PuFace：防御针对人脸识别模型的面部伪装攻击
PuFace: Defending against Facial Cloaking Attacks for Facial Recognition Models
AI总结：
本文提出 PuFace 图像净化系统，利用神经网络的泛化能力在训练前将伪装图像推向自然图像流形，有效防御面部伪装攻击，将攻击成功率降至 7.61%，且不降低模型正常准确率。
摘要：
最近提出的面部伪装攻击通过在面部图像中添加不可见的扰动（伪装），来保护用户免受未授权的人脸识别模型的识别。然而，我们表明这些“伪装”并不足够鲁棒，可以从图像中被移除。本文介绍了 PuFace，这是一个图像净化系统，它利用神经网络的泛化能力，在人脸识别模型的训练过程之前，通过将伪装图像推向自然（未伪装）图像的流形，来削弱伪装的影响。具体而言，我们设计了一个净化器，它将所有训练图像（包括伪装图像和自然图像）作为输入，并生成接近自然图像所在流形的净化面部图像。为了实现防御目标，我们提出在特别放大的伪装图像上训练净化器，并使用结合图像损失和特征损失的损失函数。我们的实证实验表明，PuFace 能够有效防御两种最先进的面部伪装攻击，并在不降低各种人脸识别模型正常准确率的情况下，将攻击成功率平均从 69.84% 降低至 7.61%。此外，PuFace 是一种与模型无关的防御机制，无需修改模型结构即可应用于任何人脸识别模型。
英文摘要：
The recently proposed facial cloaking attacks add invisible perturbation (cloaks) to facial images to protect users from being recognized by unauthorized facial recognition models. However, we show that the "cloaks" are not robust enough and can be removed from images. This paper introduces PuFace, an image purification system leveraging the generalization ability of neural networks to diminish the impact of cloaks by pushing the cloaked images towards the manifold of natural (uncloaked) images before the training process of facial recognition models. Specifically, we devise a purifier that takes all the training images including both cloaked and natural images as input and generates the purified facial images close to the manifold where natural images lie. To meet the defense goal, we propose to train the purifier on particularly amplified cloaked images with a loss function that combines image loss and feature loss. Our empirical experiment shows PuFace can effectively defend against two state-of-the-art facial cloaking attacks and reduces the attack success rate from 69.84\% to 7.61\% on average without degrading the normal accuracy for various facial recognition models. Moreover, PuFace is a model-agnostic defense mechanism that can be applied to any facial recognition model without modifying the model structure.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
