Modern machine learning algorithms are able to extract privacy sensitive information from user-generated multimedia data that is available online, such as geo-location [1,4]. The objective of the Pixel Privacy Task of MediaEval 2019 [5] is to find solutions that could protect privacy-sensitive information in images against scene classifier, and at the same time keep or increase the visual appeal of these adversarial images. The provided test-dataset is a subset of the Places365-Standard dataset [11]. This paper proposes a method to create adversarial examples by perturbing the pixels in the image based on color variation, which is better aligned with human perception.
Neural network-based algorithms have weaknesses that make them susceptible to adversarial examples [2]. By perturbing specific pixels in the image, the resulting outcome of the network can be changed without a substantial change to the image. The knowledge of adversarial examples can also be applied to protect privacy sensitive information. PIRE [6] is an iterative method to generate adversarial images, but it does not consider the human noticeability of these perturbed pixels. One solution to this problem is to consider the human perception of these perturbations. [7] suggests that perturbing pixels in low variance regions (i.e. white walls or blue skies) is more noticeable than perturbing pixels in high variance regions (i.e. a brick wall). In [7] this is implemented by calculating the standard deviation around a pixel based on its intensity (greyscale value). However, in this case, the color-specific information is discarded. The CV-PIRE method [9] suggests an approach that takes the human perception of colors into account, using high and low color variance regions. Pixel color variance can be calculated by using CIEDE2000 [8] difference between a specific pixel and the surrounding pixels. The CIEDE2000 algorithm gives a better numerical distance between two colors based on human perception than for example the Euclidean distance. A Gaussian distribution can be used to weight the contribution of the surrounding pixels in order to smooth the color variance between two neighboring pixels. Pixels further away contribute less to the total color difference.
In this section, we describe our perturbation-based protection algorithm in detail. In particular, we discuss the construction of model loss, hyper-parameter selection and training details.
Pixel values of images can be perturbed in a certain way to influence the predicted label by the threat model when generating adversarial examples. Given the ground truth label, we could optimize the perturbations iteratively until the predicted class meets our adversarial condition (i.e. fall out of top 2 or top 5). To minimize the noticeability of the perturbations, we include a threshold that determines the maximum perturbation of one pixel. If we set the same threshold for every pixel in the image we may get very noticeable perturbations in low color variance regions, while the perturbations in high color variance regions are less noticeable. In our method, we follow the threshold method [9] in which CIEDE2000-based color variation is used to generate threshold map (e.g., second figure of top row in Figure 1).
Algorithm 1 demonstrates how the adversarial examples are generated. Here cV is the pixel color variance matrix for the image, f the classification model, in our case a ResNet-50 [3] classifier, m threshold multiplier that determines how big the actual threshold is relative to the color variance, T the maximum iterations, α the weight of the L1-norm loss in the total loss function and condition the adversarial condition which will later be discussed. Using the color variance matrix cV as in [9], we define the per pixel threshold that represents the maximum perturbation per pixel. The initial perturbations are randomly set based on this pixel threshold. We update the perturbations until the condition is met or the maximum amount of iterations is reached. Iteratively calculate the logits of the image with perturbations, the clamping is done such that image stays within the valid image range. If the condition is met based on the logits then we have a successfully adversarial example and we stop the loop. If not, we calculate the loss, this consists of the cross-entropy loss l ce , where the goal is to minimize loss function given the ground truth label, and the L1 norm loss, which minimizes the total amount of perturbations. The perturbations are updated by back-propagation to minimize this loss. Finally, the updated perturbations are clipped to make sure they stay within the pixel value range of image and rounded such that the perturbations would remain when saved in a uint8 image format. If it is not
We submitted five runs for the Pixel Privacy task: Top1 with L1norm (Top1-L1), Top1 with L1-norm and a 50 percent relative difference in prediction confidence compared to the top1 label (Top1-L1-50), Top1 without the L1-norm (Top1-noL1), Top5 with L1-norm (Top5-L1) and Top5 without the L1-norm (Top5-noL1). We noticed two potential flaws in the top1 with L1-norm, first average difference in the confidence between the ground-truth label and the new top1 label is often small and the new top1 label is often similar to the ground-truth label, this can also been seen in Figure 1. To counter these potential weaknesses we included the Top1-L1-50 run to increase the distance in confidence and the Top5-L1 and Top5-noL1 runs, that make sure the ground-truth label is not in the top5. We included the Top2-noL1 and Top5-noL1 runs since these need less computational resources. Table 1 presents the results of the different conditions. As can be observed, all the adversarial images achieved their goal of top-1 or top-5. Following the official evaluation rule, Top5-noL1 achieves the best result. We also include the Structural similarity (SSIM) [10] score, this measures the perceptual difference between the original image and its adversarial counterpart, this could be interperted as how faithfull the adversarial image is to the original.
The perturbations of especially the Top1 are small, as can also been seen in the SSIM score. This could cause the robustness of the adversarial images under image transformations such as compression or filters to be weak. As can been seen in Table 1 there is a clear difference between the aesthetics score and SSIM. SSIM score could represent how noticeable the perturbations are, where in the Top1-L1 the perturbations are least to barely noticeable and the Top5-noL1 have the most noticeable perturbations. However, the aesthetics score is the highest on Top5-noL1, which could mean that the locations where the perturbations take place in our method are creating somewhat of an adversarial example to the aesthetics score method. Further research could look at possible conditions where all the top predictions would be of a different scenes that are not closely related to the ground-truth scene. To increase the usability of this approach in practice, the robustness of protected images should be improved. Data augmentation of original image and ensemble training against different threat models can be considered in the future.