# Privacy-Preserving Action Recognition: Taxonomy, Methods, and Privacy-Utility Trade-offs

arXiv: https://arxiv.org/abs/2608.04501 · HTML: https://mlsanity.com/paper/2608.04501/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 23 of its 124 references that are in the map.
- First posted on arXiv 5 Aug 2026.

## Builds on (most cited first, 23 of 23)

- [CIAGAN: Conditional Identity Anonymization Generative Adversarial Networks](https://mlsanity.com/paper/2005.09544/) (2020)
- [Towards Privacy-Preserving Visual Recognition via Adversarial Training: A Pilot Study](https://mlsanity.com/paper/1807.08379/) (2018)
- [SPAct: Self-supervised Privacy Preservation for Action Recognition](https://mlsanity.com/paper/2203.15205/) (2022)
- [STPrivacy: Spatio-Temporal Privacy-Preserving Action Recognition](https://mlsanity.com/paper/2301.03046/) (2023)
- [TeD-SPAD: Temporal Distinctiveness for Self-supervised Privacy-preservation for video Anomaly Detection](https://mlsanity.com/paper/2308.11072/) (2023)
- [Privacy-Preserving Action Recognition using Coded Aperture Videos](https://mlsanity.com/paper/1902.09085/) (2019)
- [A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attacks](https://mlsanity.com/paper/2310.00633/) (2023)
- [PrivHAR: Recognizing Human Actions From Privacy-preserving Lens](https://mlsanity.com/paper/2206.03891/) (2022)
- [Privacy-Preserving Action Recognition via Motion Difference Quantization](https://mlsanity.com/paper/2208.02459/) (2022)
- [The Federation Strikes Back: A Survey of Federated Learning Privacy Attacks, Defenses, Applications, and Policy Landscape](https://mlsanity.com/paper/2405.03636/) (2024)
- [Does Image Anonymization Impact Computer Vision Training?](https://mlsanity.com/paper/2306.05135/) (2023)
- [GANonymization: A GAN-based Face Anonymization Framework for Preserving Emotional Expressions](https://mlsanity.com/paper/2305.02143/) (2023)
- [Differentially Private Video Activity Recognition](https://mlsanity.com/paper/2306.15742/) (2023)
- [Selective, Interpretable, and Motion Consistent Privacy Attribute Obfuscation for Action Recognition](https://mlsanity.com/paper/2403.12710/) (2024)
- [Privacy-sensitive Objects Pixelation for Live Video Streaming](https://mlsanity.com/paper/2101.00604/) (2021)
- [Privacy Assessment of Federated Learning using Private Personalized Layers](https://mlsanity.com/paper/2106.08060/) (2021)
- [Anonymization for Skeleton Action Recognition](https://mlsanity.com/paper/2111.15129/) (2021)
- [FSAR: Federated Skeleton-based Action Recognition with Adaptive Topology Structure and Knowledge Distillation](https://mlsanity.com/paper/2306.11046/) (2023)
- [Balancing Privacy and Action Performance: A Penalty-Driven Approach to Image Anonymization](https://mlsanity.com/paper/2504.14301/) (2025)
- [Self-Supervised Human Activity Recognition by Augmenting Generative Adversarial Networks](https://mlsanity.com/paper/2008.11755/) (2020)
- [Exploring AI-based Anonymization of Industrial Image and Video Data in the Context of Feature Preservation](https://mlsanity.com/paper/2405.19173/) (2024)
- [Bones of Contention: Exploring Query-Efficient Attacks against Skeleton Recognition Systems](https://mlsanity.com/paper/2501.16843/) (2025)
- [A Lightweight 3D-CNN for Event-Based Human Action Recognition with Privacy-Preserving Potential](https://mlsanity.com/paper/2511.03665/) (2025)

## Abstract (arXiv)

Video surveillance in public safety, healthcare, and smart environments has made continuous human monitoring routine, raising real risks to personal identity and appearance. Privacy-preserving action recognition (PPAR) tackles the tension between the utility of video understanding and this exposure, and has drawn fast-growing interest. However, existing surveys remain narrow. Most catalog a single mechanism family, predate recent adversarial and hybrid work, or barely address evaluation. The result is a fragmented literature with incompatible threat models, inconsistent metrics, and no shared evaluation standard. We address this with a PRISMA-guided review of 32 peer-reviewed papers (2018--2026) drawn from 885 screened records. Methods sort into five families, namely adversarial learning (52%), skeleton-based (20%), cryptographic (12%), differential privacy (8%), and hybrid (8%), each with distinct privacy, utility, and efficiency trade-offs. Evaluation is the weak point. Only 10% of papers adopt a formal privacy definition, 65% rely on ad-hoc metrics, and 40% report an inconsistently defined cMAP. The trade-offs are steep. Skeleton methods reach about 85% accuracy but drop appearance, adversarial methods hold near 80% utility at moderate privacy (cMAP 0.9 to 0.3--0.5), and differential privacy often falls below 70%. Harder conditions stay under-tested, with fewer than 15% of papers checking cross-dataset generalization, under 10% testing adaptive attackers, and real-time edge deployment nearly untouched. We contribute a two-dimensional privacy-space taxonomy, a formal threat model, a comparative trade-off analysis, the PPAR Unified Evaluation Protocol, and a roadmap centered on benchmark standardization. With this grounding, we argue PPAR can move from prototypes toward deployment, with lessons extending to face recognition and medical imaging.