3 ms·
It was a little bit shocking to me how obviously weak the image obfuscation performed is when you think about it. Randomizing the sign is the same as eradicati
by krajzeg 6y ago
It was a little bit shocking to me how obviously weak the image obfuscation performed is when you think about it.
Randomizing the sign is the same as eradicating 1 single bit out of however many were used to represent each sample. No matter how random it looks, there is no way removing 1/32 or 1/64 of the information in the image offers any actual security for something where samples are as highly correlated as in image data.
And using a non-cryptographic PRNG for security purposes... I'd really, really expect more from anybody working on privacy research.
- btown 6y agoThis is a really interesting way of putting it. Is the presence of e.g. 31/32 of the original data the only reason InstaHide can train a model at all? I haven’t read the original paper, but it seems very possible that the entire approach runs into a fundamental tradeoff.