Comment by wizzwizz4 | Hacker News Reader

Comment by wizzwizz4 | Hacker News Reader

Parent Full thread

> Additionally, we demonstrate that ByteFormer has applications in privacy-preserving inference. ByteFormer is capable of performing inference on particular obfuscated input representations with no loss of accuracy. We also demonstrate ByteFormer's ability to perform inference with a hypothetical privacy-preserving camera which avoids forming full images by consistently masking $90\%$ of pixel channels, while still achieving $71.35\%$ accuracy on ImageNet.

I'm not certain they know what "privacy-preserving" means. All the claims they've made around privacy look, to the lay-person (me), to be meaningless:

• Permuting the input values doesn't change anything, because. If anything, this suggests that transformers might be able to approximate the original image, given an unknownly-permuted image – but so can humans, so that's nothing new. https://en.wikipedia.org/wiki/Block_cipher_modes_of_operatio...

• Their "partially-masked image" just looks like a noisy image, not a redacted one. Basic information theory suggests it's not really privacy-preserving at all.

Is it normal for AI papers to be so hypey? Like, this part is literally security-by-obscurity.

> As our method can handle highly nonlinear JPEG encodings, we expect it to perform well on a variety of alternative encodings that an outside observer might not be able to easily guess.

I don't see how any of section 4.2 contributes to the paper, other than letting them make a bold claim about a buzzword in a disproportionate amount of the abstract and conclusion.

I'm interested in that claim as well, though maybe not so overtly hostile to the research.

My first thought was certainly that, at the very least, an adversary can perform image classification as well. I think this is an obvious limitation of how privacy-preserving is possible, and so maybe it's just taken that the reader should understand that. And BIG-IF the adversary can't do much more than that, it would still be appreciated.

They say their model works for a hypothetical privacy preserving camera that masks 90% of the pixels.

I’m not sure there’s much more to it; I think you’re reading too far into it. It shows the power of their model and possible applications towards privacy.

It’s not a stance that that hypothetical camera is actually great for privacy.

But a camera that masks 90% of the pixels isn't privacy-preserving. It's just a 90s consumer-grade webcam. They haven't shown that the approach works with actual privacy measures, which makes their claims in this area dubious.

> It's just a 90s consumer-grade webcam.

The positions of the masked pixels are not stored in the resulting data -- it's not like they are just making some pixels black. The channel information is actually removed from the buffer entirely, and then inference is performed on that buffer:

> The camera stores the remaining unmasked pixel channels in an array without retaining the coordinates of pixel channels on the image sensor. In this scenario, an ad- versary could not obtain a faithful reconstruction of the in- put image. Even if the adversary could guess pixel channel locations, the low resolution of captured data prevents the adversary from recovering a high-fidelity image

Also:

> Their "partially-masked image" just looks like a noisy image, not a redacted one

The caption for the figure (assuming you're talking about figure 4) makes it clear that the figure is illustrative, since it includes the positions of the masked pixels. The pixel positions would not be present in the actual data that comes from this hypothetical camera. So what the figure "looks like" is irrelevant -- its purely illustrative.

ByteFormer. All You Need. The applied papers that claim dubious "sota" status on some benchmark do this. The foundational work that is actually worth reading doesn't.

Reply on news.ycombinator.com