Massive human-related data is collected to train neural networks for computer
vision tasks. A major conflict is exposed relating to software engineers
between better developing AI systems and distancing from the sensitive training
data. To reconcile this conflict, this paper proposes an efficient
privacy-preserving learning paradigm, where images are first encrypted to
become ``human-imperceptible, machine-recognizable'' via one of the two
encryption strategies: (1) random shuffling to a set of equally-sized patches
and (2) mixing-up sub-patches of the images. Then, minimal adaptations are made
to vision transformer to enable it to learn on the encrypted images for vision
tasks, including image classification and object detection. Extensive
experiments on ImageNet and COCO show that the proposed paradigm achieves
comparable accuracy with the competitive methods. Decrypting the encrypted
images requires solving an NP-hard jigsaw puzzle or an ill-posed inverse
problem, which is empirically shown intractable to be recovered by various
attackers, including the powerful vision transformer-based attacker. We thus
show that the proposed paradigm can ensure the encrypted images have become
human-imperceptible while preserving machine-recognizable information. The code
is available at https://github.com/FushengHao/PrivacyPreservingML.

本文提出了一种有效的隐私保护学习范式，通过对图像进行加密以实现人类不可察觉机器可识别，将这一方法应用于图像分类和目标检测，在 ImageNet 和 COCO 数据集上实验结果表明，这种方法可以实现与现有方法相当的准确性且能够确保加密图像的隐私安全。

无法察觉的人类图像，可被机器识别

Human-imperceptible, Machine-recognizable Images

Facial images disclose many hidden personal traits such as age, gender, race,
health, emotion, and psychology. Understanding these traits will help to
classify the people in different attributes. In this paper, we have presented a
novel method for classifying images using a pretrained transformer model. We
apply the pretrained transformer for the binary classification of facial images
in criminal and non-criminal classes. The pretrained transformer of GPT-2 is
trained to generate text and then fine-tuned to classify facial images. During
the finetuning process with images, most of the layers of GT-2 are frozen
during backpropagation and the model is frozen pretrained transformer (FPT).
The FPT acts as a universal image classifier, and this paper shows the
application of FPT on facial images. We also use our FPT on encrypted images
for classification. Our FPT shows high accuracy on both raw facial images and
encrypted images. We hypothesize the meta-learning capacity FPT gained because
of its large size and trained on a large size with theory and experiments. The
GPT-2 trained to generate a single word token at a time, through the
autoregressive process, forced to heavy-tail distribution. Then the FPT uses
the heavy-tail property as its meta-learning capacity for classifying images.
Our work shows one way to avoid bias during the machine classification of
images.The FPT encodes worldly knowledge because of the pretraining of one
text, which it uses during the classification. The statistical error of
classification is reduced because of the added context gained from the text.Our
paper shows the ethical dimension of using encrypted data for
classification.Criminal images are sensitive to share across the boundary but
encrypted largely evades ethical concern.FPT showing good classification
accuracy on encrypted images shows promise for further research on
privacy-preserving machine learning.

本文通过使用预训练的转换器模型提出了一种面部图像的分类方法，包括包括二进制分类、使用加密图像进行分类等，并探讨了此方法对于隐私保护机器学习的启示。