WO2025252900A1 - An apparatus and a method - Google Patents

Abstract

It is provided an apparatus comprising circuitry configured to identify a person in an input image. Further, the circuitry is configured to generate an output image based on the input image by an artificial neural network, ANN, the output image comprising a person based on the identified person of the input image. At least a first value of an attribute of the person from the input image being replaced by a second value of the attribute in the person in the output image.

Description

AN APPARATUS AND A METHOD Field The present disclosure relates to an apparatus and a method as set out in the appended set of claims. Background In today's digital landscape, the use of images and videos containing personally identifiable information (PII) for training artificial neural networks (ANNs) may raise privacy concerns. These data often include sensitive information such as faces, locations, and other personal attributes, making their unauthorized use or exposure a privacy risk or violate laws. This issue is critical in the development and deployment of ANNs, where large datasets are essen- tial for training and improving model accuracy. Protecting the privacy and anonymity of individuals in such data may not only be a legal and ethical obligation but also vital for maintaining public trust. Therefore, improved privacy in image and video data may be desirable. Summary According to a first aspect, the present disclosure provides an apparatus comprising circuitry configured to identify a person in an input image. The circuitry is further configured to gen- erate an output image based on the input image by an artificial neural network (ANN) the output image comprising a person based on the identified person of the input image. At least a first value of an attribute of the person from the input image being replaced by a second value of the attribute in the person in the output image. According to a second aspect, the present disclosure provides a method comprising identify- ing a person in an input image. The method further comprises generating an output image based on the input image by an artificial neural network, ANN, the output image comprising a person based on the identified person of the input image. At least a first value of an attrib- ute of the person from the input image being replaced by a second value of the attribute in the person in the output image. Further aspects are set forth in the appended set of claims. Brief description of the Figures Some examples of apparatuses and/or methods will be described in the following by way of example only, and with reference to the accompanying figures, in which Fig.1 illustrates a block diagram of an example of an apparatus; Fig.2 illustrates an example of a block diagram of a privacy preserving image generation; Fig.3a illustrates an example of an application result of the privacy preserving image gener- ation; Fig. 3b illustrates another example of an application result of the privacy preserving image generation; Fig.4 illustrates an example of a block diagram of a privacy preserving video generation; Fig.5 illustrates an example of the ANN in the training phase; Fig.6 illustrates an example of the ANN in the inference phase; Fig.7 illustrates an implementation setup of the ANN; Fig.8 illustrates a flowchart of an example of a method; Fig.9 illustrates the proposed a stage-I anonymization process; Fig.10 illustrates sample frames from a real video (i) and output video from the anonymiza- tion pipeline (iv); and Fig.11 illustrates the Stage-II of the proposed framework Detailed Description Some examples are now described in more detail with reference to the enclosed figures. However, other possible examples are not limited to the features of these embodiments de- scribed in detail. Other examples may include modifications of the features as well as equiv- alents and alternatives to the features. Furthermore, the terminology used herein to describe certain examples should not be restrictive of further possible examples. Throughout the description of the figures same or similar reference numerals refer to same or similar elements and/or features, which may be identical or implemented in a modified form while providing the same or a similar function. The thickness of lines, layers and/or areas in the figures may also be exaggerated for clarification. When two elements A and B are combined using an “or”, this is to be understood as disclos- ing all possible combinations, i.e. only A, only B as well as A and B, unless expressly de- fined otherwise in the individual case. As an alternative wording for the same combinations, "at least one of A and B" or "A and/or B" may be used. This applies equivalently to combi- nations of more than two elements. If a singular form, such as “a”, “an” and “the” is used and the use of only a single element is not defined as mandatory either explicitly or implicitly, further examples may also use sev- eral elements to implement the same function. If a function is described below as imple- mented using multiple elements, further examples may implement the same function using a single element or a single processing entity. It is further understood that the terms "include", "including", "comprise" and/or "comprising", when used, describe the presence of the speci- fied features, integers, steps, operations, processes, elements, components and/or a group thereof, but do not exclude the presence or addition of one or more other features, integers, steps, operations, processes, elements, components and/or a group thereof. Privacy Preservation Fig. 1 illustrates a block diagram of an example of an apparatus 100. The apparatus 100 comprises circuitry that is configured to provide the functionality of the apparatus 100. The apparatus 100 comprises a processing circuitry 110. For example, the processing circuitry 110 may be a single dedicated processor, a single shared processor, or a plurality of individ- ual processors, some of which or all of which may be shared, a digital signal processor (DSP) hardware, an application specific integrated circuit (ASIC), a neuromorphic processor or a field programmable gate array (FPGA). The processing circuitry 110 may optionally be coupled to, e.g., memory such as read only memory (ROM) for storing software, random access memory (RAM) and/or non-volatile memory. For example, the apparatus 100 may comprise memory configured to store instructions, which when executed by the processing circuitry 110, cause the processing circuitry 110 to perform the steps and methods described herein. The circuitry 110 is configured to identify a person in an input image. Further, the circuitry 130 is configured to generate an output image based on the input image by an artificial neu- ral network (ANN). The output image comprises a person based on the identified person of the input image. At least a first value of an attribute of the person from the input image being replaced by a second value of the attribute in the person in the output image. Further, in some examples, the circuitry 130 may be configured to generate a synthetic image of a per- son based on a model of the person from the input image. Further, the circuitry 130 may be configured to generate a second image based on the input image by replacing the person from the input image with the synthetic image of the person. Further, the circuitry 130 may be configured to generate the output image based on the second image by the ANN. The image generation is conditioned on at least one of a background of the input image, the mod- el of the person, a pose of the person or a depth map of the input image, an input prompt. In another example, the above may also be formulated as follows: The circuitry 130 may be configured to identify a person in an input image. The circuitry 130 may be further config- ured to generate a synthetic image of a person based on a model of the person from the input image. The circuitry 130 may be further configured to generate a second image based on the input image by replacing the person from the input image with the synthetic image of the person. The circuitry 130 may be further configured to generate an output image based on the second image by an ANN, wherein the image generation is conditioned on at least one of a background of the input image, the model of the person, a pose of the person or a depth map of the input image, an input prompt. The ANN may refer to a system of different ANN modules. For example, the ANN may comprise a generative ANN module such as a stable diffusion module (see below) or a gen- erative adversarial network (GAN) module or the like. In some examples, the ANN compris- es a detector module, that is trained to detect a person (or parts of the person, for example, the face of the person or the like) in the input image. An attribute is a specific feature of a person that is both visible in the image and clearly iden- tifiable in the image data. This attribute is detected in the input image by detector module of the ANN. This may then alter it to produce a second value in the output image, thereby changing the appearance of the person while preserving other aspects of their identity. For example, the first and/or second attribute are at least one of ethnicity, gender, sex, age, skin tone, or appearance stereotype. The appearance stereotype may be a human perceptible ap- pearance associated with a social class, gang, culture, subculture or the like. For instance, the input image may show a Black 20 year old male. That is the input image comprises a value “Black” for the attribute ethnicity, a value “male” for the attribute sex, and a value “20” for the attribute age. For example, the at least the first value of the attribute of the person in the input image, for example the value “male” of the attribute sex, is replaced by the ANN with a second value of the attribute of the person in the output image, for example by the value “female”. The background image may refer to the image wherein the detected person is removed. In some examples, the parts of the image where the person was removed are reconstructed in the background image (see below). Based on the detected person from the input image the synthetic image of the person is gen- erated based on the model of the person. In some examples, the model may be a 3D mesh model of the person. In some examples, the circuitry 130 is further configured to identify a pose of the detected person. The model of the person may be detailed 3D mesh representing the shape and surface characteristics of the person. For example, the ANN may comprise a module that is trained to generate the model of the person. In some examples, techniques such as photogrammetry may be used to infer the 3D model structures from the input image 2D image or the software 4D humans may be used. This 3D mesh model may provide a comprehensive representation of the person's physical appearance, for example including contours, textures, and dimensions. The pose of the person may be a spatial configuration of the person's body, including the positions and orientations of key joints such as the shoul- ders, elbows, hips, and knees. The ANN may comprise a module that is trained to identify the pose, which may utilize deep learning techniques to analyze the input image and accu- rately identify and map the key points onto a body structure by detecting and mapping joints. In other examples, the pose may be detected using pose estimation algorithms like 4D hu- mans, OpenPose or DensePose may be used. In some examples, the generating of the synthetic image of the person comprises rendering the model of the person. Rendering may be the process of generating an image from the model. It may involve calculating and simulating the visual appearance of the model, includ- ing lighting, shading, texture, and perspective, to produce a realistic or stylized final image. For example, the detected pose may be applied to the generated the model of the person, aligning the joints and limbs according to the identified spatial configuration of the person. This process may ensure that the synthetic image accurately reflects both the person's static appearance and their dynamic posture, resulting in a realistic and contextually accurate rep- resentation. For example, the software Pyrender or the like may be used. In some examples, the synthetic image the person may be part of a synthetic image compris- ing the person, wherein the synthetic image may have an identical resolution as the input image and/or the output image, wherein all the pixels which do not comprise the synthetical- ly rendered person (also referred to as synthetic avatar) comprise a specific value, such as zero. Then, the circuitry 130 may generate the second image by replacing the detected per- son from the input image with the synthetic image of the person. For example, the pixel val- ues of the synthetically rendered person may replace the pixel values of the detected person in the input image. Then the trained ANN may generate the output image based on the gen- erated second image. The ANN may be conditioned on at least one of a background of the input image, the model of the person, a pose of the person or a depth map of the input image, an input prompt. That is the ANN may receive the second image as input and also at least one of the background of the input image, the model of the person, the pose of the person or the depth map of the input image as input into the ANN. Conditioned (also referred to as guided) means that the generation of the output image by the ANN incorporates at least one of the background of the input image, the model of the person, the pose of the person or the depth map of the input image into the output image. When generating the output image, the ANN includes one or more of these factors directly in the generation process. The ANN uses these details to ensure that the resulting output image accurately reflects the provided condi- tions, making the output image contextually appropriate and visually coherent with the spec- ified conditions. In some examples, the circuitry 130 may be further configured to obtain the prompt input comprising a second value of the attribute to replace the at least one value of the attribute of the person from the input image in the output image. The prompt may be input by user for example via text or speech input. In another example, the input prompt may be automatically generated without human assistance. The ANN may be trained to generate the output image, based on the second image, and further be conditioned on the prompt input. For example, the attribute may be ethnicity. The input image may comprise a Black 20 year old male, so the first value of the attribute may be Black. The input prompt may for example, say “Generate an output image of a 30-year-old White female”. That is the second value of the attribute may be “White”. The ANN receives the input prompt as embedding and is trained to gener- ate an output image, comprising the same background as the input image, comprising a per- son with the same pose but instead of a 20 year Blac male a 30 year old White female. In some examples, the input image is part of a training data set of images. The circuitry 130 may be further configured to replace the input image in the training data set with the output image. It may be that this already existing and expensively created training dataset with im- ages is used to train another ANN. The images in the training dataset may make the people displayed in the image recognizable and thereby violate data protection laws and privacy protection standards. It may be desired or required to anonymize the persons in the images or certain attributes of persons within the images of the training dataset while leaving other attributes of the image, such as the background unchanged. This is possible using the tech- nique described here. This means that existing training data sets may be anonymized so that the privacy of the person is preserved, and the images may be further used and compliant without deteriorating the image quality or introducing artefacts. Images that comply with data protection regulations may also be used in other application examples. That is the by integrating of the rendering process with the ANN image generation (such as a stable diffusion application), for example using additional and intermediate information from the rendering (depth images, 3D mesh models, poses etc.) and using that as additional condi- tion (guidance) to control the ANN generation (for example the diffusion process) the quali- ty of the output images is increased. The integration of pre-computed information as de- scribed above into ANN generation process guides the ANN’s output. Further, in case of a video sequence as input (see below) it allows further for temporal coherency across frames. For example, this process may also allow for generating anonymized data automatically without human intervention which is often required for other solutions when intending to generate coherent and qualitatively appealing video with fine-level control. Training and Inference of the ANN for Privacy Preservation The ANN may comprise an encoder-decoder architecture with a latent space representation. In some examples, the ANN may comprise an encoder module and a decoder module. The ANN encoder may transform the second image into a compact latent representation, captur- ing essential features and details such as one or more attributes of the detected person as de- scribed above. This latent representation may then be conditioned on additional information, such as a background of the input image, the generated model of the detected person, the detected pose of the person, the depth map of the input image and/or the input prompt to guide the generation process of the output image. The conditioned latent representation may be fed into the ANN decoder module, which reconstructs the final output image, ensuring it aligns with the specified conditions. The encoder and/or decoder ANN module may be a generative ANN such as a stable diffusion, a variational autoencoder (VAE), a generative adversarial network (GAN), a denoising diffusion probabilistic models (DDPM), and condi- tional GAN (cGAN) or the like. During training of the ANN, a dataset comprising input images and their corresponding la- beled attributes. Each input image includes a person with attributes such as ethnicity, age, and gender and a label such as “20-year-old Black male”. In some examples, synthetic imag- es where the real person has been replaced by a synthetic avatar are used. The training da- taset may also include corresponding input prompts specifying the desired transformations, such as “Generate a 30-year-old White female”, along with the background image, the pose of the person, the model of the person and/or the depth map. This labeled and supervised dataset enables the model to learn how to transform the input images into the desired output images based on the given conditions. Then the training process begins with the encoder processing each input image to create the corresponding latent representation. This latent representation is a compact, high-dimensional vector that encapsulates the important features and attributes and details of the input image. The latent representation is then conditioned on the multiple additional inputs: the text prompt, the background of the input image, the depth map, the model of the person and/or the pose of the person. The text prompt may be encoded using an embedding layer or a pre-trained language model, converting it into a vector that represents its semantic meaning. The background is encoded separately to provide spatial context, ensuring the generated image aligns with the original scene. The depth map is en- coded to maintain spatial relationships and realistic placement of objects, providing infor- mation about the distances of various elements in the scene. The pose and the model of the person may be encoded to ensure the generated person maintains the desired posture and orientation. These conditioning inputs are for example concatenated, or otherwise integrated, with the latent representation. This integration influences the subsequent decoding process, ensuring that the output image generated by the decoder adheres to the specified conditions. The de- coder reconstructs the output image from the conditioned latent representation, generating an image that aligns with the given background, pose, model, depth information, and the se- mantic content of the text prompt. The model is trained to minimize a loss function. The loss function may comprise a perceptual loss which compares high-level features between the generated image and the input image to ensure perceptual similarity. It ensures that the syn- thetic image maintains a coherent and realistic appearance. Further, the loss function may comprise a conditional loss that ensures that the generated image aligns with the specified conditions such as the pose and the background. For this purpose, the generated image may be analyzed for the pose and background etc. For instance, an auxiliary network can predict attributes from the generated image and compare them to the desired attributes specified in the text prompt, background, pose, and depth map. Further, the loss function may comprise an adversarial Loss which may ensure the realism of the generated image by using a discrim- inator network that tries to distinguish between real and generated images. By minimizing these losses, the model learns to generate images that meet the desired specifications. In another example, during training, the model uses a similar dataset but without explicit input prompts. Each input image includes a person with attributes such as ethnicity, age, and gender (e.g., a “20-year-old Black male”). Instead of using text prompts, the model deter- mines maximum distance between one or more predetermined attributes of the input image and the corresponding attributes in the generated output image. For example, the distance of the entries in the latent representation is maximized (see also below). As in the above case, the other input conditions are integrated into the laten representation of the input image. This integration influences the decoding process, ensuring that the generated image aligns with the specified conditions. The loss may be determined as above. In some examples, the loss function further comprises a term measuring the similarity with regards to the one or more predetermined attributes and then minimizing the reverse similarity and learn to maximize the distance between the input image and the output image with regards to the one or more predetermined attributes. During inference, the trained ANN model receives the second image comprising the syn- thetically rendered person as input and at least one of a background of the input image, the model of the person, a pose of the person, a depth map of the input image, or an input prompt. In some examples, the circuitry 130 is further configured to encode, by the ANN (e.g., by the ANN encoder module) the second image into a latent representation. In some examples, the latent representation is then conditioned on all of the available additional in- puts as described above. That is, the generation of the output image is conditioned by con- catenating at least one of the background of the input image, the model of the person, the pose of the person or the depth map of the input image with the latent representation and using the concatenation as input into the ANN (e.g., the decoder ANN module). Concatenating may refer to the process of linking or integrating at least one of the back- ground of the input image, the model of the person, the pose of the person or the depth map of the input image together with the latent representation into a combined form which may be input into decoder module of the ANN. In some examples concatenating implies a se- quential joining of elements. In other examples, concatenating does not imply a strict se- quential joining of elements, but instead, it may involve combining the data into a cohesive latent representation, which may be a multidimensional vector within the latent space, which the ANN then uses as a comprehensive basis for further processing. That is the conditioned latent representation is fed into the decoder module, which generates the final output image. The decoder ensures that the generated image adheres to the specified conditions, such as changing the person's attributes while maintaining a realistic integration with the background and other contextual details. The result is an anonymized image where specific attributes have been modified (for example according to the input prompt) and other attributes stay unaltered, ready for use in creating privacy-preserving datasets. In some examples, the circuity 130 is further configured to remove the person from the input image when generating the second image. For example, the pixel values in the input image where the person is detected are just remove and set to zero. In some examples, the circuity 130 is further configured to generate a segmentation mask of the input image with regards to person and remove the person from the input image based on the segmentation mask. A segmentation mask may be a binary image with the same resolution as the input image, that labels each pixel of the input image if it comprises a part of the person or not. In some ex- amples, the generating the second image comprises to reconstruct the parts of the image where the person was removed. In some examples, the reconstruction is based on extrapolation of another image being simi- lar to the input image and/or on an area within the input image being adjacent to removed person area. Extrapolating information from another image that is similar to the input image may be done if a sequence if input images for example from a video sequence is obtained (see below). Extrapolating may involve identifying an image with a similar background and scene characteristics, then using its corresponding pixels to fill in the gaps left by the re- moved person. Alternatively, if the reconstruction may be based on the area within the input image that is adjacent to the removed person's region. In this method, surrounding pixels are analyzed and extended to seamlessly fill the vacant area, ensuring continuity in texture, col- or, and pattern to create a natural-looking background. Both approaches aim to generate a coherent and realistic reconstruction of the scene after the person has been removed. The background image that may be provided as condition to the ANN may refer to the image wherein the detected person is removed and where area where the person is removed is re- constructed as described above. In some examples, the input image may be a part of a video sequence, and the circuity 130 may be further configured to generate the output image based on the second image by the ANN, wherein the generation of the output image is further conditioned on an image being a previous image of the input image within the video sequence. For example, the video se- quence comprises a plurality of frames which are used as input images. In some examples, the ANN (for example, the same modules as described above) receive the generated output image again as an input together with a previously generated output image. The input output image is then encoded into the latent space as described above where the previously generated output image is provided as condition and then the conditioned latent representation is input into the decoder ANN. In some examples, the model, the pose and/or the depth information are also provided as condition in this step. Then the (new) generated output image is temporally coherent to the previous generated output image. This ensures the persons’ movements and appearance are consistent and flow naturally through the video se- quence. In some examples, the ANN may be conditioned on two or more or all previous and consecutive generated output images in the video sequence (see also Fig. 3a below). There- by, data-privacy compliant video sequences may be generated without altering the main con- tent of the video, which may be used as training data for other ANNs or other use cases. A pseudo-code of the video above video generation is given in the following: Given: ^^: Diffusion model designed for sequence processing. ^^: Embeddings for guidance. This is fixed for all frames and across videos but needs to be chosen well. ^_{^ = {^^1, ^^2 , … , ^^^^}: Sequence of original video frames.} ^^: Depth estimation function. Can be output of rendering step. ^^: Mesh estimation function. Can be output of rendering step. ^^_^^: Control function for depth parameters. Provides a semantic anchor to the original sequence and maintains temporal integrity. ^^_^^: Control function for mesh parameters. Provides a semantic anchor to the original sequence and maintains temporal integrity. Θ_^^: Temporal parameters to maintain sequence integrity. This is independent of the input and generally incites the network to maintain integrity between consecutive frames. Objective: G_{enerate a refined sequence of video frames ^^ = {^^1, ^^2, … , ^^^^) maintaining tem-} poral integrity. procedure REFINEVIDEOSEQUENCE൫(^^,Θ_^^ ,^^,^^,^^,^^,^^_^^,^^_^^)൯: 1_{. ( ^^ ← ^^(^^)) ^ Acquire depth maps for all frames 2. ( ^^ ← ^^(^^)) ^ Acquire mesh data for all frames ^ Derive depth parameters for all frames ^ Derive mesh parameters for all frames 5. ( ^^ ← ^^(^^, ^^,Θ^^ ,Θ^^,Θ^^)) ^ Iteratively refine entire sequence 6. ^^^^^^^^^^^^ ( ^^ )} end procedure Further details and aspects are mentioned in connection with the examples described below. The example shown in Fig. 1 may include one or more optional additional features corre- sponding to one or more aspects mentioned in connection with the proposed concept or one or more examples described below (e.g., Figs.2 - 9). Fig. 2 illustrates an example of a block diagram of a privacy preserving image generation. Input image 210 (e.g., a real image) is received as input. The input image 210 may comprise a person with personal identifiable information (PII), such as the ethnicity of the person. The input image 210 is input into a model generation unit 220. The model generation unit 220 identifies the person in the input image and estimates the pose of the person and generates a 3D mesh model of the person (if there is more than one person in the input image 210 the described technique may be applied accordingly to the plurality of persons). The 3D mesh model reflects the geometric shape and facilitates the creation of diverse synthetic avatars, allowing for variation in body shapes and demographic attributes. The 3D mesh model of the person and may be forwarded to a rendering unit 240. The rendering unit 240 renders the 3D mesh model and generates a synthetic image 242 of the person (synthetic avatar). The person in the synthetic image 242 performs the same motion as the person in the input image 210. The rendering unit 240 may not consider the parts of the input image 210 surrounding the person (i.e., the background). For example, the software Unity may be used. Further, the rendering unit 220 may generate a depth image of the input image 210. The depth image of the input image 210 may comprise depth values for each pixel of the person in the input im- age 210, from an estimated virtual camera viewing the person in input image 210. In some example the model generation unit 220 may generate the depth mask and forward it to the rendering unit 240. For example, the software 4D humans may be used. The if available, the depth map may be forwarded to a rendering unit 240. The synthetic image 242 is forwarded to a merging unit 250. Further, the input image 210 is input in the masking unit 230. The Masking unit recognizes the person and/or the PII and masks the person in the input image 210 and generates a masked image 232. The masked image 232 may only comprise privacy non-sensitive infor- mation. For example, the masking unit may generate a pixel-wise person segmentation mask of the input image 210 with regards to the person and remove the person from the input im- age based on the segmentation mask. For example, the area where the person is removed in the masked image 232 may be reconstructed. For example, the area may be reconstructed by an extrapolation of another image being similar to the input image 210 where the back- ground is unobstructed (for example if the input image is part of an image sequence such as video, a frame before or after the input image 210 may be used). For example, if the back- ground is consistently occluded the area may be reconstructed (synthesized) based on adja- cent areas of the removed area in the input image 210. The masked image 232 is forwarded to a merging unit 250. The merging unit 250 places the synthetic image 242 of the person exactly at the position of where the person was removed in the masked image 232, which yields the merged image 252. The merged image is forwarded to the stable diffusion unit 260 together, with the 3D mesh model of the person, the estimated pose and the masked image 232 (i.e., the reconstructed background). The stable diffusion unit 260 is a trained ANN. The stable diffusion is receiving the merged image as input and is conditioned on the 3D mesh model of the person, the estimated pose and the masked image (i.e., the reconstructed background). Further, the stable diffusion unit 260 receives an input prompt 261 comprising specific attributes based on which the stable diffusion generates its output (such as “Generate a 20 year old White male.”). The stable diffusion unit 260 generates the output image 270. The stable diffusion unit 260 adjusts the synthetic image (the synthetic avatar) to align it realistically with background conditions (environmental conditions), refining the appearance to match the lighting, shadows, and oth- er scene specifics. The output image comprises the same person and the same background as the input image 210 but without the PII. For example, an African person is changed into a Chinese person. That is the output image 270 may be used for several use case wherein the privacy of the person is preserved. In some examples, the background information (the masked image 232) may still contain information which might be privacy sensitive and/or the original person from the input image 210 may not be perfectly covered by the synthetic image 242. Therefore, in some examples, differential privacy methods as described below may be applied to the output image 270. For example, the software stable diffusion 1.5 or SDXL may be used. In other words, the surrounding context of the person in the input image 210 (i.e., scene in- formation) is used to realistically fit and align the synthetic image (rendered avatar) 242 placed in the scene. Without this surrounding context integration, rendered synthetic avatar 242 may have a visual dissonance with their surroundings (background) and may show ma- jor artifacts on the border of the fitted synthetic image (synthetic avatar) 242 into the back- ground, since lighting, reflections, image quality etc. may visually differ between the sur- rounding context (background) and the synthetic avatar 242 which is provided. The stable diffusion unit 260 may explicitly adding context information of the surroundings in the dif- fusion process, quality does not only improve for the synthetic avatar 242 in an isolated way but also the synthetic avatar 242 is fitted into the scene, meaning that lighting on the synthet- ic avatar 242, reflections and shadows are better represented. The quality of the output image 270 may not be achieved with rendering and merging alone, since the rendering is missing this information and rendering on its own does not resolve the visual artifacts. However, also stable diffusion on its own may not be able to maintain sufficient semantic information in the output image, such that the output image would not resemble the input image enough to be useful (and also not provide consistency across frames see Fig. 4). Fusion of both rendering and stable diffusion however achieves high quality output images 270 (see also Fig.3a). Further details and aspects are mentioned in connection with the examples described above or below. The example shown in Fig.2 may include one or more optional additional features corresponding to one or more aspects mentioned in connection with the proposed concept or one or more examples described above (e.g., Fig.1) or below (e.g., Figs.3 - 9). Fig.3a illustrates an example of an application result of the privacy preserving image gener- ation. The input image 210 shows a person with a background in a room. The person is clearly identifiable in this image as a White female, which may be considered as PII. There- fore, this PII may be removed from the image while still using the image without the PII. There the method as described above may be applied. The synthetic image 242 of the person is generated and then the merged image 252 is generated (not shown in Fig. 3a). Finally, the output image 270 is generated which shows a person with the same pose in the same back- ground room as in the input image 210, however without displaying any PII, because the person in the output image looks different and is an African woman now. Fig. 3b illustrates another example of an application result of the privacy preserving image generation. The input image 310 is input to the trained flow as described in Fig. 2. The fol- lowing attributes may be replaced: ancestry (also referred to as ethnicity or ethnicity), eye- glasses, facial feat, emotion, gender, occupation, age, skin tone and or/ hair color as shown on the 1^st to 9^th column of the Fig. 3b. The first column shows the person from the input image where the value of the attribute ethnicity is changed from a first value to the second value Japanese (first row), Malagasy (second row), Indian (third row) and Indian (fourth row). All the other attributes of the person from the input image 310 are not altered. In the corresponding first to fourth row the image with the replaced ethnicity is then further changed by changing other attributes like eyeglasses, facial feat, emotion, gender, occupa- tion, age, skin tone and or/ hair color. Further details and aspects are mentioned in connection with the examples described above or below. The example shown in Figs. 3a/3b may include one or more optional additional features corresponding to one or more aspects mentioned in connection with the proposed concept or one or more examples described above (e.g., Figs. 1 - 2) or below (e.g., Figs. 4 - 9). Fig. 4 illustrates an example of a block diagram of a privacy preserving video generation. Parts of the video generation are similar to the image generation as described in Fig. 2. A plurality of input images 410. For example, the plurality if input frames are part of a video sequence. For example, however, the plurality of input images 410 only comprise 1 frame per second or the like, that is only every second or third or fourth frame of a video sequence may be received as input. The plurality of input images 410 may comprise person with PII, such as the ethnicity of the person or the like. The plurality of input images 410 are input into a model generation unit 420. The model generation unit 420 identifies the person in each of the plurality of input images 410 and estimates the pose of the person in each of the plu- rality of input images 410 and generates a 3D mesh model of the person for each of the plu- rality of input images 410 (if there is more than one person in the plurality of input images 410 the described technique may be applied accordingly to the plurality of persons). The 3D mesh models reflect the geometric shape and facilitates the creation of diverse synthetic ava- tars, allowing for variation in body shapes and demographic attributes. For example, the software 4D humans may be used. For example, the software 4D humans may be used. The 3D mesh models of the person for each of the plurality of input images 410 may be forward- ed to a rendering unit 440. The rendering unit 440 renders the 3D mesh models and generates a synthetic image of the person (synthetic avatar) for each the plurality of input images 410, that is a plurality of syn- thetic images 444. The person in the plurality of synthetic images 442 perform the same mo- tion as the person in the plurality of input images 410. The rendering unit 440 may not con- sider the parts of the input images 410 surrounding the person (i.e., the background). Further, the rendering unit 440 may generate a depth image 446 for each of the plurality of input im- ages 410. Each depth image of the plurality of depth images 446 may comprise depth values for each pixel of the person in the corresponding input image 410, from an estimated virtual camera viewing the person in the corresponding input image 410. Further, the rendering unit 440 may generate a pixel perfect render mask 448 for each of the plurality of synthetic imag- es 442. A pixel-perfect render mask 448 may be binary mask with the same resolution as the input image 410, that defines the exact pixels where the rendered synthetic avatar 442 ap- pears. The synthetic images 442 (and in some examples the depth maps 446 and/or the pixel- perfect render masks 448) may be forwarded to a merging unit 450. The synthetic images 442, the depth maps 446 and/or the pixel-perfect render masks 448 may be forwarded to a stable diffusion unit 460. For example, the software Unity may be used. In some examples the model generation unit 420 may generate the depth images 446 for each of the plurality of input images 410 and forward them to the rendering unit 440. Further, the input image 410 is input in the masking unit 430. The Masking unit 430 recog- nizes the person and/or the PII in each of the plurality of input images 410 and masks the person in each of the plurality of input images 410 and generates corresponding masked im- ages 432. The masked images 432 may only comprise privacy non-sensitive information. For example, the masking unit may generate a pixel-wise person segmentation mask for each of the plurality of input images 410 with regards to the person and remove the person from the input image based on the segmentation mask. For example, the area where the person is removed in each of the masked images 432 may be reconstructed. For example, the area may be reconstructed by an extrapolation of another one of the plurality of input images 410 where the background is unobstructed. For example, if the background is consistently oc- cluded the area may be reconstructed (synthesized) based on adjacent areas of the removed area in the corresponding input image 410. The masked images 432 are forwarded to the merging unit 450. The merging unit 450 places each of the synthetic images 442 of the per- son exactly at the position of where the person was removed in the corresponding masked images 432, which yields the plurality of merged images 452. The plurality of merged imag- es 452 is forwarded to the stable diffusion unit 460. The stable diffusion unit 460 receives the plurality merged images 452, the plurality of 3D mesh models of the person (and the corresponding estimated poses), the plurality of the masked images 432 (i.e., the reconstructed background), the plurality of the synthetic images 444, the plurality of depth maps 446 and the plurality of depth pixel-perfect render masks 448. The stable diffusion unit 460 is a trained ANN. Further, the stable diffusion unit 460 receives an input prompt 461 comprising specific attributes based on which the stable diffu- sion generates its output (such as “Generate a 20 year old White male.”). The stable diffu- sion unit 460 generates a plurality of output image 460 corresponding to the plurality of in- put images 410. In case of the video generation, the stable diffusion image generation is conditioned on the plurality of 3D mesh models of the person and the corresponding estimat- ed poses, the plurality of input images 410 (the sequence of input frames for example), and the plurality of depth maps 446 (either estimated or actual received via the input images 410) as well as the temporal flow of all previous and consecutive generated output images 470 in the video sequence. For example, the stabile diffusion is conditioned on the previously gen- erated (t-1) output image. This maintains the temporal consistency of the synthesized images (synthetic avatars’) movements and the appearance is consistent and flows naturally through the video sequence. For example, the software stable diffusion 1.5 or SDXL may be used. Further, the stable diffusion unit 460 may compute adaptation parameters which align the output images 462 with the desired depth maps 446 and 3D mesh models (which were ex- tracted during the rendering) on each output frame, forcing fine-grained control onto the out- put images 462. For example, the software LoRAs or Contorlnets may be used for the com- putation of the adaptation parameters. The output images 462 comprise the same person in the same pose and the same background as int the corresponding input image 410 but with- out the PII. That is the output images 462 may be used for several use case wherein the pri- vacy of the person is preserved. In some examples, the background information (the masked image 232) may still contain information which might be privacy sensitive and/or the origi- nal person from the plurality of input images 410 may not be perfectly covered by the syn- thetic image 444. Therefore, in some examples, differential privacy methods as described below may be applied to the output images 462. In other words, failing temporal coherency may show in artifacts like strongly flickering images with varying poses on each frame or clothing and skin textures. This degradation in image quality may also significantly degrade the performance of networks trained on such data if the generated output images are used as training data for other ANNs. By providing the pre-computed input data to the stable diffusion unit 460 (such as the plurality of merged images 452) which approximates the desired output images 462 and using the 3D mesh models and the depth maps 446 (which is computed during the previous rendering process), the output images 462 of the stable diffusion unit 460 are be controlled not only via text (such as prompt) but also via this additional information. This may ensure that temporal co- herence is maintained while also being visually appealing. The input pre-computed infor- mation as described above – which is not subject to temporal incoherency – may be used as an anchor by the stable diffusion unit 460. The diffusion process may refine the precomputed information. Further, in case that the input images 410 where part of a video sequence, where for exam- ple, only every third frame (for example just 1 frame per second) is part of the input images 410, the corresponding output images 462a, 462, 462c also have missing frames between them (the dashed lined frames in the output image 462). Therefore, in this case the output images 462a, 462, 462c may be forwarded to interpolation unit 470. The interpolation unit 470 generates the missing frames between the generated output frames 462a, 462, 462c by interpolation. The interpolation unit 470 generates all the frames 472 of the full video se- quence. For example, the software thin plate spine motion model may be used for this. The video sequence may be synthesized by merging frames with the adjusted synthetic figures, ensuring visual and temporal consistency in the final output. The synthesized video sequence can replace or augment footage in (training) datasets, main- taining the anonymity of individuals and making it suitable for privacy-sensitive applications like machine learning training datasets. This method enhances the quality and diversity of training data while protecting individual privacy. Previous approaches do either not provide sufficient control (for the large majority of exist- ing approaches, an appealing video is generated based on text prompts, but it very loosely contains the desired content without fine-grained control; that is not applicable for practical applications and cannot be used in the scenario of person anonymization) or fails to be tem- porally coherent. Missing control over the video generation does not allow for generating useful training data Further details and aspects are mentioned in connection with the examples described above or below. The example shown in Fig.4 may include one or more optional additional features corresponding to one or more aspects mentioned in connection with the proposed concept or one or more examples described above (e.g., Figs.1 - 3) or below (e.g., Figs.5 - 9). Decoupling of Sensitive and Non-Sensitive Data in an Image In some examples, to identify the person in the input image may comprise to identify the first value of the attribute of the person in the input image. The circuitry 130 may be further configured to generate the output image based on the input image by the ANN. The output image may comprise the person from the input image with the second value of the attribute, the second value of the attribute being different from the first value of the attribute. As described above the attribute is a specific feature of a person that is both visible in the image and clearly identifiable in the image data. This attribute is detected in the input image by detector module of the ANN. This may then alter it to produce a second value in the out- put image, thereby changing the appearance of the person while preserving other aspects of their identity. For example, the first and/or second attribute are at least one of ethnicity, gen- der, sex, age, skin tone, or appearance stereotype. The appearance stereotype may be a hu- man perceptible appearance associated with a social class, gang, culture, subculture or the like. For instance, the input image may show a Black 20 year old male. That is the input im- age comprises a first value “Black” for the attribute ethnicity, a first value “male” for the attribute sex, and a first value “20” for the attribute age. For example, the first value of the attribute ethnicity of the person in the input image (Black) is replaced by the ANN with a second value of the attribute ethnicity of the person, for example White, in the output image. The first and the second value of the attribute are different. For example, the input image may comprise only a part of the person such as face or the like. The ANN may refer to a system of different ANN modules. For example, the ANN may comprise a generative ANN module such as a stable diffusion module (see below) or a gen- erative adversarial network (GAN) module or the like. In some examples, the ANN compris- es a detector module, that is trained to detect a person (or parts of the person, for example, the face of the person or the like) in the input image. In some examples, the circuitry 130 is further configured to identify the first value of the attribute of the person in the input image based on a label corresponding to the input image. In another example, the ANN is trained to identify the value of one or more attributes of the person in the input image. For example, the ANN is trained (based on a labeled training data set and supervised learning) to identify the gender and the ethnicity of the person in the input image. Based on the identified value of the attribute, the ANN is trained to replace the identi- fied first value of the attribute with a different second value of the attribute. In some examples, the circuitry 130 may be further configured to decouple the first value of the attribute of the person in the input image from a value of a second attribute of the person in the input image. Decoupling may refer to separating and decorrelating the first value of the attribute of the person in the input image from the values of the other attributes of the person in the input image. That is separating may refer to isolating the first value of the at- tribute (sensitive data) so that it is treated independently from the other attributes (non- sensitive data). Decorrelation may involve minimizing any statistical correlation between the sensitive data and non-sensitive data, ensuring that changes in the sensitive attribute do not predict changes in the non-sensitive attribute. This ensures that sensitive data and non- sensitive data are independently represented, enhancing privacy and preventing sensitive information from being inferred based on the correlation with other attributes. In some examples, the ANN may be trained to replace one or more specific attributes of the input images, such as ethnicity or gender. In some examples, the one or more attribute whose values should be replaced with other values are input into the ANN, for example via a prompt input. That is, the ANN is trained to receive an input prompt which ask for the re- placement of a specific attribute. In some examples, the ANN is trained to always replace values of some specified attributes. In some examples, the ANN is trained to identify the first value of the attribute and replace it with a second value according to a look-up table. For example, the first value “German” of the attribute ethnicity is according to a look-up table always replaced with the second value “African”. For example, the first and the second value of each attribute are defined in the look-up table such that have a low similarity. In other examples, the ANN may be trained to identify the first value of the attribute and replace it with a second value such that the difference of the first value and the second value becomes maximized within a predetermined set of attribute values. For example, the set of ethnicity attribute values comprises 10 different ethnicities and the second value is determined from this set such that the difference to the first value becomes maximized. For example, the dif- ference between the first value and the second value in a latent representation is maximized (see below). In some examples, the value of the second attribute is input into the ANN, for example via an input prompt. For example, the ANN is provided with the input prompt, “Generate an image of a 20 year old White female”. In some examples, the input image is part of a training data set of images. The circuitry 130 may be further configured to replace the input image in the training data set with the output image. It may be that this already existing and expensively created training dataset with im- ages is used to train another ANN. The images in the training dataset may show persons with certain attributes. It may be desired or required, due to government mandates or data protec- tion regulations, to anonymize certain attributes of the person within the images of the train- ing dataset while leaving other attributes of the image unchanged. This is possible using the technique described here. This means that existing training data sets may be sanitized so that they may be further used and compliant. Images that comply with data protection regulations may also be used in other application examples. Training and Inference of the ANN for Decoupling In some examples, the circuitry 130 may be further configured to encode, by the ANN, the input image into a latent representation. This the ANN identifies the first value of the sensi- tive attribute (such as ethnicity or gender) in the latent representation. The network then sep- arates and decorrelates (decouples) this sensitive attribute from other attributes within the latent representation. In some examples, the values of the latent representation corresponding to the first value of the attribute are replaced by values corresponding to the second value of the attribute. In some examples, the circuitry 130 may be further configured to decorrelate values of the la- tent representation corresponding to the first value of the attribute from one or more other values of the latent representation. Decorrelation may involve minimizing any statistical cor- relation between the sensitive data and non-sensitive data, ensuring that changes in the sensi- tive attribute do not predict changes in the non-sensitive attribute. In some examples, the decorrelation is based on an adversarial neural network. In some examples, the circuitry 130 is further configured to determine the second value of the attribute such that a difference between the first value of the attribute and the second value of the attribute is maximized. For example, the circuitry 130 is further configured to determine the values corresponding to the second value of the attribute, such that a difference between the values of the latent rep- resentation corresponding to the first value of the attribute and the values of the latent repre- sentation corresponding to the second value of the attribute are maximized. For example, the Euclidean or L₁ norm or the like of the difference between the first and the second values of the attribute are maximized within the set of available values for the attribute. Then, the de- coder module of the ANN generates the output image new image based on this modified latent representation, ensuring the new image looks similar to the original but with the sensi- tive attribute altered. Fig. 5 illustrates an example of the ANN 500 in a training phase. The ANN 500 may com- prise an encoder module 510 and a decoder module 530. The ANN 500 may be a generative ANN such as a stable diffusion, a variational autoencoder (VAE), a generative adversarial network (GAN), a denoising diffusion probabilistic models (DDPM), and conditional GAN (cGAN) or the like. The encoder 510 receives labelled input data 510 comprising images with attribute labels such as ethnicity, gender, age, etc. For example, the input image may comprise a label such as “20 year old White male”. The encoder 510 processes each input image 510 to generate a latent representation 520, capturing essential features and attributes. The latent representation 520 comprises the first attribute 522 (sensitive data) and the other attributes 524 (non-sensitive data). Further, an adversarial module 550 may be used to degrade sensitive attribute recognition. The adversarial module 550 attempts to predict sensitive attributes from the non-sensitive component of the latent representation. The adversarial module 550 receives as input the latent representation 520 comprising both first attribute 522 (sensitive data) and the other attributes 524 (non-sensitive data). The adversary's objective is to decouple/decorrelate the sensitive and non-sensitive attributes in the latent representation 520. To achieve this, an adversarial loss is included in the training process. By maximizing the adversary loss, the sensitive and non-sensitive attributes are decoupled/decorrelated. The loss function for the adversary might be a standard cross-entropy loss comparing the predicted sensitive attributes with the true labels. Conversely, the ANN 500 is trained to maximize the adversary’s loss, ensuring that sensitive information is not present in the non-sensitive component. The adver- sarial module 550 further is employed to ensure that the sensitive component 522 and the non-sensitive component 524 of this latent representation are statistically independent. That is the encoder learns to encode the input images into latent representations where a pre- defined attribute, such as ethnicity is separate from other attributes and also decorrelated from other attributes such that the latent representation 520 is separable into a latent repre- sentation 522 corresponding to the predetermined attribute and latent representation 524 cor- responding to all the other attributes. This step minimizes the correlation between the two components, preventing leakage of sensitive information. Then the output image 540 of the decoder 530 is used to determine a loss function to adapt the weights of the ANN 500. The loss function for training the ANN 500 may be composed of several components comprising: utility loss, and adversarial loss. The utility loss may ensure that the generated image 540 closely resembles the input image 510, except for the sensitive attribute that has been altered. This loss can be determined by comparing the pixel- wise differences between the input image and the generated image, using metrics such as mean squared error or perceptual loss with a pre-trained network like VGG to capture high- level feature similarities. The adversarial loss involves an adversary network that tries to predict the sensitive attribute from the non-sensitive component. The adversary is trained using a standard classification loss, such as cross-entropy loss, by comparing the predicted sensitive attributes to the true labels. The same features (for example both parts of the latent representation, the first attribute 522 (sensitive data) and the other attributes 524 (non- sensitive data)) are input to the adversary loss and the utility loss. The loss function then trains the ANN 500 to disentanglement them. This also ensures that the sensitive compo- nents 522 and the non-sensitive components 524 of the latent representation are statistically independent. This is achieved by measuring the mutual information between these compo- nents and minimizing it, ensuring no sensitive information leaks into the non-sensitive part. Meanwhile, the main model is trained to maximize this adversarial loss, thereby making it difficult for the adversary to correctly predict the sensitive attribute from the non-sensitive component. By balancing these losses, the ANN 500 learns to generate images that are accu- rate reconstructions while ensuring sensitive attributes are anonymized and not inferable from non-sensitive components. The decorrelation loss ensures that the sensitive components 522 and the non-sensitive com- ponents 524 of the latent representation are statistically independent. This is achieved by measuring the mutual information between these components and minimizing it, ensuring no sensitive information leaks into the non-sensitive part Further details and aspects are mentioned in connection with the examples described above or below. The example shown in Fig.5 may include one or more optional additional features corresponding to one or more aspects mentioned in connection with the proposed concept or one or more examples described above (e.g., Figs.1 - 4) or below (e.g., Figs.6 - 9). Fig. 6 illustrates an example of the ANN 600 in an inference phase. During inference, trained encoder 620 receives an input image with 610 comprising a person and encodes it into the latent space 622. The input image 610 may stem from a data base 602. The data base 602 may be used for training another ANN for another use case. The encoder 620 identifies the sensitive attributes in the latent representation 622 has separated and decorrelated (i.e., decoupled) them from the other, non-sensitive attributes in the latent representation 622. The first value of the sensitive attribute in the latent representation is then replaced with a second value, either by selecting the maximum distance value from a set of predetermined values or by using a lookup table. The adversary loss is implemented to degrade sensitive attribute recognition. The modified latent representation is fed into the decoder 630, which generates the output image 640. The result is an image that looks similar to the input 610 but with the sensitive attribute changed, ensuring the person's privacy is maintained and certain mandated and forced rules are complied with. This process ensures that the sensitive information is effectively anonymized while preserving the overall appearance and context of the original image. For example, the input image 610 is removed from the data base 602 and is replaced with the compliant output image 640. Further details and aspects are mentioned in connection with the examples described above or below. The example shown in Fig.6 may include one or more optional additional features corresponding to one or more aspects mentioned in connection with the proposed concept or one or more examples described above (e.g., Figs.1 - 5) or below (e.g., Figs.7 - 9). Fig. 7 illustrates an implementation setup of the ANN 500 or 600. The disclosed ANN 700 integrates Low-Rank Adaptation (LORA) layers into a neural network architecture featuring ResNet and Transformer blocks for enhanced adaptability and performance. The system be- gins with a LORA block, followed by a ResNet block that includes normalization, convolu- tion, temporal embedding layer normalization, dropout, additional convolution, and activa- tion functions. This is coupled with a Transformer block containing normalization, convolu- tion, multiple Transformer layers, and a final projection convolution. The system employs downsampling and upsampling convolution layers to resize the data, processing it through a sequence of stages that include initial convolution, cross-attention layers, and multiple Res- Net blocks. These stages are designed to handle input images with varying dimensions, en- suring efficient processing and transformation through the network. The processing pipeline of the ANN 700 includes three sets of cross-attention blocks operating on progressively re- duced dimensions, followed by downsampling through ResNet blocks and adaptive average pooling for data concatenation. The final stages involve upsampling using ResNet blocks, ensuring the data returns to its original resolution. Midway, the system integrates a Mid Cross Attention Transformer block with a ResNet block to maintain temporal coherence and enhance feature extraction. Residual connections are incorporated throughout the architec- ture to preserve essential information. This advanced configuration allows for precise and efficient anonymization and transformation of input images, making it suitable for privacy- preserving applications as described above. Fig. 8 illustrates a flowchart of an example of a method 800. The method 800 may, for in- stance, be performed by an apparatus as described herein, such as apparatus 100. The meth- od 800 comprises 810 identifying a person in an input image. The method 800 further com- prises 820 generating an output image based on the input image by an artificial neural net- work (ANN) the output image comprising a person based on the identified person of the in- put image. At least a first value of an attribute of the person from the input image being re- placed by a second value of the attribute in the person in the output image. More details and aspects of the method 800 are explained in connection with the proposed technique or one or more examples described above, e.g., with reference to Fig. 1. The method 800 may comprise one or more additional optional features corresponding to one or more aspects of the proposed technique, or one or more examples described above. Privacy-Preserving Activity Recognition using Virtual Humans and Masked Differen- tial Privacy Below a further image/video anonymization technique is proposed, which hides the identity of persons by replacing their bodies in the video/image with synthesized virtual avatars. However, because this doesn’t extend to the background, which could be informative for the target task but can still carry private information the present hybrid approach that combines anonymized videos/images as described above with differential privacy (DP). It is proposed that, instead of training the ANN with DP-SGD, which can be overly pessimistic in terms of privacy, DP is applied exclusively when learning from the background regions of the vid- eo/image, which are not protected by our anonymization technique. This approach allows to strike a better balance between utility and privacy compared to standard DP-SGD, as the DP noise doesn't significantly impact the human body regions, which are crucial for the activity recognition task. An apparatus may carry out the proposed technique. The apparatus may comprise circuitry that is configured to provide the functionality of the apparatus. The apparatus comprises a processing circuitry. For example, the processing circuitry may be a single dedicated proces- sor, a single shared processor, or a plurality of individual processors, some of which or all of which may be shared, a digital signal processor (DSP) hardware, an application specific in- tegrated circuit (ASIC), a neuromorphic processor or a field programmable gate array (FPGA). The processing circuitry may optionally be coupled to, e.g., memory such as read only memory (ROM) for storing software, random access memory (RAM) and/or non- volatile memory. For example, the apparatus may comprise memory configured to store in- structions, which when executed by the processing circuitry, cause the processing circuitry to perform the steps and methods described herein. For example, the circuitry may be configured to obtain an input image. The circuitry may be further configured to identify in the input image a first image portion and a second image portion anonymization, the first image portion being different from the second image por- tion. The circuitry may be further configured to generate an output image, by anonymizing the first image portion by a first ANN and by anonymizing the second image portion by a second ANN. The first image portion may comprise a person and/or the second image portion may com- prise a background. The first image portion is anonymized by generating a synthetic avatar of the person and replacing the person in input image with the synthetic avatar in the output image. The syn- thetic avatar has the same pose as the person in input image. The second portion is anonymized by adding noise to the background section. In some ex- amples the second portion is anonymized by blurring, obfuscation, suppression and/or add- ing gaussian/Laplacian noise to the background image. In some examples, the circuitry is further configured to detect a person and/or a background in the input image. In some examples, the circuitry is further configured to detect a pose of the person and ren- der a synthetic avatar with the same pose. In some examples, the circuitry is further configured to jointly optimize the first ANN and the second ANN. For example, persons and the background may be anonymized differently because humans contain sensitive personal information that needs complete anonymization by replacement with synthetic avatars, while the background may still contain identifiable information that requires selective obfuscation using Masked Differential Privacy to ensure overall privacy without compromising the utility of the non-sensitive parts of the video. The above described technique is described in more detail below: Privacy-preserving human action recognition is an important emerging problem in computer vision. The prevalent methods tackling this problem either use differential privacy or syn- thetically generated data to protect the privacy of individuals. In both cases, the utility of the trained model is sacrificed heavily to ensure privacy. In this work, we propose an effective approach to integrate both differentially private training and synthetic data generation in a seamless fashion with two core contributions: a data generation framework with a synthetic injection step that replaces real humans with realistic, temporally coherent synthesized virtu- al ones, and a differentially private training mechanism called masked differential privacy (MaskDP) operating selectively on the fused synthetic and real-world data. Experiments on four challenging action recognition datasets demonstrate that our proposed techniques result in better utility-privacy trade-offs compared to standard differentially private training in the _{especially demanding ^^ < 1 regime. Our codes and data generation framework will be made} publically available upon paper acceptance. Introduction: In the past two decades, human action recognition [94, 36, 8, 22] in videos has gained significant attention for its wide applications in video retrieval, behavior analysis, surveillance, and video understanding tasks. Despite notable progress in this field, concerns about data privacy have escalated as videos often contain sensitive information, such as hu- man faces and other personal attributes. Safeguarding individuals’ privacy rights in video understanding is not only a legal and ethical obligation but also a crucial necessity to build up user trust under regulatory frameworks, such as GDPR [63], CCPA [35], and EU AI Act [57]. Without rigorous privacy measures, there are substantial risks of misuse, emphasizing the need for effective privacy-preserving techniques. Fig. 9 illustrates the proposed a stage-I anonymization process. The stage-I anonymization process is segmented into distinct steps for optimal performance and privacy preservation: Circled 1 in Fig.9: Pose estimation is conducted using a 4D human model, essential for sub- sequent avatar rendering. Circled 2 in Fig.9: The original human figures are then removed and inpainted using MaskDino and E2FGVI algorithms. Circled 3 in Fig.9: A synthetic ava- tar is rendered to replace the human subject. Circled 4 in Fig. 9: The sanitized real-world video is merged with the generated avatar. Recent efforts to integrate privacy-preserving measures, either with formal or empirical guarantees, into computer vision algorithms operating on sensitive datasets can be broadly categorized into three types: (i) obfuscation-based approaches [19, 29], which hide spatial semantic information while retaining utility information through minimax optimization; (ii) training on purely synthetic data which aims to mimic real-world patterns [20, 33, 14, 90]; and (iii) training with Differential Privacy (DP) [50], which involves adding noise to input data, output labels, or model parameters. However, these methods have inherent limitations when applied to video understanding tasks. Synthetic data generation techniques struggle to capture the complexity and nuances of human behaviors, limiting their effectiveness in so- phisticated video understanding tasks. On the other hand, DP offers rigorous privacy guaran- tees but introduces noise during training which degrades model utility and accuracy. Striking _{a balance between privacy and utility remains a significant challenge, impeding the wide-} spread adoption of differentially private models in practical vision applications. Motivated by the above obstacles, we propose a new privacy-preserving framework for ac- tion recognition comprising two key components: (Stage-I) synthesizing virtual humans us- ing rendering engines, and (Stage-II) incorporating a differentially private mechanism that operates selectively on masks applied to fused synthetic and real-world data. More specifi- cally, in the first stage illustrated in Fig. 9, we introduce a synthetic injection process that replaces real humans with realistically rendered and temporally coherent virtual ones, allow- ing for generic video understanding while maintaining privacy of individuals apearing in the original videos. In the second stage, we train an activity recognition model on the resulting anonymized videos by decomposing each one into anonymized tokens representing the (vir- tual) human body and non-anonymized tokens representing the background. While anony- mized tokens carry no sensitive information due to the real humans having been already re- placed with synthesized ones, the non-anonymized background tokens can still leak private _{information. Therefore, we introduce a new relaxation of DP, called Masked Differential} Privacy (MaskDP) that exclusively obfuscates the non-anonymized tokens to ensure the pri- vacy of the remaining background elements that are less informative for activity recognition. The critical anonymized tokens, which are vital for activity recognition, remain untouched by our MaskDP training, allowing to achieve higher utility compared to standard DP. The main adavantage of this present technique is: ^ _{We provide a two-stage framework for accurate and privacy-preserving action recog-} nition in videos for humans. ^ _{We also provide a theoretical analysis of formal privacy guarantees of our training} pipeline by making connections between MaskDP and standard differential privacy. ^ _{We demonstrate that combining the two stages in our pipeline, i.e., synthesized virtu-} al humans with MaskDP, improves performance over the standard DP setting in the s_{trongly private low ^^ regime.} Previous approaches (Transformer-based Action recognition): Recent advancements have highlighted the versatility of Transformers [92], initially prominent in natural language pro- cessing and subsequently applied to vision tasks such as image classification [26], video cap- tioning [75], and multimodal representation learning [49, 42], extending to video classifica- tion [87, 3, 100]. In action recognition, models like STAM [79], ViVit [3], and MVT [100] leverage video frames for analysis, while STCA [23] focuses on contextual dynamics for temporal insights. Previous approaches (Privacy preserving action recognition): Recent privacy preservation techniques can be categorized into three major groups: downsampling-based approaches, obfuscation-based approaches, and adversarial training-based approaches. Downsampling based approaches anonymize data via low-resolution inputs, as shown by Chou et al. [13], Srivastava et al. [85], and Butler et al. [7]. Obfuscation-based approaches use off-the-shelf object detectors to identify privacy attributes and modify or remove the detected regions. Ren et al. [64] synthesize fake images in place of detected faces in action detection, and Zhang et al. [102] use semantic segmentation followed by blurring for video privacy preser- vation. Adversarial training approaches, such as those proposed by Pittaluga et al. and Xiao et al. for privacy preservation in images [60, 98], and a novel framework for privacy- preserving action recognition introduced by [96, 97], utilize a minimax optimization strate- gy where the action classification cost is minimized, while the privacy classification cost is maximized. MaSS [11] employs a framework similar to Wu et al. [96], but with the adapta- tion of a compound loss to selectively preserve specific attributes rather than eliminate them. STPrivacy [44] enhances this general framework by incorporating a transformer anonymiz- ing block to mask entire video tubelets. SPAct [19] obfuscates all spatial semantic infor- mation while keeping utility action information via minimax optimization. TeD-SPAD [29] builds on SPAct wherein they use NT-Xent [12] contrastive loss in the budget branch to mit- igate spatial privacy leakage. Recently, [51] showed differentially private training on video based action recognition. While that work bears similarities, their results are limited to a le- _{nient privacy budget of ^^ ∈ {5,10}. In this work we specifically target the feasibility of strongly private low ^^ ranges.} Previous approaches (Differential Privacy in Machine Learning): Differential Privacy (DP) [27] is a gold standard technique[21] for formalizing the privacy guarantees of algorithms operating on sensitive datasets and has been integrated into a variety of machine learning tasks, including image classification [1, 55, 89, 77, 105], activity recognition [50], language modeling [101, 82, 24], graph learning [71, 73, 72], and speech recognition [78]. The most popular method for training deep neural networks with DP is Differentially Private Stochas- tic Gradient Descent (DP-SGD) [1], which masks the contribution of any single data point to the model updates by clipping per-sample gradients and then adding Gaussian noise to the sum of the clipped gradients. However, this added noise often hampers optimization, leading to performance degradation compared to non-private training [25, 41]. To address this, vari- ous methods have been proposed to improve the utility of DP-SGD, including adaptive clip- ping [2], adaptive noise scaling [30], and gradient compression [93]. Alternatively, some works have proposed relaxed notions of DP to protect only a subset of the data or provide different privacy levels per each data attribute [34, 39, 82]. In contrast to these prior works, our work differs substantially in scope and technical approach. Our differentially private training scheme operates on masks selectively on the fused synthetic and real-world data, wherein we decompose each video into two parts (utility and non-anonymized tokens) and selectively apply DP only to the non-anonymized tokens. Previous approaches (Synthetic Data Generation for Human Action Recognition): The utili- zation of synthetic training data is a well-established practice across various computer vision domains, including object recognition, semantic segmentation, and body pose and shape es- timation, to enhance model performance and overcome data limitations [88, 10, 58, 66, 65, 53, 91, 62, 86, 59, 31, 56]. While common in these areas, the application of synthetic data in human activity recognition is relatively recent and limited. Notably, de Souza et al. pio- neered synthetic-to-real activity recognition with a generative framework that combines mo- tion capture data and computer graphics techniques to generate single-view videos depicting 35 different actions [20]. Subsequent research efforts have tailored synthetic activity exam- ples for specific domains, such as elderly assistance, recognition from new viewpoints, and unusual human activities [33, 90, 48, 74, 67]. Despite this abundance of work, existing da- tasets for synthetic-to-real activity recognition face limitations in terms of small size, limited captured classes, and domain-specific design [33, 20, 14]. In contrast, our proposed data generation framework (see sec:anonymization,sec:dp) aims to address these limitations to support both good generalization and large-scale applications for synthetic training data in activity recognition, incorporating diverse movements, body shapes, clothing styles, tex- tures, and backgrounds [62, 53, 5, 68, 10], position it to drive the development of new meth- ods for synthetic-to-real activity recognition, which significantly distinguishes it from previ- ous approaches [20, 90]. Preliminaries (Human Action Recognition): In this work, we focus on the task of human action recognition in videos, where the goal is to predict the correct action label for a given _{video sample. Formally, consider an activity recognition dataset ^^ comprising ^^ samples (^^^^, ^^^^) ∈ ^^, where ^^^^ ∈ ℝ^^×^^×^^×^^ sample of length ^^ and spatial dimensions ^^ × ^^ with ^^ channels, and ^^^^ ∈ {0,1}} ^{^^} is the corresponding one-hot encoded label vector _{denoting one of the ^^ activities. Our goal is to train a model ℳΘ to predict the correct label ^ ^^ for a given video sample ^^. To this end, we seek to minimize a loss function ℒ, given by: ℒ(ℳΘ ;^^) = ∑^^ ^^=1 ℓ(ℳΘ(^^^^),^^^^), (1) where ℳΘ(^^^^) represents the predicted action label for video sample ^^^^, ^^^^ is the ground truth label, and ℓ is a suitable loss function, such as cross-entropy. To preserve the privacy of} the training data, we propose a hybrid approach that combines the use of synthetic data and differential privacy. Next, we briefly review the concept of differential privacy and its appli- cation in deep learning. Preliminaries (Differential Privacy): Differential privacy (DP) [27] serves as a gold standard for ensuring the privacy of individuals’ sensitive data. In simple terms, DP ensures that the output of an algorithm remains consistent regardless of whether a specific individual’s data is included in the dataset. This means that an external observer who has access to the entire dataset except for one individual’s information cannot determine with high probability whether that specific individual’s data is part of the input. We provide a formal definition of DP below. _{Definition 1 (Differential Privacy [27]]): Given ^^ > 0 and ^^ > 0, a randomized algorithm ^^ satisfies (^^, ^^)-differential privacy, if for all possible pairs of adjacent datasets ^^ and ^^′ differing by at most one record, denoted as ^^ ∼ ^^′, and for any possible set of outputs ^^ ⊆} ^^^^^^^^^^(^^), we have: P_{r[^^(^^) ∈ ^^] ≤ ^^^^Pr[^^(^^′) ∈ ^^] + ^^. The parameter ^^ is referred to as the “privacy budget” or “privacy cost,” which balances the trade-off between privacy and utility. A smaller ^^ provides stronger privacy guarantees but might result in reduced utility. The parameter ^^ serves as a small failure probability, ensur-} ing the robustness of the privacy mechanism. Training differential private neural networks: In the context of deep learning, DP techniques are employed during the model training process to protect the privacy of training data. The most popular algorithm, Differentially Private Stochastic Gradient Descent (DP-SGD) [1], involves adding carefully calibrated noise to the clipped gradients computed during training, obscuring the contribution of individual data points to the model updates. More specifically, for a randomly sampled mini-batch at each training iteration, DP-SGD computes per-sample gradients, clips them to a maximum norm, and then adds Gaussian noise to the average of the clipped gradients over the mini-batch. The resulting noisy gradients are then used to up- _{date the model parameters. The final privacy cost of DP-SGD (i.e., the value of ^^ for any given ^^) can then be computed based on the contributing factors, such as the noise scale,} batch size, clipping norm, and the total number of training iterations, using a privacy ac- counting method, such as the moment accountant [1, 95] or the Fourier accountant [38, 103]. This may be carried out according to an Algorithm 1 for Virtual Human Replacement (Stage-I)): The Algorithm 1 may receive a raw video dataset, a pose estimation function, a rendering function, a person segmentation function and/or a video inpainting function. The Algorithm may anonymized the received video Dataset by rendering the avatar and replacing the removed person. In another embodiment Algorithm 1 may be an improved Algorithm 1 comprising a method and technique as described with regards to Figs.1 to 6 (privacy preser- vation) may be used. In this improved method instead of rendering, an approach that com- bines rendering and stable diffusion (see details above) may be used. _{Method: Reducing ^^ towards stronger privacy guarantees as for ^^ ∈ [0,1] comprises exces-} sive noise addition, leading to prohibitive utility loss. Hence, we propose a two-stage pipe- line to maintain privacy and utility in the low-^^ regime. Below (see section “Synthesizing Virtual Humans for Anonymization (Stage-I)”) we introduce our anonymization stage, which hides the identity of individuals by replacing their bodies with synthesized virtual ones. Considering a dataset of raw video samples, each video contains regions that represent a human and are thereby considered to be highly sensitive while at the same time containing integral information for human action recognition. In order to avoid the application of low-^^ noise for gradients affecting such image regions, we opt for replacing these regions com- pletely with a synthetic avatar performing the same actions in place of the real human. Be- low (see section “Masked Differentially Private Training (Stage-II)”) we present a private learning algorithm that uses the knowledge of non-sensitive video regions to minimize train- ing noise. By leveraging the knowledge about pixel-wise region replacement, each video sample is partitioned into two subsets: the first contains the original non-anonymized back- ground regions, and the second comprises previously sensitive but now anonymized data. _{We then propose Masked Differential Privacy, allowing selective application of DP only to} the first subset, while the second subset undergoes standard learning for maintaining higher utility. Fig.10 illustrates sample frames from a real video (i) and output video from the anonymiza- tion pipeline (iv). We also highlight the corresponding depth maps and synthesized virtual humans used to generate the final anonymized real video. Synthesizing Virtual Humans for Anonymization (Stage-I): We illustrate our end-to-end anonymization pipeline in Fig. 9 and list a more detailed description in _{alg:DataAnonymization. Provided a 2D video recording ^^^^, we leverage [32] as our 3D pose estimation function ^^pos (Fig. 9, circled 1) to acquire high-quality temporally consistent hu-} man motion information. While we find that this method may occasionally fail in scenarios with strong occlusions, it generally yields reliable results due to its usage of temporal infor- mation and is applicable to a wide range of data. Rendering a synthetic human in place is not sufficient to completely hide a person in videos, since the generated avatar might not align with the original human contour in all cases. For this reason, we additionally apply an _{inpainting function [46] (Fig. 9, circled 2), which removes the original person from the video before adding the virtual one, based on the mask ^^^^ provided by a segmentation func- tion ^^seg [43] which detects human presence regions in each frame. For integrating a synthet- ic human into scenes, we developed our own data synthesizer ^^ren (Fig. 9, circled 3) in con-} trast to using a commercial rendering engine, specifically for the capability to deploy our framework as an end-to-end solution in a headless computation setting. For human body parametrization, we leverage the SMPL-H body model [47, 69], which offers flexibility, allowing adjustments in character attributes, such as height and body shape. Person diversity can easily be provided by textures as well as a variation of SMPL parameters. In our experi- ments, we apply 32 virtual humans of diverse ages and ethnicities, but much larger sets of _{characters can easily be integrated. ^^ren also provides us with depth maps and perfect pixel- wise masks ^^^^, separating rendered anonymized humans from (potentially sensitive) back- ground. ^^^^ is different from the sanitization mask ^^^^, since it describes pixel-wise synthetic data presence, while the ^^^^ describes any pre-existing human presence, even if a valid pose} and thereby a rendered human might not subsequently be generated. Any eventual flaws in recognition of sensitive regions only affect task utility in this setup, since all non-synthesized regions will automatically be subject to subsequent masked differentially private training explained above. Finally, a merging operation (Fig. 9, circled 4) combines the sanitized con- text information with the rendered human avatar, resulting in our anonymized dataset. Masked Differentially Private Training (Stage-II): Our video anonymization technique hides the identity of individuals by replacing their bodies with synthesized virtual humans. How- ever, this doesn’t extend to the background, which could be informative for the target task but can still carry private information. To tackle this limitation, in this section, we present a hybrid approach that combines anonymized videos from the previous stage with differential privacy (DP). The idea is that, instead of training the model with DP-SGD, which can be overly pessimistic in terms of privacy, we apply DP exclusively when learning from the background regions of the video, which are not protected by our anonymization technique. This approach allows us to strike a better balance between utility and privacy compared to standard DP-SGD, as the DP noise doesn’t significantly impact the human body regions, which are crucial for the activity recognition task. Masked Differential Privacy: Here, we introduce Masked Differential Privacy (MaskDP) to formally analyze the privacy guarantees of an algorithm that offers exclusive protection of specific components of individual data points, rather than the entire record. To this end, we first define the notion of masked adjacency, which is the key concept in our definition of MaskDP: _{Definition 2 (Masked Adjacency): Let ^^ = be a dataset of size ^^, where each record ^^(^^) = {^^(^^) 1 , … , is partitioned into ^^ tokens. Let ^^msk:^^ → {0,1} be a mask func- tion indicating which tokens are protected, where ^^ is the token space = 1 and only is protected. Consider another dataset ^^′ = and for all ^^ {1, … , ^^}, let ^^ = {^^ ∈ [ (^^) (^^) ^^ ^^]:^^msk(^^^^ ) = 1or^^msk(^^′^^ ) = 1}. Then ^^ is masked-adjacent to ^^′, denoted as ^^ ∼m ^^′, if and only if ∃^^ ∈ [^^] such that} s_{uch (^^)} ^{(^^)} _{that ^^^^ ≠ ^^′} In some examples, this may be carried out as described in the pseudo-code (Algorithm 2 Anonymization-Enhanced MaskDP-SGD (Stage-II)): I_{nput: Raw Video Dataset ^^ = {(x1, y1), … , (x^^ , y^^)}; Task model ℳΘ with parame- ters Θ; Video tokenizer function ^^tok; Loss function ℒ; Number of epochs ^^; Batch size ^^; Gradient clipping threshold ^^; noise standard deviation ^^; Learning rate ^^; Result: MaskDP Trained model ℳΘ Obtain the anonymized dataset ^^′′ = {(x^1, r1, y1), … , (x^^^ , r^^ , y^^)} from ^^ using Al-} gorithm 1 I_{nitialize Θ randomly for ^^ ∈ [^^ ⋅ ^^} ℬ_{] do Sample a batch by selecting each ^^ ∈ [^^] independently with} ^^^^ f_{or ^^ ∈ ℬ^^ do} //Tokenize video into background and virtual human tokens ^^⁽ b^{^} g^{^,^^)},^^_{(^^,^^) vh ← ^^tok(x^^^, r^^)} //Compute gradients for both token sets //Clip gradients of background tokens end //Compute total gradient, add noise, and update parameters end r_{eturn ℳΘ Intuitively, when two datasets ^^ and ^^′ are masked adjacent, it implies that they are almost} identical except in one record, where a change occurs only in the tokens that are specifically _{marked as sensitive by the mask function ^^msk. Based on the above definition, we can now} formally define: _{Definition 3 (Masked Differential Privacy (MaskDP): Given ^^ > 0, ^^ > 0, and mask func- tion ^^msk, a randomized algorithm ^^ satisfies (^^, ^^)-MaskDP, if for all possible pairs of masked adjacent datasets ^^ ∼m ^^′ under ^^msk, and for any possible set of outputs ^^ ⊆} ^^^^^^^^^^(^^), we have: P_{r[^^(^^) ∈ ^^] ≤ ^^^^Pr[^^(^^′) ∈ ^^] + ^^.} This definition formalizes the idea that privacy protection targets specific components within individual records, as opposed to protecting each record in its entirety. In the context of hu- man action recognition, this implies the ability to protect designated regions of a video sam- ple, such as the background, rather than the entire video. This is particularly useful in our setting, where we aim to protect the privacy of individuals portrayed in videos using our util- ity-friendly anonymization technique while applying MaskDP to the remaining regions of the video to ensure the privacy of the background. Fig.11 illustrates the Stage-II of the proposed framework. This consists of the training algo- rithm, which partitions training data into anonymized virtual human and non-anonymized background regions based on pixel-wise anonymization masks resulting from Stage-I. This hybrid approach enhances action recognition capabilities while maintaining stringent privacy safeguards. Remark: Note that the only distinction between standard DP and MaskDP lies in the concept of dataset adjacency. As a result, fundamental properties of DP, including post-processing, composition, and privacy amplification theorems [27, 1, 95], also hold for MaskDP as they do not depend on any specific definition of adjacency. Moreover, the above definition readi- ly extends to other variants of DP, such as Renyi DP [54], only by considering def:maskedadj as the notion of adjacency between datasets. Learning with MaskDP: Above it is presented our proposed framework called Anonymiza- tion-Enhanced MaskDP-SGD, designed for training robust privacy-preserving activity recognition models on sensitive video datasets. The algorithm takes as input a raw video _{dataset ^^ and outputs a trained model ℳΘ that can be used to predict the correct action label} for a given video sample. The process begins by anonymizing the raw video dataset using alg:DataAnonymization to conceal the identities of real humans. Subsequently, the model parameters are iteratively updated. At each iteration, we sample a batch from the anony- _{mized dataset, where each sample consists of an anonymized video sequence ^ ^^, along with the corresponding anonymized regions ^^, and the ground truth label ^^. The algorithm em- ploys a video tokenizer function ^^tok to tokenize each video sample into anonymized tokens ^^vh consisting of the virtual human body regions, and non-anonymized tokens ^^bg represent-} ing the background regions, which we aim to protect with MaskDP. The algorithm then _{computes the gradients of the model’s loss function for both ^^vh and ^^bg token sets. Howev- er, only the gradients of background tokens ^^bg are clipped to bound their contribution to the} model update. Gaussian noise is then added to the sum of the anonymized tokens’ gradients and clipped non-anonymized tokens’ gradients to ensure MaskDP. Finally, the model pa- rameters are updated using the noisy gradients. The following theorem analyzes the privacy cost of our proposed algorithm. The proof is deferred to the supplementary. _{Theorem 1: Given a dataset ^^ of size ^^, batch-size ^^ < ^^, number of training epochs ^^, gradient clipping threshold ^^ > 0, and Gaussian noise standard deviation ^^ > 0, alg:ModelTraining satisfies (^^, ^^)-MaskDP for any given ^^ ∈ (0,1), where:} − _{(log^^ + log^^)(^^ − 1), providing that the labels are not protected, i.e., ^^msk(^^) = 0.} Experiments: In this section, we evaluate both our anonymization pipeline as well as the end-to-end performance of our framework with MaskDP in comparison to standard differen- tially private training (DP-SGD) on real-world data. This work relies on provable privacy guarantees, therefore we follow similar work [1, 51] and focus our experiments on the utility _{privacy tradeoff given a certain privacy budget ^^, rather than trying to approximate effective} privacy with simulated attacks. Datasets: Our experiments target a range of diverse and common human activity recognition datasets. NTU RGB+D [76] is a balanced dataset containing 56K video samples labeled with 60 action categories and recorded in a very controlled manner in front of an office back- ground which contains little information about actions performed. Toyota Smarthome [16] contains over 16K video clips containing activities of 30 daily living performed by multiple actors within an apartment which results in background and context information being de- scriptive of the performed activity. HMDB-51 [40] and UCF-101[84] are comparatively small activity recognition datasets containing videos of actions performed in complex envi- ronments, partially related to the labelled action and partially unrelated. While the utility on NTU RGB+D as well as HMDB-51 and UCF-101 is measured by action classification accu- racy, Toyota Smarthome is a highly unbalanced dataset and evaluation is commonly by mean per-class accuracy (mPCA). Implementation Details: We utilize MViTv2-S[45] for action classification with Kinetics- 400 [37] pre-trained weights, selectively fine-tuned using DP-SGD, similar to [51]. This approach maintains higher utility than full fine-tuning, as DP-SGD may erode prior knowledge. MViTv2S, a Transformer model, uses LayerNorm instead of BatchNorm to meet the requirements of differential privacy. Experiments are conducted with batch size 128, employing (Masked) DP-SGD with a clipping threshold of 1 and a 0.01 learning rate over 150 epochs. The training includes a 20-epoch warmup and a 130-epoch cosine decay. Non- private training uses standard SGD with identical parameters. Data augmentation is used in non-private training but was excluded in our privacy-focused training since the noise added _{during training already acts as a regularizer. We set ^^ for (Masked) DP-SGD at 10−6 for NTU RGB+D and 10−5 for Toyota Smarthome, HMDB-51 and UCF-101. We use Opacus to implement (Masked) DP-SGD and report results for multiple ^^ in all DP-related experi- ments. For each ^^ values, we calibrate the noise multiplier to achieve the desired privacy} level. Further information on implementation details are listed in the supplementary. MaskDP on Human Action Recognition: In order to evaluate synthetic avatar anonymization as well as Masked Differential Privacy (MaskDP) from Sections above, we perform experi- _{ments with varying ^^ on combinations of fully real-world and person-anonymized data as} well as normal differential privacy (DP) and MaskDP. Note that DP or MaskDP on anony- mized data is only required when background information is considered sensitive, since Stage-I anonymization might otherwise be sufficient on its own. We compare training on anonymized and non-anonymized datasets and report the non-private training results (indi- _{cated by ^^ = ∞) as an upper bound. Table 1 displays our results on NTU RGB+D[76] as} well as Toyota Smarthome [16] Two competing effects are visible, a fixed loss of perfor- mance by switching from purely real world to anonymized data as well as a loss of perfor- _{mance with progressively tighter privacy bound ^^. While MaskDP needs to be applied on anonymized data, it is less sensitive in regard to ^^ and outperforms DP on non-anonymized for ^^ < 0.75, similarly MaskDP outperforms DP on real world data for ^^ < 1 on Toyota} Smarthome. The effect of the domain gap between fully real world and anonymized data is crucial, to display it, we also applied MaskDP on non-anonymized data, utilizing the person masks from our anonymization pipeline and find that performance significantly increases in _{all settings, e.g. from 35.5 % to 60.8 % on NTU RGB+D for ^^ = 0.5.} Table 1 below illustrates the accuracy for NTU RGB+D and mean Per Class Accuracy for Toyota Smarthome contrasting the model’s performance with synthetic and anonymized data under Differential Privacy (DP) and Masked Differential Privacy (MaskDP) across various epsilon values. _{[⋆] Real human visible, non-private, listed to show domain gap.} Table 1 Table 2 below illustrates the accuracy on HMDB-51 and UCF-101 contrasting the model’s performance with synthetic and anonymized data under Differential Privacy (DP) and Masked Differential Privacy (MaskDP) across various epsilon values. Table 2 Table 3 below illustrates the performances on NTU RGB+D and Toyota Smarthome (TS) without differentially private training using partial fine-tuning. Table 3 Dataset Anonymization: In table 3 ablate compositions of real world and synthetic data to increase transparency in regards to domain gap as well as the importance of context infor- mation. Training on synthetic avatar movements alone provides strong privacy but is subject to a strong degradation of performance, especially on a more complicated dataset like Toyota Smarthome, which includes strongly varying perspectives and occlusion where utility is re- duced down to a prohibitive 8.8% accuracy, NTU RGB+D consists of strongly controlled settings, rendering this effect less dominant. Our framework completely replaces the original human in the scene, maintaining both, human-level privacy as well as context-based utility. While this does not reach the utility of real-world unprotected data due to the synthetic-to- real domain gap, training with anonymized data becomes viable when providing real-world context. These findings align with NTU RGB+D being a dataset with actions recorded out of context, while Toyota Smarthome displays activities of daily living in a realistic environ- ment. Conclusion: Our work addresses the crucial emerging problem of privacy-preserving action recognition. We introduce a novel approach that seamlessly integrates differentially private training with synthetic data, prioritizing privacy preservation while maintaining utility. Our key contributions include a synthetic injection step, replacing real people with realistic syn- thesized virtual humans, and a new differentially private mechanism named MaskDP, oper- ating selectively on fused synthetic and real-world data. Empirical evaluations showed that our approach exhibits superior utility vs. privacy trade-off in strongly private setups. In the following, some examples of the proposed concept are presented: An example (e.g., example 1) relates to an apparatus comprising circuitry configured to iden- tify a person in an input image, generate an output image based on the input image by an artificial neural network, ANN, the output image comprising a person based on the identified person of the input image, wherein at least a first value of an attribute of the person from the input image being replaced by a second value of the attribute in the person in the output im- age. Another example (e.g., example 2) relates to a previous example (e.g., example 1) or to any other example, further comprising that the circuitry is further configured to generate a syn- thetic image of a person based on a model of the person from the input image, generate a second image based on the input image by replacing the person from the input image with the synthetic image of the person, and generate the output image based on the second image by the ANN, wherein the image generation is conditioned on at least one of a background of the input image, the model of the person, a pose of the person, a depth map of the input im- age, or an input prompt. Another example (e.g., example 3) relates to a previous example (e.g., one of the examples 1 to 2) or to any other example, further comprising that the generation of the output image is conditioned on using at least one of the background of the input image, the model of the per- son, the pose of the person or the depth map of the input image as input into the ANN. Another example (e.g., example 4) relates to a previous example (e.g., one of the examples 2 to 3) or to any other example, further comprising that circuitry is further configured to en- code, by the ANN, the second image into a latent representation. Another example (e.g., example 5) relates to a previous example (e.g., example 4) or to any other example, further comprising that the generation of the output image is conditioned by concatenating at least one of the background of the input image, the model of the person, the pose of the person or the depth map of the input image with the latent representation and using the concatenation as input into the ANN. Another example (e.g., example 6) relates to a previous example (e.g., one of the examples 2 to 5) or to any other example, further comprising that the model is a 3D mesh of the person. Another example (e.g., example 7) relates to a previous example (e.g., one of the examples 2 to 6) or to any other example, further comprising that generating the synthetic image of the person comprises a rendering the model of the person. Another example (e.g., example 8) relates to a previous example (e.g., one of the examples 2 to 7) or to any other example, further comprising that the circuity is further configured to identify a pose of the person. Another example (e.g., example 9) relates to a previous example (e.g., one of the examples 2 to 8) or to any other example, further comprising that the circuity is further configured to remove the person from the input image. Another example (e.g., example 10) relates to a previous example (e.g., example 9) or to any other example, further comprising that the circuity is further configured to generate a seg- mentation mask of the input image with regards to person and remove the person from the input image based on the segmentation mask. Another example (e.g., example 11) relates to a previous example (e.g., one of the examples 9 or 10) or to any other example, further comprising that generating the second image com- prises to reconstruct the parts of the image where the person was removed. Another example (e.g., example 12) relates to a previous example (e.g., example 11) or to any other example, further comprising that the reconstruction is based on extrapolation of another image being similar to the input image and/or on an area within the input image be- ing adjacent to removed person area. Another example (e.g., example 13) relates to a previous example (e.g., one of the examples 2 to 12) or to any other example, further comprising that the input image is part of a video sequence, and the circuity is further configured to generate the output image based on the second image by the ANN, wherein the generation of the output image is further conditioned on an image being a previous image of the input image within the video sequence. Another example (e.g., example 14) relates to a previous example (e.g., one of the examples 1 to 13) or to any other example, further comprising that the person is identified by the ANN. Another example (e.g., example 15) relates to a previous example (e.g., one of the examples 1 to 14) or to any other example, further comprising that the ANN comprises at least one of a generative ANN, a stable diffusion or generative adversarial network, GAN. Another example (e.g., example 16) relates to a previous example (e.g., one of the examples 1 to 15) or to any other example, further comprising that input image is part of a training data set of images, and wherein the circuitry is further configured to replace the input image in the training data set with the output image. Another example (e.g., example 17) relates to a previous example (e.g., one of the examples 1 to 16) or to any other example, further comprising that the circuitry is further configured to obtain a prompt input comprising a second value of the attribute to replace the at least one value of the attribute of the person from the input image in the output image. Another example (e.g., example 18) relates to a previous example (e.g., one of the examples 1 to 16) or to any other example, further comprising that to identify the person in the input image comprises to identify the first value of the attribute of the person in the input image, wherein the circuitry is further configured to generate the output image based on the input image by the ANN, wherein the output image comprises the person from the input image with the second value of the attribute, the second value of the attribute being different from the first value of the attribute. Another example (e.g., example 19) relates to a previous example (e.g., one of the examples 1 to 18) or to any other example, further comprising that the circuitry is further configured to encode, by the ANN, the input image into a latent representation. Another example (e.g., example 20) relates to a previous example (e.g., example 19) or to any other example, further comprising that values of the latent representation corresponding to the first value of the attribute are replaced by values corresponding to the second value of the attribute Another example (e.g., example 21) relates to a previous example (e.g., one of the examples 18 to 20) or to any other example, further comprising that the circuitry is further configured to decouple the first value of the attribute of the person in the input image from a value of a second attribute of the person in the input image. Another example (e.g., example 22) relates to a previous example (e.g., one of the examples 18 to 21) or to any other example, further comprising that the circuitry is further configured to decorrelate values of the latent representation corresponding to the first value of the at- tribute from one or more other values of the latent representation. Another example (e.g., example 23) relates to a previous example (e.g., one of the examples 18 to 22) or to any other example, further comprising that the decorrelation is based on an adversarial neural network. Another example (e.g., example 24) relates to a previous example (e.g., one of the examples 18 to 23) or to any other example, further comprising that the circuitry is further configured to determine the second value of the attribute such that a difference between the first value of the attribute and the second value of the attribute is maximized. Another example (e.g., example 25) relates to a previous example (e.g., one of the examples 19 to 24) or to any other example, further comprising that the circuitry is further configured to determine the values corresponding to the second value of the attribute, such that a differ- ence between the values of the latent representation corresponding to the first value of the attribute and the values of the latent representation corresponding to the second value of the attribute are maximized. Another example (e.g., example 26) relates to where the circuitry is further configured to identify the first value of the attribute of the person in the input image based on a label corre- sponding to the input image. Another example (e.g., example 27) relates to a previous example (e.g., one of the examples 1 to 26) or to any other example, further comprising that input image is part of a training data set if images, and wherein the circuitry is further configured to replace the input image in the training data set with the output image. Another example (e.g., example 28) relates to a previous example (e.g., one of the examples 18 to 27) or to any other example, further comprising that the ANN comprises at least one of a stable diffusion or generative adversarial network, GAN. Another example (e.g., example 29) relates to a previous example (e.g., one of the examples 18 to 28) or to any other example, further comprising that the input image comprising a face of a person. Another example (e.g., example 30) relates to a previous example (e.g., one of the examples 1 to 29) or to any other example, further comprising that the first and or the second attribute are at least one of ethnicity, gender, age, skin tone, appearance stereotype. An example (e.g., example 31) relates to a method comprising identifying a person in an input image, generating an output image based on the input image by an artificial neural network, ANN, the output image comprising a person based on the identified person of the input image, wherein at least a first value of an attribute of the person from the input image being replaced by a second value of the attribute in the person in the output image. Another example (e.g., example 32) relates to a non-transitory machine-readable medium having stored thereon a program having a program code for performing the method accord- ing to example 31 when the program is executed on a processor or a programmable hard- ware. Another example (e.g., example 33) relates to a program having a program code for perform- ing the method according to example 31, when the program is executed on a processor or a programmable hardware. An example (e.g., example 34) relates to an apparatus comprising circuitry configured to obtain an input image comprising a person, identify a first value of a attribute of the person in the input image, generate an output image based on the input image by an artificial neural network, ANN, the output image comprising the person with a second value of the attribute different from the first value of the attribute. An example (e.g., example 35) relates to a method comprising obtaining an input image comprising a person, identifying a first value of an attribute of the person in the input image, generating an output image based on the input image by an artificial neural network, ANN, the output image comprising the person with a second value of the attribute different from the first value of the attribute. An example (e.g., example 36) relates to an apparatus comprising circuitry configured to identify a person in an input image, generate a synthetic image of a person based on a model of the person from the input image, generate a second image based on the input image by replacing the person from the input image with the synthetic image of the person, and gener- ate an output image based on the second image by an ANN, wherein the image generation is conditioned on at least one of a background of the input image, the model of the person, a pose of the person or a depth map of the input image, an input prompt. An example (e.g., example 37) relates to a method comprising identifying a person in an input image, generating a synthetic image of a person based on a model of the person from the input image, generating a second image based on the input image by replacing the person from the input image with the synthetic image of the person, and generating an output image based on the second image by an ANN, wherein the image generation is conditioned on at least one of a background of the input image, the model of the person, a pose of the person or a depth map of the input image, an input prompt. The aspects and features described in relation to a particular one of the previous examples may also be combined with one or more of the further examples to replace an identical or similar feature of that further example or to additionally introduce the features into the fur- ther example. Examples may further be or relate to a (computer) program including a program code to exe- cute one or more of the above methods when the program is executed on a computer, proces- sor or other programmable hardware component. Thus, steps, operations or processes of dif- ferent ones of the methods described above may also be executed by programmed comput- ers, processors or other programmable hardware components. Examples may also cover pro- gram storage devices, such as digital data storage media, which are machine-, processor- or computer-readable and encode and/or contain machine-executable, processor-executable or computer-executable programs and instructions. Program storage devices may include or be digital storage devices, magnetic storage media such as magnetic disks and magnetic tapes, hard disk drives, or optically readable digital data storage media, for example. Other exam- ples may also include computers, processors, control units, (field) programmable logic arrays ((F)PLAs), (field) programmable gate arrays ((F)PGAs), graphics processor units (GPU), application-specific integrated circuits (ASICs), integrated circuits (ICs) or system-on-a-chip (SoCs) systems programmed to execute the steps of the methods described above. It is further understood that the disclosure of several steps, processes, operations or functions disclosed in the description or claims shall not be construed to imply that these operations are necessarily dependent on the order described, unless explicitly stated in the individual case or necessary for technical reasons. Therefore, the previous description does not limit the execution of several steps or functions to a certain order. Furthermore, in further examples, a single step, function, process or operation may include and/or be broken up into several sub- steps, -functions, -processes or -operations. If some aspects have been described in relation to a device or system, these aspects should also be understood as a description of the corresponding method. For example, a block, de- vice or functional aspect of the device or system may correspond to a feature, such as a method step, of the corresponding method. Accordingly, aspects described in relation to a method shall also be understood as a description of a corresponding block, a corresponding element, a property or a functional feature of a corresponding device or a corresponding sys- tem. The following claims are hereby incorporated in the detailed description, wherein each claim may stand on its own as a separate example. It should also be noted that although in the claims a dependent claim refers to a particular combination with one or more other claims, other examples may also include a combination of the dependent claim with the subject mat- ter of any other dependent or independent claim. Such combinations are hereby explicitly proposed, unless it is stated in the individual case that a particular combination is not intend- ed. Furthermore, features of a claim should also be included for any other independent claim, even if that claim is not directly defined as dependent on that other independent claim. References: [1] Abadi, M., Chu, A., Goodfellow, I., McMahan, H.B., Mironov, I., Talwar, K., Zhang, L.: Deep learning with differential privacy. In: Proceedings of the 2016 ACM SIGSAC con- ference on computer and communications security. pp.308–318 (2016) [2] Andrew, G., Thakkar, O., McMahan, B., Ramaswamy, S.: Differentially private learning with adaptive clipping. Advances in Neural Information Processing Systems 34, 17455– 17466 (2021) [3] Arnab, A., Dehghani, M., Heigold, G., Sun, C., Lučić, M., Schmid, C.: Vivit: A video vision transformer. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp.6836–6846 (2021) [4] Balle, B., Barthe, G., Gaboardi, M., Hsu, J., Sato, T.: Hypothesis testing interpretations and renyi differential privacy. In: International Conference on Artificial Intelligence and Statistics. pp.2496–2506. PMLR (2020) [5] Bhatnagar, B.L., Tiwari, G., Theobalt, C., Pons-Moll, G.: Multi-garment net: Learning to dress 3d people from images. In: Proceedings of the IEEE/CVF international conference on computer vision. pp.5420–5430 (2019) [6] Bruce, X., Liu, Y., Zhang, X., Zhong, S.h., Chan, K.C.: Mmnet: A model-based multi- modal network for human action recognition in rgb-d videos. IEEE Transactions on Pattern Analysis and Machine Intelligence 45(3), 3522–3538 (2022) [7] Butler, D.J., Huang, J., Roesner, F., Cakmak, M.: The privacy-utility tradeoff for re- motely teleoperated robots. In: Proceedings of the tenth annual ACM/IEEE international conference on human-robot interaction. pp.27–34 (2015) [8] Carreira, J., Zisserman, A.: Quo vadis, action recognition? a new model and the kinetics dataset. In: CVPR (2017) [9] Carreira, J., Zisserman, A.: Quo vadis, action recognition? a new model and the kinetics dataset. In: proceedings of the IEEE Conference on Computer Vision and Pattern Recogni- tion. pp.6299–6308 (2017) [10] Chang, A.X., Funkhouser, T., Guibas, L., Hanrahan, P., Huang, Q., Li, Z., Savarese, S., Savva, M., Song, S., Su, H., et al.: Shapenet: An information-rich 3d model repository. arXiv preprint arXiv:1512.03012 (2015) [11] Chen, C.F., Hu, S., Shi, Z., Gulati, P., Moriarty, B., Pistoia, M., Piuri, V., Samarati, P.: Mass: Multi-attribute selective suppression. arXiv preprint arXiv:2210.09904 (2022) [12] Chen, T., Kornblith, S., Norouzi, M., Hinton, G.: A simple framework for contrastive learning of visual representations. arXiv preprint arXiv:2002.05709 (2020) [13] Chou, E., Tan, M., Zou, C., Guo, M., Haque, A., Milstein, A., Fei-Fei, L.: Privacy- preserving action recognition for smart hospitals using low-resolution depth images. arXiv preprint arXiv:1811.09950 (2018) [14] da Costa, V.G.T., Zara, G., Rota, P., Oliveira-Santos, T., Sebe, N., Murino, V., Ricci, E.: Dual-head contrastive domain adaptation for video action recognition. In: Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision. pp. 1181–1190 (2022) [15] Das, S., Chaudhary, A., Bremond, F., Thonnat, M.: Where to focus on for human ac- tion recognition? In: 2019 IEEE Winter Conference on Applications of Computer Vision (WACV). pp.71–80. IEEE (2019) [16] Das, S., Dai, R., Koperski, M., Minciullo, L., Garattoni, L., Bremond, F., Francesca, G.: Toyota smarthome: Real-world activities of daily living. In: Proceedings of the IEEE/CVF international conference on computer vision. pp.833–842 (2019) [17] Das, S., Dai, R., Yang, D., Bremond, F.: Vpn++: Rethinking video-pose embeddings for understanding activities of daily living. IEEE Transactions on Pattern Analysis and Ma- chine Intelligence 44(12), 9703–9717 (2021) [18] Das, S., Sharma, S., Dai, R., Bremond, F., Thonnat, M.: Vpn: Learning video-pose em- bedding for activities of daily living. In: Computer Vision–ECCV 2020: 16th European Con- ference, Glasgow, UK, August 23–28, 2020, Proceedings, Part IX 16. pp. 72–90. Springer (2020) [19] Dave, I.R., Chen, C., Shah, M.: Spact: Self-supervised privacy preservation for action recognition. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp.20164–20173 (2022) [20] De Souza, C.R., Gaidon, A., Cabon, Y., Peña, A.M.L.: Procedural generation of videos to train deep action recognition networks. In: CVPR (2017) [21] De, S., Berrada, L., Hayes, J., Smith, S.L., Balle, B.: Unlocking high-accuracy differen- tially private image classification through scale. arXiv preprint arXiv:2204.13650 (2022) [22] Diba, A., Fayyaz, M., Sharma, V., Paluri, M., Gall, J., Stiefelhagen, R., Gool, L.V.: Large scale holistic video understanding. In: European Conference on Computer Vision. pp. 593–610. Springer (2020) [23] Diba, A., Sharma, V., Arzani, M., Van Gool, L.: Spatio-temporal convolution-attention video network. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp.859–869 (2023) [24] Dinh, M.H., Fioretto, F.: Context-aware differential privacy for language modeling. arXiv preprint arXiv:2301.12288 (2023) [25] Dörmann, F., Frisk, O., Andersen, L.N., Pedersen, C.F.: Not all noise is accounted equally: How differentially private learning benefits from large sampling rates. In: 2021 IEEE 31st International Workshop on Machine Learning for Signal Processing (MLSP). pp. 1–6. IEEE (2021) [26] Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., et al.: An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929 (2020) [27] Dwork, C., McSherry, F., Nissim, K., Smith, A.: Calibrating noise to sensitivity in pri- vate data analysis. In: Theory of cryptography conference. pp.265–284. Springer (2006) [28] Fan, H., Xiong, B., Mangalam, K., Li, Y., Yan, Z., Malik, J., Feichtenhofer, C.: Mul- tiscale vision transformers. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp.6824–6835 (2021) [29] Fioresi, J., Dave, I.R., Shah, M.: Ted-spad: Temporal distinctiveness for self- supervised privacy-preservation for video anomaly detection. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp.13598–13609 (2023) [30] Fu, J., Chen, Z., Han, X.: Adap dp-fl: Differentially private federated learning with adaptive noise. In: 2022 IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom). pp.656–663. IEEE (2022) [31] Ghezelghieh, M.F., Kasturi, R., Sarkar, S.: Learning camera viewpoint using cnn to improve 3d body pose estimation. In: 2016 fourth international conference on 3D vision (3DV). pp.685–693. IEEE (2016) [32] Goel, S., Pavlakos, G., Rajasegaran, J., Kanazawa, A., Malik, J.: Humans in 4d: Recon- structing and tracking humans with transformers. arXiv preprint arXiv:2305.20091 (2023) [33] Hwang, H., Jang, C., Park, G., Cho, J., Kim, I.J.: Eldersim: A synthetic data generation platform for human action recognition in eldercare applications. IEEE Access pp. 1–1 (2021). https://doi.org/10.1109/ACCESS.2021.3051842 [34] Jorgensen, Z., Yu, T., Cormode, G.: Conservative or liberal? personalized differential privacy. In: 2015 IEEE 31St international conference on data engineering. pp. 1023–1034. IEEE (2015) [35] of California Department of Justice (.gov), S.: California consumer privacy act (ccpa) (2023), https://oag.ca.gov/privacy/ccpa [36] Karpathy, A., Toderici, G., Shetty, S., Leung, T., Sukthankar, R., Fei-Fei, L.: Large- scale video classification with convolutional neural networks. In: CVPR (2014) [37] Kay, W., Carreira, J., Simonyan, K., Zhang, B., Hillier, C., Vijayanarasimhan, S., Vio- la, F., Green, T., Back, T., Natsev, P., et al.: The kinetics human action video dataset. arXiv preprint arXiv:1705.06950 (2017) [38] Koskela, A., Jälkö, J., Honkela, A.: Computing tight differential privacy guarantees using fft. In: International Conference on Artificial Intelligence and Statistics. pp. 2560– 2569. PMLR (2020) [39] Kotsogiannis, I., Doudalis, S., Haney, S., Machanavajjhala, A., Mehrotra, S.: One- sided differential privacy. In: 2020 IEEE 36th International Conference on Data Engineering (ICDE). pp.493–504. IEEE (2020) [40] Kuehne, H., Jhuang, H., Garrote, E., Poggio, T., Serre, T.: Hmdb: a large video data- base for human motion recognition. In: 2011 International conference on computer vision. pp.2556–2563. IEEE (2011) [41] Kurakin, A., Song, S., Chien, S., Geambasu, R., Terzis, A., Thakurta, A.: Toward train- ing at imagenet scale with differential privacy. arXiv preprint arXiv:2201.12328 (2022) [42] Lin, Y.B., Lei, J., Bansal, M., Bertasius, G.: Eclipse: Efficient long-range video retriev- al using sight and sound. arXiv preprint arXiv:2204.02874 (2022) [43] Li, F., Zhang, H., xu, H., Liu, S., Zhang, L., Ni, L.M., Shum, H.Y.: Mask dino: To- wards a unified transformer-based framework for object detection and segmentation (2022) [44] Li, M., Liu, J., Fan, H., Liu, J.W., Li, J., Shou, M.Z., Keppo, J.: Stprivacy: Spatio- temporal tubelet sparsification and anonymization for privacy-preserving action recognition. arXiv preprint arXiv:2301.03046 (2023) [45] Li, Y., Wu, C., Fan, H., Mangalam, K., Xiong, B., Malik, J., Feichtenhofer, C.: Mvitv2: Improved multiscale vision transformers for classification and detection. arxiv. arXiv pre- print arXiv:2112.01526 (2021) [46] Li, Z., Lu, C.Z., Qin, J., Guo, C.L., Cheng, M.M.: Towards an end-to-end framework for flow-guided video inpainting. In: IEEE Conference on Computer Vision and Pattern Recognition (CVPR) (2022) [47] Loper, M., Mahmood, N., Romero, J., Pons-Moll, G., Black, M.J.: SMPL: A skinned multi-person linear model. ACM Trans. Graphics (Proc. SIGGRAPH Asia) 34(6), 248:1– 248:16 (Oct 2015) [48] Ludl, D., Gulde, T., Curio, C.: Enhancing data-driven algorithms for human pose esti- mation and action recognition through simulation. IEEE transactions on intelligent transpor- tation systems 21(9), 3990–3999 (2020) [49] Luo, H., Ji, L., Zhong, M., Chen, Y., Lei, W., Duan, N., Li, T.: Clip4clip: An empirical study of clip for end to end video clip retrieval and captioning. Neurocomputing 508, 293– 304 (2022) [50] Luo, Z., Zou, Y., Yang, Y., Durante, Z., Huang, D.A., Yu, Z., Xiao, C., Fei-Fei, L., Anandkumar, A.: Differentially private video activity recognition. arXiv preprint arXiv:2306.15742 (2023) [51] Luo, Z., Zou, Y., Yang, Y., Durante, Z., Huang, D.A., Yu, Z., Xiao, C., Fei-Fei, L., Anandkumar, A.: Differentially private video activity recognition. In: Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision. pp.6657–6667 (2024) [52] Mahasseni, B., Todorovic, S.: Regularizing long short term memory with 3d human- skeleton sequences for action recognition. In: Proceedings of the IEEE conference on com- puter vision and pattern recognition. pp.3054–3062 (2016) [53] Mahmood, N., Ghorbani, N., Troje, N.F., Pons-Moll, G., Black, M.J.: AMASS: Ar- chive of motion capture as surface shapes. In: International Conference on Computer Vision. pp.5442–5451 (Oct 2019) [54] Mironov, I.: Rényi differential privacy. In: 2017 IEEE 30th computer security founda- tions symposium (CSF). pp.263–275. IEEE (2017) [55] Papernot, N., Song, S., Mironov, I., Raghunathan, A., Talwar, K., Erlingsson, Ú.: Scal- able private learning with pate. arXiv preprint arXiv:1802.08908 (2018) [56] Park, D., Ramanan, D.: Articulated pose estimation with tiny synthetic videos. In: Pro- ceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops. pp.58–66 (2015) [57] Parliament, E.: Eu ai act: first regulation on artificial intelligence (2023), https://www.europarl.europa.eu/news/en/headlines/society/20230601STO93804/eu-ai-act- first-regulation-on-artificial-intelligence [58] Peng, X., Usman, B., Kaushik, N., Wang, D., Hoffman, J., Saenko, K.: Visda: A syn- thetic-to-real benchmark for visual domain adaptation. In: Proceedings of the IEEE Confer- ence on Computer Vision and Pattern Recognition Workshops. pp.2021–2026 (2018) [59] Pishchulin, L., Jain, A., Andriluka, M., Thormählen, T., Schiele, B.: Articulated people detection and pose estimation: Reshaping the future. In: 2012 IEEE Conference on Comput- er Vision and Pattern Recognition. pp.3178–3185. IEEE (2012) [60] Pittaluga, F., Koppal, S., Chakrabarti, A.: Learning privacy preserving encodings through adversarial training. In: 2019 IEEE Winter Conference on Applications of Computer Vision (WACV). pp.791–799. IEEE (2019) [61] Ponomareva, N., Hazimeh, H., Kurakin, A., Xu, Z., Denison, C., McMahan, H.B., Vassilvitskii, S., Chien, S., Thakurta, A.G.: How to dp-fy ml: A practical guide to machine learning with differential privacy. Journal of Artificial Intelligence Research 77, 1113–1201 (2023) [62] Punnakkal, A.R., Chandrasekaran, A., Athanasiou, N., Quiros-Ramirez, A., Black, M.J.: Babel: bodies, action and behavior with english labels. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp.722–731 (2021) [63] Regulation, G.D.P.: General data protection regulation (gdpr)-official legal text (2023) (2023) [64] Ren, Z., Lee, Y.J., Ryoo, M.S.: Learning to anonymize faces for privacy preserving action detection. In: Proceedings of the european conference on computer vision (ECCV). pp.620–636 (2018) [65] Richter, S.R., Hayder, Z., Koltun, V.: Playing for benchmarks. In: Proceedings of the IEEE International Conference on Computer Vision. pp.2213–2222 (2017) [66] Richter, S.R., Vineet, V., Roth, S., Koltun, V.: Playing for data: Ground truth from computer games. In: Computer Vision–ECCV 2016: 14th European Conference, Amster- dam, The Netherlands, October 11-14, 2016, Proceedings, Part II 14. pp. 102–118. Springer (2016) [67] Roitberg, A., Schneider, D., Djamal, A., Seibold, C., Reiß, S., Stiefelhagen, R.: Let’s play for action: Recognizing activities of daily living by learning from life simulation video games. In: 2021 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS). IEEE (2021) [68] Rombach, R., Blattmann, A., Lorenz, D., Esser, P., Ommer, B.: High-resolution image synthesis with latent diffusion models (2021) [69] Romero, J., Tzionas, D., Black, M.J.: Embodied hands: Modeling and capturing hands and bodies together. ACM Transactions on Graphics, (Proc. SIGGRAPH Asia) 36(6) (Nov 2017) [70] Ryoo, M.S., Piergiovanni, A., Kangaspunta, J., Angelova, A.: Assemblenet++: Assem- bling modality representations via attention connections. In: Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XX 16. pp.654–671. Springer (2020) [71] Sajadmanesh, S., Gatica-Perez, D.: Locally private graph neural networks. In: Proceed- ings of the 2021 ACM SIGSAC Conference on Computer and Communications Security. pp. 2130–2145. CCS ’21, Association for Computing Machinery, New York, NY, USA (2021). https://doi.org/10.1145/3460120.3484565 [72] Sajadmanesh, S., Gatica-Perez, D.: Progap: Progressive graph neural networks with differential privacy guarantees. arXiv preprint arXiv:2304.08928 (2023) [73] Sajadmanesh, S., Shamsabadi, A.S., Bellet, A., Gatica-Perez, D.: GAP: Differentially private graph neural networks with aggregation perturbation. In: 32nd USENIX Security Symposium (USENIX Security 23). pp. 3223–3240. USENIX Association, Anaheim, CA (Aug 2023) [74] Schneider, D., Keller, M., Zhong, Z., Peng, K., Roitberg, A., Beyerer, J., Stiefelhagen, R.: SynthAct: Towards Generalizable Human Action Recognition based on Synthetic Data (2023) [75] Seo, P.H., Nagrani, A., Arnab, A., Schmid, C.: End-to-end generative pretraining for multimodal video captioning. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp.17959–17968 (2022) [76] Shahroudy, A., Liu, J., Ng, T.T., Wang, G.: Ntu rgb+ d: A large scale dataset for 3d human activity analysis. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp.1010–1019 (2016) [77] Shamsabadi, A.S., Papernot, N.: Losing less: A loss for differentially private deep learning. Proceedings on Privacy Enhancing Technologies (2021) [78] Shamsabadi, A.S., Srivastava, B.M.L., Bellet, A., Vauquier, N., Vincent, E., Maouche, M., Tommasi, M., Papernot, N.: Differentially private speaker anonymization. arXiv preprint arXiv:2202.11823 (2022) [79] Sharir, G., Noy, A., Zelnik-Manor, L.: An image is worth 16x16 words, what is a video worth? arXiv preprint arXiv:2103.13915 (2021) [80] Shi, L., Zhang, Y., Cheng, J., Lu, H.: Two-stream adaptive graph convolutional net- works for skeleton-based action recognition. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp.12026–12035 (2019) [81] Shi, L., Zhang, Y., Cheng, J., Lu, H.: Skeleton-based action recognition with multi- stream adaptive graph convolutional networks. IEEE Transactions on Image Processing 29, 9532–9545 (2020) [82] Shi, W., Cui, A., Li, E., Jia, R., Yu, Z.: Selective differential privacy for language modeling. arXiv preprint arXiv:2108.12944 (2021) [83] Sonoda, T., Grunnet-Jepsen, A.: Depth image compression by colorization for intel realsenseâ„¢ depth cameras. Intel RealSense (2020) [84] Soomro, K., Zamir, A.R., Shah, M.: Ucf101: A dataset of 101 human actions classes from videos in the wild. arXiv preprint arXiv:1212.0402 (2012) [85] Srivastav, V., Gangi, A., Padoy, N.: Human pose estimation on privacy-preserving low-resolution depth images. In: International conference on medical image computing and computer-assisted intervention. pp.583–591. Springer (2019) [86] Sun, B., Saenko, K.: From virtual to reality: Fast adaptation of virtual object detectors to real domains. In: BMVC. vol.1, p.3 (2014) [87] Sun, C., Myers, A., Vondrick, C., Murphy, K., Schmid, C.: Videobert: A joint model for video and language representation learning. In: Proceedings of the IEEE/CVF Interna- tional Conference on Computer Vision. pp.7464–7473 (2019) [88] Sun, M., Kohli, P., Shotton, J.: Conditional regression forests for human pose estima- tion. In: 2012 IEEE Conference on Computer Vision and Pattern Recognition. pp. 3394– 3401. IEEE (2012) [89] Tramer, F., Boneh, D.: Differentially private learning needs better features (or much more data). arXiv preprint arXiv:2011.11660 (2020) [90] Varol, G., Laptev, I., Schmid, C., Zisserman, A.: Synthetic humans for action recogni- tion from unseen viewpoints. In: IJCV (2021) [91] Varol, G., Romero, J., Martin, X., Mahmood, N., Black, M.J., Laptev, I., Schmid, C.: Learning from synthetic humans. In: Proceedings of the IEEE conference on computer vi- sion and pattern recognition. pp.109–117 (2017) _{[92] Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, Ł.,} Polosukhin, I.: Attention is all you need. Advances in neural information processing systems 30 (2017) [93] Wang, B., Wu, F., Long, Y., Rimanic, L., Zhang, C., Li, B.: Datalens: Scalable privacy preserving training via gradient compression and aggregation. In: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security. pp. 2146–2168 (2021) [94] Wang, H., Schmid, C.: Action recognition with improved trajectories. In: Proceedings of the IEEE international conference on computer vision. pp.3551–3558 (2013) [95] Wang, Y.X., Balle, B., Kasiviswanathan, S.P.: Subsampled rényi differential privacy and analytical moments accountant. In: The 22nd International Conference on Artificial In- telligence and Statistics. pp.1226–1235. PMLR (2019) [96] Wu, Z., Wang, H., Wang, Z., Jin, H., Wang, Z.: Privacy-preserving deep action recog- nition: An adversarial learning framework and a new dataset. IEEE Transactions on Pattern Analysis and Machine Intelligence 44(4), 2126–2139 (2020) [97] Wu, Z., Wang, Z., Wang, Z., Jin, H.: Towards privacy-preserving visual recognition via adversarial training: A pilot study. In: Proceedings of the European conference on com- puter vision (ECCV). pp.606–624 (2018) [98] Xiao, T., Tsai, Y.H., Sohn, K., Chandraker, M., Yang, M.H.: Adversarial learning of privacy-preserving and task-oriented representations. In: Proceedings of the AAAI Confer- ence on Artificial Intelligence. vol.34, pp.12434–12441 (2020) [99] Yang, D., Dai, R., Wang, Y., Mallick, R., Minciullo, L., Francesca, G., Bremond, F.: Selective spatio-temporal aggregation based pose refinement system: Towards understanding human activities in real-world videos. In: Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision. pp.2363–2372 (2021) [100] Yan, S., Xiong, X., Arnab, A., Lu, Z., Zhang, M., Sun, C., Schmid, C.: Multiview transformers for video recognition. In: Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition. pp.3333–3343 (2022) [101] Yu, D., Naik, S., Backurs, A., Gopi, S., Inan, H.A., Kamath, G., Kulkarni, J., Lee, Y.T., Manoel, A., Wutschitz, L., et al.: Differentially private fine-tuning of language models. arXiv preprint arXiv:2110.06500 (2021) [102] Zhang, Z., Cilloni, T., Walter, C., Fleming, C.: Multi-scale, class-generic, privacy- preserving video. Electronics 10(10), 1172 (2021) [103] Zhu, Y., Dong, J., Wang, Y.X.: Optimal accounting of differential privacy via charac- teristic function. In: International Conference on Artificial Intelligence and Statistics. pp. 4782–4817. PMLR (2022) [105] Zhu, Y., Yu, X., Chandraker, M., Wang, Y.X.: Private-knn: Practical differential pri- vacy for computer vision. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp.11854–11862 (2020)

Claims

Claims What is claimed is: _{1. An apparatus comprising circuitry configured to:} identify a person in an input image; generate an output image based on the input image by an artificial neural network, ANN, the output image comprising a person based on the identified person of the input image, wherein at least a first value of an attribute of the person from the input image being re- placed by a second value of the attribute in the person in the output image. _{2. The apparatus of claim 1, wherein the circuitry is further configured to:} generate a synthetic image of a person based on a model of the person from the input image; generate a second image based on the input image by replacing the person from the input image with the synthetic image of the person; and generate the output image based on the second image by the ANN, wherein the image gener- ation is conditioned on at least one of a background of the input image, the model of the per- son, a pose of the person, a depth map of the input image, or an input prompt. _{3. The apparatus of claim 1, wherein the generation of the output image is conditioned} on using at least one of the background of the input image, the model of the person, the pose of the person or the depth map of the input image as input into the ANN. _{4. The apparatus of claim 2, wherein circuitry is further configured to encode, by the} ANN, the second image into a latent representation. _{5. The apparatus of claim 4, wherein the generation of the output image is conditioned} by concatenating at least one of the background of the input image, the model of the person, the pose of the person or the depth map of the input image with the latent representation and using the concatenation as input into the ANN. _{6. The apparatus of claim 2, wherein the model is a 3D mesh of the person.}

_{7. The apparatus of claim 2, wherein generating the synthetic image of the person com-} prises a rendering the model of the person. _{8. The apparatus of claim 2, wherein the circuity is further configured to remove the} person from the input image. _{9. The apparatus of claim 1, wherein the input image is part of a video sequence, and} the circuity is further configured to generate the output image based on the second image by the ANN, wherein the generation of the output image is further conditioned on an image being a previous image of the input image within the video sequence. 10. The apparatus of claim 1, wherein the circuitry is further configured to obtain a prompt input comprising a second value of the attribute to replace the at least one value of the attribute of the person from the input image in the output image. 11. An apparatus of claim 1, wherein to identify the person in the input image comprises to identify the first value of the attribute of the person in the input image; wherein the cir- cuitry is further configured to generate the output image based on the input image by the ANN, wherein the output image comprises the person from the input image with the second value of the attribute, the second value of the attribute being different from the first value of the attribute. 12. The apparatus of claim 11, wherein the circuitry is further configured to encode, by the ANN, the input image into a latent representation. 13. The apparatus of any claim 11, wherein values of the latent representation corre- sponding to the first value of the attribute are replaced by values corresponding to the second value of the attribute 14. The apparatus of claim 11, wherein the circuitry is further configured to decouple the first value of the attribute of the person in the input image from a value of a second attribute of the person in the input image. 15. The apparatus of claim 12, wherein the circuitry is further configured to determine the values corresponding to the second value of the attribute, such that a difference between the values of the latent representation corresponding to the first value of the attribute and the values of the latent representation corresponding to the second value of the attribute are max- imized. 16. The apparatus of claim 11, where the circuitry is further configured to identify the first value of the attribute of the person in the input image based on a label corresponding to the input image. 17. The apparatus of claim 1, wherein input image is part of a training data set if images; and wherein the circuitry is further configured to replace the input image in the training data set with the output image. 18. The apparatus of claim 1, wherein the ANN comprises at least one of a stable diffu- sion or generative adversarial network, GAN. 19. The apparatus of claim 1, wherein the first and or the second attribute are at least one of ethnicity, gender, age, skin tone, appearance stereotype. 20. A method comprising: identifying a person in an input image; generating an output image based on the input image by an artificial neural network, ANN, the output image comprising a person based on the identified person of the input image, wherein at least a first value of an attribute of the person from the input image being re- placed by a second value of the attribute in the person in the output image.