Skip to main content
STUB DOCUMENT: This page is intentionally minimal and will be expanded with deeper technical details in a future update.
A two-camera privacy-preserving worker. YOLOv8 detects each person, the worker pixelates their bbox, and the driver substitutes the anonymised frame into the WebRTC stream before the bytes leave the edge.

Why pixelate?

Pixelation reads as “a person, doing something” to a human reviewer — unlike stick figures which vanish on occlusion, low light or unusual poses. It also doesn’t need a pose model, cutting per-frame CPU cost by roughly 2× on edge devices. See the Privacy caveat below — pixelation is visual obscuring, not cryptographic de-identification.

Pieces

Worker

The same gate is applied automatically to workers generated from an anonymize workflow node, so workflows authored in the visual editor get the same privacy fail-closed behaviour without any code changes.

Driver configuration

Enable the frame filter per camera twin (each generic-camera driver container):
The channel name (frames/filtered) and fail-closed blank fallback are hard-coded in the driver. Freshness is tunable per driver via CYBERWAVE_METADATA_FRAME_FILTER_FRESHNESS_MS — raise it (e.g. 400500) for CPU-bound workers, at the cost of keeping visibly-stale anonymised frames on screen longer. 0 is a valid “force blank” fail-close test mode. To see the raw camera feed for debugging, set CYBERWAVE_METADATA_FRAME_FILTER_ENABLED=false and restart the driver.
When CYBERWAVE_DETECTION_OVERLAYS is left at its default (true), bounding boxes and labels are drawn on top of the anonymised frame and reveal each person’s position — which defeats the anonymisation contract for location-sensitive deployments. Set CYBERWAVE_DETECTION_OVERLAYS=false alongside the filter flag if that matters.

Privacy boundary

The Zenoh→MQTT bridge does not forward frames/* channels by default. Only events (person_too_close, …) and detections cross the WAN. The raw and anonymised frames stay on-device.
Pixelation is reversible by public depixelation models. It is deliberate visual obscuring, not GDPR-grade de-identification. For legal de-identification, combine pixelate with "redact" masking or drop frames entirely and publish only events.

Per-zone alerting with Spatial Filter + Timed Condition

For deployments where the pixelation is just the privacy scaffold and the actual alert is “person loitering inside a restricted polygon”, combine this driver setup with a workflow that wires spatial_filter and timed_condition downstream of call_model + anonymize. The polygon also renders as a read-only overlay on the twin’s WebRTC stream so operators can see which zones are armed without opening every workflow. See the Zone-based intrusion detection tutorial for the full end-to-end recipe.

Reference implementation