Organizations: Department of Computer Science, University of North Carolina at Chapel Hill, Chapel Hill, 27599, NC, USA. · Department of Applied Physical Sciences, University of North Carolina at Chapel Hill, Chapel Hill, 27599, NC, USA.
Conventional visual sensing faces a fundamental dilemma: information that should remain private today may need to be recovered tomorrow. This challenge is becoming increasingly important as cameras become pervasive in our daily surroundings. Existing safeguards either protect visual content only after an image is formed or suppress information during capture in ways that prevent its later recovery. Here, we show through an information-theoretic analysis that privacy and recoverability cannot be achieved simultaneously in static optical systems. Information preserved in a measurement for later reconstruction also remains available to an observer of that measurement, limiting the privacy such systems can provide. To overcome this limitation, we introduce conditional imaging, an imaging approach that changes the optical state for every captured frame. The measurement alone conceals the scene, while knowledge of the corresponding physical system state enables its reconstruction. We analyze how the optical parameters determine the information that can be recovered and use this analysis to guide the design of a camera prototype. We evaluate the system on a captured dataset of human faces using increasingly powerful attempts to recover the scene, from direct visualization and computational inversion to learned reconstruction and identity recognition. Our experiments show that conditional imaging preserves identity in authorized reconstructions while withholding visual information from observers without access to the system state. By making the physical state of the camera part of the information needed for reconstruction, conditional imaging enables visual information to be protected at the point of capture while remaining recoverable for future authorized use.
Figures & tables
Figure 1: Privacy-utility conflict and the conditional imaging paradigm. (a) A short-term rental scenario illustrates the conflict. A host may need evidence of unexpected incidents, such as property damage, while a guest expects privacy during their stay. (b) Existing imaging paradigms . Conventional cameras form readable images before digital safeguards are applied. Privacy-oriented optical systems suppress sensitive information during image formation, but the suppressed information cannot be recovered later. (c) Conditional imaging paradigm . The optical modulation kt changes across frames, producing each measurement yt under a different imaging state. The measurement remains obfuscated by default, while scene recovery is conditioned on access to the corresponding state kt . Releasing the states associated with selected frames enables authorized recovery while measurements whose states remain unavailable stay obfuscated.
Figure 2: Breaking the privacy-utility trade-off via conditional imaging . (a) Image formation and information modes . The imaging process can be mathematically modeled as a linear operation yt=Htxt+ηt , where the system transport operator Ht maps a scene xt to a sensor measurement yt at frame t . Singular value decomposition (SVD) decomposes this mapping into a set of parallel, independent measurement channels. Each singular value determines how strongly information is transmitted through one channel. (b) Comparison of imaging paradigms . An idealized conventional imaging system ( Ht=I ) preserves all modes and therefore provides no privacy. Static optical encoding ( Ht=H0 ) can improve privacy by suppressing selected modes, but information removed below the noise floor is unavailable to both authorized and unauthorized observers. In contrast, conditional imaging uses a frame-dependent operator Ht=H(kt) that changes with the modulation state kt while preserving the modes needed for stable authorized reconstruction. Thus, measurements can be reconstructed when kt is known while remaining obfuscated when it is withheld.
Figure 3: Conditional imaging framework and operational workflow. (a) Conceptual overview of the prototype conditional imaging camera, where physical image formation is governed by a time-varying optical modulation state. (b) Representative modulation examples for a single ground truth image. Altering the physical state changes the frame-specific point spread function (PSF), producing completely distinct, obfuscated measurements for the exact same input scene. (c) End-to-end workflow demonstrating conditional interpretability. Input scenes are transformed by the dynamic modulation layer to produce noise-like, uninterpretable obfuscated measurements. Without the modulation state (unauthorized end), the frame-specific forward operator is unknown. When the modulation state is available (authorized end), the corresponding PSF is computed and used for scene reconstruction and downstream tasks. Face images from LFW public dataset Huang et al. (2008) .
Figure 4: Evaluation of blind reconstruction attempts. (a) Four state-of-the-art blind deconvolution methods—SelfDeblur, GKPILE, BlindDPS-G (Gaussian kernel), and BlindDPS-M (motion kernel)—produce substantially degraded reconstructions compared with modulation state-aware authorized recovery. Insets show the estimated PSF for each method. (b) Quantitative performance comparison across the test set. Authorized recovery substantially outperforms all unauthorized attempts in both PSNR (blue, left axis) and SSIM (red, right axis). Error bars denote standard deviation across the test set.
Figure 5: Evaluation of PSF-assisted reconstruction attempts. (a) Sensitivity to PSF mismatch . The 10×10 PSNR matrix (right) shows cross-deconvolution between 10 randomly sampled measurements and PSFs from different modulation states. Correctly matched measurement–PSF pairs (diagonal) yield high-quality reconstructions, whereas mismatched pairs (off-diagonal) suffer substantial degradation. The 4×4 grid (left) visualizes a subset of these combinations, with green borders indicating correctly matched pairs. (b) In-scene PSF estimation at representative point-source intensities. At low relative intensities, background structure contaminates the estimated PSF. At higher intensities, the point source provides a cleaner PSF estimate but increasingly dominates the measurement, reducing the relative contribution of the surrounding scene. Insets show the extracted PSFs at representative relative intensity ratios, and image border colors correspond to the respective points in the top curves of (c). (c) Reconstruction performance across relative point-source intensities from 20 to 213 . PSNR (left axis, blue) and SSIM (right axis, red) are shown for the example in (b) (top) and aggregated across 500 test images (bottom), respectively. Consistent with the visual degradation observed in (b), both metrics remain low across all intensity levels, falling far below the authorized recovery baseline (dashed line), confirming that in-scene features do not expose sufficient information for reliable recovery.
Figure 6: Evaluation of data-driven reconstruction attempts. (a) Qualitative comparison of state-blind data-driven reconstruction using UNet, SwinIR, and Restormer with state-aware authorized recovery. Despite training on paired obfuscated and clean images, all three models produce visibly degraded reconstructions relative to authorized recovery. (b) Quantitative comparison across the LFW test set. State-aware authorized recovery substantially outperforms all data-driven reconstruction approaches and preceding unauthorized attacks in both PSNR (left axis, blue) and SSIM (right axis, red). Error bars denote standard deviation.
Figure 7: Authorized recovery and downstream face analysis. (a) Representative authorized reconstructions from face data captures. State-aware authorized recovery restores fine spatial structure and supports downstream face analysis; PSNR values are shown for each example. Raw obfuscated measurements, on the other hand, result in total detection failure. (b) Face-detection success and failure rates We evaluate face-detection performance across raw measurements, unauthorized reconstructions, authorized reconstructions, and clean references. Raw measurements fail entirely, whereas unauthorized blind and data-driven recovery methods achieve partial success for a subset of images. Authorized reconstructions achieve near-perfect success rate comparable to the clean reference. (c) Face-verification Receiver Operating Characteristic (ROC) curves . For unauthorized methods, verification is evaluated only on the subset of reconstructions that successfully pass face detection , providing a favorable conditional evaluation for the attacker. Authorized reconstruction achieves an area under the curve (AUC) of 0.91 , approaching the clean-reference AUC of 1.00 , while the best unauthorized recovery methods, Restormer and UNet, achieve AUCs of only 0.67 and 0.63 , respectively. This shows that even among unauthorized reconstructions that successfully pass face detection, identity discrimination remains substantially degraded, whereas authorized state-aware recovery approaches clean-reference verification performance.
Computational imaging combines optical and sensor design with algorithms to recover or infer scene information from indirect, compressed, or noisy measurements.
Jun 28, 2026·Vishesh Kumar Tanwar, Ashish Gupta, Sanjay Madria +1Privacy-Preserving ML
Department of Computer Science, Missouri University of Science and Technology, USA · Department of Computer Science and Engineering, BITS Pilani Dubai Campus, Dubai, UAE