On the (Im)Practicality of Adversarial Perturbation for Image Privacy

Abstract

Image hosting platforms are a popular way to store and share images with family members and friends. However, such platforms typically have full access to images raising privacy concerns. These concerns are further exacerbated with the advent of Convolutional Neural Networks (CNNs) that can be trained on available images to automatically detect and recognize faces with high accuracy.Recently, adversarial perturbations have been proposed as a potential defense against automated recognition and classification of images by CNNs. In this paper, we explore the practicality of adversarial perturbation-based approaches as a privacy defense against automated face recognition. Specifically, we first identify practical requirements for such approaches and then propose two practical adversarial perturbation approaches – (i) learned universal ensemble perturbations (UEP), and (ii) k-randomized transparent image overlays (k-RTIO) that are semantic adversarial perturbations. We demonstrate how users can generate effective transferable perturbations under realistic assumptions with less effort.We evaluate the proposed methods against state-of-theart online and offline face recognition models, Clarifai.com and DeepFace, respectively. Our findings show that UEP and k-RTIO respectively achieve more than 85% and 90% success against face recognition models. Additionally, we explore potential countermeasures that classifiers can use to thwart the proposed defenses. Particularly, we demonstrate one effective countermeasure against UEP.

FoggySight: A Scheme for Facial Lookup Privacy

“…Of particular interest are works by Gao et al [20] and Cherepanova et al [12] that develop transferable adversarial examples by optimizing in the metric space of facial recognition networks and study how much distortion individuals are willing to accept in their photos. In addition, Rajabi et al [47] and Oh et al [43] develop new approaches for generating adversarial examples against facial recognition that do not rely on the "standard" methods from [10,40] and show that they are robust even in the face of countermeasures.…”

Data Poisoning Won't Save You From Facial Recognition

“…The game dynamics change if the user can use adversarial examples to evade the model [53,46,54,13,8,41,38,9,1]. Such evasion attacks favor the attacker: the defender must first commit to a defense and the attacker can then adapt their strategy accordingly [55].…”

“…A growing body of research explores how tools from adversarial machine learning can help users fight back [46,38,54,26,45,12,13,64,66,25,7,41,1]. We revisit a recently proposed approach where users perturb the pictures they post online, in order to poison facial recognition models into misidentifying unperturbed pictures (e.g., a picture taken by a stalker or by the police).…”

Going Grayscale: The Road to Understanding and Improving Unlearnable Examples

“…Similar ideas of using grayscale transformation have also used in [17,37] Privacy Protection. In addition to data poisoning approaches that can be used to make user data unexploitable during training [7,13,30,31], approaches based on adversarial machine learning have also been developed to protect privacy by misleading the machines during test time, for in-stance, in person-related recognition [22,23,25] and social media mining [18,20]. Privacy attributes in images were analyzed in depth by [24,27].…”