ErasableMask: A Robust and Erasable Privacy Protection Scheme against Black-box Face Recognition Models

TL;DR

ErasableMask targets privacy against black-box face recognition by delivering erasable semantic perturbations that can be cleaned by trusted authorities. It introduces a meta-auxiliary attack to boost cross-model transferability, and a perturbation erasion mechanism that leverages clean-domain information injected into a reversible generation-restoration pipeline. A three-stage curriculum training scheme coordinates attribute manipulation, adversarial perturbation, and restoration robustness, yielding state-of-the-art transferability (over $72\%$ average confidence in commercial FR systems) and erasure (over $90\%$ ESR) while maintaining image quality. The work demonstrates strong performance across offline and commercial FR systems and under common image processing, highlighting practical potential for privacy-preserving face sharing with self-erasable recoverability.

Abstract

While face recognition (FR) models have brought remarkable convenience in face verification and identification, they also pose substantial privacy risks to the public. Existing facial privacy protection schemes usually adopt adversarial examples to disrupt face verification of FR models. However, these schemes often suffer from weak transferability against black-box FR models and permanently damage the identifiable information that cannot fulfill the requirements of authorized operations such as forensics and authentication. To address these limitations, we propose ErasableMask, a robust and erasable privacy protection scheme against black-box FR models. Specifically, via rethinking the inherent relationship between surrogate FR models, ErasableMask introduces a novel meta-auxiliary attack, which boosts black-box transferability by learning more general features in a stable and balancing optimization strategy. It also offers a perturbation erasion mechanism that supports the erasion of semantic perturbations in protected face without degrading image quality. To further improve performance, ErasableMask employs a curriculum learning strategy to mitigate optimization conflicts between adversarial attack and perturbation erasion. Extensive experiments on the CelebA-HQ and FFHQ datasets demonstrate that ErasableMask achieves the state-of-the-art performance in transferability, achieving over 72% confidence on average in commercial FR systems. Moreover, ErasableMask also exhibits outstanding perturbation erasion performance, achieving over 90% erasion success rate.

Figures (5)

• Figure 1: ErasableMask protection scenario: Users generate protected faces and then publicly share them on social platforms. Unauthorized hackers fail to conduct face verification. However, trusted authority can utilize ErasableMask's erasion module to obtain clean examples that are nearly identical to the original face, allowing to conduct face verification accurately.
• Figure 2: Pipeline of ErasableMask: A three-stage curriculum learning is introduced to address optimization conflicts between adversarial and erasion performance. Stage 1: $G_{end}$ and $G_{dec}$ learn an attribute modification strategy. Stage 2: $E_{adv}$ and $R$ are tightly coupled and trained end-to-end. Stage 3: The robustness and erasion capabilities of $R$ are further strengthened.
• Figure 3: Detailed framework of semantic perturbations and clean-domain information injection.
• Figure 4: Visualization of various schemes.
• Figure 5: ASR and ESR results for selection of different $\gamma$ and $\beta$.