Self-supervised Privacy-preservation via Latent Anonymization for Generalizable Video Understanding

1. The motivation is unclear and confusing. As depicted in Fig. 1 (a), previous methods suffer from privacy leakage in the utility video model. And in Fig. 1(c), the proposed method also encode the images with visible privacy information using utility video model. Therefore, the proposed method also suffer from the privacy leakage. If the privacy protection is operated in the latent space, the visible privacy information in images cannot be protected, which contradicts the statements in lines 47-49.

2. Limited technical contribution. The proposed Anonymizing Adapter Module is not novel without any insight. The overall architecture is to learn a adapter upon a video model so that the features cannot be directly classified by some attribute classifiers.

3. The comparison results in Table 1 is not sufficient since only two methods are compared.

4. The presentation can be improved. For example, the purpose of the Budget Privacy Objective has not been clearly explained.

1. In previous works, they assumed that video models were managed by public operators or APIs, so they focused on anonymizing the data before inputting it into the video model (encoder). In this paper, however, the authors propose anonymization after the video encoder, which, in my view, means privacy is already exposed when sent to the encoder. This limitation affects the practical applicability of the paper. Could the authors discuss scenarios where latent space anonymization would be preferable or more practical than input-level anonymization, given that the raw data is exposed to the encoder?

2. It appears that this model is trained on multiple tasks and then tested on the same set of tasks, which, in my opinion, is not truly generalized learning but rather multi-task learning. This approach doesn’t seem particularly meaningful since prior methods could also handle multiple tasks—they simply didn’t conduct related experiments. A more valuable approach would be to train on a set of tasks and then generalize to previously unseen tasks.

3. The experimental section misses a comparison with work [1]. Could the authors include a comparison with [1] in their experiments? Overall, I am quite positive about this work; however, these above concerns are important to me. If the authors address them, I would be happy to raise my score.

[1] Joint Attribute and Model Generalization Learning for Privacy-Preserving Action Recognition. NeurIPS 2023.

Limited Novelty: The method lacks uniqueness since it relies on common techniques and uses a framework that primarily combines existing loss functions.

Budget Privacy Objective: There is insufficient explanation about how the Budget Privacy Objective facilitates data anonymization and privacy optimization, and the role of /theta in Equation 6 needs a clearer theoretical analysis.

Inadequate Experimental Analysis: The paper's experimental comparisons with advanced privacy-preserving methods are limited. The analysis could be improved by incorporating more experiments to strengthen the argument, especially in relation to works like STPrivacy and Privacy-Preserving Action Recognition via Motion Difference Quantization.

1. The definition of privacy is not clear. Also, the privacy evaluation metrics are very unclear. Previous work has extensive discussions on the privacy attributes in videos, which is lacking in this paper.
2. A large part of the related work is under the topic of face de-identification (in videos), which is also not discussed.
3. The generalization relies heavily on the utility loss defined in Eq. (5). However, it has a constraint on the specific tasks. What if the tasks are different, or there are more tasks?