forekondy,schiele,[email protected] - arxiv · vacy tasks are images revealing private details...
TRANSCRIPT
Towards a Visual Privacy Advisor:Understanding and Predicting Privacy Risks in Images
Tribhuvanesh Orekondy Bernt Schiele Mario Fritz
Max Planck Institute for InformaticsSaarland Informatics Campus
Saabrucken, Germany{orekondy,schiele,mfritz}@mpi-inf.mpg.de
Abstract
With an increasing number of users sharing informationonline, privacy implications entailing such actions are amajor concern. For explicit content, such as user profileor GPS data, devices (e.g. mobile phones) as well as webservices (e.g. facebook) offer to set privacy settings in orderto enforce the users’ privacy preferences.
We propose the first approach that extends this conceptto image content in the spirit of a Visual Privacy Advisor.First, we categorize personal information in images into 68image attributes and collect a dataset, which allows us totrain models that predict such information directly from im-ages. Second, we run a user study to understand the privacypreferences of different users w.r.t. such attributes. Third,we propose models that predict user specific privacy scorefrom images in order to enforce the users’ privacy prefer-ences. Our model is trained to predict the user specific pri-vacy risk and even outperforms the judgment of the users,who often fail to follow their own privacy preferences onimage data.
1. IntroductionAs more people obtain access to the internet, a large
amount of personal information becomes accessible to e.g.other users, web service providers and advertisers. Tocounter these problems, more and more devices (e.g. mobilephone) and web services (e.g. facebook) are equipped withmechanisms where the user can specify privacy settings tocomply with his/her personal privacy preference.
While this has proven useful for explicit and textual in-formation, we ask how this concept can generalize to vi-sual content. While users can be asked (as we also do inour study) to specify how comfortable they are releasing acertain type of image content, the actual presence of such
credit card,face, gender,skin colour, ...
User Judgment
Visual Privacy Advisor
PrivacyAttributes
PrivacyPreferences
PrivacyRisk
Figure 1: Users often fail to enforce their privacy prefer-ences when sharing images online. We propose a first VisualPrivacy Advisor to provide user-specific privacy feedback.
content is implicit in the image and not readily available fora privacy preference enforcing mechanism nor the user. Infact – as our study shows – people frequently misjudge theprivacy relevant information content in an image – whichleads to the failure of enforcing their own privacy prefer-ences.
Hence, we work towards a Visual Privacy Advisor (Fig-ure 1) that helps users enforce their privacy preferences andprevents leakage of private information. We approach thiscomplex problem by first making personal information ex-plicit by categorizing personal information into 68 imageattributes. Based on such attribute predictions and user pri-vacy preferences, we infer a privacy score that can be usedto prevent unintentional sharing of information. Our modelis trained to predict the user specific privacy risk and inter-estingly, it outperforms human judgment on the same im-ages.
Our main contributions in this paper are as follows:(i) To the best of our knowledge, we are the first to formu-late the problem of identifying a diverse set of personal in-formation in images and personalizing predictions to usersbased on their privacy preferences (ii) We provide a sizable
1
arX
iv:1
703.
1066
0v2
[cs
.CV
] 7
Aug
201
7
dataset1 of 22k images annotated with 68 privacy attributes(iii) We conduct a user study and analyze the diversity ofusers’ privacy preferences as well as the level to which theyachieve to follow their privacy preferences on image data(iv) We propose the first model for Privacy Attribute Pre-diction. We also extend it to directly estimate user-specificprivacy risks (v) Finally, we show that our models outper-form users in following their own privacy preferences onimages
2. Related WorkPrivacy is becoming an increasing concern [48, 10], es-
pecially due to the rise of social networking websites al-lowing individuals to share personal information, withoutexplaining consequences of these actions. In this section,we discuss work that highlights these concerns and exploresconsequences of such actions. We also discuss literaturethat deals with identifying private content in images andtext.
Identifying Personal Information There is a compa-rably small body of work that aims to recognize personalinformation. Aura et al. [3] explore this in the context ofelectronic documents, where they propose a tool to removeuser names, identifiers, organization names and other pri-vate information from text-based documents with metadata.[5, 13] study this in the context of textual email-content.Bier et al. [5] model this as a privacy-classification problem,whereas Geng et al. [13] detect four types of personal in-formation – email addresses, telephone numbers, addressesand money. The closest related work to ours is [42], who arealso motivated by unwanted disclosure and privacy viola-tion on social media. They approach the task as classifyingif an image is public or private based on features extractedfrom a Convolutional Neural Network and user-generatedtags for the image. However, we later show that users havedifferent notions of privacy and hence cannot be modeledas a binary classification problem. Instead, we first tackle amore principled problem of predicting the privacy-sensitiveelements present in images and use these in combinationwith users preferences to estimate privacy risk.
Leakage and De-anonymization A problem closely re-lated to ours is privacy leakage, which deals with uncov-ering and analyzing methods leading to disclosure of per-sonal information, rather than detection before such inci-dents. [24, 22] uncover privacy leakage when websites ac-cidentally provide user information embedded in HTTP re-quests when contacting third-party aggregators. As leak-ages can be user-intended, Yang et al. [47] explore this casein Android applications. Some works [32, 43] study thecase where users identity, location or other details can be
1Refer to project website: https://tribhuvanesh.github.io/vpa/
de-anonymized when aggregating anonymized data acrossmultiple social networks. In contrast to these, our approachis concerned about image content and privacy preferences.
Privacy Preferences and Social Networks [26, 14, 23]study types of personal information disclosed on social net-working websites. Other tasks include preserving one’s pri-vacy while using social networks [15, 52, 27] and explor-ing privacy settings [11, 8, 28]. However in our user study,apart from collecting and analyzing user studies on privacypreferences for images, we additionally use them to trainmodels based on image data.
Privacy and Computer Vision Several works exploredetecting individual privacy attributes such as license plates[53, 49, 6], age estimation from facial photographs [4], so-cial relationships [45], face detection [40, 44], landmark de-tection [51] and occupation recognition [39]. Apart fromdetecting attributes, some works introduce new privacychallenges in vision such as adversarial perturbations [31,35], privacy-preserving video capture [1, 36, 33, 37], personre-identification [2, 30], avoiding face detection [46, 16],full body re-identification [34] and privacy-sensitive lifel-ogging [18, 20]. In this work, we present a new challengein computer vision designed to help users assess privacy riskbefore sharing images on social media that encompasses abroad range of personal information in a single study.
Datasets for Privacy Tasks Crucial to exploring pri-vacy tasks are images revealing private details such as faces,names or opinions. However, many available datasets donot contain a significant number of such images to effec-tively study privacy tasks. Although some datasets [12]contain such information, they are either too small or notrepresentative of images on social networks. The closestcandidate is the PIPA dataset [50] with 37,107 Flickr im-ages, proposed for people recognition in an unconstrainedsetting and does not include images covering many otherprivacy aspects such as license plates, political views orofficial identification documents. In this paper, we intro-duce the first dataset of real-life images capturing importantprivacy-relevant attributes.
3. The Visual Privacy (VISPR) DatasetMobile devices and social media platforms provide pri-
vacy settings, so that users can communicate their privacypreferences on the disclosure of different type of textual in-formation. How does this concept transfer to image data?We need to establish a similar concept of privacy relevantinformation types – but now for images. This will allow usto query users about their privacy preferences on the disclo-sure of various information types, as we will do in the nextsection.
Therefore, we propose in this section a categorization ofpersonal information into 68 privacy attributes such as gen-
2
der, tattoo, email address or fingerprint. We collect a datasetof 22k images that allows the study of privacy relevant at-tributes in images and the training of automatic recognizers.
Privacy Attributes
As motivated before, we need to categorize different typesof personal content in images – akin to the privacy settingsdeployed in today’s devices and services. Therefore, wedefine a list of privacy attributes an image can disclose.
The primary challenge here is the lack of a standard listof privacy attributes. We thus compile attributes from mul-tiple sources. First, we consolidate relevant attributes fromthe guidelines for handling Personally Identifiable Infor-mation [29] provided in the EU Data Protection Directive95/46/EC [9] and the US Privacy Act of 1974. Second, weadd relevant attributes from the rules on prohibiting sharingpersonal information on various social networking websites(e.g., Twitter, Reddit, Flickr). Finally, we manually exam-ine images that are shared on these websites and identifyadditional attributes. As a result, we draft an initial set of104 potential privacy attributes. As discussed in the nextsection, these are reduced to 68 attributes (see Table 1) afterpruning.
Annotation Setup
The annotation was set up as a multi-label task to three an-notators annotating independent sets of images. A web-based tool was provided to select multiple options corre-sponding to the 104 privacy attributes per image. Addition-ally, annotators could mark if they were unsure about theirannotation. In case none of the provided privacy labels ap-plied, they were instructed to label the image as safe, whichwe use as one of our privacy attributes. Images were dis-carded if annotators were unsure, or if the image contained acopyright watermark, was a historic photograph, containedprimarily non-English text, or was of poor quality.
Data Collection and Annotation Procedure
In this section, we discuss the steps taken to obtain the finalset of 22k images annotated with 68 privacy attributes.
Seed Sample We first gather 100k random images fromthe OpenImages dataset [21], a collection of ∼9 millionFlickr images. Using the definition and examples of the pri-vacy attributes, the annotators annotate 10,000 images ran-domly selected from the downloaded images.
Handling Imbalance Based on the label statistics fromthese 10,000 images, we add images to balance attributeswith fewer than 100 occurrences. These additional imagesare added by querying relevant OpenImages labels possiblyrepresentative of insufficient privacy attributes.
Split All Train Val Test
Images 22,167 10,000 4,167 8,000Labels 115,742 51,799 22,026 41,917Avg Labels/Image 5.22 5.18 5.29 5.24Max Images/Label 10,460 4,710 1,969 3,781Min Images/Label 44 20 7 12
Table 1: Dataset Statistics
Extended Search for Rare Classes In spite of using theabove strategy, 37 attributes contain under 40 images. Wemanually add images for these attributes by querying rele-vant keywords on Flickr. We do not add multiple imagesfrom the same album. For credit cards, we manually ob-tain 50 high-quality images from Twitter, which are theonly non-Flickr images in our dataset.
Selected Attributes After annotating the dataset with theinitial 104 labels, we discard 19 labels because either (i) im-ages were difficult to obtain manually (e.g. iris/retinal scan,insurance details) or (ii) the set of images did not clearlyrepresent the attribute. We additionally merge groups of at-tributes which capture similar concepts (e.g. work and homephone number). In the end, we obtain a dataset of 22,167images, each annotated with one or more of 68 privacy at-tributes.
Curation To reduce labeling mistakes, we organize thedataset into batches of images with each batch correspond-ing to a privacy attribute. We curate attribute batches whicheither contain fewer than 500 images or are considered sen-sitive by users.
Splits We perform a random 45-20-35 split with 10,000training, 4,167 validation and 8,000 test images. The finalstatistics of our dataset is presented in Table 1. The labelsand its distribution in our dataset is shown in Figure 2.
4. Understanding Privacy RisksIn this section, we explore how users’ personal privacy
preferences relate to the attributes in Section 4.1. Further-more, we study how good users are at enforcing their ownprivacy preferences on visual data when making judgmentsbased on image data in Section 4.2.
4.1. Understanding Users’ Privacy Preferences
In this section, we study the degree to which varioususers are sensitive to the privacy attributes discussed in Sec-tion 3.
User Study We present each user with a series of 72questions in a randomized order. Each of these questionscorresponds to either exactly one of 67 privacy attributes(excluding the safe attribute) or a control question. In each
3
10
100
1000
10000SkinColor
Gend
erHa
irCo
lor
Race
AgeGrou
pSafe
Face(C
)Face(P
)EyeCo
lor
WeightG
roup
HeightGroup
Cultu
reLand
mark
Occup
ation
Visited
Locatio
n(P)
Date/Tim
eofActivity
SocialCircle
Spectators
Professio
nalC
ircle
Semi-n
udity
FullNa
me
Similarview
Sports
Gene
ralO
pinion
Person
alRelationships
WorkOccassio
nTickets
Hand
writing
SexualOrie
ntation
Tattoo
Hobb
ies
LicensePlate(C)
Tradition
alclothing
Med
icalTreatm
ent
Compe
titors
Signature
Religion
Passpo
rtRe
ceipts
FirstN
ame
Natio
nality
LastNam
ePerson
alOccassio
nPh
ysicaldisa
bility
LicensePlate(P)
DateofB
irth
VehicleOwne
rship
Phon
eno
.Visited
Locatio
n(C)
Educationhistory
Onlinec
onversations
Username
Marita
lstatus
Homeaddress(C)
PoliticalOpinion
Cred
itCard
Emailadd
ress
Stud
entID
DriversLicen
seMed
icalHistory
PlaceofBirth
Emailcon
tent
Legalinvolvemen
tNu
dity
Fingerprint
Natio
nalIde
ntificatio
nHo
meaddress(P)
Figure 2: Label distribution in our dataset. Y -axis indicates the number of images.
question, the users are asked how much they would findtheir privacy violated if they accidentally shared details ofa particular attribute publicly online. For instance: “Howmuch would you find your privacy violated if you acciden-tally shared details on personal occasions you have attended(like a birthday party or friend’s wedding).” Responses forthe question are collected on a scale of 1 to 5, where: (1) Pri-vacy is not violated (2) Privacy is slightly violated (3) Pri-vacy is somewhat violated (4) Privacy is violated (5) Privacyis extremely violated. We treat these responses as users pri-vacy preference for this particular privacy attribute.
Participants We collect responses of 305 unique AMTworkers in this survey. Out of the 305 respondents, 59%were male, 78% were under 40 years of age with 57% fromUSA and 38% from India. Additionally, 75% were regularFacebook users, 80% and 44% reported to be aware of andhave used Twitter and Flickr at least once.
Analysis In order to understand the diversity in users’privacy preferences, we first cluster the users based on theirpreferences into user privacy profiles. We cluster using K-means and choose K based on silhouette score [38], whichconsiders distance between points within the cluster and ad-ditionally distance between points and their neighbouringcluster. We choose K = 30 as this yields the lowest sil-houette score. This enables visualizing the preferences overthe attributes, as seen in Figure 3, where each row repre-sents the preferences for one of the 30 user profiles (orderedbased on number of users associated with the profile). Weobserve from this study: (i) Users show a wide variety ofpreferences. This supports requiring user-specific privacyrisk predictions. (ii) The majority (Profiles 1-4, 7-11, 13-14,18-20 in Figure 3) display a similar order of sensitivity tothe attributes (iii) A minority (Profiles 21-30) of users areparticularly sensitive to some attributes such as their polit-ical view, sexual orientation or religion (iv) The uniform-ly-sensitive users (Profiles 5, 6, 12, 15, 17) are uniformlysensitive to all attributes even though to different degrees.
4.2. Users and Visual Privacy Judgment
In this study, we first ask participants to judge their per-sonal privacy risk based on images representing an attribute(providing a visual privacy risk score) and afterwards askingthe actual user’s privacy preferences for the same attribute(providing a desired or explicit privacy risk score). Hence,we study how good users are at assessing their personal pri-vacy risks based on images.
User Study In this study, we split the survey into twoparts. In the first part, the users are shown a group of 3-6images. Given the sensitive nature of attributes, we cannotobtain or ask users to rate their personal images and henceuse images from the dataset. They are asked how comfort-able they are sharing such images publicly, considering theyare the subject in these images. Responses are collectedon a scale of 1 to 5, where: (1) Extremely comfortable(2) Slightly comfortable (3) Somewhat comfortable (4) Notcomfortable (5) Extremely uncomfortable. Each group ofimages represents one of the 68 privacy attributes. In mostcases, the attributes occur isolated and are the most promi-nent visual cue in the image. We refer to these responses ashuman visual privacy score. The second part is identical toquestions and the setting in the previous user-study on pri-vacy preferences. Each question is designed to obtain theprivacy preference of the user for each attribute. As before,the user rates on a scale of 1 (Not Violated) to 5 (ExtremelyViolated). We refer to these responses as privacy preferencescore.
Participants We split the study into two parts to preventuser fatigue. Each part contains only half of the attributes.We obtain 50 unique responses for this survey from AMT.In each of these parts, roughly: 70% of the respondentswere under 40 years, 57% were male and 87% were fromUSA. Additionally, 80% responded that they use Facebook,84% Twitter and 46% Flickr.
Analysis We compute for each attribute average privacypreference score and human visual scores, and visualized
4
Nudity
Figure 3: Privacy preferences of user profiles for the privacy attributes. Darker colors represent higher privacy-sensitivity toattributes. Each row corresponds to one of the 30 profiles and the number in brackets on the Y -axis represents the number ofusers mapped to the profile. Rows are ordered based on number of users linked to the profile.
1.0 2.0 3.0 4.0 5.0Privacy Preference
1.0
2.0
3.0
4.0
5.0
Hum
an V
isual Pri
vacy
Sco
re
Handwriting
Place of Birth
First Name
PersonalReln.
LicensePlate (P)
Social Circle
Fingerprint
Last Name
LicensePlate (C)
Weight Group
VisitedLocation (P)
Nationality
Figure 4: Users are asked to rate on a scale of 1 (Not vi-olated) to 5 (Extremely violated) how much an attributeaffects their privacy. X-axis denotes their desired privacypreference and Y -axis denotes their evaluation of risk onimages. The red markers indicate privacy attributes withhighly underestimated or overestimated user ratings
them as a scatter plot in Figure 4. From the results, weobserve: (i) The off-diagonal data points show a clear in-
consistency in the users between the required privacy pref-erence and their judgment of privacy risk in images. (ii) Forcases close to the diagonal, like credit cards, passport andnational identification documents, users display consistentbehaviour on images and attributes. (iii) However, whenphotographs are natural scenes containing people or ve-hicles, users underestimate (below diagonal) the privacyscore, such as in the case of family photographs or carsdisplaying license plate numbers. We speculate this is in-dicative of personal photographs commonly shared online.(iv) They overestimate (above diagonal) the privacy risk ofsome photographs showing birth place or their name. Wespeculate this is because the photographs are often officialdocuments, making users more cautious.
5. Predicting Privacy RisksIn this section, we make a step towards our overall goal
of a Visual Privacy Advisor. As illustrated in Figure 5, wefollow a similar paradigm e.g. on social networks that de-fines privacy risk based on both the content type and user-specific privacy settings. In our case, the content type isdescribed by (user-independent) attributes in the previoussection. We combine these with the user-specific privacypreferences to determine if the image contains a privacy vi-
5
Attributes
Annotation
Attribute Predictions
Image
Objective Task(user-independent)
Subjective Task(user-specific)
Privacy RiskScore
Groundtruth
AP-PR
PR-CNN
UserPreferences
Figure 5: We learn an end-to-end model for user-specificprivacy risk estimation.
olation.We describe our model for privacy attribute prediction
in Section 5.1, followed by our approaches to personalizedprivacy risk prediction in Section 5.2. We conclude with acomparison of human judgment of privacy risks in imagesagainst the prediction of our proposed models in Section5.3.
5.1. Privacy Attribute Prediction
In this section, we define the user-independent task ofpredicting privacy attributes from images. Then, we presentand evaluate different methods on our new VISPR dataset.
Task We propose the task of Privacy Attribute Predic-tion, which is to predict one or more of 68 privacy attributesbased on an image. This can be seen as a multilabel classi-fication problem that recognizes different type of personalinformation visual data and therefore has the potential tomake this information explicit. Figure 1 shows multiple ex-amples for this task. The task is challenging due to imagediversity, subtle cues and high level semantics.
Metric To assess performance of methods for this task,we compute the Average Precision (AP) per class, which isthe area under Precision-Recall curve for the attribute. Ad-ditionally, the overall performance of a method is given byClass-based Mean Average Precision (C-MAP), the averageof the AP score across all 68 attributes.
Methods We experiment with three types of visual fea-tures extracted from CNNs – CaffeNet [19], GoogleNet[41] and ResNet-50 [17]. First, we train a linear SVMmodel using features from the layer preceding the last fully-connected layer of these CNNs. In a pilot study, we foundthat the multilabel SVM with smoothed hinge loss [25]yields better results than SVM multi-label prediction [7]and cross-entropy loss. Second, we fine-tune the CNNs ini-tialized with pretrained ImageNet models, based on a multi-
Training Features C-MAP
SVMCaffeNet 37.93GoogleNet 39.88Resnet-50 40.50
End-to-EndCaffeNet 42.99GoogleNet 43.29Resnet-50 47.45
Table 2: Accuracy of our methods given by Class-basedMean Average Precision, evaluated on test
label classification loss with sigmoid activations.Results Quantitative results of our method are shownin Table 2 and qualitative results in Figure 6 (more dis-cussed in supplementary). We additionally present the Av-erage Precision scores per class in Figure 7. We make thefollowing observations: (i) The CNN performs well in at-tributes such as tickets, passports, medical treatment thatcorrelated well with scenes (e.g. airport, hospital). It alsoperforms well in recognizing attributes which are human–centric, such as faces, gender and age. (ii) Fine-grained dif-ferences cause confusions such as predicting student IDs fordrivers licenses or differentiating between street and othersignboards. (iii) We observe failure modes due to small de-tails in the image, such as tattoos, marriage rings or a creditcard in the hands of a child. (iv) Another shortcoming is notbeing able to recognize relationship-based attributes (e.g.,personal or social relationships, vehicle ownership) whichrequires reasoning based on interaction of multiple visualcues in an image rather than just their presence.
5.2. Personalizing Privacy Risk Prediction
In the previous section, we discussed predicting privacyattributes in images, a task independent of user privacy pref-erences. In this section, we investigate user-specific visualprivacy feedback. The goal is to compute a privacy riskscore per image, representing the risk of privacy leakagefor the particular user.Task As illustrated in Figure 5, we combine privacy at-tributes (user independent) together with the privacy pref-erences based on these attributes (user specific) to arrive atthe privacy risk score. As we allow the users to give scoresfor each attributes based on their privacy preferences, wedefine the following privacy risk score.
Definition 1. Privacy Risk Score. For some image x, at-tributes y ∈ [0, 1]A and user preference u ∈ [0, 5]A, theprivacy risk score of image x containing attributes y on useru is maxa yaua
This represents the user-specific score of the most sensi-tive attribute, most likely to be present in an image. As a re-
6
True Positives False Positives False Negatives
Tattoo
PhysicalDisability
Landmark
Figure 6: Qualitative Results of our Privacy Attribute Prediction method
0102030405060708090100
Skinco
lor
Gen
der
Race
HairCo
lor
AgeGroup
Face(C
)Safe
EyeCo
lor
Face(P
)Passpo
rtCu
lture
Med
icalTreatm
ent
Tickets
Onlineconversatio
nsSemi-n
udity
Similarview
Educationhistory
WeightG
roup
Fingerprint
Emailcon
tent
Profession
alCircle
Hand
writing
DriversLicen
seSpectators
Physicaldisab
ility
Receipts
Sports
DateofB
irth
LicensePlate(C)
Gen
eralOpinion
Date/Tim
eofActivity
Cred
itCa
rdHe
ightGroup
WorkOccassion
Occup
ation
Religion
Compe
titors
PlaceofBirth
Med
icalHistory
Nationa
lity
FullNam
eSocialCircle
Homead
dress(C)
Stud
entID
Trad
ition
alclothing
Signature
Land
mark
Legalinvolvemen
tHo
bbies
Person
alRelationships
VisitedLocatio
n(P)
SexualOrie
ntation
Usernam
eTattoo
Nationa
lIde
ntificatio
nEm
ailadd
ress
Person
alOccassion
FirstN
ame
LicensePlate(P)
Nud
ityVisitedLocatio
n(C)
PoliticalOpinion
Marita
lstatus
LastNam
ePh
oneno
.VehicleOwne
rship
Homead
dress(P)
Figure 7: Average Precision (AP) Scores for the privacy attributes from our method
sult, the privacy-risk score is comparable to the preference-score: 1 (Not Sensitive) to 5 (Extremely Sensitive). As il-lustrated in Figure 5, we compute the ground-truth privacyrisk score based on ground-truth attribute annotation for animage (represented as a k-hot vector y ∈ {0, 1}A) and pri-vacy preferences of users.
Method: Attribute Prediction-Based Privacy Risk (AP-PR) Our first method performs Attributed-Based PrivacyRisk (AP-PR) prediction. As illustrated in Figure 5, wecombine the privacy attribute prediction and the profile’sprivacy preferences (that we can assume as provided byusers at test time) to compute the privacy risk score as de-fined above.
Method: Privacy Risk CNN (PR-CNN) We propose aPrivacy Risk CNN (PR-CNN) that does not directly use theuser profile’s privacy preferences – but only indirectly viathe ground-truth. The key observation is that AP-PR scoressuffer from erroneous attribute predictions (see Figure 7).Therefore, we extend the the privacy attribute predictionnetwork by additional fully-connected layers to directly pre-dict the privacy risk score. A parameter search yielded bestresults using additional two fully-connected hidden layersof 128 neurons, each followed by sigmoid activations. We
L1-Error MAP
1+ 2+ 3+ 4+
AP-PR 0.656 94.94 94.27 87.97 77.89PR-CNN 0.637 94.35 93.65 88.14 78.38
Table 3: Evaluation of Personalized Privacy Risk
finetune this network from our Googlenet Privacy AttributePrediction network for 30 user profiles described in Section4 and a Euclidean loss.
Evaluation We use two metrics for evaluation. First, theL1 error averaged over all images and profiles; it representsthe mean absolute difference between the ratings. Secondly,we calculate the Precision-Recall curves for varying thresh-olds of sensitivity which indicates how well our models de-tect images above a certain true privacy risk. By calculat-ing the area under the Precision-Recall curves over all userprofiles, we additionally report the Mean Average Precision(MAP).
In our experiments, we use the previously introduceduser-profiles instead of individual users in order to cater to
7
0.0 0.2 0.4 0.6 0.8 1.0Recall
0.2
0.4
0.6
0.8
1.0
Pre
cisi
on
Privacy Risk = 3.0+
AP-PR
PR-CNN
0.0 0.2 0.4 0.6 0.8 1.0Recall
0.2
0.4
0.6
0.8
1.0 Privacy Risk = 4.0+
Figure 8: Performance of our approach in predicting Pri-vacy Risks of images. Our approach performs better on highprivacy-risk images.
0.0 0.2 0.4 0.6 0.8 1.0
Recall
0.2
0.4
0.6
0.8
1.0
Pre
cisi
on
Privacy Risk = 3.0+
AP-PR
PR-CNN
Human
0.0 0.2 0.4 0.6 0.8 1.0
Recall
0.2
0.4
0.6
0.8
1.0
Pre
cisi
on
Privacy Risk = 4.0+
Figure 9: The Precision-Recall curves of three risk estima-tions are displayed – users implicitly evaluating risk fromimages and our two methods AP-PR and PR-CNN.
all the diverse privacy preferences equally that we have seenin the previous section. We assign a privacy risk score of 0.5for the safe attribute for all profiles.
The evaluation of our approach on these metrics is pre-sented in Table 3. Each graph in Figure 8 represents PRcurves over the ground-truth thresholded to obtain a partic-ular risk interval, such that any score above this threshold isconsidered private. This allows us to estimate performanceof methods at various levels of sensitivity. We then obtainthe PR-curves for each sensitivity interval by thresholdingscores estimated by AP-PR and PR-CNN.
From these results, we observe: (i) PR-CNN performsbetter in predicting risk compared to using the intermediateattributes predictions. Notably, the prediction is on averageless than one step on the scale from 1 to 5 away from the trueprivacy risk. (ii) Moreover, it is better at detecting high-riskimages, as shown in Figure 8. In particular, we notice betterrecall for high-risk images. We discuss profile-specific PRcurves in the supplementary material.
5.3. Humans vs. Machine
In Section 4, we have shown inconsistency in users’ pri-vacy preferences and their assessment of privacy risks inimages. In this section, we compare our proposed approach
for evaluating privacy risk against human judgments.In our second user study (subsection 4.2), for each at-
tribute, users first assessed their personal privacy risk on im-ages (providing a visual privacy risk score) and later ratedtheir privacy preference (providing a desired privacy riskscore). We have computed scores with our privacy riskmodels AP-PR and PR-CNN on those very same images.
As a result, for each image, we have (a) users’ pri-vacy preference (b) users’ privacy risk judgment from im-ages (c) our AP-PR privacy risk score from images (d) ourPR-CNN privacy risk score from images. All these scoresare on a scale of 1 (Not Sensitive) to 5 (Extremely Sen-sitive). Using the users desired preference as the ground-truth, we now ask: who is better at reproducing the user’sdesired privacy preference on images? As from the previ-ous section, we use precision-recall and L1-error as metricsto compare the desired preference score (a) and predictedprivacy risk score for evaluation (b, c, d).
The precision-recall-curves for the three candidates arepresented in Figure 9. Evaluation using the L1-error isdiscussed in the supplementary material. We observe:(i) AP-PR achieves better precision-recall for the task thanPR-CNN and – remarkably – is even consistently betterthan the users’ image-based judgment. (ii) On average, thePR-CNN estimates privacy risks (L1 error = 1.03) slightlybetter than the user’s image-based judgment (L1 error = 1.1)and AP-PR (L1 error = 1.27).
6. ConclusionWe have extended the concept of privacy settings to vi-
sual content and have presented work towards a Visual Pri-vacy Advisor that can provide feedback to the users basedon their privacy preferences. The significance of this re-search direction is highlighted by our user study whichshows users often fail to enforce their own privacy prefer-ences when judging image content. Our survey also cap-tures typical privacy preference profiles that show a sur-prising level of diversity. Our new VISPR dataset allowedus to train visual models that recognize privacy attributes,predict privacy risk scores and detect images that conflictwith user’s privacy. In particular, a final comparison of hu-man vs. machine prediction of privacy risks on images,shows an improvement by our model over human judgment.This highlights the feasibility and future opportunities of theoverarching goal – a Visual Privacy Advisor.
AcknowledgementThis research was supported by the German Research Foun-dation (DFG CRC 1223). We thank Paarijaat Aditya,Philipp Muller and Julian Steil for advice on the user study.We also thank Dr. Mykhaylo Andriluka and Seong Joon Ohfor valuable feedback on the paper.
8
References[1] P. Aditya, R. Sen, P. Druschel, S. Joon Oh, R. Benenson,
M. Fritz, B. Schiele, B. Bhattacharjee, and T. T. Wu. I-pic:A platform for privacy-compliant image capture. In Proceed-ings of the 14th Annual International Conference on MobileSystems, Applications, and Services, pages 235–248. ACM,2016. 2
[2] E. Ahmed, M. Jones, and T. K. Marks. An improved deeplearning architecture for person re-identification. In Proceed-ings of the IEEE Conference on Computer Vision and PatternRecognition, pages 3908–3916, 2015. 2
[3] T. Aura, T. A. Kuhn, and M. Roe. Scanning electronic doc-uments for personally identifiable information. In Proceed-ings of the 5th ACM workshop on Privacy in electronic soci-ety, pages 41–50. ACM, 2006. 2
[4] C. Bauckhage, A. Jahanbekam, and C. Thurau. Age recog-nition in the wild. In ICPR, 2010. 2
[5] C. Bier and J. Prior. Detection and labeling of personal iden-tifiable information in e-mails. In IFIP International Infor-mation Security Conference, pages 351–358. Springer, 2014.2
[6] S.-L. Chang, L.-S. Chen, Y.-C. Chung, and S.-W. Chen. Au-tomatic license plate recognition. IEEE Trans. IntelligentTransportation Systems, 5:42–53, 2004. 2
[7] K. Crammer and Y. Singer. A family of additive online al-gorithms for category ranking. Journal of Machine LearningResearch, 3(Feb):1025–1058, 2003. 6
[8] G. Danezis. Inferring privacy policies for social network-ing services. In Proceedings of the 2nd ACM workshop onSecurity and artificial intelligence, pages 5–10. ACM, 2009.2
[9] E. Directive. 95/46/ec of the european parliament and of thecouncil of 24 october 1995 on the protection of individualswith regard to the processing of personal data and on the freemovement of such data. Official Journal of the EC, 23(6),1995. 3
[10] C. Dwyer, S. Hiltz, and K. Passerini. Trust and privacy con-cern within social networking sites: A comparison of face-book and myspace. AMCIS 2007 proceedings, page 339,2007. 2
[11] L. Fang and K. LeFevre. Privacy wizards for social network-ing sites. In Proceedings of the 19th international conferenceon World wide web, pages 351–360. ACM, 2010. 2
[12] A. Gallagher and T. Chen. Clothing cosegmentation for rec-ognizing people. In Proc. CVPR, 2008. 2
[13] L. Geng, L. Korba, X. Wang, Y. Wang, H. Liu, and Y. You.Using data mining methods to predict personally identifi-able information in emails. In International Conference onAdvanced Data Mining and Applications, pages 272–281.Springer, 2008. 2
[14] R. Gross and A. Acquisti. Information revelation and privacyin online social networks. In Proceedings of the 2005 ACMworkshop on Privacy in the electronic society, pages 71–80.ACM, 2005. 2
[15] S. Guha, K. Tang, and P. Francis. Noyb: Privacy in onlinesocial networks. In Proceedings of the first workshop on On-line social networks, pages 49–54. ACM, 2008. 2
[16] A. Harvey. Cv dazzle: Camouflage from computer vision.Technical report, 2012. 2
[17] K. He, X. Zhang, S. Ren, and J. Sun. Deep residual learn-ing for image recognition. In Proceedings of the IEEE Con-ference on Computer Vision and Pattern Recognition, pages770–778, 2016. 6
[18] R. Hoyle, R. Templeman, D. Anthony, D. Crandall, andA. Kapadia. Sensitive lifelogs: A privacy analysis of photosfrom wearable cameras. In Proceedings of the 33rd AnnualACM Conference on Human Factors in Computing Systems,CHI ’15, pages 1645–1648, New York, NY, USA, 2015.ACM. 2
[19] Y. Jia, E. Shelhamer, J. Donahue, S. Karayev, J. Long, R. Gir-shick, S. Guadarrama, and T. Darrell. Caffe: Convolu-tional architecture for fast feature embedding. In Proceed-ings of the 22nd ACM international conference on Multime-dia, pages 675–678. ACM, 2014. 6
[20] M. Korayem, R. Templeman, D. Chen, D. Crandall, andA. Kapadia. Enhancing lifelogging privacy by detectingscreens. In ACM CHI Conference on Human Factors in Com-puting Systems (CHI), 2016. 2
[21] I. Krasin, T. Duerig, N. Alldrin, V. Ferrari, S. Abu-El-Haija,A. Kuznetsova, H. Rom, J. Uijlings, S. Popov, A. Veit,S. Belongie, V. Gomes, A. Gupta, C. Sun, G. Chechik,D. Cai, Z. Feng, D. Narayanan, and K. Murphy. Open-images: A public dataset for large-scale multi-label andmulti-class image classification. Dataset available fromhttps://github.com/openimages, 2017. 3
[22] B. Krishnamurthy, K. Naryshkin, and C. E. Wills. Privacyleakage vs. protection measures: the growing disconnect. InProceedings of the Web, volume 2, pages 1–10, 2011. 2
[23] B. Krishnamurthy and C. E. Wills. Characterizing privacy inonline social networks. In Proceedings of the first workshopon Online social networks, pages 37–42. ACM, 2008. 2
[24] B. Krishnamurthy and C. E. Wills. On the leakage of per-sonally identifiable information via online social networks.In Proceedings of the 2nd ACM workshop on Online socialnetworks, pages 7–12. ACM, 2009. 2
[25] M. Lapin, M. Hein, and B. Schiele. Loss functions for top-kerror: Analysis and insights. In CVPR, 2016. 6
[26] A. Lenhart and M. Madden. Teens, privacy and online so-cial networks: How teens manage their online identities andpersonal information in the age of myspace. 2007. 2
[27] M. Li, N. Cao, S. Yu, and W. Lou. Findu: Privacy-preservingpersonal profile matching in mobile social networks. In IN-FOCOM, 2011 Proceedings IEEE, pages 2435–2443. IEEE,2011. 2
[28] Y. Liu, K. P. Gummadi, B. Krishnamurthy, and A. Mislove.Analyzing facebook privacy settings: user expectations vs.reality. In Proceedings of the 2011 ACM SIGCOMM con-ference on Internet measurement conference, pages 61–70.ACM, 2011. 2
[29] E. McCallister. Guide to protecting the confidentiality of per-sonally identifiable information. Diane Publishing, 2010. 3
[30] N. McLaughlin, J. Martinez del Rincon, and P. Miller. Re-current convolutional network for video-based person re-identification. In Proceedings of the IEEE Conference
9
on Computer Vision and Pattern Recognition, pages 1325–1334, 2016. 2
[31] S.-M. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, andP. Frossard. Universal adversarial perturbations. arXivpreprint arXiv:1610.08401, 2016. 2
[32] A. Narayanan and V. Shmatikov. De-anonymizing social net-works. CoRR, abs/0903.3276, 2009. 2
[33] C. Neustaedter, S. Greenberg, and M. Boyle. Blur filtra-tion fails to preserve privacy for home-based video confer-encing. ACM Transactions on Computer-Human Interaction(TOCHI), 13(1):1–36, 2006. 2
[34] S. J. Oh, R. Benenson, M. Fritz, and B. Schiele. Facelessperson recognition: Privacy implications in social media.In European Conference on Computer Vision, pages 19–35.Springer, 2016. 2
[35] N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami.Distillation as a defense to adversarial perturbations againstdeep neural networks. In Security and Privacy (SP), 2016IEEE Symposium on, pages 582–597. IEEE, 2016. 2
[36] F. Pittaluga and S. J. Koppal. Privacy preserving optics forminiature vision sensors. In Proceedings of the IEEE Con-ference on Computer Vision and Pattern Recognition, pages314–324, 2015. 2
[37] N. Raval, A. Srivastava, K. Lebeck, L. Cox, andA. Machanavajjhala. Markit: Privacy markers for protectingvisual secrets. In Proceedings of the 2014 ACM InternationalJoint Conference on Pervasive and Ubiquitous Computing:Adjunct Publication, pages 1289–1295. ACM, 2014. 2
[38] P. J. Rousseeuw. Silhouettes: a graphical aid to the interpre-tation and validation of cluster analysis. Journal of compu-tational and applied mathematics, 20:53–65, 1987. 4
[39] M. Shao, L. Li, and Y. Fu. What do you do? occupationrecognition in a photo via social context. In Proceedingsof the IEEE International Conference on Computer Vision,pages 3631–3638, 2013. 2
[40] X. Sun, P. Wu, and S. C. H. Hoi. Face detection usingdeep learning: An improved faster rcnn approach. CoRR,abs/1701.08289, 2017. 2
[41] C. Szegedy, W. Liu, Y. Jia, P. Sermanet, S. Reed,D. Anguelov, D. Erhan, V. Vanhoucke, and A. Rabinovich.Going deeper with convolutions. In Proceedings of the IEEEConference on Computer Vision and Pattern Recognition,pages 1–9, 2015. 6
[42] A. Tonge and C. Caragea. Privacy prediction of imagesshared on social media sites using deep features. arXivpreprint arXiv:1510.08583, 2015. 2
[43] M. H. Veiga and C. Eickhoff. Privacy leakage through inno-cent content sharing in online social networks. arXiv preprintarXiv:1607.02714, 2016. 2
[44] P. A. Viola and M. J. Jones. Robust real-time face detec-tion. International Journal of Computer Vision, 57:137–154,2001. 2
[45] G. Wang, A. C. Gallagher, J. Luo, and D. A. Forsyth. See-ing people in social context: Recognizing people and socialrelationships. In ECCV, 2010. 2
[46] M. J. Wilber, V. Shmatikov, and S. Belongie. Can we stillavoid automatic face detection? In Applications of Computer
Vision (WACV), 2016 IEEE Winter Conference on, pages 1–9. IEEE, 2016. 2
[47] Z. Yang, M. Yang, Y. Zhang, G. Gu, P. Ning, and X. S. Wang.Appintent: analyzing sensitive data transmission in androidfor privacy leakage detection. In ACM Conference on Com-puter and Communications Security, 2013. 2
[48] A. L. Young and A. Quan-Haase. Information revelationand internet privacy concerns on social network sites: a casestudy of facebook. In Proceedings of the fourth interna-tional conference on Communities and technologies, pages265–274. ACM, 2009. 2
[49] H. Zhang, W. Jia, X. He, and Q. Wu. Learning-based licenseplate detection using global and local features. In ICPR,2006. 2
[50] N. Zhang, M. Paluri, Y. Taigman, R. Fergus, and L. Bourdev.Beyond frontal faces: Improving person recognition usingmultiple cues. In The IEEE Conference on Computer Visionand Pattern Recognition (CVPR), June 2015. 2
[51] Y. Zheng, M. Zhao, Y. Song, H. Adam, U. Buddemeier,A. Bissacco, F. Brucher, T.-S. Chua, and H. Neven. Tour theworld: Building a web-scale landmark recognition engine.In 2009 IEEE Conference on Computer Vision and PatternRecognition, 2009. 2
[52] B. Zhou and J. Pei. Preserving privacy in social networksagainst neighborhood attacks. In Data Engineering, 2008.ICDE 2008. IEEE 24th International Conference on, pages506–515. IEEE, 2008. 2
[53] W. Zhou, H. Li, Y. Lu, and Q. Tian. Principal visual worddiscovery for automatic license plate detection. IEEE Trans.Image Processing, 21:4269–4279, 2012. 2
ChangelogVersion 2 (31-July-2017)• New teaser figure• Improving writing• Citing more related work• Additional information on User Study• Project web-page link
10
AppendicesA. Privacy Attributes and Examples
A complete list of privacy attributes with descriptionsand an example image is given in Table 4. We considerall these cases when viewing the image in its original high-resolution form. We use these definitions to any subject inthe image – either in the foreground or background. Us-ing these definitions, attributes can be typically inferredfrom an image in multiple ways: (a) Direct: it is explic-itly mentioned, such as in a form or document (e.g. gen-der on an identity card) (b) Visual: based on visual cues(e.g. gender from clothing or facial features) (c) Reason-ing: it is inferred by some additional reasoning (e.g. rela-tionships based on age differences between multiple peo-ple). Dataset is available on the project website: https://tribhuvanesh.github.io/vpa/.
B. Additional Details on User StudyIn this section, we provide additional details on the user
study discussed in Section 4.
B.1. Understanding Users’ Privacy Preferences
The task in this user study is to obtain user preferencesover the 67 privacy attributes (excludes the attribute safe).The questionnaire instructs the user on a fictitious web-site (similar to Flickr or Twitter), where content posted isby default visible to everyone else on the platform. Byunintentionally posting information about a particular at-tribute, the user exposes private information comprisinghis/her anonymity. Each question is a verbal descriptionof one of the attributes (Figure 10). We collect responseson a scale of 1-5 of how much the user finds his/her privacyviolated as a consequence of this action.
Instructions provided to the Users
In this academic survey we want to understand how sensi-tive you are to certain details of your personal or privatelife. For instance, are you more comfortable sharing yourfull name, gender or details on your personal relationships?
We refer to these details of your personal or private lifeas ”Personally Identifiable Information” (PII).
PII is information that can be used on its own or withother information to identify, contact, or locate a single per-son, or to identify an individual. Such information could beone or more of your: Full Name, Home Address, PoliticalOpinion, etc.
Following this description are a list of PIIs. For eachof these PIIs, consider the following situation: On an on-line public platform, you create an anonymous account. Onthis platform, once you post something, you cannot delete it.
Figure 10: Questions from user study to understand privacypreferences
Only the moderators can delete this post. However, they canbe extremely slow and unresponsive. One day, you uninten-tionally shared/posted this PII about yourself. Immediately,you realize that you cannot delete this post.
On a scale of 1-5, please rate how much you feel yourprivacy is violated by this action, where:1 - I feel my privacy is not violated. So, I wouldn’t care.2 - I feel my privacy is slightly violated. However, it’s notworth taking any action.3 - I feel my privacy is somewhat violated. I will messagethe moderator. In case there’s no response, I will give up.4 - I feel my privacy is violated. I will inform the moderatorand follow up for a few days. In case there’s no responseafter that, I will give up.5 - I feel my privacy is extremely violated. I will not give upuntil this post is deleted.
B.2. Users and Visual Privacy Judgment
In order to understand how good are users at identify-ing privacy risks from images, we conduct this user studyin two parts. In the first part, we instruct users on a ficti-tious photo-sharing website, where images shared are pub-licly available. For each of the 68 privacy attributes, wepresent a question on a group of images from the datasetrepresenting this attribute (Figure 11). The user respondshow comfortable he/she is posting such images on the web-
11
Group Attribute Description Examples
PersonalDescription
Gender Subject’s gender is clearly visible using one or moregender-specific discriminative visual cues such as morethan 50% body being visible, clothing, facial/head hairor colored nails.
Eye Color If eyes are visible and can be categorized as one of:brown, hazel, blue or green.
Hair Color Subject’s head hair color is visible
Fingerprint Fingerprint is visible through either a close-up shot ofone’s finger or adu -sh . n imprint on some surface.
Signature Complete signature is visible in an image, such as in aform or document
Face (Complete) A face is completely visible. Also includes photographsof faces on identity cards, documents or billboards.
Face (Partial) Less than 70% of the face is visible or there is occlusion,such as when the subject is wearing sun-glasses.
Tattoo Subject displays either a tattoo or body paint.
Nudity (Partial) Subject appears in undergarments
Nudity (Complete) Human subject appears without clothing
Race Any subject in the photograph can be categorized intoone of Caucasian, Asian or Negroid.
(Skin) Color One’s skin color can be categorized into one of White,Brown or Black.
Traditional Clothing Subject appears in clothing which is indicative of a par-ticular region or country e.g. dirndl, sari.
Table 4: List of Privacy Attributes including their definitions and examples
12
Group Attribute Description Examples
Full Name A recognizable full name which appears in the contextof a form, document or a badge. Also includes if thename can be inferred from a signature.
Name (First) Only if the first name is visible on a form, document,badge or clothing.
Name (Last) Only if the last name is visible on a form, document,badge or clothing.
Place of Birth Place of Birth is explicitly mentioned, such as in a formor in an identification document.
Date of Birth Date of Birth is explicitly mentioned in writing. Includesyear, month or the day of birth.
Nationality A passport indicating country is clearly visible. Includesthe case if a subject appears holding a country’s flag orwearing a uniform bearing the flag (such as a soldier oran international athlete).
Handwriting Hand-written text on any surface.
Marital status A subject is wearing an engagement ring. Includes wed-ding photographs taken of the bride and groom.
Documents National Identification Documents such as a Green Card or a European nationalidentity card, not including passports.
Credit Card Either the front or back of a credit card. Includes caseswhen the card is partially visible e.g. in someone’s handor in a shredded form
Passport A photograph of any page in the passport or its frontcover.
Drivers License Either front or back of a drivers license or a driving per-mit.
Student ID Front or back of a student identity card, with at least thename of a school, college or university clearly readable.
13
Group Attribute Description Examples
Mail Contents of a mail or the envelope.
Receipts Purchase receipts indicating a financial transaction withan amount clearly visible, e.g. a restaurant receipt.
Tickets A travel, movie or concert ticket which specifies travellocation or an event.
Health Physical disability Subject appears with a permanent physical disability e.g.an amputee or a person in a wheelchair.
Medical Treatment Subject appears either with an injury or indicates hospi-tal admittance.
Medical History Photographs of medicine or medical prescriptions.
Employment Occupation Subject appears in a distinguishable occupation-specificuniform e.g. doctor, policemen, construction worker.
Work Occasion Subject is photographed while giving a talk, presenta-tion, attending a work-related or broad-casting event.Includes photographs of people in formal attire in an of-fice.
PersonalLife
Religion Subject appears associated with a distinguishable reli-gious symbol, religion-specific clothing or at a religiouslocation.
Sexual Orientation Two subjects are photographed in an intimate setting
Culture Subjects appear celebrating a traditional festival or at-tending an art or culture related activity e.g. concert,play.
Hobbies A non-professional related activity of a subject is visiblee.g. playing a musical instrument, taking photographs.
Sports Subject appears taking part in an indoor or outdoorsports activity
14
Group Attribute Description Examples
Education history Photographs contains cues indicating subject’s educa-tion history, such as at a graduation ceremony, clothingindicating university or an academic or school certificate
Legal involvement Photographs indicating subject’s involvement with law-related activities e.g. someone being arrested, in a courthearing.
Personal Occasion Photographs of people celebrating a personal occasionwith friends or family members e.g. wedding, birthday.
General Opinion Subject appears associated with a placard or clothingindicating opinion on general issues e.g. wars, taxes,LGBT rights.
Political Opinion Subject appears with either clothing, placard or in acrowd at a political rally.
Relationships Personal Relationships Photographs of people in a visually-identifiable personalrelationship e.g. mother-son, husband-wife.
Social Circle Subjects of the same age-group photographed in a ca-sual setting e.g. friends at a party, walking together on astreet.
Professional Circle A group of people who share an occupation (e.g. a groupof policemen) or who are dressed for a professionalevent (e.g. a conference or meeting).
Competitors A group of people taking part in team sports. Also in-cludes the case when subjects belong to the same team.
Spectators A group of people spectating an event such as a concertor play.
Similar view A group of people at a rally or a protest who share opin-ions on a general issue. Only includes the case whenplacards or clothing denoting a cause or rallying for apolitical party is visible.
Whereabouts Visited Landmark Photograph contains text indicating a business’ name,street sign or a well-known landmark.
15
Group Attribute Description Examples
Visited Location (Com-plete)
Text indicating a complete address (e.g. restaurant re-ceipt with the address of the restaurant) or a screen-shotof GPS-based location.
Visited Location (Par-tial)
Text which partially indicates the subject’s location,such as street name, city or country where the photo-graph was taken.
Home address (Com-plete)
Photograph containing a complete non-commercialpostal address.
Home address (Partial) Photograph containing a partial non-commercial postaladdress.
Date/Time of Activity Photograph contains information of date and/or time ofsubject’s location or activity such as a time-stamp wa-termark in an image, or a clock in the photograph.
Phone no. A phone number that is visible in the photograph (eitherpersonal or commercial).
Internet Ac-tivity
Username A screen shot of a website which mentions any usernameor internet handles.
Email address Any complete valid email-address that appears in a pho-tograph or a screen-shot.
Email content Screenshots of emails including the subject of the email,or parts of the email body content.
Online conversations Screenshots of online conversations, posts, tweets or in-ternet activity by any user.
Automobile Vehicle Ownership Photograph of a person riding a motor vehicle.
License Plate (Com-plete)
A clearly visible license plate or registration number ofany motor vehicle.
License Plate (Partial) A partial license plate or registration number of any mo-tor vehicle
16
Figure 11: Questions from the user study to evaluate userprivacy judgment
site. The exact instructions for this part is provided below.In the second part, we obtain user preferences over the
attributes following the exact instructions in the previoussection.
Instructions provided to the Users
In this academic survey we want to understand your comfortlevel sharing things on the internet.
Following this description are groups of images. Foreach of these groups of images, consider the following sit-uation: On an online public platform, you create an ac-count. On this platform, you are allowed to post pho-tographs, which anyone can view. Moreover, you can also
interact with other users who shared their photographs andcan comment on or like them.
Important: For each of the below groups of images, pic-ture yourself as either being the subject in the photograph,or the one who took the photograph of a family-member.
On a scale of 1-5, rate how comfortable you are sharingsuch photographs, where:1 - You are extremely comfortable sharing such photographs2 - You are slightly comfortable sharing such photographs3 - You are somewhat comfortable sharing such pho-tographs4 - You are not comfortable sharing such photographs5 - You are extremely uncomfortable sharing such pho-tographs
C. Additional Qualitative Examples for Pri-vacy Attribute Prediction
In Section 5.1 we discussed our approach to Privacy At-tribute Prediction – a user-independent method of predict-ing multiple privacy attributes given an image. In this sec-tion, in addition to Figure 6, we present additional quali-tative examples in Figure 12. Each row represents imagesof a particular privacy attribute. The True Positives columnindicate the case when this attribute is in both the ground-truth and predicted set of privacy attributes. The False Pos-itives column indicate images when the attribute is incor-rectly predicted. The False Negatives column indicate im-ages when the attribute is in ground-truth, but is not pre-dicted.
We observe our method associates privacy attributes todistinctive visual cues such as clothing (for occupation andethnic clothing), exposed skin (for tattoos, nudity), metallicobjects with wheels (for physical disability, license plates)and text (for names, drivers license, username, handwrit-ing). As a result, apart from correct predictions, we findthat this also leads to incorrectly predicting attributes (e.g.predicting card-shaped identification documents as driverslicenses, cars for license plates) or failing to recognize at-tributes in a different context (e.g. handwriting on a wallinstead of documents, new types of drivers licenses). Wealso observe our approach underperform in differentiatingbetween full, first and last names, or usernames and emailaddresses (which requires text-based reasoning), identify-ing relationships and sexual orientation (which requires in-terpreting interaction between multiple people) and differ-entiating occupations, religion and ethnic clothing (whichrequires fine-grained recognition).
17
True Positives False Positives False Negatives
Credit Card
EthnicClothing
Full Name
Hobbies
Passport
SexualOrientation
MedicalHistory
DriversLicense
Handwriting
Occupation
PersonalRelationships
Username
License Plate(Complete)
Figure 12: Additional Qualitative Results of our Privacy Attribute Prediction method
18
Cre
dit
Card
Nati
onal Id
enti
fica
tion
Pass
port
Dri
vers
Lic
ense
Stu
dent
IDR
ece
ipts
Medic
al H
isto
rySem
i-nudit
yTra
dit
ional cl
oth
ing
Hobbie
sH
air
Colo
rH
om
e a
ddre
ss (
C)
Cult
ure
Tic
kets
Gender
C n
udit
ySpect
ato
rsSport
sEm
ail
addre
ssEm
ail
conte
nt
Sig
natu
reA
ge G
roup
Legal in
volv
em
ent
Polit
ical O
pin
ion
Occ
upati
on
Face
(P)
Colo
rM
edic
al Tre
atm
ent
Work
Occ
ass
ion
Eye C
olo
r O
ccass
ion
Tatt
oo
Mari
tal st
atu
sC
om
peti
tors
Heig
ht
Gro
up
Race
Vis
ited L
oca
tion (
C)
Hom
e a
ddre
ss (
P)
Relig
ion
Vehic
le O
wners
hip
Date
of
Bir
thPhysi
cal dis
abili
tySexual O
rienta
tion
Use
rnam
eG
enera
l O
pin
ion
Onlin
e c
onvers
ati
ons
Landm
ark
Nam
e (
Full)
Educa
tion h
isto
rySim
ilar
vie
wFa
ce (
C)
Nam
e (
Last
)Pro
fess
ional C
ircl
eSoci
al C
ircl
eD
ate
/Tim
e o
f A
ctiv
ity
Phone n
o.
Weig
ht
Gro
up
Handw
riti
ng
Nati
onalit
yV
isit
ed L
oca
tion (
P)
Nam
e (
Firs
t)Pla
ce o
f B
irth
Fingerp
rint
Rela
tionsh
ips
Lice
nse
Pla
te (
C)
Lice
nse
Pla
te (
P)0
1
2
3
4
5
L1-e
rror
PR-CNN
AP-PR
Users Visual Risk Assessment
Figure 13: L1 errors over attributes
D. Additional Results for Personalized PrivacyPrediction
D.1. Qualitative Results
In this section, we discuss additional results for Section5.2: Personalizing Privacy Risk Prediction.
Figure 14 presents qualitative results for our approachto user-specific Personalized Privacy Risk Prediction dis-cussed in Section 5.2. To visualize the qualitative resultsover all 30 user profiles simultaneously, we present a scat-ter plot of ground-truth vs. predicted scores for each image.Each point in the scatter plot represents one user-profile. Inthese plots, points closer to the diagonal (dotted line) indi-cate lower errors. Points above the diagonal indicate riskover-estimation and under the diagonal indicate risk under-estimation.
We observe from the qualitative results and w.r.t eachrow in Figure 14: (i) (First row) presents examples withcorrect high confidence attribute predictions according tothe posterior probability. Here, both AP-PR and PR-CNNperform equally well. (ii) (Second row) presents exampleswhere attribute predictions are noisy. In these, PR-CNNoutperforms AP-PR. (iii) (Third row) Both AP-PR andPR-CNN are challenged by difficult images (low contrast,unnatural angles, low lighting, occlusion). However, wesee that PR-CNN often performs slightly better than AP-PRin these cases. (iv) (Fourth row) presents examples whereAP-PR with correct attribute predictions performs betterthan PR-CNN.
D.2. Precision-Recall Curves for User Profiles
Section 5.2 discussed Precision-Recall curves evaluatedover all profiles. These were obtained by treating theprivacy risk-prediction as a binary classification problem,where images above a certain risk score (3+ and 4+ previ-
ously) is considered private per user profile.In Figure 15, we present the Precision-Recall curves
evaluated over groups of profiles and additional risk thresh-olds. To generate the curves in these figures, we first createfour groups of profiles, with an equal number of profilesin each group. We refer to these groups as quartiles Q1-Q4.We then obtain the Precision-Recall curves for each of thesequartiles.
We observe that PR-CNN displays better performancefor high-risk images over all quartiles of the 30 user profilesand hence contributing to an overall better performance.
Additionally, we observe a similar pattern with the L1-error metric (the absolute difference in scores), where PR-CNN (error = 0.67) incurs lower error in scores for privateimages compared to AP-PR (error = 0.84). However, AP-PR (error = 0.34) performs better for safe images in com-parison to PR-CNN (error = 0.58).
E. Additional Results for Humans vs. MachineIn Section 5.3, we discussed the performance of our Pri-
vacy Risk Evaluation Methods when compared to the usersthemselves. The performance evaluation was primarily withPrecision-Recall curves.
In this section, we discuss performance when evaluatedusing L1 as a distance metric between the ground-truth pri-vacy scores (user’s specified preferences) and the privacyrisk estimation using three approaches (user’s visual riskassessment and our two proposed approaches – AP-PR andPR-CNN). The L1 distance here measures the absolute dif-ference in risk score (where risk scores are between 1–5).Figure 13 presents these errors per attribute.
We observe from these results: (i) On average (horizon-tal lines), the PR-CNN estimates privacy risks (L1 error =1.03) slightly better than the user’s image-based judgment(L1 error = 1.1) (ii) Users often misjudge the risk (right end
19
1.0 2.0 3.0 4.0 5.0
Privacy Risk - GT
1.0
2.0
3.0
4.0
5.0
Pri
vacy
Ris
k -
Pre
dic
ted AP-PR
PR-CNN
1.0 2.0 3.0 4.0 5.0
Privacy Risk - GT
1.0
2.0
3.0
4.0
5.0
Pri
vacy
Ris
k -
Pre
dic
ted AP-PR
PR-CNN
1.0 2.0 3.0 4.0 5.0
Privacy Risk - GT
1.0
2.0
3.0
4.0
5.0
Pri
vacy
Ris
k -
Pre
dic
ted AP-PR
PR-CNN
1.0 2.0 3.0 4.0 5.0
Privacy Risk - GT
1.0
2.0
3.0
4.0
5.0
Pri
vacy
Ris
k -
Pre
dic
ted AP-PR
PR-CNN
1.0 2.0 3.0 4.0 5.0
Privacy Risk - GT
1.0
2.0
3.0
4.0
5.0
Pri
vacy
Ris
k -
Pre
dic
ted AP-PR
PR-CNN
1.0 2.0 3.0 4.0 5.0
Privacy Risk - GT
1.0
2.0
3.0
4.0
5.0
Pri
vacy
Ris
k -
Pre
dic
ted AP-PR
PR-CNN
1.0 2.0 3.0 4.0 5.0
Privacy Risk - GT
1.0
2.0
3.0
4.0
5.0
Pri
vacy
Ris
k -
Pre
dic
ted AP-PR
PR-CNN
1.0 2.0 3.0 4.0 5.0
Privacy Risk - GT
1.0
2.0
3.0
4.0
5.0
Pri
vacy
Ris
k -
Pre
dic
ted AP-PR
PR-CNN
1.0 2.0 3.0 4.0 5.0
Privacy Risk - GT
1.0
2.0
3.0
4.0
5.0
Pri
vacy
Ris
k -
Pre
dic
ted AP-PR
PR-CNN
1.0 2.0 3.0 4.0 5.0
Privacy Risk - GT
1.0
2.0
3.0
4.0
5.0
Pri
vacy
Ris
k -
Pre
dic
ted AP-PR
PR-CNN
1.0 2.0 3.0 4.0 5.0
Privacy Risk - GT
1.0
2.0
3.0
4.0
5.0
Pri
vacy
Ris
k -
Pre
dic
ted AP-PR
PR-CNN
1.0 2.0 3.0 4.0 5.0
Privacy Risk - GT
1.0
2.0
3.0
4.0
5.0
Pri
vacy
Ris
k -
Pre
dic
ted AP-PR
PR-CNN
1.0 2.0 3.0 4.0 5.0
Privacy Risk - GT
1.0
2.0
3.0
4.0
5.0
Pri
vacy
Ris
k -
Pre
dic
ted AP-PR
PR-CNN
1.0 2.0 3.0 4.0 5.0
Privacy Risk - GT
1.0
2.0
3.0
4.0
5.0
Pri
vacy
Ris
k -
Pre
dic
ted AP-PR
PR-CNN
1.0 2.0 3.0 4.0 5.0
Privacy Risk - GT
1.0
2.0
3.0
4.0
5.0
Pri
vacy
Ris
k -
Pre
dic
ted AP-PR
PR-CNN
1.0 2.0 3.0 4.0 5.0
Privacy Risk - GT
1.0
2.0
3.0
4.0
5.0
Pri
vacy
Ris
k -
Pre
dic
ted AP-PR
PR-CNN
Figure 14: Qualitative results for Personalized Privacy Risk Prediction
20
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30Profile number
05
1015202530
# U
sers
in P
rofile Q1
Q2Q3
Q4
0.0 0.2 0.4 0.6 0.8 1.0
Recall
0.0
0.2
0.4
0.6
0.8
1.0
Q1
Pre
cisi
on
Risk = 1.0+
AP-PR
PR-CNN
0.0 0.2 0.4 0.6 0.8 1.0
Recall
Risk = 2.0+
0.0 0.2 0.4 0.6 0.8 1.0
Recall
Risk = 3.0+
0.0 0.2 0.4 0.6 0.8 1.0
Recall
Risk = 4.0+
0.0 0.2 0.4 0.6 0.8 1.0
Recall
0.0
0.2
0.4
0.6
0.8
1.0
Q2
Pre
cisi
on
Risk = 1.0+
AP-PR
PR-CNN
0.0 0.2 0.4 0.6 0.8 1.0
Recall
Risk = 2.0+
0.0 0.2 0.4 0.6 0.8 1.0
Recall
Risk = 3.0+
0.0 0.2 0.4 0.6 0.8 1.0
Recall
Risk = 4.0+
0.0 0.2 0.4 0.6 0.8 1.0
Recall
0.0
0.2
0.4
0.6
0.8
1.0
Q3
Pre
cisi
on
Risk = 1.0+
AP-PR
PR-CNN
0.0 0.2 0.4 0.6 0.8 1.0
Recall
Risk = 2.0+
0.0 0.2 0.4 0.6 0.8 1.0
Recall
Risk = 3.0+
0.0 0.2 0.4 0.6 0.8 1.0
Recall
Risk = 4.0+
0.0 0.2 0.4 0.6 0.8 1.0
Recall
0.0
0.2
0.4
0.6
0.8
1.0
Q4
Pre
cisi
on
Risk = 1.0+
AP-PR
PR-CNN
0.0 0.2 0.4 0.6 0.8 1.0
Recall
Risk = 2.0+
0.0 0.2 0.4 0.6 0.8 1.0
Recall
Risk = 3.0+
0.0 0.2 0.4 0.6 0.8 1.0
Recall
Risk = 4.0+
Figure 15: Precision-Recall curves when visualized over groups of user profiles
21
of figure) from natural-looking images such as cars withvisible license plates or family photographs depicting re-lationships. In these cases, PR-CNN is better at evaluatingrisks. (iii) Considering the attributes in which AP-PR incurshigh errors (e.g. relationships, addresses, username, signa-ture, credit card), we see that PR-CNN outperforms in allthese cases bypassing incorrect attribute predictions.
22