CityGuard: Graph-Aware Private Descriptors for Bias-Resilient Identity Search Across Urban Cameras

CityGuard is a privacy-preserving, graph-aware transformer framework that enables robust, bias-resilient person re-identification across distributed urban cameras by integrating dispersion-adaptive metric learning, spatially conditioned attention for coarse geometric alignment, and differentially private embeddings to balance retrieval accuracy with data protection.

The Gist

Imagine a massive city filled with thousands of security cameras. If a person walks through the city, they might be seen by Camera A, then Camera B, then Camera C. Each camera sees them from a different angle, in different lighting, and maybe the person is wearing a hat or holding an umbrella.

The Problem:
Traditionally, to find this person, security systems would need to take photos from all these cameras, send them to a central server, and compare them. But this raises two big issues:

1. Privacy: Sending raw photos of people everywhere violates privacy laws (like GDPR). It's like sending everyone's ID card to a central office just to check if they are the right person.
2. Confusion: If the person is partially hidden by a crowd or the camera angle is weird, the computer gets confused and thinks it's a different person.

The Solution: CityGuard
The paper introduces CityGuard, a new "smart detective" system that solves these problems. Think of it as a privacy-first, map-aware ID scanner.

Here is how CityGuard works, broken down into three simple superpowers:

1. The "Smart Map" (Geometry-Aware Attention)

Imagine you are looking for a friend in a crowded park. You don't look at every single person randomly. You look at the people near your friend's last known location. You know that if your friend was near the fountain, they are likely still near the fountain, not on the other side of the city.

• How CityGuard does it: Instead of treating every camera as an isolated island, CityGuard builds a digital map of the city. It knows which cameras are close to each other and which way they are facing.
• The Magic: When the system sees a person, it uses this map to say, "Okay, this camera is right next to that one, so the person probably walked there next." It uses this "spatial common sense" to connect the dots, even if the person looks slightly different in each shot. It doesn't need perfect surveyor-grade maps; rough GPS data works fine.

2. The "Flexible Memory" (Adaptive Metric Learning)

Imagine you are trying to recognize a friend who sometimes wears glasses, sometimes doesn't, and sometimes has a backpack. A rigid rule like "Must have glasses" would fail. You need a flexible memory that says, "It's still my friend even if the glasses are missing."

• How CityGuard does it: In the world of AI, "margins" are the rules the computer uses to decide if two people are the same. Old systems use a rigid rule (e.g., "If the difference is less than 5%, it's the same person").
• The Magic: CityGuard uses a flexible rule. It looks at a specific person and asks, "How much does this person usually change?" If a person is very consistent, the rule is strict. If a person is often obscured or changes clothes, the rule becomes more forgiving. It adapts its "memory" for every single individual, making it much harder to get confused by bad angles or hidden faces.

3. The "Privacy Blur" (Differential Privacy)

This is the most important part. Imagine you want to find a friend in a crowd, but you don't want to show their face to anyone. Instead of showing a photo, you give the crowd a fuzzy, mathematical description of them (e.g., "Tall, wearing blue, walking fast").

• How CityGuard does it: Before the system saves or shares any data about a person, it adds a tiny bit of "mathematical noise" (like static on a radio) to the description.
• The Magic: This noise is calculated so precisely that:
  • For the Search: The system can still find the right person (the fuzzy description is close enough).
  • For the Spy: If a hacker steals the data, they can't reconstruct the person's face or figure out who they are. It's like looking at a photo through a frosted glass that is clear enough to see the shape, but too blurry to see the features.

Why is this a big deal?

• It's Safe: You can search for people across a whole city without ever storing or sharing their actual photos.
• It's Smart: It uses the layout of the city to help find people, making it work better when cameras are far apart or the view is blocked.
• It's Fair: The paper shows it works equally well for people of different genders and ethnicities, reducing bias.

In a nutshell:
CityGuard is like a super-smart, privacy-conscious security guard. It knows the city layout, it remembers people even when they look different, and it only shares "fuzzy descriptions" of people so that no one's privacy is ever violated. It turns a city full of cameras into a secure, efficient, and ethical search engine.

Technical Summary

1. Problem Statement

The paper addresses the challenge of City-scale Person Re-Identification (Re-ID), which involves matching individuals across distributed, non-overlapping camera networks in urban environments. The system must overcome three critical hurdles simultaneously:

• Severe Appearance Variation: Significant changes in viewpoint, occlusion, lighting, and clothing across different cameras.
• Domain Shift: Heterogeneity in camera hardware and deployment environments causing distribution shifts.
• Privacy Constraints: Strict data protection regulations (e.g., GDPR, CCPA) that prohibit the sharing of raw imagery or unencrypted embeddings, necessitating privacy-preserving retrieval without sacrificing utility.

Existing solutions often fail to integrate these requirements, typically treating privacy as an afterthought or ignoring the geometric relationships between cameras, leading to suboptimal accuracy-privacy trade-offs.

2. Methodology: The CityGuard Framework

CityGuard is a unified framework designed to improve discrimination, encode geometry-aware alignment, and enforce privacy. It consists of four core technical components:

A. Geometry-Conditioned Attention & Topology-Aware Encoding

Instead of treating cameras as independent nodes, CityGuard constructs a spatial adjacency graph based on coarse geometric metadata (e.g., GPS coordinates, floor plans, or approximate rotations).

• Affinity Matrix: A Gaussian affinity matrix $A_{ij}$ is computed between camera $i$ and $j$ based on Euclidean distance and relative rotation. This allows the system to function with "coarse" metadata (e.g., GPS with ~5m error) without requiring survey-grade calibration.
• Graph Self-Attention: The framework injects this geometric prior into a Transformer-based backbone. The attention logits are biased by the geometry matrix ($B_{geom}$), forcing the model to prioritize features from physically proximate or heading-aligned cameras. This enables projectively consistent cross-view alignment.

B. Dispersion-Aware Adaptive Metric Learning (ACT Loss)

To handle the varying difficulty of different identities (e.g., some people are harder to distinguish due to clothing or pose), CityGuard introduces an Adaptive Class-Tolerant (ACT) Loss.

• Dynamic Margins: Instead of fixed margins, the loss calculates an instance-specific margin $\gamma_i$ based on the Kullback-Leibler (KL) divergence between an identity's empirical feature distribution and a global reference.
• Mechanism: Identities with high intra-class variance (high dispersion) receive larger margins to prevent overfitting, while compact identities receive tighter margins.
• Hard Mining: The loss employs explicit hard-positive and semi-hard-negative mining strategies within mini-batches to refine the embedding space.

C. Temporal Graph Network (TGN)

For video-based Re-ID, a TGN aggregates neighborhood information across time steps. It uses message-passing to capture cross-camera motion cues and temporal correlations, refining features based on the camera graph structure.

D. Differentially Private (DP) Embedding Release

To ensure privacy, CityGuard applies a Gaussian Mechanism to the encoder outputs.

• Clipping & Noise: Encoder outputs are clipped to a fixed radius $B$ to bound sensitivity ($S_f \le 2B$). Isotropic Gaussian noise is then added to the embeddings.
• Privacy Accounting: The system uses the Advanced Composition Theorem to track cumulative privacy loss ($\epsilon_{total}, \delta_{total}$) across multiple queries, ensuring rigorous $(\epsilon, \delta)$-differential privacy guarantees.
• Indexing: The privatized embeddings are stored in compact approximate indexes (e.g., HNSW or PQ) for efficient, secure retrieval.

3. Key Contributions

1. Topology-Aware Attention: A novel attention mechanism that leverages coarse geometric priors (GPS/floor plans) to guide self-attention, achieving spatially consistent alignment without precise calibration.
2. Dispersion-Aware Metric Learning: An adaptive margin strategy (ACT Loss) that dynamically adjusts decision boundaries based on per-identity feature dispersion, significantly improving intra-class compactness and cross-camera discrimination.
3. Privacy-Calibrated Pipeline: A unified system that integrates differential privacy directly into the embedding generation and indexing process, offering tunable privacy-utility trade-offs with formal guarantees.
4. Robustness & Fairness: The framework demonstrates resilience against adversarial attacks (FGSM/PGD), occlusion, and domain shifts, while also reducing demographic bias (fairness) across race, gender, and ethnicity groups.

4. Experimental Results

CityGuard was evaluated on standard benchmarks (Market-1501, MARS, MSMT17) and specialized datasets for occlusion (Occluded-REID) and cross-modality (SYSU-MM01, RegDB).

• State-of-the-Art Performance:
  • Market-1501: Achieved 97.5% Rank-1 and 96.5% mAP, outperforming strong baselines like TransReID and ChatReID.
  • MARS (Video): Achieved 95.7% Rank-1 and 91.6% mAP.
  • Occlusion: Significantly outperformed existing methods on Occluded-REID and Partial-REID, demonstrating robustness to partial visibility.
• Privacy-Utility Trade-off:
  • Even under strict privacy budgets (e.g., $\epsilon = 2.0$), CityGuard maintained >90% Rank-1 accuracy.
  • Membership Inference Attacks (MIA): In the non-private baseline, attack precision was 81.5%. With CityGuard's DP mechanism ($\epsilon=2.0$), attack precision dropped to 54.3% (statistically indistinguishable from random guessing), effectively neutralizing privacy leaks.
• Efficiency & Deployment:
  • The system supports efficient approximate nearest neighbor search.
  • Database integration tests (PostgreSQL + PG-Strom) showed CityGuard reduced latency by ~45% and index size by ~60% compared to ResNet50 baselines while improving mAP.
• Fairness: CityGuard reduced demographic disparities (e.g., racial AUC gaps) by 52–78% compared to baseline models.

5. Significance

CityGuard represents a significant step forward in deploying Re-ID systems for smart cities and public safety. Its significance lies in:

• Practicality: It removes the dependency on expensive, survey-grade camera calibration by utilizing coarse, readily available metadata (GPS).
• Compliance: It provides a mathematically rigorous path to comply with data privacy laws (GDPR/CCPA) without rendering the system useless, solving the "privacy vs. utility" paradox.
• Resilience: By integrating geometry, temporal dynamics, and adaptive metric learning, it creates a system robust to the chaotic conditions of real-world urban surveillance (occlusion, domain shift, and adversarial attacks).
• Ethical AI: The framework explicitly addresses and mitigates demographic bias, making it suitable for responsible, large-scale deployment.

In summary, CityGuard offers a holistic, production-ready solution for secure, accurate, and fair identity search across distributed urban camera networks.