8 ms·

Some tips to maximise user privacy while deploying this tool: 1) The code, for now, runs locally. This is good. To avoid the possibility of the code being tamp

Some tips to maximise user privacy while deploying this tool: 1) The code, for now, runs locally. This is good. To avoid the possibility of the code being tampered with at a later day (for example, it could be modified to send copies of the image to a server), download the webpage and use the saved copy, not the live copy. 2) Do not use the blur functionality. For maximum privacy, this should be removed from the app entirely. There are _a lot_ of forensic methods to reverse blur techniques. 3) Be weary of other things in the photograph that might identify someone: reflections, shadows, so on. 4) Really a subset of 2 and 3, but be aware that blocking out faces is often times not sufficient to anonymise the subject in the photo. Identifying marks like tattoos, or even something as basic as the shoes they are wearing, can be used to identify the target.

NightlyDev 6y ago
"There are _a lot_ of forensic methods to reverse blur techniques" Any examples? You can't reverse it if the data is gone.
- forgotmypw17 6y ago
  The data may still be there, it just looks like it's gone.
  - okamiueru 6y ago
    Blur is in effect a lowpass filter on the image. The high frequency information is gone. Reconstruction based on domain knowledge, like AI methods etc is unlikely to be able to reconstruct the distinguishing features between people enough to avoid false positives when used to search for similar people. Then again, maybe groups of people can be associated together, and a poor match is good enough given other clues. So, much better to be safe than sorry. I'm not sure if I had a particular good point to make, other than that blurring does remove information that cannot easily be reversed. You can probably make very convincing reconstructions, but they might not look like the original person.
    - radarsat1 6y ago
      > The high frequency information is gone diminished in power. It's only gone if it goes below the quantization threshold. Depends on the filter.
      - okamiueru 6y ago
        True. I think the reasonable assumption would be a low-pass filter that removes high frequencies altogether. A gaussian filter wouldn't be a particularly good idea.
    - pizza 6y ago
      I mean, if you have a prior probabilistic model for what a face looks like, you could combine that with standard deconvolution and get a scary good reconstruction I imagine
      - okamiueru 6y ago
        You can get a scaryly real like looking high detailed image that blurs to something really close to the original blurred image. Yet, it won't look like the original image, and won't identify the person.
    - thr0waw4y5555 6y ago
      Blur deconvolution is not exactly a new method. Easy to find examples of reconstruction from blurred images. Eg, https://www.instantfundas.com/2012/10/how-to-unblur-out-of-focus-and-blurred.html https://www.instantfundas.com/2012/10/how-to-unblur-out-of-f...
      - okamiueru 6y ago
        I don't when de-blurring would be a novel idea. I think newer methods that use machine learning can produce very good results. But the math of it is much older than any computer implementation. If you remove high frequency details, you in effect remove distinguishing features. That it is possible to create an absolutely convincing high-detail image that if blurred, gives the same "original" blurred image doesn't mean you have the correct deblurred image. With not too fancy methods, I'm pretty sure you can make a blurred image identify as any multiple people. I don't think this is a controversial statement either. In any case, this is a tangential discussion, since blurring to hide identities is a flawed method to begin with. With video recording, tracking, grouped individuals, etc, I'm sure reconstruction with good databases of likely subjects can have some surprising accuracy. So, better to avoid it altogether. That said, one image, sufficiently blurred with a proper low-pass filter (i.e not a softer gaussian type, but one that just removes frequency ranges altogether), will absolutely not contain information to identify someone. The information literally isn't there. A large number of people are an equally good match, and then no one is. But, since combined with other methods I mentioned, it's a bad idea, then, yes, it's a bad idea.
- chrisseaton 6y ago
  > You can't reverse it if the data is gone. That's the problem - the data you think is gone isn't gone. High frequencies are gone.... but you left all the low frequencies, didn't you? You can read a face from the low frequencies.
  - pbhjpbhj 6y ago
    If you blur then mosaic, or vice-versa, then presumably you get rid of the low and high frequencies? Depending on the detail shown in the original image either, or both, might remove enough information to render the image anonymised. How about replace each face with a "this is not a person" AI generated face, then blur+mosaic. Or just a non-person face using a deepfake system that matches the facial expression?
    - chrisseaton 6y ago
      Why do all these complicated things? Just draw a black box over faces.
      - tgsovlerkhgsel 6y ago
        Because the result is a lot more ugly. Don't tell people what not to do. Figure out why they're doing it, and provide what they actually want while still achieving the goals (here: security). Very coarse mosaic, add noise, then blur seems reasonably safe, and doesn't have to look like crap.
        Hello71 6y ago
        "seems reasonably safe" seems like a terrible cryptographic analysis. in fact, given that we already know that both blurring and mosaicing are individually reversible, and noise is easily removable from a sufficiently wide mosaic, this seems like a particularly terrible algorithm. that's not the point though: any man can create an encryption algorithm that he himself cannot break. maybe you can come up with an obfuscation algorithm that cannot be trivially broken, but that doesn't mean it's even remotely a good idea.
- coopsmgoops 6y ago
  The simplest being just scale the photo down and the facial details come back especially if the photo was high resolution to begin with.
- adrianmonk 6y ago
  I think people are stumbling over the word "reverse" here. A common use of "reverse" is to undo. And you're 100% right that you cannot undo the destruction of information. But instead, "reverse" is being used here to mean something like analyze or to apply countermeasures to defeat the obfuscation.
- fragmede 6y ago
  Here's a very specific example, having to do with a much smaller data-set, the OCR font used for the routing and account number on cheques. https://lifehacker.com/how-to-uncover-blurred-information-in-photographs-1648562658 https://lifehacker.com/how-to-uncover-blurred-information-in...
  - jcrawfordor 6y ago
    Very minor but interesting nitpick: the font used on checks is not OCR (optical) but MICR (magnetic ink). The design objectives are different and different font families exist for the two purposes. MICR as used on checks (more properly called E-13B) bears unusual, distinctive character shapes emphasizing abnormally wide horizontal components due to the need for each character to have a distinctive waveform when read as density from left to right, essentially by a tape recorder read head. Fonts optimized for OCR are usually more normal looking to humans because they emphasize clear detection of lines instead. E-13B is a bit of an ideal use case for this method because of the highly constrained character set used on checks and the unusually nonuniform density of E-13B. The same thing can be done on text more generally but gets significantly more difficult.
- sly010 6y ago
  https://www.youtube.com/watch?v=Vxq9yj2pVWk https://www.youtube.com/watch?v=Vxq9yj2pVWk Sorry.
- norrius 6y ago
  If you do something really simple like a Gaussian blur (which is a type of convolution), it might be possible to find the inverse convolution (de-convolution) and restore the original image with some accuracy. One method is the Lucy-Richardson deconvolution [1], which is an iterative algorithm, and here [2] is the best practical example I could find right away. Unfortunately the text is not in English, but the illustrations and formulae might be enough to give some intuition of the process. [1] https://en.wikipedia.org/wiki/Richardson%E2%80%93Lucy_deconvolution https://en.wikipedia.org/wiki/Richardson%E2%80%93Lucy_deconv... [2] https://habr.com/en/post/136853/ https://habr.com/en/post/136853/
  - buzzier 6y ago
    https://github.com/Y-Vladimir/SmartDeblur https://github.com/Y-Vladimir/SmartDeblur http://smartdeblur.net/ http://smartdeblur.net/
    - norrius 6y ago
      Yes, that's it, thank you! And here's the English version of the article I linked above: https://yuzhikov.com/articles/BlurredImagesRestoration1.htm https://yuzhikov.com/articles/BlurredImagesRestoration1.htm
  - barbegal 6y ago
    Yes this is possible before JPEG compression, because convolution removes fairly little information but once you compress using JPEG you remove the frequency components that make it reversible.
- dahart 6y ago
  The data isn’t usually gone, just spread out! Deconvolution was used to fix the Hubble Space Telescope. https://en.wikipedia.org/wiki/Hubble_Space_Telescope#Flawed_mirror https://en.wikipedia.org/wiki/Hubble_Space_Telescope#Flawed_... Even more impressive, you can see around corners with similar reconstruction techniques https://graphics.stanford.edu/papers/dual_photography/ https://graphics.stanford.edu/papers/dual_photography/ https://www.quantamagazine.org/the-new-science-of-seeing-around-corners-20180830/ https://www.quantamagazine.org/the-new-science-of-seeing-aro...
samstave 6y ago
So based n all the replies, can someone design the most resilient facemask that can never be understood by facial AIs?
- thephyber 6y ago
  https://cvdazzle.com/ https://cvdazzle.com/ But remember that facial recognition is far from the only way to identify protesters. Assume that the full power of the DHS is there (drones, Stingrays / IMSI catchers, license plate readers)
- literallycancer 6y ago
  Best bet is probably just using a normal looking facemask that is highly reflective in the spectrum the camera sees.
- herewulf 6y ago
  Once a face is captured that image data can be retained forever while the image recognition continually improves and then repeatedly reprocessed for matches. Best not to show your face at all if you don't want to be held accountable.
deleted 6y ago
[deleted]
_bxg1 6y ago
A replacement for blur could just be black boxes. Seems easy and safe enough.
- tornato7 6y ago
  Even better, replace the face with Kim-Jong Un and then blur it. When they apply those forensic techniques they'll discover that it was him all along!
- Polylactic_acid 6y ago
  Make sure they are 100% opacity. A lot of people mess this up and use 90% opacity or similar and the original image can be revealed by messing with the color levels.
  - t-writescode 6y ago
    I've doxxed my Reddit username on my Apple phone doing that exact thing. The black marker is not opaque, even after a few stripes over the username. You have to do it many more times.
    - aspenmayer 6y ago
      Easier to select an area and delete it from the layer entirely so that a transparent hole is left. Then make sure you cleanup EXIF and other metadata or you may have the original image still in a thumbnail field at reduced fidelity. Free online metadata viewer http://exif.regex.info http://exif.regex.info Powered by FOSS (Perl-based) https://exiftool.org https://exiftool.org
      - girst 6y ago
        Do not keep it transparent! The Gimp for example keeps the underlying colour data, and just sets the opacity to 0. this bug (closed as Expected Behavior) has a demonstration: https://gitlab.gnome.org/GNOME/gimp/-/issues/4487 https://gitlab.gnome.org/GNOME/gimp/-/issues/4487
derhuerst 6y ago
I opened https://github.com/everestpipkin/image-scrubber/issues/5 https://github.com/everestpipkin/image-scrubber/issues/5 to discuss how to encourage people to use this tool responsibly. Please contribute your knowledge!
- nkbrd 6y ago
  Do you really think that altered in any way images without any exif can hold someone accountable? Even videos can not be trusted nowadays.
  - CameronNemo 6y ago
    AIUI this is mainly to be used by news publications, which need to continuously build their credibility regardless, rather than as evidence in a courtroom.
  - heavyset_go 6y ago
    Yes. There is a very low bar to pass to convince a jury that a defendent is guilty. 99% conviction rates should scare you.
  - bigiain 6y ago
    We know leo uses parallel construction. Even images without chain of evidence reliability might get you on "a list"... Do you reckon cops invited to "run wild" with clearview ai _AREN'T_ gonna be running protester photos through it to see who to "profile"? https://www.buzzfeednews.com/article/ryanmac/clearview-ai-cops-run-wild-facial-recognition-lawsuits https://www.buzzfeednews.com/article/ryanmac/clearview-ai-co...
  - bigiain 6y ago
    Even being fairly familiar with deepfakes, I would very much prefer to avoid having to defend myself in court against prosecutors claiming to have "video evidence" of me murdering someone...
deleted 6y ago
[deleted]

NightlyDev 6y ago

"There are _a lot_ of forensic methods to reverse blur techniques" Any examples? You can't reverse it if the data is gone.

forgotmypw17 6y ago
The data may still be there, it just looks like it's gone.
- okamiueru 6y ago
  Blur is in effect a lowpass filter on the image. The high frequency information is gone. Reconstruction based on domain knowledge, like AI methods etc is unlikely to be able to reconstruct the distinguishing features between people enough to avoid false positives when used to search for similar people. Then again, maybe groups of people can be associated together, and a poor match is good enough given other clues. So, much better to be safe than sorry. I'm not sure if I had a particular good point to make, other than that blurring does remove information that cannot easily be reversed. You can probably make very convincing reconstructions, but they might not look like the original person.
  - radarsat1 6y ago
    > The high frequency information is gone diminished in power. It's only gone if it goes below the quantization threshold. Depends on the filter.
    - okamiueru 6y ago
      True. I think the reasonable assumption would be a low-pass filter that removes high frequencies altogether. A gaussian filter wouldn't be a particularly good idea.
  - pizza 6y ago
    I mean, if you have a prior probabilistic model for what a face looks like, you could combine that with standard deconvolution and get a scary good reconstruction I imagine
    - okamiueru 6y ago
      You can get a scaryly real like looking high detailed image that blurs to something really close to the original blurred image. Yet, it won't look like the original image, and won't identify the person.
  - thr0waw4y5555 6y ago
    Blur deconvolution is not exactly a new method. Easy to find examples of reconstruction from blurred images. Eg, https://www.instantfundas.com/2012/10/how-to-unblur-out-of-focus-and-blurred.html https://www.instantfundas.com/2012/10/how-to-unblur-out-of-f...
    - okamiueru 6y ago
      I don't when de-blurring would be a novel idea. I think newer methods that use machine learning can produce very good results. But the math of it is much older than any computer implementation. If you remove high frequency details, you in effect remove distinguishing features. That it is possible to create an absolutely convincing high-detail image that if blurred, gives the same "original" blurred image doesn't mean you have the correct deblurred image. With not too fancy methods, I'm pretty sure you can make a blurred image identify as any multiple people. I don't think this is a controversial statement either. In any case, this is a tangential discussion, since blurring to hide identities is a flawed method to begin with. With video recording, tracking, grouped individuals, etc, I'm sure reconstruction with good databases of likely subjects can have some surprising accuracy. So, better to avoid it altogether. That said, one image, sufficiently blurred with a proper low-pass filter (i.e not a softer gaussian type, but one that just removes frequency ranges altogether), will absolutely not contain information to identify someone. The information literally isn't there. A large number of people are an equally good match, and then no one is. But, since combined with other methods I mentioned, it's a bad idea, then, yes, it's a bad idea.
chrisseaton 6y ago
> You can't reverse it if the data is gone. That's the problem - the data you think is gone isn't gone. High frequencies are gone.... but you left all the low frequencies, didn't you? You can read a face from the low frequencies.
- pbhjpbhj 6y ago
  If you blur then mosaic, or vice-versa, then presumably you get rid of the low and high frequencies? Depending on the detail shown in the original image either, or both, might remove enough information to render the image anonymised. How about replace each face with a "this is not a person" AI generated face, then blur+mosaic. Or just a non-person face using a deepfake system that matches the facial expression?
  - chrisseaton 6y ago
    Why do all these complicated things? Just draw a black box over faces.
    - tgsovlerkhgsel 6y ago
      Because the result is a lot more ugly. Don't tell people what not to do. Figure out why they're doing it, and provide what they actually want while still achieving the goals (here: security). Very coarse mosaic, add noise, then blur seems reasonably safe, and doesn't have to look like crap.
      - Hello71 6y ago
        "seems reasonably safe" seems like a terrible cryptographic analysis. in fact, given that we already know that both blurring and mosaicing are individually reversible, and noise is easily removable from a sufficiently wide mosaic, this seems like a particularly terrible algorithm. that's not the point though: any man can create an encryption algorithm that he himself cannot break. maybe you can come up with an obfuscation algorithm that cannot be trivially broken, but that doesn't mean it's even remotely a good idea.
coopsmgoops 6y ago
The simplest being just scale the photo down and the facial details come back especially if the photo was high resolution to begin with.
adrianmonk 6y ago
I think people are stumbling over the word "reverse" here. A common use of "reverse" is to undo. And you're 100% right that you cannot undo the destruction of information. But instead, "reverse" is being used here to mean something like analyze or to apply countermeasures to defeat the obfuscation.
fragmede 6y ago
Here's a very specific example, having to do with a much smaller data-set, the OCR font used for the routing and account number on cheques. https://lifehacker.com/how-to-uncover-blurred-information-in-photographs-1648562658 https://lifehacker.com/how-to-uncover-blurred-information-in...
- jcrawfordor 6y ago
  Very minor but interesting nitpick: the font used on checks is not OCR (optical) but MICR (magnetic ink). The design objectives are different and different font families exist for the two purposes. MICR as used on checks (more properly called E-13B) bears unusual, distinctive character shapes emphasizing abnormally wide horizontal components due to the need for each character to have a distinctive waveform when read as density from left to right, essentially by a tape recorder read head. Fonts optimized for OCR are usually more normal looking to humans because they emphasize clear detection of lines instead. E-13B is a bit of an ideal use case for this method because of the highly constrained character set used on checks and the unusually nonuniform density of E-13B. The same thing can be done on text more generally but gets significantly more difficult.
sly010 6y ago
https://www.youtube.com/watch?v=Vxq9yj2pVWk https://www.youtube.com/watch?v=Vxq9yj2pVWk Sorry.
norrius 6y ago
If you do something really simple like a Gaussian blur (which is a type of convolution), it might be possible to find the inverse convolution (de-convolution) and restore the original image with some accuracy. One method is the Lucy-Richardson deconvolution [1], which is an iterative algorithm, and here [2] is the best practical example I could find right away. Unfortunately the text is not in English, but the illustrations and formulae might be enough to give some intuition of the process. [1] https://en.wikipedia.org/wiki/Richardson%E2%80%93Lucy_deconvolution https://en.wikipedia.org/wiki/Richardson%E2%80%93Lucy_deconv... [2] https://habr.com/en/post/136853/ https://habr.com/en/post/136853/
- buzzier 6y ago
  https://github.com/Y-Vladimir/SmartDeblur https://github.com/Y-Vladimir/SmartDeblur http://smartdeblur.net/ http://smartdeblur.net/
  - norrius 6y ago
    Yes, that's it, thank you! And here's the English version of the article I linked above: https://yuzhikov.com/articles/BlurredImagesRestoration1.htm https://yuzhikov.com/articles/BlurredImagesRestoration1.htm
- barbegal 6y ago
  Yes this is possible before JPEG compression, because convolution removes fairly little information but once you compress using JPEG you remove the frequency components that make it reversible.
dahart 6y ago
The data isn’t usually gone, just spread out! Deconvolution was used to fix the Hubble Space Telescope. https://en.wikipedia.org/wiki/Hubble_Space_Telescope#Flawed_mirror https://en.wikipedia.org/wiki/Hubble_Space_Telescope#Flawed_... Even more impressive, you can see around corners with similar reconstruction techniques https://graphics.stanford.edu/papers/dual_photography/ https://graphics.stanford.edu/papers/dual_photography/ https://www.quantamagazine.org/the-new-science-of-seeing-around-corners-20180830/ https://www.quantamagazine.org/the-new-science-of-seeing-aro...

samstave 6y ago

So based n all the replies, can someone design the most resilient facemask that can never be understood by facial AIs?

thephyber 6y ago
https://cvdazzle.com/ https://cvdazzle.com/ But remember that facial recognition is far from the only way to identify protesters. Assume that the full power of the DHS is there (drones, Stingrays / IMSI catchers, license plate readers)
literallycancer 6y ago
Best bet is probably just using a normal looking facemask that is highly reflective in the spectrum the camera sees.
herewulf 6y ago
Once a face is captured that image data can be retained forever while the image recognition continually improves and then repeatedly reprocessed for matches. Best not to show your face at all if you don't want to be held accountable.

deleted 6y ago

[deleted]

_bxg1 6y ago

A replacement for blur could just be black boxes. Seems easy and safe enough.

tornato7 6y ago
Even better, replace the face with Kim-Jong Un and then blur it. When they apply those forensic techniques they'll discover that it was him all along!
Polylactic_acid 6y ago
Make sure they are 100% opacity. A lot of people mess this up and use 90% opacity or similar and the original image can be revealed by messing with the color levels.
- t-writescode 6y ago
  I've doxxed my Reddit username on my Apple phone doing that exact thing. The black marker is not opaque, even after a few stripes over the username. You have to do it many more times.
  - aspenmayer 6y ago
    Easier to select an area and delete it from the layer entirely so that a transparent hole is left. Then make sure you cleanup EXIF and other metadata or you may have the original image still in a thumbnail field at reduced fidelity. Free online metadata viewer http://exif.regex.info http://exif.regex.info Powered by FOSS (Perl-based) https://exiftool.org https://exiftool.org
    - girst 6y ago
      Do not keep it transparent! The Gimp for example keeps the underlying colour data, and just sets the opacity to 0. this bug (closed as Expected Behavior) has a demonstration: https://gitlab.gnome.org/GNOME/gimp/-/issues/4487 https://gitlab.gnome.org/GNOME/gimp/-/issues/4487

derhuerst 6y ago

I opened https://github.com/everestpipkin/image-scrubber/issues/5 https://github.com/everestpipkin/image-scrubber/issues/5 to discuss how to encourage people to use this tool responsibly. Please contribute your knowledge!

nkbrd 6y ago
Do you really think that altered in any way images without any exif can hold someone accountable? Even videos can not be trusted nowadays.
- CameronNemo 6y ago
  AIUI this is mainly to be used by news publications, which need to continuously build their credibility regardless, rather than as evidence in a courtroom.
- heavyset_go 6y ago
  Yes. There is a very low bar to pass to convince a jury that a defendent is guilty. 99% conviction rates should scare you.
- bigiain 6y ago
  We know leo uses parallel construction. Even images without chain of evidence reliability might get you on "a list"... Do you reckon cops invited to "run wild" with clearview ai _AREN'T_ gonna be running protester photos through it to see who to "profile"? https://www.buzzfeednews.com/article/ryanmac/clearview-ai-cops-run-wild-facial-recognition-lawsuits https://www.buzzfeednews.com/article/ryanmac/clearview-ai-co...
- bigiain 6y ago
  Even being fairly familiar with deepfakes, I would very much prefer to avoid having to defend myself in court against prosecutors claiming to have "video evidence" of me murdering someone...

deleted 6y ago

[deleted]