Pith. sign in

REVIEW 5 major objections 6 minor 74 references

Beyond Anonymization: Object Scrubbing for Privacy-Preserving 2D and 3D Vision Tasks

T0 review · 5 major / 6 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read ROAR removes sensitive objects from a dataset by generative inpainting and preserves 87.5% of detection accuracy, versus 74.2% when images are dropped.

desk verdict Useful empirical benchmark for object scrubbing, but the headline privacy-utility comparison compares unequal privacy levels and the privacy metric is self-referential; worth reviewing with major revisions. read the letter →

arxiv 2504.16557 v1 pith:BWMPJMNY submitted 2025-04-23 cs.CV

Murat Bilgehan Ertan , Ronak Sahu , Phuong Ha Nguyen , Kaleel Mahmood , Marten van Dijk This is my paper · ORCID
classification cs.CV
keywords privacy-preservingvisionobjectscrubbinggenerativeinpaintingdatasetobfuscationdetectionneuralradiancefieldsinstancesegmentationprivacy-utilitytrade-off
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

ROAR, a privacy-preserving pipeline introduced in this paper, removes sensitive objects—chiefly people—from images with generative inpainting and then re-annotates the cleaned images, instead of blurring, pixelating, or replacing people. The paper's central claim is that object scrubbing preserves dataset utility far better than image dropping: on COCO detection, models trained on scrubbed data retain 87.5% of baseline average precision, while models trained after dropping sensitive images retain only 74.2%. In NeRF-based 3D reconstruction, scrubbing costs at most 1.66 dB PSNR while holding SSIM and improving LPIPS, so the approach transfers from 2D datasets to 3D scenes. A generous reading is that deletion-based privacy is wasteful when the underlying scenes still contain useful context, and that scrubbing can recover most of that context safely.

What carries the argument

The load-bearing mechanism is the obfuscation operator $O(I,M) = I\odot(1-M) + G(I,M,z)\odot M$, which applies a pretrained inpainting model only inside the segmentation masks while leaving unmasked content intact. Around this sits the ROAR pipeline: Mask2Former for sensitive-object masks, diffusion-based or GAN-based inpainting for the masked regions, and RT-DETRv2 as an oracle that re-annotates only the objects whose bounding boxes collide with the removed areas, using thresholds $\zeta$ and $\tau$. This re-annotation step is what converts a scrubbed image into a usable training example: collided boxes are re-checked, unaffected boxes are retained. For NeRF, a stitching-based inpainting strategy with $\alpha$ blending, histogram matching, and Gaussian boundary smoothing maintains cross-view consistency.

What would settle it

Run a person re-identification or face-detection attack on the scrubbed COCO images and check whether crops of the inpainted regions can be matched to the original individuals above chance; if non-trivial matching succeeds even in images where the oracle reports PE=100%, the privacy claim collapses.

Watch

Extended reading notes

Core claim

The paper establishes that generative object removal is a viable privacy mechanism for vision datasets. ROAR takes COCO images, detects persons with Mask2Former, inpaints the masked regions with Stable Diffusion, Kandinsky, or AOT-GAN, and uses RT-DETRv2 as an oracle to re-annotate objects that overlap the removed regions. Trained on the scrubbed COCO data, RT-DETRv2 and YOLOv9 retain 0.420 AP (87.5% of baseline) versus 0.356 AP (74.2%) for image dropping; Kandinsky with boundary dilation reaches 89.22% person-removal efficiency. In NeRF reconstruction, scrubbing costs at most 1.66 dB PSNR while maintaining SSIM and often improving LPIPS. The paper concludes that image dropping is the worst strategy and that scrubbing should be tailored to the privacy and utility requirements of the target task.

Load-bearing premise

Privacy is judged by whether one detector, RT-DETRv2, still sees persons after inpainting, and the paper assumes that segmentation false positives are nearly zero; if a stronger detector or a re-identification attack finds residual traces, the claimed strong privacy guarantee fails.

Editorial extensions

If this is right

  • Image dropping is the worst privacy strategy: it removes 45.79% of images and 69.48% of annotations yet yields the lowest detection AP, so scrubbing dominates it on both privacy and utility.
  • Inpainting method matters: Kandinsky (diffusion-based) outperforms AOT-GAN in NeRF quality and privacy efficiency, and expanding the scrub area by 10 pixels raises person-removal efficiency to 89.22% at a modest AP cost.
  • Small objects attached to persons, such as backpacks, handbags, remotes, and toothbrushes, lose the most AP because they are removed or occluded along with the person; large context-independent objects like buses and airplanes stay above 90% of baseline AP.
  • Selective scrubbing, which removes one person per image in half of the sensitive images, preserves AP near 0.465 and reduces image loss to roughly 2%, offering a high-utility operating point.
  • NeRF reconstruction from scrubbed multi-view images stays within 1.66 dB PSNR and can improve LPIPS, indicating that 3D scenes remain reconstructable from privacy-compliant data.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because privacy is measured with the same detector family used for re-annotation, the reported person-removal rates are likely optimistic; an independent person detector or a face-recognition/re-identification attack could reveal residual traces that RT-DETRv2 misses.
  • The large advantage of scrubbing over dropping for small objects suggests that preserving scene context is the main utility mechanism, which would predict even bigger gains for tasks such as instance segmentation or tracking where nearby context is essential.
  • ROAR's per-image inpainting has no explicit temporal or cross-view consistency constraint beyond the NeRF stitching step; extending it to video would require object removal across frames, and flicker would likely be the limiting artifact.
  • A formal privacy model could be layered on top: after scrubbing, the remaining person-level information is bounded by the detector's false-negative rate, and bounding residual pixel-level identity leakage would turn the framework into a certified privacy tool.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes ROAR, a four-stage pipeline for privacy-preserving dataset obfuscation in 2D and 3D vision: Mask2Former detects sensitive objects (e.g., persons), a pre-trained generative inpainting model (Stable Diffusion, Kandinsky, AOT-GAN) removes them, an RT-DETRv2 oracle re-annotates collided objects, and utility is measured by training detectors or NeRF models on the processed data. The headline results are that on COCO-based detection ROAR retains 87.5% of baseline AP versus 74.2% for image dropping (Table 1), and that in NeRF reconstruction the method loses at most 1.66 dB PSNR while improving LPIPS (Table 2, Section 4.4). The paper also analyzes object-wise degradation patterns, showing that small objects attached to persons suffer the most, and provides qualitative comparisons against DeepPrivacy2 anonymization.

Significance. If the central claim held, the work would make a useful contribution: it systematically compares three inpainting families for object scrubbing, extends the evaluation to NeRF-based 3D reconstruction, and provides a reproducible pipeline with a public code repository and fixed seeds. The cluster-wise analysis of small-object degradation is a genuinely informative empirical finding, and the NeRF stitching-based inpainting strategy is a constructive step for view-consistent removal. However, the significance is currently limited by the fact that the headline privacy-utility comparison is not privacy-equalized and the 'strong privacy guarantees' claim rests on a self-referential oracle metric and an unverified false-positive assumption, so the paper is best viewed as an empirical exploration rather than a validated privacy framework.

major comments (5)
  1. [4.2.1, Eqs. (17)-(19); Table 1; Section 5] The headline comparison of scrubbing versus dropping is not privacy-equalized and the privacy metric is self-referential. PE and IE in Eqs. (17)-(19) are computed with RT-DETRv2, the same detector family used in Stage 3 to decide whether a collided object is retained in the annotations (Eqs. (13)-(16)). Residual persons are therefore counted only when the oracle happens to detect them, and any false negatives undercount privacy leakage in both the metric and the re-annotation. More concretely, Table 1 shows FP.KD at PE=79.82% and IE=64.77%, FP.SD at PE=59.19% and IE=38.16%, while FP.drop achieves PE=IE=100%. Comparing AP 0.420 versus 0.356 under such unequal residual-person rates does not support the abstract's claim that scrubbing beats dropping; the utility advantage may be partly purchased by incomplete privacy. The authors should report privacy under a stronger or independent detector, provide an equalized comparison (e.g., drop plus inpainting of the removed images), and clearly separate 'residual privacy risk' from 'oracle-verified removal'.
  2. [4.4, Table 2; Section 5 and Abstract] The stated NeRF loss bound contradicts the reported numbers. The conclusion and abstract say scrubbing incurs a PSNR loss of at most 1.66 dB, but Table 2 shows a loss of 2.89 dB for the Room scene with the GAN method (32.70 to 29.81). Moreover, Ours/KD improves PSNR over the baseline by a noticeable margin in Fern (26.49 vs 25.17) and Flower (27.64 vs 27.40), which is surprising because removing a visible object should not improve fidelity of the original views; this suggests the baseline or the evaluation protocol needs clarification. The authors should either restrict the 'at most 1.66 dB' claim to the Kandinsky variant, report per-method bounds, or explain the mechanism behind the PSNR improvement.
  3. [Appendix B; Section 5] The claimed 'strong privacy guarantees' are not supported by the evidence presented. Appendix B assumes the sensitive-object detector's false-positive rate is 'approximately zero' and frames privacy only as non-detection by a downstream person detector, but no attack evaluation, re-identification test, or formal privacy model is provided. The metrics in Eqs. (17)-(19) verify absence with the same oracle that is used for re-annotation, so the guarantee is conditional on that detector's blind spots. The authors should add a stronger-detector evaluation, a face/body re-identification test on the inpainted regions, or an explicit statement that the reported PE/IE are oracle-relative measures rather than formal privacy guarantees.
  4. [4.3 and Appendix E] All detection results appear to come from a single random seed (Appendix E, seed 3407), and Table 1 reports no variance or error bars. Because several AP differences are small relative to typical COCO training noise (e.g., FP.SD 0.441 vs FP.AOT 0.424, or SP.KD 0.466 vs SP.SD 0.465), the conclusions that 'Kandinsky achieves the strongest privacy with superior detection accuracy' and that specific methods are optimal are not statistically grounded. At minimum, the authors should run multiple seeds for the main comparison and report mean and standard deviation, or temper the ranking claims accordingly.
  5. [Appendix B, 'Selection of tau and zeta'] The IoU verification threshold tau is selected as 0.3 based on 'empirical observations' without a sensitivity analysis. Because tau directly controls which collided objects are reinstated in the final annotations (Eq. (15)), the reported AP values and privacy outcomes may depend on this choice. The authors should report results for a range of tau values (e.g., tau in {0.1, 0.3, 0.5}) and justify that the headline scrubbing-vs-dropping conclusion is robust to the threshold.
minor comments (6)
  1. [Section 5] The conclusion states that image dropping reduces AP to 74.5%, but Table 1 and the abstract report 74.2%; this numeric discrepancy should be corrected.
  2. [Eq. (9)] The notation P(R^4 x C x [0,1]) is used for the oracle's output space without defining P as the power set; please add a definition or use a standard notation such as 2^(R^4 x C x [0,1]).
  3. [Section 1] The claim that 'our method is the first to demonstrate broad applicability across both 2D object detection and 3D NeRF reconstruction' is stronger than the related-work discussion supports; it would be safer to say 'to the best of our knowledge' and cite the closest concurrent or prior NeRF-privacy works.
  4. [Table 1 caption and Section 4.3 item 3] The BD variants are described as expanding the scrubbing area, and Section 4.3 says 'by 10px', but Table 1 does not state the expansion amount; please specify the boundary dilation in the caption or table notes.
  5. [Appendix C] The LPIPS metric is said to use VGG16, but the exact pre-trained feature network and normalization are not specified; please cite the precise VGG configuration to ensure reproducibility.
  6. [Figure 4 captions and axis labels] The x-axis of Figure 4 is labeled with 'X' in the text version, and the caption is minimal; please clarify what the baseline bar represents and whether the bars are mean values or single runs.

Circularity Check

1 steps flagged · score 5.0 of 10

Privacy metric and re-annotation share the same oracle, so 'strong privacy guarantees' are true by construction relative to RT-DETRv2.

  1. self definitional [Sec. 3.3, Eqs. (13)-(16) and Sec. 4.2.1, Eqs. (17)-(19); Tab. 1]
    "The oracle detects objects in Iobf, producing: Aoracle = O(Iobf,M) = {(b′j,c′j,s′j) | j = 1,...,L}. ... Averified = {(bi,ci) | (bi,ci)∈Acollided, ∃(b′j,c′j,s′j)∈Aoracle, IoU(bi,b′j)>τ}. ... P Scrubbed i is the number of remaining persons after scrubbing calculated using the oracle model."

    The same RT-DETRv2 oracle O that builds the processed dataset also supplies the privacy metric. Stage 3 keeps a collided person in final annotations only if O detects it (Eqs. 13-16); Stage 4 counts a person as removed only if O fails to detect it (Eqs. 17-19). So 'successful scrubbing' is defined as O's non-detection: the privacy evaluation cannot see residuals that the re-annotation oracle also missed. The abstract's 'strong privacy guarantees' reduce to 'RT-DETRv2 does not detect the persons it does not detect.' Tab. 1 Full Privacy rows still have PE=59.19-89.22, i.e., 10-40% of persons remain detectable by the same oracle; no independent detector, re-identification attack, or formal privacy model is invoked.

full rationale

The paper's utility claims (COCO AP, NeRF PSNR/SSIM/LPIPS) are empirical comparisons against external benchmarks and are not circular: the AP and reconstruction numbers stand or fall on their own. I found no load-bearing self-citation chain; references to prior work are standard. The circular element is confined to the privacy evaluation: Eqs. (17)-(19) define privacy as the oracle's failure to detect persons, while Eqs. (13)-(16) use the same oracle to decide which objects survive in the re-annotated training set. Consequently, PE/IE are measures of one detector's blind spots, not of the absence of sensitive content, and the 'Full Privacy' label is misleading for rows with PE<100. Appendix B's explicit assumption of negligible false positives and false-negative-only leakage is a stated limitation that actually acknowledges the problem; it does not make the argument more circular, but it also does not repair the self-referential metric. The unequal-privacy comparison between FP.KD (PE=79.82) and FP.drop (PE=100) is a confound in the headline 87.5%-vs-74.2% claim, though that is a validity issue rather than an additional circular step. Overall, because the privacy conclusion is partly true by definition while the utility evaluation retains independent content, a moderate score is appropriate.

Assumptions & free parameters 4 free parameters · 6 assumptions · 0 invented entities

The central results depend on a small set of manually chosen thresholds, on an oracle-detector definition of privacy, and on the unverified power of pretrained inpainting to erase identity. No new physical or formal entities are introduced; ROAR is a pipeline composed of existing models.

free parameters (4)
  • IoU verification threshold tau = 0.3
    Selected in Appendix B based on empirical observation of IoU settings; directly controls which objects are kept in the re-annotated dataset.
  • Collision overlap threshold zeta = 0
    Set to 0 so any overlap triggers verification; affects how many annotations survive the scrubbing process.
  • Boundary dilation for BD variants = 10 px
    Expanding the scrubbed area by 10 pixels changes PE from 79.82 to 89.22 and AP from 0.420 to 0.410 in Table 1.
  • Inpainting text prompt = generic background
    A fixed prompt chosen based on empirical observation in Sec. 3.2; it guides all diffusion-based inpainting outputs.
assumptions (6)
  • domain assumption Privacy is equivalent to the oracle detector not finding persons after scrubbing.
    PE and IE in Eqs. (17)-(19) count persons remaining according to the oracle detector; no attack-based privacy check is provided.
  • domain assumption Sensitive-object detection has negligible false positives.
    Appendix B states the false positive rate is approximately zero; this is untested and load-bearing for both privacy and utility claims.
  • domain assumption Pre-trained inpainting models can reconstruct backgrounds without leaving recognizable traces of removed persons.
    The whole pipeline depends on this, while Sec. 4.5 acknowledges that inpainting can introduce artifacts and hallucinations in large occlusions.
  • domain assumption Manual NeRF object masks are view-consistent enough for stitching-based inpainting.
    Appendix C admits that slight mask inconsistencies across views could lead to artifacts, yet the stitching method is assumed sufficient.
  • standard math NeRF volume rendering equations from Mildenhall et al. are correct.
    Used without proof in Appendix C, Eqs. (21)-(23), as background for the 3D reconstruction experiments.
  • domain assumption COCO person annotations are an adequate definition of sensitive content.
    All 2D scrubbing targets, privacy metrics, and utility analyses treat persons as the sensitive class; no other sensitive categories are considered.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Beyond Anonymization: Object Scrubbing for Privacy-Preserving 2D and 3D Vision Tasks." pith.science (2026). https://pith.science/paper/BWMPJMNY

@misc{pith2026250416557,
  author       = {Pith},
  title        = {Pith review of: Beyond Anonymization: Object Scrubbing for Privacy-Preserving 2D and 3D Vision Tasks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BWMPJMNY}},
  note         = {Machine review of arXiv:2504.16557}
}
read the original abstract

We introduce ROAR (Robust Object Removal and Re-annotation), a scalable framework for privacy-preserving dataset obfuscation that eliminates sensitive objects instead of modifying them. Our method integrates instance segmentation with generative inpainting to remove identifiable entities while preserving scene integrity. Extensive evaluations on 2D COCO-based object detection show that ROAR achieves 87.5% of the baseline detection average precision (AP), whereas image dropping achieves only 74.2% of the baseline AP, highlighting the advantage of scrubbing in preserving dataset utility. The degradation is even more severe for small objects due to occlusion and loss of fine-grained details. Furthermore, in NeRF-based 3D reconstruction, our method incurs a PSNR loss of at most 1.66 dB while maintaining SSIM and improving LPIPS, demonstrating superior perceptual quality. Our findings establish object removal as an effective privacy framework, achieving strong privacy guarantees with minimal performance trade-offs. The results highlight key challenges in generative inpainting, occlusion-robust segmentation, and task-specific scrubbing, setting the foundation for future advancements in privacy-preserving vision systems.

Figures

Figures reproduced from arXiv: 2504.16557 by the authors.

Figure 1
Figure 1. Privacy-preserving transformations for dataset obfusca [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Privacy-preserving dataset obfuscation pipeline. [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Each row represents a different image processed through [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figures from the paper (14 more)
Figure 4
Figure 4. Figure 4: Privacy Efficiency The bar plots show Person Re￾moval Efficiency (PE%) and Image Removal Efficiency (IE%). KD (Kandinsky), SD (Stable Diffusion), and AOT (AOT-GAN) denote different inpainting methods, while Drop removes sensi￾tive images. This section presents the empi…
Figure 5
Figure 5. Figure 5: Comparison of FP (scrubbing sensitive objects) and [PITH_FULL_IMAGE:figures/full_fig_p015_5.png]
Figure 6
Figure 6. Figure 6: Comparison of different approaches: Full Privacy (FP) ensures the removal of all sensitive objects in the dataset, leaving no [PITH_FULL_IMAGE:figures/full_fig_p021_6.png]
Figure 7
Figure 7. Figure 7: Comparison of different approaches. 22 [PITH_FULL_IMAGE:figures/full_fig_p022_7.png]
Figure 8
Figure 8. Figure 8: Comparison of different approaches. 23 [PITH_FULL_IMAGE:figures/full_fig_p023_8.png]
Figure 9
Figure 9. Figure 9: Comparison of different approaches. 24 [PITH_FULL_IMAGE:figures/full_fig_p024_9.png]
Figure 10
Figure 10. Figure 10: Comparison of different approaches. 25 [PITH_FULL_IMAGE:figures/full_fig_p025_10.png]
Figure 11
Figure 11. Figure 11: Comparison of different approaches. 26 [PITH_FULL_IMAGE:figures/full_fig_p026_11.png]
Figure 12
Figure 12. Figure 12: Flower Scene. Comparison of original and scrubbed images using GAN, KD, and SD methods. [PITH_FULL_IMAGE:figures/full_fig_p027_12.png]
Figure 13
Figure 13. Figure 13: Room Scene. Comparison of original and scrubbed images using GAN, KD, and SD methods. [PITH_FULL_IMAGE:figures/full_fig_p028_13.png]
Figure 14
Figure 14. Figure 14: Fern Scene. Comparison of original and scrubbed images using GAN, KD, and SD methods. [PITH_FULL_IMAGE:figures/full_fig_p029_14.png]
Figure 15
Figure 15. Figure 15: Flower Scene: original image, scrubbed using Kandinsky, and the NeRF reconstruction. [PITH_FULL_IMAGE:figures/full_fig_p030_15.png]
Figure 16
Figure 16. Figure 16: Room Scene: original image, scrubbed using Kandinsky, and the NeRF reconstruction. [PITH_FULL_IMAGE:figures/full_fig_p031_16.png]
Figure 17
Figure 17. Figure 17: Fern Scene: original image, scrubbed using Kandinsky, and the NeRF reconstruction. [PITH_FULL_IMAGE:figures/full_fig_p032_17.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

74 extracted references · 69 canonical work pages

  1. [1]

    Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang

    Martin Abadi, Andy Chu, Ian Goodfellow, H. Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. InProceedings of the 2016 ACM SIGSAC Conference on Computer and Communica- tions Security. ACM, 2016. 2, 19

    work page 2016

  2. [2]

    Aithal, Pratyush Maini, Zachary C

    Sumukh K. Aithal, Pratyush Maini, Zachary C. Lipton, and J. Zico Kolter. Understanding hallucinations in diffusion models through mode interpolation. In Advances in Neu- ral Information Processing Systems 38: Annual Conference on Neural Information Processing Systems 2024, NeurIPS 2024, Vancouver, BC, Canada, December 10 - 15, 2024 ,

    work page 2024

  3. [3]

    Bal, Dick H

    Henri E. Bal, Dick H. J. Epema, Cees de Laat, Rob van Nieuwpoort, John W. Romein, Frank J. Seinstra, Cees Snoek, and Harry A. G. Wijshoff. A medium-scale dis- tributed system for computer science research: Infrastructure for the long term. Computer, 49(5):54–63, 2016. 9

    work page 2016

  4. [4]

    Attribute-preserving face dataset anonymization via latent code optimization, 2023

    Simone Barattin, Christos Tzelepis, Ioannis Patras, and Nicu Sebe. Attribute-preserving face dataset anonymization via latent code optimization, 2023. 2, 18

    work page 2023

  5. [5]

    Bonawitz, Vladimir Ivanov, Ben Kreuter, Anto- nio Marcedone, H

    Kallista A. Bonawitz, Vladimir Ivanov, Ben Kreuter, Anto- nio Marcedone, H. Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. Practical secure ag- gregation for privacy-preserving machine learning. In Pro- ceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS 2017, Dallas, TX, USA, October 30 - Nov...

    work page 2017

  6. [6]

    Kallista A. Bonawitz, Hubert Eichner, Wolfgang Grieskamp, Dzmitry Huba, Alex Ingerman, Vladimir Ivanov, Chlo´e Kid- don, Jakub Kone ˇcn´y, Stefano Mazzocchi, Brendan McMa- han, Timon Van Overveldt, David Petrou, Daniel Ramage, and Jason Roselander. Towards federated learning at scale: System design, 2019. 2, 17

    work page 2019

  7. [7]

    Qualitative failures of image generation models and their application in detecting deepfakes.Image Vis

    Ali Borji. Qualitative failures of image generation models and their application in detecting deepfakes.Image Vis. Com- put., 137:104771, 2023. 9

    work page 2023

  8. [8]

    Extracting training data from diffu- sion models

    Nicholas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagiel- ski, Vikash Sehwag, Florian Tram`er, Borja Balle, Daphne Ip- polito, and Eric Wallace. Extracting training data from diffu- sion models. In 32nd USENIX Security Symposium, USENIX Security 2023, Anaheim, CA, USA, August 9-11, 2023, pages 5253–5270. USENIX Association, 2023. 2

    work page 2023

Show all 74 references
  1. [9]

    Yolor-based multi- task learning

    Hung-Shuo Chang, Chien-Yao Wang, Richard Robert Wang, Gene Chou, and Hong-Yuan Mark Liao. Yolor-based multi- task learning. CoRR, abs/2309.16921, 2023. 3, 5, 20

    2023 arXiv

  2. [10]

    GS-WGAN: A gradient-sanitized approach for learning dif- ferentially private generators

    Dingfan Chen, Tribhuvanesh Orekondy, and Mario Fritz. GS-WGAN: A gradient-sanitized approach for learning dif- ferentially private generators. In Advances in Neural Infor- mation Processing Systems 33: Annual Conference on Neu- ral Information Processing Systems 2020, NeurIPS ...

    2020

  3. [11]

    Pri- vate set generation with discriminative information

    Dingfan Chen, Raouf Kerkouche, and Mario Fritz. Pri- vate set generation with discriminative information. In Ad- vances in Neural Information Processing Systems 35: An- nual Conference on Neural Information Processing Systems 2022, NeurIPS 2022, New Orleans, LA, USA, November ...

    2022

  4. [12]

    DPGEN: differentially private generative energy-guided network for natural image synthe- sis

    Jia-Wei Chen, Chia-Mu Yu, Ching-Chia Kao, Tzai-Wei Pang, and Chun-Shien Lu. DPGEN: differentially private generative energy-guided network for natural image synthe- sis. In IEEE/CVF Conference on Computer Vision and Pat- tern Recognition, CVPR 2022, New Orleans, LA, USA, June ...

    2022

  5. [13]

    Schwing, Alexan- der Kirillov, and Rohit Girdhar

    Bowen Cheng, Ishan Misra, Alexander G. Schwing, Alexan- der Kirillov, and Rohit Girdhar. Masked-attention mask transformer for universal image segmentation, 2022. 3, 4, 18

    2022

  6. [14]

    Combating mode collapse in GAN train- ing: An empirical analysis using hessian eigenvalues

    Ricard Durall, Avraam Chatzimichailidis, Peter Labus, and Janis Keuper. Combating mode collapse in GAN train- ing: An empirical analysis using hessian eigenvalues. In Proceedings of the 16th International Joint Conference on Computer Vision, Imaging and Computer Graphics Theor...

    2021

  7. [15]

    The algorithmic founda- tions of differential privacy

    Cynthia Dwork and Aaron Roth. The algorithmic founda- tions of differential privacy. Found. Trends Theor. Comput. Sci., 9(3-4):211–407, 2014. 2, 19

    2014

  8. [16]

    Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron C

    Ian J. Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron C. Courville, and Yoshua Bengio. Generative adversarial networks, 2014. 2, 18

    2014

  9. [17]

    Model-based face de-identification

    Ralph Gross, Latanya Sweeney, Fernando De la Torre, and Simon Baker. Model-based face de-identification. In IEEE Conference on Computer Vision and Pattern Recognition, CVPR Workshops 2006, New York, NY, USA, 17-22 June, 2006, page 161. IEEE Computer Society, 2006. 2

    2006

  10. [18]

    Diff-privacy: Diffusion-based face privacy pro- tection

    Xiao He, Mingrui Zhu, Dongxin Chen, Nannan Wang, and Xinbo Gao. Diff-privacy: Diffusion-based face privacy pro- tection. IEEE Trans. Circuits Syst. Video Technol., 34(12): 13164–13176, 2024. 3, 18

    2024

  11. [19]

    Denoising dif- fusion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising dif- fusion probabilistic models. In Advances in Neural Informa- tion Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, De- cember 6-12, 2020, virtual, 2020. 2, 18, 20

    2020

  12. [20]

    Image quality metrics: PSNR vs

    Alain Hor ´e and Djemel Ziou. Image quality metrics: PSNR vs. SSIM. In 20th International Conference on Pattern Recognition, ICPR 2010, Istanbul, Turkey, 23-26 August 2010, pages 2366–2369. IEEE Computer Society, 2010. 7, 17

    2010

  13. [21]

    Deepprivacy2: To- wards realistic full-body anonymization

    H ˚akon Hukkel ˚as and Frank Lindseth. Deepprivacy2: To- wards realistic full-body anonymization. In IEEE/CVF Win- ter Conference on Applications of Computer Vision, WACV 2023, Waikoloa, HI, USA, January 2-7, 2023 , pages 1329–

    2023

  14. [22]

    Deepprivacy: A generative adversarial network for face anonymization

    H ˚akon Hukkel ˚as, Rudolf Mester, and Frank Lindseth. Deepprivacy: A generative adversarial network for face anonymization. In Advances in Visual Computing - 14th International Symposium on Visual Computing, ISVC 2019, Lake Tahoe, NV , USA, October 7-9, 2019, Proceedings, Par...

    2019

  15. [23]

    Brendan McMahan, Brendan Avent, Aur´elien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista A

    Peter Kairouz, H. Brendan McMahan, Brendan Avent, Aur´elien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista A. Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, Rafael G. L. D’Oliveira, Hubert Eichner, Salim El Rouayheb, David Evans, Josh Gardner, Zachary Garrett...

    2021

  16. [24]

    Balancing privacy and ac- curacy: Exploring the impact of data anonymization on deep learning models in computer vision

    Jun Ha Lee and Su Jeong You. Balancing privacy and ac- curacy: Exploring the impact of data anonymization on deep learning models in computer vision. IEEE Access, 12:8346– 8358, 2024. 2, 3, 18

    2024

  17. [25]

    You can use but cannot recognize: Preserving visual pri- vacy in deep neural networks

    Qiushi Li, Yan Zhang, Ju Ren, Qi Li, and Yaoxue Zhang. You can use but cannot recognize: Preserving visual pri- vacy in deep neural networks. In 31st Annual Network and Distributed System Security Symposium, NDSS 2024, San Diego, California, USA, February 26 - March 1, 2024 . ...

    2024

  18. [26]

    Differentially private imaging via latent space manipulation, 2021

    Tao Li and Chris Clifton. Differentially private imaging via latent space manipulation, 2021. 2, 18

    2021

  19. [27]

    Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll ´ar, and C

    Tsung-Yi Lin, Michael Maire, Serge J. Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll ´ar, and C. Lawrence Zitnick. Microsoft COCO: common objects in context, 2014. 3, 6

    2014

  20. [28]

    Differentially private video activity recognition, 2024

    Zelun Luo, Yuliang Zou, Yijin Yang, Zane Durante, De-An Huang, Zhiding Yu, Chaowei Xiao, Li Fei-Fei, and Ani- mashree Anandkumar. Differentially private video activity recognition, 2024. 2

    2024

  21. [29]

    Rt-detrv2: Improved base- line with bag-of-freebies for real-time detection transformer,

    Wenyu Lv, Yian Zhao, Qinyao Chang, Kui Huang, Guanzhong Wang, and Yi Liu. Rt-detrv2: Improved base- line with bag-of-freebies for real-time detection transformer,

  22. [30]

    RAD: real- istic anonymization of images using stable diffusion

    Simon Malm, Viktor R ¨onnb¨ack, Amanda H˚akansson, Minh- Ha Le, Karol Wojtulewicz, and Niklas Carlsson. RAD: real- istic anonymization of images using stable diffusion. InPro- ceedings of the 23rd Workshop on Privacy in the Electronic Society, WPES 2024, Salt Lake City, UT, US...

    2024

  23. [31]

    CIA- GAN: conditional identity anonymization generative adver- sarial networks

    Maxim Maximov, Ismail Elezi, and Laura Leal-Taix ´e. CIA- GAN: conditional identity anonymization generative adver- sarial networks. In 2020 IEEE/CVF Conference on Com- puter Vision and Pattern Recognition, CVPR 2020, Seattle, WA, USA, June 13-19, 2020 , pages 5446–5455. Compu...

    2020

  24. [32]

    Defeating image obfuscation with deep learning, 2016

    Richard McPherson, Reza Shokri, and Vitaly Shmatikov. Defeating image obfuscation with deep learning, 2016. 2

    2016

  25. [33]

    Srinivasan, Matthew Tancik, Jonathan T

    Ben Mildenhall, Pratul P. Srinivasan, Matthew Tancik, Jonathan T. Barron, Ravi Ramamoorthi, and Ren Ng. Nerf: Representing scenes as neural radiance fields for view syn- thesis. In Computer Vision - ECCV 2020 - 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceed...

    2020

  26. [34]

    Blur filtration fails to preserve privacy for home-based video conferencing

    Carman Neustaedter, Saul Greenberg, and Michael Boyle. Blur filtration fails to preserve privacy for home-based video conferencing. ACM Trans. Comput.-Hum. Interact. , 13(1): 1–36, 2006. 2

    2006

  27. [35]

    Balancing privacy and awareness in home media spaces

    Carman Gerard Neustaedter and Saul Greenberg. Balancing privacy and awareness in home media spaces. University of Calgary, Department of Computer Science Calgary, 2003. 2

    2003

  28. [36]

    Improved denoising diffusion probabilistic models

    Alexander Quinn Nichol and Prafulla Dhariwal. Improved denoising diffusion probabilistic models. In Proceedings of the 38th International Conference on Machine Learning, ICML 2021, 18-24 July 2021, Virtual Event , pages 8162–

    2021

  29. [37]

    The European Parliament. Regulation (eu) 2016/679 of the european parliament and of the council of 27 april 2016 on the protection of natural persons with regard to the process- ing of personal data and on the free movement of such data, and repealing directive 95/46/ec (gener...

    2016

  30. [38]

    Yang, Zachary DeVito, Mar- tin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala

    Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zem- ing Lin, Natalia Gimelshein, Luca Antiga, Alban Desmai- son, Andreas K ¨opf, Edward Z. Yang, Zachary DeVito, Mar- tin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit S...

    2019

  31. [39]

    Torch.manual seed(3407) is all you need: On the influence of random seeds in deep learning architectures for computer vision

    David Picard. Torch.manual seed(3407) is all you need: On the influence of random seeds in deep learning architectures for computer vision. CoRR, abs/2109.08203, 2021. 20

    2021 arXiv

  32. [40]

    Kandinsky: an improved text-to-image syn- thesis with image prior and latent diffusion, 2023

    Anton Razzhigaev, Arseniy Shakhmatov, Anastasia Malt- seva, Vladimir Arkhipkin, Igor Pavlov, Ilya Ryabov, An- gelina Kuts, Alexander Panchenko, Andrey Kuznetsov, and Denis Dimitrov. Kandinsky: an improved text-to-image syn- thesis with image prior and latent diffusion, 2023. 2...

    2023

  33. [41]

    High-resolution image syn- thesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj¨orn Ommer. High-resolution image syn- thesis with latent diffusion models. InIEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2022, New Orleans, LA, USA, June 18-24, 2022 , pages 10674–...

    2022

  34. [42]

    Activity recognition on avatar-anonymized datasets with masked differential privacy, 2024

    David Schneider, Sina Sajadmanesh, Vikash Sehwag, Saquib Sarfraz, Rainer Stiefelhagen, Lingjuan Lyu, and Vivek Sharma. Activity recognition on avatar-anonymized datasets with masked differential privacy, 2024. 19

    2024

  35. [43]

    Kandinsky 2

    Arseniy Shakhmatov, Anton Razzhigaev, Aleksandr Nikolich, Vladimir Arkhipkin, Igor Pavlov, An- drey Kuznetsov, and Denis Dimitrov. Kandinsky 2. https://github.com/ai-forever/Kandinsky- 2/tree/main, 2022. Accessed: Feb 2025. 4, 6 11

    2022

  36. [44]

    Membership inference attacks against machine learning models

    Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE Symposium on Security and Privacy, SP 2017, San Jose, CA, USA, May 22-26, 2017 , pages 3–18. IEEE Computer Society, 2017. 2

    2017

  37. [45]

    Portrait of a privacy invasion

    Yan Shoshitaishvili, Christopher Kruegel, and Giovanni Vi- gna. Portrait of a privacy invasion. Proc. Priv. Enhancing Technol., 2015(1):41–60, 2015. 2

    2015

  38. [46]

    Natural and effective ob- fuscation by head inpainting

    Qianru Sun, Liqian Ma, Seong Joon Oh, Luc Van Gool, Bernt Schiele, and Mario Fritz. Natural and effective ob- fuscation by head inpainting. In 2018 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2018, Salt Lake City, UT, USA, June 18-22, 2018 , pages 5050–

    2018

  39. [47]

    A hybrid model for iden- tity obfuscation by face replacement

    Qianru Sun, Ayush Tewari, Weipeng Xu, Mario Fritz, Chris- tian Theobalt, and Bernt Schiele. A hybrid model for iden- tity obfuscation by face replacement. In Computer Vision - ECCV 2018 - 15th European Conference, Munich, Germany, September 8-14, 2018, Proceedings, Part I, pag...

    2018

  40. [48]

    Catastrophic forget- ting and mode collapse in gans

    Hoang Thanh-Tung and Truyen Tran. Catastrophic forget- ting and mode collapse in gans. In 2020 International Joint Conference on Neural Networks, IJCNN 2020, Glasgow, United Kingdom, July 19-24, 2020, pages 1–10. IEEE, 2020. 2, 18

    2020

  41. [49]

    Neurad: Neural rendering for autonomous driving

    Adam Tonderski, Carl Lindstr ¨om, Georg Hess, William Ljungbergh, Lennart Svensson, and Christoffer Petersson. Neurad: Neural rendering for autonomous driving. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2024, Seattle, WA, USA, June 16-22, 2024, pag...

    2024

  42. [50]

    DP-CGAN: differentially private synthetic data and label generation

    Reihaneh Torkzadehmahani, Peter Kairouz, and Benedict Paten. DP-CGAN: differentially private synthetic data and label generation. In IEEE Conference on Computer Vision and Pattern Recognition Workshops, CVPR Workshops 2019, Long Beach, CA, USA, June 16-20, 2019 , pages 98–104....

    2019

  43. [51]

    Differentially private learn- ing needs better features (or much more data), 2021

    Florian Tram `er and Dan Boneh. Differentially private learn- ing needs better features (or much more data), 2021. 19

    2021

  44. [52]

    Data-centric AI for reliable and respon- sible AI: From theory to practice

    Mihaela van der Schaar, Isabelle Guyon, Nabeel Seedat, Jen- nifer Wortman Vaughan, Kyunghyun Cho, Razvan Pascanu, and Jim Weatherall. Data-centric AI for reliable and respon- sible AI: From theory to practice. In Neural Information Processing Systems (NeurIPS) Tutorial, 2023. 2, 17

    2023

  45. [53]

    Yuille, and Cihang Xie

    Chen Wang, Angtian Wang, Junbo Li, Alan L. Yuille, and Cihang Xie. Benchmarking robustness in neural radiance fields. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2024 - Workshops, Seattle, WA, USA, June 17-18, 2024, pages 2926–2936. IEEE, 2024. 3

    2024

  46. [54]

    Yolov9: Learning what you want to learn using pro- grammable gradient information, 2024

    Chien-Yao Wang, I-Hau Yeh, and Hong-Yuan Mark Liao. Yolov9: Learning what you want to learn using pro- grammable gradient information, 2024. 3, 5, 6, 18, 20

    2024

  47. [55]

    Dpml- bench: Holistic evaluation of differentially private machine learning

    Chengkun Wei, Minghu Zhao, Zhikun Zhang, Min Chen, Wenlong Meng, Bo Liu, Yuan Fan, and Wenzhi Chen. Dpml- bench: Holistic evaluation of differentially private machine learning. In Proceedings of the 2023 ACM SIGSAC Con- ference on Computer and Communications Security, CCS 2023...

    2023

  48. [56]

    Feng, and Heng Huang

    Yihan Wu, Brandon Y . Feng, and Heng Huang. Shielding the unseen: Privacy protection through poisoning nerf with spatial deformation. CoRR, abs/2310.03125, 2023. 3

    2023 arXiv

  49. [57]

    Ultra-nerf: Neural radiance fields for ultrasound imaging

    Magdalena Wysocki, Mohammad Farid Azampour, Chris- tine Eilers, Benjamin Busam, Mehrdad Salehi, and Nassir Navab. Ultra-nerf: Neural radiance fields for ultrasound imaging. In Medical Imaging with Deep Learning, MIDL 2023, 10-12 July 2023, Nashville, TN, USA, pages 382–401. PM...

    2023

  50. [58]

    Dp-image: Differential privacy for image data in feature space, 2023

    Hanyu Xue, Bo Liu, Ming Ding, Tianqing Zhu, Dayong Ye, Li Song, and Wanlei Zhou. Dp-image: Differential privacy for image data in feature space, 2023. 2

    2023

  51. [59]

    Nerf-pytorch

    Lin Yen-Chen. Nerf-pytorch. https://github.com/ yenchenlin/nerf-pytorch/, 2020. 6, 17

    2020

  52. [60]

    Opacus: User- friendly differential privacy library in pytorch

    Ashkan Yousefpour, Igor Shilov, Alexandre Sablayrolles, Davide Testuggine, Karthik Prasad, Mani Malek, John Nguyen, Sayan Ghosh, Akash Bharadwaj, Jessica Zhao, Graham Cormode, and Ilya Mironov. Opacus: User- friendly differential privacy library in pytorch. CoRR, abs/2109.1229...

    2021 arXiv

  53. [61]

    Dataset obfuscation: Its applications to and impacts on edge machine learning

    Guangsheng Yu, Xu Wang, Ping Yu, Caijun Sun, Wei Ni, and Ren Ping Liu. Dataset obfuscation: Its applications to and impacts on edge machine learning. CoRR, abs/2208.03909,

    arXiv

  54. [62]

    Aggregated contextual transformations for high- resolution image inpainting, 2023

    Yanhong Zeng, Jianlong Fu, Hongyang Chao, and Bain- ing Guo. Aggregated contextual transformations for high- resolution image inpainting, 2023. 2, 3, 4, 5, 6, 18, 20

    2023

  55. [63]

    S 2nerf: Privacy- preserving training framework for nerf

    Bokang Zhang, Yanglin Zhang, Zhikun Zhang, Jinglan Yang, Lingying Huang, and Junfeng Wu. S 2nerf: Privacy- preserving training framework for nerf. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Com- munications Security, CCS 2024, Salt Lake City, UT, USA, O...

    2024

  56. [64]

    Efros, Eli Shecht- man, and Oliver Wang

    Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shecht- man, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In 2018 IEEE Con- ference on Computer Vision and Pattern Recognition, CVPR 2018, Salt Lake City, UT, USA, June 18-22, 2018, ...

    2018

  57. [65]

    On the conver- gence and mode collapse of GAN

    Zhaoyu Zhang, Mengyan Li, and Jun Yu. On the conver- gence and mode collapse of GAN. In SIGGRAPH Asia 2018 Technical Briefs, Tokyo, Japan, December 04-07, 2018, pages 21:1–21:4. ACM, 2018. 2, 18

    2018

  58. [66]

    Detrs beat yolos on real-time object detection, 2024

    Yian Zhao, Wenyu Lv, Shangliang Xu, Jinman Wei, Guanzhong Wang, Qingqing Dang, Yi Liu, and Jie Chen. Detrs beat yolos on real-time object detection, 2024. 3, 5, 6, 20

    2024

  59. [67]

    Privacy-preserving in medical image analysis: A re- view of methods and applications

    Yanming Zhu, Xuefei Yin, Alan Wee-Chung Liew, and Hui Tian. Privacy-preserving in medical image analysis: A re- view of methods and applications. CoRR, abs/2412.03924,

    arXiv

  60. [68]

    Context-aware full body anonymization using text-to-image diffusion models, 2024

    Pascal Zwick, Kevin R ¨osch, Marvin Klemp, and Oliver Bringmann. Context-aware full body anonymization using text-to-image diffusion models, 2024. 2, 3, 19 12 A. Appendix Organization This appendix provides supplementary details and addi- tional insights into various aspects o...

    2024

  61. [72]

    In contrast, Malm et al

    on differentially private imaging, where latent space manipulation is used to inject noise selectively, balancing privacy guarantees and data utility. In contrast, Malm et al

  62. [73]

    Maximov et al

    introduce the RAD framework, which integrates Sta- ble Diffusion with ControlNet for high-utility anonymiza- tion while preserving downstream model performance. Maximov et al. [31] propose CIAGAN, a conditional 18 identity anonymization GAN that allows controlled identity swap...

  63. [74]

    Our work differentiates from traditional anonymization techniques by adopting a data transformation strategy cen- tered on complete object removal

    explore text-to-image diffusion models to synthesize anonymized figures that integrate seamlessly into complex scenes. Our work differentiates from traditional anonymization techniques by adopting a data transformation strategy cen- tered on complete object removal. Instead of...

  64. [595]

    Computer Vision Foundation / IEEE Computer Society,

  65. [1338]

    1, 2, 3, 18, 20

    IEEE, 2023. 1, 2, 3, 18, 20

    2023

  66. [5059]

    Computer Vision Foundation / IEEE Computer Soci- ety, 2018. 2, 19

    2018

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.