PPEDCRF: Dynamic-CRF-Guided Selective Perturbation for Background-Based Location Privacy in Video Sequences

Bo Ma; Jinsong Wu; Weiqi Yan

arxiv: 2604.17163 · v1 · submitted 2026-04-18 · 💻 cs.CV

PPEDCRF: Dynamic-CRF-Guided Selective Perturbation for Background-Based Location Privacy in Video Sequences

Bo Ma , Weiqi Yan , Jinsong Wu This is my paper

Pith reviewed 2026-05-10 06:10 UTC · model grok-4.3

classification 💻 cs.CV

keywords location privacyvideo sequencesselective perturbationconditional random fieldbackground matchingretrieval attackGaussian noiseprivacy preservation

0 comments

The pith

Dynamic CRF guides selective Gaussian noise into location-sensitive video backgrounds, cutting retrieval accuracy while preserving higher quality than uniform noise.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper introduces PPEDCRF to defend background-based location privacy in released video frames against attackers who match visual cues to geo-tagged galleries. It uses a dynamic conditional random field to identify sensitive background regions, scales perturbation strength via a normalized control penalty, and adds calibrated Gaussian noise only inside those regions. Experiments on a paired-scene benchmark show this drops ResNet18 Top-1 retrieval accuracy from 0.667 to 0.361 at a chosen noise level while delivering 36.14 dB PSNR, roughly 6 dB better than noise applied everywhere. A sympathetic reader cares because the method lets videos be shared with lower geolocation risk without the broad quality penalty of global noise.

Core claim

PPEDCRF estimates location-sensitive background regions with a dynamic conditional random field, rescales perturbation strength with a normalized control penalty, and injects Gaussian noise only inside the inferred regions via a DP-style calibration rule. On a controlled paired-scene retrieval benchmark with eight attacker backbones and three noise seeds, PPEDCRF reduces ResNet18 Top-1 retrieval accuracy from 0.667 to 0.361±0.127 at σ₀=8 while preserving 36.14 dB PSNR, an approximate 6 dB quality advantage over global Gaussian noise. Transfer across the eight-backbone seed-averaged benchmark is broadly supportive, with matched-operating-point analysis showing that the practical benefit is a

What carries the argument

Dynamic conditional random field (DCRF) for estimating location-sensitive regions, combined with normalized control penalty (NCP) to scale and calibrate selective Gaussian perturbation.

Load-bearing premise

The dynamic CRF reliably segments location-sensitive background regions without excessive false negatives that leak privacy or false positives that degrade quality unnecessarily.

What would settle it

An attacker model or improved background segmentation that recovers retrieval accuracy near the original 0.667 level at the same σ₀=8 noise scale while the reported PSNR advantage disappears.

Figures

Figures reproduced from arXiv: 2604.17163 by Bo Ma, Jinsong Wu, Weiqi Yan.

**Figure 1.** Figure 1: A released video frame can be matched to a geo-tagged reference image through background cues even when explicit [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗

**Figure 2.** Figure 2: Overview of the PPEDCRF pipeline. A unary sensitive-region predictor produces per-frame logits, DCRF enforces [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗

**Figure 3.** Figure 3: Privacy–utility frontier. Lower retrieval accuracy means better privacy; higher PSNR means better visual utility. PPEDCRF [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗

**Figure 4.** Figure 4: Attacker-backbone and gallery-size sensitivity from the unified seed-averaged eight-backbone benchmark (three seeds), [PITH_FULL_IMAGE:figures/full_fig_p013_4.png] view at source ↗

**Figure 5.** Figure 5: Support-aware deterministic baseline sweep. Each point shows a blur kernel size ( [PITH_FULL_IMAGE:figures/full_fig_p015_5.png] view at source ↗

**Figure 6.** Figure 6: Qualitative visualization of PPEDCRF sanitization ( [PITH_FULL_IMAGE:figures/full_fig_p016_6.png] view at source ↗

**Figure 1.** Figure 1: Legacy detector-training curves from the original PPEDCRF pipeline. These curves are retained as auxiliary downstream-utility [PITH_FULL_IMAGE:figures/full_fig_p022_1.png] view at source ↗

**Figure 2.** Figure 2: Qualitative utility examples from the legacy segmentation pipeline. Sanitization changes background appearance while [PITH_FULL_IMAGE:figures/full_fig_p022_2.png] view at source ↗

read the original abstract

We propose PPEDCRF, a calibrated selective perturbation framework that protects \emph{background-based location privacy} in released video frames against gallery-based retrieval attackers. Even after GPS metadata are stripped, an adversary can geolocate a frame by matching its background visual cues to geo-tagged reference imagery; PPEDCRF mitigates this threat by estimating location-sensitive background regions with a dynamic conditional random field (DCRF), rescaling perturbation strength with a normalized control penalty (NCP), and injecting Gaussian noise only inside the inferred regions via a DP-style calibration rule. On a controlled paired-scene retrieval benchmark with eight attacker backbones and three noise seeds, PPEDCRF reduces ResNet18 Top-1 retrieval accuracy from 0.667 to $0.361\pm0.127$ at $\sigma_0=8$ while preserving $36.14\,$dB PSNR -- an ${\approx}6\,$dB quality advantage over global Gaussian noise. Transfer across the eight-backbone seed-averaged benchmark is broadly supportive (23 of 24 backbone-gallery cells show negative $\Delta$), while appendix-scale confirmation identifies MixVPR as a remaining adverse-transfer exception. Matched-operating-point analysis shows that PPEDCRF and global Gaussian noise converge in Top-1 privacy at equal utility, so the practical benefit is spatially concentrated perturbation that preserves higher visual quality at any given noise scale rather than stronger matched-utility privacy. Code: https://github.com/mabo1215/PPEDCRF

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Desk Editor's Note private letter to a colleague

PPEDCRF shows a selective Gaussian perturbation scheme that beats global noise on PSNR at matched retrieval drop, but the DCRF segmentation step has no reported accuracy numbers so the selectivity claim stays untested.

read the letter

The main takeaway is that this method applies noise only to inferred location-sensitive background regions and reports a roughly 6 dB PSNR gain over uniform Gaussian noise while cutting ResNet-18 top-1 retrieval accuracy from 0.667 to 0.361 on their paired-scene benchmark. The integration of a dynamic CRF for region estimation, a normalized control penalty for strength scaling, and a DP-style calibration rule is the concrete new piece; prior global or non-selective baselines do not do this combination on video frames for background geolocation attacks. The multi-backbone transfer results (23 of 24 cells negative delta) and the matched-utility analysis are useful additions, and the authors supply code, which helps verification of the end-to-end numbers. The central weakness is that no segmentation metrics appear for the DCRF itself—no IoU, no false-negative rate on geo-distinctive patches, no comparison against ground-truth location cues. Without those numbers it is impossible to tell whether the observed privacy gain comes from correct masking or simply from the chosen sigma_0=8 scale applied wherever the model happens to fire. The single adverse-transfer case with MixVPR is noted but not explored. The threat model is narrow (gallery-based background retrieval after GPS stripping), which is fine if stated clearly, but the paper does not show that the DCRF avoids both excessive leaks and unnecessary quality loss. This work is aimed at researchers building practical video privacy tools that preserve visual quality. A reader working on selective perturbation or location privacy in retrieval settings will find the benchmark and the quality-utility trade-off worth looking at. The empirical setup and code make it referee-ready; an editor should send it out, with the explicit request that reviewers check the missing DCRF validation numbers and the exact calibration rule.

Referee Report

2 major / 0 minor

Summary. The manuscript introduces PPEDCRF, a calibrated selective perturbation framework for protecting background-based location privacy in video frames against gallery-based retrieval attackers. It estimates location-sensitive background regions using a dynamic conditional random field (DCRF), rescales perturbation via a normalized control penalty (NCP), and injects Gaussian noise only inside the inferred regions according to a DP-style calibration rule. On a paired-scene retrieval benchmark with eight attacker backbones, PPEDCRF reduces ResNet18 Top-1 accuracy from 0.667 to 0.361±0.127 at σ₀=8 while preserving 36.14 dB PSNR (≈6 dB quality advantage over global Gaussian noise). Transfer results are largely supportive across backbones, with one adverse exception noted for MixVPR; matched-operating-point analysis indicates the benefit is higher visual quality at equivalent privacy rather than stronger privacy at matched utility.

Significance. If the central claims hold, this provides a practical method for spatially selective noise application that improves the privacy-utility tradeoff for location privacy in videos by preserving higher PSNR at given noise scales. Strengths include the multi-backbone empirical evaluation with transfer results, the public code release, and the explicit distinction between matched-utility privacy and quality gains.

major comments (2)

[Method section] Method section (DCRF description): No segmentation metrics (IoU, precision/recall, or false-negative rate on geo-distinctive regions) are reported for the DCRF. This is load-bearing for the central claim, as the observed drop in retrieval accuracy could arise from the noise scale σ₀=8 rather than accurate selective masking; without these metrics it is impossible to rule out excessive false negatives (privacy leaks) or false positives (eroded PSNR advantage).
[Experimental section] Experimental section (results and calibration): Training details for the DCRF, exact definition of the DP-style calibration rule, and error-bar methodology (for the ±0.127) are opaque. This prevents independent verification that the selective perturbation, rather than global effects, drives the reported 6 dB quality advantage and transfer behavior.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive and detailed feedback on our manuscript. We appreciate the emphasis on reproducibility and validation of the DCRF component. Below we provide point-by-point responses to the major comments. We will incorporate the requested clarifications and additional metrics in the revised version of the paper.

read point-by-point responses

Referee: [Method section] Method section (DCRF description): No segmentation metrics (IoU, precision/recall, or false-negative rate on geo-distinctive regions) are reported for the DCRF. This is load-bearing for the central claim, as the observed drop in retrieval accuracy could arise from the noise scale σ₀=8 rather than accurate selective masking; without these metrics it is impossible to rule out excessive false negatives (privacy leaks) or false positives (eroded PSNR advantage).

Authors: We agree that reporting segmentation metrics for the DCRF is necessary to substantiate that the privacy gains stem from accurate region selection rather than the global noise scale. The original submission prioritized end-to-end retrieval and PSNR results. In the revision we will add IoU, precision, recall, and false-negative rate on a held-out set of frames with manually annotated geo-distinctive background regions. These metrics will be computed against the DCRF outputs at the operating point used in the main experiments, directly addressing the concern about false negatives (potential privacy leaks) and false positives (impact on PSNR). revision: yes
Referee: [Experimental section] Experimental section (results and calibration): Training details for the DCRF, exact definition of the DP-style calibration rule, and error-bar methodology (for the ±0.127) are opaque. This prevents independent verification that the selective perturbation, rather than global effects, drives the reported 6 dB quality advantage and transfer behavior.

Authors: We apologize for the insufficient detail in these sections. In the revised manuscript we will expand the Method section to include: (i) complete training hyperparameters, optimizer settings, and dataset splits used for the DCRF; (ii) the exact mathematical formulation of the DP-style calibration rule, including the normalized control penalty (NCP) definition and the privacy-budget parameters that map σ₀ to per-region noise variance; and (iii) the error-bar methodology, which reports mean ± standard deviation over three independent noise-injection seeds. These additions will allow full reproduction of both the selective perturbation and the reported quality advantage. revision: yes

Circularity Check

0 steps flagged

No circularity; empirical results independent of inputs

full rationale

The paper defines PPEDCRF as a pipeline (DCRF segmentation + NCP rescaling + DP-calibrated Gaussian noise) and reports direct experimental outcomes on an external paired-scene retrieval benchmark across eight backbones. No equations are presented that equate the claimed Top-1 drop or PSNR advantage to a fitted parameter by construction, nor does any load-bearing premise reduce to a self-citation chain or ansatz smuggled from prior author work. The derivation chain consists of a proposed algorithm whose performance is measured against independent attacker models and utility metrics; the results are therefore falsifiable and not tautological.

Axiom & Free-Parameter Ledger

2 free parameters · 1 axioms · 2 invented entities

Ledger inferred from abstract components only; full paper would allow more precise extraction of fitted values and assumptions.

free parameters (2)

σ₀
Base noise scale parameter set to 8 for the reported operating point
NCP scaling factors
Parameters controlling normalized penalty for perturbation strength rescaling

axioms (1)

domain assumption Gaussian noise addition inside estimated regions provides meaningful protection against gallery-based visual retrieval
Invoked in the DP-style calibration rule and threat model

invented entities (2)

Dynamic Conditional Random Field (DCRF) no independent evidence
purpose: Estimating location-sensitive background regions
Core new component for selective perturbation
Normalized Control Penalty (NCP) no independent evidence
purpose: Rescaling perturbation strength to balance privacy and quality
Introduced to modulate noise injection

pith-pipeline@v0.9.0 · 5585 in / 1414 out tokens · 43171 ms · 2026-05-10T06:10:01.325887+00:00 · methodology

discussion (0)

Reference graph

Works this paper leans on

43 extracted references · 43 canonical work pages

[1]

Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. 2016. Deep Learning with Differential Privacy. InProceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS). ACM, New York, NY, USA, 308–318

work page 2016
[2]

Amar Ali-bey, Brahim Chaib-draa, and Philippe Giguère. 2023. MixVPR: Feature Mixing for Visual Place Recognition. InProceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (W ACV). IEEE, Waikoloa, HI, USA, 2998–3007

work page 2023
[3]

Miguel E Andrés, Nicolás E Bordenabe, Konstantinos Chatzikokolakis, and Catuscia Palamidessi. 2013. Geo-indistinguishability: Differential Privacy for Location-Based Systems. InProceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS). ACM, New York, NY, USA, 901–914

work page 2013
[4]

Relja Arandjelović, Petr Gronat, Akihiko Torii, Tomas Pajdla, and Josef Sivic. 2016. NetVLAD: Visual Place Recognition with Weakly Supervised Ranking Loss. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, Las Vegas, NV, USA, 5297–5306

work page 2016
[5]

Shai Avidan and Moshe Butman. 2007. Efficient methods for privacy preserving face detection. InAdvances in neural information processing systems. Curran Associates, Inc., Red Hook, NY, USA, 57–64

work page 2007
[6]

Borja Balle and Yu-Xiang Wang. 2018. Improving the Gaussian Mechanism for Differential Privacy: Analytical Calibration and Optimal Denoising. InInternational Conference on Machine Learning (ICML). PMLR, Stockholm, Sweden, 394–403

work page 2018
[7]

Gabriele Berton, Riccardo Mereu, Gabriele Trivigno, Carlo Masone, Gabriela Csurka, Torsten Sattler, and Barbara Caputo. 2022. Rethinking Visual Geo-localization for Large-Scale Applications. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, New Orleans, LA, USA, 4878–4888

work page 2022
[8]

Chamikara, P

M.A.P. Chamikara, P. Bertok, I. Khalil, D. Liu, and S. Camtepe. 2020. Privacy Preserving Face Recognition Utilizing Differential Privacy.Computers and Security97 (2020), 101951

work page 2020
[9]

Liang-Chieh Chen, George Papandreou, Iasonas Kokkinos, Kevin Murphy, and Alan L Yuille. 2017. Deeplab: Semantic image segmentation with deep convolutional nets, atrous convolution, and fully connected CRFs.IEEE Transactions on Pattern Analysis and Machine Intelligence40, 4 (2017), 834–848

work page 2017
[10]

2014.The Algorithmic Foundations of Differential Privacy

Cynthia Dwork and Aaron Roth. 2014.The Algorithmic Foundations of Differential Privacy. Foundations and Trends in Theoretical Computer Science, Vol. 9. Now Publishers, Hanover, MA, USA. 211–407 pages

work page 2014
[11]

Zekeriya Erkin, Martin Franz, Jorge Guajardo, Stefan Katzenbeisser, Inald Lagendijk, and Tomas Toft. 2009. Privacy-preserving face recognition. In International symposium on privacy enhancing technologies symposium. Springer, Springer, Berlin, Heidelberg, Germany, 235–253

work page 2009
[12]

Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and Harnessing Adversarial Examples. InInternational Conference on Learning Representations (ICLR). OpenReview.net, San Diego, CA, USA

work page 2015
[13]

Stephen Hausler, Sourav Garg, Ming Xu, Michael Milford, and Tobias Fischer. 2021. Patch-NetVLAD: Multi-Scale Fusion of Locally-Global Descriptors for Place Recognition. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, Nashville, TN, USA, 14141–14152

work page 2021
[14]

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep Residual Learning for Image Recognition. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, Las Vegas, NV, USA, 770–778

work page 2016
[15]

Håkon Hukkelås, Rudolf Mester, and Frank Lindseth. 2019. DeepPrivacy: A Generative Adversarial Network for Face Anonymization. InInternational Symposium on Visual Computing (ISVC). Springer, Cham, Switzerland, 565–578

work page 2019
[16]

Georgios A Kaissis, Marcus R Makowski, Daniel Rückert, and Rickmer F Braren. 2020. Secure, privacy-preserving and federated machine learning in medical imaging.Nature Machine Intelligence2 (2020), 305–311

work page 2020
[17]

Philipp Krähenbühl and Vladlen Koltun. 2011. Efficient Inference in Fully Connected CRFs with Gaussian Edge Potentials. InAdvances in Neural Information Processing Systems (NeurIPS). Curran Associates, Inc., Red Hook, NY, USA, 109–117

work page 2011
[18]

Yuancheng Li, Yimeng Wang, and Daoxing Li. 2019. Privacy-preserving lightweight face recognition.Neurocomputing363 (2019), 212–222

work page 2019
[19]

Yang Liu, Zhuo Ma, Ximeng Liu, Siqi Ma, and Kui Ren. 2022. Privacy-preserving object detection for medical images with faster R-CNN.IEEE Transactions on Information Forensics and Security17 (2022), 69–84. Manuscript submitted to ACM 18 Bo Ma, Weiqi Yan, and Jinsong Wu

work page 2022
[20]

Stephanie Lowry, Niko Sünderhauf, Paul Newman, John J Leonard, David Cox, Peter Corke, and Michael J Milford. 2016. Visual Place Recognition: A Survey.IEEE Transactions on Robotics32, 1 (2016), 1–19

work page 2016
[21]

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards Deep Learning Models Resistant to Adversarial Attacks. InInternational Conference on Learning Representations (ICLR). OpenReview.net, Vancouver, BC, Canada

work page 2018
[22]

Carlo Masone and Barbara Caputo. 2021. A Survey on Deep Visual Place Recognition.IEEE Access9 (2021), 19516–19547

work page 2021
[23]

Maxim Maximov, Ismail Elezi, and Laura Leal-Taixé. 2020. CIAGAN: Conditional Identity Anonymization Generative Adversarial Networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, Seattle, WA, USA, 5447–5456

work page 2020
[24]

Richard McPherson, Reza Shokri, and Vitaly Shmatikov. 2016. Defeating Image Obfuscation with Deep Learning.arXiv preprint arXiv:1609.00408 (2016). arXiv:1609.00408

work page Pith review arXiv 2016
[25]

Ilya Mironov. 2017. Rényi differential privacy. In2017 IEEE 30th Computer Security Foundations Symposium (CSF). IEEE, IEEE, Piscataway, NJ, USA, 263–275

work page 2017
[26]

Seong Joon Oh, Rodrigo Benenson, Mario Fritz, and Bernt Schiele. 2016. Faceless Person Recognition: Privacy Implications in Social Media. In European Conference on Computer Vision (ECCV). Springer, Cham, Switzerland, 19–35

work page 2016
[27]

José Ramón Padilla-López, Alexandros André Chaaraoui, and Francisco Flórez-Revuelta. 2015. Visual privacy protection methods: A survey.Expert Systems with Applications42, 9 (2015), 4177–4195

work page 2015
[28]

Francesco Pittaluga, Sanjeev J Koppal, Sing Bing Kang, and Sudipta N Sinha. 2019. Revealing Scenes by Inverting Structure from Motion Reconstructions. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, Long Beach, CA, USA, 145–154

work page 2019
[29]

Zhongzheng Ren, Yong Jae Lee, and Michael S Ryoo. 2018. Learning to anonymize faces for privacy preserving action detection. InEuropean Conference on Computer Vision. Springer, Cham, Switzerland, 620–636

work page 2018
[30]

Slobodan Ribaric, Aladdin Ariyaeeinia, and Nikola Pavesic. 2016. De-identification in multimedia content: A survey.Signal Processing: Image Communication47 (2016), 131–151

work page 2016
[31]

Proteek Chandan Roy and Vishnu Naresh Boddeti. 2019. Mitigating information leakage in image representations: A maximum entropy approach. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition. IEEE, Long Beach, CA, USA, 2586–2594

work page 2019
[32]

Reza Shokri, George Theodorakopoulos, Jean-Yves Le Boudec, and Jean-Pierre Hubaux. 2011. Quantifying Location Privacy. InIEEE Symposium on Security and Privacy (S&P). IEEE, Oakland, CA, USA, 247–262

work page 2011
[33]

Pablo Speciale, Johannes L Schonberger, Sing Bing Kang, Sudipta N Sinha, and Marc Pollefeys. 2019. Privacy preserving image-based localization. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. IEEE, Long Beach, CA, USA, 5493–5503

work page 2019
[34]

Qianru Sun, Liqian Ma, Seong Joon Oh, Luc Van Gool, Bernt Schiele, and Mario Fritz. 2018. Natural and Effective Obfuscation by Head Inpainting. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, Salt Lake City, UT, USA, 5050–5059

work page 2018
[35]

Akihiko Torii, Relja Arandjelović, Josef Sivic, Masatoshi Okutomi, and Tomas Pajdla. 2018. 24/7 place recognition by view synthesis.IEEE Transactions on Pattern Analysis and Machine Intelligence40, 2 (2018), 257–271

work page 2018
[36]

Han Wang, Shangyu Xie, and Yuan Hong. 2020. VideoDP: A Flexible Platform for Video Analytics with Differential Privacy.Proceedings on Privacy Enhancing Technologies2020, 4 (2020), 277–296

work page 2020
[37]

Yang Wang, Kia-Fock Loe, and Jian-Kang Wu. 2005. A dynamic conditional random field model for foreground and shadow segmentation.IEEE Transactions on Pattern Analysis And Machine Intelligence28, 2 (2005), 279–289

work page 2005
[38]

Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. 2004. Image quality assessment: from error visibility to structural similarity. IEEE Transactions On Image Processing13, 4 (2004), 600–612

work page 2004
[39]

Zhenyu Wu, Zhangyang Wang, Zhaowen Wang, and Hailin Jin. 2018. Towards Privacy-Preserving Visual Recognition via Adversarial Training: A Pilot Study. InProceedings of the European Conference on Computer Vision (ECCV). Springer, Cham, Switzerland, 606–624

work page 2018
[40]

Chugui Xu, Ju Ren, Deyu Zhang, Yaoxue Zhang, Zhan Qin, and Kui Ren. 2019. GANobfuscator: Mitigating information leakage under GAN via differential privacy.IEEE Transactions on Information Forensics and Security14, 9 (2019), 2358–2371

work page 2019
[41]

Shuai Zheng, Sadeep Jayasumana, Bernardino Romera-Paredes, Vibhav Vineet, Zhizhong Su, Dalong Du, Chang Huang, and Philip H S Torr. 2015. Conditional Random Fields as Recurrent Neural Networks. InIEEE International Conference on Computer Vision (ICCV). IEEE, Santiago, Chile, 1529–1537

work page 2015
[42]

Jizhe Zhou and Chi-Man Pun. 2020. Personal Privacy Protection via Irrelevant Faces Tracking and Pixelation in Video Live Streaming.IEEE Transactions on Information Forensics and Security16 (2020), 1088–1103. Manuscript submitted to ACM Appendix: PPEDCRF for Background-Based Location Privacy in Video Sequences ACM Reference Format: . 2026. Appendix: PPEDCR...

work page doi:10.1145/nnnnnnn.nnnnnnn 2020
[43]

Manuscript submitted to ACM Manuscript submitted to ACM 1 2 maximum 0.997). The selected hard distractors are not random negatives: the first 12 distractors used for the 24-way gallery average 0.919 maximum similarity to one of the paired locations, while all 36 distractors used for the 48-way gallery average 0.856 and the hardest distractor reaches 0.994...

work page 2000

[1] [1]

Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. 2016. Deep Learning with Differential Privacy. InProceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS). ACM, New York, NY, USA, 308–318

work page 2016

[2] [2]

Amar Ali-bey, Brahim Chaib-draa, and Philippe Giguère. 2023. MixVPR: Feature Mixing for Visual Place Recognition. InProceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (W ACV). IEEE, Waikoloa, HI, USA, 2998–3007

work page 2023

[3] [3]

Miguel E Andrés, Nicolás E Bordenabe, Konstantinos Chatzikokolakis, and Catuscia Palamidessi. 2013. Geo-indistinguishability: Differential Privacy for Location-Based Systems. InProceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS). ACM, New York, NY, USA, 901–914

work page 2013

[4] [4]

Relja Arandjelović, Petr Gronat, Akihiko Torii, Tomas Pajdla, and Josef Sivic. 2016. NetVLAD: Visual Place Recognition with Weakly Supervised Ranking Loss. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, Las Vegas, NV, USA, 5297–5306

work page 2016

[5] [5]

Shai Avidan and Moshe Butman. 2007. Efficient methods for privacy preserving face detection. InAdvances in neural information processing systems. Curran Associates, Inc., Red Hook, NY, USA, 57–64

work page 2007

[6] [6]

Borja Balle and Yu-Xiang Wang. 2018. Improving the Gaussian Mechanism for Differential Privacy: Analytical Calibration and Optimal Denoising. InInternational Conference on Machine Learning (ICML). PMLR, Stockholm, Sweden, 394–403

work page 2018

[7] [7]

Gabriele Berton, Riccardo Mereu, Gabriele Trivigno, Carlo Masone, Gabriela Csurka, Torsten Sattler, and Barbara Caputo. 2022. Rethinking Visual Geo-localization for Large-Scale Applications. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, New Orleans, LA, USA, 4878–4888

work page 2022

[8] [8]

Chamikara, P

M.A.P. Chamikara, P. Bertok, I. Khalil, D. Liu, and S. Camtepe. 2020. Privacy Preserving Face Recognition Utilizing Differential Privacy.Computers and Security97 (2020), 101951

work page 2020

[9] [9]

Liang-Chieh Chen, George Papandreou, Iasonas Kokkinos, Kevin Murphy, and Alan L Yuille. 2017. Deeplab: Semantic image segmentation with deep convolutional nets, atrous convolution, and fully connected CRFs.IEEE Transactions on Pattern Analysis and Machine Intelligence40, 4 (2017), 834–848

work page 2017

[10] [10]

2014.The Algorithmic Foundations of Differential Privacy

Cynthia Dwork and Aaron Roth. 2014.The Algorithmic Foundations of Differential Privacy. Foundations and Trends in Theoretical Computer Science, Vol. 9. Now Publishers, Hanover, MA, USA. 211–407 pages

work page 2014

[11] [11]

Zekeriya Erkin, Martin Franz, Jorge Guajardo, Stefan Katzenbeisser, Inald Lagendijk, and Tomas Toft. 2009. Privacy-preserving face recognition. In International symposium on privacy enhancing technologies symposium. Springer, Springer, Berlin, Heidelberg, Germany, 235–253

work page 2009

[12] [12]

Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and Harnessing Adversarial Examples. InInternational Conference on Learning Representations (ICLR). OpenReview.net, San Diego, CA, USA

work page 2015

[13] [13]

Stephen Hausler, Sourav Garg, Ming Xu, Michael Milford, and Tobias Fischer. 2021. Patch-NetVLAD: Multi-Scale Fusion of Locally-Global Descriptors for Place Recognition. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, Nashville, TN, USA, 14141–14152

work page 2021

[14] [14]

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep Residual Learning for Image Recognition. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, Las Vegas, NV, USA, 770–778

work page 2016

[15] [15]

Håkon Hukkelås, Rudolf Mester, and Frank Lindseth. 2019. DeepPrivacy: A Generative Adversarial Network for Face Anonymization. InInternational Symposium on Visual Computing (ISVC). Springer, Cham, Switzerland, 565–578

work page 2019

[16] [16]

Georgios A Kaissis, Marcus R Makowski, Daniel Rückert, and Rickmer F Braren. 2020. Secure, privacy-preserving and federated machine learning in medical imaging.Nature Machine Intelligence2 (2020), 305–311

work page 2020

[17] [17]

Philipp Krähenbühl and Vladlen Koltun. 2011. Efficient Inference in Fully Connected CRFs with Gaussian Edge Potentials. InAdvances in Neural Information Processing Systems (NeurIPS). Curran Associates, Inc., Red Hook, NY, USA, 109–117

work page 2011

[18] [18]

Yuancheng Li, Yimeng Wang, and Daoxing Li. 2019. Privacy-preserving lightweight face recognition.Neurocomputing363 (2019), 212–222

work page 2019

[19] [19]

Yang Liu, Zhuo Ma, Ximeng Liu, Siqi Ma, and Kui Ren. 2022. Privacy-preserving object detection for medical images with faster R-CNN.IEEE Transactions on Information Forensics and Security17 (2022), 69–84. Manuscript submitted to ACM 18 Bo Ma, Weiqi Yan, and Jinsong Wu

work page 2022

[20] [20]

Stephanie Lowry, Niko Sünderhauf, Paul Newman, John J Leonard, David Cox, Peter Corke, and Michael J Milford. 2016. Visual Place Recognition: A Survey.IEEE Transactions on Robotics32, 1 (2016), 1–19

work page 2016

[21] [21]

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards Deep Learning Models Resistant to Adversarial Attacks. InInternational Conference on Learning Representations (ICLR). OpenReview.net, Vancouver, BC, Canada

work page 2018

[22] [22]

Carlo Masone and Barbara Caputo. 2021. A Survey on Deep Visual Place Recognition.IEEE Access9 (2021), 19516–19547

work page 2021

[23] [23]

Maxim Maximov, Ismail Elezi, and Laura Leal-Taixé. 2020. CIAGAN: Conditional Identity Anonymization Generative Adversarial Networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, Seattle, WA, USA, 5447–5456

work page 2020

[24] [24]

Richard McPherson, Reza Shokri, and Vitaly Shmatikov. 2016. Defeating Image Obfuscation with Deep Learning.arXiv preprint arXiv:1609.00408 (2016). arXiv:1609.00408

work page Pith review arXiv 2016

[25] [25]

Ilya Mironov. 2017. Rényi differential privacy. In2017 IEEE 30th Computer Security Foundations Symposium (CSF). IEEE, IEEE, Piscataway, NJ, USA, 263–275

work page 2017

[26] [26]

Seong Joon Oh, Rodrigo Benenson, Mario Fritz, and Bernt Schiele. 2016. Faceless Person Recognition: Privacy Implications in Social Media. In European Conference on Computer Vision (ECCV). Springer, Cham, Switzerland, 19–35

work page 2016

[27] [27]

José Ramón Padilla-López, Alexandros André Chaaraoui, and Francisco Flórez-Revuelta. 2015. Visual privacy protection methods: A survey.Expert Systems with Applications42, 9 (2015), 4177–4195

work page 2015

[28] [28]

Francesco Pittaluga, Sanjeev J Koppal, Sing Bing Kang, and Sudipta N Sinha. 2019. Revealing Scenes by Inverting Structure from Motion Reconstructions. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, Long Beach, CA, USA, 145–154

work page 2019

[29] [29]

Zhongzheng Ren, Yong Jae Lee, and Michael S Ryoo. 2018. Learning to anonymize faces for privacy preserving action detection. InEuropean Conference on Computer Vision. Springer, Cham, Switzerland, 620–636

work page 2018

[30] [30]

Slobodan Ribaric, Aladdin Ariyaeeinia, and Nikola Pavesic. 2016. De-identification in multimedia content: A survey.Signal Processing: Image Communication47 (2016), 131–151

work page 2016

[31] [31]

Proteek Chandan Roy and Vishnu Naresh Boddeti. 2019. Mitigating information leakage in image representations: A maximum entropy approach. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition. IEEE, Long Beach, CA, USA, 2586–2594

work page 2019

[32] [32]

Reza Shokri, George Theodorakopoulos, Jean-Yves Le Boudec, and Jean-Pierre Hubaux. 2011. Quantifying Location Privacy. InIEEE Symposium on Security and Privacy (S&P). IEEE, Oakland, CA, USA, 247–262

work page 2011

[33] [33]

Pablo Speciale, Johannes L Schonberger, Sing Bing Kang, Sudipta N Sinha, and Marc Pollefeys. 2019. Privacy preserving image-based localization. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. IEEE, Long Beach, CA, USA, 5493–5503

work page 2019

[34] [34]

Qianru Sun, Liqian Ma, Seong Joon Oh, Luc Van Gool, Bernt Schiele, and Mario Fritz. 2018. Natural and Effective Obfuscation by Head Inpainting. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, Salt Lake City, UT, USA, 5050–5059

work page 2018

[35] [35]

Akihiko Torii, Relja Arandjelović, Josef Sivic, Masatoshi Okutomi, and Tomas Pajdla. 2018. 24/7 place recognition by view synthesis.IEEE Transactions on Pattern Analysis and Machine Intelligence40, 2 (2018), 257–271

work page 2018

[36] [36]

Han Wang, Shangyu Xie, and Yuan Hong. 2020. VideoDP: A Flexible Platform for Video Analytics with Differential Privacy.Proceedings on Privacy Enhancing Technologies2020, 4 (2020), 277–296

work page 2020

[37] [37]

Yang Wang, Kia-Fock Loe, and Jian-Kang Wu. 2005. A dynamic conditional random field model for foreground and shadow segmentation.IEEE Transactions on Pattern Analysis And Machine Intelligence28, 2 (2005), 279–289

work page 2005

[38] [38]

Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. 2004. Image quality assessment: from error visibility to structural similarity. IEEE Transactions On Image Processing13, 4 (2004), 600–612

work page 2004

[39] [39]

Zhenyu Wu, Zhangyang Wang, Zhaowen Wang, and Hailin Jin. 2018. Towards Privacy-Preserving Visual Recognition via Adversarial Training: A Pilot Study. InProceedings of the European Conference on Computer Vision (ECCV). Springer, Cham, Switzerland, 606–624

work page 2018

[40] [40]

Chugui Xu, Ju Ren, Deyu Zhang, Yaoxue Zhang, Zhan Qin, and Kui Ren. 2019. GANobfuscator: Mitigating information leakage under GAN via differential privacy.IEEE Transactions on Information Forensics and Security14, 9 (2019), 2358–2371

work page 2019

[41] [41]

Shuai Zheng, Sadeep Jayasumana, Bernardino Romera-Paredes, Vibhav Vineet, Zhizhong Su, Dalong Du, Chang Huang, and Philip H S Torr. 2015. Conditional Random Fields as Recurrent Neural Networks. InIEEE International Conference on Computer Vision (ICCV). IEEE, Santiago, Chile, 1529–1537

work page 2015

[42] [42]

Jizhe Zhou and Chi-Man Pun. 2020. Personal Privacy Protection via Irrelevant Faces Tracking and Pixelation in Video Live Streaming.IEEE Transactions on Information Forensics and Security16 (2020), 1088–1103. Manuscript submitted to ACM Appendix: PPEDCRF for Background-Based Location Privacy in Video Sequences ACM Reference Format: . 2026. Appendix: PPEDCR...

work page doi:10.1145/nnnnnnn.nnnnnnn 2020

[43] [43]

Manuscript submitted to ACM Manuscript submitted to ACM 1 2 maximum 0.997). The selected hard distractors are not random negatives: the first 12 distractors used for the 24-way gallery average 0.919 maximum similarity to one of the paired locations, while all 36 distractors used for the 48-way gallery average 0.856 and the hardest distractor reaches 0.994...

work page 2000