# Adversarial Privacy-preserving Filter

arXiv: https://arxiv.org/abs/2007.12861 · HTML: https://mlsanity.com/paper/2007.12861/

## Key facts

- Cited by 13 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 25 Jul 2020.

## Built on by (most cited first, 13 of 13)

- [CLIP2Protect: Protecting Facial Privacy using Text-Guided Makeup via Adversarial Latent Search](https://mlsanity.com/paper/2306.10008/) (2023)
- [Fairness for Unobserved Characteristics: Insights from Technological Impacts on Queer Communities](https://mlsanity.com/paper/2102.04257/) (2021)
- [Unlearnable Clusters: Towards Label-agnostic Unlearnable Examples](https://mlsanity.com/paper/2301.01217/) (2022)
- [OPOM: Customized Invisible Cloak towards Face Privacy Protection](https://mlsanity.com/paper/2205.11981/) (2022)
- [Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspective](https://mlsanity.com/paper/2302.09457/) (2023)
- [AdvCloak: Customized Adversarial Cloak for Privacy Protection](https://mlsanity.com/paper/2312.14407/) (2023)
- [Low-Mid Adversarial Perturbation against Unauthorized Face Recognition System](https://mlsanity.com/paper/2206.09410/) (2022)
- [ImageNet Pre-training also Transfers Non-Robustness](https://mlsanity.com/paper/2106.10989/) (2021)
- [Minimum Noticeable Difference based Adversarial Privacy Preserving Image Generation](https://mlsanity.com/paper/2206.08638/) (2022)
- [Adversarial Attacks for Good: A Survey of Proactive Protection across the Visual Content Lifecycle](https://mlsanity.com/paper/2608.04314/) (2026)
- [Debiasing Backdoor Attack: A Benign Application of Backdoor Attack in Eliminating Data Bias](https://mlsanity.com/paper/2202.10582/) (2022)
- [Benign Adversarial Attack: Tricking Models for Goodness](https://mlsanity.com/paper/2107.11986/) (2021)
- [Reversible Unlearnable Examples: Towards the Copyright Protection in Deep Learning Era](https://mlsanity.com/paper/2608.06211/) (2026)

## Abstract (arXiv)

While widely adopted in practical applications, face recognition has been critically discussed regarding the malicious use of face images and the potential privacy problems, e.g., deceiving payment system and causing personal sabotage. Online photo sharing services unintentionally act as the main repository for malicious crawler and face recognition applications. This work aims to develop a privacy-preserving solution, called Adversarial Privacy-preserving Filter (APF), to protect the online shared face images from being maliciously used.We propose an end-cloud collaborated adversarial attack solution to satisfy requirements of privacy, utility and nonaccessibility. Specifically, the solutions consist of three modules: (1) image-specific gradient generation, to extract image-specific gradient in the user end with a compressed probe model; (2) adversarial gradient transfer, to fine-tune the image-specific gradient in the server cloud; and (3) universal adversarial perturbation enhancement, to append image-independent perturbation to derive the final adversarial noise. Extensive experiments on three datasets validate the effectiveness and efficiency of the proposed solution. A prototype application is also released for further evaluation.We hope the end-cloud collaborated attack framework could shed light on addressing the issue of online multimedia sharing privacy-preserving issues from user side.