Personalized Privacy Protection Mask Against Unauthorized Facial Recognition

TL;DR

This paper presents Chameleon, a novel personalized privacy mask that efficiently protects facial images from unauthorized recognition, maintaining visual quality and robustness against unknown models through a user-centric, ensemble learning approach.

Contribution

Introduces P3-Mask, a user-specific privacy protection mask generated via cross-image optimization, enhancing efficiency, visual quality, and robustness against unknown face recognition models.

Findings

Outperforms state-of-the-art methods in protection effectiveness

Maintains high visual quality of protected images

Provides cost-effective de-obfuscation for authorized use

Abstract

Face recognition (FR) can be abused for privacy intrusion. Governments, private companies, or even individual attackers can collect facial images by web scraping to build an FR system identifying human faces without their consent. This paper introduces Chameleon, which learns to generate a user-centric personalized privacy protection mask, coined as P3-Mask, to protect facial images against unauthorized FR with three salient features. First, we use a cross-image optimization to generate one P3-Mask for each user instead of tailoring facial perturbation for each facial image of a user. It enables efficient and instant protection even for users with limited computing resources. Second, we incorporate a perceptibility optimization to preserve the visual quality of the protected facial images. Third, we strengthen the robustness of P3-Mask against unknown FR models by integrating focal diversity-optimized ensemble learning into the mask generation process. Extensive experiments on two benchmark datasets show that Chameleon outperforms three state-of-the-art methods with instant protection and minimal degradation of image quality. Furthermore, Chameleon enables cost-effective FR authorization using the P3-Mask as a personalized de-obfuscation key, and it demonstrates high resilience against adaptive adversaries.