Abstract
The success of face recognition (FR) systems has led to serious privacy concerns due to potential unauthorized surveillance and user tracking on social networks. Existing methods for enhancing privacy fail to generate natural face images that can protect facial privacy. In this paper, we propose diffusion-based adversarial identity manipulation (DiffAIM) to generate natural and highly transferable adversarial faces against malicious FR systems. To be specific, we manipulate facial identity within the low-dimensional latent space of a diffusion model. This involves iteratively injecting gradient-based adversarial identity guidance during the reverse diffusion process, progressively steering the generation toward the desired adversarial faces. The guidance is optimized for identity convergence towards a target while promoting semantic divergence from the source, facilitating effective impersonation while maintaining visual naturalness. We further incorporate structure-preserving regularization to preserve facial structure consistency during manipulation. Extensive experiments on both face verification and identification tasks demonstrate that compared with the state-of-the-art, DiffAIM achieves stronger black-box attack transferability while maintaining superior visual quality. We also demonstrate the effectiveness of the proposed approach for commercial FR APIs, including Face++ and Aliyun.
Abstract (translated)
面部识别（FR）系统的成功引发了严重的隐私担忧，因为它们可能被未经授权地用于监视和跟踪社交媒体上的用户。现有的增强隐私的方法无法生成能够保护面部隐私的自然人脸图像。在本文中，我们提出了一种基于扩散的对抗性身份操纵方法（DiffAIM），旨在针对恶意面部识别系统生成自然且高度可转移的对抗性面孔。具体而言，我们在扩散模型的低维潜在空间内操控面部身份，并通过反向扩散过程中迭代注入梯度导向的对抗身份引导，逐步将生成过程引导到所需的对抗性面孔上。这种引导优化了身份朝目标收敛的同时促进了语义与来源图像的差异，从而在保持视觉自然性的前提下有效进行伪装。我们还引入了一种结构保留正则化方法，在操作过程中保持面部结构的一致性。在人脸验证和识别任务上的广泛实验表明，与现有最佳技术相比，DiffAIM能够在维持更优质的视觉质量的同时实现更强的黑盒攻击转移能力。此外，我们展示了该方法对商业面部识别API（如Face++和阿里云）的有效性。
URL
https://arxiv.org/abs/2504.21646
