# Face-Off: Adversarial Face Obfuscation

arXiv: https://arxiv.org/abs/2003.08861 · HTML: https://mlsanity.com/paper/2003.08861/

## Key facts

- Cited by 25 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 19 Mar 2020.

## Built on by (most cited first, 25 of 25)

- [Glaze: Protecting Artists from Style Mimicry by Text-to-Image Models](https://mlsanity.com/paper/2302.04222/) (2023)
- [Data Poisoning Won't Save You From Facial Recognition](https://mlsanity.com/paper/2106.14851/) (2021)
- [SoK: Anti-Facial Recognition Technology](https://mlsanity.com/paper/2112.04558/) (2021)
- [FACE-AUDITOR: Data Auditing in Facial Recognition Systems](https://mlsanity.com/paper/2304.02782/) (2023)
- [Data Isotopes for Data Provenance in DNNs](https://mlsanity.com/paper/2208.13893/) (2022)
- [Towards a Robust and Trustworthy Machine Learning System Development: An Engineering Perspective](https://mlsanity.com/paper/2101.03042/) (2021)
- [Fairness Properties of Face Recognition and Obfuscation Systems](https://mlsanity.com/paper/2108.02707/) (2021)
- [Two-Face: Adversarial Audit of Commercial Face Recognition Systems](https://mlsanity.com/paper/2111.09137/) (2021)
- [Rethinking Image-Scaling Attacks: The Interplay Between Vulnerabilities in Machine Learning Systems](https://mlsanity.com/paper/2104.08690/) (2021)
- [Meta-Cognition. An Inverse-Inverse Reinforcement Learning Approach for Cognitive Radars](https://mlsanity.com/paper/2205.01794/) (2022)
- [Adversarial for Good? How the Adversarial ML Community's Values Impede Socially Beneficial Uses of Attacks](https://mlsanity.com/paper/2107.10302/) (2021)
- [Evaluation of Human Visual Privacy Protection: A Three-Dimensional Framework and Benchmark Dataset](https://mlsanity.com/paper/2507.13981/) (2025)
- [Towards Robust Vision Transformer via Masked Adaptive Ensemble](https://mlsanity.com/paper/2407.15385/) (2024)
- [ReFace: Real-time Adversarial Attacks on Face Recognition Systems](https://mlsanity.com/paper/2206.04783/) (2022)
- [StyleGAN as a Utility-Preserving Face De-identification Method](https://mlsanity.com/paper/2212.02611/) (2022)
- [Data Defenses Against Large Language Models](https://mlsanity.com/paper/2410.13138/) (2024)
- [Towards Privacy-aware Mental Health AI Models: Advances, Challenges, and Opportunities](https://mlsanity.com/paper/2502.00451/) (2025)
- [Addressing Privacy Threats from Machine Learning](https://mlsanity.com/paper/2111.04439/) (2021)
- [Group-based Robustness: A General Framework for Customized Robustness in the Real World](https://mlsanity.com/paper/2306.16614/) (2023)
- [Facial Data Minimization: Shallow Model as Your Privacy Filter](https://mlsanity.com/paper/2310.15590/) (2023)
- [Mendata: A Framework to Purify Manipulated Training Data](https://mlsanity.com/paper/2312.01281/) (2023)
- [Mask-up: Investigating Biases in Face Re-identification for Masked Faces](https://mlsanity.com/paper/2402.13771/) (2024)
- [FairDeFace: Evaluating the Fairness and Adversarial Robustness of Face Obfuscation Methods](https://mlsanity.com/paper/2503.08731/) (2025)
- [AuraMask: An Extensible Pipeline for Developing Aesthetic Anti-Facial Recognition Image Filters](https://mlsanity.com/paper/2605.12937/) (2026)
- [Personalized Face Privacy Protection From a Single Image](https://mlsanity.com/paper/2605.19032/) (2026)

## Abstract (arXiv)

Advances in deep learning have made face recognition technologies pervasive. While useful to social media platforms and users, this technology carries significant privacy threats. Coupled with the abundant information they have about users, service providers can associate users with social interactions, visited places, activities, and preferences--some of which the user may not want to share. Additionally, facial recognition models used by various agencies are trained by data scraped from social media platforms. Existing approaches to mitigate these privacy risks from unwanted face recognition result in an imbalanced privacy-utility trade-off to users. In this paper, we address this trade-off by proposing Face-Off, a privacy-preserving framework that introduces strategic perturbations to the user's face to prevent it from being correctly recognized. To realize Face-Off, we overcome a set of challenges related to the black-box nature of commercial face recognition services, and the scarcity of literature for adversarial attacks on metric networks. We implement and evaluate Face-Off to find that it deceives three commercial face recognition services from Microsoft, Amazon, and Face++. Our user study with 423 participants further shows that the perturbations come at an acceptable cost for the users.