3D-Aware Adversarial Makeup Generation for Facial Privacy Protection

TL;DR

This paper introduces 3DAM-GAN, a novel 3D-aware adversarial makeup generation method that enhances privacy protection by creating realistic, transferable makeup adversarial examples to fool face recognition systems.

Contribution

The paper presents a new 3D-aware GAN with a UV-based generator and ensemble training for improved makeup realism, transferability, and face privacy protection.

Findings

Effective protection against various face recognition models.

High-quality, realistic makeup adversarial examples.

Improved transferability over existing methods.

Abstract

The privacy and security of face data on social media are facing unprecedented challenges as it is vulnerable to unauthorized access and identification. A common practice for solving this problem is to modify the original data so that it could be protected from being recognized by malicious face recognition (FR) systems. However, such ``adversarial examples'' obtained by existing methods usually suffer from low transferability and poor image quality, which severely limits the application of these methods in real-world scenarios. In this paper, we propose a 3D-Aware Adversarial Makeup Generation GAN (3DAM-GAN). which aims to improve the quality and transferability of synthetic makeup for identity information concealing. Specifically, a UV-based generator consisting of a novel Makeup Adjustment Module (MAM) and Makeup Transfer Module (MTM) is designed to render realistic and robust makeup with the aid of symmetric characteristics of human faces. Moreover, a makeup attack mechanism with an ensemble training strategy is proposed to boost the transferability of black-box models. Extensive experiment results on several benchmark datasets demonstrate that 3DAM-GAN could effectively protect faces against various FR models, including both publicly available state-of-the-art models and commercial face verification APIs, such as Face++, Baidu and Aliyun.