💻 computer science

Protecting and Preserving Protest Dynamics for Responsible Analysis

This paper proposes a responsible computing framework that utilizes conditional image synthesis to generate realistic, privacy-preserving synthetic protest imagery, thereby enabling the analysis of collective action dynamics while mitigating surveillance risks and ensuring demographic fairness.

Original authors: Cohen Archbold, Usman Hassan, Nazmus Sakib, Sen-ching Cheung, Abdullah-Al-Zubaer Imran

Published 2026-04-08

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Cohen Archbold, Usman Hassan, Nazmus Sakib, Sen-ching Cheung, Abdullah-Al-Zubaer Imran

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a massive, chaotic street protest. It's a powerful moment of people coming together to demand change. Now, imagine someone taking thousands of photos of that crowd and feeding them into a super-smart computer brain (an AI) to study how the crowd moves, how big it is, and whether things are getting violent.

This is a great idea for understanding history and helping policymakers, but there's a huge problem: The photos contain real people.

If a computer learns from these photos, it might accidentally "memorize" who those people are. Later, a bad actor (like a repressive government or a hacker) could trick the computer into revealing, "Oh, that person in photo #405 was at the protest." This puts real people in danger of getting arrested, fired, or hurt.

This paper proposes a clever solution: Don't show the computer the real people at all. Show it a perfect, fake version instead.

Here is the breakdown of their idea using simple analogies:

1. The Problem: The "Glass House" of Data

Currently, researchers use real photos of protests to train AI. It's like teaching a child to recognize birds by showing them photos of their neighbors' pets. The child learns, but they also learn exactly who lives next door. If someone steals the child's notebook, they know who the neighbors are.

In the world of protests, this "notebook" is dangerous. If an AI is trained on real images, it can be hacked to reveal identities, locations, and sensitive details about the protesters.

2. The Solution: The "Holographic Stand-in"

The authors built a system that acts like a master forger. Instead of using real photos, they use an AI (called a GAN, or Generative Adversarial Network) to create synthetic images.

Think of it like this:

Real Data: A photograph of a real person holding a sign.
Synthetic Data: A computer-generated image of a person holding a sign that looks exactly like a real photo, but the person doesn't actually exist.

The computer learns to recognize "a protest," "police presence," or "violence" by studying these fake, holographic stand-ins. It learns the patterns of the crowd without ever seeing a real face.

3. The "Two-Stage" Training (The Acting School)

The authors realized that just making fake photos isn't enough; they have to be good fake photos. They used a two-step training process:

Step 1: The General Acting Class. First, they taught the AI to understand crowds and people using generic photos (like people in parks or stadiums). This is like teaching an actor how to walk and talk before giving them a specific script.
Step 2: The Specific Script. Then, they fine-tuned the AI using the specific "protest" data. Because the AI already understood how people look, it could learn the specific details of protests (like signs, police uniforms, or crowds) without needing to memorize the actual faces of the protesters.

4. The Safety Check: "Can the Hacker Break In?"

The researchers didn't just hope this worked; they tried to break it. They acted as "ethical hackers" to see if they could trick the AI into revealing if a specific real person was in the training data.

The Result: When they used their synthetic (fake) images, the hackers failed. The AI couldn't tell the difference between a real person and a fake one because the fake ones were the only ones it ever saw.
The Trade-off: Usually, when you add privacy protection (like blurring faces), the AI gets "dumber" and makes more mistakes. But this method kept the AI smart enough to do its job (counting crowds, detecting violence) while keeping the people safe.

5. The Fairness Check: "Is the Cast Diverse?"

There is a risk that the AI might only generate fake people who look like one specific group (e.g., only young men), which would make the analysis unfair.

The researchers checked the "cast" of their fake actors. They found that while the AI was mostly fair, it sometimes struggled to generate enough people of certain ages or races. They highlighted this so future researchers know to fix it. It's like a movie director realizing they need to cast more diverse actors to tell the whole story accurately.

The Bottom Line

This paper offers a pragmatic shield. It doesn't promise that the data is 100% unbreakable (nothing is), but it creates a "safe zone."

By replacing real, vulnerable people with high-quality, fake "digital twins," we can study the dynamics of social movements, understand violence, and help policymakers—without putting the protesters' lives at risk. It's like studying a fire by looking at a simulation of fire, rather than running into the burning building yourself.

1. Problem Statement

The paper addresses the critical ethical and privacy challenges associated with analyzing social media imagery of protests. While visual data is valuable for understanding collective action, estimating crowd sizes, and assessing violence, its use poses severe risks:

Surveillance and Repression: Contemporary AI systems can identify individuals, infer sensitive attributes (race, age, gender), and cross-reference data across platforms. This enables state or institutional surveillance, potentially leading to the identification and persecution of protesters and bystanders.
Limitations of Existing Methods:
- Formal Privacy (e.g., Differential Privacy): While theoretically strong, applying Differential Privacy (DP) to large-scale visual models often results in significant degradation of image quality and utility, making the data unusable for complex tasks like violence estimation.
- Simple Anonymization: Techniques like blurring faces or text often fail to protect privacy because background context, location, and crowd dynamics remain identifiable.
- Bias: Existing automated analysis tools often inherit and amplify biases present in training data, leading to unfair outcomes for specific demographic subgroups.

The core gap is the lack of a holistic pipeline that simultaneously addresses privacy risk, downstream analytical utility, and demographic fairness in the context of sensitive protest imagery.

2. Methodology

The authors propose a responsibility-driven framework that replaces sensitive raw protest imagery with conditionally synthesized images for training downstream analysis models.

A. Image Generation (The Core Engine)

Model Architecture: The framework utilizes StyleGAN3, adapted for the specific challenges of protest imagery (low-resource, highly imbalanced data).
Two-Stage Training Strategy:
1. Unconditional Pre-training: The generator is first pre-trained on diverse, non-sensitive crowd-counting datasets (UCF-QNRF, JHU-CROWD++, NWPU-Crowd) and a large protest subset from the VGKG dataset. This allows the model to learn generalizable human and crowd structures without relying on sensitive, sparsely labeled protest data.
2. Conditional Fine-tuning: The model is then fine-tuned on the benchmark dataset (Won et al.) using conditional inputs (annotations). This ensures the generated images preserve task-relevant attributes (e.g., presence of police, signs, violence levels) while decoupling them from specific real-world identities.
Privacy Mechanism: The authors explicitly state they do not use formal Differential Privacy (DP) mechanisms within the GAN training due to stability and quality constraints. Instead, they rely on the heuristic privacy of GANs: by training on $m$ samples and generating $n$ samples, the output exhibits a weak, inherent form of differential privacy (where $\delta \approx O(n/m)$ ). The goal is harm mitigation rather than absolute mathematical guarantees.

B. Downstream Analysis

Task: The synthetic images are used to train a ResNet-50 model for three specific tasks:
1. Protest Detection: Binary classification (Protest vs. Non-Protest).
2. Violence Assessment: Regression to estimate violence levels (0–1).
3. Attribute Classification: Detecting 10 visual attributes (e.g., signs, fire, police, group size).
Loss Function: A hybrid loss combining Cross-Entropy (for classification) and Mean Squared Error (for violence regression).

C. Evaluation Framework

The authors evaluate the system across four dimensions:

Image Quality: Measured via FID (Fréchet Inception Distance), KID, and IS.
Utility: Performance of the downstream model (AUC-ROC, correlation) compared to models trained on real data.
Privacy Risk: Evaluated via Membership Inference Attacks (MIA) in both Black-Box and White-Box scenarios.
- Black-Box: Adversary queries model outputs to guess if an image was in the training set.
- White-Box: Adversary has full access to model internals (gradients, weights) to reconstruct training data membership.
Fairness: Analysis of demographic representation (age, race, gender) in synthetic vs. real data and statistical parity in downstream predictions.

3. Key Contributions

Responsible Framework: A novel pipeline for socially sensitive data analysis that prioritizes privacy protection and harm mitigation over strict theoretical guarantees.
Conditional Synthesis: A tailored StyleGAN3 approach that generates high-fidelity, diverse protest imagery while reducing reliance on identifiable original data.
Comprehensive Trade-off Analysis: An extensive evaluation demonstrating that synthetic data can achieve high downstream utility while significantly reducing privacy risks compared to real-data training.
Systematic Fairness Audit: A method to assess whether synthetic representations disproportionately affect specific demographic subgroups, ensuring equity is a core component of the analysis.

4. Key Results

Image Quality: The proposed StyleGAN3 method significantly outperformed baseline models (WGAN-GP and DP-GAN) in image fidelity.
- FID Score: The proposed method achieved 15.83, compared to ~300 for WGAN-GP and DP-GAN, indicating synthetic images are visually indistinguishable from real data to feature extractors.
Downstream Utility:
- Models trained on synthetic data achieved performance comparable to models trained on real data for protest detection and attribute classification.
- In violence prediction, models pre-trained on VGKG data performed exceptionally well, suggesting synthetic data can capture complex violent patterns effectively.
Privacy Protection:
- Black-Box Attacks: The proposed method showed lower attack accuracy, precision, and recall compared to models trained on real data.
- White-Box Attacks: The synthetic training data significantly weakened the ability of adversaries to perform membership inference (lower recall, higher log-loss) compared to real-data baselines.
- Note: While DP-SGD offered stronger theoretical privacy resistance, it resulted in near-random predictions (low utility), whereas the synthetic approach offered a practical balance.
Fairness:
- The synthetic data successfully preserved demographic distributions similar to the real dataset.
- Pre-training on diverse datasets (VGKG) helped increase the representation of underrepresented groups (e.g., Black individuals, women, specific age groups) in the generated data.
- Some disparities remained in violence detection for darker skin tones and age groups, highlighting the need for continued fairness interventions.

5. Significance and Conclusion

This paper presents a pragmatic shift in how sensitive social data is handled. Rather than relying on formal privacy guarantees that often render data useless for complex visual tasks, the authors propose a harm-mitigating approach.

Practical Impact: The framework enables researchers and policymakers to analyze protest dynamics (size, violence, sentiment) without exposing individual protesters to the risk of re-identification or surveillance.
Ethical Stance: It acknowledges that while absolute privacy is unattainable, responsible design choices (synthetic data generation) can significantly reduce risk while maintaining analytical value.
Future Directions: The authors suggest exploring diffusion models for better diversity, expanding conditional generation for more balanced demographics, and evaluating additional privacy attacks (e.g., model inversion).

In summary, the paper demonstrates that synthetic data generation is a viable, effective strategy for balancing the competing demands of privacy, utility, and fairness in the high-stakes domain of protest analysis.