Conditional Imaging for Privacy-Preserving Visual Sensing

Hengyu Lian; Debabrata Mandal; Anzhou Wen; Yujie Wang; Xi Peng; Praneeth Chakravarthula

cs.CVOct 20, 2026

Conditional Imaging for Privacy-Preserving Visual Sensing

Authors: Hengyu Lian, Debabrata Mandal, Anzhou Wen, Yujie Wang, Xi Peng, Praneeth Chakravarthula

Organizations: Department of Computer Science, University of North Carolina at Chapel Hill, Chapel Hill, 27599, NC, USA. · Department of Applied Physical Sciences, University of North Carolina at Chapel Hill, Chapel Hill, 27599, NC, USA.

Abstract

Conventional visual sensing faces a fundamental dilemma: information that should remain private today may need to be recovered tomorrow. This challenge is becoming increasingly important as cameras become pervasive in our daily surroundings. Existing safeguards either protect visual content only after an image is formed or suppress information during capture in ways that prevent its later recovery. Here, we show through an information-theoretic analysis that privacy and recoverability cannot be achieved simultaneously in static optical systems. Information preserved in a measurement for later reconstruction also remains available to an observer of that measurement, limiting the privacy such systems can provide. To overcome this limitation, we introduce conditional imaging, an imaging approach that changes the optical state for every captured frame. The measurement alone conceals the scene, while knowledge of the corresponding physical system state enables its reconstruction. We analyze how the optical parameters determine the information that can be recovered and use this analysis to guide the design of a camera prototype. We evaluate the system on a captured dataset of human faces using increasingly powerful attempts to recover the scene, from direct visualization and computational inversion to learned reconstruction and identity recognition. Our experiments show that conditional imaging preserves identity in authorized reconstructions while withholding visual information from observers without access to the system state. By making the physical state of the camera part of the information needed for reconstruction, conditional imaging enables visual information to be protected at the point of capture while remaining recoverable for future authorized use.

Figures & tables

Figure 1: Privacy-utility conflict and the conditional imaging paradigm. (a) A short-term rental scenario illustrates the conflict. A host may need evidence of unexpected incidents, such as property damage, while a guest expects privacy during their stay. (b) Existing imaging paradigms . Conventional cameras form readable images before digital safeguards are applied. Privacy-oriented optical systems suppress sensitive information during image formation, but the suppressed information cannot be recovered later. (c) Conditional imaging paradigm . The optical modulation $k_{t}$ changes across frames, producing each measurement $y_{t}$ under a different imaging state. The measurement remains obfuscated by default, while scene recovery is conditioned on access to the corresponding state $k_{t}$ . Releasing the states associated with selected frames enables authorized recovery while measurements whose states remain unavailable stay obfuscated.

Figure 2: Breaking the privacy-utility trade-off via conditional imaging . (a) Image formation and information modes . The imaging process can be mathematically modeled as a linear operation $\mathbf{y}_{t}=\mathbf{H}_{t}\mathbf{x}_{t}+\boldsymbol{\eta}_{t}$ , where the system transport operator $\mathbf{H}_{t}$ maps a scene $\mathbf{x}_{t}$ to a sensor measurement $\mathbf{y}_{t}$ at frame $t$ . Singular value decomposition (SVD) decomposes this mapping into a set of parallel, independent measurement channels. Each singular value determines how strongly information is transmitted through one channel. (b) Comparison of imaging paradigms . An idealized conventional imaging system ( $\mathbf{H}_{t}=\mathbf{I}$ ) preserves all modes and therefore provides no privacy. Static optical encoding ( $\mathbf{H}_{t}=\mathbf{H}_{0}$ ) can improve privacy by suppressing selected modes, but information removed below the noise floor is unavailable to both authorized and unauthorized observers. In contrast, conditional imaging uses a frame-dependent operator $\mathbf{H}_{t}=\mathbf{H}(\mathbf{k}_{t})$ that changes with the modulation state $\mathbf{k}_{t}$ while preserving the modes needed for stable authorized reconstruction. Thus, measurements can be reconstructed when $\mathbf{k}_{t}$ is known while remaining obfuscated when it is withheld.

Figure 3: Conditional imaging framework and operational workflow. (a) Conceptual overview of the prototype conditional imaging camera, where physical image formation is governed by a time-varying optical modulation state. (b) Representative modulation examples for a single ground truth image. Altering the physical state changes the frame-specific point spread function (PSF), producing completely distinct, obfuscated measurements for the exact same input scene. (c) End-to-end workflow demonstrating conditional interpretability. Input scenes are transformed by the dynamic modulation layer to produce noise-like, uninterpretable obfuscated measurements. Without the modulation state (unauthorized end), the frame-specific forward operator is unknown. When the modulation state is available (authorized end), the corresponding PSF is computed and used for scene reconstruction and downstream tasks. Face images from LFW public dataset Huang et al. (2008) .

Figure 4: Evaluation of blind reconstruction attempts. (a) Four state-of-the-art blind deconvolution methods—SelfDeblur, GKPILE, BlindDPS-G (Gaussian kernel), and BlindDPS-M (motion kernel)—produce substantially degraded reconstructions compared with modulation state-aware authorized recovery. Insets show the estimated PSF for each method. (b) Quantitative performance comparison across the test set. Authorized recovery substantially outperforms all unauthorized attempts in both PSNR (blue, left axis) and SSIM (red, right axis). Error bars denote standard deviation across the test set.

Figure 5: Evaluation of PSF-assisted reconstruction attempts. (a) Sensitivity to PSF mismatch . The $10\times 10$ PSNR matrix (right) shows cross-deconvolution between 10 randomly sampled measurements and PSFs from different modulation states. Correctly matched measurement–PSF pairs (diagonal) yield high-quality reconstructions, whereas mismatched pairs (off-diagonal) suffer substantial degradation. The $4\times 4$ grid (left) visualizes a subset of these combinations, with green borders indicating correctly matched pairs. (b) In-scene PSF estimation at representative point-source intensities. At low relative intensities, background structure contaminates the estimated PSF. At higher intensities, the point source provides a cleaner PSF estimate but increasingly dominates the measurement, reducing the relative contribution of the surrounding scene. Insets show the extracted PSFs at representative relative intensity ratios, and image border colors correspond to the respective points in the top curves of (c). (c) Reconstruction performance across relative point-source intensities from $2^{0}$ to $2^{13}$ . PSNR (left axis, blue) and SSIM (right axis, red) are shown for the example in (b) (top) and aggregated across 500 test images (bottom), respectively. Consistent with the visual degradation observed in (b), both metrics remain low across all intensity levels, falling far below the authorized recovery baseline (dashed line), confirming that in-scene features do not expose sufficient information for reliable recovery.

Figure 6: Evaluation of data-driven reconstruction attempts. (a) Qualitative comparison of state-blind data-driven reconstruction using UNet, SwinIR, and Restormer with state-aware authorized recovery. Despite training on paired obfuscated and clean images, all three models produce visibly degraded reconstructions relative to authorized recovery. (b) Quantitative comparison across the LFW test set. State-aware authorized recovery substantially outperforms all data-driven reconstruction approaches and preceding unauthorized attacks in both PSNR (left axis, blue) and SSIM (right axis, red). Error bars denote standard deviation.

Figure 7: Authorized recovery and downstream face analysis. (a) Representative authorized reconstructions from face data captures. State-aware authorized recovery restores fine spatial structure and supports downstream face analysis; PSNR values are shown for each example. Raw obfuscated measurements, on the other hand, result in total detection failure. (b) Face-detection success and failure rates We evaluate face-detection performance across raw measurements, unauthorized reconstructions, authorized reconstructions, and clean references. Raw measurements fail entirely, whereas unauthorized blind and data-driven recovery methods achieve partial success for a subset of images. Authorized reconstructions achieve near-perfect success rate comparable to the clean reference. (c) Face-verification Receiver Operating Characteristic (ROC) curves . For unauthorized methods, verification is evaluated only on the subset of reconstructions that successfully pass face detection , providing a favorable conditional evaluation for the attacker. Authorized reconstruction achieves an area under the curve (AUC) of $0.91$ , approaching the clean-reference AUC of $1.00$ , while the best unauthorized recovery methods, Restormer and UNet, achieve AUCs of only $0.67$ and $0.63$ , respectively. This shows that even among unauthorized reconstructions that successfully pass face detection, identity discrimination remains substantially degraded, whereas authorized state-aware recovery approaches clean-reference verification performance.

Computational Imaging

Computational imaging combines optical and sensor design with algorithms to recover or infer scene information from indirect, compressed, or noisy measurements.

See all 123 papers

Aug 31, 2026

Lensless Gaze Is Not Private by Default: Auditing Identity Leakage Across Disclosure Surfaces

Lensless near-eye sensing is often described as privacy-friendly because its coded measurements are visually unintelligible. Yet visual unintelligibility reflects human interpretation, not what a learned adversary can recover. We therefore treat identity privacy as a systems property of disclosure surfaces: representations crossing sensing, storage, computation, and output boundaries. We audit a simulated lensless gaze pipeline under a 36-subject known-gallery closed-set identification protocol with a fixed, known PSF; privacy from an unknown or varying optical key is outside our scope. Reported accuracies are empirical attack success rates under matched linear and MLP probes and do not upper-bound stronger adversaries. Simulated lensless measurements yield 96.7% top-1 identification versus 97.7% for matched original eye crops, while an MAE embedding retains 94.3%. Compression alone offers little protection: 8-D PCA and a matched 8-D bottleneck retain 93.2% and 91.8%, whereas separately trained 8-D GSPL bottlenecks yield 77.5% mean recovery across three seeds. A released 128-way gaze token lowers single-frame recovery to 38.1%, while its residual and continuous gaze output expose 62.1% and 72.6%, respectively. Under a source-frame-disjoint tiled protocol, token summaries reach 39.9% at T=25, showing that repeated-output risk depends on representation and aggregation. These rates reflect all subject-correlated information in the evaluated dataset, including acquisition and behavioral cues, rather than isolating intrinsic ocular biometrics. Ordinary least squares residualization against a six-dimensional crop geometry and intensity summary still leaves lensless recovery at 95.1%. Our results show that privacy claims for lensless sensing must be tested at disclosure boundaries rather than inferred from appearance.

Rahul Vimalkanth, Kaushik Mitra

Indian Institute of Technology Madras, Chennai, India

Privacy Auditing Gaze Estimation Biometric Identification

Ask PDF

Mar 5, 2026

Privacy-Aware Camera 2.0 Technical Report

With the increasing deployment of intelligent sensing technologies in highly sensitive environments such as restrooms and locker rooms, visual surveillance systems face a profound privacy-security paradox. Existing privacy-preserving approaches, including physical desensitization, encryption, and obfuscation, often compromise semantic understanding or fail to ensure mathematically provable irreversibility. Although Privacy Camera 1.0 eliminated visual data at the source to prevent leakage, it provided only textual judgments, leading to evidentiary blind spots in disputes. To address these limitations, this paper proposes a novel privacy-preserving perception framework based on the AI Flow paradigm and a collaborative edge-cloud architecture. By deploying a visual desensitizer at the edge, raw images are transformed in real time into abstract feature vectors through nonlinear mapping and stochastic noise injection under the Information Bottleneck principle, ensuring identity-sensitive information is stripped and original images are mathematically unreconstructable. The abstract representations are transmitted to the cloud for behavior recognition and semantic reconstruction via a "dynamic contour" visual language, achieving a critical balance between perception and privacy while enabling illustrative visual reference without exposing raw images.

Huan Song, Shuyu Tian, Ting Long +5

Institute of Artificial Intelligence (TeleAI), China Telecom

Video Surveillance Privacy-Preserving ML

Ask PDF

Jun 28, 2026

Bit-ViP: Leveraging Bit-planes to Preserve Visual Privacy in Images through Obfuscation

The unprecedented growth of computer vision applications, such as surveillance systems and social media, raises security and visual privacy concerns, especially when data is stored on cloud servers. Image obfuscation offers a way to preserve visual privacy while maintaining an adequate level of usability; thus, it has been a topic of great interest in recent years. However, prior obfuscation schemes are either vulnerable to malicious attacks, such as model inversion to reconstruct original images from obfuscated images, or generate non-trainable obfuscated images, making them unusable for achieving reasonable accuracy. This paper proposes a novel bit-plane-based image obfuscation scheme, {\em Bit-ViP}, to preserve visual privacy for image-based recognition tasks. The Bit-ViP scheme produces secure, usable images by incorporating an innovative end-to-end obfuscation function. While doing so, the obfuscated image would contain non-invertible noise (generated by Lorenz's chaotic system and differential privacy), making it hard for an adversary to reconstruct the original image. We conduct extensive experiments on two popular activity recognition datasets, namely UCF101 and HMDB51, to validate the effectiveness of Bit-ViP. In the face of attacks on reconstruction, pixel frequency, information entropy, and pixel inter-correlation, we present a rigorous security analysis demonstrating tangible improvements over existing schemes.

Vishesh Kumar Tanwar, Ashish Gupta, Sanjay Madria +1

Department of Computer Science, Missouri University of Science and Technology, USA · Department of Computer Science and Engineering, BITS Pilani Dubai Campus, Dubai, UAE

Privacy-Preserving ML

Ask PDF

Abstract

Computational Imaging

Explore similar work

Lensless Gaze Is Not Private by Default: Auditing Identity Leakage Across Disclosure Surfaces

Privacy-Aware Camera 2.0 Technical Report

Bit-ViP: Leveraging Bit-planes to Preserve Visual Privacy in Images through Obfuscation