k-Same-Net: k-Anonymity with Generative Deep Neural Networks for Face Deidentification

Abstract

; Tel.: +386-1-479-8245 † This paper is an extended version of our paper published in Meden B.; Emeršič Ž.; Štruc V.; Peer P.k-Same-Net: Neural-Network-Based Face Deidentification. In the Proceedings of the International Conference and Workshop on Bioinspired Intelligence (IWOBI), Funchal Madeira, Portugal, 10-12 July 2017.Received: 1 December 2017 ; Accepted: 9 January 2018; Published: 13 January 2018Abstract: Image and video data are today being shared between government entities and other relevant stakeholders on a regular basis and require careful handling of the personal information contained therein. A popular approach to ensure privacy protection in such data is the use of deidentification techniques, which aim at concealing the identity of individuals in the imagery while still preserving certain aspects of the data after deidentification. In this work, we propose a novel approach towards face deidentification, called k-Same-Net, which combines recent Generative Neural Networks (GNNs) with the well-known k-Anonymitymechanism and provides formal guarantees regarding privacy protection on a closed set of identities. Our GNN is able to generate synthetic surrogate face images for deidentification by seamlessly combining features of identities used to train the GNN model. Furthermore, it allows us to control the image-generation process with a small set of appearance-related parameters that can be used to alter specific aspects (e.g., facial expressions, age, gender) of the synthesized surrogate images. We demonstrate the feasibility of k-Same-Net in comprehensive experiments on the XM2VTS and CK+ datasets. We evaluate the efficacy of the proposed approach through reidentification experiments with recent recognition models and compare our results with competing deidentification techniques from the literature. We also present facial expression recognition experiments to demonstrate the utility-preservation capabilities of k-Same-Net.Our experimental results suggest that k-Same-Net is a viable option for facial deidentification that exhibits several desirable characteristics when compared to existing solutions in this area.

Privacy–Enhancing Face Biometrics: A Comprehensive Survey

“…One possibility to address these issues is to completely remove all information that could be used by biometric recognition techniques. At the image-level, for example, early privacy protection methods tried to hide sensitive information by placing black patches over individuals or replacing image regions corresponding to individuals by uninformative surrogate images [10], [15], [61]. While such approaches ensure perfect privacy protection, they also completely destroy the utility of the data.…”

“…Meden et al [9], for example, designed a face deidentification pipeline around Generative Neural Networks (GNN) consisting of the Viola-Jones face detector, a VGG16-based feature extractor and a GNN based face renderer -for surrogate face generation. This ad-hoc pipeline was then extended to the k-Same-Net model, which incorporated elements from the k-Same family of algorithms and was empirically shown to offer a solid compromise between privacy protection and data utility -preserving facial expressions without visual artifacts [33], [61]. While k-Same-Net was inspired by the kanonymity model, a formal proof of the privacy guarantees associated with the model was not provided.…”

Preventing Fake Information Generation Against Media Clone Attacks

“…The results may not necessarily be natural or sufficiently anonymized [16]- [19]. The concept of k-anonymity [20] provides a theoretical guarantee of privacy [21]- [25]. Neural networks or, more specifically, generative adversarial networks (GANs), offer a new approach to anonymizing faces by synthesizing realistic yet anonymous faces [17], [26]- [29], which can be used together with k-anonymity or other theoretical criteria [25], [30].…”

Learning Privacy Preserving Encodings Through Adversarial Training

“…Much prior work on achieving privacy with such data, especially with images and videos, has relied on domain knowledge and hand-crafted approaches-such as pixelation, blurring, face/object replacement, etc.-to degrade sensitive information [1,2,4,6,13,27]. These methods can be effective in many practical settings when it is clear what to censor, and some variants are even able to make the resulting image look natural and possess chosen attributese.g., replacing faces with generated ones [3,5,17] of different individuals with the same expression, pose, etc. However, we consider the general case when all cues in an image towards the private attribute can not be enumerated, and that an adversary seeking to recover that attribute will learn an estimator specifically for our encoding.…”