Face Encryption via Frequency-Restricted Identity-Agnostic Attacks

TL;DR

This paper introduces FRIA, a novel face encryption method that uses frequency-restricted adversarial attacks to protect biometric privacy against black-box face recognition systems, ensuring natural appearance and high attack success.

Contribution

The study proposes a frequency-restricted, identity-agnostic adversarial framework that enhances black-box face recognition attack success and visual naturalness, addressing limitations of prior methods.

Findings

Achieves 96% success rate in black-box face recognition attacks.

Generates more natural-looking encrypted faces compared to existing methods.

Effective against real-world commercial face recognition APIs.

Abstract

Billions of people are sharing their daily live images on social media everyday. However, malicious collectors use deep face recognition systems to easily steal their biometric information (e.g., faces) from these images. Some studies are being conducted to generate encrypted face photos using adversarial attacks by introducing imperceptible perturbations to reduce face information leakage. However, existing studies need stronger black-box scenario feasibility and more natural visual appearances, which challenge the feasibility of privacy protection. To address these problems, we propose a frequency-restricted identity-agnostic (FRIA) framework to encrypt face images from unauthorized face recognition without access to personal information. As for the weak black-box scenario feasibility, we obverse that representations of the average feature in multiple face recognition models are similar, thus we propose to utilize the average feature via the crawled dataset from the Internet as the target to guide the generation, which is also agnostic to identities of unknown face recognition systems; in nature, the low-frequency perturbations are more visually perceptible by the human vision system. Inspired by this, we restrict the perturbation in the low-frequency facial regions by discrete cosine transform to achieve the visual naturalness guarantee. Extensive experiments on several face recognition models demonstrate that our FRIA outperforms other state-of-the-art methods in generating more natural encrypted faces while attaining high black-box attack success rates of 96%. In addition, we validate the efficacy of FRIA using real-world black-box commercial API, which reveals the potential of FRIA in practice. Our codes can be found in https://github.com/XinDong10/FRIA.