Vision Language Model Helps Private Information De-Identification in Vision Data

Technical Summary: VisShield – Vision Privacy Shield for De-identification in Vision Data

Problem Statement
While Vision Language Models (VLMs) have demonstrated remarkable capabilities in solving image-related tasks, they inherit privacy risks from their Large Language Model (LLM) components, particularly regarding the memorization and output of sensitive information. Existing privacy mitigation strategies for LLMs primarily focus on text-based inputs, largely overlooking privacy risks embedded in visual data. A critical gap exists in handling Protected Health Information (PHI) and other Personally Identifiable Information (PII) present as text within images (e.g., medical records, documents). Current de-identification methods predominantly target facial features using generative models, while tools like Presidio lack the flexibility to define custom privacy categories and demonstrate suboptimal performance in visual contexts. The core challenge is twofold: accurately localizing sensitive text within an image and processing it to ensure privacy protection without compromising the utility of the remaining visual data.

Methodology: VisShield Framework
The authors propose VisShield (Vision Privacy Shield), an end-to-end framework designed to enhance the privacy awareness of VLMs. The framework operates through a pipeline where an instruction-tuned VLM performs targeted Optical Character Recognition (OCR) on privacy-sensitive regions, followed by selective masking of the identified information. The methodology relies on two primary components:

1. OPTIC Dataset (Optical Privacy Text Instruction Collection):

   • Scale and Composition: A specialized instruction-tuning dataset comprising 50 million image-text pairs.
   • Generation Pipeline: The dataset is synthesized using a three-stage process:
     • Prompt Generation: Large Language Models (GPT-4 and Claude-3.5 Sonnet) generate diverse instruction prompts. These prompts include a specific definition of private information (e.g., "private information stands for names and SSNs"), few-shot examples of the defined categories, and a special trigger token <ocr> to initiate the OCR task.
     • Synthetic Image Generation: Private information (fake data generated via the Faker package) is overlaid onto base images from diverse sources (flickr30k for natural scenes and Rutherford et al. for medical images). The overlay process randomizes font types, sizes, and colors to ensure robustness.
     • Labeling: Ground truth labels are generated as bounding boxes (<bbox>) for the specific text entities defined in the instruction prompt. If no such text exists, the label is "No private information."
   • Categories: The dataset covers eight categories: Name, Date of Birth (DOB), Social Security Number (SSN), Address, Phone Number, Email, Medical Record Numbers, and Disease Names.

2. Tailored Training Methodology:

   • Base Model: The framework fine-tunes Kosmos-2.5, a pre-trained multimodal model with inherent OCR capabilities.
   • Training Strategy: The authors demonstrate that training on a small subset of 100,000 samples is sufficient to significantly enhance de-identification capabilities, avoiding the computational cost of training on the full 50M dataset.
   • Adaptation Techniques: Two strategies are explored: Full Fine-Tuning (updating all parameters) and LoRA (Low-Rank Adaptation), a parameter-efficient method. Both aim to teach the model to selectively extract only privacy-relevant text based on dynamic definitions provided in the prompt, rather than extracting all text.

Key Contributions

• First Customized De-identification: To the best of the authors' knowledge, this is the first work to address the de-identification of textual private information in vision data using customized definitions of privacy.
• OPTIC Dataset: The creation of a massive, diverse instruction-tuning dataset (50M samples) that enables VLMs to output OCR results specifically for identifying private information based on user-defined criteria.
• Effective Fine-Tuning: Demonstration that fine-tuning a pre-trained VLM (Kosmos-2.5) with a relatively small portion of the OPTIC dataset is sufficient to achieve high-performance de-identification, establishing a new application scope for VLMs.

Experimental Results
The authors evaluated the fine-tuned models against the existing tool Presidio and a baseline pipeline (Tesseract OCR + Llama2-7B) across various scenarios:

• Generalization: The models were tested on images generated from different base datasets (COCO, ADE20K, RITE) and different instruction prompts (human-written and generated by Gemma1.5).
• Performance Metrics: Evaluation used F1 scores for OCR quality and Intersection over Union (IoU) for detection accuracy.
• Findings:
  • VisShield significantly outperformed Presidio, which showed near-zero IoU scores due to its inability to customize privacy definitions.
  • The fine-tuned models achieved mean IoU scores consistently above 0.9 across different datasets and information types.
  • Full fine-tuning and LoRA showed comparable performance, with LoRA occasionally showing marginal gains.
  • The models demonstrated robustness in handling new information types (e.g., 11-digit phone numbers, passport numbers) and challenging scenarios, including handwritten text and private information embedded within sentences.
  • Ablation studies indicated that few-shot examples in the prompt are crucial for handling unseen formats (like passport numbers), while zero-shot prompts performed well for familiar formats.

Significance and Claims
The paper claims that VisShield paves the way for privacy-preserving applications in vision-language models by enabling them to understand and execute customized de-identification tasks. The authors emphasize that their approach allows VLMs to recognize privacy-sensitive text and output precise bounding boxes for effective masking, addressing a gap where previous works focused solely on faces or lacked flexibility. The work is presented as a foundational step toward safer integration of VLMs in privacy-sensitive domains, such as healthcare, while acknowledging limitations regarding rare domain-specific formats and dependency on OCR accuracy in low-quality images.