Gaussian Differentially Private Human Faces Under a Face Radial Curve Representation

We thank the reviewer for their summary of our paper.

Weakness (1) We see the importance of the problems of expression analysis, age estimation, and other related problems in facial recognition, however the emphasis and main goal of this paper is the privacy of the faces, as the reviewer stated. We will expand on the discussion about the applicability of our GDP FDA framework in general settings and add citations on these independent FDA interests. This will emphasize the usability of one of our contributions for privacy in a larger context.

Weakness (2) We include most of the response to this in our response is in Weakness(1). We agree that adding another example of disk parameterized surfaces would strengthen the paper; in terms of privacy, human faces seemed like the most relevant example. While one could use this for any disk parameterized surfaces, our face data exists on many datasets and this method being applicable in those settings seem quite pertinent. We will further expand on this but also believe adding a more classical FDA example will strengthen the applicability.

In response to weaknesses (2) and (5): We are familiar with the mentioned citations and both were cited in our paper. Our representation, while similar, is not entirely the same. The cited works generate the curve/function representation on each face independently. We, however, use the SRNF framework to register all curves/functions across all faces simultaneously. The cited work, for instance, will generate the ith curve of a face as all points distance $r$ from the tip of the nose. This restriction is limiting as features such as eyes are not the same distance from the tip of the nose among all individuals. We have no such restriction. Our use of the SRNF framework forces a registration among all faces and this distinction is the difference and strength in our representation.

In response to weakness (3): We see both mentioned items as contributions. (a) The extension of GDP to FDA is novel; this contribution can be further explored and we will add an example of DP FDA comparisons with classical FDA examples such as the Berkeley growth data. (b) Differential privacy for 3D faces is novel; we agree that ``privacy" for 3D faces has been considered but not differential privacy. (c) the representation we propose is novel, albeit incremental in comparison to the previous cited works. In conjunction these three contributions answer a larger question of privacy for human 3D faces.

In response to weakness (4): We speak of FDA in general terms as our contribution in GDP FDA is not limited to faces. Our GDP FDA method can be applied to any set of functions. Each face is represented as a set of functions $\{f_i\}$ with each $f_i:\mathbb{S}^1\rightarrow \mathbb{R}^3$, that is each function is parameterized by the unit disk.

We thank the reviewer for their suggestions but note that we have addressed many of these weakness in the original submission. We will however add further discussion on these topics and an example of GDP FDA for functions outside of the scope of privacy for faces upon a resubmission.

We thank the reviewer for the thorough summary.

In regards to weakness (1), Diagrams aren't typical in the differential privacy literature. Guiding sentences and a diagram are small, reasonable asks, so we will add these upon a resubmission.

Weakness (2): We will expand on this discussion. We envisioned settings such as anthropologic studies where the data is collected in a uniform, controlled environment such as in the cited Sero et al. paper. However, we agree it is not always the case of having perfect data.

In the case of non perfect data we have two cases (a) Noisy data: this would only pose an issue in the processing step as triangulated meshes are generally not robust to noise. Although we did not explore this avenue, MeshLab does offer smoothing which would circumvent this issue. Further, our GDP functional mechanism incorporates smoothing, so noisy parameterized faces should pose no issue. (b) Missing and incomplete data: this is a case which our method cannot immediately handle. We will expand on the discussion and mention how facial recognition handle the problem of missing data such as in Dagli et al. (2011). This would however only add another pre processing step to our method. Generally these missing data problems for faces use another dataset (or the clean data) to infer the missing components or perhaps a template face. This problem is indeed interesting but also not entirely in the scope of our method. Partial matching of curves for shape analysis has been explored for instance in Bryner & Srivastava (2021) as well as for face surfaces as in Perakis et al. (2009) which can be interesting avenues for future works. We thank the reviewer for mentioning this weakness however emphasize data imputation in the case of missing data for faces is an important topic which can be handled independently as it is not necessarily an easy task. We will expand on these points in our discussion and mention our data is very clean compared to some real world scenarios.

Weakness (3) Part of this response is contained in our response to Weakness (2). We do suggest our method can be applied to terrain data and any disk parameterized surfaces, in terms of privacy though faces seem to be the most relevant. In our paper we focused on privacy for sets of functions which constituted faces but our GDP FDA contribution is general to any set of functions. We will expand on the discussion about the applicability of our GDP FDA framework in general settings and add citations on these independent FDA interests.

Weakness (4) We do mention some computational times in the Supplemental material section ``Experiments Compute Resources." We did not investigate the computational time of the shape analysis pre processing as much of it was explored in Jermyn et al. (2017). Computing the mean and sanitizing it using our method requires a relatively trivial amount of time (less than 3 minutes on a desktop).

We will add more details on the benchmark method but also note that previous to this paper there have been no other works in the differential privacy setting for 3D faces. In short, the we add noise to the point-wise mean by adding noise to each coordinate of each point. For comparison to our method, we take the budget from the GDP FDA method and split it evenly across all points to have the same total budget. We will add a table for the computational cost for all the processing and the benchmark method.

The reviewer has pointed out weaknesses for the paper which we believe are important issues which will be discussed upon a resubmission. Some issues however are whole research areas in and of themselves; these issues of course should and will be mentioned.