Abstract
The wide deployment of Face Recognition (FR) systems poses risks of privacy leakage. One countermeasure to address this issue is adversarial attacks, which deceive malicious FR searches but simultaneously interfere the normal identity verification of trusted authorizers. In this paper, we propose the first Double Privacy Guard (DPG) scheme based on traceable adversarial watermarking. DPG employs a one-time watermark embedding to deceive unauthorized FR models and allows authorizers to perform identity verification by extracting the watermark. Specifically, we propose an information-guided adversarial attack against FR models. The encoder embeds an identity-specific watermark into the deep feature space of the carrier, guiding recognizable features of the image to deviate from the source identity. We further adopt a collaborative meta-optimization strategy compatible with sub-tasks, which regularizes the joint optimization direction of the encoder and decoder. This strategy enhances the representation of universal carrier features, mitigating multi-objective optimization conflicts in watermarking. Experiments confirm that DPG achieves significant attack success rates and traceability accuracy on state-of-the-art FR models, exhibiting remarkable robustness that outperforms the existing privacy protection methods using adversarial attacks and deep watermarking, or simple combinations of the two. Our work potentially opens up new insights into proactive protection for FR privacy.
Abstract (translated)
广泛部署人脸识别（FR）系统会带来隐私泄露的风险。解决这个问题的一个对策是对抗性攻击，这种攻击会欺骗恶意的人脸识别，但同时会干扰可信授权者的正常身份验证。在本文中，我们提出了基于可追踪的对抗性水印的第一个双隐私保护（DPG）方案。DPG采用一次性水印嵌入来欺骗未经授权的人脸识别模型，并允许授权者通过提取水印来验证身份。具体来说，我们针对FR模型提出了信息指导的对抗性攻击。编码器将身份特定的水印嵌入到载体的深度特征空间中，引导图像的可识别特征远离源身份。我们进一步采用了一种可互补的元优化策略，该策略与子任务兼容，规范了编码器和解码器的联合优化方向。这种策略提高了普遍载荷特征的代表性，减轻了水印标记中的多目标优化冲突。实验证实，DPG在最先进的FR模型上实现了显著的攻击成功率和可追溯准确性，表现出出色的稳健性，超过使用对抗攻击和深度水印的现有隐私保护方法，或者使用简单的水印和编码器组合。我们的工作可能会为FR隐私的主动保护提供新的见解。
URL
https://arxiv.org/abs/2404.14693
