# Toward Face Biometric De-identification using Adversarial Examples

arXiv: https://arxiv.org/abs/2302.03657 · HTML: https://mlsanity.com/paper/2302.03657/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- Builds on 22 of its 38 references that are in the map.
- First posted on arXiv 7 Feb 2023.

## Builds on (most cited first, 22 of 22)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Squeeze-and-Excitation Networks](https://mlsanity.com/paper/1709.01507/) (2017)
- [FaceNet: A Unified Embedding for Face Recognition and Clustering](https://mlsanity.com/paper/1503.03832/) (2015)
- [Adversarial examples in the physical world](https://mlsanity.com/paper/1607.02533/) (2016)
- [DeepFool: a simple and accurate method to fool deep neural networks](https://mlsanity.com/paper/1511.04599/) (2015)
- [VGGFace2: A dataset for recognising faces across pose and age](https://mlsanity.com/paper/1710.08092/) (2017)
- [Joint Face Detection and Alignment using Multi-task Cascaded Convolutional Networks](https://mlsanity.com/paper/1604.02878/) (2016)
- [Evasion Attacks against Machine Learning at Test Time](https://mlsanity.com/paper/1708.06131/) (2017)
- [LowKey: Leveraging Adversarial Attacks to Protect Social Media Users from Facial Recognition](https://mlsanity.com/paper/2101.07922/) (2021)
- [Face Image Quality Assessment: A Literature Survey](https://mlsanity.com/paper/2009.01103/) (2020)
- [SensitiveLoss: Improving Accuracy and Fairness of Face Representations with Discrimination-Aware Deep Learning](https://mlsanity.com/paper/2004.11246/) (2020)
- [Biometric Quality: Review and Application to Face Recognition with FaceQnet](https://mlsanity.com/paper/2006.03298/) (2020)
- [OPOM: Customized Invisible Cloak towards Face Privacy Protection](https://mlsanity.com/paper/2205.11981/) (2022)
- [Facial Soft Biometrics for Recognition in the Wild: Recent Works, Annotation, and COTS Evaluation](https://mlsanity.com/paper/2210.13129/) (2022)
- [SensitiveNets: Learning Agnostic Representations with Application to Face Images](https://mlsanity.com/paper/1902.00334/) (2019)
- [Quality Measures in Biometric Systems](https://mlsanity.com/paper/2111.08704/) (2021)
- [Ulixes: Facial Recognition Privacy with Adversarial Machine Learning](https://mlsanity.com/paper/2010.10242/) (2020)
- [OTB-morph: One-Time Biometrics via Morphing applied to Face Templates](https://mlsanity.com/paper/2111.13213/) (2021)
- [Learning Emotional-Blinded Face Representations](https://mlsanity.com/paper/2009.08704/) (2020)
- [Introduction to Presentation Attack Detection in Iris Biometrics and Recent Advances](https://mlsanity.com/paper/2111.12465/) (2021)

## Built on by (most cited first, 8 of 8)

- [Is My Data in Your AI? Membership Inference Test (MINT) applied to Face Biometrics](https://mlsanity.com/paper/2402.09225/) (2024)
- [PBa-LLM: Privacy- and Bias-aware NLP using Named-Entity Recognition (NER)](https://mlsanity.com/paper/2507.02966/) (2025)
- [Face De-identification: State-of-the-art Methods and Comparative Studies](https://mlsanity.com/paper/2411.09863/) (2024)
- [SaFL: Sybil-aware Federated Learning with Application to Face Recognition](https://mlsanity.com/paper/2311.04346/) (2023)
- [Blockchain and Biometrics: Survey, GDPR Analysis, and Future Directions](https://mlsanity.com/paper/2302.10883/) (2023)
- [PAD-Phys: Exploiting Physiology for Presentation Attack Detection in Face Biometrics](https://mlsanity.com/paper/2310.02140/) (2023)
- [Palmprint De-Identification Using Diffusion Model for High-Quality and Diverse Synthesis](https://mlsanity.com/paper/2504.08272/) (2025)
- [NLML-HPE: Head Pose Estimation with Limited Data via Manifold Learning](https://mlsanity.com/paper/2507.18429/) (2025)

## Abstract (arXiv)

The remarkable success of face recognition (FR) has endangered the privacy of internet users particularly in social media. Recently, researchers turned to use adversarial examples as a countermeasure. In this paper, we assess the effectiveness of using two widely known adversarial methods (BIM and ILLC) for de-identifying personal images. We discovered, unlike previous claims in the literature, that it is not easy to get a high protection success rate (suppressing identification rate) with imperceptible adversarial perturbation to the human visual system. Finally, we found out that the transferability of adversarial examples is highly affected by the training parameters of the network with which they are generated.