PrivLEX: Legal Image Privacy Classifier

• PrivLEX is a legally interpretable image privacy classifier that aligns decisions with statutory personal data definitions.
• It employs a two-stage, label-free architecture using zero-shot VLM detection and sparse logistic regression for traceable classification.
• The system achieves competitive accuracy on VISPR and PrivacyAlert datasets while providing clear legal rationales for privacy decisions.

PrivLEX is an interpretable image privacy classifier that grounds its decision-making in legally defined personal data concepts, operationalized via zero-shot Vision-LLMs (VLMs) and a label-free Concept Bottleneck Model (CBM). PrivLEX specifically addresses the requirement for privacy classifiers to align with formal privacy regulations, such as the European Union’s General Data Protection Regulation (GDPR), the Data Governance Act (DGA), and the proposed EU AI Act. Its design enables traceability of privacy decisions to legally established categories of personal data, while maintaining performance comparable to non-interpretable state-of-the-art approaches (Baranouskaya et al., 14 Jan 2026).

1. Motivation: Legal Alignment and Interpretability

Traditional image privacy classifiers predominantly leverage subjective private/public labels and often rely on ad-hoc or dataset-specific concept taxonomies. Two primary deficiencies arise in this paradigm. First, the absence of alignment with legal definitions of personal data can result in classifiers providing recommendations that lack legal reliability, undermining their utility for compliance with statutory obligations. Second, the interpretability deficit in black-box models impedes auditors, users, and regulators from understanding the explicit rationale underlying privacy designations. PrivLEX addresses these limitations by constructing its semantic bottleneck around legal personal data definitions and employing a label-free CBM, powered by a zero-shot VLM, to achieve both legal grounding and transparency in the classification pipeline (Baranouskaya et al., 14 Jan 2026).

2. Underlying Legal Concepts and Taxonomic Structure

PrivLEX leverages the Data Privacy Vocabulary – Personal Data (DPV-PD) taxonomy, which is derived from key European legal frameworks, including the GDPR, DGA, and the EU AI Act proposal. DPV-PD aggregates personal data into eight top-level categories, such as Internal, External, Financial, Historical, Social, and Tracking, among others. Subdivision occurs through up to four levels of granularity, with third-level concepts constituting the primary semantic units used by PrivLEX. For example, under the External category, “Identifying → Biometric” includes concepts like “fingerprint” and “face.” The classifier employs 131 distinct legal-style concepts, each with a succinct legal description. To reduce redundancy, fourth-level distinctions (e.g., “passport expiry date”) are subsumed into their parent concept. This structure ensures each detected concept directly references a legally relevant category (Baranouskaya et al., 14 Jan 2026).

Top-level Group	Example Subgroup	Example Concepts
External	Identifying → Biometric	Fingerprint, Face
Tracking	Location	GPS coordinates
Financial	Insurance	Insurance number

PrivLEX’s adherence to formal taxonomies avoids the ambiguity and inconsistency associated with data-driven or crowd-sourced concept labeling, forming a transparent mapping between model rationale and legislative language.

3. Model Architecture and Zero-Shot Concept Detection

PrivLEX architecture adopts a two-stage, label-free CBM approach. The first stage utilizes a pre-trained VLM, specifically CLIP (ViT-B/32), for zero-shot detection of legal concepts. For each image $x_i$, CLIP’s image encoder yields an embedding $I_i \in \mathbb{R}^d$, and for each concept $t_j$ with its legal-style description, the text encoder produces $T_j \in \mathbb{R}^d$. The concept relevance score is given by the cosine similarity:

$$c_{ij} = \frac{I_i \cdot T_j}{\|I_i\| \cdot \|T_j\|}$$

These raw scores are linearly normalized to $[0,1]$ to yield $c_{ij}^N$.

In the second stage, the vector of all $n$ normalized concept scores for the image, $c_i^N = [c_{i1}^N, \ldots, c_{in}^N]^T$, is input to a sparse Logistic Regression classifier:

$\hat{y}_i = \sigma(W^T c_i^N + b)$

with strong $I_i \in \mathbb{R}^d$0 regularization imposed on the weights $I_i \in \mathbb{R}^d$1 to promote sparsity. This architecture ensures that only a subset of detected legal concepts contributes to the binary privacy label assigned to each image (Baranouskaya et al., 14 Jan 2026).

No concept-specific training or fine-tuning of CLIP is performed; detection is strictly zero-shot. Prompt templates for concepts follow the pattern: “<Concept name>: <legal-style description>.” Auxiliary studies confirm that CLIP achieves notable balanced accuracy (72% on VISPR concepts) when using either dataset-specific or legal-style prompts.

4. Interpretability and Legal Traceability

Interpretability is an inherent consequence of the explicit concept bottleneck. For each image, PrivLEX outputs:

• A privacy classification (public/private) with an associated probability $I_i \in \mathbb{R}^d$2
• A ranked, scored list of detected legal concepts, annotated by the sign and magnitude of $I_i \in \mathbb{R}^d$3

Each $I_i \in \mathbb{R}^d$4 indicates a concept’s positive contribution to the “private” decision, $I_i \in \mathbb{R}^d$5 reflects a negative (i.e., “public”) influence, and $I_i \in \mathbb{R}^d$6 denotes non-discriminative or dataset-absent concepts. Concept selection for explanation is thresholded: concepts with $I_i \in \mathbb{R}^d$7 exceeding $I_i \in \mathbb{R}^d$8 (empirically set at 0.245) and $I_i \in \mathbb{R}^d$9 set as $t_j$0, guaranteeing a minimum explanatory context.

Color coding is used in reporting to distinguish private-driving (orange), public-driving (blue), and neutral (brown) concepts, allowing stakeholders to inspect the concrete legal rationale underlying each privacy prediction (Baranouskaya et al., 14 Jan 2026).

5. Datasets, Training, and Empirical Evaluation

PrivLEX is validated on VISPR (8,000 test images) and PrivacyAlert (~6,000 images), both of which supply binary privacy labels based on crowdworker annotation. No additional concept-level labeling is required; the CBM is trained only on privacy binary labels using the VLM-extracted concept vectors. Key experimental metrics include Accuracy (ACC), Balanced Accuracy (BA), F1-macro (F1-m), and F1-private (F1ₚ). Hyperparameters for Logistic Regression (regularization C, number of iterations) are tuned via Optuna; the concept-score threshold is set using distributional characteristics from the training set.

Performance benchmarks are as follows:

Dataset	BA (PrivLEX)	F1-m (PrivLEX)	F1ₚ (PrivLEX)
PrivacyAlert	83.21%	82.90%	74.47%
VISPR	88.11%	88.10%	91.06%

PrivLEX outperforms all interpretable baselines and demonstrates empirical parity with non-interpretable SVM-like state-of-the-art models. Ablation on concept taxonomies exhibits that PrivLEX’s use of DPV-PD’s 131 concepts leads to superior or matching balanced accuracy as compared to alternatives, including dataset-specific, broad, and LLM-generated taxonomies (Baranouskaya et al., 14 Jan 2026).

6. Analysis of Human Sensitivity to Legal Concepts

PrivLEX enables analysis of human sensitivity to legal concepts through inspection of learned weight vectors $t_j$1 post-training. Concept weights substantiate which categories annotators implicitly judge to be privacy-sensitive. Consistently private-associated concepts (large $t_j$2) include biometric identifiers (fingerprint, face), official IDs (passport), health data (disability), and sexual preferences. Public-associated (large $t_j$3) are general personality, work cues, and online-tracking artifacts not individually privacy-laden. Dataset-specific biases are also observable: PrivacyAlert places greater emphasis on nudity/sexual content, while VISPR differentially weights vehicle-related concepts based on the presence of people. Such analysis serves as an indirect proxy for annotator perceptions of legal privacy risks, with concept polarity faithfully mirroring societal norms and expectations (Baranouskaya et al., 14 Jan 2026).

7. Limitations and Prospective Research Directions

Current limitations include VLM challenges with abstract or weakly visual concepts, unreliable recognition of textual data types in images (e.g., disambiguating names, emails, PIN codes due to the absence of robust text recognition), and model sensitivity to rare concepts, which can bias weight magnitude. Nonetheless, sign stability of weights remains reliable for interpretive purposes.

Planned improvements and research avenues involve:

• Exploiting the full DPV-PD hierarchy for enhanced fine-grained detection via hierarchical aggregation,
• Incorporating dedicated OCR modules to address textual data detection robustness,
• Adopting more rigorous cross-validation and alternative VLM architectures (e.g., BLIP, FLAVA) to mitigate existing biases,
• Integration into compliance workflows, enabling privacy impact statements that reference specific statutory articles (Baranouskaya et al., 14 Jan 2026).

PrivLEX establishes a state-of-the-art, legally interpretable methodology for image privacy classification, achieving competitive accuracy and enabling actionable transparency and traceability for both technical and regulatory scrutiny.