Towards Face Encryption by Generating Adversarial Identity Masks

1. Introduction

• Unauthorized parties may identify photos shared on social media, exposing personal information without the owners’ permission.The motivation notes cybercasing as a possible consequence of this exposure.Source: §1 · p. 1
• The target is open-set face identification: the system should misidentify a user as an authorized or virtual target, while the image remains natural to people.The paper notes that recognition systems are generally unknown and cannot be queried directly.Source: §1 · pp. 1–2
• The method generates transferable, imperceptible masks through iterative optimization against white-box and black-box face systems using multiple target identities.Transferability concerns deceiving other black-box systems; imperceptibility means the altered photo remains visually natural to human observers.Source: §1 · p. 2
• TIP-IM reports 95+% protection success against white-box face systems in practical open-set tests and outperforms prior methods against state-of-the-art algorithms.The paper also reports effectiveness in an experiment using a commercial API service.Source: §1 · p. 2
• The paper frames user-centered protection around targeted outputs, natural images, black-box systems, and an unknown gallery set.Its proposed optimization uses multi-target sets and a mechanism intended to work across scenarios.Source: §1 · p. 2

Obfuscation-based methods

• Obfuscation methods such as blurring and pixelation can be ineffective against current recognition systems, while more sophisticated approaches may alter appearance or produce unnatural images.GAN-based synthesis and landmark-conditioned in-painting are examples of these more sophisticated approaches [49] [43].Source: §2 · pp. 2–3

Comparison of methods

• Table 1 compares methods by gallery-set knowledge, targeted misclassification, black-box support, naturalness, and human recognition of the same identity.The caption identifies comparison dimensions but does not establish which method performs best.Source: Table 1 · p. 3

Adversarial methods

• The paper distinguishes its adversarial approach from Fawkes [39] and [32] by targeting unknown systems without training-data changes, open-set galleries, and controllable naturalness under an ℓp norm.It characterizes [32] as assuming white-box access and contrasts open-set identification with closed-set classification.Source: §2 · p. 3

Differential privacy

• Differential privacy protects whether an entity is present in a dataset, whereas this paper addresses concealing one person’s identity by exploiting neural-network vulnerabilities [45].The cited discussion mentions DP methods and applications.Source: §2 · p. 3

3. Adversarial Identity Mask

• Face recognition compares feature distances between a probe and gallery images, assigning the probe to the identity of the nearest gallery image.The model maps an image to a fixed-length feature representation.Source: §3 · p. 3
• The method adds an adversarial mask to an image and permits recognition as any identity in a target set rather than requiring one specific target.The paper says this relaxed target constraint makes identity protection easier to achieve.Source: §3 · p. 3
• The formulation combines a relative identification loss with a naturalness constraint and an ℓp perturbation bound.The relative loss increases the feature-distance gap between a target image and the original; the naturalness condition and norm bound constrain the protected image’s appearance.Source: §3 · p. 3
• The protected image should look natural because an ℓp norm bound alone may still permit perceptible perturbations that do not fit human perception well.The paper proposes an additional naturalness objective to constrain images toward the real-image data manifold.Source: §3 · p. 3, Figure 2 · p. 4
• Because the real gallery is unknown, the method optimizes against substitute target-identity images and the original image instead of the unavailable gallery examples.The rationale is that images of one identity have similar representations, so matching substitutes may also bring the protected image close to that identity’s gallery images.Source: §3 · p. 4
• The evaluation is designed to simulate real-world settings with minimum assumptions about the target face-recognition system, which the paper describes as more challenging than prior settings.Source: §3 · p. 4

4.1. Problem Formulation

• The objective increases feature-space separation from a selected target while constraining perturbation size and using MMD to encourage natural-looking protected images.MMD compares generated and real-image batches; minimizing it constrains generated images toward the real-data manifold.Source: §4.1 · p. 4

4.2. Targeted Identity-Protection Iterative Method

• TIP-IM minimizes the batch loss through repeated small-step gradient updates, projecting images onto the perturbation bound and using momentum to improve transferability and avoid local minima.For a single image or a small image set, transformations can augment the batch.Source: §4.2 · pp. 4–5

4.3. Search Optimal xt via Greedy Insertion

• For multiple targets, greedy insertion selects a target with the largest marginal gain at each iteration, using feature-based similarity to guide selection.The method is an approximate solution: the authors note that strict submodularity is not guaranteed.Source: §4.3 · p. 5

5.1. Experimental Settings

• Experiments use LFW and MegFace, with 500 protected identities, 10 target identities, and 500 additional gallery identities; one model generates masks while other models test protection.The evaluation reports targeted and untargeted Rank-N success rates alongside PSNR, SSIM, and MMD image-quality measures.Source: §5 · pp. 5–6, §5.1 · p. 6

5.2. Effectiveness of Black-box Face Encryption

• TIP-IM achieves nearly twice MT-DIM’s success rates on Rank-1-T and Rank-5-T, with similar SSIM values and average Rank-1-UT accuracy above 80% for black-box models.The evaluation also reports Rank-1-T and Rank-5-T results in Table 3 and Rank-1-UT and Rank-5-UT results in Table 4; StyleGAN-generated target images are also reported to work for black-box protection.Source: §5.2 · pp. 6–7, Table 3 · p. 7, Table 4 · p. 7

5.3. Naturalness

• As γ increases, image quality improves, but identity protection can fail; users can adjust γ to trade stronger obfuscation against better visual quality.The study evaluates PSNR, SSIM, and MMD across γ values and reports a general downward trend in SSIM as Rank-1-T accuracy increases.Source: §5.3 · pp. 7–8, Table 5 · p. 7, Figure 4 · p. 8

5.4. Effectiveness on a Real-World Application

• On a commercial face-search API with unknown mechanisms and training data, all 20 original probes were identifiable at Rank 1; protected probes returned target identities in 6 Rank-1 and 16 Rank-5 results.Two examples are shown in Figure 6.Source: §5.4 · p. 8, Figure 6 · p. 8

• TIP-IM is evaluated by simulating realistic identification systems in social media.Source: §6 · p. 8
• Extensive experiments show that TIP-IM enables users to protect private information from unauthorized identification systems.Source: §6 · p. 8
• The reported protection does not affect users’ experience in social media.Source: §6 · p. 8

• MegFace has more than 50k gallery images, making it a large-scale evaluation dataset.Source: A. Evaluation Results on MegFace · p. 9
• The passage characterizes targeted identity protection on MegFace as more difficult overall than on LFW.Source: A. Evaluation Results on MegFace · p. 9
• Results on the MegFace dataset are reported in Table 8.Source: A. Evaluation Results on MegFace · p. 9

• Visual-quality evaluation becomes stable when batch size exceeds 50.The paper sets the batch size to 50.Source: B. Batch Analysis on MMD Optimization · p. 9, Table 6 · p. 9
• For single-image crafting, the paper considers self-augmentation or collecting irrelevant images to form an optimization batch.Self-augmentation includes rotation, projective, brightness, and transformations.Source: B. Batch Analysis on MMD Optimization · p. 9
• Table 6 reports mean PSNR (db) and SSIM for different batch sizes based on CosFace.Source: Table 6 · p. 9

• The black-box protection curve rises and then approaches a steady state as the number of targets increases.The figure identifies MobileFace as the surrogate white-box model.Source: C. Comparison Experiments about Target… · p. 9, Figure 7 · p. 9
• The target-image experiment uses StyleGAN-generated images, with examples shown in Figure 8.Source: C. Comparison Experiments about Target… · p. 9, Figure 8 · p. 9
• TIP-IM retains excellent black-box identity-protection performance with generated target images against six face-recognition models.The models are SphereFace, FaceNet, ArcFace, MobileFace, ResNet, and CosFace; Table 7 reports the results.Source: C. Comparison Experiments about Target… · p. 9, Table 7 · p. 9
• The method is described as applicable to available authorized target identities or generated facial images.Source: C. Comparison Experiments about Target… · p. 9

D. Ill-suited ℓp-norm perturbation in Face encryption

• Even pixel changes of 12 or 16 on a 0–255 scale can leave artifacts that sacrifice perceived visual quality.The passage cites Fig. 9 for this comparison with existing attack methods such as PGD and MIM.Source: D. Ill-suited ℓp-norm perturbation in… · p. 9
• ℓp-norm adversarial perturbations do not naturally fit human perception.The passage says this observation accords with [54] [38].Source: D. Ill-suited ℓp-norm perturbation in… · p. 9
• TIP-IM uses multi-target optimization and Lnat in its objective to generate more natural images.The passage presents these as design choices intended to improve effectiveness and naturalness.Source: D. Ill-suited ℓp-norm perturbation in… · p. 9