Privacy Blur: Quantifying Privacy and Utility for Image Data Release

2025-12-17

AI Summary

This paper addresses the privacy–utility trade-off in image data publication by systematically evaluating four anonymization techniques: Gaussian blurring, pixelation, DP-Pix (pixelation with differential privacy noise), and cropping. We identify a critical vulnerability: low-intensity Gaussian blurring is susceptible to reversible inversion attacks. To address this, we propose a pixelation parameter optimization criterion grounded in image degradation modeling and jointly evaluated against discriminative and inversion attacks. We further release PrivacyBlur, an open-source, standardized toolkit for privacy-preserving image blurring. Experimental results demonstrate that, at practical granularity levels, pixelation and DP-Pix substantially outperform Gaussian blurring—achieving inversion attack success rates below 8% (a 3.2× privacy gain) while incurring less than 2.1% accuracy degradation on downstream self-supervised and supervised learning tasks. The toolkit includes empirically validated, ready-to-use optimal parameter configurations.

Technology Category

• Computer Vision: Bias, Fairness & Privacy
• Machine Learning: Privacy
• Natural Language Processing: Ethics — Bias, Fairness, Transparency & Privacy

Application Category

• Security and Privacy: Privacy-enhancing technologies
• User Modeling, Personalization and Recommendation: User privacy protection in personalized systems
• Responsible Web: Data and user privacy-enhancing technologies for the Web

Abstract

Image data collected in the wild often contains private information such as faces and license plates, and responsible data release must ensure that this information stays hidden. At the same time, released data should retain its usefulness for model-training. The standard method for private information obfuscation in images is Gaussian blurring. In this work, we show that practical implementations of Gaussian blurring are reversible enough to break privacy. We then take a closer look at the privacy-utility tradeoffs offered by three other obfuscation algorithms -- pixelization, pixelization and noise addition (DP-Pix), and cropping. Privacy is evaluated by reversal and discrimination attacks, while utility by the quality of the learnt representations when the model is trained on data with obfuscated faces. We show that the most popular industry-standard method, Gaussian blur is the least private of the four -- being susceptible to reversal attacks in its practical low-precision implementations. In contrast, pixelization and pixelization plus noise addition, when used at the right level of granularity, offer both privacy and utility for a number of computer vision tasks. We make our proposed methods together with suggested parameters available in a software package called Privacy Blur.

Problem

• Evaluates privacy-utility tradeoffs in image obfuscation methods
• Shows Gaussian blur is reversible and least private in practice
• Proposes pixelization and DP-Pix for better privacy and utility

Innovation

• Gaussian blur reversal vulnerability exposed
• Pixelization with noise addition balances privacy utility
• Software package Privacy Blur implements optimized parameters