{"id":"e1c90e0a-614a-419f-a461-b70e7775b35e","arxiv_id":"2504.14301","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"The paper shows that adding a pixel-distance penalty with a tunable threshold to a privacy anonymizer preserves action recognition accuracy while keeping privacy leakage roughly stable across settings.","lead":"A computer vision paper proposes a penalty knob that keeps anonymized surveillance video useful for action recognition while still hiding private attributes. The method adds a threshold on how much the anonymizer may alter action frames, and tests several thresholds on standard action and privacy datasets.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Core penalty is defined inconsistently: Eq. 4 is pixel-space RMS, while §3.2 and Algorithm 1 imply a feature-space RMS through fT, leaving the evaluated objective unspecified.","rationale":"The reader's weakest_assumption pointed to the pixel-space proxy risk and to the inconsistent penalty definition in the rationale. I agree those are real, but the sharper issue is that the paper gives two different penalty formulas: Eq. 4 (pixel-space) and Section 3.2/Algorithm 1 (feature-space through f_T). The §3.2 form is not even computable as written because f_T outputs class logits, not image-shaped tensors. This means the central empirical claim cannot be assigned to a well-defined objective. I do not treat this as a consensus disagreement; it is an internal formal inconsistency. I also weighed the 'privacy leakage nearly constant' objection: Table 6 shows cMAP and F1 stable across B on the pretrained-privacy evaluation, and the UCF101 row in Table 1 is stable, so that objection is weaker. The pixel-proxy objection is also softened by the presence of LT in Eq. 3, which directly optimizes action performance; the penalty is an additional regularizer but not the only action-preserving term. The paper's extensive cross-dataset and model-agnostic evaluations are real evidence for a weaker claim, but they cannot identify which penalty produced the numbers. Therefore the reader's CONDITIONAL verdict remains appropriate, with the condition tightened to: state and implement one consistent L_penalty definition and make the code available. If the authors clarify that Eq. 4 was used and the §3.2 sentence is a typo, the proxy concern remains but is testable; if the feature-space version was used, Eq. 4 and all references to it must be corrected.","tokens_in":18381,"tokens_out":10554,"duration_ms":94970,"concrete_test":"Ask the authors for the training code (the 'Find code HERE' link is missing) and inspect the L_penalty computation. If code is unavailable, run the UCF101-VISPR1 configuration twice: (a) L_penalty = max(0, RMS(X - f_A(X)) - B) and (b) L_penalty = max(0, RMS(feature_T(X) - feature_T(f_A(X))) - B) on the I3D feature map before final pooling, with B=0.3, lambda_penalty=1.0, same seeds and epochs. Compare action Top-1 and VISPR1 cMAP. If the two variants differ by more than about 1-2 points, the reported results depend on an unstated definition, and the manuscript must be revised before the central claim is accepted.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is that the penalty in Eq. 3/4 is what preserves action performance while keeping privacy leakage nearly unchanged. The manuscript never fixes the definition of L_penalty. Eq. 4 defines L_penalty(X, f_A(X)) = max(0, ||X - f_A(X)||_RMS - B), a pixel-space distance between input and anonymized output. Section 3.2 instead writes L_penalty = max(0, ||X_action - f_T(f_A(X_action))||_RMS - B), and Algorithm 1 line 16 gives L_P arguments (theta_A, theta_T), matching the §3.2 version. That version is not dimensionally well-posed as written: f_T is the I3D action classifier, whose output is a class-logit vector, not an image-shaped tensor, so an RMS distance against X_action cannot be computed. The two definitions are different objectives; one constrains total pixel change, the other ties the penalty to utility predictions. Every table and the lambda_penalty ablation in Table 3 depend on which one was actually optimized. The paper's 'Find code HERE' is not a URL, so the implemented loss cannot be checked. This is an internal inconsistency in the load-bearing component, not a disagreement with consensus.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes a penalty-driven minimax optimization framework for privacy-preserving action recognition. An anonymizer f_A (UNet++) is trained with a utility loss for action classification (I3D), a self-supervised contrastive privacy loss for the budget branch (ResNet-50/VISPR), and an additional penalty term L_penalty intended to limit over-anonymization of action-relevant features. The penalty is controlled by a threshold B and a weight lambda_penalty. Experiments are conducted on UCF101, HMDB51, PA-HMDB, VISPR1/2, VPUCF, and VPHMDB, with cross-dataset protocols and ablations over B and lambda_penalty. The central claim is that the penalty improves action recognition performance while keeping privacy leakage nearly unchanged across penalty settings.","tokens_in":18683,"tokens_out":5345,"duration_ms":48423,"significance":"If the intended objective can be pinned down, the simple idea of adding a utility-side penalty to a self-supervised anonymizer is attractive, and the empirical scope is broad: the paper evaluates several datasets, multiple target action classifiers, and multiple privacy classifiers. The reported gains over SPACT on UCF101 and PA-HMDB are substantial. The main weaknesses are the internally inconsistent definition of the penalty loss, the lack of uncertainty quantification, and the fact that the 'feature-based penalty' claim in the abstract does not match the pixel-space equation in Eq. (4). These issues are load-bearing because they concern the exact objective being optimized and the reliability of the headline comparisons.","major_comments":[{"comment":"The penalty loss is defined inconsistently across the paper. Eq. (4) defines L_penalty(X, f_A(X)) = max(0, ||X - f_A(X)||_RMS - B), a pixel-space distance between input and anonymized output, whereas Section 3.2 defines it as max(0, ||X_action - f_T(f_A(X_action))||_RMS - B) and Algorithm 1 line 16 calls it L_P(theta_A, theta_T). The latter form is dimensionally ill-posed because f_T is the I3D action classifier, whose output is a label logit vector, not an image-shaped tensor, so an RMS distance against X_action cannot be computed. The objective actually minimized determines every number in Tables 1-3 and the lambda_penalty ablation, so the paper must fix the definition, provide the exact implemented loss, and rerun or confirm all experiments after the correction. This is not a cosmetic issue.","section":"Section 3.2, Eq. (4), Algorithm 1"},{"comment":"The claim of 'nearly consistent privacy leakage across different penalty settings' is not supported by the reported numbers. On PA-HMDB, the F1 score varies from 0.253 at B=0.3 to 0.124 at B=0.7, more than a factor of two, and the cMAP values span 65.02 to 65.88. On VISPR1, F1 spans 0.450 to 0.493. These variations are not negligible, and without confidence intervals it is unclear whether they are noise or real trends. Please report error bars over multiple runs or substantially temper the stability claim and discuss the PA-HMDB outliers.","section":"Table 1, Section 5"},{"comment":"All comparisons appear to be single-run. The central empirical claim is that Ours at B=0.3 outperforms SPACT by 16.10% on UCF101 and by comparable margins elsewhere, but no standard deviations, seeds, or number of repeats are reported. Given the typical run-to-run variance of deep action recognition and privacy-classifier training, the claimed improvements and the 'nearly constant' privacy differences could be within noise. Please report mean and standard deviation over at least three independent runs for the main tables, state whether baseline numbers are rerun under identical conditions or copied from prior papers, and justify the protocol.","section":"Section 4.3, Tables 1 and 2"},{"comment":"The paper describes the method as a 'feature-based penalty scheme' that 'exclusively controls the action features,' but Eq. (4) is a pixel-space RMS constraint. Even if the inconsistency with Section 3.2 is resolved in favor of the pixel-space version, no evidence is provided that pixel RMS distance between X and f_A(X) tracks preservation of action-relevant features. An anonymizer could apply spatial or color transforms that keep pixel RMS under B while destroying action cues, or conversely could remove privacy attributes with large pixel changes while preserving the features the utility branch needs. Please provide a validation analysis, for example an ablation comparing the pixel-RMS penalty against a feature-space penalty, or a correlation study between the penalty value and downstream action accuracy.","section":"Abstract, Eq. (4), Section 3.2.2"}],"minor_comments":[{"comment":"The text 'Find code HERE' contains no URL or repository identifier; a link or DOI is needed for reproducibility.","section":"Abstract and Code Availability"},{"comment":"The sentence 'Lpenalty is the penalty loss used for the anonymizer. is the penalty loss used to penalize the anonymizer...' is broken and duplicated; it should be rewritten.","section":"Section 3, Eq. (3) text"},{"comment":"Line 27 updates theta'_B with the gradient of L_T(theta'_B, theta*_A), but the budget/privacy branch should be trained with the privacy loss L_B; this appears to be a typo.","section":"Algorithm 1, line 27"},{"comment":"The caption says '↓ and ↓' without identifying which curve is the action drop and which is the privacy drop; the axes and curves should be labeled explicitly.","section":"Figure 3"},{"comment":"The statement that 'Equation 4 is applied exclusively to action-related features' is unclear because Eq. (4) takes only X and f_A(X) as arguments; please specify how X_action is separated from X_privacy in a batch and how the RMS is normalized over pixels and channels.","section":"Section 3.2.2"},{"comment":"The column group headers are confusing because VISPR1 appears to have no action column while PA-HMDB and VPHMDB have both action and privacy columns; please restructure the headers to make the dataset-protocol grouping explicit.","section":"Tables 1-2"}],"recommendation":"major_revision","confidential_remarks":"The central method is currently underspecified because of the L_penalty inconsistency, and the stability claim is overstated. The paper is within scope for a computer vision venue, but I would recommend a careful re-review after the authors resolve the objective definition and add uncertainty quantification. The novelty claim of being 'first to introduce a feature-based penalty scheme' should also be positioned more carefully relative to SPACT and STPrivacy, which already use utility-branch signals; this is not by itself a rejection concern."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe short version: this paper adds a thresholded RMS penalty to the SPACT self-supervised anonymization pipeline and reports that it lifts UCF101 action accuracy from 62% to 78% while keeping privacy leakage roughly steady. If that holds up, it's a genuinely useful result for surveillance applications. But as written, the penalty is defined two incompatible ways, and until that is resolved the experiments can't be checked.\n\nWhat's actually new: the penalty term with threshold B, applied only to action data, is a simple addition to the SPACT minimax objective. The idea is that the anonymizer should be free to obfuscate private attributes but not destroy action features, and the penalty enforces a budget on modification. The authors show gains across multiple datasets and a range of target architectures (R3D, R2plus1D, MViTv2, I3D, C3D), and the cross-dataset generalization results look solid. That's a practical contribution, even if it's not a new principle.\n\nThe soft spots, in order of severity. First, the penalty is defined inconsistently. Eq. 4 is a pixel-space RMS distance between X and fA(X). Section 3.2 and Algorithm 1 instead write it as a distance between X_action and fT(fA(X_action)), which is dimensionally ill-posed because fT is an I3D classifier outputting logits. These are two different constraints, and the paper never says which one was optimized. The 'Find code HERE' placeholder is not a URL, so the implemented loss is not checkable. That's load-bearing, not cosmetic. Second, the privacy-stability claim is overstated: on PA-HMDB the F1 score moves from 0.253 at B=0.3 to 0.124 at B=0.7, a twofold change, so 'nearly consistent' is not accurate. Third, there are no error bars anywhere, so it's impossible to tell whether the differences between B=0.3 and B=0.5 are meaningful. The reader's concern about pixel-space distance being a poor proxy for action features is fair if the pixel version is the real objective; the paper offers no evidence that this proxy tracks downstream accuracy.\n\nOverall: the core idea is plausible and the reported numbers are striking, but the manuscript is not reproducible in its current form. It deserves peer review — this is an accept-shaped paper with conditions — but the authors should be asked to fix the loss definition, report variance, and release working code. That would turn a promising preprint into a credible result.","headline":"A practical penalty knob for SPACT with strong reported gains, but an inconsistent loss definition and missing code keep it from being reproducible as written.","tokens_in":19125,"tokens_out":3613,"would_cite":false,"duration_ms":31762,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Penalizing an anonymizer when it alters action-relevant pixels too much—while leaving privacy-image anonymization uncapped—keeps action recognition near raw-data accuracy and holds privacy leakage nearly constant across penalty settings.","keywords":["privacy-preserving image anonymization","action recognition","penalty-driven minimax optimization","visual privacy leakage","self-supervised contrastive learning","utility-privacy trade-off","video surveillance privacy","EU AI Act GDPR compliance"],"falsifier":"Apply a post-hoc block shuffle or small affine warp to frames anonymized at B=0.3 so the RMS distance stays below B; if action Top-1 accuracy collapses while privacy leakage stays low, then the penalty is not what protects action cues and the reported gains come from the utility loss rather than the cap.","tokens_in":18217,"feed_emoji":"🛡️","tokens_out":11557,"duration_ms":96200,"temperature":0.7,"pith_summary":"Privacy-preserving video anonymizers usually damage the very features action-recognition models need. This paper argues the damage is avoidable if the anonymizer is given an explicit, feature-targeted instruction: keep action-relevant pixels close to the original, and let everything else be aggressively destroyed. Concretely, it adds a hinge penalty based on RMS pixel distance between input and anonymized frame, applied only to action frames, inside a minimax training loop with a self-supervised privacy branch. On UCF101, HMDB51, PA-HMDB, and VPHMDB, the method reports action accuracy close to raw data at the tightest penalty setting (B=0.3) while privacy leakage measured by cMAP and F1 stays nearly flat across B=0.3–0.9, beating prior self-supervised anonymizers on action performance. A sympathetic reader would take the contribution as evidence that the privacy–utility trade-off is not fixed, and a simple scalar cap can shift it.","feed_headline":"A small pixel cap rescues action accuracy from anonymization","feed_subtitle":"A pixel-change cap keeps action accuracy high while privacy leakage stays flat, beating prior self-supervised anonymizers.","key_machinery":"The load-bearing mechanism is the penalty term $L_{\\mathrm{penalty}} = \\max(0,\\|X - f_A(X)\\|_{\\mathrm{RMS}} - B)$ applied to action frames within a two-step minimax loop. The term is a hinge: as long as the anonymizer keeps the RMS pixel difference below B it is free to do whatever it likes to the image; once the difference exceeds B, the anonymizer is pushed back toward the original. Because it is applied only to action input data, the budget branch's inverted contrastive loss can push for maximal destruction of private attributes without fighting the utility-preserving constraint. This feature-dependent penalty is the component the paper says is new; the surrounding adversarial training and self-supervised budget branch follow prior work.","core_discovery":"On the paper's own terms, the discovery is that a single scalar threshold on how much the anonymizer may change action-related pixels buys most of the privacy–utility trade-off. The anonymizer $f_A$ (a UNet++ initially trained to be the identity) is trained in two alternating steps: it minimizes utility cross-entropy loss minus a self-supervised contrastive budget loss plus $\\lambda_{\\mathrm{penalty}}\\max(0,\\|X-f_A(X)\\|_{\\mathrm{RMS}}-B)$, with the penalty evaluated only on action frames, while the utility classifier and budget classifier are then updated against the frozen anonymizer. Across B = 0.3, 0.5, 0.7, and 0.9, action performance rises as B falls, privacy leakage as measured by class-wise mean average precision and F1 remains almost unchanged, and B = 0.3 gives the best balance, with UCF101 Top-1 accuracy within about a quarter of a point of raw data and PA-HMDB action accuracy far above the prior self-supervised baseline. The same anonymizer transfers to unseen action datasets and to different action classifiers, and it suppresses private attributes in new privacy datasets as well.","pith_inferences":["Because privacy leakage barely moves when B changes, the budget branch is likely doing the bulk of the privacy work; the penalty looks like an independent utility-control dial, so the two objectives may be almost fully separable rather than genuinely coupled.","RMS pixel distance is a weak proxy for semantic preservation: a spatial perturbation such as a block shuffle or small affine warp can keep the penalty below B while destroying action cues. A stricter test would replace the RMS cap with a feature-space distance from the utility encoder.","The GDPR/EU AI Act alignment is regulatory framing rather than an empirical result; a deployment story would need to measure leakage against stronger or task-specific attackers instead of a fixed ResNet-50 privacy model."],"forward_implications":["At the tightest penalty setting B=0.3, UCF101 action Top-1 accuracy is 78.26% versus 78.88% on raw data, while privacy leakage drops by about 6.5 cMAP points; no prior self-supervised anonymizer reported in the paper achieves this balance.","Privacy leakage stays nearly flat from B=0.3 to B=0.9 across all tested datasets, so the utility-preserving penalty can be tuned without rebalancing the privacy budget.","The trained anonymizer generalizes to unseen action and privacy datasets: for instance, on VPHMDB-to-VPUCF it keeps 91.91% Top-1 accuracy at B=0.3 against 92.23% on raw data while cutting privacy leakage by roughly 8.7 cMAP points.","The anonymizer transfers across different action classifiers (R3D-18, R2plus1D, MViTv2, I3D, C3D), with B=0.3 consistently closest to raw accuracy, supporting the paper's claim that it is model-agnostic.","Because the privacy branch is self-supervised, the whole pipeline avoids private-attribute labels, which the paper argues makes it more practical under EU AI Act and GDPR-style regulation."],"supporting_citations":[{"why":"Supplies the self-supervised privacy-preservation baseline and the training/evaluation protocol this work extends and compares against.","marker":"[8]"},{"why":"Introduces the adversarial minimax formulation and the PA-HMDB benchmark used for cross-dataset action-privacy evaluation.","marker":"[33]"},{"why":"Provides the video-level anonymization baseline and the VPUCF/VPHMDB private-attribute video datasets used in the experiments.","marker":"[18]"},{"why":"Provides the contrastive (NT-Xent) objective that the budget branch inverts to suppress private attributes without labels.","marker":"[5]"},{"why":"UNet++ is the encoder-decoder architecture used as the anonymizer, pretrained as an identity mapping before the main training.","marker":"[37]"},{"why":"VISPR supplies the VISPR1 and VISPR2 private-attribute benchmarks used to quantify privacy leakage.","marker":"[22]"},{"why":"Defines the I3D ResNet-50 utility classifier and its Kinetics-400 pretrained weights.","marker":"[3]"},{"why":"UCF101 is the primary action dataset for known and novel action-recognition evaluations.","marker":"[28]"}],"fun_headline_variants":["Penalty cap keeps action accuracy, privacy intact","Pixel penalty: privacy without action loss","Capped pixels: action performance preserved","Penalty-driven anonymizer beats trade-offs","One threshold: high action, low privacy leak"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that pixel-level similarity between the original and anonymized image faithfully measures whether action cues survive, and that training can cleanly separate action frames from privacy frames so the penalty applies only to action data.","fun_headline_variants_meta":{"raw":{"variants":["Penalty cap keeps action accuracy, privacy intact","Pixel penalty: privacy without action loss","Capped pixels: action performance preserved","Penalty-driven anonymizer beats trade-offs","One threshold: high action, low privacy leak"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000298,"raw_usage":{"total_tokens":1756,"prompt_tokens":1007,"completion_tokens":749,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":623,"completion_tokens_details":{"reasoning_tokens":683}},"tokens_in":623,"tokens_out":749,"duration_ms":6982,"temperature":1.0,"reasoning_tokens":683,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T11:51:14.296598+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Apply a post-hoc block shuffle or small affine warp to frames anonymized at B=0.3 so the RMS distance stays below B; if action Top-1 accuracy collapses while privacy leakage stays low, then the penalty is not what protects action cues and the reported gains come from the utility loss rather than the cap.","supporting_citations":[{"cited_title":"Spact: Self-supervised privacy preservation for action recog- nition","cited_arxiv_id":null,"evidence_quote":"Supplies the self-supervised privacy-preservation baseline and the training/evaluation protocol this work extends and compares against."},{"cited_title":"Privacy-preserving deep action recogni- tion: An adversarial learning framework and a new dataset","cited_arxiv_id":null,"evidence_quote":"Introduces the adversarial minimax formulation and the PA-HMDB benchmark used for cross-dataset action-privacy evaluation."},{"cited_title":"Stprivacy: Spatio-temporal privacy-preserving action recognition","cited_arxiv_id":null,"evidence_quote":"Provides the video-level anonymization baseline and the VPUCF/VPHMDB private-attribute video datasets used in the experiments."},{"cited_title":"Unet++: A nested u-net ar- chitecture for medical image segmentation","cited_arxiv_id":null,"evidence_quote":"UNet++ is the encoder-decoder architecture used as the anonymizer, pretrained as an identity mapping before the main training."},{"cited_title":"To- wards a visual privacy advisor: Understanding and predict- ing privacy risks in images","cited_arxiv_id":null,"evidence_quote":"VISPR supplies the VISPR1 and VISPR2 private-attribute benchmarks used to quantify privacy leakage."}],"review_version":1}