Slashdot Mirror
None of Your Pixelated or Blurred Information Will Stay Safe On The Internet (qz.com)
The University of Texas at Austin and Cornell University are saying blurred or pixelated images are not as safe as they may seem. As machine learning technology improves, the methods used to hide sensitive information become less secure. Quartz reports: Using simple deep learning tools, the three-person team was able to identify obfuscated faces and numbers with alarming accuracy. On an industry standard dataset where humans had 0.19% chance of identifying a face, the algorithm had 71% accuracy (or 83% if allowed to guess five times). The algorithm doesn't produce a deblurred image -- it simply identifies what it sees in the obscured photo, based on information it already knows. The approach works with blurred and pixelated images, as well as P3, a type of JPEG encryption pitched as a secure way to hide information. The attack uses Torch (an open-source deep learning library), Torch templates for neural networks, and standard open-source data. To build the attacks that identified faces in YouTube videos, researchers took publicly-available pictures and blurred the faces with YouTube's video tool. They then fed the algorithm both sets of images, so it could learn how to correlate blur patterns to the unobscured faces. When given different images of the same people, the algorithm could determine their identity with 57% accuracy, or 85% percent when given five chances. The report mentions Max Planck Institute's work on identifying people in blurred Facebook photos. The difference between the two research is that UT and Cornell's research is much more simple, and "shows how weak these privacy methods really are."
This is my shocked face: https://upload.wikimedia.org/wikipedia/en/d/d8/Mr_Swirl.jpg
Putting a big black square over your face in Paint is the only surefire method.
Anyway, using social media and simultaneously demanding privacy is pure silliness to begin with. The real question is how much of an illusion of privacy needs to be maintained to keep you from complaining.
I felt a great disturbance in the force, as if a million Japanese porn fans cried out in disappointment.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
For a computer, most algorithms behind comparing two pictures is already a blurred picture of both. Most of these algorithms take samples/pixels of the pictures and see if the relationships of both sets of samples are the same or within a margin of deviation. There is little value in comparing pixel by pixel for exact matches. Similar to human finger prints.
A blurred picture is similar to taking less samples on one picture and setting the margin of deviation wider.
But for computers, 57% is pretty bad. 85% is also very bad and that's when you are telling the machine the answer. At those rates, this is kind of hard to do mass comparisons... the false positives would be far too high for any human to weed through. This will apply more for targeted searches where an investigator wants the 5 most probable matches to a blur. Unlike the researchers here who know the answer before hand, he still needs to take the guess on which one it actually is.
In a criminal investigation, if we had a database of likely suspects, this would work. But we are all about mass collection of data data data. With a large population of pictures, the blur will probably match a lot more than 5.
Just do like I do. If you put a picture of your car online, put a black bar over the license plate.
Have you ever fallen asleep at the keybhanusdiog?
Blurring is a technique reversible with Wiener filtering. Basically the quality of recovery very much depends on subsequent quantization/compression. Pixelation is more complete information loss.
However, the article talks about video filters. In that case, per-frame pixelization will let a lot of image detail become recoverable through motion compensation (straightforward blurring is less suscetible to this recovery strategy). So if you really want to inhibit recovery, blot out the information hard. The less your result depends on the originally available information, the better.
And people can still be identified by gait etc, so just blocking out the face is still not buying you perfect cover.
Pixelated too
Exactly. Adding noise... adds noise. If you have a relatively small data set, then the edit distance between the blurred image and one or two of the originals is likely to be smaller than the others, which is what this kind of system determines. If you have a very large dataset, then you're going to end up with far more false positives.
To give a simple example, consider a data set of four people: two white, two black, and of those one each with blond hair and one with dark. You add a lot of noise, but you can still effectively identify them by averaging the colour in the top third and bottom two thirds of the image. You should get a 100% accuracy even with a lot of noise in the image. Now consider doing the same thing on a data set of 100 people in those same four categories. At best, you'll narrow it down to about a quarter of the people.
Neural networks aren't magic. They can approximate any mathematical function and they're often easier to generate than working out what the function that you actually want would look like. If there is enough information in the source data for discrimination, then a neural network can be trained to extract it and perform the classification. If there isn't, then you're out of luck.
Often; however, these things work because the blurring is not actually a very lossy transform. It's a convolution filter that only discards a very small amount of information, but does so in a way that confuses the human brain (the opposite of something like JPEG, which tries to throw away only the information that the human visual cortex doesn't use to identify the image). A number of such transforms have been shown to be either fully reversible, or partially reversible such that you can identify the original quite clearly.
I am TheRaven on Soylent News
I'm just reminded of the case (About a decade ago) of a pedophile who published photo's of himself abusing children with his face obfuscated by the photoshop swirl tool. The police desperately wanted to ID him but couldn't deobfuscate the photos so they published them minus the abuse sections hoping that members of the public might identify the man based on his surroundings. Of course the public not being utter fucknuggets quickly deswirled the photo and published it on the internet. I never did find out how long the guy survived.
Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.
It is a fundamental law of computer science that you cannot increase the amount of information in a given dataset. In this case the combined dataset of the blurred image and the learned statistical averages of a human face.
Once an image has been blurred (information has been deleted) it cannot be recreated. What you can do is to apply statistical averages in the hopes of getting something which might resemble the original information. It will - however - be just that, cosmetic improvements based on statistical averages.
If sufficient information has been removed by blurring the image, the deblurring process - no matter if you use the word AI or statistic averages - cannot recreate a uniquely identifiable image.
It was the police who deswirled the photographs.
systemd is Roko's Basilisk.
You know, you raise a good question.
I've just always been told it's a good practice, but yeah, what would someone actually be able to do with someone else's plate numbers?
Have you ever fallen asleep at the keybhanusdiog?
Can we stop with this "deep learning" bullshit now? It is just algorithms. Every moron has to interject "AI" or "deep learning" or "neural nets" into their program description. This is really stupid "research" anyway. Is this what passes for research in CS now?
I remember a demo of Photoshop from two years ago when they managed to reverse lens blur off a photo. It was only a matter of time.
They had a photo with an obscured face and the same photo with unobscured face in their training set. It seems obvious a computer can match those two. The solution would be to use unique photos, not uploaded anywhere, as the source for obscuration and only publish the obscured version.
The guy was caught in Thailand. The German police "deswirled" his photograph:
https://en.wikipedia.org/wiki/Christopher_Paul_Neil
Most Asian women I see in the US are no longer pixelated.
"That's the way to do it" - Punch
Surprisingly he's not dead yet
https://en.wikipedia.org/wiki/...
news report
http://thelede.blogs.nytimes.c...
etc
"It is a greater offense to steal men's labor, than their clothes"
Why would you show a blurred photo anyway? Show the face in full, or don't show it at all. There is no compromise here.
That's no image filter, that's just the way my face naturally looks, you insensitive clod!
If you care about security, you shouldn't be using blur, you should be putting a nice black circle over it. A yellow smiley face works just as well.
If I take a photo that has license plates, street addresses etc...I CUT them out, PAST another image of the photo in place. If you don't just blur it, but REMOVE it, how would they figure it out?
I wonder if this can be used to attack steganography...
“He’s not deformed, he’s just drunk!”
It's gone.
Between social media mining, NSA/CIA/FBI operations, license plate readers, Stingray gadgets, the GPS in your phone, cell tower triangulation, TPMS scanners, and the video cams on every power pole and stop light, the concept of 'privacy' or anonymous behavior is pretty much gone.
I'd wager it would be nearly impossible to travel between any to major cities or buy anything in a store without leaving a trackable signature.
You'd basically have to travel by bicycle with your head covered (leaving your cell phone at home, of course) and pay for stuff in cash while wearing gloves. I'm not sure even that would do it.
Just cruising through this digital world at 33 1/3 rpm...
Wait... you mean that's an actual thing now?
Hey, glasses seem to work as an effective disguise for Clark Kent. . .
. . .oh, nevermind. . .
I'd suggest that the obvious next step is to produce a device and corresponding software that will allow a user to see through frosted glass or the wavy glass blocks that are frequently used in the bathrooms of homes. Both are intended to let natural light in while providing privacy by breaking up/diffusing the image in ways that make it impossible for the human brain to reconstruct, but there's no reason (I can see) that a computer shouldn't eventually be able to reconstruct the original image, allowing someone to effectively look through privacy glass as if it was perfectly clear.
The applications in law enforcement and voyeurism are obvious.
Either mask the face/license plate/whatever entirely or replace it with a "fake blur" that was made from another image.
For license plates, use a sample plate like ABC-123 to generate the blurred image.
Faces will be a little harder to do: Either 1) you will only have a few "sample faces" and things will look creepy even if you use the best-matching sample, 2) you will have a few thousand and you will, in effect, leak information, or 3) you will be in between and it will look creepy and leak information.
Perhaps just masking the face altogether will be the best option.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
The wavy glass block inverter was done at least 10 years ago. Can't remember the paper, sorry, it was before arxiv was standard.
That's what they do on all the crime scene investigation shows!
Well. That's terrifying.
Why blur at all, instead of just putting a solid black oval over the face, including hair? Then there is ZERO chance of anyone or any machine being able to retrieve or reconstruct anything?
The lens has a certain unchanging point spread function (how a point of light is spread into a blur) which scales linearly with distance away from (and closer than) the focal plane. You estimate the size of the blur, then apply an inverse of this PSF. The process is similar to tomography used in CT scans (Computer-assisted Tomography) and MRIs. Likewise, camera shake simply adds a linear smear component to this PSF. Heck, technically you don't even need a lens. The light shining through a window which falls as a smear on a piece of paper (or sensor) is just the Fourier transform of the scene visible through the window. FTs are symmetric (reversible), so if you run a FT of what that sensor records, you get back the image out the window. The catch being that you need to record both intensity and phase data. That's what a hologram does. You shine a laser at a scene, and the scattered laser light (FT'ed) falls onto the holographic film which records the light interference pattern (phase and intensity data). Shining the same laser light through the film (another FT) recreates an image of the original scene. This is also how light field cameras work, and why they're able to change focus after the "photo" has been taken. They're capturing the light field (intensity and phase), and are able to completely reconstruct the scene.
Gaussian blurs are harder to undo because they're random. "Gaussian" means you're applying a random blur which falls within a statistical normal curve. i.e. Each time you run a Gaussian blur on the same photo, the end result is slightly different. But in blurred video, you've got multiple sequential Gaussian blurs of the same subject. Time-averaging those causes the normal curve to narrow into a sharp peak, at which point the statistical randomness is close to nil and you can (theoretically) reverse the blur.
Oh, all the super villains know his secret identity. But it's not like he's weaker at work or anything, and they want him to spend 8 hours a day working a normal job!
Socialism: a lie told by totalitarians and believed by fools.
Turns out someone's been fixing blurred lines for a while now
https://app.box.com/WitthoftResume Code: https://github.com/cellocgw
Let's see their 'deep learning tool' identify something that's got a featureless black box over it, or someone's face that's got a black box or oval over it.
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
All of this research, all of the effort.
Defeated by a black box in MS PAINT.
Ten years ago, I was CTO for a company making smart touchscreen devices for restaurant and bar tabletops. We didn't have a camera in any of the ones we fielded (people were still to weirded out by that idea, then), but I did some serious technical investigation on whether we could use an intentionally low-res image to determine basic demographics of the diners w/o voilating their privacy.
In my research, I found an really interesting paper (from France, IIRC, it's been a while) showing that even a 16-pixel (!) image could still be used to determine the age and sex of a person to around 80-90% accuracy, and recognize the same person again over half the time. IIRC, it used both neural networks and some standard image processing, but nothing really exotic or so big that we couldn't run it locally in the display device, if we'd decided to. Even the author was amazed that this was possible, because neither he nor anyone else had thought there was enough information there to perform such a feat of recognition.
But computers really don't look at things like we do, and why even "just metadata" (and it's a lot more than that, now) is so dangerous - with some not-too-complicated processing, the machine can tease out patterns in the data that we cannot.... (Note that this means that the spooks probably really can do some of the "ridiculous" image processing and recognition we tend to laugh at in movies and TV shows. No Way Out, indeed....
"The future's good and the present is nothing to sneeze at." - Roblimo's last
http://www.martinbackes.com/pixelhead-limited-edition/
as any fule kno
In my research, I found an really interesting paper (from France, IIRC, it's been a while) showing that even a 16-pixel (!) image could still be used to determine the age and sex of a person to around 80-90% accuracy, and recognize the same person again over half the time
There was some research from DERA a while ago (back when DERA still existed, so a good 15 or so years back) trying to put biometric information on magstripe cards. They managed to put enough information in the 50 bits of space that they had to uniquely identify all of the faces that they tested it with (a few million) with no false positives. That's not really surprising, when you think that 50 bits gives you 2^50 combinations (about one quadrillion). With perfect encoding, you'd only need around 34 bits to uniquely identify every human, so 50 bits gave them a lot of space for the non-linear distribution of real faces in the possible-face space. 16 colour pixels gives you 384 bits, so there's a lot of possible discrimination with that much information (though there are probably a lot of combinations of pixel values that you never see: blue and pink polkadot faces are pretty rare).
Note that this means that the spooks probably really can do some of the "ridiculous" image processing and recognition we tend to laugh at in movies and TV shows
In the 90s there was a lot of research into algorithmic image compression. For faces, this works very well - you take an average face and then just encode the differences between a specific face and the average (then apply normal data compression to the result). You can often enhance images in the same way: If you know that the thing you're looking at is a face then that's a lot of information that you can add to data that you get from the source image. You may not get the original, but you'll probably get something that a human (or another well trained NN) can use to recognise the person.
I am TheRaven on Soylent News