# Privacy-Preserving Representations are not Enough -- Recovering Scene Content from Camera Poses arXiv: https://arxiv.org/abs/2305.04603 ยท HTML: https://mlsanity.com/paper/2305.04603/ ## Key facts - Cited by 7 papers in the map (data through 14 Oct 2026). - Builds on 29 of its 55 references that are in the map. - First posted on arXiv 8 May 2023. ## Builds on (most cited first, 29 of 29) - [ScanNet: Richly-annotated 3D Reconstructions of Indoor Scenes](https://mlsanity.com/paper/1702.04405/) (2017) - [SuperGlue: Learning Feature Matching with Graph Neural Networks](https://mlsanity.com/paper/1911.11763/) (2019) - [SuperPoint: Self-Supervised Interest Point Detection and Description](https://mlsanity.com/paper/1712.07629/) (2017) - [LoFTR: Detector-Free Local Feature Matching with Transformers](https://mlsanity.com/paper/2104.00680/) (2021) - [From Coarse to Fine: Robust Hierarchical Localization at Large Scale](https://mlsanity.com/paper/1812.03506/) (2018) - [R2D2: Repeatable and Reliable Detector and Descriptor](https://mlsanity.com/paper/1906.06195/) (2019) - [Visual Camera Re-Localization from RGB and RGB-D Images Using DSAC](https://mlsanity.com/paper/2002.12324/) (2020) - [Inverting Visual Representations with Convolutional Networks](https://mlsanity.com/paper/1506.02753/) (2015) - [Learning Less is More - 6D Camera Localization via 3D Surface Regression](https://mlsanity.com/paper/1711.10228/) (2017) - [Patch2Pix: Epipolar-Guided Pixel-Level Correspondences](https://mlsanity.com/paper/2012.01909/) (2020) - [MatchFormer: Interleaving Attention in Transformers for Feature Matching](https://mlsanity.com/paper/2203.09645/) (2022) - [Expert Sample Consensus Applied to Camera Re-Localization](https://mlsanity.com/paper/1908.02484/) (2019) - [Revealing Scenes by Inverting Structure from Motion Reconstructions](https://mlsanity.com/paper/1904.03303/) (2019) - [Robust Image Retrieval-based Visual Localization using Kapture](https://mlsanity.com/paper/2007.13867/) (2020) - [Learning to Navigate the Energy Landscape](https://mlsanity.com/paper/1603.05772/) (2016) - [MeshLoc: Mesh-Based Visual Localization](https://mlsanity.com/paper/2207.10762/) (2022) - [Is Geometry Enough for Matching in Visual Localization?](https://mlsanity.com/paper/2203.12979/) (2022) - [Privacy Preserving Image-Based Localization](https://mlsanity.com/paper/1903.05572/) (2019) - [Large-scale, real-time visual-inertial localization revisited](https://mlsanity.com/paper/1907.00338/) (2019) - [Hybrid Scene Compression for Visual Localization](https://mlsanity.com/paper/1807.07512/) (2018) - [Project AutoVision: Localization and 3D Scene Perception for an Autonomous Vehicle with a Multi-Camera System](https://mlsanity.com/paper/1809.05477/) (2018) - [Beyond Controlled Environments: 3D Camera Re-Localization in Changing Indoor Scenes](https://mlsanity.com/paper/2008.02004/) (2020) - [Let's Take This Online: Adapting Scene Coordinate Regression Network Predictions for Online RGB-D Camera Relocalisation](https://mlsanity.com/paper/1906.08744/) (2019) - [NinjaDesc: Content-Concealing Visual Descriptors via Adversarial Learning](https://mlsanity.com/paper/2112.12785/) (2021) - [How Privacy-Preserving are Line Clouds? Recovering Scene Details from 3D Lines](https://mlsanity.com/paper/2103.05086/) (2021) - [Privacy Preserving Visual SLAM](https://mlsanity.com/paper/2007.10361/) (2020) - [Efficient 2D-3D Matching for Multi-Camera Visual Localization](https://mlsanity.com/paper/1809.06445/) (2018) - [Analysis and Mitigations of Reverse Engineering Attacks on Local Feature Descriptors](https://mlsanity.com/paper/2105.03812/) (2021) - [Privacy-Preserving Image Features via Adversarial Affine Subspace Embeddings](https://mlsanity.com/paper/2006.06634/) (2020) ## Built on by (most cited first, 7 of 7) - [An Outlook into the Future of Egocentric Vision](https://mlsanity.com/paper/2308.07123/) (2023) - [Obfuscation Based Privacy Preserving Representations are Recoverable Using Neighborhood Information](https://mlsanity.com/paper/2409.11536/) (2024) - [Remove360: Benchmarking Residuals After Object Removal in 3D Gaussian Splatting](https://mlsanity.com/paper/2508.11431/) (2025) - [Is there anything left? Measuring semantic residuals of objects removed from 3D Gaussian Splatting](https://mlsanity.com/paper/2503.17574/) (2025) - [Depth-Guided Privacy-Preserving Visual Localization Using 3D Sphere Clouds](https://mlsanity.com/paper/2605.00562/) (2026) - [Revisiting Geometric Obfuscation with Dual Convergent Lines for Privacy-Preserving Image Queries in Visual Localization](https://mlsanity.com/paper/2604.22310/) (2026) - [Seeing Through the Weights: Privacy Leakage in Scene Coordinate Regression](https://mlsanity.com/paper/2606.31164/) (2026) ## Abstract (arXiv) Visual localization is the task of estimating the camera pose from which a given image was taken and is central to several 3D computer vision applications. With the rapid growth in the popularity of AR/VR/MR devices and cloud-based applications, privacy issues are becoming a very important aspect of the localization process. Existing work on privacy-preserving localization aims to defend against an attacker who has access to a cloud-based service. In this paper, we show that an attacker can learn about details of a scene without any access by simply querying a localization service. The attack is based on the observation that modern visual localization algorithms are robust to variations in appearance and geometry. While this is in general a desired property, it also leads to algorithms localizing objects that are similar enough to those present in a scene. An attacker can thus query a server with a large enough set of images of objects, eg, obtained from the Internet, and some of them will be localized. The attacker can thus learn about object placements from the camera poses returned by the service (which is the minimal information returned by such a service). In this paper, we develop a proof-of-concept version of this attack and demonstrate its practical feasibility. The attack does not place any requirements on the localization algorithm used, and thus also applies to privacy-preserving representations. Current work on privacy-preserving representations alone is thus insufficient.