards High Fidelity And Occlusion Aware Face Swapping](https://mlsanity.com/paper/1912.13457/) (2019)
- [Adversarial Variational Bayes: Unifying Variational Autoencoders and Generative Adversarial Networks](https://mlsanity.com/paper/1701.04722/) (2017)
- [Privacy Amplification by Iteration](https://mlsanity.com/paper/1808.06651/) (2018)
- [When Machine Learning Meets Privacy: A Survey and Outlook](https://mlsanity.com/paper/2011.11819/) (2020)
- [Natural and Effective Obfuscation by Head Inpainting](https://mlsanity.com/paper/1711.09001/) (2017)
- [AnonymousNet: Natural Face De-Identification with Measurable Privacy](https://mlsanity.com/paper/1904.12620/) (2019)
- [Defeating Image Obfuscation with Deep Learning](https://mlsanity.com/paper/1609.00408/) (2016)
- [A Hybrid Model for Identity Obfuscation by Face Replacement](https://mlsanity.com/paper/1804.04779/) (2018)
- [Adversarial Image Perturbation for Privacy Protection -- A Game Theory Perspective](https://mlsanity.com/paper/1703.09471/) (2017)
- [Faceless Person Recognition; Privacy Implications in Social Media](https://mlsanity.com/paper/1607.08438/) (2016)
- [InfoScrub: Towards Attribute Privacy by Targeted Obfuscation](https://mlsanity.com/paper/2005.10329/) (2020)

## Built on by (most cited first, 23 of 23)

- [A Survey of What to Share in Federated Learning: Perspectives on Model Utility, Privacy Leakage, and Communication Efficiency](https://mlsanity.com/paper/2307.10655/) (2023)
- [Bounding the Invertibility of Privacy-preserving Instance Encoding using Fisher Information](https://mlsanity.com/paper/2305.04146/) (2023)
- [Face De-identification: State-of-the-art Methods and Comparative Studies](https://mlsanity.com/paper/2411.09863/) (2024)
- [Disguise without Disruption: Utility-Preserving Face De-Identification](https://mlsanity.com/paper/2303.13269/) (2023)
- [Local Differential Privacy Image Generation Using Flow-based Deep Generative Models](https://mlsanity.com/paper/2212.10688/) (2022)
- [PrivateGaze: Preserving User Privacy in Black-box Mobile Gaze Tracking Services](https://mlsanity.com/paper/2408.00950/) (2024)
- [Syfer: Neural Obfuscation for Private Data Release](https://mlsanity.com/paper/2201.12406/) (2022)
- [Semantics versus Identity: A Divide-and-Conquer Approach towards Adjustable Medical Image De-Identification](https://mlsanity.com/paper/2507.21703/) (2025)
- [Privacy Protectability: An Information-theoretical Approach](https://mlsanity.com/paper/2305.15697/) (2023)
- [Enhancing User-Centric Privacy Protection: An Interactive Framework through Diffusion Models and Machine Unlearning](https://mlsanity.com/paper/2409.03326/) (2024)
- [SemDP: Semantic-level Differential Privacy Protection for Face Datasets](https://mlsanity.com/paper/2412.15590/) (2024)
- [PASS: Private Attributes Protection with Stochastic Data Substitution](https://mlsanity.com/paper/2506.07308/) (2025)
- [ROFI: A Deep Learning-Based Ophthalmic Sign-Preserving and Reversible Patient Face Anonymizer](https://mlsanity.com/paper/2510.11073/) (2025)
- [Contextualize differential privacy in image database: a lightweight image differential privacy approach based on principle component analysis inverse](https://mlsanity.com/paper/2202.08309/) (2022)
- [Differentially Private Cross-camera Person Re-identification](https://mlsanity.com/paper/2306.02765/) (2023)
- [SpinML: Customized Synthetic Data Generation for Private Training of Specialized ML Models](https://mlsanity.com/paper/2503.03160/) (2025)
- [Computation-Efficient and Recognition-Friendly 3D Point Cloud Privacy Protection](https://mlsanity.com/paper/2503.15818/) (2025)
- [Beyond Anonymization: Object Scrubbing for Privacy-Preserving 2D and 3D Vision Tasks](https://mlsanity.com/paper/2504.16557/) (2025)
- [Amplified Patch-Level Differential Privacy for Free via Random Cropping](https://mlsanity.com/paper/2603.24695/) (2026)
- [Assessing Privacy Preservation and Utility in Online Vision-Language Models](https://mlsanity.com/paper/2604.09695/) (2026)
- [Bit-ViP: Leveraging Bit-planes to Preserve Visual Privacy in Images through Obfuscation](https://mlsanity.com/paper/2606.29417/) (2026)
- [End-to-End Differential Privacy in Training Deep Neural Network Classifiers](https://mlsanity.com/paper/2607.19580/) (2026)
- [Picture the Epsilon: Pursuing Identity-Level Privacy Guarantees for Images](https://mlsanity.com/paper/2608.17147/) (2026)

## Abstract (arXiv)

The excessive use of images in social networks, government databases, and industrial applications has posed great privacy risks and raised serious concerns from the public. Even though differential privacy (DP) is a widely accepted criterion that can provide a provable privacy guarantee, the application of DP on unstructured data such as images is not trivial due to the lack of a clear qualification on the meaningful difference between any two images. In this paper, for the first time, we introduce a novel notion of image-aware differential privacy, referred to as DP-image, that can protect user's personal information in images, from both human and AI adversaries. The DP-Image definition is formulated as an extended version of traditional differential privacy, considering the distance measurements between feature space vectors of images. Then we propose a mechanism to achieve DP-Image by adding noise to an image feature vector. Finally, we conduct experiments with a case study on face image privacy. Our results show that the proposed DP-Image method provides excellent DP protection on images, with a controllable distortion to faces.