Due to the ever-increasing web presence of people and proliferation of image sharing on social media, it is becoming increasingly dificult for users to maintain the privacy and security of their sensitive data. Majority of the users share their images on various platforms presuming that the data would only serve its intended purpose. However, in reality, there is a significant risk of the images falling into the wrong hands and eventually being used for malignant purposes without the users' knowledge. To prevent any unwanted disclosures, it is imperative to devise efective techniques that notify the user to review their decision before any sensitive information is shared. Several methods have been proposed to execute this task, yet most have shortcomings that might make them unsuitable for end-users. In this paper, we propose a configurable privacy prediction system that addresses some of the major drawbacks of the existing methods while still achieving state-ofthe art performance. The proposed solution accommodates personalization which enables the users to include their privacy preferences and tweak the system according to their requirements. Along with the predictions, the proposed system also provides user-friendly human-readable explanations.
might harm one’s career prospects [4, 5, 6].
Despite the serious concerns over mismanaged personal content, studies have shown that majority of the users fail to diligently protect the privacy of their data either due to lack of awareness or dificulties in managing privacy settings [7, 8, 9]. Even in the case of proactive users who actively manage their privacy settings, the authors of [7] demonstrate that the users’ judgement of privacy risk may not accurately represent the true level of associated privacy risk. These factors project the substantial necessity of an accurate and informative privacy Figure 1: The goal is to devise a personalized privacy predic- prediction system. tion system equipped with an explanation generation module One of the major challenges in privacy prediction is the and a feedback interface for the user. For example, a user im- fact that privacy is highly subjective in nature. While an age is classified as private (previously classified as public) once image can be construed as private by some, others could the user gives his feedback about the privacy of the image, as argue that it is public in nature. The ground truths used illustrated in the figure above. for training the prediction models are usually collected from multiple manual reviewers who vote based on their
In today’s highly connected world, sensitive content perception and the majority vote for a particular image shared on the internet without appropriate privacy set- is considered to be its training label [10]. Therefore, thetings can adversely afect all parties involved from users oretically even if a model achieves 100% accuracy on the to corporations. For instance, malicious videos could be training labels, a considerable number of manual annotacreated using deepfakes [1] if suficient images of the tors would disagree with the model’s predictions. This user are made available to the public, and this is a serious fact signifies the need of personalization in privacy presecurity concern that could damage the user’s reputa- diction systems. In order to provide relevant predictions tion [2, 3]. Even when used in legitimate tasks such as for each user based on their privacy requirements, the background verification of job applicants by employers, system needs to allow personalization. However, there personal content which might be perceived as indecorous are significant challenges to personalized models such as requirement of large amounts of user data, resource constraints to train and deploy them, and dificulties associated with accommodating sudden changes in preferences [11]. Our paper describes a novel approach to address these problems yet requires similar amount of data and computational resources as non-personalized introduces multiple important characteristics to the privacy prediction process while still achieving state of the art performance. To the best of our knowledge, there does not exist any other privacy prediction method that addresses these multiple challenges simultaneously. Contributions of the proposed approach are five-fold: 1. Personalization realized through user feedback. 2. Explanation for each prediction in real-time. 3. Configurability by allowing modifications to the
system composition. 4. Customizable privacy settings for enforcing elevated security constraints in user-specified conditions. 5. Instantaneous updation of the user’s privacy pref
erences.
Over the years, researchers have explored various machine learning techniques for evaluating the privacy of the images. These approaches employed several types of data in addition to image data, such as social group methods. Additionally, our method keeps up with the information, location information, deep tags, user tags changing user requirements and updates its behavior and others. While there are advantages of training clasinstantaneously to reflect the preferences. sifiers on each of these alternative data types, most of
It is commonplace for users to overlook important de- them tend to have limitations such as availability and tails that might leak private information. For example, noises. Relying solely on image contents and features deusers may not pay much attention to what is visible in rived directly from images appear to be more promising the background when taking pictures in their personal as they do not depend on the availability of additional space and sensitive content such as computer screens or information and as a result are more generic in nature confidential documents might accidentally be captured and hence, more reliable. in the frame. In such cases, users may assume that the Classifiers trained on deep tags in conjunction with prediction is erroneous unless an explanation is provided user tags have achieved promising results [13] as the along with the prediction, bringing the unnoticed details automated deep tags would mitigate the scarcity of user to the users’ attention. In many cases, the user may not be tags. In [14], Tran et al. demonstrate that employing aware of the privacy implications of an image’s contents high-level hierarchical features at object level is benefiwhich would lead to a diference in the user’s judgement cial compared to using low-level vision features which are and the predicted label [7]. In such scenarios, an expla- usually non-informative to users. Traditional computer nation would become imperative to convince the user vision techniques such as Scale-Invariant Feature Transabout the apparent privacy violation. Otherwise, there is form (SIFT) [15] and Global Image Descriptor (GIST) [16] a risk of the user ignoring the suggested privacy status have been used in [17, 11, 18], and the authors in [17, 19] due to a lack of confidence in the automated prediction. ifnd that SIFT along with image tags perform best for Hence, we devise our system to generate an explanation image privacy classification. In [ 20], Tonge et al. leverage along with each prediction. multi-modal data fusing object, scene context, and image
Reusability in machine learning applications wherever tags information and report promising results. In [21], applicable is paramount as building models from scratch Tonge et al. present impressive results by using deep viunless required is redundant, expensive in terms of both sual features and tags derived from widely-known CNN computational resources and time, and even has environ- architectures, and also present a detailed comparison mental impacts [12]. In this work, we leverage several with prior works. pretrained deep learning models that have achieved im- Interestingly, all of the methods discussed above share pressive results and use them eficiently in our privacy a common limitation, i.e., they do not support personprediction system. alization. Fewer studies have been conducted on per
In this work, we introduce a novel framework that sonalized models for privacy prediction [11, 7]. In [11],
expensive to build in terms of computational costs, space and time requirements. To address these challenges, Orekondy et al. [7] use clustering of user profiles and map each user to one of the representative clusters which are significantly fewer in number, and as a result, reduce the computational costs involved.
At present, there does not exist any privacy prediction method that generates intuitive human-readable explanations, to the best of our knowledge. Post-hoc interpretability methods such as LIME [22], SHAP [23], GradCAM [24] and many others can be used for image classification tasks such as privacy prediction, but most of these methods generate generic heatmaps without any contextual link to privacy. The visual cues generated by the multitude of interpretability methods in the literature are dificult to decipher even for domain experts and would not be suitable for the wider audience.
3.1. Goal
configured according to their own privacy preferences. To this end, we build a composite machine learning system to classify images as Private and Public. However, it should be noted that a standard definition of privacy does not exist, in fact, it is highly subjective as each individual might have a diferent interpretation of privacy. Therefore, for the predictions to be relevant to the user, it is paramount that the system incorporates the user’s preferences and requirements. Additionally, we also provide cogent reasoning through explanations for the predictions to aid the users’ understanding of the privacy implications and help them make an informed decisions. privacy-related questions in the Privacy MNN (PrivMNN) (see Figure 3). Depending on the users’ perception of privacy, their preferences and requirements, these questions might vary considerably. However, research has shown that generic patterns and trends do exist with respect to privacy of images when studies are conducted at a large scale [17, 19, 18]. Therefore, we begin by training a model which captures the patterns that apply to the generic population and provide individual users with the flexibility to tweak the privacy prediction system to better suit their perspectives, requirements and personality traits. We detail this approach in Explainable and Personalized Privacy Prediction in Section 5.
encapsulate various deep learning tasks such as scene recognition, object detection, facial detection and nudity detection into a comprehensive system that is transparent yet efective in its functioning.
In this section, we present the architectural composition of the PrivMNN. We discuss diferent modules and their workings in detail, and how their outputs are put together and fed to the decision network for personalized privacy predictions.
generates high quality face embeddings. In this work, we use FaceNet to generate embeddings of faces present in a given image.
prediction that leverages the abundance of deep learning machinery. We logically combine diferent machine learning tools and devise a framework to deliver an explainable and personalized privacy prediction system. 5.1.1. Modules
The system design of our approach is largely inspired Each of the modules in the PrivMNN handles a subtask by the human decision-making process and we employ that addresses fundamental questions which will result in PrivMNN (5.1) that draws parallels to the questions hu- the generation of relevant information vital for assessing mans would contemplate for inspecting the privacy con- the privacy of an image. tent of an image (please refer section 3.2). To accommo- Object Detection Module: This module addresses the date the users’ difering privacy definitions and prefer- question "what objects are present in the picture?". This ences, we rely on supplementary techniques in addition information is valuable for inspecting the existence of to PrivMNN which will be discussed in subsections 5.3 sensitive content. For example, if a laptop is visible in and 5.4. The role and nature of user interactions are dis- the picture, then it is possible that sensitive information cussed in subsection 5.2. Details of how a consolidated is on display. Pre-trained FasterRCNN model [27] is used ifnal prediction is arrived at by considering the outputs for generating an embedding vector of size 81 indicating of all the components is discussed in subsection 5.4. The the presence of diferent objects. sequential flow of operations is presented in subsection Location Detection: This module addresses the ques5.5. The generation of explanations for the predictions is tions "Is the picture taken indoors or outdoors?" and discussed in subsection 5.6. "What is the location?". Recognising the scene where the picture was taken is essential, since pictures taken in private space such as bedrooms tend to be more private than pictures taken in public space. Pre-trained previously reported state-of-the-art performance [21]. Places365-ResNet [28] model is employed for generat- However, this score only reflects how well the model ing an embedding vector of size 367 which correspond learns the generic privacy trends in the dataset provided to 365 diferent locations two additional dimensions for by the annotators. A user whose privacy preferences indicating if the picture is taken indoors or outdoors. deviate significantly from these generic trends might not
Object Localization: This module tackles the ques- find the predictions generated by the model to be useful. tion "How many people are present in the image?". If Therefore, our goal is to incorporate the users’ privacy people are present in the image, it indicates that the pic- preferences by utilizing their feedback inputs. ture contains Personally Identifiable Information (PII). For the feedback interface to be efective, the actions reIt is imperative to handle PII data with additional care. quired from the user should be intuitive and user-friendly. MTCNN is also used for detecting license plates in later Keeping this in mind, the user would be required to perpart of the study (see section 7.4). Pre-trained MTCNN form two simple tasks: model [32] is used for generating an embedding vector 1. Identifying misclassified instances: The users of size 6 to indicate the number of people present in the would have the option to indicate if a prediction is conpicture ranging from 0 to 4 persons and above 4 as many tradicting their own judgement by identifying the correpeople. sponding image and providing its intended label.
Explicit Content Detection: This module answers 2. Identifying faces of personal acquaintances: the question "Is there any explicit content in the image?". The user would have the option to identify the presence The presence of explicit content usually indicates that of either theirs or their personal acquaintance’s face in an the picture may not be safe for public viewing. We use image, and the required privacy condition. This actions pre-trained NudeNet model [31] to generate a vector of needs to be performed only once for each face. size 2 to indicate if an image is Suitable-for-Work (SFW) or Not-Suitable-for-Work (NSFW).
5.1.2. Decision Network Besides PrivMNN, we utilize two additional deep learning models to achieve our goal of personalization. These The decision network is responsible for consolidating the models are used for generating feature embeddings for information from all the modules and making the final the feedback inputs given by the user. prediction. It takes the concatenated embedding vector of ResNet: Feature vectors of seemingly misclassified size 456 which is obtained by combining output vectors public and private images are extracted using preof all modules as input and performs binary classification trained ResNet model and stored separately in respective i.e. public or private class. databases for future references. Once entry has been
The decision network in the proposed PrivMNN con- stored, future image instances are checked for similarity sists of four fully connected layers with Leaky ReLU with these user-rectified instances to prevent mistakes activation function and is trained with Adam optimizer. of the same nature in the future. In Figure 4, the ’Feature Weighted Binary Cross-Entropy (BCE) is used to address Generator’ represents ResNet and the discussed correthe class imbalance problem. sponding steps are highlighted in orange. FaceNet: FaceNet is used for generating the feature 5.2. Feedback Interface embeddings of user-identified faces which are then stored in a face embeddings database. MTCNN [29] is used in conjunction with FaceNet [33], where MTCNN is used for detecting and localizing the facial region in an image.
In Figure 4, the ’Face Extractor + Detector’ represents the MTCNN and FaceNet pair and the discussed corresponding steps are highlighted in blue.
vided any feedback yet, the decision operation simply passes the prediction from the PrivMNN as the final decision. Once the user starts providing feedback, the decision operation is updated accordingly to reflect the user’s privacy requirements.
In this work, we make use of the traditional yet efec- 5.6. Explanation Generation tive rule-based systems [34]. Initially, the rule-base prior to the creation of any user-specified rules or learning Intuitive and human-readable explanations that require them from the user inputs is kept basic i.e., any query no technical expertise from the user are the most suitresults from the databases (public, private or face em- able ones for end-user applications, such as this one. beddings) is given higher priority than the PrivMNN’s Heatmaps and other form of explanations could be prove predictions since these results would be based on user to be confusing for the technically uninitiated. To this interactions. In cases of ambiguity or conflicting labels, efect, we generate textual explanations which provide the private class is preferred as it is the safer side to err descriptive explanations of the predictions that are easy on. to understand.
The user should not be required to provide hundreds With abundance of information being generated by the of corrective feedback inputs before the system starts various components of the system, it simply becomes a to show some improvement, which would be the case matter of conveying the information coherently. We emif we attempt to retrain the decision neural network to ploy regular expressions, a simple yet efective method, reflect these changes. Instead, a list of rules can easily for presenting our explanations. The default explanabe created from very few user feedback inputs or they tions generated by the system are quite straight-forward can even be explicitly created by the user by mentioning and as the system evolves the explanations also change their requirements. These rules can be put into efect at according to the scenario (see Figures 8 and 10). the very instant and the improvement in results can be observed in all predictions henceforth. 6. Datasets
As the user continues to interact with the system, more complex rules can emerge. For instance, if the user marks 6.1. PicAlert! Dataset their own pictures as public when outdoors in a public location like a sporting venue, but marks the pictures as We conduct our experiments on a subset of the PicAlert! private when located in personal space like a bedroom, dataset [10] used in previous studies [21, 20], which origa rule can be created to reflect this preference. On the inally had 32,000 images from which 27,000 were used contrary, users could also choose to be notified prior for training and remaining 5,000 for testing. However, to sharing any images of themselves by strictly mark- few of the images are now inaccessible from the Flickr ing all of the images containing their faces as private. website, hence the updated dataset used in this study conThis design makes the system highly customizable, as sists of 30,136 images out of which 25,136 were used for any number of rules can be added or removed when not training and remaining 5,000 were reserved for testing. required. We maintain the ratio of Public and Private images to be 3:1 in each split, similar to the splits used in previous studies. The images in this dataset are labeled manually 5.5. Flow of Operations by multiple reviewers and at the least by two reviewers In previous sections we describe every module in detail. [10, 18]. In the occurrence of conflicting labels, the image Now we illustrate the flow of data through the system is shown to an additional reviewer in order to reach a for privacy prediction. As demonstrated in Figure 4, the consensus on the final label [10, 18]. input is simultaneously processed by the PrivMNN, the ResNet model and the face detector. Subsequently, the 6.2. Labeled Faces in the Wild (LFW) query results and PrivMNN’s prediction are fed to the Dataset decision operator which generates the final decision. If the user finds the result acceptable, no further actions The Labeled Faces in the Wild (LFW) [35] dataset is a are required. However, if the user finds the result is not widely used benchmark dataset for face verification conappropriate according to their perspective, they could sisting of 13233 images of 5749 individuals. This dataset provide a feedback to the system. This feedback is used is used only for testing purposes in experiments where for creating customized rules in the decision ops module, multiple images of the same person were required (see and for updating the relevant databases. All misclassified section 7.3). instances are also stored in a separate database, and if the number of these instances is significant enough, the PrivMNN could be fine-tuned from these. However, it 7. Experiments and Results is unlikely that a single user would provide such a high number of misclassified instances as it is expected that For the purpose of illustrating the proposed system’s the system would handle most of the user’s concerns configurability and its improvement in performance with after receiving a few feedback inputs from the user. user feedback, we demonstrate the system’s behavior and prediction results in four diferent system configurations. The proposed method outperforms the previously reported SOTA accuracy of 87.58% [21] in generic feedback configuration [7.2] (See Table 1).
Method
Accuracy ResNet PCNH UT DT UT+DT Default Config Feedback Config
tion, in which the system has not taken any feedback inputs from the user yet. The final decisions are solely based on PrivMNN predictions.
Rec The purpose of this configuration is to demonstrate the 94.3 baseline behavior of the privacy prediction system. Even 92.1 in its basic configuration, the proposed system performs 9819..74 better than most methods proposed in the literature and 91.3 it is almost on par with the SOTA model (see Table 1). 90.5 However, our main objective here is not the performance 92.2 alone, rather it is the incorporation of explainability and personalization to the system. In this particular baseline configuration, we focus on explainability alone and we do not utilize user inputs yet.
By examining the explanations provided for the corresponding images in Figure 2, it is evident that the explanations reveal useful insights about the model’s behavior. As expected, the model almost always predicts the image to be private when humans are present in the image, unless they are situated in a public venue (Figure 2(f) and (h)). However, an interesting trend can be noticed by comparing 2 (b) and 2 (f), the picture which was determined to be NSFW was labeled private even though remaining conditions remained mostly similar (indoors, one person and a public venue) with the one that was classified as public because it was SFW. Comparing 2(d) and 2(h) reveals the importance of location (personal space, public venue).Pictures (2 (e) and 2 (g)) which had no people present in them and were clicked outdoors were classified as public.
Configuration Settings: In this configuration, the user change if the user or an acquaintance of the user is provides feedback inputs only on misclassified instances present in the image. Naturally, users are more con(see section 5.2). The performance of the system is up- cerned for the privacy of the images in which they or dated with every feedback input received from the user. their friends or family members are present, however, After 21 feedback inputs, the proposed system surpasses the existing methods do not this into consideration while previously reported state-of-the-art accuracy [21]. It arriving at a prediction. We believe that this information should be noted that the increment or reduction of per- is a very strong indicator of privacy and therefore cannot formance is dependant on the user’s feedback. be overlooked and must be incorporated to the prediction
The purpose of this configuration is to demonstrate process. In Figure 9, we show that identifying a single how the system incorporates user’s preferences based on face image of a person is suficient to treat all images corrective feedback provided by the user on misclassified of that person with higher importance with respect to instances. In Figure 6 and 7, the images in the first row privacy. By default, all images of identified persons are correspond to the misclassified instances identified by treated as private but more complex rules can be created the user. Subsequent images shown below them in their based on the user’s specifications. respective columns are images which were incorrectly classified previously but are correctly classified now as a result of the corrective feedback. In Figure 6 (a), we notice that a family portrait was erroneously classified as public and when the user corrects this mistake by marking it as private, other visually similar portraits are identified as private by the updated system. A picture of a computer screen marked as private in 6 (b) resulted in multiple other images of computer screens to be classi- Figure 9: Elevated privacy conditions for user’s pictures. ifed as private as well. In 6 (c), a picture of a meal was marked as private which prompted the system to classify other pictures of food as private. Although these images of food have been labeled as private in the flickr dataset 7.4. Customizability Demo by the reviewers, it should be noted that the user might Configuration have a diferent view, and the proposed framework allows the users to personalise the system by incorporating their perspectives. Similarly, we observe in Figure 7 that images of dolls or album covers were initially identified as private but after receiving corrective feedback from the user, they were correctly identified as public. As the reasoning behind the predictions made based on the user feedback is diferent in nature, it makes more sense to use prototypical explanations [36] instead of the textual explanations. Therefore, we provide explanations for these types of decisions as shown in Figure 8.
a new module to the PrivMNN to detect license plates.
We illustrate the customizability of the proposed framework by updating the privacy prediction system with a new module in this configuration. License plates are known to be indirect PII and studies have been conducted which discuss the privacy implications of vehicle images with visible license plates [37, 38, 39]. To address this specific concern, we include a dedicated module for detecting license plates. As can be observed from Figures 2 (g) and 10, an image of cars where license plates are visible was classified as public earlier but predicted to be private after the addition of license plate recognition module. It is worthy to note that the training label for this particular image is public in the dataset as they have not considered this issue. Similarly, depending on the user’s requirements and by leveraging domain knowl
provides feedback by only identifying faces of personal acquaintances (see section 5.2).
edge, many tailored specifications can be baked into the prediction process. The proposed privacy prediction system simultaneously incorporates several desirable features such as personalization, explainability, configurability, customizability and responsiveness to user’s changing privacy requirements. Our approach generates explanations in a detailed manner to: (i) provide meaningful feedback, and (ii) make the user aware of the sensitive content present in the image.
The flexibility of the proposed privacy prediction system enables it to be extended in several ways, like adding new modules or using a more sophisticated decision operations. In the future, we also plan to support predictions for images which are considered to be undecidable in terms of privacy, by adding an additional class to the existing two classes. The modular nature of the framework allows us to do privacy prediction for other data modalities such as speech, videos and text as well.
In summary, we have proposed a privacy prediction system that addresses several drawbacks of the existing methods and outperforms them. We also demonstrate its workings through multiple configurations and examples. ings of the 35th international ACM SIGIR confer- tering, in: Proceedings of the IEEE conference on ence on Research and development in information computer vision and pattern recognition, 2015, pp. retrieval, 2012, pp. 35–44. 815–823. [19] A. Squicciarini, C. Caragea, R. Balakavi, Toward [34] F. Hayes-Roth, Rule-based systems, Communicaautomated online photo privacy, ACM Transactions tions of the ACM 28 (1985) 921–932. on the Web (TWEB) 11 (2017) 1–29. [35] G. B. Huang, M. Ramesh, T. Berg, E. Learned-Miller, [20] A. Tonge, C. Caragea, Dynamic deep multi-modal Labeled Faces in the Wild: A Database for Studyfusion for image privacy prediction, in: The World ing Face Recognition in Unconstrained EnvironWide Web Conference, 2019, pp. 1829–1840. ments, Technical Report 07-49, University of Mas[21] A. Tonge, C. Caragea, Image privacy prediction sachusetts, Amherst, 2007.
using deep neural networks, ACM Transactions on [36] C. Chen, O. Li, C. Tao, A. J. Barnett, J. Su, C. Rudin, the Web (TWEB) 14 (2020) 1–32. This looks like that: deep learning for interpretable [22] M. T. Ribeiro, S. Singh, C. Guestrin, " why should i image recognition, arXiv preprint arXiv:1806.10574 trust you?" explaining the predictions of any clas- (2018). sifier, in: Proceedings of the 22nd ACM SIGKDD [37] L. Du, H. Ling, Preservative license plate deinternational conference on knowledge discovery identification for privacy protection, in: 2011 Inand data mining, 2016, pp. 1135–1144. ternational Conference on Document Analysis and [23] S. M. Lundberg, S.-I. Lee, A unified approach to Recognition, IEEE, 2011, pp. 468–472. interpreting model predictions, in: Proceedings of [38] J. Gao, L. Sun, M. Cai, Quantifying privacy vulnerthe 31st international conference on neural infor- ability of individual mobility traces: a case study mation processing systems, 2017, pp. 4768–4777. of license plate recognition data, Transportation [24] R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, research part C: emerging technologies 104 (2019) D. Parikh, D. Batra, Grad-cam: Visual explanations 78–94. from deep networks via gradient-based localization, [39] J.-P. Hubaux, S. Capkun, J. Luo, The security and in: Proceedings of the IEEE international confer- privacy of smart vehicles, IEEE Security & Privacy ence on computer vision, 2017, pp. 618–626. 2 (2004) 49–55. [25] B. L. Happel, J. M. Murre, Design and evolution of modular neural network architectures, Neural networks 7 (1994) 985–1004. [26] F. Azam, Biologically inspired modular neural networks, Virginia Polytechnic Institute and State University, 2000. [27] S. Ren, K. He, R. Girshick, J. Sun, Faster r-cnn:
Towards real-time object detection with region proposal networks, Advances in neural information processing systems 28 (2015) 91–99. [28] B. Zhou, A. Lapedriza, A. Khosla, A. Oliva, A. Torralba, Places: A 10 million image database for scene recognition, IEEE Transactions on Pattern Analysis and Machine Intelligence (2017). [29] K. Zhang, Z. Zhang, Z. Li, Y. Qiao, Joint face detection and alignment using multitask cascaded convolutional networks, IEEE Signal Processing Letters 23 (2016) 1499–1503. [30] W. Wang, J. Yang, M. Chen, P. Wang, A light cnn for end-to-end car license plates detection and recognition, IEEE Access 7 (2019) 173875–173883. [31] notAI.tech, Nudenet, https://github.com/
notAI-tech/NudeNet, 2019. [32] K. He, X. Zhang, S. Ren, J. Sun, Deep residual learning for image recognition, in: Proceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 770–778. [33] F. Schrof, D. Kalenichenko, J. Philbin, Facenet: A unified embedding for face recognition and clus