DIP-Watermark：一种基于鲁棒对抗水印的双重身份保护方法
DIP-Watermark: A Double Identity Protection Method Based on Robust Adversarial Watermark
AI总结：
本文提出DIP-Watermark方案，通过一次性嵌入可追溯对抗水印，在欺骗未授权人脸识别的同时支持授权方验证身份，并利用信息引导攻击与协同元优化提升鲁棒性和可追溯性。
摘要：
人脸识别（FR）系统的广泛部署带来了隐私风险。一种应对措施是对抗攻击，它可以欺骗未经授权的恶意FR系统，但同时也会干扰可信授权方的正常身份验证，从而加剧身份冒充的潜在威胁。为了解决这一问题，我们提出了首个基于可追溯对抗水印的双重身份保护方案，称为DIP-Watermark。DIP-Watermark采用一次性水印嵌入来欺骗未经授权的FR模型，并允许授权方通过提取水印进行身份验证。具体而言，我们提出了一种针对FR模型的信息引导对抗攻击。编码器将特定身份的水印嵌入到载体的深度特征空间中，引导图像的可识别特征偏离源身份。我们进一步采用了一种与子任务兼容的协同元优化策略，该策略正则化编码器和解码器的联合优化方向。该策略增强了通用载体特征的表示能力，缓解了水印中多目标优化的冲突。实验证实，DIP-Watermark在最先进的FR模型上取得了显著的攻击成功率和可追溯精度，表现出卓越的鲁棒性，优于现有的使用对抗攻击和深度水印的隐私保护方法，或二者的简单组合。我们的工作可能为FR隐私的主动保护开辟新的见解。
英文摘要：
The wide deployment of Face Recognition (FR) systems poses privacy risks. One countermeasure is adversarial attack, deceiving unauthorized malicious FR, but it also disrupts regular identity verification of trusted authorizers, exacerbating the potential threat of identity impersonation. To address this, we propose the first double identity protection scheme based on traceable adversarial watermarking, termed DIP-Watermark. DIP-Watermark employs a one-time watermark embedding to deceive unauthorized FR models and allows authorizers to perform identity verification by extracting the watermark. Specifically, we propose an information-guided adversarial attack against FR models. The encoder embeds an identity-specific watermark into the deep feature space of the carrier, guiding recognizable features of the image to deviate from the source identity. We further adopt a collaborative meta-optimization strategy compatible with sub-tasks, which regularizes the joint optimization direction of the encoder and decoder. This strategy enhances the representation of universal carrier features, mitigating multi-objective optimization conflicts in watermarking. Experiments confirm that DIP-Watermark achieves significant attack success rates and traceability accuracy on state-of-the-art FR models, exhibiting remarkable robustness that outperforms the existing privacy protection methods using adversarial attacks and deep watermarking, or simple combinations of the two. Our work potentially opens up new insights into proactive protection for FR privacy.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
