This work tackles the Pixel Privacy task put forth by MediaEval 2019. Our goal is to decrease the accuracy of a classification algorithm while preserving the original image quality. We use the fast gradient sign method, which normally has a corrupting influence on image appeal, and devise two methods to minimize the damage. The first approach uses a map that is a combination of salient and flat areas. Perturbations are more noticeable in these locations, and so are directed away from them. The second approach adds the gradient of an aesthetic algorithm to the gradient of the attacking algorithm to guide the perturbations towards a direction that preserves appeal. We make our code available at: https://git.io/JesX

Linardos, Panagiotis

Little, Suzanne

McGuinness, Kevin

arXiv

Irish Universities

MediaEval 2019: concealed FGSM perturbations for privacy preservation

DCU Online Research Access Service

MediaEval 2019: Concealed FGSM Perturbations for PrivacyPreservationPanagiotis Linardos, Suzanne Little, Kevin McGuinnessDublin City Universitylinardos.akis@gmail.comABSTRACTThis work tackles the Pixel Privacy task put forth byMediaEval 2019.Our goal is to decrease the accuracy of a classification algorithmwhile preserving the original image quality. We use the fast gradientsign method, which normally has a corrupting influence on imageappeal, and devise two methods to minimize the damage. The firstapproach uses a map that is a combination of salient and flat areas.Perturbations are more noticeable in these locations, and so aredirected away from them. The second approach adds the gradient ofan aesthetic algorithm to the gradient of the attacking algorithm toguide the perturbations towards a direction that preserves appeal.We make our code available at: https://git.io/JesXr.1 INTRODUCTIONThe Pixel Privacy task, introduced by MediaEval [11], aims at de-veloping methods for manipulating images in a way that foolsautomatic scene classifiers. As an added constraint, the imagesshould not exhibit a decrease in aesthetic quality; it is even encour-aged that their appeal increases. The organizers made available thePlaces365-Standard data set [10] along with a pre-trained scenethreat model following the ResNet [3] for the task. In this work,the classification model will be referred to as “threat model.”The contribution of image enhancement techniques in privacyprotection has been previously explored [1], showing that evenpopular filters used in social media have a cloaking effect againstgeo-location algorithms. A more recent work by Liu et al. [6] pro-posed a perturbation-based approach (white-box) and a transferstyle approach (black-box). Similar to the first module in that work,we propose two perturbation-based approaches and explore ways tolocalize the perturbations in a manner that does not reduce appeal.2 APPROACHWe developed two approaches, both of which utilize the FGSMadversarial attack [2]. This method uses the gradient of the threatmodel and changes the pixel values by nudging them towards the di-rection that maximizes the loss. The magnitude of this perturbationis represented by the value ϵ , which is essentially the strength ofthe attack. Note that we used the threat model’s gradients, makingthis a white-box setting.To mitigate the corrupting effect the FGSM attack has on theimage, our first approach uses a combination of saliency mapsand Sobel filters. The goal is to localize the perturbations in areasthat are less obvious to observers. Our second approach constrainsthe attack towards a direction that is more aesthetically pleasing,Copyright held by the owner/author(s).MediaEval’19, 27-29 October 2019, Sophia Antipolis, France(a) Original Image (b) Sobel Map(c) Reverse Saliency Map (d) Final MapFigure 1: Maps used to constrain perturbations on less obvious ar-eas. The reverse saliencymap alongwith the Sobelmap produce thefinal map.by using also the gradient of the aesthetics assessment algorithm(NIMA).2.1 Salient DefenceWe combine two maps: one is a measure of saliency and the other ameasure of flatness. Salient areas are the ones that are more likelyto attract the eye of an observer. We use a deep neural network thatpredicts saliency from images to detect these areas. In particular, weuse a SalBCE [5] trained on the SALICON dataset [4]. Furthermore,perturbations become more obvious when they are located in flatareas. For this reason, we also used a Sobel filter [8], which detectsareas where edges are more prevalent and Gaussian blurring ( σ=10)to spread the detected edges, forming a map. The saliency map isreversed so that the pixels corresponding to salient areas are zeroedout. Then, pixels where the mean value is below average on theSobel map (hence more likely to be a flat area) are also zeroed out.The resulting map is then multiplied by ϵ as well as the gradient ofthe network and added to the original image, completing the attack.Figure 1 illustrates an example of map generation.Additionally, we used a popular filter for image manipulation,namely tilt-shift to inspect how it affects the efficacy of our ap-proach. Tilt-shift essentially blurs parts of the background whileintensifying foreground. In our case we used the saliency maps asan estimate of the foreground to be intensified, blurring the rest.MediaEval’19, 27-29 October 2019, Sophia Antipolis, France P. Linardos et al.Figure 2: Threat model accuracy under differing values of ϵ .2.2 Coupled OptimizationThe second approach exploits the gradients of both the threat modeland the aesthetics evaluation algorithm. The aesthetics evaluationin our case is the NIMA algorithm [9]. Since the networks differsignificantly, the gradients need to be normalized to unit length inorder to be brought to the same scale. Afterwards, NIMA’s gradientis subtracted from ResNet’s and as a result we get the sign of thetotal gradient and multiply that by ϵ .3 RESULTS AND ANALYSISIn our initial experiments, we used a variety of ϵ values to investi-gate how it affects the accuracy of the threat model (Figure 2). Com-pared with the default FGSM attack, our approach is constrainedon non-flat, non-salient areas, which naturally reduces the strengthof the algorithm as less pixels are perturbed. We also note thatadditional manipulations on the image (tilt-shift filter in this case)further reduce the efficacy of those perturbations. The coupled op-timization approach, on the other hand, has a higher impact on theaccuracy of the threat model, as it manipulates all the pixels of theimage. Note that we obtained these results using the original fullsize of each image from Places365.On the other hand, images evaluated by the MediaEval team(Table 1) were first downsampled to 256 × 256 and the algorithmswere applied afterwards. Note that this set includes only images thatResNet predicts successfully, therefore the initial accuracy (ϵ = 0)is 100%. In that case it seems that the tilt-shift effect actually addsto the efficacy of the perturbations, bringing the accuracy of thethreat model down.To test NIMA’s sensitivity to perturbations, we attempted avanilla FGSM attack with a very high ϵ = 0.15 on a small sub-set (100) of the validation images. This type of attack effectivelyruins the visual appeal; however, the NIMA score drops by only(a) Vanilla FGSM epsilon=0.05 (b) Salient Defence epsilon=0.05(c) S. D. & tshift epsilon=0.01 (d) Coupled Opt. epsilon=0.05Figure 3: The most promising configurations contrasted with theoriginal FGSM.Methods ϵ Top-1 Acc.↓ NIMA Score↑S. Defence 0.01 0.937 4.630.05 0.735 4.58S. Defence & tilt-shift 0.01 0.868 4.75C. Optimization 0.01 0.917 4.630.05 0.458 4.54Original Test Set - 1.0 4.64Table 1: Results on MediaEval test set. Top-1 accuracy refers to thethe prediction accuracy of the threat model (ResNet50 trained onPlaces365-standard data set). TheNIMAScore column represents theaverage of the aesthetics scores.a small amount (from 4.26 to 3.98). This indicates that NIMA haslow-sensitivity to adversarial perturbations. NIMA was trainedon AVA [7], a dataset collected by photographers. The model is,therefore, sensitive high-level concepts of aesthetic appeal, such asthe rule of thirds, but has not been trained to be sensitive to thelow-level corrupting influence of perturbations.4 DISCUSSION AND OUTLOOKOur qualitative analysis showed that these perturbations, evenwhen hidden, become more obvious on a high-resolution image.This stems from a rather obvious shortcoming of our salient defencealgorithm: that saliency is subject to change after manipulationsto the image. We believe that future effort should be targeted to-wards reducing the saliency of these perturbations. Furthermore,our coupled optimization approach effectively fools NIMA withouttruly preserving appeal. We believe that aesthetic algorithms thattake into consideration low-level cues such as perturbations couldimprove the efficacy of this approach.Pixel Privacy MediaEval’19, 27-29 October 2019, Sophia Antipolis, FranceACKNOWLEDGMENTSThis publication has emanated from research conducted with thefinancial support of Science Foundation Ireland (SFI) under grantnumber SFI/15/SIRG/3283 and SFI/12/RC/2289REFERENCES[1] Jaeyoung Choi, Martha Larson, Xinchao Li, Kevin Li, Gerald Friedland, andAlan Hanjalic. 2017. The geo-privacy bonus of popular photo enhancements. InProceedings of the 2017 ACM on International Conference on Multimedia Retrieval.ACM, 84–92.[2] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining andharnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014).[3] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep residuallearning for image recognition. In Proceedings of the IEEE conference on computervision and pattern recognition. 770–778.[4] Ming Jiang, Shengsheng Huang, Juanyong Duan, and Qi Zhao. 2015. Salicon:Saliency in context. In Proceedings of the IEEE conference on computer vision andpattern recognition. 1072–1080.[5] Panagiotis Linardos, Eva Mohedano, Juan Jose Nieto, Noel E O’Connor, XavierGiro-i Nieto, and Kevin McGuinness. 2019. Simple vs complex temporal recur-rences for video saliency prediction. arXiv preprint arXiv:1907.01869 (2019).[6] Zhuoran Liu and Zhengyu Zhao. 2018. First Steps in Pixel Privacy: ExploringDeep Learning-based Image Enhancement against Large-Scale Image Inference..In MediaEval.[7] Naila Murray, Luca Marchesotti, and Florent Perronnin. 2012. AVA: A large-scaledatabase for aesthetic visual analysis. In 2012 IEEE Conference on Computer Visionand Pattern Recognition. IEEE, 2408–2415.[8] Irwin Sobel and Gary Feldman. 1968. A 3x3 isotropic gradient operator for imageprocessing. a talk at the Stanford Artificial Project in (1968), 271–272.[9] Hossein Talebi and Peyman Milanfar. 2018. Nima: Neural image assessment.IEEE Transactions on Image Processing 27, 8 (2018), 3998–4011.[10] Bolei Zhou, Agata Lapedriza, Aditya Khosla, Aude Oliva, and Antonio Torralba.2017. Places: A 10 million image database for scene recognition. IEEE transactionson pattern analysis and machine intelligence 40, 6 (2017), 1452–1464.[11] Martha Larson Zhuoran Liu, Zhengyu Zhao. 2019. Pixel Privacy 2019: ProtectingSensitive Scene Information in Images. MediaEval (2019).

http://doras.dcu.ie/23779/1/MediaEval_2019___Pixel_Privacy.pdf

MediaEval 2019: concealed FGSM perturbations for privacy preservation

Abstract

Similar works

Full text

Available Versions

Irish Universities

DCU Online Research Access Service