期刊名称：Proceedings on Privacy Enhancing Technologies
电子版ISSN：2299-0984
出版年度：2021
卷号：2021
期号：1
页码：85-106
DOI：10.2478/popets-2021-0006
语种：English
出版社：Sciendo
摘要：Image hosting platforms are a popular way to store and share images with family members and friends. However,such platforms typically have full access to images raising privacy concerns. These concerns are further exacerbated with the advent of Convolutional Neural Networks (CNNs) that can be trained on available images to automatically detect and recognize faces with high accuracy. Recently,adversarial perturbations have been proposed as a potential defense against automated recognition and classification of images by CNNs. In this paper, we explore the practicality of adversarial perturbationbased approaches as a privacy defense against automated face recognition. Specifically,we first identify practical requirements for such approaches and then propose two practical adversarial perturbation approaches – (i) learned universal ensemble perturbations (UEP),and (ii) k-randomized transparent image overlays (k-RTIO) that are semantic adversarial perturbations. We demonstrate how users can generate effective transferable perturbations under realistic assumptions with less effort. We evaluate the proposed methods against state-of-theart online and offline face recognition models,Clarifai.com and DeepFace,respectively. Our findings show that UEP and k-RTIO respectively achieve more than 85% and 90% success against face recognition models. Additionally,we explore potential countermeasures that classifiers can use to thwart the proposed defenses. Particularly,we demonstrate one effective countermeasure against UEP.
