Using Neural Networks to Identify Blurred Faces

Neural networks are good at identifying faces, even if they’re blurry:

In a paper released earlier this month, researchers at UT Austin and Cornell University demonstrate that faces and objects obscured by blurring, pixelation, and a recently-proposed privacy system called P3 can be successfully identified by a neural network trained on image datasets—in some cases at a more consistent rate than humans.

“We argue that humans may no longer be the ‘gold standard’ for extracting information from visual data,” the researchers write. “Recent advances in machine learning based on artificial neural networks have led to dramatic improvements in the state of the art for automated image recognition. Trained machine learning models now outperform humans on tasks such as object recognition and determining the geographic location of an image.”

Research paper

Tags: academic papers, biometrics, identification, privacy, surveillance

Posted on September 27, 2016 at 9:39 AM • 10 Comments

Comments

Pete Forman • September 27, 2016 2:55 PM

Ah, but how good are these neural networks going to be at identifying cows?

https://www.theguardian.com/technology/2016/sep/16/beefed-up-google-street-view-privacy-blurs-cows-face

[Google street view pixelated a cow’s face]

Tern • September 27, 2016 3:01 PM

This is creepy and distressing, but sadly an inevitability. We’re going to need to re-fight old fights for the same liberties over and over again as censors legislate use of this tech to impose arbitrary “morality” requirements.

Kyle Wilson • September 27, 2016 5:42 PM

I’d expect that the quick fix here would be to layer in a pink oval on the face before burring the edges. No details in the blurred or pixelated output to key on should mean no risks at that level. There will still be the rest of the picture itself to work with but that is a known risk…

Sheep Target • September 27, 2016 8:40 PM

Fabulous technology but I question the essential purpose of face prints.

It’s for the cops and corps. The cops so they can they exert mass control over people and the corps to perpetuate mass fleecing of the people. But, you dasn’t try to control or fleece them. That’s illegal.

Clive Robinson • September 27, 2016 9:49 PM

@ Kyle Wilson,

I’d expect that the quick fix here would be to layer in a pink oval on the face before burring the edges.

Whilst it will work, I expect that software will be written to look for and filter out such simple techniques.

Thus I expect that in quite a short time someone will release low cost or free software that will track individual faces, and replace them with other faces say of well known politicos / celebs[1].

Thus when that goes through a privacy image mangler there will still be hooks there so simple filtering will not work…

Which in turn will mean some other bio-metric will get used such as gait or gesture analysis.

Such is the way of the world.

[1] Such software is already in use for the high end of the market for use in the,likes of films and commercials. For instance there is an advert for a well known chocolate product where a body double actresses face has been replaced with that of Audrey Hepburn. With the result that certain well known living actors are already selling their “deceased image” rights currently.

Drone • September 28, 2016 1:21 AM

“Using Neural Networks to Identify Blurred Faces”

Whether your neural net is made of silicon or biological material, they are both just neural networks. The difference is: You pay for the silicon version once up-front and it works continuously without complaint. On the other hand, you pay repeatedly for the biological version, it gets sick, complains repeatedly, joins corrupt labor unions, and sues you when it doesn’t get what it wants.

Winter • September 29, 2016 8:27 AM

@Clive
“Thus I expect that in quite a short time someone will release low cost or free software that will track individual faces, and replace them with other faces say of well known politicos / celebs[1].”

But for the purpose of “blurring a face”, use a stock face to replace the target face and only then blur it.

And this can be repeated for other biometrics.

If I control the bits, I can remove as much information as I want. For instance, instead of transforming speech to make it unrecognizable (automatic identification of speakers is already better than humans), simply resynthesize the speech with a run of the mill text-to-speech synthesis. That also removes intonation etc. And I can change the words slightly to cut off that side-channel.

Clive Robinson • September 29, 2016 9:35 AM

@ Winter,

There is still the issue of gait etc analysis. The implication of which is to do an inverse green screen where you blank out the person compleatly and replace with another similar but different body type.

But to be honest, I think those that “own the bits” and chose to release even a heavily modified version of them are to be polite stupid. As your sins will always come back to haunt you if you leave evidence of any kind as a “future hostage”. Which is what those who left DNA at crime scenes from before the 1990’s are finding out.

However even today many male criminals are using their phone cameras to shoot themselves with compromising evidence etc… Even knowing that Law Enforcment can get at the footage whenever they feel like it…

Proving : Stupid is, as stupid does…

A Nonny Bunny • September 30, 2016 4:03 PM

You can fool deep neural networks into classifying a bus as an ostrich just by adding a tiny bit of carefully selected “noise”, even though to a human there’s no visual difference. See e.g. karpathy.github.io/2015/03/30/breaking-convnets/ So I’m not too worried. Sure, simple human-targetting blurs may not work for DNNs, but contrariwise, hiding things from DNNs’ prying eyes can also be done without hiding them from human eyes. And you can combine the two to hide it from both.

murray • October 1, 2016 2:30 AM

@Clive

“As your sins will always come back to haunt you if you leave evidence of any kind as a “future hostage.”

I guess this is implying that any attempt at “masking” will instead be adding to the signature, which can then be exploited by a sufficiently smart scanning algorithm. Yet another cat-and-mouse game to up the ante.

Schneier on Security

Using Neural Networks to Identify Blurred Faces

Comments

Leave a comment Cancel reply