Modern computer vision services often require users to share raw feature
descriptors with an untrusted server. This presents an inherent privacy risk,
as raw descriptors may be used to recover the source images from which they
were extracted. To address this issue, researchers recently proposed
privatizing image features by embedding them within an affine subspace
containing the original feature as well as adversarial feature samples. In this
paper, we propose two novel inversion attacks to show that it is possible to
(approximately) recover the original image features from these embeddings,
allowing us to recover privacy-critical image content. In light of such
successes and the lack of theoretical privacy guarantees afforded by existing
visual privacy methods, we further propose the first method to privatize image
features via local differential privacy, which, unlike prior approaches,
provides a guaranteed bound for privacy leakage regardless of the strength of
the attacks. In addition, our method yields strong performance in visual
localization as a downstream task while enjoying the privacy guarantee.

现代计算机视觉服务经常要求用户与不受信任的服务器共享原始特征描述符，这带来隐私风险，为解决此问题，研究人员最近提出了通过将图像特征嵌入一个仿射子空间中从而使其包含原始特征及对抗特征样本来实现特征私有化。本文提出了两种新的反演攻击方法，证明从这些嵌入中可以（近似地）恢复原始图像特征，从而能够恢复敏感的图片内容。鉴于这样的成功和现有视觉隐私方法缺乏理论上的隐私保证，我们进一步提出了第一个通过局部差分隐私来实现图像特征私有化的方法，不同于先前的方法，该方法提供了一个隐私泄露的保证边界，无论攻击的强度如何。此外，我们的方法在视觉定位作为下游任务中表现出很强的性能，并享有隐私保证。