Protecting and Preserving Protest Dynamics for Responsible Analysis

Cohen Archbold; Usman Hassan; Nazmus Sakib; Sen-ching Cheung; Abdullah-Al-Zubaer Imran

cs.CVApr 6, 2026

Protecting and Preserving Protest Dynamics for Responsible Analysis

Authors: Cohen Archbold, Usman Hassan, Nazmus Sakib, Sen-ching Cheung, Abdullah-Al-Zubaer Imran

Organizations: University of Kentucky, USA

Abstract

Protest-related social media data are valuable for understanding collective action but inherently high-risk due to concerns surrounding surveillance, repression, and individual privacy. Contemporary AI systems can identify individuals, infer sensitive attributes, and cross-reference visual information across platforms, enabling surveillance that poses risks to protesters and bystanders. In such contexts, large foundation models trained on protest imagery risk memorizing and disclosing sensitive information, leading to cross-platform identity leakage and retroactive participant identification. Existing approaches to automated protest analysis do not provide a holistic pipeline that integrates privacy risk assessment, downstream analysis, and fairness considerations. To address this gap, we propose a responsible computing framework for analyzing collective protest dynamics while reducing risks to individual privacy. Our framework replaces sensitive protest imagery with well-labeled synthetic reproductions using conditional image synthesis, enabling analysis of collective patterns without direct exposure of identifiable individuals. We demonstrate that our approach produces realistic and diverse synthetic imagery while balancing downstream analytical utility with reductions in privacy risk. We further assess demographic fairness in the generated data, examining whether synthetic representations disproportionately affect specific subgroups. Rather than offering absolute privacy guarantees, our method adopts a pragmatic, harm-mitigating approach that enables socially sensitive analysis while acknowledging residual risks.

Figures & tables

Figure 1. Diagram of our proposed protest analysis framework. We synthesize image $\tilde{\mathbf{x}}$ , from the real data annotations $\mathbf{y}$ , for training our downstream analysis model privately. The the information flow for the downstream analysis is shown in red. Diagram of the information flow of the model.

Dataset	Total	Train	Test	Protest Samples	Attributes
Won et al. (2017)	40,764	32,611	8,153	11,659	Yes
Ours	40,764	32,611	8,153	11,659	Yes
VGKG	106,817	106,817	–	106,817	No
UCF-QNRF ( Idrees et al., 2018 )	1,535	1,535	–	–	No
JHU-CROWD++ ( Sindagi et al., 2020 )	4,250	4,250	–	–	No
NWPU-Crowd ( Wang et al., 2021 )	5,109	5,109	–	–	No

Table 1. Distributions of the datasets used in this work

Figure 2. Qualitative examples of generated imagery for each generative model. We show the results of each generative model in each row and compare them to the real data sample (final row). Each column corresponds to a specific training set data entry, and it is conditionally generated using the corresponding annotation. Faces in the real images are blurred for privacy protection. Samples from each generative model for protest imagery in this study.

Model	FID $\downarrow$	IS $\uparrow$	KID $\downarrow$
WGAN-GP ( Gulrajani et al., 2017 )	303.524	1.736	0.343
DP-GAN ( Xie et al., 2018 ) ( $\epsilon=1$ )	290.444	2.416	0.258
DP-GAN ( Xie et al., 2018 ) ( $\epsilon=10$ )	325.381	1.699	0.341
DP-GAN ( Xie et al., 2018 ) ( $\epsilon=50$ )	330.144	1.909	0.345
Ours (StyleGAN3)	15.832	6.508	0.007
Ours FT (Crowd)	40.263	5.827	0.024

Table 2. Quantitative evaluation of generative model performance. Visual quality and diversity metrics include FID, IS, and KID. For DP-GAN ( Xie et al., 2018 ) we show the results at varying privacy levels

{\epsilon=1,10,50}

as described in Eq. ( 1 ).

Panel of Figure 3 — Figure 3. Downstream protest and violence prediction performance: (a) We report the receiver operating characteristic curve for downstream models trained on different synthetic data, as well as DP-SGD trained on real data. (b) Violence score performance is reported. We plot a scatter plot of 1000 samples from predicted violence on the test set and compute the line of best fit for each model using all test data samples. Protest and Violence prediction accuracy of downstream models.

Figure 4. AUC-ROC per attribute of downstream classifiers on the UCLA test set when trained on the different conditionally generated data. Error bars represent 95% confidence intervals computed using Wilson score. Attribute prediction accuracy of downstream models.

Method	Threshold	Accuracy	Precision	Recall
Real	0.950	0.592	0.563	0.871
Real	0.990	0.621	0.627	0.616
DP-SGD( $\varepsilon=10$ )	0.500	0.506	0.506	1.000
DP-SGD( $\varepsilon=1$ )	0.500	0.506	0.506	1.000
Ours	0.950	0.532	0.540	0.505
Ours	0.990	0.539	0.617	0.233

Table 3. Reported accuracy, precision, and recall scores of classification using the block-box attack model. We experimented with softmax thresholds of

[0.95,0.99]

, and

[0.50]

for DP-SGD due to its low confidence.

Attack Model	Method	Accuracy	Precision	Recall	AUC-ROC	Log-Loss
Nasr et al. (2019)	Real	0.703	0.674	0.786	0.794	1.908
	DP-SGD( $\varepsilon=10$ )	0.500	0.500	1.000	0.500	0.693
	DP-SGD( $\varepsilon=1$ )	0.500	0.500	1.000	0.500	0.693
	Ours	0.679	0.689	0.654	0.733	2.4579

Table 4. Reported accuracy, precision, recall, and AUC-ROC scores of classification using the white-box attack model. Our results show a considerable advantage in the worse case attack scenario, compared to training on real data.

Panel of Figure 5 — Figure 5. Pairwise statistical parity differences for predicted outcomes across sensitive attributes: age, race, and gender. Each heatmap cell compares the prediction rates between two demographic groups (Comparison Group vs Reference Group) for a given attribute. The values represent the difference in prediction rates (Comparison Group – Reference Group), with 95% confidence intervals shown below each value. These intervals are computed using Wilson score. Darker red colors indicate larger disparities in prediction rates, highlighting potential fairness concerns. Pairwise statistical parity differences for predicted outcomes of our resulting model. Plotted as confusion matrices.

Panel of Figure 6 — Figure 6. Face Attribute distributions from synthetic and real datasets, assessing (a) Age, (b) Gender, and (c) Race. We randomly sample 2500 images from each training set, and extract the facial attributes of detected faces with $\geq 0.5$ confidence using a pre-trained VGG-Face model ( Serengil and Ozpinar, 2021 ) trained on the FairFace dataset ( Kärkkäinen and Joo, 2021 ) . Face attribute statistics collected from both real and synthetic datasets.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Task	Accuracy	Precision	Recall	mIOU	[email protected]
Face Detection	—	—	—	0.737	0.816
Age Classification	36.2%	0.405	0.291	—	—
Race Classification	60.9%	0.689	0.429	—	—
Gender Classification	72.5%	0.381	0.308	—	—

Appendix

Table 5. Performance metrics for face detection and demographic attribute classification on 100 manually labeled protest images.

Figure 7. Additional samples of synthetic images Additional samples of synthetic images

Figure 8. Additional samples of synthetic images pre-trained on crowd-counting datasets Additional samples of synthetic images pre-trained on crowd-counting datasets

Figure 9. Additional samples of synthetic images pre-trained on the VGKG dataset Additional samples of synthetic images pre-trained on the VGKG dataset

Privacy-Preserving ML

Privacy-preserving machine learning develops methods to learn, share, and run models while limiting exposure of sensitive data.

See all 432 papers

Phantoms and Disclosures: a Causal Framework for Auditing Synthetic Data
Jun 15, 2026Kareem Amin, Rudrajit Das, Alessandro Epasto +4Privacy Auditing Membership Inference Attacks
1Google · University of Southern California
Rethinking Anonymity Claims in Synthetic Data Generation: A Model-Centric Privacy Attack Perspective
Jan 30, 2026Georgi Ganev, Emiliano De CristofaroPrivacy Auditing Synthetic Tabular Data Generation
UCL · SAS · UC Riverside
Generative AI and Digital Ecosystem Resilience: A Proactive Lifecycle-Based Survey
May 28, 2026Jonghyun Chung, Rishabh Chaddha, Sanket Badhe +3
Google LLC

Jun 15, 2026J/K move · Enter open · S save

Phantoms and Disclosures: a Causal Framework for Auditing Synthetic Data

Kareem Amin, Rudrajit Das, Alessandro Epasto, Adel Javanmard+3

1Google · University of Southern California

Privacy Auditing Membership Inference Attacks Synthetic Data Evaluation

Open paper AskPDF arXiv

The rapid adoption of generative AI and Large Language Models (LLMs) has spurred interest in synthetic data as a privacy-preserving alternative to sensitive real-world datasets. However, generating high-utility synthetic data often carries the risk of memorizing and regurgitating private information from the training corpus. In this work, we present a customizable empirical auditing framework designed to detect and explain such data disclosures. Our framework introduces a mechanism to distinguish between "true disclosures"-where the system directly reproduces a user's information-and "phantom disclosures''-where the system incidentally generates a user's data. By partitioning input data into training and holdout sets and applying rigorous statistical hypothesis testing, we determine if observed disclosures are consistent with strict privacy baselines, such as zero-learning or specific Differential Privacy (DP) bounds. Crucially, this approach requires no model access, no canary insertion, and no reference model training -only the synthetic output and a held-out control set. We demonstrate that this framework effectively functions as a membership inference attack, providing empirical lower bounds on privacy leakage that are tighter than prior data-based auditing methods. Our approach is model-agnostic, applies to any synthetic data generation mechanism, and requires orders of magnitude fewer computational resources than shadow-model or canary-based alternatives.

Abstract

Privacy-Preserving ML

Explore similar work

Phantoms and Disclosures: a Causal Framework for Auditing Synthetic Data

Rethinking Anonymity Claims in Synthetic Data Generation: A Model-Centric Privacy Attack Perspective

Generative AI and Digital Ecosystem Resilience: A Proactive Lifecycle-Based Survey