{"id":"f318aa85-14a3-411b-8f6c-95944b5106ca","arxiv_id":"2411.16440","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"AnonyNoise adds trainable, data-dependent noise to event camera streams, cutting neural-network re-identification accuracy by up to 60% while keeping most downstream task accuracy.","lead":"This paper introduces AnonyNoise, a method that adds learned, data-dependent noise to event-camera data to make it harder for AI systems to identify individuals while still allowing tasks like gesture or emotion recognition. It addresses the growing privacy risk from surveillance cameras that record event streams, which can be re-identified by neural networks.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Residual re-id accuracy of 40% (DVS-Gesture) and 25% (SEE) is far above chance, contradicting the paper's central claim of 'preventing' re-identification.","rationale":"The reader's weakest_assumption focuses on the use of a single attacker architecture and representation, arguing that a different re-identification network might still recover identity information. I agree that this is a generalization risk, but I find a more direct and load-bearing concern: the paper's own reported numbers already show re-identification accuracy far above chance using the same ResNet50 architecture and event histogram representation that were used during adversarial training. For DVS-Gesture, accuracy drops from 98.33% to 40.00%; for SEE, from 72.5% to 25.0%. These residuals are not close to chance, so the claim that AnonyNoise 'prevents' re-identification fails on the paper's own evaluation. The 'reduces by up to 60%' claim is accurate, but the 'prevents' language in the abstract, introduction, and conclusion is an overclaim. This is an internal inconsistency rather than a disagreement with external consensus. The reader's verdict of CONDITIONAL is appropriate because the paper's contribution is still valuable as a mitigation method, and the claims could be revised to accurately describe reduction rather than prevention. Adding chance-level baselines and statistical significance tests would also strengthen the evaluation. My concern does not change the verdict, hence UNCHANGED, but it sharpens the reason: the central claim is not supported by the paper's own data.","tokens_in":12629,"tokens_out":5528,"duration_ms":58130,"concrete_test":"Compute the chance-level accuracy for the DVS-Gesture re-identification protocol (e.g., random retrieval among the gallery identities) and test whether the reported 40.0% post-anonymization accuracy in Table 1 is statistically significantly above chance using a one-sided binomial test on the number of query samples. If the 40.0% is significantly above chance, the abstract's statement that AnonyNoise 'prevents re-identification' is contradicted by the paper's own data.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim—stated in the abstract, introduction, and conclusion—is that AnonyNoise 'prevents' re-identification by neural networks. The paper's own results contradict this. In Table 1, after anonymization, re-identification accuracy is 40.00% on DVS-Gesture and 25.0% on SEE, both far above chance (with ~29 subjects in DVS-Gesture and 20 validation subjects in SEE, chance is roughly 3–5%). The Event-ReId generalization experiment (Table 2) also shows top-1 accuracy of 38.64% after anonymization, compared to 59.09% without privacy, so substantial identity information remains. The abstract's more measured claim of 'reducing attackers' re-identification capabilities by up to 60%' is supported, but the stronger 'prevent' claim is not. Because the method was trained adversarially against a ResNet50 re-identification network and the post-training attack uses the same architecture and event histogram representation, the residual accuracy already demonstrates that a network of the exact type used in training can still re-identify individuals. This is not a speculation about stronger attackers; it is an internal inconsistency with the paper's headline claim. The contribution of a privacy-utility tradeoff is real, but the current framing overstates the privacy guarantee by calling it prevention.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes AnonyNoise, a learned noise-prediction network that anonymizes event-camera histograms by adding data-dependent noise, with the stated goal of preventing re-identification by neural networks while preserving downstream-task accuracy. The pipeline trains an anonymization network adversarially against a ResNet50 re-identification network and a target network, then simulates a post-training attack by retraining the re-identification network on the frozen anonymized data. Experiments on DVS-Gesture, SEE, and Event-ReId report reductions in re-identification accuracy (up to about 60% on DVS-Gesture) with moderate target-task degradation, plus robustness to inversion and image-reconstruction attacks. The method is presented as the first event-data anonymization pipeline specifically targeting neural-network re-identification.","tokens_in":12907,"tokens_out":4263,"duration_ms":42250,"significance":"If the claims were fully supported, this would be a useful contribution: it addresses a timely privacy problem for event cameras, introduces an adversarial min-max training scheme with a post-training attack evaluation, and releases code. The paper is also honest about several limitations (e.g., histogram-only input). However, the central headline claim—that AnonyNoise \"prevents\" re-identification by neural networks—is contradicted by the paper's own numbers: post-anonymization re-identification accuracy remains far above chance on the same architecture used in training. The real contribution is a privacy-utility tradeoff method that reduces, rather than prevents, re-identification. Because the paper frames the contribution as prevention and claims robustness against arbitrary re-identification networks, the current evidence base is not sufficient to support the stated claims.","major_comments":[{"comment":"The paper's central claim that AnonyNoise \"prevents re-identification ... by neural networks\" is not supported by the reported results. In Table 1, the post-anonymization re-identification accuracy is 40.00% on DVS-Gesture and 25.0% on SEE. Even under the most favorable reading of the evaluation protocol, chance-level performance would be at most about 16.7% for DVS-Gesture (with 6 test subjects) and 5% for SEE (with 20 validation subjects); the reported numbers are therefore well above chance. This is not a speculation about stronger attackers: the same ResNet50 architecture used in adversarial training is the one that still re-identifies individuals after anonymization. The abstract's more measured phrasing, \"reducing attackers' re-identification capabilities by up to 60%,\" is supported, but the stronger \"prevent\" claim appears throughout the abstract, introduction, and conclusion and should be revised or substantiated with near-chance residual accuracy.","section":"Abstract, Sec. 7, Table 1"},{"comment":"The claim that the adversarial training \"ensures the robustness of our anonymization against exploitation from any re-identification network\" is unjustified. The anonymization loss in Eq. (4) only penalizes the triplet term, not the classifier cross-entropy term of the attacker's loss in Eq. (2). More importantly, the post-training attack in Sec. 4.4 retrains the same ResNet50 backbone on the same event-histogram representation used during adversarial training. The residual re-identification accuracy of 40.00% on DVS-Gesture and 38.64% top-1 on Event-ReId (Table 2) demonstrates that even this same-architecture attacker retains substantial identity information. To support the robustness claim, the authors would need to evaluate attackers with different backbones, different event representations, or otherwise argue why the trained architecture is a worst-case proxy. Without this, the \"any re-identification network\" claim is unsupported.","section":"Sec. 4.3, Eq. (4); Sec. 4.4; Contributions bullet"},{"comment":"All quantitative results are reported as single runs with no error bars, confidence intervals, or multiple training seeds. This is particularly problematic for the privacy claims, because the re-identification validation sets are small: DVS-Gesture has only 6 test subjects, and SEE has 20 validation subjects with two query samples per subject. An accuracy value such as 25.0% on SEE corresponds to roughly 10 correct queries out of 40, and the difference between 25% and chance-level 5% may be sensitive to the random query/gallery split. Without repeated trials or a statistical significance measure, the paper cannot support precise statements such as \"reducing accid by nearly 60%\" or the comparison of ablation variants in Table 3.","section":"Tables 1–3; Sec. 5.1–5.4"},{"comment":"The construction of the DVS-Gesture re-identification evaluation is under-specified, and this materially affects the interpretation of \"prevention.\" The paper states that DVS-Gesture has 6 test and 23 training subjects, and that a query set is built by choosing a random sample per subject and per target label, but it does not state whether the gallery/query sets are restricted to the test subjects or include training subjects. The baseline raw re-identification accuracy of 98.33% in Table 1 suggests the protocol may not be a standard closed-set test with only 6 identities. The authors should clarify the exact gallery and query construction, the number of query samples, and the resulting chance-level accuracy, since the residual risk claim depends directly on this protocol.","section":"Sec. 5.1, re-identification evaluation protocol"}],"minor_comments":[{"comment":"The sentence \"latest research showed that neural networks are able to reconstruct high-quality grayscale images ... This proofs the remainder of structural and personal information\" contains a typo: \"proofs\" should be \"proves.\"","section":"Introduction, Sec. 1"},{"comment":"The phrase \"This poses a potential thread against the privacy of the individual\" should read \"threat\" instead of \"thread.\"","section":"Sec. 3.1"},{"comment":"The heading \"Post-Training Attack\" contains a typo: \"re-identifaction\" should be \"re-identification.\"","section":"Sec. 4.4"},{"comment":"The notation for the event histogram is introduced as shape (2*T, H, W) with T=5, but the text later refers to \"T = 5timesteps\" and the equations do not explicitly use T. Please make the temporal-bin definition consistent and explicit in the equations.","section":"Sec. 4.1"},{"comment":"The caption states \"The arrow is pointing from the result without to the result with a denoise network used,\" which is hard to parse. Please rephrase to clarify which points are compared.","section":"Fig. 1"},{"comment":"The sentence \"As an optimizer we use AdamW [15]\" is followed by a period but the preceding text in the same paragraph is not a complete sentence; please merge these into a grammatically correct paragraph.","section":"Sec. 5.2"}],"recommendation":"major_revision","confidential_remarks":"This is a solid engineering contribution with a clearly described method, a released codebase, and an evaluation that shows a genuine privacy-utility tradeoff. The main problem is overclaiming: the paper says \"prevent\" when its own data show re-identification accuracy far above chance. That overclaim is fixable by reframing the contribution as \"reducing re-identification risk\" and by adding confidence intervals and a stronger attack evaluation. The paper's scope is well within WACV, and the work is not fatally flawed; it just needs to align its claims with its evidence."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague, here's my read on AnonyNoise. The core method is genuinely new in the event-camera privacy space: a learned per-pixel noise generator trained adversarially against a re-ID network, with a post-training retraining attack to simulate an adaptive adversary. They release code, and the experiments on DVS-Gesture, SEE, and Event-ReId show real reductions in re-identification accuracy—roughly 60% on DVS-Gesture and 50% on SEE—while maintaining decent target-task accuracy. That is a legitimate engineering contribution and a good baseline for future work.\n\nThe soft spot is the framing. The abstract, intro, and conclusion claim the method 'prevents' re-identification. Their own Table 1 shows 40% re-ID accuracy on DVS-Gesture and 25% on SEE after anonymization. With 29 and 20 subjects, chance is around 3–5%, so a quarter to two-fifths of identities are still recoverable. That is not prevention. The paper also acknowledges this implicitly in the results section, where it says the method 'effectively prevents' while reporting those numbers, but the conclusion doubles down. This is a load-bearing overclaim: the privacy guarantee is a reduction, not a guarantee. The data supports 'reduces re-identification by up to 60%,' not 'prevents re-identification.'\n\nTwo smaller issues: no error bars or multiple seeds, so we don't know if the 40% vs 35% differences are meaningful. And the attack/defense use the same ResNet50 backbone and the same event histogram representation, so the evaluation is partly self-referential. The post-training retraining is a reasonable adaptive attack, but one architecture is thin for a claim of robustness against 'any re-identification network,' as the contribution list says. The Event-ReId generalization is a good addition, though again only against that same backbone.\n\nThe ethical discussion in Sec. 2 is brief but not intrusive; it doesn't carry the technical weight. The ablation is useful and shows the noise input matters. Overall, the paper is worth serious referee time. The method is novel enough and the experiments, though missing uncertainty quantification, are reproducible. My recommendation: send it to peer review, but push the authors to revise the language from 'prevent' to 'reduce,' add variance estimates, and ideally test against a different backbone (e.g., a transformer or a different event representation). If those changes are made, this becomes a solid contribution. As is, I'd be skeptical of the headline but not of the underlying work.","headline":"Real engineering contribution undone by an overclaimed privacy guarantee; worth reviewing with a mandatory language and robustness revision.","tokens_in":13407,"tokens_out":2055,"would_cite":true,"duration_ms":18396,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"AnonyNoise is a trainable noise-injection pipeline that anonymizes event-camera data against neural-network re-identification while keeping downstream tasks like gesture and emotion recognition usable.","keywords":["event cameras","privacy preservation","re-identification","anonymization","adversarial training","event histograms","noise injection","gesture recognition"],"falsifier":"Train a re-identification model with a substantially different architecture (for example, a transformer or a graph neural network operating directly on raw event streams) on the anonymized outputs of AnonyNoise, or scale up the denoising/inversion network; if re-identification accuracy on the anonymized data rises back to near the raw-data level, the central privacy claim is refuted.","tokens_in":12442,"feed_emoji":"🕶️","tokens_out":7996,"duration_ms":68736,"temperature":0.7,"pith_summary":"This paper tries to establish that event-camera data, once assumed private because it is hard for humans to read, can still leak identity through neural networks, and that a learned noise injection can close that leak without destroying the data's usefulness. AnonyNoise adds data-dependent noise to event histograms, trained adversarially against a continuously adapting re-identification network. On two real event datasets the paper measures re-identification accuracy falling by roughly 60% and 50% relative to raw data, while target-task accuracy drops by about 12% and 22%. The anonymizer also transfers to an unseen dataset and resists denoising/inversion and grayscale-reconstruction attacks. A sympathetic reader would take this as evidence that practical, task-preserving event anonymization is possible, and that machine re-identification should be treated as a first-class privacy threat.","feed_headline":"Event-camera privacy: learnable noise cuts re-identification by 60%","feed_subtitle":"Anonymization network keeps gesture and emotion recognition usable while blocking neural-network re-identification.","key_machinery":"The load-bearing object is the anonymization network $f_{\\text{Anon}}$, a lightweight fully convolutional network with no skip connections that outputs per-pixel noise parameters. Its input is the event histogram $X_e$ concatenated with random noise $n \\sim \\mathcal{N}(0,1)$; its output is the anonymized histogram $X'_e = X_e + X_\\mu + X_{\\sigma^2} \\cdot n$, a reparameterization that keeps the operation differentiable. Two auxiliary networks pull in opposite directions during training: a target network $f_T$ encourages preserving task-relevant structure, while a re-identification network $f_{\\text{ReId}}$, adversarially updated, tries to recover identity; the anonymizer's loss is $L_{\\text{Anon}} = L_T - \\mathcal{T}(\\hat{X}_{\\text{id}})$, i.e., target cross-entropy minus the triplet loss on identity features. Post-training, $f_{\\text{Anon}}$ is frozen and a simulated attacker retrains $f_{\\text{ReId}}$ on the anonymized data, which is the evaluation that grounds the privacy claim.","core_discovery":"On the paper's own terms, the central discovery is that a per-pixel, data-dependent noise generator can strip identity information from event streams while preserving the information a downstream task needs. The anonymized events are produced by $X'_e = X_e + X_\\mu + X_{\\sigma^2} \\cdot n$, where the network predicts the noise statistics from the input histogram and the random draw. A min-max adversarial loop keeps the re-identification network adapting, so the anonymizer cannot settle for fooling one fixed attacker. In the post-training attack simulation, AnonyNoise lowers re-identification accuracy on DVS-Gesture from 98.33% to 40.00% and on SEE from 72.5% to 25.0%, while holding target accuracy at 80.68% and 55.71%; on unseen Event-ReId data, top-1 re-identification drops from 59.09% to 38.64% without fine-tuning. The paper further claims robustness to a learned denoising/inversion attack and to grayscale image reconstruction.","pith_inferences":["Inference: the reparameterized noise mechanism is generic and could be carried over to other sensor streams such as radar or LiDAR, where deep networks are beginning to enable re-identification.","Inference: since the anonymizer is trained in tandem with a specific target task, its privacy/utility balance may not transfer to a different downstream task; a task-agnostic or multi-task variant would be a natural next step.","Inference: the paper reports empirical robustness but no formal privacy guarantee; quantifying residual identity leakage with an information-theoretic or differential-privacy bound would turn the claimed protection into a provable one.","Inference: the attacker in the main experiments shares the same representation (event histograms) and a similar backbone as the target network; a harder attacker using raw sparse events or a very different architecture would be a sterner test of the re-identification claim."],"forward_implications":["If the central claim holds, event-based surveillance and always-on cameras can be deployed with a privacy layer that blocks automatic person tracking without sacrificing the sensing task the camera was installed for.","The same pipeline can be retargeted to any downstream task that should not depend on identity, such as emotion detection, activity recognition, or gaze estimation, by swapping the target network.","The generalization result on Event-ReId suggests that an anonymizer trained on one event domain can be transferred to new camera setups, resolutions, and body poses without retraining.","The robustness to inversion and reconstruction attacks means that adding a learned denoiser before classification does not restore the attacker's ability to identify individuals from AnonyNoise output.","Because the anonymization noise is data-dependent, fixed denoising filters cannot undo it, which is the qualitative advantage over simple Gaussian noise reported by the paper."],"supporting_citations":[{"why":"Supplies the prior event-anonymization baseline and the Event-ReId dataset used for generalization tests.","marker":"[1]"},{"why":"Provides the DVS-Gesture dataset used for the main re-identification and target-task evaluation.","marker":"[4]"},{"why":"Supplies the residual backbone architecture used for the re-identification and target networks.","marker":"[12]"},{"why":"Provides the E2VID network used to test grayscale image-reconstruction attacks on anonymized events.","marker":"[18]"},{"why":"Supplies the adversarial training paradigm for RGB privacy preservation that AnonyNoise extends to event data.","marker":"[27]"},{"why":"Provides the SEE single-eye emotion dataset used for the second re-identification and target-task evaluation.","marker":"[29]"}],"fun_headline_variants":["Learnable noise cuts event-camera re-ID by 60%","AnonyNoise: adversarial noise hides identities, keeps tasks","Event data anonymized: re-ID drops 60%, utility stays","Noise that fools re-ID: 60% less identification, robust","Anonymizing event streams: 60% less re-ID, unseen proof"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The privacy claim rests on the assumption that the re-identification attacks tested (a single residual-network architecture and a single event-histogram representation) are representative of all realistic attackers; if a different architecture or a raw sparse-event representation lets an attacker recover identity from AnonyNoise output, the core privacy guarantee fails.","fun_headline_variants_meta":{"raw":{"variants":["Learnable noise cuts event-camera re-ID by 60%","AnonyNoise: adversarial noise hides identities, keeps tasks","Event data anonymized: re-ID drops 60%, utility stays","Noise that fools re-ID: 60% less identification, robust","Anonymizing event streams: 60% less re-ID, unseen proof"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00092,"raw_usage":{"total_tokens":3946,"prompt_tokens":946,"completion_tokens":3000,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":562,"completion_tokens_details":{"reasoning_tokens":2907}},"tokens_in":562,"tokens_out":3000,"duration_ms":21838,"temperature":1.0,"reasoning_tokens":2907,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T13:05:40.858976+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a re-identification model with a substantially different architecture (for example, a transformer or a graph neural network operating directly on raw event streams) on the anonymized outputs of AnonyNoise, or scale up the denoising/inversion network; if re-identification accuracy on the anonymized data rises back to near the raw-data level, the central privacy claim is refuted.","supporting_citations":[{"cited_title":"Person re-identification without identification via event anonymiza- tion","cited_arxiv_id":null,"evidence_quote":"Supplies the prior event-anonymization baseline and the Event-ReId dataset used for generalization tests."},{"cited_title":"A low power, fully event-based gesture recognition system","cited_arxiv_id":null,"evidence_quote":"Provides the DVS-Gesture dataset used for the main re-identification and target-task evaluation."},{"cited_title":"High speed and high dynamic range video with an event camera","cited_arxiv_id":null,"evidence_quote":"Provides the E2VID network used to test grayscale image-reconstruction attacks on anonymized events."},{"cited_title":"Privacy-preserving deep action recogni- tion: An adversarial learning framework and a new dataset","cited_arxiv_id":null,"evidence_quote":"Supplies the adversarial training paradigm for RGB privacy preservation that AnonyNoise extends to event data."},{"cited_title":"In the blink of an eye: Event-based emotion recognition","cited_arxiv_id":null,"evidence_quote":"Provides the SEE single-eye emotion dataset used for the second re-identification and target-task evaluation."}],"review_version":1}