Congratulations! VIPL’s paper on face identity protection in the physical world, "Natural Adversarial Mask for Face Identity Protection in Physical World" (authors: Xie Tianxin, Han Hu, Shan Shiguang, Chen Xilin), was accepted by IEEE Transactions on Pattern Analysis and Machine Intelligence (T-PAMI). T-PAMI is a tie-1 journal in the fields of pattern recognition, computer vision, and machine learning, with an impact factor of 20.8 in 2024.
With the growing use of face recognition technology, concerns about personal privacy breaches are rising, especially when facial images are used for identification without consent. Adversarial sample generation technology offers a way to protect personal face data from unauthorized use while still benefiting from technological advancements. This method is crucial for face identity protection. Current approaches mainly aim at the reduction of recognition accuracy but often neglect the natural appearance and practicality of adversarial samples in the physical world, which are effective for digital domain face protection. Still, when they are applied to physical domains, they often lack natural appearance and generalization capability. To tackle these issues, this work introduces a method for creating natural adversarial masks for face identity protection (NatMask). As shown in the figure below, the proposed method enables the generation of highly natural adversarial masks through face 3D reconstruction and differentiable rendering, enhancing transferability via identity-aware style injection (IASI). Compared to existing methods, the proposed method improves face identity protection in the physical world by: (1) Enhancing natural appearance: the adversarial masks look as normal as regular masks, but are much more effective than regular masks in both dodging and impersonation-based face protection; (2) Increased transferability: the generated masks are robust against unknown face recognition models; (3) Enhanced physical feasibility: the generated masks can be printed on A4 paper and attached to regular masks for effective protection. Experiments using two face datasets, four public recognition models, and three commercial APIs demonstrate the method's effectiveness for black-box face protection in physical and digital domains. Additionally, subjective evaluations indicate that the face images with our adversarial masks appear more natural compared to those from other adversarial face image generation methods.
Figure 1. The proposed face identity protection based on natural adversarial mask generation mainly consists of three parts: 3D face reconstruction, differentiable rendering, and identity-aware style injection.