Research

Our method

Baseline

Abstract

Cloud robotics allows low-power robots to perform computationally intensive inference tasks by offloading them to the cloud, raising privacy concerns when transmitting sensitive images. Although end-to-end encryption secures data in transit, it doesn’t prevent misuse by inquisitive third-party services since data must be decrypted for processing. This paper tackles these privacy issues in cloud-based object detection tasks for service robots. We propose a co-trained encoder-decoder architecture that retains only task-specific features while obfuscating sensitive information, utilizing a novel weak loss mechanism with proposal selection for privacy preservation. A theoretical analysis of the problem is provided, along with an evaluation of the trade-off between detection accuracy and privacy preservation through extensive experiments on public datasets and a real robot.

Scenario

We consider a cloud robotic architecture in which a service robot leverages a third-party inference service for object detection. The robot performs queries to the remote neural network (called TaskNet) sending its visual perceptions that are remotely processed to detect objects. In such a context, data protection is a major issue as privacy-sensitive data, that need to be decrypted for inference, could be used for malicious purposes by a potentially curious cloud provider. To solve this, we propose to add an encoder-decoder obfuscator to remove sensitive information while maintaining the necessary features to perform object detection from remote. We test our approach by implementing an attacker which aims to reconstruct the original input after obfuscation.

Method

In the paper we theoretically and empirically prove that detection and privacy are competing tasks. Training the encoder-decoder with a large bottleneck ensures good detection but low privacy, because the proposal-based object detector forces the encoder-decoder to reconstruct the original input to produce the same activation over the thousand proposals optimized in the loss function. Compressing the bottleneck enhances privacy but degrades the task performance. To address this, we propose a co-training scheme to obtain both detection and privacy: it trains the encoder-decoder with a “weakened” task loss calculated using a very limited but meaningful subset of proposals. This forces the encoder-decoder (even with a large bottleneck) to extract from the input only the essential features to activate a small but targeted subset of TaskNet proposals, while discarding those features exploitable by potential attackers for reconstructing the original input from its obfuscated version. For each ground truth, our algorithm divides the proposals into positives and negatives, and selects a fixed number of each to drive the TaskNet loss.

Experiments

We conduct an extensive experimental campaign using publicly available datasets for object detection. We train the TaskNet (a Faster R-CNN) and the encoder-decoder obfuscator using COCO, then test on COCO and Pascal VOC to show effectiveness also in out-of-distribution settings. We consider people and vehicle detection, two scenarios with strong privacy-preservation requirements, and additionally test with data from our real GIRAFF-X robot navigating in our laboratory.