MultiPriv: Benchmarking Individual-Level Privacy Reasoning in Vision-Language Models

Hui Li; Jiaming Zhang; Kaili Liu; Ruxin Feng; Wei Yang Bryan Lim; Wen Jun Tan; Xiongtao Sun; Yujie Yang

REVIEW 4 major objections 5 minor 4 cited by

MultiPriv: Benchmarking Individual-Level Privacy Reasoning in Vision-Language Models

T0 review · 4 major / 5 minor · reviewed 2026-08-03 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Most current AI vision models can stitch scattered photos and documents—a face, a name, a card—into one person's profile, with top models succeeding over 80 percent of the time.

desk verdict Useful benchmark, credible measurements, but the threat headline outruns the evidence: synthetic-to-real transfer is asserted, not shown. read the letter →

arxiv 2511.16940 v3 pith:34V4ST5N submitted 2025-11-21 cs.CV cs.CR

Xiongtao Sun , Hui Li , Jiaming Zhang , Yujie Yang , Kaili Liu , Ruxin Feng , Wen Jun Tan , Wei Yang Bryan Lim This is my paper

classification cs.CVcs.CR

keywords privacyreasoningvision-languagemodelsindividualre-identificationchainedmultimodalperceptionsafetyalignmentPPRframework

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that individual-level privacy violation is no longer a hypothetical risk but a measurable, present-day capability of vision-language models. It argues that existing privacy benchmarks only test 'perception'—whether a model notices a phone number or a face in a single image—whereas the real risk is 'reasoning': whether a model can chain a face to a name, a name to an address, an address to a bank card, until the fragments resolve to one identified person. To make that threat measurable, the authors built MultiPriv, a bilingual (English and Chinese) benchmark of 40 synthetic individuals with internally consistent documents—ID cards, boarding passes, chest X-rays, vehicle registrations, bank cards—and nine tasks that escalate from attribute spotting to cross-modal identity linkage. Evaluated on more than 50 open-source and commercial models, 60% of widely used VLMs performed individual-level privacy reasoning, with the best model reaching an overall reasoning risk of 0.874 and 0.963 on cross-modal association. The paper's conclusion is that reasoning, not perception, drives privacy risk, and that current safety alignment is too uneven across models, languages, and task types to stop it.

What carries the argument

The load-bearing mechanism is the Privacy Perception and Reasoning (PPR) formalization: a perception function Φ that turns raw multimodal data into sensitive attributes, and a reasoning function Ψ that consolidates attributes into one identity using contextual logic. The derived risk score R_PPR—ε for unattached attributes, λ for identity-resolved ones—justifies the design: isolated attributes are low-risk, so a meaningful test must let attributes be controllably linked to identities. MultiPriv's 40 synthetic profiles do exactly that: each profile carries stable links (same name, face, fingerprint, address across an ID, boarding pass, vehicle registration, bank card, X-ray), so the intended

What would settle it

Re-run the nine tasks on realistically degraded documents—torn ID cards, low-resolution photos, mismatched or missing fields, rotated licenses—keeping the same ground-truth links and questions, and compare per-task accuracy. If cross-modal association and chained reasoning fall well below the paper's 0.80–0.96 range (toward refusal rates), the claim that individual-level privacy reasoning is a low-cost automated threat in practice would fail.

Watch

Extended reading notes

Core claim

On its own terms, the paper claims VLM privacy risk is two-stage: perception function Φ extracts sensitive attributes from raw input, and reasoning function Ψ links them to a single identity. Risk R_PPR is small when attributes point to no one, large when they resolve to a named person—so the benchmark's core question is whether Ψ succeeds. Empirically it does: across 50+ models, 60% of widely used VLMs perform individual-level privacy reasoning, with the best scoring 0.874 overall (0.878 chained, 0.963 cross-modal). The paper concludes the risk is intertwined with alignment—uneven across languages, tasks, and attribute types—making individual-level privacy violations low-cost automated capa

Load-bearing premise

The load-bearing premise is that the high accuracy measured on 40 clean, internally consistent synthetic profiles transfers to real-world fragmented data; if actual documents are noisy, partial, or contradictory, the headline threat level would not hold.

Editorial extensions

If this is right

Privacy evaluation should center reasoning, not perception: the same models score 0.35–0.47 on perception but 0.87–0.96 on reasoning tasks, so perception-only benchmarks systematically understate individual-level risk.
Model scale is not a proxy for risk: a 4B-parameter model (0.871) ties its 32B sibling (0.874) and beats a 72B model (0.632), so privacy risk must be measured behaviorally, not inferred from parameter count.
Reasoning effort interacts unpredictably with alignment: increasing reasoning effort raises one model family's privacy risk while pushing another to refuse about 69% of English tasks—so 'more reasoning' is neither uniformly safe nor uniformly risky.
Single-language audits miss leakage: identical samples get systematically different recognition and refusal in English versus Chinese (e.g., biometric recognition 0.83 vs 0.69), so one-language evaluations can hide a model's real threat level.
Alignment weakly covers the most dangerous operations: cross-modal association and re-identification—precisely the tasks that link attributes to identities—are refused far less often than explicit sensitive-attribute requests.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

How far the synthetic-measured accuracies transfer to real-world data is left open: the benchmark's 40 profiles are coherent by construction, so a naturalistic re-run on noisy, partial, or contradictory real documents would show whether the 0.80–0.96 range holds outside the lab.
The PPR risk formula has a legal corollary the paper leaves implicit: if data 'reasonably linked' to an individual counts as personal data under GDPR/CCPA, a model that scores high on Stage-II reasoning is arguably performing identity-linked processing, giving regulators a concrete hook on model outputs.
Cross-modal association is the paper's highest-scoring task (up to 0.963) and among the least refused, which singles it out as the most probable real-world attack surface—an adversary with one reference photo and some text gets maximum linkage with minimum resistance.
The paper's own Ch-2/Ch-3 failure data suggest errors accumulate at later links of a chain; a testable defense is data minimization—removing redundant consistent fields from document sets—and measuring whether models' reasoning accuracy collapses when one link is missing.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: this is a genuinely useful benchmark paper. The PPR framing is a real step beyond perception-only privacy evals, and the nine-task structure—especially chained reasoning and cross-modal association—gives you a controlled way to test whether a VLM can stitch fragments into an identity. The empirical core is credible: exact-string tasks (card/ID/plate numbers) score highest, semantic tasks use a human-reviewed LLM judge, and the GPT-5 reasoning-effort refusal pattern is a nice finding. The cross-lingual asymmetry results are interesting and worth chasing.

The soft spots are real but not fatal. The biggest is the synthetic-to-real transfer question, which the stress-test note nails: the 40 profiles are coherent by construction and the images are cleanly generated, so measured accuracies of 0.80–0.96 may not survive contact with scratched documents, OCR errors, or mismatched addresses. The paper doesn't have a dedicated limitations section, and the conclusion's 'low-cost automated capabilities' claim goes beyond what a synthetic benchmark supports. That said, it doesn't sink the benchmark's internal validity—it just means the threat statement should be tuned down to 'potential' until a real-world probe exists.

Other issues, in decreasing order: the corpus count is inconsistent (719 in the abstract vs 1,119 + 40×10 in §3.3); the '60% of widely used VLMs' headline has no defined threshold or model denominator; there's no human or random baseline to calibrate near-ceiling scores; and several source datasets (CC BY-NC-ND, All Rights Reserved) look incompatible with redistribution, so the release may need a license audit. None of these are load-bearing—the tables stand on their own—but they should be fixed before this is citable.

Bottom line: this deserves a serious referee. It's a solid contribution to the privacy-benchmark literature and a basis for follow-up work on real-world transfer. I'd send it to review and ask the authors to address the transfer limitation, clean up the numbers, and define the headline statistic.

Referee Report

4 major / 5 minor

Summary. This paper introduces MultiPriv, a bilingual (English/Chinese) vision-language benchmark for evaluating 'Privacy Perception and Reasoning' (PPR). The authors construct 40 synthetic individual profiles that link direct identifiers (faces, names, ID numbers) to sensitive attributes (health, finance, location, etc.) across 36 fine-grained attribute subcategories, and they define nine VQA-style tasks covering perception (recognition, extraction, localization) and reasoning (single-step, chained, re-identification, cross-modal association). They evaluate 5 commercial and over 30 open-source VLMs and report that reasoning-capable models achieve high reasoning-risk scores—e.g., Qwen3-VL-32B-Thinking at 0.874 overall and Gemini-2.5-Flash at 0.825—and interpret this as evidence that VLMs can reconstruct individual profiles from fragmented multimodal data, with the abstract claiming that 60% of widely used VLMs can perform individual-level privacy reasoning with up to 80% accuracy. The paper also analyzes refusal rates, cross-lingual alignment, and the effect of reasoning effort.

Significance. MultiPriv addresses a real gap: existing VLM privacy benchmarks mostly test perception or refusal, not linkage-based inference across images and modalities. The synthetic-profile design is a defensible way to control ground truth while avoiding real PII, and it enables chained-reasoning tasks that are largely missing from prior work. The evaluation is unusually broad, and the paper is transparent about verification (hybrid human-reviewed LLM judging, App. 10) and about refusals (§14, Appendix 14). The Stage-I/Stage-II threat distinction and the PPR formalization are useful conceptual contributions. If the headline numbers are accurate, MultiPriv provides an upper-bound capability measurement with practical relevance. However, the threat conclusion currently overreaches in several specific ways detailed below: the reasoning prompts conflict with the 'no explicit CoT' claim, the 60% headline lacks a clear denominator and threshold, and the synthetic-to-real transfer is asserted rather than tested.

major comments (4)

[§4.1 and App. 15] The claim that models are evaluated 'without any explicit chain-of-thought (CoT) instructions' (§4.1) is contradicted by the prompts in App. 15: the Chained Reasoning prompt asks the model to 'Please provide your complete reasoning process,' and Single-step Reasoning and Cross-modal Association prompts ask for 'your reasoning process.' For thinking-enabled models (Qwen3-VL-Thinking, GPT-5, etc.), these requests can differentially activate reasoning effort and inflate the measured reasoning scores. Please clarify what 'no explicit CoT' means, show the exact prompts used in the main evaluation, and either report an answer-only condition or soften the claims about measured reasoning capability.
[Abstract and Table 4] The headline '60% of widely used VLMs can perform individual-level privacy reasoning with up to 80% accuracy' is not supported by a defined denominator or threshold. Table 4 reports reasoning risk for 18 reasoning-capable models (13 open-source, 5 commercial), not for the 'over 50' VLMs mentioned elsewhere. If the criterion is overall reasoning risk ≥ 0.8, then 11/18 of this subset (≈61%) qualify, but the subset is not 'widely used VLMs' generally; most evaluated models were not scored on these multi-image reasoning tasks. The phrase 'up to 80%' also conflicts with Table 4's top overall score of 0.874. Please specify the threshold and denominator explicitly and state the headline as applying to the reasoning-capable subset, or justify the broader claim with additional data.
[§3.3, §7, and §5] The central threat conclusion ('Advances in Vision–Language Models have turned individual-level privacy violations from high-effort human inference into low-cost automated capabilities,' §5) extrapolates from a purely synthetic, internally coherent benchmark. The 40 profiles in §3.3 and the synthesis pipeline in §7 are constructed so that cross-document links (name/address/ID/card/plate/X-ray) are mutually consistent, and images are generated or edited to match. The paper provides no evidence that this distribution resembles real fragmented records—scratched or partially redacted documents, OCR noise, address variants, ambiguous face crops—so the measured accuracies (0.80–0.96 in Table 4) may be an upper bound that does not transfer. This is not a circularity objection; it is a missing-evidence problem for the real-world threat claim. Please add a robustness experiment (e.g., perturbing
[§3.5 vs. §13.1 and Table 3] The aggregate perception score is defined inconsistently. §3.5 says 'Aggregate Perception Risk is the bilingual mean of F1 and IEA, with mIoU reported separately,' while §13.1 says the Overall Perception Score is the bilingual mean of recognition, extraction, and localization. Table 3's overall column is only reproducible if mIoU is included (e.g., QvQ-72B: (0.568+0.573+0.22)/3 = 0.454). This ambiguity affects the perception-risk values used in the §4.2 analysis and should be reconciled.

minor comments (5)

[Intro, §3.3, Fig. 2] The dataset size is inconsistent: the Introduction and Figure 2 say 719 images, while §3.3 says 1,119 images (719 attribute-level images plus 40×10 individual-level images). Please clarify the total and the per-level counts in one place.
[App. 12] There is a broken cross-reference ('Table ??') in Appendix 12. This should be fixed before publication.
[Table 11] The column header 'Single-Extra' in Table 11 appears to be a typo, likely for 'Sin-Rea' (single-step reasoning). Please correct.
[References and Table 8] LLaMA-4 Scout/Maverick are cited to Touvron et al. (2023), which is the LLaMA-1/2 paper; cite the correct Llama 4 model report. The commercial model listed as 'Claude Sonnet 4' in the text appears as 'Claude Sonnet 4.5' in Table 8; the naming should be consistent.
[Throughout] Consider reporting confidence intervals or per-task sample sizes. With 40 profiles and 7,414 VQA pairs, aggregate scores may have nontrivial uncertainty, especially for the 18-model reasoning subset.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: MultiPriv is an empirical benchmark with pre-defined ground-truth labels; the headline accuracy is a measurement, not a fit-based prediction, and no load-bearing self-citation is used.

full rationale

MultiPriv is a measurement paper, not a derivation. The central claim that 60% of VLMs can perform individual-level privacy reasoning with up to 80% accuracy is obtained by running fixed, publicly deployed models on a fixed dataset whose ground-truth labels were constructed before evaluation (Sec. 3.3, Sec. 7, Sec. 9). No model parameter is fitted to a subset of the data and then used to 'predict' a closely related quantity; no equation in the paper makes a predicted output equal to an input by construction. The PPR formalization (Eqs. 1-3) defines a threat taxonomy but does not derive the empirical accuracies from its own definitions. The use of expected reasoning chains (Sec. 9) and an LLM-assisted verification prompt (Sec. 10) is a construct-validity issue: correctness is defined as agreement with the authors' pre-defined expected steps, and the corresponding tasks are those where the ground truth is semantically interpreted. This is not circular because the ground truth is not defined in terms of the evaluated models' outputs, and the LLM judgments are reviewed by human experts rather than being the sole criterion. The synthetic-to-real transfer question (Sec. 7's 'coherent personal profiles' vs. noisy real fragments) is an external-validity limitation, not a circularity, and the paper itself does not claim a formal derivation from first principles. No load-bearing self-citations are present; cited prior benchmarks are distinct works. Accordingly, no circular step meets the required standard of exhibiting a specific reduction by construction.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

No fitted numerical parameters appear in the paper; the two free parameters below are hand-chosen design choices (equal metric weighting) and an undefined headline threshold. The load-bearing premise is axiom 2 (synthetic-to-real transferability), which is structurally distinct from the capability claim itself. Axioms 1 and 3 are domain assumptions about legal grounding and judge reliability; axiom 4 is the disclosed scoring policy; axiom 5 is plain notation. No invented entities (no new particles, forces, or conserved quantities).

free parameters (2)

Overall-risk aggregation weights = equal weights (bilingual means; F1+IEA+mIoU for perception; four task metrics for reasoning)
Hand-chosen equal weighting with no sensitivity analysis; rank ordering of models and the headline 'risk' numbers change under alternative weights (e.g., dropping mIoU for models without localization capability).
Threshold behind the '60% of VLMs' headline = unstated
The abstract's 60% figure requires a threshold (what reasoning score counts as 'can perform privacy reasoning') and a denominator (which of the 53 models are 'widely used'); neither is specified in the text.

assumptions (5)

domain assumption GDPR/CCPA 'reasonably linked to an individual' definitions justify treating attribute-linkage as the privacy harm to measure
Section 3 (intro) and Table 1 anchor the benchmark in legal definitions; the linkability-as-harm premise is a legal/policy choice, and the benchmark operationalizes it.
domain assumption Scores on perfectly consistent synthetic profiles are indicative of real-world individual-level privacy threat
Section 3.3/7: profiles are constructed so all cross-document links are stable and consistent; no evidence that this distribution matches adversarial real-world fragmented data; the threat conclusion (Abstract, §5) rides on this transfer.
domain assumption LLM-judge verification (human-reviewed) yields unbiased correctness labels for semantically ambiguous tasks
Section 10: 'large language models are prompted to provide an initial correctness judgment, which is then reviewed and confirmed by human experts'; judge bias would propagate into all semantic-task scores.
domain assumption Scoring refusals as failures, while reporting them separately, yields an interpretable privacy-risk measure
Section 3.1 and §13: refusal-as-failure conflates capability and alignment in the headline 'Overall Risk' numbers; authors disclose and report refusals separately (App 14), but the aggregate still mixes the two.
standard math Standard set-theoretic notation for Φ, Ψ, R_PPR is a faithful formalization of privacy perception/reasoning
Section 3.2: the formalism is definitional composition of functions; no deep mathematics is invoked.

how reviews work

0 comments

Cite this review

Pith. "Pith review of MultiPriv: Benchmarking Individual-Level Privacy Reasoning in Vision-Language Models." pith.science (2026). https://pith.science/paper/34V4ST5N

@misc{pith2026251116940,
  author       = {Pith},
  title        = {Pith review of: MultiPriv: Benchmarking Individual-Level Privacy Reasoning in Vision-Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/34V4ST5N}},
  note         = {Machine review of arXiv:2511.16940}
}

read the original abstract

Modern Vision-Language Models (VLMs) pose significant individual-level privacy risks by linking fragmented multimodal data to identifiable individuals through hierarchical chain-of-thought reasoning. However, existing privacy benchmarks remain structurally insufficient for this threat, as they primarily evaluate privacy perception while failing to address the more critical risk of privacy reasoning: a VLM's ability to infer and link distributed information to construct individual profiles. To address this gap, we propose MultiPriv, the first benchmark designed to systematically evaluate individual-level privacy reasoning in VLMs. We introduce the Privacy Perception and Reasoning (PPR) framework and construct a bilingual multimodal dataset with synthetic individual profiles, where identifiers, such as faces and names, are linked to sensitive attributes. This design enables nine challenging tasks spanning attribute detection, cross-image re-identification, and chained inference. We conduct a large-scale evaluation of over 50 open-source and commercial VLMs. In our controlled benchmark, 60% of widely used VLMs can perform individual-level privacy reasoning with up to 80% accuracy, suggesting a significant potential threat to personal privacy. The benchmark is available at https://github.com/CyberChangAn/MultiPriv-PII.

Figures

Figures reproduced from arXiv: 2511.16940 by the authors.

**Figure 1.** Individual-level privacy leakage via PPR. RVLMs escalate privacy risks by transitioning from (1) Privacy Perception, which extracts discrete attributes from unstructured data, to (2) Privacy Reasoning, which aggregates these fragments into a consolidated identity profile [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗

**Figure 2.** MultiPriv task overview. The MultiPriv benchmark decomposes privacy perception and reasoning into nine subtasks, with representative VQA examples for each category shown in the figure. The dataset includes 36 privacy attributes across 40 individual profiles, 719 images, and 7,414 manually designed VQA pairs. Additional examples are provided in the appendix [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** Privacy Taxonomy and Definition. MultiPriv defines a comprehensive privacy taxonomy, covering 36 fine-grained privacy attributes grouped into 7 major categories: Biometric, Identity Document, Medical Health, Financial Account, Location Trajectory, Property Identity, and Social Attributes. Science and Engineering, 2016; tapakah68, 2025; bond007, 2025; Demner-Fushman et al., 2016; Li et al., 2024). To support priva… view at source ↗

Figures from the paper (11 more)

**Figure 4.** Figure 4: MultiPriv VLMs refusal distribution. Panels (a) and (b) show the top 3 and bottom 3 models in terms of refusal rates on privacy perception and reasoning tasks, respectively. Panels (c) and (d) depict refusal distributions across different MultiPriv tasks and privacy …

**Figure 5.** Figure 5: MultiPriv privacy alignment boundaries across languages. Privacy alignment boundaries for implicit attributes (a) and models (b) in Chinese and English. in English. Such non-monotonic fluctuations indicate that multilingual alignment does not ensure consistent privacy…

**Figure 6.** Figure 6: Examples of MultiPriv dataset at attribute-level and individual-level. The figure shows representative privacy data from our MultiPriv dataset. The attribute-level data covers 7 major categories: Biometric, Identity Document, Medical Health, Financial Account, Location…

**Figure 7.** Figure 7: Chained Reasoning Task Creation Workflow. This figure illustrates the multi step process for creating chained reasoning tasks including Step 1 generating synthetic individual level profiles, Step 2 formulating multi step reasoning questions that require integrating mul…

**Figure 8.** Figure 8: Top PII information missed or falsely perceived by VLMs in English and Chinese contexts. Panels (a) and (b) show the PII information that is most frequently missed in English and Chinese contexts, respectively, on privacy perception tasks. Panels (c) and (d) depict t…

**Figure 9.** Figure 9: Examples of Direct and Indirect Identifier Recognition from MultiPriv. Yes, the itinerary is specific location activity route, the event is scheduled for WED 23 AUG 2006 8:30PM, the event will be held at SYDNEY OPERA HOUSE, seating information SECTION/AISLE GA, ROWBOX …

**Figure 10.** Figure 10: Privacy Information Extraction on Trajectory and Geolocation Data. 25 [PITH_FULL_IMAGE:figures/full_fig_p025_10.png]

**Figure 11.** Figure 11: Privacy Region Localization on License Plates and Bank Cards. Through fingerprint matching, the fingerprint image is consistent with the ID photo. Conclusion: No disease was detected. \n Logic: The report states "Diagnosis: Normal chest X-ray", and describes no abnorm…

**Figure 12.** Figure 12: Examples of Single-step Cross-Validation and Single-step Reasoning. 26 [PITH_FULL_IMAGE:figures/full_fig_p026_12.png]

**Figure 13.** Figure 13: Examples of Re-identification, Linkability, and Cross-modal Association. "expected_reasoning": [{"step": 1,"source": "B.png, F.png","logic": "In all records containing address information, find the identity information that matches the given address '1234 Maple Avenue…

**Figure 14.** Figure 14: Examples of Chained Reasoning. 27 [PITH_FULL_IMAGE:figures/full_fig_p027_14.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 4 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

How Far Are VLMs from Privacy Awareness in the Physical World? An Empirical Study
cs.CR 2026-05 unverdicted novelty 6.0 of 10

VLMs show consistent deficits in identifying sensitive items in cluttered scenes, adapting to social contexts, and resolving conflicts between commands and privacy constraints in a new physical simulator benchmark.
How Far Are VLMs from Privacy Awareness in the Physical World? An Empirical Study
cs.CR 2026-05 unverdicted novelty 6.0 of 10

Vision-language models exhibit perceptual fragility and fail to consistently respect privacy constraints when operating in simulated physical environments, with performance declining in cluttered scenes and under conf...
Safactory: A Scalable Agentic Infrastructure for Training Trustworthy Autonomous Intelligence
cs.AI 2026-05 unverdicted novelty 4.0 of 10

Safactory integrates three platforms for simulation, data management, and agent evolution to create a unified pipeline for training trustworthy autonomous AI.
Safactory: A Scalable Agentic Infrastructure for Training Trustworthy Autonomous Intelligence
cs.AI 2026-05 unverdicted novelty 3.0 of 10

Safactory combines parallel simulation, trustworthy data management, and asynchronous evolution platforms into a single pipeline claimed to be the first unified framework for trustworthy autonomous agents.

Reference graph

Works this paper leans on

5 extracted references · 4 linked inside Pith · cited by 2 Pith papers

[1]

"The image contains indirect identifiers such as barcodes, postal codes, and reference numbers like \

**Phone Number**\n 2. **Postal Address**\n 3. **Postal Code (Zip Code)**\n 4. **Date and Time of Shipment**\n 5. **Signature (Handwritten)**\n 6. **Tracking Number / Barcode**\n 7. **Company Name (Sender)**\n 8. **Item Description**\n 9. **Weight and Dimensions**\n 10. **Payment Method**\n "The image contains indirect identifiers. The types are:\n\n1. Pho...

2014
[2]

Gemini 2.5: Pushing the frontier with ad- vanced reasoning, multimodality, long context, and 9 next generation agentic capabilities.arXiv preprint arXiv:2507.06261. d1oxf. 2025. Mobile-captured pharmaceutical medica- tion packages. Wenliang Dai, Junnan Li, Dongxu Li, Anthony Tiong, Junqi Zhao, Weisheng Wang, Boyang Li, Pascale N Fung, and Steven Hoi. 2023...

arXiv 2025
[2017]

correct\

Towards a visual privacy advisor: Understand- ing and predicting privacy risks in images. InPro- ceedings of the IEEE international conference on computer vision, pages 3686–3695. Prasad. 2023. Healthcare dataset. Roboflow. 2023. Mainland id card dataset. Laurens Samson, Nimrod Barazani, Sennay Ghebreab, and Yuki M Asano. 2024. Privacy-aware visual lan- g...

arXiv 2023
[2019]

InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 939–948

Vizwiz-priv: A dataset for recognizing the presence and purpose of private visual information in images taken by blind people. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 939–948. Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Os- trow, Akila Welihinda, Alan Hayes, Alec...

arXiv 2024
[2025]

China Computer Federation

Sft or rl? an early investigation into training r1- like reasoning large vision-language models.arXiv preprint arXiv:2504.11468. China Computer Federation. 2022. Ccf privacy detec- tion dataset v2. Gheorghe Comanici, Eric Bieber, Mike Schaekermann, Ice Pasupat, Noveen Sachdeva, Inderjit Dhillon, Mar- cel Blistein, Ori Ram, Dan Zhang, Evan Rosen, et al

arXiv 2022

Pith tools

Reviewed August 3, 2026 · model on record in the stance chip above.

[1] [1]

"The image contains indirect identifiers such as barcodes, postal codes, and reference numbers like \

**Phone Number**\n 2. **Postal Address**\n 3. **Postal Code (Zip Code)**\n 4. **Date and Time of Shipment**\n 5. **Signature (Handwritten)**\n 6. **Tracking Number / Barcode**\n 7. **Company Name (Sender)**\n 8. **Item Description**\n 9. **Weight and Dimensions**\n 10. **Payment Method**\n "The image contains indirect identifiers. The types are:\n\n1. Pho...

2014

[2] [2]

Gemini 2.5: Pushing the frontier with ad- vanced reasoning, multimodality, long context, and 9 next generation agentic capabilities.arXiv preprint arXiv:2507.06261. d1oxf. 2025. Mobile-captured pharmaceutical medica- tion packages. Wenliang Dai, Junnan Li, Dongxu Li, Anthony Tiong, Junqi Zhao, Weisheng Wang, Boyang Li, Pascale N Fung, and Steven Hoi. 2023...

arXiv 2025

[3] [2017]

correct\

Towards a visual privacy advisor: Understand- ing and predicting privacy risks in images. InPro- ceedings of the IEEE international conference on computer vision, pages 3686–3695. Prasad. 2023. Healthcare dataset. Roboflow. 2023. Mainland id card dataset. Laurens Samson, Nimrod Barazani, Sennay Ghebreab, and Yuki M Asano. 2024. Privacy-aware visual lan- g...

arXiv 2023

[4] [2019]

InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 939–948

Vizwiz-priv: A dataset for recognizing the presence and purpose of private visual information in images taken by blind people. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 939–948. Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Os- trow, Akila Welihinda, Alan Hayes, Alec...

arXiv 2024

[5] [2025]

China Computer Federation

Sft or rl? an early investigation into training r1- like reasoning large vision-language models.arXiv preprint arXiv:2504.11468. China Computer Federation. 2022. Ccf privacy detec- tion dataset v2. Gheorghe Comanici, Eric Bieber, Mike Schaekermann, Ice Pasupat, Noveen Sachdeva, Inderjit Dhillon, Mar- cel Blistein, Ori Ram, Dan Zhang, Evan Rosen, et al

arXiv 2022