Fawkes: Protecting Privacy against Unauthorized Deep Learning Models

Abstract

Today's proliferation of powerful facial recognition systems poses a real threat to personal privacy. As Clearview.ai demonstrated, anyone can canvas the Internet for data and train highly accurate facial recognition models of individuals without their knowledge. We need tools to protect ourselves from potential misuses of unauthorized facial recognition systems. Unfortunately, no practical or effective solutions exist. In this paper, we propose Fawkes, a system that helps individuals inoculate their images against unauthorized facial recognition models. Fawkes achieves this by helping users add imperceptible pixel-level changes (we call them "cloaks") to their own photos before releasing them. When used to train facial recognition models, these "cloaked" images produce functional models that consistently cause normal images of the user to be misidentified. We experimentally demonstrate that Fawkes provides 95+% protection against user recognition regardless of how trackers train their models. Even when clean, uncloaked images are "leaked" to the tracker and used for training, Fawkes can still maintain an 80+% protection success rate. We achieve 100% success in experiments against today's state-of-the-art facial recognition services. Finally, we show that Fawkes is robust against a variety of countermeasures that try to detect or disrupt image cloaks.

References in corpus (17)

• Deep Learning with Differential Privacy
• How transferable are features in deep neural networks?
• Learning Face Representation from Scratch
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Countering Adversarial Images using Input Transformations
• Detecting Adversarial Samples from Artifacts
• Robustness May Be at Odds with Accuracy
• AdvHat: Real-world adversarial attack on ArcFace Face ID system
• Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
• Generative Poisoning Attack Method Against Neural Networks
• Transferable Clean-Label Poisoning Attacks on Deep Neural Nets
• Detection of Adversarial Training Examples in Poisoning Attacks through Anomaly Detection
• Gotta Catch 'Em All: Using Honeypots to Catch Adversarial Attacks on Neural Networks
• Privacy-Protective-GAN for Face De-identification
• Hiding Faces in Plain Sight: Disrupting AI Face Synthesis with Adversarial Perturbations
• Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectors

Cited by in corpus (6)

• RobustBench: a standardized adversarial robustness benchmark
• SocialGuard: An Adversarial Example Based Privacy-Preserving Technique for Social Images
• Ulixes: Facial Recognition Privacy with Adversarial Machine Learning
• Using a GAN to Generate Adversarial Examples to Facial Image Recognition
• Adversarial Transfer Attacks With Unknown Data and Class Overlap
• Adversarial for Good? How the Adversarial ML Community's Values Impede Socially Beneficial Uses of Attacks