Abstract
The task of privacy-preserving face recognition (PPFR) currently faces two major unsolved challenges: (1) existing methods are typically effective only on specific face recognition models and struggle to generalize to black-box face recognition models; (2) current methods employ data-driven reversible representation encoding for privacy protection, making them susceptible to adversarial learning and reconstruction of the original image. We observe that face recognition models primarily rely on local features ({e.g., face contour, skin texture, and so on) for identification. Thus, by disrupting global features while enhancing local features, we achieve effective recognition even in black-box environments. Additionally, to prevent adversarial models from learning and reversing the anonymization process, we adopt an adversarial learning-based approach with irreversible stochastic injection to ensure the stochastic nature of the anonymization. Experimental results demonstrate that our method achieves an average recognition accuracy of 94.21\% on black-box models, outperforming existing methods in both privacy protection and anti-reconstruction capabilities.
Abstract (translated)
隐私保护人脸识别（PPFR）当前面临着两大未解决的挑战：(1) 现有方法通常仅在特定的人脸识别模型上有效，难以泛化到黑盒人脸识别模型；(2) 当前的方法使用数据驱动的可逆表示编码来保护隐私，使其容易受到对抗性学习和原始图像重建的影响。我们观察到，人脸识别模型主要依赖局部特征（如人脸轮廓、皮肤纹理等）进行识别。因此，通过扰乱全局特征同时增强局部特征，我们在黑盒环境中也能实现有效的识别。此外，为了防止对抗模型学习并逆转匿名化过程，我们采用基于对抗学习的方法，并引入不可逆的随机注入以确保匿名化的随机性。实验结果显示，我们的方法在黑盒模型上实现了平均94.21%的识别准确率，在隐私保护和防重建能力方面均优于现有方法。
URL
https://arxiv.org/abs/2412.08276
