17 ms·
Sure, Facebook might delete your photo when they're done, but they probably won't delete any machine learning models that they trained using it.
by cbhl 9y ago
Sure, Facebook might delete your photo when they're done, but they probably won't delete any machine learning models that they trained using it.
- josephpmay 9y agoI'm pretty sure Facebook already has plenty of training data of faces
- eternalban 9y agoExcuse me. The issue is biometrics. "We'll delete the picture" =/= "we'll delete the control points and features extracted from your pics".
- obmelvin 9y agoIs there any precedent for recovering individual training items from a model trained on 100m+ examples?
- eternalban 9y agoWhat recovery? You're uploading your pic via your account. It is already associated with you.
- obmelvin 9y agoAs I understood it you are making the argument that they will have information about you from uploading this picture even if they delete the actual picture. I'm genuinely asking if it is possible to recover an individual training example from a model which is shown vast amounts of data. I'm only aware of being able to recover stuff like this - https://ars.els-cdn.com/content/image/1-s2.0-S0893608017302095-gr9.jpg https://ars.els-cdn.com/content/image/1-s2.0-S08936080173020... which is hardly PII
- samat 9y agoIt is not about being able to recover, rather about being able to identify your face on other photos.
- eternalban 9y agoI understood your question. What I am pointing out is that when you submit an artifact to FB, it is a trivial matter for them to store as 'extended-attributes' your facial biometrics. This has nothing to do with the ML pipeline that munches on data in the aggregate. As to whether it is possible to extract such information, per my understanding the internals of ML pipelines are rather opaque, so it would be non-trivial, if not impossible. I have no idea either way.
- Retric 9y agoThe goal is to be able to identify you, not recover an image of you. This is just as much PII as your fingerprints. Fingerprint based devices store metadata not images. I can't look at a fingerprint and connect it to a person, but a machine can. Similarly the output of a NN designed to recognize people will be useful for validation. Otherwise biometrics would not work. Remember if they are using your photo as training data the NN is going to learn you vs someone else or it's useless. If they can find you in any photo that's as effective as handing a person the uploaded photo and giving the same task.
- TaylorAlexander 9y agoI think there are two separate questions being raised. My understanding (EDIT: my understanding of the concern being raised in this discussion) was not that they would try to recover individual readings from a trained model, but that they would run a model on your face to extract features, then save an array of features that defines your face. Only those features are needed to identify your face - after data extraction the photo is no longer needed. This article talks about how those data points are extracted using a different method. https://medium.com/@ageitgey/machine-learning-is-fun-part-4-modern-face-recognition-with-deep-learning-c3cffc121d78 https://medium.com/@ageitgey/machine-learning-is-fun-part-4-...
- deleted 9y ago[deleted]
- pishpash 9y agoYes, I guess it depends on what "picture" covers legally. Is a bijectively transformed version of your picture the same "picture"? How about a degraded version? How about a 3D model of your face?
- thomas_howland 9y agoExactly. "We don't store your picture, we store an abstracted entity that allows us to recognize your picture in the future." The latter part is what people are concerned about anyway - the abstracted representation of "their face", not some particular photograph.
- pbhjpbhj 9y agoUnder the EU GDPR (eg https://www.eugdpr.org/ https://www.eugdpr.org/) it appears that they'll need explicit consent to retain the data (all of it, anything related and traceable to the person) and users will both have a right to view it and to have it deleted.
- andrewstuart2 9y agoThat only applies to Europe. The question is whether the data is valuable enough to Facebook to spend the time to add `if (europe)` to their code.
- sleepychu 9y agoOr indeed care about the law enough to bother before they're fined for doing it. After all you'll need to prove they didn't delete the data first!
- contingencies 9y agoSomeone in Europe should make a privacy complaint just to keep them on their toes.
- jacobush 9y agoYou mean to step on their toes.
- geocar 9y agoThe GDPR penalties can reach 4% global (i.e. sum all related companies) annual turnover per infraction. If anyone ever found out Facebook had a widespread violation, Facebook would be likely be dissolved.
- FridgeSeal 9y agoOh boy would I be thrilled if that happens. Nothing of value will really be lost, replacements would spring up super quickly and I'd like to think that we would have learned enough about the downsides of the current social-network systems for the next generation to avoid the pitfalls and hopefully make something much better.
- bogomipz 9y agoWhat do you mean by "control points"?
- Kenji 9y agoI think he means features like the corners of your mouth and eyes, points along the shape of your chin, etc.
- nicky0 9y agoYou are excused. Facebook has lots of photos of my face already, will one more make a difference?
- drb91 9y agoNot everyone uploads their face to facebook over and over and over again.
- Drdrdrq 9y agoOr at all.
- jacobush 9y agoDon’t worry we’ve got you covered! (Tags Dr Queer.)
- nicky0 9y agoBut most do.
- drb91 9y agoMost humans don’t even have a facebook account. Did you mean “most people in my observable social circle and subculure”? Just because many of my generation willingly give their identity away does not mean this behavior is normal or that this is an excusable form of exploitation.
- nicky0 9y agoThat is correct, currently only about one third of all humans over 13 are active users of Facebook.
- contingencies 9y ago... and the new iphone also wants to "set up FaceID", and Samsung's S8+ literally says "Face Recognition: Register your face." / "Fingerprint Scanner: Add your fingerprints." / "Iris Scanner: Register your irises".
- dabockster 9y agoFaceID is unique in the sense that it's supposed to be on-device only in the form of an ASIC coprocessor.
- contingencies 9y agoYou can't tell with closed source. Anyway, what about "iCloud backup"?
- krrrh 9y agoApple doesn’t backup TouchID or FaceID data to the cloud (just as they don’t backup your iOS device passcode). You need to set up each device independently. https://images.apple.com/ca/fr/business-docs/FaceID_Security_Guide.pdf https://images.apple.com/ca/fr/business-docs/FaceID_Security...
- deleted 9y ago[deleted]
- xenophonf 9y ago> Apple doesn’t backup TouchID or FaceID data to the cloud We only have Apple's word to go by.
- saagarjha 9y agoWell, that and the word of numerous security researchers whose job it is to make sure that Apple is true to their word.
- 9y ago
- jokoon 9y agoOddly reminds me of the scene in Ex Machina where the scientists says he just turned on all phone's camera to mine face expression data.
- jesperlang 9y agowording like this is really tricky (intentionally so!), it exploits our naive notion of digital information as files. One aspect is the machine learning you mention but basically they can also create a new "file" from your image with metadata about your image. Metadata rich enough to render the original image unnecessary. There is no way out of this relatiohship with FB, however they formulate words to comfort you, there is always a different unexpected side to what they are saying..
- halflings 9y agoThe more data they keep about these images that they are promising to delete, the more they would make themselves liable to be sued for privacy violation (especially in the EU). It is a blurred line, but one that most rational companies (=not Uber) would prefer to avoid in the first place by only storing data that is necessary for their main functionality.
- goialoq 9y agoWhat is Facebook's "main functionality"?
- andrei_says_ 9y agoMonetizing on people’s relationships and social addiction, collecting and providing detailed data on all user activities, sentiments and connections, selling sets of such data to ...?
- kfrzcode 9y agoAdvertisers. If you've ever bought an ad on facebook and see you can pick your target audience by which types of food they shop for or their income range from 10k increments alongside thousands of other filters.... fuck man they have a helluva ad platform
- halflings 9y agoNot facebook's main functionality. The feature's functionality. e.g if you are building a captcha test feature, it should not keep more data than is needed for it to function. This is the policy where I work at least, and I believe this is shared by most privacy-conscious companies (which facebook is... as far as the legal definition of privacy is concerned :)).