Recent studies have demonstrated external information leakage (EIL) attacks which allow an attacker to infer various sensitive implicit properties related to a machine learning (ML) model’s training data. Most of those attacks assumed 1) a white-box scenario in which the attacker has complete access to the ML model, its structure, and its parameters, or 2) a black-box (alternatively gray-box) scenario with non-realistic requirements such as a high query budget or high computational resources for the attacker. In this paper, we propose two practical query-based (i.e., black-box) EIL attacks that target face recognition ML models and allow an attacker to infer sensitive implicit properties, such as the facial characteristics, gender, ethnicity, income level, and average age of the individuals in the training data, with a limited number of queries. The first proposed attack, referred to as the random noise injection (RNI) attack, exploits the effect of injecting random noise into input samples on the target model’s predictions. The second proposed attack, referred to as the property substitute model (PSM) attack, creates a substitute model for each property value examined, whose predictions are compared to the target model’s predictions. Our comprehensive evaluation (a total of 730 experiments) performed on the CelebA dataset shows that the proposed attacks outperform existing EIL attacks and successfully infer private information, posing a threat to the privacy and security of the face recognition models.

In this paper, we present an end-to-end domain adaptation technique that utilizes both feature distribution alignment and Self-Training effectively for object detection. One set of methods for domain adaptation relies on feature distribution alignment and adapts models on an unlabeled target domain by learning domain invariant representations through adversarial loss. Although this approach is effective, it may not be adequate or even have an adverse effect when domain shifts are large and inconsistent. Another set of methods utilizes Self-Training which relies on pseudo labels to approximate the target domain distribution directly. However, it can also have a negative impact on the model performance due to erroneous pseudo labels. To overcome these two issues, we propose to generate reliable pseudo labels through feature distribution alignment and data distillation. Further, to minimize the adverse effect of incorrect pseudo labels during Self-Training we employ interpolation-based consistency regularization called mixup. While distribution alignment helps in generating more accurate pseudo labels, mixup regularization of Self-Training reduces the adverse effect of less accurate pseudo labels. Both approaches supplement each other and achieve effective adaptation on the target domain which we demonstrate through extensive experiments on one-stage object detector. Experiment results show that our approach achieves a significant performance improvement on multiple benchmark datasets.

We investigate the task of single-stroke classification into one of three classes (text, figure, or table rule lines). Individual strokes form handwriting structures such as text lines, figures, and tables in combination with peripheral strokes. To classify strokes using local contexts of neighborhood strokes, we propose a composite descriptor that represents in detail the relation between individual strokes and temporal and spatial neighborhood strokes. Evaluation of online handwritten documents written in English and in Japanese indicate that the proposed method more accurately classifies strokes than does the conventional method that employs shape-related features of a single stroke.

Since the k-nearest neighbor (k-NN) classification is computationally demanding in terms of time and memory, approximate nearest neighbor (ANN) algorithms that utilize dimensionality reduction and hashing are gathering interest. Dimensionality reduction saves memory usage for storing training patterns and hashing techniques significantly reduce the computation required for distance calculation. Several ANN methods have been proposed which make k-NN classification applicable to those tasks that have a large number of training patterns with very high-dimensional feature. Though conventional ANN methods try to approximate Euclidean distance calculation in the original high-dimensional feature space with much lower-dimensional subspace, the Euclidean distance in the original feature space is not necessarily optimal for classification. According to the recent studies, metric learning is effective to improve accuracy of the k-NN classification. In this paper, Large Margin Discriminative Hashing (LMDH) method, which projects input patterns into low dimensional subspace with the optimized metric for the k-NN classification, is proposed.

In this paper, we propose a novel feature localization method based on a global vector concentration approach. Our approach does not rely on the detection of local salient features around feature points. Instead, we exploit global structural information of the object extracted by calculating the concentration of directional vectors from sampling points. Those vectors are combined with local pattern descriptors of a query image and selected from preliminarily trained extended templates by nearest neighbor search. Due to the insensitivity of local changes, our method can handle partially occluded and noisy objects. We apply the proposed method to fully automatic feature localization of the left ventricular in echocardiograms. The results show the effectiveness of our method in comparison with a conventional edge-based method in terms of accuracy and robustness.

In this paper, we propose an efficient and generic facial feature localization method based on a weighted vector concentration approach. Our method does not require any specific priors on facial shape but implicitly learns its structural information from a training data. Unlike previous work, facial feature points are globally estimated by the concentration of directional vectors from sampling points on a face region, and those vectors are weighted by using local likelihood patterns which discriminate the appropriate position of the feature points. The directional vectors and local likelihood patterns are provided through nearest neighbor search between local patterns around the sampling points and a trained codebook of extended templates. The combination of the global vector concentration and the verification with the local likelihood patterns achieves robust facial feature point detection. We demonstrate that our method outperforms state-of-the-art method based on the Active Shape Models in our evaluation.

This paper proposes a novel method for recognizing faces in a cluster of moving people. In this task, there are two problems caused by motion, which are occlusions, and changes in facial pose and illumination. Multiple cameras are used to acquire near-frontal faces to avoid occlusions and profile faces. The hierarchical image-set matching (HISM) creates a distribution for each individual by integrating a set of face images of the same individual acquired from the multiple cameras. By adopting a method for comparing between test and training distributions in identification, variation in pose and illumination is alleviated, and good recognition accuracy can be obtained. Experimental results using video sequences containing 349 people show that the proposed method achieves high recognition performance compared with conventional methods, which use frame-by-frame identification and a distribution obtained from a single camera.

Most nearest neighbor (NN) classifiers employ NN search algorithms for the acceleration. However, NN classification does not always require the NN search. Based on this idea, we propose a novel algorithm named k-d decision tree (KDDT). Since KDDT uses Voronoi condensed prototypes, it is less memory consuming than naive NN classifiers. We have confirmed that KDDT is much faster than NN search based classifiers through the comparative experiment (from 9 to 369 times faster).