arXiv CSopen access

Bit-ViP: Leveraging Bit-planes to Preserve Visual Privacy in Images through Obfuscation

Accepted for publication in IEEE Transactions on Emerging Topics in Computing (TETC)

Bit-ViP: Leveraging Bit-planes to Preserve Visual Privacy in Images through Obfuscation Vishesh Kumar Tanwar∗ , Ashish Gupta† , Sanjay Madria∗ , and Sajal K. Das∗

∗ Department of Computer Science, Missouri University of Science and Technology, USA

† Department of Computer Science and Engineering, BITS Pilani Dubai Campus, Dubai, UAE

arXiv:2606.29417v1 [cs.CV] 28 Jun 2026

{vishesh.tanwar, madrias, sdas}@mst.edu, [email protected]

Abstract—The unprecedented growth of computer vision applications, such as surveillance systems and social media, raises security and visual privacy concerns, especially when data is stored on cloud servers. Image obfuscation offers a way to preserve visual privacy while maintaining an adequate level of usability; thus, it has been a topic of great interest in recent years. However, prior obfuscation schemes are either vulnerable to malicious attacks, such as model inversion to reconstruct original images from obfuscated images, or generate non-trainable obfuscated images, making them unusable for achieving reasonable accuracy. This paper proposes a novel bit-plane-based image obfuscation scheme, Bit-ViP, to preserve visual privacy for image-based recognition tasks. The BitViP scheme produces secure, usable images by incorporating an innovative end-to-end obfuscation function. While doing so, the obfuscated image would contain non-invertible noise (generated by Lorenz’s chaotic system and differential privacy), making it hard for an adversary to reconstruct the original image. We conduct extensive experiments on two popular activity recognition datasets, namely UCF101 and HMDB51, to validate the effectiveness of Bit-ViP. In the face of attacks on reconstruction, pixel frequency, information entropy, and pixel inter-correlation, we present a rigorous security analysis demonstrating tangible improvements over existing schemes.

Image Database

Gender Clothes Activity Race

Surveillance

Surveillance

Camera 1

Camera 2

Fig. 1: Illustrating an airport surveillance scenario. Images uploaded to a cloud server may expose visual attributes such as gender, race, and clothes.

gender, race, travel details, etc., by attacking the server. In such scenarios, a unified security and privacy assurance scheme must be integrated with cloud services to create secure data storage without harming the usability of cloud-based applications. In addition, privacy-preserving schemes protect the visual privacy of image information, especially in scenarios where raw data transmission to the cloud for processing may pose security and privacy risks, thereby enhancing user trust in sharing their data for machine learning (ML) purposes. This is especially important in applications such as healthcare and surveillance, where data security and privacy are critical. However, most existing schemes either focus on data security [3] or on privacy-preserving processing [4], but not both simultaneously, which we address in this paper. A straightforward way to preserve individuals’ visual identity is to obfuscate their faces via blurring [5] before storing the data on a cloud. Extending the obfuscation from the face to the entire image can be accomplished by down-sampling [6], [7] to conceal V-PII that otherwise is apparent in the high-resolution images. On a similar track, the authors in [8] incorporated downsampling and added Gaussian noise to the underlying image to obtain an obfuscated image that conceals activity information. Scrambling [9] and image encryption [10] are data security methods that break the inter-correlation of the pixels,

Index Terms—Image obfuscation, security, visual privacy

I. Introduction Due to advancements in digital camera technology and an unprecedented surge in the use of surveillance systems [1], the amount of image and video data has exploded on cloud servers. Traditionally, such data is uploaded in plain form (i.e., unobfuscated) to leverage the cloud’s resources for computer vision tasks such as object detection and face identification, which raises security and privacy concerns for the users because the involved companies may exploit the private visual information [2] or the cloud could be compromised. According to a survey 1 conducted over 2000 users, 97% of people accept inplace legal terms and conditions without reading carefully, further increasing the severity level of the issue. Consider a scenario of airport surveillance security in which multiple CCTV cameras are deployed to detect suspicious human activities. As shown in Fig. 1, the recorded data (image and video) are continuously uploaded to the cloud, which may invite adversaries to obtain passengers’ visual personal identification information (V-PII), such as their face, 1 https://www.usatoday.com/story/tech/2020/01/28/not-readingthe-small-print-is-privacy-policy-fail/4565274002/

1

thereby making the resultant image visually indecipherable and unusable to ML applications. Slightly different from obfuscation, cryptography-based approaches for secure data processing, such as fully homomorphic encryption (FHE) [11], secure multi-party computations [12], and Garbled Circuits [13] offer strong visual privacy; however, these approaches are computationally and communicationineffective with ML algorithms, imparting three major limitations: (1) Security and usability (accuracy): Though the prior encryption schemes [9], [11], [14] offer only good security by minimizing or breaking the pixels’ inter-correlation, the generated obfuscated images are not usable enough for training deep neural networks (DNNs) to achieve adequate classification accuracy (in other words, usability of the encrypted data). On the other hand, blurred [5] or downsampled [7] images preserve essential information for training DNNs, thereby demonstrating the high usability of obfuscated data, but they are vulnerable to malicious attacks such as data reconstruction [15]. Thus, the underlying privacy-preserving schemes lack essential security measures and may lead to information leakage from images. (2) Trusted server: In current client-server settings, the clients are bound to assume that the server is trustworthy because the underlying obfuscation schemes [6], [7] are designed and provided by the server. In most cases, the schemes are developed using data-driven DNNs whose inverse can be obtained by reverse training, posing a risk of adversarial attacks [15] if the server has malicious intent. Thus, users may be reluctant to adopt such solutions for sensitive applications. (3) Model architecture dependency: As the existing schemes [6], [7] employ fixed DNNs to generate an obfuscated image, they restrict the server to using only a fixed model architecture, which may not be suitable for the user’s application interests, thereby limiting users’ flexibility.

With lightweight computations, the Bit-ViP is suitable for low-configuration devices; thus, the obfuscation function need not be known to the server, making it independent of the server’s intentions and robust against adversarial access. • By employing two benchmark activity recognition datasets, UCF101 [16] and HMDB51 [17], we evaluate the usability (training the DNNs) and security effectiveness of the proposed method through rigorous qualitative and quantitative security analysis, demonstrating its superiority over existing recognition and data security schemes, respectively. This paper extends our prior work [18], which introduces an end-to-end image obfuscation scheme that secures data against reconstruction attacks and is supported by rigorous theoretical analysis, thereby solidifying the BitViP framework. The proposed obfuscation methodology has been advanced by integrating bit-plane perturbations with an exponential differential privacy (DP) mechanism, thereby achieving greater security. Extensive new experiments demonstrate the security and effectiveness of our novel approach, Bit-ViP, through a comparative analysis with well-established algorithms, highlighting the superiority of Bit-ViP. We also address real-time scalability by evaluating the computation time of the BitViP framework. Additionally, this scheme explains critical concepts, such as Privacy and Utility for the considered scenario, normalization, and binary thresholding while removing ambiguities related to labels. This extended version introduces a more refined problem statement with two practical use cases. Paper organization: Section II discusses the recent related research on obfuscation schemes, followed by preliminaries in Section III. The problem statement and threat model are explained in Section IV, and Section V proposes our image obfuscation method, with theoretical and qualitative analyses. We conduct extensive activity recognition experiments for the usability of obfuscated data and security attacks, and the results are reported in Section VI. Finally, Section VII concludes the paper with promising future directions. •

Contributions: Addressing the above limitations, we ensure the security and privacy of images stored on the cloud platform to enable efficient use, such as training a DNN for classification. Our major contributions are:

II. Related Work

We propose a novel end-to-end bit-planes-based image obfuscation scheme, Bit-ViP, to preserve V-PII for creating secure image storage. With an innovative design, we incorporate security into the original images by partitioning them into non-overlapping rectangular blocks, thereby introducing chaotic confusion at the bit-plane level. Then, non-invertible, bounded, and differentially private noise is added to each block to improve usability. • Unlike prior approaches, the Bit-ViP offers more robust security against malicious attacks like reconstruction and de-identification attacks by injecting non-invertible noise at a bit-plane level while making a comparatively lesser compromise on the recognition accuracy.

This section presents the current status of the literature on obfuscation methods. We divided the prior works into two categories based on the underlying process.

•

A. Learning-based obfuscation methods By introducing a privacy-preserving system for accessing users’ images stored in the social-media cloud, the authors in [5] focused on blurring users’ faces and preventing identity leakage. In [6], the face resolution is reduced to an extremely low level (via downsampling) to preserve privacy, while the image background is enhanced to improve the models’ learning capability. On the same track, DeepBlur [7] is proposed to prevent face re-identification attacks by obfuscating the latent feature space of the unconditional generative adversarial 2

network [19]. However, this scheme significantly fails to protect users’ other privacy attributes like gender, race, location, clothes, etc. To improve the classification in extremely Low Resolution (eLR) space, a mosaicing approach is leveraged in [20], but still, the resultant obfuscated image is highly vulnerable to differential attacks. Although [21] introduces an effective optimization approach to improve the underlying DNN’s recognition accuracy while achieving strong privacy protection against adversarial attacks, it assumes the presence of a trusted server, which we relax in our obfuscation scheme. Unlike down-sampling-based approaches, the authors in [22] combined high-resolution and eLR videos to improve activity recognition by leveraging spatial-temporal attention. The spatial-temporal information is also exploited in [23], where the authors argued that training the model on eLR images and using a teacher-student knowledge distillation approach could enhance visual privacy and improve accuracy. Recently, [24] brought in the concept of event-to-image and an event-based camera that captures only a fraction of visual information, thereby hiding susceptible details and offering strong visual privacy, contrasting Bit-ViPs’ motivation.

fail to preserve image usability for DNNs because they lose the pixels’ intercorrelations. Therefore, this work proposes a Bit-ViP scheme with adequate security while maintaining strong data usability for activity recognition through bit-plane-based obfuscation. III. Preliminaries To better understand our obfuscation scheme, we first define privacy and usability in this context, then discuss Lorenz’s chaotic structures and differential privacy. Definition 1. Privacy: It refers to how obfuscated image data effectively conceals sensitive visual information, ensuring that an adversary cannot reconstruct or identify the original content. Thus, the scheme protects individuals’ visual identities, prevents misuse, and maintains the data’s utility for intended applications. Definition 2. Usability: It is defined as the ability of obfuscated image data to maintain sufficient quality and integrity to effectively train DNNs using temporal features, resulting in good recognition accuracy while ensuring security from adversarial attacks. A. Random noise generation using Lorenz’s chaotic structures As Bit-ViP aims to insert a non-invertible noise into the input image, we reviewed the related literature and found that chaotic structures [27] are a favorable choice for securing image information, as they are unpredictable and non-reproducible. Following the work [27], we utilize Lorenz’s chaotic structures on three variables x, y, z, defined as:

B. Non-learning based obfuscation methods To protect the privacy of social media images, in [25], the images are pixelized by partitioning the input image into blocks and assigning an average intensity value to each block. Later, differentially private Gaussian noise is added to these values to protect V-PII. However, this scheme significantly harms image usability. Similarly, the authors in [8] utilized position-based superpixel transformation and Gaussian noise on RGB-depth video data to build an activity recognition system. In [9], a block-based image scrambling technique is introduced where discrete wavelet transformation is employed to secure the image. The work [11] presented a scheme, called CryptoNets, to obfuscate gray-scale images using the fully homomorphic encryption (FHE) scheme; however, due to computational and storage overheads, this scheme cannot be scaled for complex image and video datasets. To prevent biometric features while authenticating the individual, the study in [14] proposed a privacy-preserving face recognition protocol. [26] presented a secure multi-classification scheme to address the privacy leakage in robot systems using DNNs. Two activation-cost function pairs using homomorphic encryption, namely softmax plus log-likelihood and sigmoid plus cross-entropy, were adopted to enable secure computation. Recently, an image obfuscation method based on combining various chaotic systems and hash functions was presented in [10]. Although this method exhibits strong cryptographic properties, it destroys image usability for DNN training. Limitations: The methods in Section II-A leverage DNNs to obtain obfuscated data but are prone to various adversarial attacks by reversing the training. In contrast, the latter ones in Section II-B offer strong cryptographic security against various malicious attacks. However, they

dx = α(y − x), dt

dy dz = βx − y − xz, and = xy − γz, (1) dt dt

where α, β, γ are the system parameters. Solution hyperplane of this equation system has chaotic nature for (α = 10, β = 28, γ = 8/3); the chosen values are borrowed from [27]. Let S ∈ Rnumsol ×3 denote a solution matrix of Eq. 1, where numsol is total number of solutions. To initialize the noise for image obfuscation, we define a nonlinear transformation ζ : S → M2 (R) as   −6b + 2c a−b+c+1 ζ(a, b, c) = , (2) −a + b − 6c − 8 3a − b + 4c where M2 (R) is the ring of matrices of order two with real entries. We randomly choose one solution in S, say s ∈ R3 , and transform as ζ(s) using Eq. 2, which generates two vectors [n11 , n21 ] and [n12 , n22 ], taken row-wise. Bit-ViP leverages these vectors to perturb the QR components in Section V-A. B. Differential Privacy (DP) The work [28] ensures data privacy, where the data remains useful for analytics, specifically for the training of DNNs, without revealing any private information. The fundamental idea is to introduce randomness into the original data so that private information cannot be inferred from the altered data, while preserving statistical information, even with the adversary having unlimited computational resources. 3

Definition 3. A randomized mechanism M is said to be ϵ-Differential Privacy if for any two datasets D and D′ differs with one element, and all subsets U of possible range Y,

B. Threat Model The Bit-ViP involves two entities: an “honest” user U who outsources the image database D to train an activity recognition model while protecting the images’ visual information, and an “honest-but-curious2 ” CSP, denoted by C, provides the ML model training services with storage and computational resources in a pay-peruse business model. The visual information in each image of D is obfuscated at the user-end using our proposed image obfuscation scheme in Section V, resulting in the obfuscated image database, denoted by Dobs , which is then transmitted, through a secure communication channel, to C for training a DNN model. In our model, U does not hold control over the DNN architecture selection and computations performed by C over DObs . The server would share the final trained model with the user for local future inference. It is important to note that our threat model protects only image information, not the associated ground truth labels. From our security viewpoint, the obtained information is meaningless if an adversary attempts to extract the visual information from an obfuscated image in DObs . Scope of reconstruction attacks: Our threat model focuses on preventing exact or near-exact recovery of the original visual information from the obfuscated database. We do not consider distributional re-synthesis or semantic regeneration attacks, where an adversary uses strong generative priors, such as super-resolution, hallucination, GAN-based latent search, or diffusion inversion, to synthesize a plausible image consistent with the obfuscated input [29]. These attacks are important but remain outside the scope of this work and will be evaluated in future extensions of Bit-ViP. Non-visual channels: Although this paper focuses on protecting visual channels by obfuscating the pixels to resist reconstruction/de-identification attacks while maintaining the ML model utility. However, label information and auxiliary metadata (timestamps, device IDs, GPS/EXIF) may contribute to inference risk. It is important to note that these channels are orthogonal to Bit-ViP and can be mitigated by introducing a label-privacy mechanism, such as label DP (randomized response at the class label) or PATE (noisy aggregation of teacher votes), and by using server-side DP-SGD during training when using a CSP. We make these options explicit and consider them as composable modules with the Bit-ViP.

P r [M (D) ∈ U ] ≤ exp(ϵ) · P r [M (D′ ) ∈ U ] IV. Problem Statement and Threat Model A. Problem Statement This paper considers the standard setting for privacypreserving centralized training of a DNN on a cloud server. In Bit-ViP, a user has a sensitive image database and would like to train a DNN model for predefined applications on a cloud platform. However, the cloud service provider (CSP) may be “untrusted” and tries to (i) extract users’ sensitive information from the transmitted images and (ii) leverage the database to develop their models for other applications, benefiting themselves. However, users’ images may contain sensitive and confidential information that could be leaked, significantly impacting users’ lives. Similarly, privacy concerns would arise if an adversary compromised the cloud platform. For more clarification, we provide two scenarios. Scenario 1 (Home and Office Surveillance): A user with a network of smart surveillance cameras at home and office seeks to develop a personalized activity recognition and object detection DNN model for sensitive labeled videos. Lacking deep learning expertise and resources, the user opts for cloud-based development. However, transmitting unobfuscated (or plain) images poses privacy risks, as they contain sensitive details (visual identity, daily routines, family information, etc.). The proposed solution allows users to obfuscate images before transmission while retaining labels for effective DNN training, ensuring privacy and usability. Scenario 2 (CSP Leveraging User Data): CSPs often face challenges in collecting robust user data for DNN model development. A CSP might be tempted to utilize usertransmitted labeled surveillance data without consent, raising ethical and legal concerns. Our approach enables users to obfuscate their surveillance videos, preserving visual privacy while the labels remain intact. This ensures the user’s visual privacy is not compromised while CSPs use data for model training. Adding the above scenarios, our proposed scheme can be enhanced for the following applications: 1) Label Retention for Effective Training: In our approach, the associated labels to each image can be retained and transmitted securely while the images undergo obfuscation. This ensures that the DNNs can still be trained effectively using the labeled, obfuscated images. 2) Semi-Supervised and Unsupervised Learning: Bit-ViP opens avenues for semi-supervised and unsupervised learning models, where labels may not be available. In such scenarios, DNNs can learn from obfuscated images, with labels playing a supportive rather than a central role.

V. Proposed Obfuscation scheme This section proposes our Bit-ViP obfuscation scheme to conceal users’ V-PII when image data is stored in a cloud database, while maintaining security. Unlike prior schemes [30], [31] that obfuscate images by pixel location permutation, Bit-ViP follows a novel idea by obfuscating each pixel of the input image via incorporating chaoticness 2 It always follows the defined protocol but would try to extract information from users’ transmitted database.

4

and non-invertible noise without altering its location. BitViP produces a non-invertible image, i.e., the original image cannot be reconstructed from its obfuscated form, thereby protecting it from malicious activities such as reconstruction attacks.

Partitioning Image

A. Bit-ViP Scheme Existing image obfuscation schemes obfuscate the secret image as a whole (by adding noise to each pixel intensity value ranging from 0 to 255), which significantly destroys the image’s spatial features, such as pixel intercorrelations, and the resulting obfuscated image is least usable for DNN model training. Contrasting prior approaches, we propose an end-to-end scheme to obfuscate an image, say I, while preserving its usability by partitioning I into nonoverlapping rectangular subimages (a.k.a. blocks). The intuition behind image partitioning to bound the noise range is to be incorporated with the block’s pixel intensity range to mitigate the effect of one block’s obfuscation on another region of the image. The approach helps obfuscate each non-overlapping region of the secret image with different noise ranges, thereby masking the corresponding spatial features and supporting DNN training. Bit-ViP obfuscates the input image through block-based bit-planes obfuscation. Then, we add Differentially Private (DP) noise to each pixel of the obtained image. Fig. 2 demonstrates the overall obfuscation process of our scheme. We aim to perturb the bit-planes of each sub-image using a chaotic structure that would spread and accumulate to each pixel intensity value during reconstruction via bit-plane combination, without altering pixel locations. Injection of non-invertible, bounded DP-noise into pixels protects image information from vulnerabilities arising from the unstable periodicity of chaotic maps and limited computing precision [32]. Assume the dimension of I is m × n which we partition into L non-overlapping blocks, each of dimension τ1 × τ2 ,  denoted as Ib1 , Ib2 , · · · IbL , where L = τm×n ∈ N. Each 1 ×τ2 block may be perceived as a τ1 × τ2 -dimensional grayscale image. Given L gray-scale blocks, first, we perform obfuscation on each block as follows.

Original image

Obfuscated blocks

Bit-plane extraction QR-Decomposition Lorenz's chaotic noise

backward step

Incorporate differentially private noise

forward step

Each block

Combining blocks

Obfuscated blocks

Obfuscated Image

Fig. 2: An overview of the proposed image obfuscation scheme, BitViP.

Next, we compute QR-decomposition of k th bit-plane of Ibl as  Q  R BPkl = BPkl × BPkl ∀ k = 5, 6, 7, 8 (4)  Q  R where BPkl and BPkl are orthogonal and uppertriangular feature maps of dimensions τ1 × τ2 . The QRdecomposition technique is robust to small perturbations, i.e., small perturbations in the QR components result in a variance in the original bit-plane, thereby introducing the desired level of randomness in the generated obfuscated image during reconstruction [34]. Here, Bit-ViP leverages the vectors [n11 , n21 ] and [n12 , n22 ], generated by Lorenz’s chaotic structures in Section III-A, to produce an noninvertible chaoticness for pixel location (i, j) as Q 1 1 1 noiseQ ij = n1 + (n2 − n1 ) × randij 1 2 2 R noiseR ij = n2 + (n2 − n1 ) × randij ,

Forward step – Each lth block, Ibl , contains pixel intensity values in the range [0, 255] that can be represented by an 8-bit binary sequence [33], and thus Ibl can be partitioned into 8 bit-planes, denoted as BP1l , BP2l , · · · , BP8l , 1 ≤ l ≤ L, and each of dimension equal to Ibl , as depicted in Fig. 3. Mathematically, thel bit-planes are computed as Ib mod 2 ∀ k = 1, 2, .., 8 (3) BPkl = k−1 2 where ⌊·⌋ represents the floor function. It is well established in the literature [33] that almost all 93% − 94% of the total image information is contained in the last four most significant bit-planes. In contrast, the first four least-significant bit-planes contain nearly 6% − 7% only (see Table 1 in [33]). Thus, it is worth performing operations for the last four bitplanes, BP5l , BP6l , BP7l , BP8l , making Bit-ViP efficient and lightweight.

⌊

Original blocks

(5)

R where randQ ij and randij are random values generated by Gaussian distribution N (0, 1), 1 ≤ i ≤ τ1 and 1 ≤ j ≤ τ2 . Now, we obfuscate each QR component of bit-plane BPkl as   l Q Q BPk obs (i, j) = BPkl (i, j) + noiseQ ij  l R  l R R (6) BPk obs (i, j) = BPk (i, j) + noiseij .

⌋

Crucially, the independent and bounded noise is injected at values of Q and R, and the reverse composition of noisy components makes a significant perturbation in each reconstructed bit-plane and, hence, the whole block Ibl . R Moreover, as noiseQ ij and noiseij incorporate the chaotic noise vectors, the obfuscated QR components are now in real-valued space.

5

0

0

0

1

0

0

0

0

1

0

1

0

8.4180 -4.8152

7.7109 -5.5223

-0.7071 0.7071

7.6719 2.5158

6.9648 3.2229

-35.4967 53.8396

0

1

-1.4142 -1.4142

2.6839 5.5790

1.2697 4.1648

35.2736 16.3278

1

0

8.2008 -3.9341

8.2008 -3.9341

-0.7071 -0.7071

-4.1435 6.0259

-4.8506 5.3188

-0.7071 0.7071

-1.8183 9.9392

-2.5254 10.6463

0

26 9 31 11 Original block

-0.7071 -0.7071

1

1

1

1

0

1

1

1

Original

0

-1.4142

0

-7.2679 6.1095

-8.6821 6.1095

0

0

-3.5388 2.3813

-3.5388 2.3813

QR

Normalization and Binarization

23.2912 -16.9691 -15.7494 9.9231

39 152 26 0

1

1

0

1

0

0

1

67

Obfuscated block

Inverse QR-Decomposition

Lorenz's noise

Decomposition

Obfuscated

Bit-planes

Bit-planes

Fig. 3: Intermediate outputs of our proposed scheme for a given block of size 2 × 2.

Backward step – In this step, we perform inverse QRdecomposition, using Eq. 4, followed by normalization and thresholding to obtain obfuscated bit-planes. Since the results of inverse QR-decomposition contains nonbinary real values, Bit-ViP performs normalization over the range [0, 1] and then applies binary thresholding at the mean value of the normalized form,  which in turn generates the obfuscated bit-plane BPkl obs . Normalization scaled the obfuscated bit-plane values to fall within [0, 1] without distorting differences and maintaining consistent obfuscation quality. In other words, by bringing all images to a similar scale, normalization ensures that the obfuscation process affects each image uniformly. The approach is critical for images with varied lighting conditions or contrast, as it prevents them from being more or less obfuscated by their original pixel value ranges. In contrast, binary thresholding at the mean of the normalized image converts the floating-point values into a binary image (bit-plane). By setting the threshold at the mean for binary thresholding, approximately half the pixels would be above and half below, assuming a normal distribution of pixel values. This ensures that a significant portion of the image’s structure and content is retained, which is crucial for maintaining the utility of the obfuscated images for classification tasks. It creates a balance between obfuscating the image (for privacy) and retaining enough structural information (for usability). The conversion to binary effectively obscures finer details and textures that may contain sensitive information. This loss of detail inherently protects privacy, as it prevents the extraction of specific features that could identify individuals or sensitive objects in the image. Further, the normalization and thresholding steps make Bit-ViP a non-invertible obfuscation function that protects users’ VPII against malicious reconstruction and de-identification attacks originating from the image database. Later, we construct the obfuscated block. 8 X (7) [Ibl ]obs = [BPkl ]obs × 2k−1 , 1 ≤ l ≤ L

Algorithm 1: Bit-plane obfuscation Input: A bit-plane BP of dimension τ1 × τ2 and two noise vectors [n11 , n11 ] and [n12 , n22 ] generated in Section III-A 1 . Output: Obfuscated bit-plane BPobs /* Pixel obfuscation using QR-decomposition of BP */ [ ] Q R 2 BP , BP = QRDecompose (BP) for i ← 1 to τ1 do for j ← 1 to τ2 do q q q Q 5 noiseQ i,j = n1 + (n2 − n1 ) × randi,j r r r R 6 noisei,j = n2 + (n2 − n1 ) × randR i,j

3

4

7 8

end

9

Q BPobs (i, j) = BP Q (i, j) + noiseQ i,j R BPobs (i, j) = BP R (i, j) + noiseR i,j

10

end

11

/* Reconstruction of obfuscated bit plane from QR */ Q R BPobs = BPobs × BPobs

12

13 14

15 16

Compute maximum (Max) and minimum (Min) of BPobs obs −M in) BPobs ← (BP // Normalization (M ax−M in)

µ = mean(BPobs ) // Threshold for bit-plane Binarization for i ← 1 to τ1 do for j ← 1 to τ2 do{ BPobs (i, j) =

17

BPobs (i, j) ≤ µ BPobs (i, j) > µ

end

18 19

0, 1,

end

To this end, we have incorporated a degree of security to preserve the visual privacy of each block’s information, and the final obfuscated image can be obtained by combining the obfuscated blocks at their respective positions. However, numerous real-world image scenarios exist where partial protection of the image’s visual information is insufficient. For instance, images with large areas of uniform color or brightness can still be discernible post-obfuscation, and high-contrast images with simple geometric features might still be recognizable after obfuscation with small block sizes, resulting in differential and ML-based adversarial attacks. We introduce differential

k=1

For a block of size 2×2, Fig. 3 illustrates the intermediate outputs of our proposed scheme, and the pseudo-code for obfuscating a single bit-plane is presented in Algorithm 1. 6

privacy noise into the pixel values of the obfuscated blocks to ensure sufficient contrast in areas of uniform hue or brightness, thereby further concealing the original information. The most widely used ϵ-DP mechanisms in the research community are Laplacian and Gaussian [28], which focus on the privatization of numerical queries by simply adding noise to the pixel intensities themselves. In contrast, BitViP aims to protect local image features while perturbing the image without compromising the usability of the obfuscated data. Therefore, we utilize the Exponential mechanism [28], which allows selecting the “best” intensity rather than the possible intensities, such as Laplacian and Gaussian mechanisms, with strong data reconstruction guarantees and usability. In other words, the exponential mechanism outputs a pixel intensity value in the range [0, 255], which may not have the highest score but still significantly preserves privacy. Given the obfuscated blocks, this section provides an additional layer of security while preserving certain local block features. We inject bounded customized DP noise  into each pixel intensity of the obfuscated blocks Ibl obs obtained above, where 1 ≤ l ≤ L. For simplicity, let Φ(·) l denote a function that   transforms a plain block Ib into an obfuscated one Ibl obs . The traditional notion of DP, Definition 3, is defined for two datasets D and D′ that differ by one element. However, this notion does not apply to two images, as two images differing by one pixel at a single location do not significantly change the visual information. Therefore, we consider the modified definition of DP in the context of our obfuscated image block [35].

and pixel structure recovery in the visual channel. We apply the Exponential Mechanism in the 8-bit intensity domain; using a normalized [0, 1] domain would rescale the sensitivity (∆ ref. Def. 5) to 255 without affecting the DP guarantee. Definition 5. Sensitivity in obfuscated block: Let R denote the possible perturbed blocks of the same dimensions, having pixel intensity values in the range [0, 255] over the set of obfuscated blocks D. Define a score function q : D × R → R to quantify the output quality r ∈ R for an input block. Then, the sensitivity, ∆, is defined as the l maximum h idifference q produced by two blocks, q( Ib obs ) ′

and q( Ibl

), obs

l ̸= l′ :

∆ = max q [Ib ]obs , r − q [Ib′ ]obs , r r∈R

≤ max [Ib ]obs − [Ib′ ]obs 1 ≤ 255 T, r∈R

T = τ 1 τ2

    where, q( Ibl obs , r) = − r − Ibl obs 1 Next, we state an exponential mechanism in Theorem 1 and prove that it satisfies ϵ-DP for the probabil  conditions ϵq(D,r) , which signifies that ity distribution Pr[r] ∼ exp 2∆ the obfuscated block reveals negligible spatial information. Theorem 1. (ϵ, τ1 × τ2 )-DP-Block Exponential Mechanism: For a given obfuscated block [Ib ]obs of dimension τ1 τ2 = T , a mechanism ME that maps [Ib ]obs 2 to a perturbed block [Ib ]obs ∈ R, is (ϵ, τ1 × τ2 )DP-Block if and only if ME ([Ib ]obs ) is equal to Ψ [Φ(Ib ) + NExp ] ∀ [Ib ]obs ∈ D, where Ψ reconstructs the obfuscated block to a block with values in R, NExp denotes an exponential mechanism, and D contains blocks of dimensions τ1 × τ2 .

Definition 4. ϵ-DP-Block: A randomized mechanism M, defined over the dataset of independent and identically distributed (I.I.D.) obfuscated blocks produces ϵ-DP-Block  l if h and i only if for any two obfuscated blocks Ib obs and ′

Ibl and all subset U of the possible range of perturbed obs blocks R, the following condition holds h h ′i i     P r M( Ibl obs ) ∈ U ≤ exp(ϵ) · P r M( Ibl )∈U ,

Proof. We define a bounded range Ψ = [0, Γ] to avoid the excess incorporation of DP-noise to pixels in each block; otherwise, the obfuscated image as a whole may significantly drop the training performance of the underlying DNN model, where $  
 
% max Ibl obs − min Ibl obs , Γ = max 1≤l≤L 2

obs

where ϵ quantifies the amount of privacy offered by M. In our definition, IID means blocks of the same dimensions. Traditionally, DP noise (e.g., Exponential) is added locally to the information before it is transmitted to the cloud server. Such mechanisms are well-suited for decentralized learning in which DP-noise can be added to the model (instead of to the data) before dispatching it to the cloud server, as in federated learning [36]. In our scenario, the clients share the obfuscated data (i.e., images) with the server without compromising VPII. Thus, we need to develop a reconstruction mapping, denoted by Ψ, that converts the DP-block M([Ib ]obs ) back to the previous step domain, ensuring that the reconstructed image preserves visual information. The ϵ−DP step provides a privacy guarantee that holds under any data-independent transformations of the obfuscated output. This paper addresses each reconstruction resistance

and ⌊.⌋ is a floor function. To prove the stated mechanism ME holds ϵ-DP, it is sufficient to show that the output distribution of the function M, defined below, satisfies ϵ-DP (Definition 4),  M(Ib ) = [Φ(Ib ) + NExp ] · 10β mod Ψ  = [[Ib ]obs + NExp ] · 10β mod Ψ, ∀ β ∈ N The exponential output distribution of M(Ib ) is close in a multiplication sense to M(Ib′ ) everywhere. Further steps of the proof are followed by post-processing properties of DP: finite addition and/or composition of ϵ-DP 7

mechanisms are also DP. We adopt a few notations for convenience: X = Ib , X ′ = Ib′ , and T = τ1 × τ2 . Consider,

Algorithm 2: Bit-ViP scheme Input: A m × n-dimensional gray-scale image I Output: Obfuscated image Iobs 1 Partition I into blocks of size τ1 × τ2 . Let [ ] Ib = Ib1 , Ib2 , ...IbL are obtained blocks in row-roster form.

P r (Exp(X, R, q, ϵ/T ) = r) P r (Exp(X ′ , R, q, ϵ/T ) = r) T ∏ P r (Exp(Xt , R, q, ϵ/T ) = r) = P r (Exp(Xt′ , R, q, ϵ/T ) = r) t=1 ( ) ( ) ∑ ϵq(Xt′ ,r ′ ) t ,r) T exp ϵq(X ∏ r ′ ∈R exp 2∆T 2∆T ( )· ( ) = ∑ ϵq(Xt′ ,r) ϵq(Xt ,r ′ ) exp exp t=1 ′ r ∈R 2∆T 2∆T ( ( ) ∑ ) ϵq(Xt′ ,r ′ ) ϵq(Xt ,r) T ∏ exp r ′ ∈R exp 2∆T 2∆T )·∑ ( ) ( = ϵq(Xt′ ,r) ϵq(Xt ,r ′ ) t=1 exp r ′ ∈R exp 2∆T 2∆T

for each block Ibl ∈ IB , ∀ l ∈ {1, 2, · · · , L} do [BP1l , BP2l , · · · , BP8l ] ← Extract bit-planes of Ibl 4 for t ← 5 to 8 do 5 Obfuscate BPtl using Algorithm 1 to get [BPtl ]obs 6 end [ ] 7 Construct obfuscated block Ibl obs using } { 8 [BPtl ]obs t=1 [ ] /* Add exponential noise to each pixel of Ibl obs */ 8 for i ← 1 to τ1 do 9 for j ← 1 to τ2 do [ l ]2 [ ] 10 Ib obs (i, j) ← Ibl obs (i, j) + NExp , 11 end 12 end 13 end 14 Construct obfuscated image {[ ] 2 } L Iobs ← Concatenate Ibl obs 2

3

( ϵ ( ( ))) q (Xt , r) − q Xt′ , r · 2∆T t=1 ( ) ∑ ϵq(Xt ,r ′ )+∆ r ′ ∈R exp 2∆T ( ) ∑ ϵq(Xt ,r ′ ) exp r ′ ∈R 2∆T ( ) ∑ ϵq(Xt ,r ′ ) T ( ϵ ) ( ϵ ) ∏ r ′ ∈R exp 2∆T ( ) = exp · exp ·∑ ′ 2T 2T exp ϵq(Xt ,r ) t=1 ′

≤

T ∏

exp

r ∈R

=

T ∏ t=1

exp

(ϵ) T

2∆T

l=1

= exp(ϵ),

the obfuscated form, Iobs , obtained using Bit-ViP follows ϵ-DP Exponential mechanism.

where the inequality holds from the sensitivity definition. r(Exp(X,R,q,ϵ/T )=r) ≥ exp(−ϵ) By symmetry, we get PPr(Exp(X ′ ,R,q,ϵ/T )=r) which proves the mechanism M is ϵ-DP. After performing obfuscation over all L blocks, we concatenate all the obfuscated blocks n   2 2  L 2 o 1 2 IB , I , ... IB obs at the corresponding B obs  obs L 2 1 to obtain our final obfuscated , ...IB , IB locations of IB image Iobs . In Algorithm 2, we presented the pseudocode of Bit-ViP for obfuscating a gray-scale image. We independently apply Bit-ViP to all color channels of an RGB image.

Proof. In our final step, we concatenate the obfuscated blocks to obtain Iobs , which is equivalent to the parallel composition of various DP mechanisms over disjoint, independent blocks. Also, we proved in Theorem 1 that each of the L blocks follows the ϵ-DP Exponential mechanism. Therefore, following the post-processing properties in DP [28], Iobs follows ϵ-DP Exponential mechanism. Lemma 1. Assume that an m × n-dimensional image I can be partitioned into L non-overlapping blocks, each of dimension τ1 × τ2 . Then, the total random values incorporated to obfuscate I by our proposed scheme is m×n 32L + 16Lτ1 τ2 + m × n, where L = τ1 × τ2

(a)

To demonstrate the change in V-PII, we show the four most significant bit-planes of an original image (of hairblowing activity) and its obfuscated form in Fig. 4. To analyze the information security of Bit-ViP, we compute the number of random values used by our scheme to transform the input image I of dimension m × n into Iobs of the same dimension; the more random values, the higher the security.

Proof. Ideally, the probability of reconstruction of any pixel intensity value I(i, j) of image I at pixel-location (i, j) using the obfuscated intensity value Iobs (i, j) should be close to zero. Given the block size τ1 × τ2 , we need to obfuscate L blocks to obtain Iobs . Each block has 8 bit planes, so the total number of bit-plane obfuscations is L × 8. In the algorithm, we initialize each of L × 8 bit-planes with two noise vectors, as shown in Eq. 5, generated by the solution matrix of Lorenz’s chaotic system (see Eq. 1). Thus, we used 4 × L × 8 random numbers. Further, we decomposed each bit-plane into two τ1 × τ2 -dimensional QR components, and thus, the total number of random values is RV1 = 4 × L × 8 + 2 × L × 8 × τ1 × τ2 = 32L + 16Lτ1 τ2 .

Corollary 1. Obfuscated image is ϵ-DP: For a given image I that can be partitioned into L non-overlapping blocks,

Further, we added a differentially private random number to each pixel intensity in each obfuscated block, yielding

(b)

Fig. 4: Four most significant bit-planes comparison of (a) original image and (b) obfuscated image obtained upon applying Bit-ViP.

8

m × n additional random values in RV1 . Thus, the total random numbers to obfuscate I are T otalRV = 32L + 16Lτ1 τ2 + m × n.

(stored in the image database in the cloud) for large block sizes; however, it comes at the cost of degraded accuracy, which we validated empirically, and the results are reported in the next section.

Hence proved Lemma 1. Note that the random values counted for RV1 distributed uniformly over the unit interval [0, 1]. Therefore, 1 the probability for getting a random value becomes |RV , 1| where |·| computes the size. Since these random values are generated by chaotic structures, Bit-ViP would discourage adversaries from recovering original pixel values. Moreover, the last m×n random values are distributed across L distinct exponential-differentially private intervals. Based on this analysis, we assert that an adversary can extract almost no spatial information about the original pixel intensities from the obfuscated pixel values, even with complete access to the obfuscated database. For an RGB-color image, the total number of random values is T otalRV × 3, which means Bit-ViP would offer enhanced security.

Hair Blowing Image

Bimof+ (block 5 x 5)

Bimof+ (block 10 x 10)

Text

Bimof+ (block 20 x 20)

Bimof+ (block 25 x 25)

Bimof+ (block 40 x 40)

Fig. 5: Comparison of Bit-ViP obfuscated images with different block sizes. A larger block size offers better privacy.

VI. Experimental Evaluation We validate the effectiveness of the proposed scheme against the activity recognition system using performance metrics, including recognition accuracy on benchmark video datasets, namely HMDB51 [17] and UCF101 [16]. This section reports and critically analyses the results obtained by extensive experiments. We implemented the proposed scheme in Python language on Ubuntu 20.14 64-bit, over an HP workstation with an Nvidia Quadro P5000 graphics card and an Intel Xeon(R) 5120 CPU @2.20×56 GHz. Four state-ofthe-art DCNNs, namely ResNet18, ResNet34, ResNet50, and VGG16 are employed for activity recognition system. Training hyperparameters: batch size = 128, epochs = 125, optimizer = adam, cosine annealing lr-scheduler, learning rate = 1e−3 , and negative log-likelihood loss. While maintaining the original train-test split ratio, we use 10% of the training data for validation. The size of each block is a factor of 200×200 (the dimension of the original frame). We assume privacy budget ϵ = 0.5 as considered in [25]. We also provide an accuracy comparison with varying ϵ in the supplementary file. To provide a fair comparison, we compare Bit-ViP with three axes: (i) security (resistance to reconstruction/deidentification attacks), (ii) utility (recognition accuracy on obfuscated data), and (iii) visual/structural distortion, and the baseline work is considered accordingly.

Theorem 2. Security is directly proportional to block size: Let J1 and J2 be two image blocks of dimensions τ1 × τ2 and η1 × η2 respectively, where η1 > τ1 and η2 > τ2 . Then, the obfuscated form of J2 obtained by the Bit-ViP scheme is more secure than that of J1 . Proof. Let us assume that the obfuscated form of J1 and J2 are J1obs and J2obs respectively. We prove our theorem by showing that the total number of random values utilized in J2obs is more than that incorporated in J1obs . As explained in Lemma 1, the total number of random values incorporated to obtain J1obs and J1obs are T otalRV 1 = 32 + 17τ1 τ2 , T otalRV 2 = 32 + 17η1 η2 Consider, Dif f RV = T otalRV 2 − T otalRV 1 = 32 + 17η1 η2 − 32 + 17τ1 τ2 = 17 (η1 η2 − τ1 τ2 ) > 0 as η1 > τ1 and η2 > τ2 Since, Dif fRV > 0 which proves our Theorem 2. B. Qualitative analysis of Bit-ViP scheme This section qualitatively analyzes the information security of the obfuscated image obtained from our scheme across varying block sizes. As mentioned in our scheme, the input image is divided into non-overlapping blocks of dimension τ1 × τ2 . Here, we visually show the obfuscated images obtained with varying block sizes: 5 × 5, 10 × 10, 20 × 20, 25 × 25, and 40 × 40, for the original image of hair blowing activity of dimension 200 × 200 in Fig. 5. For instance, an obfuscated image with a block size of 5 × 5 reveals a few edges and activity attributes, whereas one with a block size of 25 × 25 conceals them. It can be observed that the visually sensitive information would not be revealed by an adversary from the obfuscated images

A. Dataset Description 1) HMDB51 dataset [17] consists of 6849 realistic video clips with 51 categories (classes) of human activities, and there exist more than 100 clips for each class; some of the activities are “throw”, “pull-ups”, “pick”, etc. 2) UCF101 [16] is also a standard dataset for evaluating HAR systems. It consists of 13320 video clips divided into 101 classes, like “blow dry hair”, “push-ups” , etc. 9

TABLE I: Accuracy (i.e., usability) and security comparison of different schemes. Unlike prior schemes, which offer either security or usability, Bit-ViP offers strong security while maintaining its usability by achieving an adequate level of recognition accuracy.

B. Recognition Accuracy At first, we conducted experiments to evaluate the recognition accuracy of the considered models in the plain and obfuscated data domains, and the obtained results are reported in Fig. 6. Our scheme is modelagnostic, meaning it works with different models without requiring any change in the underlying process/steps. It addresses the model architecture dependency limitation of the existing schemes, highlighted in Section I. Moving ahead with the results, all the models lose accuracy by an admissible magnitude, approximately 16% − 22%, on obfuscated data compared to the ones with plain data and 6% − 18% as compared to Bimof [18], but with much stronger security because of incorporating the DP-block exponential mechanism. The magnitude of the difference depends on the chosen block size during obfuscation. For instance, the best-performing model ResNet50 shows an accuracy drop of ∼ 16.2% from plain data to the least obfuscation block 5 × 5 and 27% from block 5 × 5 to 40 × 40, for the HMDB51 dataset. The reason for such a drop is elevated perturbations in spatial information with a larger block size, breaking the inter-correlation among neighboring pixels and eventually affecting the model’s learning, thereby addressing the limitations of security and usability. Still, it paid off in terms of more robust protection of visual information. Thus, our scheme enables users to choose an appropriate block size based on the level of protection for personal information they desire, finally addressing the limitation of the need for a trusted server. We observed a similar privacy-utility trade-off reported in prior vision research work that leverage strong, pretrained features for DP learning, i.e., modest utility gaps even at low ε due to robust features and transfer (e.g., ∼84.3% with ε = 0.1 and ∼88% with ε = 8) [37]. Next, we compare the accuracy of the Bit-ViP scheme with prior obfuscation schemes [6], [8], [10], [25], [38] using the best-performing model, ResNet50, in Table I. It is easy to see that the down-sampling scheme [6] achieves higher accuracy than the proposed scheme but provides no security, making it vulnerable to adversarial attacks such as reconstruction and model inversion. On the other hand, a few prior schemes ensure security but suffer a drastic drop in accuracy when applied to obfuscated data, thus reducing usability. Our previous approach, Bimof, outperforms Bit-ViP; it optimizes only task-specific accuracy rather than the privacy-utility trade-off. In contrast, Bit-ViP offers strong security while maintaining usability by achieving adequate recognition accuracy while preserving the location of pixels in the obfuscated image. • Activity-wise accuracy: We selected 10 activities from each dataset and reported the obtained accuracy in Fig. 7. The selected activities from the HMDB51 dataset are Brushing hair (A1), Dribbling (A2), Drinking (A3), Ride Horse (A4), Run (A5), Shoot Ball (A6), Sitting (A7), Throwing (A8), Turn (A9), and Walk (A10). From the UCF101 database, 10 activities are Horse Riding (B1),

Scheme Original Face blurring[6] Full mosaicing[20] Down-sampling [39] Pixelation [25] Encryption [10] Scrambling [9] Superpixel Noise [8] Bimof (block 5 × 5) [18] Bit-ViP (block 5 × 5) Bimof (block 40 × 40) [18] Bit-ViP (block 40 × 40)

HMDB51 68.7 67.6 66.2 64.4 18.9 10.2 11.2 15.4 65.8 52.5 59.8 41.1

UCF101 79.1 78.4 76.7 74.6 21.9 14.5 14.0 19.6 77.1 71.1 68.3 56.7

Security × × × × ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓

Usable ✓ ✓ ✓ ✓ × × × × ✓ ✓ ✓ ✓

Bench Press (B2), Biking (B3), Playing Dhol (B4), Salsa spin (B5), Throwing disc (B6), Soccer juggling (B7), Drumming (B8), Rowing (B9), and Punch (B10). Regardless of the activity type and the dataset, we observe an accuracy drop of 8% ∼ 10% when the model learns from obfuscated data with a block size of 5×5 compared to plain data, and this drop increases by 10% ∼ 15% with a block size of 40×40. However, strong visual privacy pays off from such a drop. Note that this paper focuses on developing a novel privacy-preserving scheme that bridges privacy and usability for an image database hosted on the cloud server, rather than solely improving usability (accuracy). C. Image Structural Analysis We conduct image structural analysis using referenceand textit non-reference- based evaluation metrics [40] to quantify the structural distortion (i.e., randomness) in the obfuscated image against the original input image. 1) Reference based analysis: In this analysis, the perceptual quality of Iobs is compared against the original image I, which is commonly measured by the following four metrics: structural similarity index measure (SSIM), peak signal-to-noise ratio (PSNR), multi-scale SSIM (MSSIM), and mean square error (MSE), and the obtained results are reported in Table II. The lower the PSNR, SSIM, and M-SSIM scores, the better the scheme; the converse holds for the MSE score. While the proposed scheme (regardless of block size) outperforms schemes such as down-sampling [6], pixelation [25], and noiseobfuscation [8], it reveals more visual information than scrambling [9] and encryption [10]. However, the image obtained after scrambling or encryption does not contain learnable information that a machine-learning model can leverage, thereby making Bit-ViP a favorable option. 2) Non-reference based analysis: Non-reference-based metrics [41] are powerful because they can evaluate the quality of Iobs without its plain form by using images of natural scenes that exhibit similar distortions. Table II reports the results using three commonly employed metrics: blind image spatial quality evaluator (BRISQUE), natural image quality evaluator (NIQE), and perceptionbased image quality evaluator (PIQE). The higher the score, the better the scheme. We observe that the 40 × 40 block size is the best at concealing information, yielding 10

(a) VGG16 results on HMDB51 (b) ResNet18 results on HMDB51(c) ResNet34 results on HMDB51(d) ResNet50 results on HMDB51

(e) VGG16 results on UCF

(f) ResNet18 results on UCF

(g) ResNet34 results on UCF

(h) ResNet50 results on UCF

Fig. 6: Accuracy (%) on plain and obfuscated data with varying block sizes. TABLE II: Reference- and non-reference-based image structural analysis.

Original Encryption [10] Down-sampling [6] Pixelation [25] Noise obfuscation [8] Scrambling [9] Bit-ViP (block 5 × 5) Bit-ViP (block 10 × 10) Bit-ViP (block 20 × 20) Bit-ViP (block 25 × 25) Bit-ViP (block 40 × 40)

PSNR -39.82 -32.15 -30.22 -33.19 -40.21 -40.82 -40.68 -40.90 -40.51 -41.24

Referenced Based SSIM M-SSIM 0.0011 0.0 0.1408 0.4302 0.1862 0.6011 0.1282 0.3987 0.0026 0.0045 0.0182 0.0669 0.0034 0.0252 0.0043 0.0074 0.0038 0.0333 0.0058 0.0397

MSE 9618.50 1740.40 1106.40 2095.90 11197.0 14187.0 13056.0 12837.0 11508.0 13318.0

Accuracy (%)

60 40

0

Plain data Obfuscated (block 5 × 5) Obfuscated (block 40 × 40) A1

A2

A3

A4

A5

A6

A7

A8

A9

A10

B8

B9

B10

Activity

(a) On HMDB51 dataset

Accuracy (%)

80 60 40 20 0

Plain data Obfuscated (block 5 × 5) Obfuscated (block 40 × 40) B1

B2

B3

B4

B5

B6

B7

Red 7.2527 7.7302 7.7692 7.1892 7.4732 7.8224 7.6645 7.2325 7.5473 7.9244 7.4704

Entropy Green Blue 7.2830 6.8378 7.7656 7.4314 7.8281 7.1779 7.3294 6.8794 7.4735 7.4314 7.7973 7.2116 7.0276 7.8066 7.2822 7.9993 7.4598 7.6690 7.6297 7.3957 7.5294 7.9943

Mean 7.1245 7.6424 7.5917 7.1327 7.6424 7.6105 7.4996 7.5047 7.5587 7.6499 7.6647

extract information from an obfuscated image and conceal an individual’s identity. 1) Image reconstruction attack: It involves reverse training the obfuscation scheme to recover original images from obfuscated ones. This process exploits weaknesses in the obfuscation method to reconstruct the input data, compromising privacy and security. For experiments, we performed inverse training [42] of learning-based (or datadriven based) obfuscation function Φ(·) presented in [43] to obtain Φ−1 (·). The obtained visuals are presented in Fig. 8. For the original video frames in Fig.8(a), (b) indicates the obfuscated frames using Φ, and Fig. 8(c) shows the reconstructed frames using Φ−1 , revealing all sensitive visual information. In contrast, our scheme produces a more sophisticated obfuscated image (Fig. 8(d)) and is robust against reconstruction and de-identification attacks, as shown in Fig. 8(e). 2) Pixel-frequency based attack: In this attack, an adversary computes the frequency of each pixel intensity of the obfuscated image (Iobs ) and attempts to extract meaningful information from the original image (I) [44]. Though it may seem like a trivial attack, the adversary may learn quite a bit about the original image if an underlying obfuscation scheme does not disrupt these frequencies. Ideally, the frequencies of Iobs ’s pixels must be uniform and unrelated to I. Fig. 9 depicts channel-wise pixel-frequencies for (a) hair blowing plain image (shown

80

20

Non-referenced Based Brisque Niqe Piqe 28.30 3.26 62.27 44.03 24.08 80.27 45.61 9.57 66.76 43.46 28.80 65.23 52.09 11.34 77.02 44.56 31.97 41.24 43.48 22.08 74.98 43.59 29.29 76.44 43.46 28.18 76.29 44.94 45.11 78.83 57.45 61.29 80.50

Activity

(b) On UCF101 dataset Fig. 7: Accuracy for 10 randomly selected activities.

substantial gains across all three metrics compared to existing schemes. D. Security Analysis This section presents the security analysis of our proposed image obfuscation scheme and informationextracting cryptographic attacks used by adversaries to 11

block 40 × 40, the mean entropy is 7.67, close to the maximum possible value (8). 4) Differential analysis: Through differential analysis, we examine changes in two distinct obfuscated forms of a plain image I ∈ RM ×N under small perturbations. Specifically, we perturb I with a pixel intensity value and obtain obfuscated forms before and after perturbation, say Iobs1 and Iobs2 , and then compute their difference percentage (DP) as PM PN D(m, n) DP = m=1 n=1 × 100, M × N ( 1, if Iobs2 (m, n) ̸= Iobs1 (m, n) where D(m, n) = 0, if Iobs2 (m, n) = Iobs1 (m, n).

Fig. 8: (a) Original image from UCF101, (b) Obfuscated by [43], and (c) Reconstructed image of (b), (d) Our obfuscated image, (e) Reconstructed image of (d).

in Fig. 5), (b) encryption [10], (c) noise obfuscation [8], and (d) proposed scheme using 40 × 40 block. Encryption offers more uniform (almost ideal) pixel frequencies than the proposed one. However, the DNN model cannot be trained on encrypted images, resulting in poor accuracy (see Table I). In contrast, our scheme has approximately uniform frequencies after obfuscation while securing a usable accuracy.

Table III presents the channel-wise scores averaged over ten randomly chosen images from both datasets. TABLE III: DP for different obfuscation schemes. Encryption [10] Down-sampling [6] Pixelation [25] Noise obfuscation [8] Scrambling [9] Bit-ViP (block 5 × 5) Bit-ViP (block 10 × 10) Bit-ViP (block 20 × 20) Bit-ViP (block 25 × 25) Bit-ViP (block 40 × 40)

(a)

Red 99.63% 0.0% 67.73% 93.98% 97.31% 88.97% 89.49% 92.44% 93.69% 95.01%

Green 99.66% 0.0% 60.38% 92.94% 97.30% 87.82% 89.76% 90.79% 92.25% 94.56%

Blue 99.62% 0.0% 68.14% 92.54% 96.69% 85.83% 91.27% 91.55% 93.62% 91.92%

Mean 99.64% 0.0% 65.42% 93.15% 97.10% 87.54% 90.17% 91.59% 93.19% 93.83%

The obtained mean (over channels) DP lies in the range 87%-94% (higher is better), signifying sufficient variations in the pixel intensities of two obfuscated images Iobs1 and Iobs2 . Our scheme achieved better scores with a 40 × 40 size. The interesting point is that DP is zero for down-sampling [6] because it applies the same kernel on each image, whereas the pixelation [25] uses a fixed range Laplacian noise and thereby secures ≈ 65%. The scrambling [9] randomly permutes pixel locations every time, thus achieving competitive scores. Further, encryption [10] achieved better scores than our scheme, but without supporting model learning on the data; therefore, encryption alone is not acceptable in machine learning applications. 5) Pixels-correlation attack: It (denoted as corr) signifies the interdependence among the pixel intensity values across horizontal, vertical, and diagonal orientations within an image [45]. Elevated pixel correlation suggests a stronger presence of significant content and an increased susceptibility to leakage. To mitigate this risk, the correlation of an obscured image should be inversely related to that of the original image, ideally nearing zero. In this attack, the adversary can access the obfuscated images and use correlation between neighboring pixels to extract meaningful regions. Mathematically, corr is evaluated over random K neighboring pixels say {(x1 , y1 ), (x2 , y2 ), ..., (xK , yK )} in an image as

(b)

(c)

(d)

Fig. 9: Channel-wise pixel frequencies for (a) original image, (b) encryption scheme, (c) noise obfuscation scheme, and (d) proposed scheme with block size 40 × 40. The x-axis and y-axis indicate the pixel intensity values in [0, 255] and their frequencies, respectively.

3) Information entropy: Entropy quantifies the amount of randomness present in the data. Higher entropy is desirable for concealing private visual information of an obfuscation image. For an N -bit image Iobs with T distinct pixel intensities,Pthe entropy lies in range [0, N ], and is T −1 computed as − t=0 p(t) log2 (p(t)). We compute entropy over 10 randomly chosen images from both datasets, including one shown in Fig. 5, and report the average channel-wise results in Table II. It clearly shows that the effectiveness of our scheme is comparable to that of all existing schemes, particularly with large block sizes. With

corr(x, y) = 12

cov(x, y) St D(x) × St D(y)

(8)

Original Image

(b)

Bimof (block 40 x 40)

(a)

(b)

(c)

Fig. 10: Qualitative analysis of the correlation of the original and the Bit-ViP obfuscated images for red, green, and blue color channels in (a) horizontal, (b) vertical, and (c) diagonal directions. TABLE IV: Quantitative comparison of the correlation. R, G, B, and M denote red, green, and blue color channels and the mean of R, G, and B, respectively. Direction Original Encryption [10] Down-sampling [6] Pixelation [25] Noise obfuscation [8] Scrambling [9] Bit-ViP (block 5 × 5) Bit-ViP (block 10 × 10) Bit-ViP (block 20 × 20) Bit-ViP (block 25 × 25) Bit-ViP (block 40 × 40)

R 0.986 -0.005 0.999 0.989 0.998 0.693 0.620 0.686 0.552 0.285 0.376

Horizontal G B 0.985 0.976 -0.035 -0.012 0.999 0.999 0.988 0.986 0.998 0.997 0.687 0.671 0.589 0.538 0.633 0.665 0.553 0.546 0.457 0.507 0.329 0.312

M 0.982 -0.020 0.999 0.988 0.998 0.684 0.583 0.661 0.550 0.417 0.339

R 0.988 -0.02 0.999 0.990 0.998 0.694 0.633 0.667 0.533 0.230 0.337

where St D and cov(x, y) represent the standard deviation and covariance respectively between pixel intensities x = {x1 , x2 , ..., xK } and y = {y1 , y2 , ..., yK }. corr lies in [-1, 1], with “-1” and “1” indicating perfect inverse and direct proportionality, whereas corr close to “0” depicts no relation between x and y. We compute the corr of the gray-scale hair blowing image as shown in Fig. 10 and Bit-ViP images with a block size of 40 × 40. Qualitatively, the pixels of the original and obfuscated images would be projected diagonally and scattered, respectively, as shown in Fig. 10. For experiments, we set K = 2000, and the average correlation values for 100 random images in the horizontal, vertical, and diagonal directions are reported in Table IV. The correlation of original images lies in [0.965, 0.988] whereas Bit-ViP has range [−0.01, 0.686], depicting that Bit-ViP significantly preserves V-PII. It is observed that Bit-ViP outperforms existing schemes [6], [8], [9], [25].

Vertical G B 0.987 0.978 0.041 -0.010 0.999 0.999 0.989 0.987 0.998 0.997 0.668 0.679 0.611 0.535 0.662 0.666 0.536 0.563 0.470 0.513 0.289 0.297

M 0.984 0.003 0.999 0.989 0.998 0.680 0.593 0.665 0.544 0.404 0.308

R 0.979 0.010 0.998 0.964 0.997 0.476 0.468 0.506 0.337 0.246 0.013

Diagonal G B 0.979 0.965 0.026 0.015 0.998 0.998 0.963 0.962 0.997 0.995 0.476 0.467 0.397 0.412 0.496 0.494 0.324 0.362 0.204 0.255 -0.010 0.032

M 0.947 0.017 0.998 0.963 0.996 0.473 0.426 0.499 0.341 0.235 0.012

presented in Table V. Each value is the average time to obfuscate the given 10 images for the indicated dimension and block size. For instance, if a 32 × 32-dimensional image is broken into blocks of size 5 × 5 (with padding), then a total of 49 blocks are produced. Our scheme takes 0.011 seconds per block, so it takes 0.539 seconds (0.539 = 0.011 × 49) for all the blocks. TABLE V: Obfuscation time for varying image dimensions and block sizes. Image size 32 × 32 128 × 128 256 × 256 512 × 512

5×5 2.37 20.73 81.41 358.13

Bit-ViP (time in seconds) 10 × 10 20 × 20 25 × 25 0.45 0.18 0.16 4.14 1.09 0.84 20.83 5.71 3.69 94.37 27.97 18.56

40 × 40 0.11 0.51 1.13 10.49

The time required for pre-processing, such as splitting the image into color channels followed by generation of 5×5 blocks, post-processing operations, and concatenating the obfuscated blocks of each color channel of a 32 × 32-dimensional image, is 1.831 seconds, making the total obfuscation time 2.37 = 1.831 + 0.539 seconds. Note that the same image requires 0.11 seconds if the block size is 40 × 40.

E. Computation Time The time taken by an obfuscation scheme at the local device is essential for cloud services, which we discuss in this section. We experimented with 10 images randomly selected from both datasets to compute time with varying image dimensions and block sizes, and the results are 13

VII. Conclusion

[9] S. Jeevitha and N. Amutha Prabha, “Novel medical image encryption using dwt block-based scrambling and edge maps,” Journal of Ambient Intelligence and Humanized Computing, vol. 12, no. 3, pp. 3373–3388, 2021. [10] W. Zhou, X. Wang, M. Wang, and D. Li, “A new combination chaotic system and its application in a new bit-level image encryption scheme,” Optics and Lasers in Engineering, vol. 149, p. 106782, 2022. [11] R. Gilad-Bachrach, N. Dowlin, K. Laine, K. Lauter, M. Naehrig, and J. Wernsing, “Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy,” in Proceedings of the International Conference on Machine Learning, 2016, pp. 201–210. [12] B. Knott, S. Venkataraman, A. Hannun, S. Sengupta, M. Ibrahim, and L. van der Maaten, “Crypten: Secure multiparty computation meets machine learning,” Advances in Neural Information Processing Systems (NeurIPS), vol. 34, pp. 4961–4973, 2021. [13] A. Saleem, A. Khan, F. Shahid, M. M. Alam, and M. K. Khan, “Recent advancements in garbled computing: How far have we come towards achieving secure, efficient and reusable garbled circuits,” Journal of Network and Computer Applications, vol. 108, pp. 1–19, 2018. [14] M. A. P. Chamikara, P. Bertok, I. Khalil, D. Liu, and S. Camtepe, “Privacy preserving face recognition utilizing differential privacy,” Computers & Security, vol. 97, p. 101951, 2020. [15] J. Jeon, j. Kim, K. Lee, S. Oh, and J. Ok, “Gradient inversion with generative image prior,” in Advances in Neural Information Processing Systems (NeurIPS), vol. 34, 2021, pp. 29 898–29 908. [16] K. Soomro, A. R. Zamir, and M. Shah, “Ucf101: A dataset of 101 human actions classes from videos in the wild,” arXiv preprint arXiv:1212.0402, 2012. [17] H. Kuehne, H. Jhuang, E. Garrote, T. Poggio, and T. Serre, “Hmdb: a large video database for human motion recognition,” in Proceedings of the International Conference on Computer Vision (ICCV). IEEE, 2011, pp. 2556–2563. [18] V. K. Tanwar, A. Gupta, S. Madria, and S. K. Das, “Preserving privacy in image database through bit-planes obfuscation,” in 2023 IEEE 39th International Conference on Data Engineering Workshops (ICDEW). IEEE, 2023, pp. 132–137. [19] Y. Wang, C. Wu, L. Herranz, J. van de Weijer, A. GonzalezGarcia, and B. Raducanu, “Transferring gans: generating images from limited data,” in Proceedings of the European Conference on Computer Vision (ECCV), 2018, pp. 218–234. [20] E. Chou, M. Tan, C. Zou, M. Guo, A. Haque, A. Milstein, and L. Fei-Fei, “Privacy-preserving action recognition for smart hospitals using low-resolution depth images,” arXiv preprint arXiv:1811.09950, 2018. [21] Z. Wu, H. Wang, Z. Wang, H. Jin, and Z. Wang, “Privacypreserving deep action recognition: An adversarial learning framework and a new dataset,” IEEE Transactions on Pattern Analysis and Machine Intelligence, 2020. [22] Y. Bai, Q. Zou, X. Chen, L. Li, Z. Ding, and L. Chen, “Extreme low resolution activity recognition with confident spatialtemporal attention transfer,” arXiv preprint arXiv:1909.03580, 2019. [23] D. Purwanto, R. Renanda Adhi Pramono, Y.-T. Chen, and W.-H. Fang, “Extreme low resolution action recognition with spatial-temporal multi-head self-attention and knowledge distillation,” in Proceedings of the IEEE International Conference on Computer Vision Workshops (ICCVw), 2019, pp. 961–969. [24] J. Kim, Y. M. Kim, Y. Wu, R. Zahreddine, W. A. Welge, G. Krishnan, S. Ma, and J. Wang, “Privacy-preserving visual localization with event cameras,” arXiv preprint arXiv:2212.03177, 2022. [25] L. Fan, “Image pixelization with differential privacy,” in IFIP Annual Conference on Data and Applications Security and Privacy. Springer, 2018, pp. 148–162. [26] Y. Chen, Y. Ping, Z. Zhang, B. Wang, and S. He, “Privacypreserving image multi-classification deep learning model in robot system of industrial iot,” Neural Computing and Applications, pp. 1–18, 2020. [27] I. S. Badr, A. G. Radwan, E.-S. M. El-Rabaie, L. A. Said, G. M. El Banby, W. El-Shafai, and F. E. Abd El-Samie, “Cancellable face recognition based on fractional-order lorenz chaotic system

We introduced Bit-ViP, a novel scheme based on bitplanes to safeguard individuals’ private visual information within images uploaded to cloud storage while maintaining data security. By integrating Lorenz’s chaotic noise across bit planes and performing subsequent QR decomposition, our scheme achieves resilience against adversarial attacks, such as reconstruction and model inversion, while retaining sufficient information in the obfuscated data for effective model training. Theoretical analysis confirmed that the obfuscated images, essentially the dataset, adhere to the DP exponential mechanism at the block level, indicating the non-invertible nature of the Bit-ViP scheme. Extensive experimentation on real-world human activity recognition datasets (UCF101 and HMDB51) provides a qualitative and quantitative evaluation of the proposed scheme, comprehensively assessing security, usability, and image structure. Results demonstrated that Bit-ViP effectively mitigates V-PII exposure by disrupting pixel correlations, altering pixel frequencies, and introducing random noise, while significantly surpassing previous schemes in accuracy. Furthermore, we explored a security-usability trade-off by varying block sizes, empowering users to select the most suitable size for their application requirements. We plan to exploit the correlation between the original image and its obfuscated version to gain recognition accuracy. This work motivates further research to incorporate users’ choices in selecting a region of interest, such as faces or secret objects to be obfuscated, thereby requiring finetuning of randomness based on the importance level of the visual information. References [1] A. Doula, A. Sanchez Guinea, and M. Mühlhäuser, “Vr-surv: a vr-based privacy preserving surveillance system,” in CHI Conference on Human Factors in Computing Systems Extended Abstracts, 2022, pp. 1–7. [2] Q. M. Rajpoot and C. D. Jensen, “Security and privacy in video surveillance: requirements and challenges,” in IFIP international information security conference. Springer, 2014, pp. 169–184. [3] R. Kumar, R. Tripathi, N. Marchang, G. Srivastava, T. R. Gadekallu, and N. N. Xiong, “A secured distributed detection system based on ipfs and blockchain for industrial image and video data security,” Journal of Parallel and Distributed Computing, vol. 152, pp. 128–143, 2021. [4] S. Myneni, G. Agrawal, Y. Deng, A. Chowdhary, N. Vadnere, and D. Huang, “Scvs: On ai and edge clouds enabled privacypreserved smart-city video surveillance services,” ACM Transactions on Internet of Things, vol. 3, no. 4, pp. 1–26, 2022. [5] P. Ilia, I. Polakis, E. Athanasopoulos, F. Maggi, and S. Ioannidis, “Face/off: Preventing privacy leakage from photos in social networks,” in Proceedings of the 22nd ACM SIGSAC Conference on computer and communications security, 2015, pp. 781–792. [6] M. U. Kim, H. Lee, H. J. Yang, and M. S. Ryoo, “Privacypreserving robot vision with anonymized faces by extreme low resolution,” in International Conference on Intelligent Robots and Systems (IROS). IEEE, 2019, pp. 462–467. [7] T. Li and M. S. Choi, “Deepblur: A simple and effective method for natural image obfuscation,” arXiv arXiv:2104.02655, vol. 1, 2021. [8] A. S. Rajput, B. Raman, and J. Imran, “Privacy-preserving human action recognition as a remote cloud service using rgb-d sensors and deep cnn,” Expert Systems with Applications, vol. 152, p. 113349, 2020.

14

and haar wavelet fusion,” Digital Signal Processing, vol. 116, p. 103103, 2021. [28] C. Dwork, A. Roth et al., “The algorithmic foundations of differential privacy,” Foundations and Trends® in Theoretical Computer Science, vol. 9, no. 3–4, pp. 211–407, 2014. [29] S. Menon, A. Damian, S. Hu, N. Ravi, and C. Rudin, “Pulse: Self-supervised photo upsampling via latent space exploration of generative models,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2020, pp. 2437–2445. [30] Q. Lu, C. Zhu, and X. Deng, “An efficient image encryption scheme based on the lss chaotic map and single s-box,” IEEE Access, vol. 8, pp. 25 664–25 678, 2020. [31] C. Fu, B.-b. Lin, Y.-s. Miao, X. Liu, and J.-j. Chen, “A novel chaos-based bit-level permutation scheme for digital image encryption,” Optics Communications, vol. 284, no. 23, pp. 5415– 5423, 2011. [32] R. Rhouma, E. Solak, and S. Belghith, “Cryptanalysis of a new substitution–diffusion based image cipher,” Communications in Nonlinear Science and Numerical Simulation, vol. 15, no. 7, pp. 1887–1892, 2010. [33] Z.-l. Zhu, W. Zhang, K.-w. Wong, and H. Yu, “A chaosbased symmetric image encryption scheme using a bit-level permutation,” Information Sciences, vol. 181, no. 6, pp. 1171– 1186, 2011. [34] H. Y. Zha, “A componentwise perturbation analysis of the qr decomposition,” SIAM journal on matrix analysis and applications, vol. 14, no. 4, pp. 1124–1131, 1993. [35] B. Liu, M. Ding, H. Xue, T. Zhu, D. Ye, L. Song, and W. Zhou, “Dp-image: differential privacy for image data in feature space,” arXiv preprint arXiv:2103.07073, 2021. [36] X. Zhou, W. Liang, J. Ma, Z. Yan, I. Kevin, and K. Wang, “2d federated learning for personalized human activity recognition in cyber-physical-social systems,” IEEE Transactions on Network Science and Engineering, vol. 9, no. 6, pp. 3934–3944, 2022. [37] H. Mehta, W. Krichene, A. Thakurta, A. Kurakin, and A. Cutkosky, “Differentially private image classification from features,” arXiv preprint arXiv:2211.13403, 2022. [38] J. Imran, B. Raman, and A. S. Rajput, “Robust, efficient and privacy-preserving violent activity recognition in videos,” in Proceedings of the 35th Annual ACM Symposium on Applied Computing, 2020, pp. 2081–2088. [39] M. Ryoo, K. Kim, and H. Yang, “Extreme low resolution activity recognition with multi-siamese embedding learning,” in Proceedings of the Conference on Artificial Intelligence (AAAI), vol. 32, no. 1, 2018. [40] Z. Wang and A. C. Bovik, “Modern image quality assessment,” Synthesis Lectures on Image, Video, and Multimedia Processing, vol. 2, no. 1, pp. 1–156, 2006. [41] G. Zhai and X. Min, “Perceptual image quality assessment: a survey,” Science China Information Sciences, vol. 63, no. 11, pp. 1–52, 2020. [42] J. Geiping, H. Bauermeister, H. Dröge, and M. Moeller, “Inverting gradients-how easy is it to break privacy in federated learning?” Advances in neural information processing systems, vol. 33, pp. 16 937–16 947, 2020. [43] I. R. Dave, C. Chen, and M. Shah, “Spact: Self-supervised privacy preservation for action recognition,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 20 164–20 173. [44] Y. Xian and X. Wang, “Fractal sorting matrix and its application on chaotic image encryption,” Information Sciences, vol. 547, pp. 1154–1169, 2021. [45] G. Chen, Y. Mao, and C. K. Chui, “A symmetric image encryption scheme based on 3d chaotic cat maps,” Chaos, Solitons & Fractals, vol. 21, no. 3, pp. 749–761, 2004.

Ashish Gupta is an Assistant Professor in Computer Science at BITS Pilani Dubai Campus, UAE. He worked as a postdoctoral fellow in the Department of Computer Science at Missouri S&T, USA, from 2021 to 2023. He received a Ph.D. in Computer Science and Engineering from the Indian Institute of Technology (BHU), Varanasi, India. His research interests include sensor data analytics, federated learning, and applied machine learning.

Sanjay Madria is a Curators’ Distinguished Professor in the Department of Computer Science at Missouri S&T, USA. He has published 300+ journal and conference papers on mobile and sensor computing, big data and cloud computing, and cybersecurity. He has been awarded the Japanese Society for the Promotion of Science Invitational Visiting Scientist Fellowship, the American Society for Engineering Education Fellowship, and an ACM Distinguished Scientist. He is an IEEE Senior Member and an IEEE Golden Core Awardee.

Sajal K. Das is a Curators’ Distinguished Professor of computer science and Daniel St. Clair Endowed Chair at Missouri S&T, USA. His research interests include cyber-physical systems, IoT, smart environments (including smart agriculture), wireless sensor networks, pervasive and mobile computing, and cybersecurity. He is the editor-in-chief of Elsevier’s Pervasive and Mobile Computing journal and an associate editor of the IEEE Transactions on Mobile Computing and IEEE Transactions on Dependable and Secure Computing.

Vishesh Kumar Tanwar is a Senior Research Associate in the Department of Computer Science at Missouri S&T, USA. He received his Ph.D. in applied mathematics from the Indian Institute of Technology Roorkee, India. His research interests include privacypreserving multimedia processing, split learning, and cloud computing.

15