# Differentially Private Cross-camera Person Re-identification

Lucas Maris1, Yuki Matsuda12, Keiichi Yasumoto12  1 Nara Institute of Science
and Technology, Nara, Japan  2 RIKEN Center for Advanced Intelligence Project
AIP, Tokyo, Japan
Email: {lucas.maris.lo3, yukimat<EMAIL_ADDRESS>
###### Abstract

Camera-based person re-identification is a heavily privacy-invading task by
design, benefiting from rich visual data to match together person
representations across different cameras. This high-dimensional data can then
easily be used for other, perhaps less desirable, applications. We here
investigate the possibility of protecting such image data against uses outside
of the intended re-identification task, and introduce a differential privacy
mechanism leveraging both pixelisation and colour quantisation for this
purpose. We show its ability to distort images in such a way that adverse task
performances are significantly reduced, while retaining high re-identification
performances.

###### Index Terms:

differential privacy, person re-identification

##  I Introduction

Cities keep growing, creating logistic challenges in terms of traffic
management, city planning, and tourism. In parallel, the interest in smart
cities, i.e., cities that use information and communication technologies to
transform the city and its governance, and achieve a positive impact on the
community inhabiting it [1], is peaking, with both large and small-scale
projects being developed around the globe.

Japan, for instance, sees its population decrease and its demography evolve,
with a decrease of the relative working-age population and a general movement
toward metropolitan areas [2]. These changes and the resulting shift in
citizen expectations make it highly valuable to dispose of comprehensive data
regarding human flows within the city. This data can then be exploited by,
e.g., policymakers for urban planning decisions [3], transport or tourism
companies for commercial ends [4], or individuals for route planning purposes
[5].

One of the most commonly available sensors in cities is a video camera. Often
installed primarily as a means of passive surveillance, with the aim of
disposing of a record of events for understanding past incidents, their feeds
have the potential to be leveraged for real-time traffic or crowd monitoring.

In this context, cross-camera person re-identification has been extensively
studied over the past decade, as the computer vision task of matching
individuals from different camera perspectives. Notwithstanding promising
applications in security, planning, or tourism areas, little concern has been
paid to the glaring privacy concerns this raises, and thus the social
acceptance of such systems. This study aims to build a privacy-aware cross-
camera re-identification system.

By empirically comparing the effect of different types and magnitudes of
noise, including both traditional image obfuscation methods and a new
differential privacy method, on the inputs to a state-of-the-art re-
identification model, we evaluate the feasibility of conducting the
paradoxical task of re-identifying people without effectively invading their
privacy. We illustrate this goal by means of an additional empirical
evaluation of the ability to predict demographic attributes, such as gender,
age, or ethnicity, from these very same noised inputs.

The purpose is to distort visual data in such a way that it remains maximally
useful for the specific intent of video camera controllers, here chosen to be
cross-camera re-identification, while making it minimally useful for other
purposes, here defined as common demographic classification tasks. The ability
to control the privacy leakage of re-identification systems is key to their
social acceptance, which requires building trustful relationships with
citizens, customers, or individuals at large.

Our contributions are as follows: (1) we formulate a strict image differential
privacy mechanism leveraging both pixelisation and colour quantisation; (2) we
highlight the robustness of centroid-based re-identification models against
noise; and (3) we show that the use of our image differential privacy
mechanism allows for nearly state-of-the-art re-identification performances
while significantly reducing the utility of images for adverse tasks.

##  II Related Work

###  II-A Person re-identification (reID)

The recognition of individuals across different visual snapshots from
different points of view has become a traditional computer vision task over
the last 20 years [6]. While still a matter of designing informative
appearance signatures for individuals [7, 8], the advent of deep convolutional
neural networks [9] has shifted this problem to yet another learning problem
[10].

Notwithstanding its many variations, the task is essentially defined as the
retrieval of all occurrences of a given individual within a set of videos,
often captured from different angles, with only a single snapshot of that
individual to work from. This is usually formalised as an image-retrieval
task, where the aim is to train a model on a training set such that it can
rank images from the gallery set in order of their similarity to a given image
from the query set.

As the input data is usually a set of videos, this reID definition glances
over the object detection, tracking and segmentation aspects to focus more
heavily on how to transform images into effective vector representations and
on how to score such representations against one another. Recent state-of-the-
art reID systems achieve maximum performances on traditional reID datasets
such as Market1501 [11] or MSMT17 [12] by answering these questions with CNN
feature extractors [13] and triplet loss [14], combined with various other
techniques, e.g., the use of spatial-temporal data [15], large-scale pre-
training [16] or attention mechanisms [17].

###  II-B Differential privacy (DP)

Over the last decade, differential privacy [18] has become the single most
popular way of modelling formal data privacy, due to its ability to provide
quantifiable protection against arbitrary risks. By perturbing computations
over statistical databases, it promises indistinguishability between databases
and plausible deniability to every individual composing such databases,
providing them with roughly the same privacy that would result from having
their data removed from the database.

Recent work regarding differential privacy has aimed at extending its
desirable properties to other forms of data, e.g., location [19] or deep
neural network models [20]. With unstructured data making up most of today’s
data landscape, a line of work regarding image differential privacy has also
emerged, with studies leveraging pixelization [21], autoencoders [22] or
generative adversarial networks [23]. As noted in a recent survey regarding
differential privacy for unstructured data [24], the common approach is to
vectorize unstructured data into a structured form, which can then be
obfuscated with conventional DP methods.

##  III Method

In this paper, we consider the inherent privacy threat that originates from
storing image-representations of individuals for tracking across multiple
video feeds. We expect this to be useful for applications where the aim is to
collect itinerary data from pedestrians in such a way that the specifics of
every individual are protected; for instance, one may wish to know the
percentage of people that visit point B shortly after point A, without needing
to know whether this percentage includes a specific individual that could be
recognised from their visual representation.

In other words, we consider the threat of an attacker gaining access to a
collection of images from individuals, which were collected for the purpose of
re-identification. To lessen the gravity of such a breach, we aim to distort
collected images such that they remain maximally useful for the cross-camera
reID task but minimally useful for other tasks. The adverse tasks we focus on
in this study include gender, age, and ethnicity identification.

###  III-A DP-obfuscation

To provide a quantifiable privacy guarantee on the gallery images, we extend
the pixel-level differential privacy definition first introduced as DP-Pix
[21]. As it provides privacy directly on pixel values, it has since been
deemed too strict of a definition, destroying too much of the data’s utility
in the privacy process [22, 23, 24]. This being precisely our goal here, we
further restrict its definition; instead of providing indistinguishability
between same-sized images differing by at most $m$ pixels, we here aim for
indistinguishability between same-sized images differing in _any_ amount of
pixels.

Definition 1. _$\varepsilon$ -Image DP_: a randomized mechanism $\mathcal{M}$
gives $\varepsilon$-image differential privacy if for any two images $i$ and
$j$ of same dimension, and for any possible output
$R\subseteq\text{Range}(\mathcal{M})$,

$\text{Pr}[\mathcal{M}(i)\in R]\leq\text{exp}(\varepsilon)\
\text{Pr}[\mathcal{M}(j)\in R]$ (1)

As shown in [18], the Laplace mechanism can achieve such a guarantee, provided
$\mathcal{M}$ is defined as the noisy function:

$\mathcal{M}(x)=f(x)+n\newline \text{, where }n\sim
Laplace\left(0,\frac{\Delta f}{\varepsilon}\right)$ (2)

The exact amount of noise $n$ is to be calibrated to the sensitivity $\Delta
f$ of function $f$. We generalise and extend the DP-Pix definition of this
function $f$; instead of defining $f$ as the pixelisation of grayscale image
$x$, we define $f$ as the identity function applied to RGB image $x$, with
optional pixelisation and colour quantisation parameters $b$ and $c$. The
sensitivity of this function is then:

$\Delta f=\frac{wh}{b^{2}}\left(\frac{256}{c}-1\right)^{3}$ (3)

Where $w$ and $h$ are the width and height of images, $b$ defines the amount
of pixelisation to be applied to images, and $c$ characterises the amount of
colours to be kept in images. These additional dimensionality reduction
parameters are introduced to reduce the magnitude of the sensitivity,
increased by our broader neighborhood definition. If $b=1$ and $c=1$, the
sensitivity is equivalent to that of the identity function.

This privacy mechanism is to be applied directly on stored images, prior to
their use for re-identification. By protecting the image data upfront with a
quantifiable privacy guarantee, their sensitivity can be mitigated. Even in
the event of a data leak, the utility of training, query, and gallery samples
is expected to be decreased for other applications.

###  III-B Centroid-reID

Despite the higher noise-level introduced by our strict pixel-level
differential privacy definition, we wish to be able to link obfuscated image
representations with their corresponding identity. One recently introduced
method to improve on re-identification and image-retrieval tasks at large is
to average training samples into mean centroid representations, i.e.,
aggregated class representations. By shifting the task from ranking specific
identity-instances to classifying into actual identities, which arguably also
makes more sense in practical applications, state-of-the-art re-identification
performances can be achieved on classic reID datasets [25].

The training of a centroid-based re-identification model relies on the
Centroid Triplet Loss function, which is formulated below. It aims to minimise
the distance between embedding $f(A)$ of a training sample $A$ and the class
centroid $c_{P}$ for the class that sample belongs to, while maximising the
distance between said embedding $f(A)$ and class centroid $c_{N}$ for a class
the sample does not belong to.

$\mathcal{L}_{CTL}=\left[||f(A)-c_{P}||^{2}_{2}-||f(A)-c_{N}||^{2}_{2}+\alpha_{c}\right]_{+}$
(4)

Class centroids $c_{k}$ are simply defined as the mean embedding of all
samples available at a given point; during training, these are the items of
same class as the currently considered sample within a mini-batch; during
testing, these are all gallery samples for a given class. If we denote the
available class samples as $\mathcal{S}_{k}$, the class centroid $c_{k}$ is:

$c_{k}=\frac{1}{|\mathcal{S}_{k}|}\sum_{x_{i}\in S_{k}}f(x_{i})$ (5)

We here postulate that by using averaged individual representations, the re-
identification system can be made more robust against introduced noise. We
expect such aggregated representations to be able to magnify the identity-
specific latent features that remain underneath the noise. To this end, we
train centroid-based models directly onto noised training images, and test
them with noised sets of gallery and query samples.

###  III-C Adverse tasks

To evaluate the privacy protection offered by our system beyond the
theoretical privacy budget $\varepsilon$, we additionally consider adverse
tasks in the form of demographic attribute classification, specifically
gender, age range, and ethnic group. As such tasks are both common and
feasible with very limited inputs, we believe them a good way to evaluate the
practical privacy protection offered by our mechanism.

Attribute classification is implemented as a simple fully connected layer on
top of a ResNet50v2 [13] backbone, itself pretrained on ImageNet [26].

##  IV Results

In this section, we use an $\varepsilon$-Image DP-protected dataset for both
our target task, person re-identification, and adversary tasks, here chosen to
be gender, age, and ethnicity classification. We show how little our target
task suffers from the privacy protection applied to the dataset, while the
performance of adversary tasks drops more drastically.

We evaluate both the reID and gender classification performances after
obfuscation on Market1501 [11], a common reID dataset, whose balanced
attribute labels are unfortunately limited to unbalanced gender annotations
[27]. To further evaluate the degree of obfuscation provided by our method, we
additionally evaluate the performance of gender, age, and ethnicity
classification models after applying the same obfuscation to FairFace [28], a
recent face image dataset that provides balanced gender, age, and ethnicity
annotations.

###  IV-A ReID

To properly get a feel for the effect of pixelisation and quantisation
parameters $b$ and $c$, we consider 3 parameter combinations; $b=1$ and
$c=64$, $b=2$ and $c=32$, and $b=4$ and $c=16$, which yield sensitivity values
$\Delta f$ of similar magnitude. Noise levels $\varepsilon$ were made to vary
between $10^{-3}$ and $10^{6}$. Fig. 1 shows the performance of both a regular
and a centroid-based reID model on data noised with the first set of
parameters. Table I and Table II summarise the results for the second and
third sets of parameters, as these yield visually similar graphs.

Figure 1: Market1501 reID results, with b=1, c=64, $\Delta f$=221184. TABLE I: Market1501 reID results, with b=2, c=32, $\Delta f$=702464 | Regular | Centroid-based
---|---|---
Noise $\varepsilon$ | mAP% | Top-1% | mAP% | Top-1%
$10^{-3}$ | 19.7% | 39.0% | 81.6% | 78.6%
$1$ | 19.4% | 38.2% | 81.0% | 77.6%
$10^{3}$ | 19.7% | 38.4% | 81.6% | 78.4%
$10^{6}$ | 43.9% | 68.2% | 94.3% | 93.2%
none | 76.8% | 90.7% | 98.1% | 97.7%
TABLE II: Market1501 reID results, with b=4, c=16, $\Delta f$=1728000 | Regular | Centroid-based
---|---|---
Noise $\varepsilon$ | mAP% | Top-1% | mAP% | Top-1%
$10^{-3}$ | 5.0% | 11.1% | 41.5% | 34.8%
$1$ | 4.1% | 8.9% | 35.7% | 29.2%
$10^{3}$ | 4.0% | 8.7% | 35.1% | 28.7%
$10^{6}$ | 11.7% | 24.8% | 67.6% | 62.2%
none | 66.1% | 83.9% | 97.0% | 96.4%

It is striking from our experiments that centroid-based reID models offer high
robustness to noise. While non-centroid-based models suffer, on average, a
43.4%, a 74.5%, and a 93.6% mAP decrease, for each of our parameter
combinations in ascending $b$ order, centroid-based models only suffer an
average 4.2%, 17.0% and 62.4% mAP decrease, respectively. These averages are
computed on mAP metrics obtained with $\varepsilon$ varying between $10^{-3}$
and $10^{3}$. As Fig. 1 illustrates, this robustness allows to conserve a mean
mAP of 93.6% even at noise levels $\varepsilon\leq 10^{3}$.

It is also quite apparent from experiments that there exists a hard limit on
the effect of pixel-based noising, with $\varepsilon$ values lower than
$10^{3}$ yielding more or less the same results as those observed at the
$\varepsilon=10^{3}$ level. Considering the fact that our sensitivities
$\Delta f$ are themselves of the order of $10^{5}$ or $10^{6}$, which
naturally increases the relative scale of $\varepsilon$ values, and that
differentially private noise is meant to be scaled to these values, this is in
line with the “All Small Epsilons Are Alike” observation by Dwork et al. [18].

###  IV-B Attribute classification

####  IV-B1 Market1501

Using the same noised Market1501 images to perform gender classification
yields the results summarised in Table III.

TABLE III: Market1501 gender classification accuracy Noise $\varepsilon$ | Accuracy%
---|---
b=1, c=64 | b=2, c=32 | b=4, c=16
$\mathit{10^{-3}}$ | 65.9% | 63.5% | 61.6%
$\mathit{1}$ | 65.9% | 63.4% | 61.8%
$\mathit{10^{3}}$ | 65.8% | 64.0% | 61.4%
$\mathit{10^{6}}$ | 73.1% | 65.5% | 62.9%
none | 77.2% | 78.3% | 74.8%

The initial 81.3% gender classification accuracy, obtained on the original
Market1501 dataset, gets affected both by the dimensionality reduction
parameters b and c, as shown in the unnoised row of the table, and the
additional noise added on top of this transformation. As with our reID
results, the effect of added noise stagnates when setting $\varepsilon\leq
10^{3}$. The average accuracy decrease, computed with $\varepsilon$ varying
between $10^{-3}$ and $10^{3}$, for each parameter combination in ascending b
order, is 14.6%, 19.0%, and 18.0%. Considering that 57.0% of the total samples
are men, which implies a trivial classifier would achieve a 57.0% accuracy, we
can see our privacy mechanism brings gender prediction performances on
Market1501 sensibly closer to chance-level.

####  IV-B2 Fairface

Likewise, we apply the same transformations to the images from the Fairface
dataset, on which we then train gender, age, and ethnicity classification
models. As the images from this dataset are significantly larger, being
224x224 against 64x128 for Market1501, we intentionally use a higher
pixelisation level b, to make the sensitivity $\Delta f$ of the images from
these different datasets more comparable. For brevity’s sake, we only consider
a single parameter combination $b=4$ and $c=32$, which yields sensitivity
$\Delta f=1075648$. Table IV goes over the observed results.

TABLE IV: Fairface classification accuracy,
with b=4 c=32, $\Delta f$=1075648 Noise $\varepsilon$ | Accuracy%
---|---
Gender | Age | Ethnicity
$\mathit{10^{-3}}$ | 66.0% | 31.6% | 31.8%
$\mathit{1}$ | 66.3% | 32.0% | 31.8%
$\mathit{10^{3}}$ | 65.7% | 31.8% | 31.9%
$\mathit{10^{6}}$ | 67.0% | 32.8% | 32.5%
none | 76.9% | 39.7% | 42.4%
chance | 50.0% | 11.1% | 14.3%

Again, the initial classification accuracies of 79.8%, 43.3% and 46.1%,
obtained on the original Fairface dataset for each task respectively, get
affected by both the dimensionality reduction step as well as the noising
step. The effect of noise also tends to stabilise with $\varepsilon\leq
10^{3}$; the average accuracy decreases, when $\varepsilon$ varies between
$10^{-3}$ and $10^{3}$, are 14.1%, 19.5% and 25.7%, for each task
respectively.

##  V Discussion

###  V-A Effect of parameters $b$ and $c$

This section further studies the individual effects of the pixelisation
parameter $b$ and quantisation parameter $c$, in order to get a better
understanding of the performance changes that are to be attributed to our
privacy mechanism $\varepsilon$-Image DP, and those that are to be attributed
to more traditional computer vision transformations.

Fig. 2 shows the effect of increasingly large values for $b$ and $c$ on reID
performances for Market1501 images. While heavy pixelisation destroys the
utility of images for reID, with mAP dipping under 50% when $b\geq 2^{4}$,
heavy colour quantisation has nearly no impact on performances, even at
$c=2^{7}$. In both cases, a centroid-based reID model proves more effective at
identifying people than a regular reID model.

Fig. 3 shows the effect of increasingly large values for $b$ and $c$ on gender
classification for Market1501 images. Unsurprisingly, the effect of
pixelisation is more marked than that of colour quantisation, with the lowest
accuracy being 63.4% for the maximum $b$ value 64, against 72.2% for the
maximum $c$ value 128. While both are a significant departure from the initial
classification accuracy of 81.3%, neither suffice for achieving chance-level
predictions.

Figure 2: Market1501 reID results, with varying $b$ and $c$. Figure 3:
Market1501 gender classification results, with varying $b$ and $c$.

Similarly, Table V gives a summary of the effect of increasingly large
dimensionality reduction parameters on gender, age, and ethnicity
classification for FairFace images. Again, pixelisation has a larger impact
than colour quantisation, and varying these parameters individually only
reduces performances halfway to chance-level, at best.

TABLE V: Fairface classification accuracy, with varying $b$ and $c$. Parameters | Accuracy%
---|---
Gender | Age | Ethnicity
b=1, c=1 | 79.8% | 43.3% | 46.1%
b=21, c=1 | 80.3% | 43.9% | 45.9%
b=23, c=1 | 76.9% | 40.7% | 43.4%
b=25, c=1 | 66.9% | 32.2% | 32.2%
b=1, c=21 | 80.2% | 43.6% | 46.1%
b=1, c=23 | 79.7% | 43.1% | 45.9%
b=1, c=25 | 76.4% | 40.0% | 41.4%
b=1, c=27 | 69.8% | 33.6% | 33.7%
chance | 50.0% | 11.1% | 14.3%

###  V-B Limits of adverse task reduction

Both our experiments and the observations described in the previous section
showcase the ever-present tradeoff between utility and privacy; by design,
increasing privacy, and thus limiting the information contained within data,
comes at the cost of utility.

In our case, we are trying to conduct a task benefiting from high-dimensional
data, i.e., person re-identification, while limiting the extent to which tasks
such as demographic attribute classification can be carried out, which can do
with much lower-dimensional data. As shown in Fig. 3(a), using just two RGB
pixels summarising the general colour information in images still allows for
significantly above chance-level gender predictions; if any reID-relevant
information is to be maintained within images, a utility-driven privacy
mechanism can then hardly be expected to reduce demographic attribute
classification performances beyond that level.

The ability of our utility-driven privacy mechanism to reduce gender
prediction accuracy on Market1501 to $\sim$63.9% (average of all experimented
parameter & noise combinations) is thus in line with the practical limit to
adverse task performance reduction, which we observed to be 63.4% with nothing
but 2 RGB pixels of information, while retaining sensibly higher reID
performances.

The same observation can be made regarding the Fairface dataset, where the
application of our privacy mechanism reduces gender, age, and ethnicity
prediction accuracies to averages of $\sim$66.0%, $\sim$32.0%, and $\sim$31.5%
(average of all experimented noise combinations), respectively, in line with
the accuracies observed when applying exceedingly high pixelisation, which
were 66.9%, 32.2%, and 32.2%, respectively, for images composed of just 9 RGB
pixels.

##  VI Conclusion

We introduce a strict pixel-level image differential privacy mechanism, which
aims for indistinguishability between any pair of same-sized RGB images,
leveraging both pixelisation and colour quantisation to bound the large
sensitivity and therefore large noise this would otherwise entail. We show
that by applying our privacy mechanism to an image dataset, one can sensibly
reduce the utility of said data for very simple tasks such as gender, age, or
ethnicity classification, to performance levels in line with those obtained by
means of exceptionally high pixelisation-based obfuscation. Despite this low
general-purpose utility, the images can still be used for near state-of-the-
art person re-identification when using centroid-based models. We expect these
results to be useful for building privacy-compliant camera-based pedestrian
flow information systems, able to link together highly noised person
representations without compromising pedestrians’ privacy.

## References

  * [1] M. Deakin and H. A. Waer, “From intelligent to smart cities,” _Intelligent Buildings International_ , vol. 3, pp. 140–152, 2011. [Online]. Available: https://doi.org/10.1080/17508975.2011.586673
  * [2] C. S. Schieder, “Demographic decline: Reconciling population and social expectations,” _East Asia Forum Quarterly_ , vol. 13, no. 3, pp. 32–34, 2021. [Online]. Available: https://search.informit.org/doi/10.3316/INFORMIT.114624371616764
  * [3] G. Schrotter and C. Hürzeler, “The digital twin of the city of zurich for urban planning,” _PFG–Journal of Photogrammetry, Remote Sensing and Geoinformation Science_ , vol. 88, no. 1, pp. 99–112, 2020. [Online]. Available: https://doi.org/10.1007/s41064-020-00092-2
  * [4] J. Khan, R. Hrelja, and F. Pettersson-LÃ¶fstedt, “Increasing public transport patronage â an analysis of planning principles and public transport governance in swedish regions with the highest growth in ridership,” _Case Studies on Transport Policy_ , vol. 9, no. 1, pp. 260–270, 2021. [Online]. Available: https://doi.org/10.1016/j.cstp.2020.12.008
  * [5] S. Isoda, M. Hidaka, Y. Matsuda, H. Suwa, and K. Yasumoto, “Timeliness-aware on-site planning method for tour navigation,” _Smart Cities_ , vol. 3, no. 4, pp. 1383–1404, 2020. [Online]. Available: https://doi.org/10.3390/smartcities3040066
  * [6] M. Ye, J. Shen, G. Lin, T. Xiang, L. Shao, and S. H. Hoi, “Deep learning for person re-identification: A survey and outlook,” _IEEE Transactions on Pattern Analysis & Machine Intelligence_, vol. 44, no. 06, pp. 2872–2893, 2022\. [Online]. Available: https://doi.org/10.1109/TPAMI.2021.3054775
  * [7] L. Bazzani, M. Cristani, A. Perina, M. Farenzena, and V. Murino, “Multiple-shot person re-identification by hpe signature,” in _20th International Conference on Pattern Recognition_ , ser. ICPR’10, 2010, pp. 1413–1416. [Online]. Available: https://doi.org/10.1109/ICPR.2010.349
  * [8] M. Farenzena, L. Bazzani, A. Perina, V. Murino, and M. Cristani, “Person re-identification by symmetry-driven accumulation of local features,” in _2010 IEEE Computer Society Conference on Computer Vision and Pattern Recognition_ , ser. CVPR’10, 2010, pp. 2360–2367. [Online]. Available: https://doi.org/10.1109/CVPR.2010.5539926
  * [9] A. Krizhevsky, I. Sutskever, and G. E. Hinton, “Imagenet classification with deep convolutional neural networks,” in _Advances in Neural Information Processing Systems_ , ser. NIPS’12, 2012, pp. 1097–1105. [Online]. Available: https://dl.acm.org/doi/10.5555/2999134.2999257
  * [10] D. Yi, Z. Lei, S. Liao, and S. Z. Li, “Deep metric learning for person re-identification,” in _2014 22nd international conference on pattern recognition_ , ser. ICPR’14, 2014, pp. 34–39. [Online]. Available: https://doi.org/10.1109/ICPR.2014.16
  * [11] L. Zheng, L. Shen, L. Tian, S. Wang, J. Wang, and Q. Tian, “Scalable person re-identification: A benchmark,” in _2015 IEEE International Conference on Computer Vision_ , ser. ICCV’15, 2015, pp. 1116–1124. [Online]. Available: https://doi.org/10.1109/ICCV.2015.133
  * [12] L. Wei, S. Zhang, W. Gao, and Q. Tian, “Person transfer gan to bridge domain gap for person re-identification,” in _2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , ser. CVPR’18, 2017, pp. 79–88. [Online]. Available: https://doi.org/10.1109/CVPR.2018.00016
  * [13] K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in _2016 IEEE Conference on Computer Vision and Pattern Recognition_ , ser. CVPR’16, 2016, pp. 770–778. [Online]. Available: https://doi.org/10.1109/CVPR.2016.90
  * [14] A. Hermans, L. Beyer, and B. Leibe, “In Defense of the Triplet Loss for Person Re-Identification,” _arXiv preprint arXiv:1703.07737_ , 2017. [Online]. Available: https://arxiv.org/abs/1703.07737
  * [15] G. Wang, J. Lai, P. Huang, and X. Xie, “Spatial-Temporal Person Re-identification,” in _Proceedings of the AAAI Conference on Artificial Intelligence_ , vol. 33, no. 01, 2019, pp. 8933–8940. [Online]. Available: https://doi.org/10.1609/aaai.v33i01.33018933
  * [16] D. Fu, D. Chen, J. Bao, H. Yang, L. Yuan, L. Zhang, H. Li, and D. Chen, “Unsupervised pre-training for person re-identification,” in _2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , ser. CVPR’21, 2021, pp. 14 745–14 754. [Online]. Available: https://doi.org/10.1109/CVPR46437.2021.01451
  * [17] Y. Chen, H. Wang, X. Sun, B. Fan, C. Tang, and H. Zeng, “Deep attention aware feature learning for person re-identification,” _Pattern Recognition_ , vol. 126, p. 108567, 2022. [Online]. Available: https://doi.org/10.1016/j.patcog.2022.108567
  * [18] C. Dwork, A. Roth _et al._ , “The algorithmic foundations of differential privacy,” _Foundations and Trends® in Theoretical Computer Science_ , vol. 9, no. 3–4, pp. 211–407, 2014. [Online]. Available: https://doi.org/10.1561/0400000042
  * [19] M. E. Andrés, N. E. Bordenabe, K. Chatzikokolakis, and C. Palamidessi, “Geo-Indistinguishability: Differential Privacy for Location-Based Systems,” in _Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security_, ser. CCS’13, 2013, pp. 901–914. [Online]. Available: https://doi.org/10.1145/2508859.2516735
  * [20] M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in _Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security_ , ser. CCS’16, 2016, pp. 308–318. [Online]. Available: https://doi.org/10.1145/2976749.2978318
  * [21] L. Fan, “Image Pixelization with Differential Privacy,” in _Data and Applications Security and Privacy XXXII_ , vol. 10980, 2018, pp. 148–162. [Online]. Available: https://doi.org/10.1007/978-3-319-95729-6_10
  * [22] B. Liu, M. Ding, H. Xue, T. Zhu, D. Ye, L. Song, and W. Zhou, “DP-Image: Differential Privacy for Image Data in Feature Space,” _arXiv preprint arXiv:2103.07073_ , 2021. [Online]. Available: https://arxiv.org/abs/2103.07073
  * [23] T. Li and C. Clifton, “Differentially Private Imaging via Latent Space Manipulation,” _arXiv preprint arXiv:2103.05472_ , 2021. [Online]. Available: https://doi.org/10.48550/arXiv.2103.05472
  * [24] Y. Zhao and J. Chen, “A survey on differential privacy for unstructured data content,” _ACM Computing Surveys_ , vol. 54, no. 10s, pp. 1–28, 2022. [Online]. Available: https://doi.org/10.1145/3490237
  * [25] M. Wieczorek, B. Rychalska, and J. Dabrowski, “On the unreasonable effectiveness of centroids in image retrieval,” in _Neural Information Processing_ , ser. ICONIP’21, vol. 13111, 2021, pp. 212–223. [Online]. Available: {https://doi.org/10.1007/978-3-030-92273-3_18}
  * [26] O. Russakovsky, J. Deng, H. Su, J. Krause, S. Satheesh, S. Ma, Z. Huang, A. Karpathy, A. Khosla, M. Bernstein, A. C. Berg, and L. Fei-Fei, “ImageNet Large Scale Visual Recognition Challenge,” _International Journal of Computer Vision (IJCV)_ , vol. 115, no. 3, pp. 211–252, 2015. [Online]. Available: https://doi.org/10.1007/s11263-015-0816-y
  * [27] Y. Lin, L. Zheng, Z. Zheng, Y. Wu, Z. Hu, C. Yan, and Y. Yang, “Improving person re-identification by attribute and identity learning,” _Pattern Recognition_ , 2019. [Online]. Available: https://doi.org/10.1016/j.patcog.2019.06.006
  * [28] K. Karkkainen and J. Joo, “FairFace: Face Attribute Dataset for Balanced Race, Gender, and Age for Bias Measurement and Mitigation,” in _2021 IEEE Winter Conference on Applications of Computer Vision_ , ser. WACV’21, 2021, pp. 1547–1557. [Online]. Available: https://doi.org/10.1109/WACV48630.2021.00159