Privacy considerations in Computer Vision - Model Metrics & Evaluation

Metrics & Evaluation - Privacy considerations

Which metric matters for Privacy considerations and WHY

In privacy-focused computer vision, traditional accuracy metrics are not enough. We need metrics that measure how well the model protects sensitive data. Examples include differential privacy guarantees, membership inference attack success rates, and data anonymization effectiveness. These metrics help us understand if the model leaks private information or if it respects user privacy.

Confusion matrix or equivalent visualization

For privacy, a confusion matrix is less relevant. Instead, consider a table showing attack success rates on private data:

    +----------------------------+---------------------+
    | Attack Type                | Success Rate (%)     |
    +----------------------------+---------------------+
    | Membership Inference       | 5                   |
    | Model Inversion            | 3                   |
    | Attribute Inference        | 7                   |
    +----------------------------+---------------------+
    

Lower success rates mean better privacy protection.

Precision vs Recall tradeoff (or equivalent) with concrete examples

In privacy, there is a tradeoff between model utility (accuracy) and privacy protection. For example, adding noise to images can reduce model accuracy but improve privacy by hiding sensitive details.

Example:

• High accuracy, low privacy: Model recognizes faces well but leaks identity information.
• High privacy, low accuracy: Model blurs faces to protect identity but struggles to detect objects.

Finding the right balance depends on the application needs.

What "good" vs "bad" metric values look like for Privacy considerations

Good privacy metrics:

• Membership inference attack success rate < 10%
• Differential privacy epsilon < 1 (strong privacy)
• Minimal data leakage detected

Bad privacy metrics:

• Attack success rates > 50%
• High epsilon values (e.g., > 10) indicating weak privacy
• Evidence of sensitive data reconstruction

Metrics pitfalls

• Ignoring privacy metrics: Focusing only on accuracy can hide privacy risks.
• Data leakage: Training data accidentally exposed in model outputs.
• Overfitting: Model memorizes training images, increasing privacy risk.
• False sense of security: Using weak privacy guarantees or incomplete tests.

Self-check question

Your computer vision model has 95% accuracy but a membership inference attack success rate of 60%. Is it good for privacy? Why or why not?

Answer: No, it is not good for privacy. A 60% attack success rate means attackers can often tell if a person's data was used to train the model. This leaks sensitive information despite high accuracy.

Key Result

Privacy metrics like attack success rates and differential privacy epsilon are key to evaluating if a computer vision model protects sensitive data.