See the MediaEval 2020 webpage for information on how to register and participate.
High-quality images shared online can be misappropriated for promotional goals. In this task, participants work to defeat an automatic image quality classifier, which effectively hides images. The camouflaged image appears to be appealing to the human eye, but the Blind Image Quality Assessment (BIQA) classifier finds it to be low quality, i.e., there is a dramatic descrease in the image’s automatically predicted quality score.
Participants will receive a set of images (representative of images shared on social media) and are required to modify them. The modification should achieve two goals: (1) Protection: It must block the ability of a binary BIQA classifier from correctly predicting the quality of images and (2) Appeal: The changes made to the image must be as imperceptible to the human eye as possible, or the changes must contribute to enhancing the appeal of the image. Note that the task is not focused on concealing sensitive information from humans, rather from automatic inference.
This year the quality camouflage task is a “whitebox” attack. Participants’ goal is to defeat a BIQA that predicts the perceptual quality of images. The BIQA is trained on KonIQ-10k, which contains 10,073 in-the-wild images annotated with subjective quality scores.
Participants can choose to address the task in one of two different ways. In the first, the quality camouflage approach seeks to make invisible changes to the image. In the second, the approach makes visible changes to the image, but restricts itself to changes that enhance the image’s appeal, or at least do not bother someone looking at the image.
We encourage participants to release their code.
Conventionally, adversarial images are studied in the context of scenarios in which they can cause harm by misleading computer vision system. Pixel Privacy introduces the notion that adversarial images can serve another goal as well: protect privacy-sensitive information in cases in which the computer vision system itself may be a source of harm. An important example is image search engines that can find images of people who are pictured in a specific location or setting. In the past installment of the task, we have investigated how adversarial images can effectively prevent the inference of semantic information concerning the scene of an image.
Semantic information, is not, however, the only characteristic that a search engine uses in order to return a results list to a user. Another characteristic is automatically-inferred image quality. In the 2020 Pixel Privacy task we turn our attention to quality camouflage, i.e., approaches which can cause a Blind Image Quality Assessment (BIQA) to misclassify an image as low quality, when it appears to be high quality to the human eye. Quality camouflage will help to ensure that personal photos reflecting sensitive scene information, e.g., vacation photos depicting people, are less easily findable via image search engines.
We hope that this task attracts a wide range of participants who are concerned about privacy from computer scientists to artists and photographers. Within the field of computer science, people interested in machine learning, adversarial machine learning, computer graphics, privacy, and computer vision will find the task interesting.
Development data will be the KonIQ-10k data set. Test data will be selected from the validation set of the Places365, and different from previous editions, we will use high-resolution images for ensuring relatively high quality. Participants are provided with a set of correctly classified images that are also predicted to have ‘good quality’ by the BIQA model.
The protection score will be the accuracy of the BIQA prediction on modified images by participants. We specify the threshold that is to be used by BIQA. Note that we expect that accuracy to decrease after protection, but theoretically it is also possible that protection fails, and that it stays the same.
We appreciate approaches that are robust against practical post-processing operations. So the submitted images will be evaluated on their slightly JPEG compressed (quality factor = 90%) version. We have confirmed such compression has little impact on the BIQA scores.
Appeal will be evaluated by a jury of computer vision experts. Submissions will be ranked as follows: All approaches that achieve a protection score of at least 50% (50% reduction in the accuracy of the prediction) will be ranked in terms of their appeal by the jury.
Vlad Hosu, Hanhe Lin, Tamas Sziranyi and Dietmar Saupe. KonIQ-10k: An Ecologically Valid Database for Deep Learning of Blind Image Quality Assessment. In IEEE Transactions on Image Processing 29, (Jan. 2020), 4041-4056.
Samuel Dodge, and Lina Karam. Understanding How Image Quality Affects Deep Neural Networks. In Proceedings of 8th International Conference on Quality of Multimedia Experience (QoMEX ‘16). IEEE, 1-6.
Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy.Explaining and Harnessing Adversarial Examples. International Conference on Learning Representations (ICLR ‘15).
Pixel Privacy Task. 2018. Working Notes Proceedings of the MediaEval 2018 Workshop. Retrieved from http://ceur-ws.org/Vol-2283/
Nilaksh Das, Madhuri Shanbhogue, Shang-Tse Chen, Fred Hohman, Siwei Li, Li Chen, Michael E. Kounavis, and Duen Horng Chau. 2018. SHIELD: Fast, Practical Defense and Vaccination for Deep Learning using JPEG Compression. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining (KDD ’18). Association for Computing Machinery, New York, NY, USA, 196–204.
Zhengyu Zhao, Zhuoran Liu, and Martha Larson. 2020. Adversarial Color Enhancement: Generating Unrestricted Adversarial Images by Optimizing a Color Filter. In Proceedings of the 31th British Machine Vision Conference (BMVC ‘20).
Zhuoran Liu, Radboud University, Netherlands, z.liu (at) cs.ru.nl
Zhengyu Zhao, Radboud University, Netherlands
Martha Larson, Radboud University, Netherlands
Laurent Amsaleg, CNRS-IRISA, France
Workshop will be held online.