Privacy considerations in Computer Vision - Model Metrics & Evaluation

Metrics & Evaluation - Privacy considerations

Which metric matters for Privacy considerations and WHY

In privacy-focused computer vision, traditional accuracy metrics are not enough. We need metrics that measure how well the model protects sensitive data. Examples include differential privacy guarantees, membership inference attack success rates, and data anonymization effectiveness. These metrics help us understand if the model leaks private information or if it respects user privacy.

Confusion matrix or equivalent visualization

For privacy, a confusion matrix is less relevant. Instead, consider a table showing attack success rates on private data:

    +----------------------------+---------------------+
    | Attack Type                | Success Rate (%)     |
    +----------------------------+---------------------+
    | Membership Inference       | 5                   |
    | Model Inversion            | 3                   |
    | Attribute Inference        | 7                   |
    +----------------------------+---------------------+
    

Lower success rates mean better privacy protection.

Precision vs Recall tradeoff (or equivalent) with concrete examples

In privacy, there is a tradeoff between model utility (accuracy) and privacy protection. For example, adding noise to images can reduce model accuracy but improve privacy by hiding sensitive details.

Example:

• High accuracy, low privacy: Model recognizes faces well but leaks identity information.
• High privacy, low accuracy: Model blurs faces to protect identity but struggles to detect objects.

Finding the right balance depends on the application needs.

What "good" vs "bad" metric values look like for Privacy considerations

Good privacy metrics:

• Membership inference attack success rate < 10%
• Differential privacy epsilon < 1 (strong privacy)
• Minimal data leakage detected

Bad privacy metrics:

• Attack success rates > 50%
• High epsilon values (e.g., > 10) indicating weak privacy
• Evidence of sensitive data reconstruction

Metrics pitfalls

• Ignoring privacy metrics: Focusing only on accuracy can hide privacy risks.
• Data leakage: Training data accidentally exposed in model outputs.
• Overfitting: Model memorizes training images, increasing privacy risk.
• False sense of security: Using weak privacy guarantees or incomplete tests.

Self-check question

Your computer vision model has 95% accuracy but a membership inference attack success rate of 60%. Is it good for privacy? Why or why not?

Answer: No, it is not good for privacy. A 60% attack success rate means attackers can often tell if a person's data was used to train the model. This leaks sensitive information despite high accuracy.

Key Result

Privacy metrics like attack success rates and differential privacy epsilon are key to evaluating if a computer vision model protects sensitive data.

Practice

1. What is the main reason to blur faces in images used for computer vision projects?

easy

A. To make the images look artistic

B. To improve the image quality for better model training

C. To reduce the file size of the images

D. To protect people's privacy by hiding their identity

Solution

1. Step 1: Understand privacy protection in images

   Blurring faces hides personal identity, which protects privacy.

2. Step 2: Compare other options

   Improving quality, reducing size, or artistic effects do not relate to privacy.

3. Final Answer:

   To protect people's privacy by hiding their identity -> Option D

4. Quick Check:

   Blurring faces = privacy protection [OK]

Hint: Blurring hides identity to protect privacy [OK]

Common Mistakes:

• Thinking blurring improves image quality
• Confusing file size reduction with privacy
• Assuming artistic effects protect privacy

2. Which of the following is the correct way to remove metadata from an image file in Python?

easy

A. Use PIL's Image.save() with 'exif' parameter set to None

B. Use cv2.imread() and cv2.imwrite() without extra steps

C. Rename the image file extension to .txt

D. Open the image in a text editor and delete random lines

Solution

1. Step 1: Identify proper metadata removal method

   PIL's Image.save() with 'exif=None' removes metadata correctly.

2. Step 2: Evaluate other options

   cv2.imread/write does not remove metadata; renaming or editing text is invalid.

3. Final Answer:

   Use PIL's Image.save() with 'exif' parameter set to None -> Option A

4. Quick Check:

   Remove metadata = PIL save with exif=None [OK]

Hint: Use PIL save with exif=None to remove metadata [OK]

Common Mistakes:

• Assuming cv2.imwrite removes metadata
• Renaming file extensions changes nothing
• Editing image as text corrupts the file

3. Consider this Python code snippet that blurs faces in an image using OpenCV:

import cv2
image = cv2.imread('group_photo.jpg')
face_cascade = cv2.CascadeClassifier('haarcascade_frontalface_default.xml')
faces = face_cascade.detectMultiScale(image, scaleFactor=1.1, minNeighbors=5)
for (x, y, w, h) in faces:
    face_region = image[y:y+h, x:x+w]
    blurred_face = cv2.GaussianBlur(face_region, (99, 99), 30)
    image[y:y+h, x:x+w] = blurred_face
cv2.imwrite('blurred_photo.jpg', image)

What will be the result of running this code?

medium

A. The output image will have all detected faces blurred to protect privacy

B. The output image will be unchanged because GaussianBlur is not applied correctly

C. The code will raise an error because detectMultiScale requires a grayscale image

D. The code will blur the entire image instead of just faces

Solution

1. Step 1: Trace the code execution

   cv2.imread loads a color image. However, detectMultiScale requires a grayscale image input, so passing a color image will cause an error or incorrect detection.

2. Step 2: Correct usage

   The image should be converted to grayscale before calling detectMultiScale, e.g., gray = cv2.cvtColor(image, cv2.COLOR_BGR2GRAY).

3. Final Answer:

   The code will raise an error because detectMultiScale requires a grayscale image -> Option C

4. Quick Check:

   detectMultiScale requires grayscale input [OK]

Hint: detectMultiScale needs grayscale image [OK]

Common Mistakes:

• Thinking detectMultiScale works directly on color images
• Assuming no error on color input
• Believing blur applies to whole image

4. You have a dataset of images with faces but forgot to get consent from people. Which fix below best respects privacy and legal rules?

medium

A. Blur all faces in the dataset before using it for training

B. Use the images as is because they are publicly available

C. Remove all images with faces and keep only background images

D. Add random noise to images without blurring faces

Solution

1. Step 1: Identify privacy and legal requirements

   Consent is needed; without it, faces must be anonymized.

2. Step 2: Evaluate options for compliance

   Blurring faces anonymizes identities; using images as is or adding noise does not protect privacy properly.

3. Final Answer:

   Blur all faces in the dataset before using it for training -> Option A

4. Quick Check:

   No consent = anonymize faces by blurring [OK]

Hint: No consent? Blur faces to protect privacy [OK]

Common Mistakes:

• Assuming public availability means consent
• Thinking noise addition protects identity
• Removing images may lose valuable data unnecessarily

5. You want to build a face recognition system but must comply with privacy laws. Which combined approach best balances functionality and privacy?

hard

A. Train on unblurred public images and delete them after training

B. Collect images only with explicit consent and blur faces in public datasets

C. Use any available images without consent but encrypt the dataset

D. Avoid face recognition and use only object detection instead

Solution

1. Step 1: Understand privacy law requirements

   Explicit consent is required to use personal images legally.

2. Step 2: Combine consent and anonymization

   Blurring faces in public datasets protects privacy while allowing training.

3. Step 3: Evaluate other options

   Using images without consent or deleting after training does not ensure compliance; avoiding face recognition limits functionality.

4. Final Answer:

   Collect images only with explicit consent and blur faces in public datasets -> Option B

5. Quick Check:

   Consent + blur = privacy compliance and functionality [OK]

Hint: Consent plus blurring balances privacy and use [OK]

Common Mistakes:

• Thinking encryption replaces consent
• Assuming deleting data after training is enough
• Avoiding face recognition is not always necessary