# Adversarial Image Perturbation for Privacy Protection -- A Game Theory Perspective

arXiv: https://arxiv.org/abs/1703.09471 · HTML: https://mlsanity.com/paper/1703.09471/

## Key facts

- Cited by 38 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 28 Mar 2017.

## Built on by (most cited first, 30 of 38)

- [A Study of Face Obfuscation in ImageNet](https://mlsanity.com/paper/2103.06191/) (2021)
- [Data Poisoning Won't Save You From Facial Recognition](https://mlsanity.com/paper/2106.14851/) (2021)
- [CLIP2Protect: Protecting Facial Privacy using Text-Guided Makeup via Adversarial Latent Search](https://mlsanity.com/paper/2306.10008/) (2023)
- [Image Shortcut Squeezing: Countering Perturbative Availability Poisons with Compression](https://mlsanity.com/paper/2301.13838/) (2023)
- [Transferable Adversarial Facial Images for Privacy Protection](https://mlsanity.com/paper/2408.01428/) (2024)
- [IdentityDP: Differential Private Identification Protection for Face Images](https://mlsanity.com/paper/2103.01745/) (2021)
- [DP-Image: Differential Privacy for Image Data in Feature Space](https://mlsanity.com/paper/2103.07073/) (2021)
- [OPOM: Customized Invisible Cloak towards Face Privacy Protection](https://mlsanity.com/paper/2205.11981/) (2022)
- [Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspective](https://mlsanity.com/paper/2302.09457/) (2023)
- [The Best Defense is a Good Offense: Adversarial Augmentation against Adversarial Attacks](https://mlsanity.com/paper/2305.14188/) (2023)
- [Get a Model! Model Hijacking Attack Against Machine Learning Models](https://mlsanity.com/paper/2111.04394/) (2021)
- [My Face My Choice: Privacy Enhancing Deepfakes for Social Media Anonymization](https://mlsanity.com/paper/2211.01361/) (2022)
- [Does Image Anonymization Impact Computer Vision Training?](https://mlsanity.com/paper/2306.05135/) (2023)
- [Going Grayscale: The Road to Understanding and Improving Unlearnable Examples](https://mlsanity.com/paper/2111.13244/) (2021)
- [Face De-identification: State-of-the-art Methods and Comparative Studies](https://mlsanity.com/paper/2411.09863/) (2024)
- [Two-Face: Adversarial Audit of Commercial Face Recognition Systems](https://mlsanity.com/paper/2111.09137/) (2021)
- [Makeup-Guided Facial Privacy Protection via Untrained Neural Network Priors](https://mlsanity.com/paper/2408.12387/) (2024)
- [Hiding Visual Information via Obfuscating Adversarial Perturbations](https://mlsanity.com/paper/2209.15304/) (2022)
- [Enhancing targeted transferability via feature space fine-tuning](https://mlsanity.com/paper/2401.02727/) (2024)
- [Diffusion-based Adversarial Identity Manipulation for Facial Privacy Protection](https://mlsanity.com/paper/2504.21646/) (2025)
- [Preemptive Image Robustification for Protecting Users against Man-in-the-Middle Adversarial Attacks](https://mlsanity.com/paper/2112.05634/) (2021)
- [DRAG: Dynamic Region-Aware GCN for Privacy-Leaking Image Detection](https://mlsanity.com/paper/2203.09121/) (2022)
- [PrivateGaze: Preserving User Privacy in Black-box Mobile Gaze Tracking Services](https://mlsanity.com/paper/2408.00950/) (2024)
- [Adversary for Social Good: Leveraging Adversarial Attacks to Protect Personal Attribute Privacy](https://mlsanity.com/paper/2306.02488/) (2023)
- [Mitigating Low-Frequency Bias: Feature Recalibration and Frequency Attention Regularization for Adversarial Robustness](https://mlsanity.com/paper/2407.04016/) (2024)
- [Learning Robust and Privacy-Preserving Representations via Information Theory](https://mlsanity.com/paper/2412.11066/) (2024)
- [GMFIM: A Generative Mask-guided Facial Image Manipulation Model for Privacy Preservation](https://mlsanity.com/paper/2201.03353/) (2022)
- [StyleGAN as a Utility-Preserving Face De-identification Method](https://mlsanity.com/paper/2212.02611/) (2022)
- [Roulette: A Semantic Privacy-Preserving Device-Edge Collaborative Inference Framework for Deep Learning Classification Tasks](https://mlsanity.com/paper/2309.02820/) (2023)
- [DivTrackee versus DynTracker: Promoting Diversity in Anti-Facial Recognition against Dynamic FR Strategy](https://mlsanity.com/paper/2501.06533/) (2025)

## Abstract (arXiv)

Users like sharing personal photos with others through social media. At the same time, they might want to make automatic identification in such photos difficult or even impossible. Classic obfuscation methods such as blurring are not only unpleasant but also not as effective as one would expect. Recent studies on adversarial image perturbations (AIP) suggest that it is possible to confuse recognition systems effectively without unpleasant artifacts. However, in the presence of counter measures against AIPs, it is unclear how effective AIP would be in particular when the choice of counter measure is unknown. Game theory provides tools for studying the interaction between agents with uncertainties in the strategies. We introduce a general game theoretical framework for the user-recogniser dynamics, and present a case study that involves current state of the art AIP and person recognition techniques. We derive the optimal strategy for the user that assures an upper bound on the recognition rate independent of the recogniser's counter measure. Code is available at https://goo.gl/hgvbNK.