Ulixes：基于对抗机器学习的人脸识别隐私保护
Ulixes: Facial Recognition Privacy with Adversarial Machine Learning
AI总结：
本文提出Ulixes，通过生成非侵入性对抗噪声掩码，阻止面部编码器嵌入空间中形成可识别聚类，保护用户隐私，并验证其对多种方法及对抗训练模型的鲁棒性。
摘要：
人脸识别工具在从图像中识别个人方面正变得异常准确。然而，这以在线服务（如社交媒体平台）用户的隐私为代价，这些服务提供照片管理功能。尤其令人不安的是，即使未对图像进行标记，也能利用无监督学习识别人脸。在本文中，我们提出Ulixes，一种生成视觉上非侵入性的人脸噪声掩码的策略，这些掩码产生对抗样本，从而阻止在面部编码器的嵌入空间中形成可识别的用户聚类。即使在线存在未掩码且已标记的图像，这种方法也适用。我们通过展示各种分类和聚类方法无法可靠地标记我们生成的对抗样本，证明了Ulixes的有效性。我们还研究了Ulixes在各种黑盒设置中的效果，并将其与当前最先进的对抗机器学习方法进行了比较。最后，我们挑战Ulixes对经过对抗训练的模型的有效性，并表明它对反制措施具有鲁棒性。
英文摘要：
Facial recognition tools are becoming exceptionally accurate in identifying people from images. However, this comes at the cost of privacy for users of online services with photo management (e.g. social media platforms). Particularly troubling is the ability to leverage unsupervised learning to recognize faces even when the user has not labeled their images. In this paper we propose Ulixes, a strategy to generate visually non-invasive facial noise masks that yield adversarial examples, preventing the formation of identifiable user clusters in the embedding space of facial encoders. This is applicable even when a user is unmasked and labeled images are available online. We demonstrate the effectiveness of Ulixes by showing that various classification and clustering methods cannot reliably label the adversarial examples we generate. We also study the effects of Ulixes in various black-box settings and compare it to the current state of the art in adversarial machine learning. Finally, we challenge the effectiveness of Ulixes against adversarially trained models and show that it is robust to countermeasures.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
