通过美颜保护人脸隐私

doi:10.3778/j.issn.1673-9418.2210098

摘要/Abstract

摘要： 社交网络上广泛传播的人脸图像易被未授权的自动识别系统推断出敏感信息，这为用户隐私带来了威胁。为保护用户隐私，一些方法通过在人脸上添加具有可迁移性的扰动来去除可识别信息。然而，它们生成的结果由于存在较为明显的扰动使得视觉感知效果较差，因此并不适合在社交网络上分享。为此，提出了一种基于美颜的对抗性人脸生成方案Adv-beauty。Adv-beauty利用人脸匹配器和美颜鉴别器来协同监督生成器的训练过程，促使生成器在原始人脸上产生类似美颜的扰动来混淆人脸匹配器，换句话说美颜带来的像素变化遮盖了扰动产生的不良视觉效果。此外，在身份损失上设置对抗性阈值，用来防止身份特征的过分偏离而导致的人脸区域扭曲。充分的实验表明，Adv-beauty不仅能够保持良好的视觉效果，而且能够防御多种未知人脸识别分类器和商业APIs。

关键词: 美颜, 人脸隐私, 身份, 生成对抗网络（GAN）

Abstract: Face images distributed widely on social networks are vulnerable to inferring sensitive information by unauthorized automatic identification systems, which poses a threat to user privacy. To protect face privacy, several methods have been proposed to generate highly transferable adversarial faces to remove identity information. However, the results generated by existing methods still suffer from obvious perturbations that make visual perception poor, which is not friendly for sharing on social networks. This paper proposes an adversarial face generation scheme via beautification, i.e., Adv-beauty. Adv-beauty utilizes a face matcher and a beautification discriminator to collaboratively supervise the training process of the generator, prompting the generator to produce a beauty-like perturbation on the original face to confront the face matcher. In other words, the pixel changes produced by the beauty mask the undesirable visual effects produced by the perturbations. In addition, this paper sets an adversarial threshold for identity loss to prevent face distortion due to excessive deviation of identity features. Sufficient experiments show that Adv-beauty maintains good visual results and is effectively against unknown face recognition classifiers and commercial APIs.

Key words: beautification, face privacy, identity, generative adversarial networks (GAN)

汪涛, 张玉书, 赵若宇, 温文媖, 朱友文. 通过美颜保护人脸隐私[J]. 计算机科学与探索, 2024, 18(1): 244-251.

WANG Tao, ZHANG Yushu, ZHAO Ruoyu, WEN Wenying, ZHU Youwen. Protecting Face Privacy via Beautification[J]. Journal of Frontiers of Computer Science and Technology, 2024, 18(1): 244-251.

参考文献

[1] CAO J, LIU B, WEN Y, et al. Personalized and invertible face de-identification by disentangled identity information manipulation[C]//Proceedings of the 2021 IEEE/CVF Interna-tional Conference on Computer Vision, Jun 19-25, 2021. Piscataway: IEEE, 2021: 3334-3342.
[2] GONG M, LIU J, LI H, et al. Disentangled representation learning for multiple attributes preserving face deidentifica-tion[J]. IEEE Transactions on Neural Networks and Learning Systems, 2022, 33(1): 244-256.
[3] MAXIMOV M, ELEZI I, LEAL-TAIXé L. CIAGAN: condit-ional identity anonymization generative adversarial networks[C]//Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition, Jun 14-19, 2020. Piscataway: IEEE, 2020: 5447-5456.
[4] SUN Q, TEWARI A, XU W, et al. A hybrid model for identity obfuscation by face replacement[C]//LNCS 11211: Proceedings of the 15th European Conference on Computer Vision, Munich, Sep 8-14, 2018. Cham: Springer, 2018: 553-569.
[5] WANG H P, OREKONDY T, FRITZ M. InfoScrub: towards attribute privacy by targeted obfuscation[C]//Proceedings of the 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition, Jun 19-25, 2021. Piscataway: IEEE, 2021: 3281-3289.
[6] CHEREPANOVA V, GOLDBLUM M, FOLEY H, et al. LowKey: leveraging adversarial attacks to protect social media users from facial recognition[EB/OL]. [2022-08-05]. https://arxiv.org/abs/ 2101.07922.
[7] CHHABRA S, SINGH R, VATSA M, et al. Anonymizing k-facial attributes via adversarial perturbations[EB/OL]. [2022-08-05]. https://arxiv.org/abs/1805.09380.
[8] YANG X, DONG Y, PANG T, et al. Towards face encryp-tion by generating adversarial identity masks[C]//Proceedings of the 2021 IEEE/CVF International Conference on Computer Vision, Montreal, Mar 10-11, 2021. Piscataway: IEEE, 2021: 3897-3907.
[9] ZHANG J, SANG J, ZHAO X, et al. Adversarial privacy-preserving filter[C]//Proceedings of the 2020 ACM Interna-tional Conference on Multimedia. New York: ACM, 2020: 1423-1431.
[10] ZHONG Y, DENG W. OPOM: customized invisible cloak towards face privacy protection[J]. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2023, 45(3): 3590-3603.
[11] HU S, LIU X, ZHANG Y, et al. Protecting facial privacy: generating adversarial identity masks via style-robust makeup transfer[C]//Proceedings of the 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition, New Orleans, Jun 18-24, 2022. Piscataway: IEEE, 2022: 15014-15023.
[12] DIAMANT N, ZADOK D, BASKIN C, et al. Beholder-GAN: generation and beautification of facial images with condi-tioning on their beauty level[C]//Proceedings of the 2019 IEEE International Conference on Image Processing, Taipei, China, Sep 22-25, 2019. Piscataway: IEEE, 2019: 739-743.
[13] HUANG Z, SUEN C Y. Identity-preserved face beauty trans-formation with conditional generative adversarial networks[C]//Proceedings of the 2021 International Conference on Pattern Recognition, Jan 10-11, 2021. Cham: Springer, 2021: 7273-7280.
[14] HE J, WANG C, ZHANG Y, et al. FA-GANs: facial attrac-tiveness enhancement with generative adversarial networks on frontal faces[EB/OL]. [2022-08-05]. https://arxiv.org/abs/2005.08168.
[15] GOODFELLOW I, POUGET-ABADIE J, MIRZA M, et al. Generative adversarial nets[C]//Advances in Neural Information Processing Systems 27, Montreal, Dec 8-13, 2014: 2672-2680.
[16] ISOLA P, ZHU J Y, ZHOU T, et al. Image-to-image transla-tion with conditional adversarial networks[C]//Proceedings of the 2017 IEEE Conference on Computer Vision and Pattern Recognition, Hawaii, Jul 21-26, 2017. Washington: IEEE Computer Society, 2017: 1125-1134.
[17] SCHROFF F, KALENICHENKO D, PHILBIN J. FaceNet: a unified embedding for face recognition and clustering[C]//Proceedings of the 2015 IEEE Conference on Computer Vision and Pattern Recognition, Boston, Jun 7-12, 2015. Washington: IEEE Computer Society, 2015: 815-823.
[18] WANG H, WANG Y, ZHOU Z, et al. CosFace: large margin cosine loss for deep face recognition[C]//Proceedings of the 2018 IEEE Conference on Computer Vision and Pattern Recognition, Salt Lake City, Jun 19-21, 2018. Washington: IEEE Computer Society, 2018: 5265-5274.
[19] GULRAJANI I, AHMED F, ARJOVSKY M, et al. Improved training of Wasserstein GANs[C]//Advances in Neural Infor-mation Processing Systems 30, Long Beach, Dec 4-9, 2017: 5769-5779.
[20] MADRY A, MAKELOV A, SCHMIDT L, et al. Towards deep learning models resistant to adversarial attacks[EB/OL]. [2022-08-05]. https://arxiv.org/abs/1706.06083.
[21] GOODFELLOW I J, SHLENS J, SZEGEDY C. Explaining and harnessing adversarial examples[EB/OL]. [2022-08-05]. https://arxiv.org/abs/1412.6572.
[22] POURSAEED O, KATSMAN I, GAO B, et al. Generative adversarial perturbations[C]//Proceedings of the 2018 IEEE Conference on Computer Vision and Pattern Recognition, Salt Lake City, Jun 19-21, 2018. Washington: IEEE Computer Society, 2018: 4422-4431.
[23] DENG J, GUO J, XUE N, et al. ArcFace: additive angular margin loss for deep face recognition[C]//Proceedings of the 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition, Long Beach, Jun 16-20, 2019. Piscataway: IEEE, 2019: 4690-4699.
[24] HU J, SHEN L, SUN G. Squeeze-and-excitation networks[C]//Proceedings of the 2018 IEEE Conference on Computer Vision and Pattern Recognition, Salt Lake City, Jun 19-21, 2018. Washington: IEEE Computer Society, 2018: 7132-7141.
[25] HOWARD A G, ZHU M, CHEN B, et al. MobileNets: effi-cient convolutional neural networks for mobile vision appli-cations[EB/OL]. [2022-08-05]. https://arxiv.org/abs/1704.04861.