ErasableMask: A Robust and Erasable Privacy Protection Scheme against Black-box Face Recognition Models
Not on the map. Why?
Abstract (arXiv)
While face recognition (FR) models have brought remarkable convenience in face verification and identification, they also pose substantial privacy risks to the public. Existing facial privacy protection schemes usually adopt adversarial examples to disrupt face verification of FR models. However, these schemes often suffer from weak transferability against black-box FR models and permanently damage the identifiable information that cannot fulfill the requirements of authorized operations such as forensics and authentication. To address these limitations, we propose ErasableMask, a robust and erasable privacy protection scheme against black-box FR models. Specifically, via rethinking the inherent relationship between surrogate FR models, ErasableMask introduces a novel meta-auxiliary attack, which boosts black-box transferability by learning more general features in a stable and balancing optimization strategy. It also offers a perturbation erasion mechanism that supports the erasion of semantic perturbations in protected face without degrading image quality. To further improve performance, ErasableMask employs a curriculum learning strategy to mitigate optimization conflicts between adversarial attack and perturbation erasion. Extensive experiments on the CelebA-HQ and FFHQ datasets demonstrate that ErasableMask achieves the state-of-the-art performance in transferability, achieving over 72% confidence on average in commercial FR systems. Moreover, ErasableMask also exhibits outstanding perturbation erasion performance, achieving over 90% erasion success rate.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 41 of its 62 references that are in the map. First posted on arXiv 22 Dec 2024.
Builds on
41 of 62 references.
References · 41
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2018A Style-Based Generator Architecture for Generative Adversarial Networkscited by 5,986
- 2017Model-Agnostic Meta-Learning for Fast Adaptation of Deep Networkscited by 4,861
- 2017Squeeze-and-Excitation Networkscited by 4,763
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2017Progressive Growing of GANs for Improved Quality, Stability, and Variationcited by 2,967
- 2015FaceNet: A Unified Embedding for Face Recognition and Clusteringcited by 2,833
- 2018CosFace: Large Margin Cosine Loss for Deep Face Recognitioncited by 968
- 2016Joint Face Detection and Alignment using Multi-task Cascaded Convolutional Networkscited by 895
29 more
- 2018Deep Face Recognition: A Surveycited by 275
- 2017AttGAN: Facial Attribute Editing by Only Changing What You Wantcited by 241
- 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 173
- 2019AdvHat: Real-world adversarial attack on ArcFace Face ID systemcited by 161
- 2021MBRS : Enhancing Robustness of DNN-based Watermarking by Mini-Batch of Real and Simulated JPEG Compressioncited by 108
- 2021Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognitioncited by 95
- 2019SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editingcited by 93
- 2019Self-Supervised Generalisation with Meta Auxiliary Learningcited by 88
- 2019Regularized Fine-grained Meta Face Anti-spoofingcited by 86
- 2021Improving Transferability of Adversarial Patches on Face Recognition with Generative Modelscited by 80
- 2020Towards Transferable Adversarial Attack against Deep Face Recognitioncited by 79
- 2022Protecting Facial Privacy: Generating Adversarial Identity Masks via Style-robust Makeup Transfercited by 77
- 2020Towards Face Encryption by Generating Adversarial Identity Maskscited by 62
- 2019AdvFaces: Adversarial Face Synthesiscited by 59
- 2020Improved Residual Networks for Image and Video Recognitioncited by 52
- 2022Adv-Attribute: Inconspicuous and Transferable Adversarial Attack on Face Recognitioncited by 42
- 2023CLIP2Protect: Protecting Facial Privacy using Text-Guided Makeup via Adversarial Latent Searchcited by 42
- 2022Simultaneously Optimizing Perturbations and Positions for Black-box Adversarial Patch Attackscited by 41
- 2023WavMark: Watermarking for Audio Generationcited by 41
- 2018Attacks on State-of-the-Art Face Recognition using Attentional Adversarial Attack Generative Networkcited by 38
- 2023DiffProtect: Generate Adversarial Examples with Diffusion Models for Facial Privacy Protectioncited by 34
- 2023Sibling-Attack: Rethinking Transferable Adversarial Attacks against Face Recognitioncited by 32
- 2024Transferable Adversarial Facial Images for Privacy Protectioncited by 26
- 2023Adv-Diffusion: Imperceptible Adversarial Face Identity Attack via Latent Diffusion Modelcited by 21
- 2015Robust Face Recognition via Multimodal Deep Face Representationcited by 19
- 2022Discrete Point-wise Attack Is Not Enough: Generalized Manifold Adversarial Attack for Face Recognitioncited by 11
- 2022Self-recoverable Adversarial Examples: A New Effective Protection Mechanism in Social Networkscited by 6
- 2019Reversible Adversarial Attack based on Reversible Image Transformationcited by 5
- 2018Unauthorized AI cannot Recognize Me: Reversible Adversarial Examplecited by 4
Built on by
Citing papers per year: 2026: 1.
1 paper.