用于隐私保护的可迁移对抗性人脸图像
Transferable Adversarial Facial Images for Privacy Protection
AI总结：
针对黑盒下面部隐私保护难题，提出通过全局对抗隐变量搜索与关键点正则化生成自然、高可迁移对抗人脸图像的方法。
摘要：
深度人脸识别（FR）系统的成功引发了严重的隐私担忧，因为它们能够在数字世界中对用户进行未经授权的跟踪。以往研究提出向人脸图像中引入难以察觉的对抗噪声，以欺骗这些人脸识别模型，从而实现增强面部隐私保护的目标。然而，这些方法严重依赖用户选择的参考图像来引导对抗噪声的生成，并且无法在黑盒场景中同时构建自然且具有高可迁移性的对抗性人脸图像。鉴于此，我们提出了一种新颖的面部隐私保护方案，在保持高视觉质量的同时提升可迁移性。我们建议直接塑造整个人脸空间，而不是利用化妆信息等某一种面部特征来整合对抗噪声。为实现这一目标，我们首先利用全局对抗隐变量搜索遍历生成模型的隐空间，从而生成具有高可迁移性的自然对抗性人脸图像。随后，我们引入关键关键点正则化模块，以保留视觉身份信息。最后，我们研究了各类隐空间的影响，发现 $\mathcal{F}$ 隐空间有利于在视觉自然性与对抗可迁移性之间取得平衡。在两个数据集上进行的大量实验表明，我们的方法在保持高视觉质量的同时显著增强了攻击可迁移性，其性能优于最先进方法：在深度 FR 模型上平均提升25%，在包括 Face++、Aliyun 和 Tencent 在内的商业 FR API 上平均提升10%。
英文摘要：
The success of deep face recognition (FR) systems has raised serious privacy concerns due to their ability to enable unauthorized tracking of users in the digital world. Previous studies proposed introducing imperceptible adversarial noises into face images to deceive those face recognition models, thus achieving the goal of enhancing facial privacy protection. Nevertheless, they heavily rely on user-chosen references to guide the generation of adversarial noises, and cannot simultaneously construct natural and highly transferable adversarial face images in black-box scenarios. In light of this, we present a novel face privacy protection scheme with improved transferability while maintain high visual quality. We propose shaping the entire face space directly instead of exploiting one kind of facial characteristic like makeup information to integrate adversarial noises. To achieve this goal, we first exploit global adversarial latent search to traverse the latent space of the generative model, thereby creating natural adversarial face images with high transferability. We then introduce a key landmark regularization module to preserve the visual identity information. Finally, we investigate the impacts of various kinds of latent spaces and find that $\mathcal{F}$ latent space benefits the trade-off between visual naturalness and adversarial transferability. Extensive experiments over two datasets demonstrate that our approach significantly enhances attack transferability while maintaining high visual quality, outperforming state-of-the-art methods by an average 25% improvement in deep FR models and 10% improvement on commercial FR APIs, including Face++, Aliyun, and Tencent.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
