  Large training data and expensive model tweaking are standard features of
deep learning for images. As a result, data owners often utilize cloud
resources to develop large-scale complex models, which raises privacy concerns.
Existing solutions are either too expensive to be practical or do not
sufficiently protect the confidentiality of data and models. In this paper, we
study and compare novel \emph{image disguising} mechanisms, DisguisedNets and
InstaHide, aiming to achieve a better trade-off among the level of protection
for outsourced DNN model training, the expenses, and the utility of data.
DisguisedNets are novel combinations of image blocktization, block-level random
permutation, and two block-level secure transformations: random
multidimensional projection (RMT) and AES pixel-level encryption (AES).
InstaHide is an image mixup and random pixel flipping technique \cite{huang20}.
We have analyzed and evaluated them under a multi-level threat model. RMT
provides a better security guarantee than InstaHide, under the Level-1
adversarial knowledge with well-preserved model quality. In contrast, AES
provides a security guarantee under the Level-2 adversarial knowledge, but it
may affect model quality more. The unique features of image disguising also
help us to protect models from model-targeted attacks. We have done an
extensive experimental evaluation to understand how these methods work in
different settings for different datasets.
