Privacy in Computer Vision
Cameras capture bystanders, plates, and screens along with their subject. Privacy work removes or protects those extras while keeping the task accuracy intact.
Why Does This Exist?
A retail counter, a street camera, or a training crawl photographs people who never consented to be training data: faces, plates, badges, screens. Storing raw frames creates a searchable gallery of strangers, and models memorize details they were never asked to keep.
Privacy in vision covers the capture-to-deletion chain: minimize what is recorded, redact what is stored, and prove the trade. General ML privacy tools are covered in privacy in ML, with formal guarantees in differential privacy and decentralized training in federated learning. This page covers the vision half: redaction, re-identification risk, and retention.
Think of It Like This
A courtroom sketch artist
Court artists draw the witness clearly and render jurors as blank shapes, because the record needs testimony, not bystander faces. The sketch stays useful for the trial while nobody in the gallery becomes searchable.
Vision redaction works the same way. Faces and plates get blurred or masked at capture, the counting or defect task runs on the rest, and raw frames expire on a short clock. The analogy stops at reversibility: a heavy blur can still leak under reconstruction attacks, while a sketch never contained the face at all.
How It Actually Works
The threat model names the attacker first: gallery matching (is this face in the database), attribute inference (what can be read off), and reconstruction from stored crops. Defenses layer accordingly: detect and blur faces and plates before storage, process on device so raw frames never leave the camera, aggregate counts instead of saving identities, and set retention clocks in days, not years. Each layer states its measurable trade against task accuracy.
The demo numbers that price it
On a demo gallery of 100 identities with a people-counting task: raw frames re-identify 83 of 100 via a public face matcher while counting accuracy is 0.96. Gaussian face blurring drops re-identification to 9 of 100 while counting accuracy falls to 0.94, a 2-point price. Full head masking drops re-identification to 2 of 100 but counting falls to 0.88. So blurring is the knee of the curve here: most of the privacy gain for little task loss, with masking reserved for higher-risk deployments.
Watch Out For
Treating blur as a guarantee
Common blurs leave enough structure for modern matchers, and cropped bodies with clothing and gait still identify. The symptom is a blurred release that re-identifies at 40 of 100 in an audit. Measure with a real matcher on redacted outputs, and add masking or deletion where the number stays high.
The Quick Version
- Vision systems capture bystanders along with subjects, so privacy starts at capture.
- Threats are gallery matching, attribute reading, and reconstruction from stored crops.
- On the demo gallery blurring cuts re-identification 83 to 9 for a 2-point task price.
- Layer blurring with on-device processing, aggregation, and short retention.
- Audit redacted outputs with a real matcher; blur alone is not a guarantee.