CityGuard: Graph-Aware Private Descriptors for Bias-Resilient Identity Search Across Urban Cameras

Rong Fu; Yibo Meng; Rui Lu; Jiekai Wu; Simon Fong

cs.CVFeb 20, 2026

CityGuard: Graph-Aware Private Descriptors for Bias-Resilient Identity Search Across Urban Cameras

Authors: Rong Fu, Yibo Meng, Rui Lu, Jiekai Wu, Simon Fong

Organizations: Independent Researcher

Abstract

City-scale person re-identification across distributed cameras must handle severe appearance changes from viewpoint, occlusion, and domain shift while complying with data protection rules that prevent sharing raw imagery. We introduce CityGuard, a topology-aware transformer for privacy-preserving identity retrieval in decentralized surveillance. The framework integrates three components. A dispersion-adaptive metric learner adjusts instance-level margins according to feature spread, increasing intra-class compactness. Spatially conditioned attention injects coarse geometry, such as GPS or deployment floor plans, into graph-based self-attention to enable projectively consistent cross-view alignment using only coarse geometric priors without requiring survey-grade calibration. Differentially private embedding maps are coupled with compact approximate indexes to support secure and cost-efficient deployment. Together these designs produce descriptors robust to viewpoint variation, occlusion, and domain shifts, and they enable a tunable balance between privacy and utility under rigorous differential-privacy accounting. Experiments on Market-1501 and additional public benchmarks, complemented by database-scale retrieval studies, show consistent gains in retrieval precision and query throughput over strong baselines, confirming the practicality of the framework for privacy-critical urban identity matching.

Figures & tables

Figure 1: Overview of the CityGuard framework for bias-resilient, privacy-preserving identity search. The process begins with Topology-Aware Geometry Encoding , where camera coordinates and rotations are mapped to a spatial adjacency graph. The Geometry-Conditioned Backbone then fuses multi-scale features and refines them through a Temporal Graph Network (TGN) to capture cross-camera motion cues. Centrally, the Dispersion-Aware Metric Calibration utilizes an Adaptive Class-Tolerant (ACT) Loss to dynamically adjust margins $\gamma_{i}$ based on per-identity distribution divergence. Global consistency is enforced via a Transport-Regularized Retrieval objective using Sinkhorn iterations. Finally, the Differentially Private Embedding Release applies a Gaussian mechanism calibrated by $L_{2}$ -sensitivity to produce privatized descriptors $\widetilde{f}$ for secure, large-scale indexing.

Configuration	Market R1	Market mAP	MARS R1	MARS mAP
Baseline (Swin-T)	87.6	79.5	84.2	78.3
+ ACT Loss	91.2	82.4	87.1	81.4
+ Geo-Attention	89.8	81.1	86.5	80.1
+ OT Loss	94.5	93.2	94.1	89.3
Full CityGuard (perfect calibration)	97.5	96.5	95.7	91.6
Full CityGuard (w/ coarse GPS noise $\sigma$ =5m) ⋆	97.1	96.2	95.4	91.1

Table 1: Progressive component ablation on Market-1501 and MARS (R1 and mAP only).

\dagger

denotes removal of geometric prior.

\star

denotes robustness to approximate geometry (coarse GPS or identity rotation).

Method	MARS-mAP (%)	MARS-R1 (%)	Market-R1 (%)	Market-mAP (%)
AuxIMD [ 56 ]	78.5	87.0	80.9	72.4
STE-NVAN [ 57 ]	82.3	88.5	90.0	82.8
HMN [ 58 ]	85.1	90.1	93.1	83.3
STA [ 59 ]	85.1	89.8	86.3	80.8
COSAM [ 60 ]	82.9	90.2	86.9	87.4
GLTR [ 61 ]	85.8	90.0	87.0	78.5

Table 2: Comparative performance evaluation on MARS and Market-1501 datasets.

Method	Market-1501			MSMT17
Method	Clean	FGSM	PGD-20	Clean	FGSM	PGD-20
	Rank-1/mAP	Rank-1/mAP	Rank-1/mAP	Rank-1/mAP	Rank-1/mAP	Rank-1/mAP
TransReID [ 5 ]	95.2/89.5	12.3/5.1	3.7/1.2	83.5/64.4	15.8/6.9	5.4/2.1
OAT [ 68 ]	95.7/89.9	18.4/7.3	6.2/2.4	91.2/82.3	19.1/8.5	7.1/2.9
FED [ 74 ]	95.0/86.3	22.7/9.8	8.9/3.7	86.3/79.3	24.5/10.2	9.3/3.8
CityGuard (Ours)	97.5/96.5	68.7/52.4	45.2/31.8	94.9/90.1	71.3/55.1	48.9/35.3

Table 3: Adversarial robustness evaluation of CityGuard and baseline methods on Market-1501 and MSMT17 under FGSM (

\epsilon=4/255

) and PGD-20 (

\epsilon=4/255

, step size=

1/255

) attacks.

Appendix figures & tables21 assets

Supplementary material from the paper’s appendix.

Appendix

Method	Occluded-REID		Partial-REID		Partial-iLIDS
Method	Rank-1	mAP	Rank-1	mAP	Rank-1	mAP
DSR [ 55 ]	72.8	62.8	73.7	68.1	64.3	58.1
PCB [ 77 ]	66.3	63.8	56.3	54.7	46.8	40.2
HOReID [ 78 ]	80.3	70.2	85.3	-	72.6	-
QPM [ 79 ]	81.7	-	-	-	77.3	-
RTGAT [ 80 ]	71.8	51.0	-	-	-	-

Appendix

Table 4: Performance comparison (Rank-1 / mAP in %) on occluded and partial person re-identification datasets. ‘ ∗ ’ indicates ImageNet pre-training and ‘ † ’ indicates LUPerson pre-training. Top performance is in bold , second-best is underlined.

$\gamma_{0}$	$\alpha$	$\beta$	Rank-1	mAP
0.3	0.0	0.0	94.2	91.8
0.4	0.0	0.0	95.1	93.2
0.5	0.0	0.0	94.8	92.9
0.3	0.2	1.0	96.3	94.5
0.4	0.2	1.0	97.5	96.5
0.5	0.2	1.0	97.1	95.8

Appendix

Table 5: Impact of adaptive margin hyperparameters

\gamma_{0}

\alpha

, and

\beta

on retrieval performance (Rank-1 and mAP in %) evaluated on Market-1501.

Setting	Rank-1	mAP
$\tau=0.5$	82.1	79.3
$\tau=1.0$	87.2	84.5
$\tau=1.5$	85.3	82.1
$\tau=2.0$	84.7	81.6
$\epsilon_{\text{OT}}=0.001$	95.8	94.2
$\epsilon_{\text{OT}}=0.01$	96.3	95.1

Appendix

Table 6: Ablation of temporal window

\tau

and regularization

\epsilon_{\text{OT}}

. Metrics: Rank-1 and mAP (%).

Figure 2: Camera topology (GPS only): top-down 2D layout of camera nodes with edge thickness encoding the row-stochastic affinity $A_{ij}$ . This panel visualizes affinity derived solely from pairwise GPS distances.

Figure 3: Camera topology (GPS + Rotation): top-down 2D layout where $A_{ij}$ incorporates both GPS distance and heading alignment. Rotation-aware alignment increases weights between cameras with similar headings.

Figure 4: Attention matrix $A$ computed from visual similarity alone (no geometric bias). Rows correspond to source cameras and columns to target cameras; intensity indicates attention weight before incorporation of the geometric term $B_{\mathrm{geom}}$ .

Figure 5: Attention matrix $A$ after adding geometric bias $B_{\mathrm{geom}}$ . Compared with Figure 4 , physical neighbors and heading-aligned cameras receive visibly higher attention weights, illustrating the effect of the geometry-conditioned term.

Figure 6: ACT margin dynamics: evolution of adaptive margins $\gamma_{i}$ for several example identities over training. Curves follow $\gamma_{i}=\gamma_{0}+\alpha\tanh(\beta\,\mathrm{KL}_{i})$ , showing margins increase with per-identity KL divergence.

Figure 7: UMAP visualization of feature distributions comparing baseline and CityGuard embeddings.

Figure 8: Baseline feature distribution exhibiting dispersed intra-class clusters and overlapping inter-class regions.

Figure 9: CityGuard feature distribution demonstrating compact intra-class clusters and clear inter-class separation.

Figure 10: Training convergence on Market-1501 using Swin Transformer with circle loss and domain generalization.

Figure 11: Performance analysis on Market-1501 under varying training configurations.

Model	Params (M)	Latency	GFLOPS
Swin-T	29.0	10.2 ms	4.3
PMT	33.5	12.7 ms	5.1
CityGuard	31.2	11.2 ms	4.7
Sparse variant	24.1	8.9 ms	3.9

Appendix

Table 7: Resource profile for

128\times 64

input.

Method	SYSU-MM01 (All-Search)			RegDB
	Rank-1	mAP	mINP	Rank-1	mAP	mINP
AGW [ 94 ]	47.50	47.65	35.30	70.05	66.37	50.19
CIL [ 95 ]	45.41	47.64	38.15	74.96	69.75	55.68
DGTL [ 96 ]	57.34	55.13	42.55	83.92	73.78	59.17
DART [ 97 ]	68.72	66.29	53.26	83.60	75.67	60.60
DEEN [ 98 ]	74.70	71.80	59.06	91.10	85.10	67.01

Appendix

Table 8: Comparative cross-modality re-identification performance on SYSU-MM01 and RegDB datasets. CityGuard achieves state-of-the-art results under both evaluation protocols.

Method	Rank-1 (%)	mAP (%)	mINP (%)	Transfer Gap ‡
ResNet-50 (Baseline)	54.2 $\pm$ 0.4	40.1 $\pm$ 0.3	18.5 $\pm$ 0.2	–
TransReID [ 5 ]	58.3 $\pm$ 0.3	45.2 $\pm$ 0.3	22.1 $\pm$ 0.2	–
AGW [ 94 ]	60.5 $\pm$ 0.3	47.8 $\pm$ 0.3	24.3 $\pm$ 0.2	–
HOSNet [ 101 ]	61.2 $\pm$ 0.3	48.5 $\pm$ 0.3	25.1 $\pm$ 0.2	–
CityGuard (w/o geometry)	62.4 $\pm$ 0.3	48.9 $\pm$ 0.3	26.2 $\pm$ 0.2	35.1
CityGuard (full)	65.1 $\pm$ 0.3	52.3 $\pm$ 0.3	29.4 $\pm$ 0.2	32.4

Appendix

Table 9: Zero-shot cross-domain generalization (Market-1501

\rightarrow

MSMT17). Models are trained on Market-1501 only and evaluated on MSMT17 without adaptation. † indicates geometric priors transferred to the target camera layout.

Figure 12: Privacy-utility trade-off curves showing Rank-1 accuracy and mAP degradation on Market-1501 under varying privacy budgets $\epsilon$ with a fixed $\delta=10^{-5}$ . The dashed horizontal lines represent non-private baseline performance.

Privacy Budget	Rank-1	$\Delta$ Rank-1	mAP	$\Delta$ mAP
$\epsilon$	(%)	(%)	(%)	(%)
$\infty$ (Baseline)	97.5 $\pm$ 0.3	–	96.5 $\pm$ 0.2	–
100	97.3 $\pm$ 0.3	0.2	96.2 $\pm$ 0.2	0.3
50	97.1 $\pm$ 0.3	0.4	95.9 $\pm$ 0.2	0.6
20	96.5 $\pm$ 0.4	1.0	95.1 $\pm$ 0.3	1.4
10	95.8 $\pm$ 0.4	1.7	93.9 $\pm$ 0.3	2.6

Appendix

Table 10: Quantitative privacy-utility trade-off on Market-1501 (

\delta=10^{-5}

). We report mean performance over 5 independent runs with different random seeds.

\Delta

denotes the absolute degradation relative to the non-private baseline.

Configuration	$\epsilon$	Prec. (%)	Adv. (%)
Non-private baseline	$\infty$	81.5	63.0
Weak protection	8.0	68.2	36.4
Moderate protection	4.0	61.5	23.0
Strong protection (Ours)	2.0	54.3	8.6
Very strong protection	1.0	51.2	2.4

Appendix

Table 11: Membership inference attack precision (Prec.) and advantage (Adv.) under varying privacy budgets

\epsilon

on Market-1501.

Attribute	Model	DPD $\downarrow$	DEOdds $\downarrow$	AUC $\uparrow$	ES-AUC $\uparrow$	Group-wise AUC $\uparrow$
Race	CLIP	5.3	14.0	77.3	72.4	79.74/73.60/77.82
	CLIP-FT	4.0	9.6	80.3	74.7	82.19/75.67/81.20
	BLIP2	9.4	10.6	73.8	68.9	76.28/69.55/74.22
	BLIP2-FT	8.3	10.9	80.1	73.8	82.09/74.43/80.97
	CityGuard	2.2	6.8	98.5	95.3	97.82/96.45/98.93
Gender	CLIP	1.1	5.2	77.3	72.5	74.25/80.88

Appendix

Table 12: Demographic fairness comparison across vision-language models. Best results highlighted in bold , second-best underlined .

Config	Latency (ms)	Index (GB)	GPU Mem (MB)	mAP
PostgreSQL + SeqScan	1420	0	0	0.712
PG-Strom + ResNet50	380	22.1	1480	0.823
PG-Strom + CityGuard	210	8.7	890	0.859

Appendix

Table 13: Database integration benchmarks (extended MSMT17).

Explore similar work

Privacy-Preserving Person Re-Identification from Temporal Sequences with Transformer and Hungarian Optimization
Jun 22, 2026Raphaël Delécluse, Hazem Wannous, Laurent GuimasPrivacy-Preserving ML Person Re-Identification
IMT Nord Europe, University of Lille, CNRS UMR 9189 - CRIStAL, F-59000 Lille, France · Explain, F-59000 Lille, France
Identity-Conditioned Score Fusion for Open-Set Person Re-Identification
Oct 5, 2026Manyi Yao, Jurijs Nazarovs, Eunji Chong +6Multimodal Fusion Person Re-Identification
University of California, Riverside · Amazon
Misanthrope: A Privacy-Preserving Keypoint Detector
Aug 24, 2026Francesco Vultaggio, Predrag Djindjic, Markus Gerke +2Keypoint Detection Privacy-Preserving ML
Austrian Institute of Technology, Assistive & Autonomous Systems Vienna 1210, Austria. · Technical University of Braunschweig, Institute of Geodesy and Photogrammetry Braunschweig 38106, Germany. · University of Vienna, Data Mining and Machine Learning Vienna 1090, Austria.

Jun 22, 2026J/K move · Enter open · S save

Privacy-Preserving Person Re-Identification from Temporal Sequences with Transformer and Hungarian Optimization

Raphaël Delécluse, Hazem Wannous, Laurent Guimas

IMT Nord Europe, University of Lille, CNRS UMR 9189 - CRIStAL, F-59000 Lille, France · Explain, F-59000 Lille, France

Privacy-Preserving ML Person Re-Identification

Open paper AskPDF arXiv

Person re-identification (Re-ID) is a crucial task in surveillance and human behavior analysis, often used in public spaces such as transport hubs. Traditional RGB-based Re-ID methods raise privacy concerns and are highly sensitive to lighting variations and occlusion. In this paper, we propose a novel Re-ID approach that leverages depth images, which inherently obscures facial and other identifiable features, making it a privacy-preserving solution. Our method addresses the association problem between multiple views of individuals by applying the Hungarian algorithm, optimizing the matching process through minimization of the global cost across the distance matrix. We further enhance the approach by introducing temporal sequences of frames as input to a Transformer encoder architecture, which exploits both RGB and depth modalities. This architecture captures dynamic movement patterns, improving feature extraction and re-identification accuracy. Additionally, we employ batch hard triplet loss to enhance discriminative feature learning by focusing on the hardest samples. We evaluate both depth-only and RGB-D models on several top-view datasets, including TVPR2, GODPR, and BIWI RGBD-ID. Our results demonstrate that depth-only re-identification can achieve competitive performance compared to state-of-the-art methods, as measured by standard metrics such as Cumulative Matching Characteristics (CMC) and Mean Average Precision (mAP), while prioritizing privacy preservation.

Abstract

Explore similar work

Privacy-Preserving Person Re-Identification from Temporal Sequences with Transformer and Hungarian Optimization

Identity-Conditioned Score Fusion for Open-Set Person Re-Identification

Misanthrope: A Privacy-Preserving Keypoint Detector