Research map / Image generation / Editing and style transfer
Transferable Facial Privacy Protection against Blind Face Restoration via Domain-Consistent Adversarial Obfuscation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DomCo, a domain-consistent adversarial obfuscation method that perturbs pixelated faces in the high-quality domain so that perturbations transfer across blind face restoration models.
Problem
Pixelated or otherwise obfuscated faces can be restored by blind face restoration (BFR) models, exposing identity; existing adversarial perturbations overfit the surrogate and fail to transfer to other BFR models.
Approach
Treat BFR models as approximate inverse mappings of the degradation transform T, and compute adversarial perturbations in the high-quality domain (za, then obfuscate via T) so the resulting perturbation stays domain-consistent; add domain-consistent data augmentation (Gaussian noise on HQ images) to the surrogate to improve transferability, with a face-parsing structure loss.
Key results
- On RestoreFormer surrogate, DomCo drops HiFaceGAN identity similarity to 0.25 versus 0.72 for plain pixelation, and LMD rises to 83.41 from 4.91.
- Domain-consistent augmentation on the GFPGAN surrogate raises transfer against RestoreFormer, with FID rising from 37.80 to 68.70 relative to the unaugmented surrogate on the same target... (see Table 2 for surrogate-dependent results)
- Gradient cosine similarity analysis shows domain-consistent perturbations increase cross-model gradient similarity compared with domain-inconsistent perturbations.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Domain-consistent adversarial obfuscation (DomCo) instead of PPGD | adversarial obfuscation against BFR models, RestoreFormer surrogate · HiFaceGAN, GFPGAN, GPEN, CodeFormer attackers | IDS (lower is better): e.g. HiFaceGAN 0.54 -> 0.25; GFPGAN 0.53 -> 0.33; GPEN 0.55 -> 0.35; CodeFormer 0.63 -> 0.32 | Helped |
| Domain-consistent adversarial obfuscation (DomCo) instead of PPGD | RestoreFormer surrogate, RestoreFormer white-box attacker · RestoreFormer attacker | IDS (lower is better): PPGD 0.19 vs DomCo 0.23 | Hurt |
| Domain-consistent adversarial obfuscation (DomCo) instead of PPGD | RestoreFormer surrogate · CodeFormer attacker, LPIPS | LPIPS (higher is better as defense): PPGD 0.1100 vs DomCo 0.1596 (CodeFormer); PPGD 0.1935 vs DomCo 0.1968 (RestoreFormer) | Mixed |
| Domain-consistent data augmentation added to the surrogate model (ablation) | CodeFormer and GFPGAN surrogates · HiFaceGAN, GFPGAN, GPEN, CodeFormer, RestoreFormer attackers | IDS (lower is better): e.g. HiFaceGAN: DomCo-CF 0.49 -> +Aug 0.36; DomCo-GF 0.32 -> +Aug 0.24 (GF); RestoreFormer: DomCo-GF 0.56 -> +Aug 0.35 | Mixed |
| Face structure loss (Lstruc) instead of content loss or perceptual loss (ablation) | adversarial obfuscation with DomCo · HiFaceGAN attacker, Table 3 | IDS (lower is better): Lstruc 0.27 vs Lc 0.34 and Lpercep 0.33 | Helped |
| Face structure loss (Lstruc) instead of content loss or perceptual loss (ablation) | adversarial obfuscation with DomCo · RestoreFormer attacker, Table 3 | IDS (lower is better): Lstruc 0.25 vs Lc 0.37 and Lpercep 0.38 | Helped |
| Pixelated obfuscation without adversarial perturbation (baseline) | pixelation obfuscation · FFHQ/CelebA-HQ, HiFaceGAN attacker | IDS (lower is better): Pixelate IDS 0.72 vs DomCo 0.25 | Hurt |
Surprising findings
- Simply retraining BFR models on pixelated faces lets them restore obfuscated faces with high fidelity, so conventional pixelation offers weak privacy against BFR.
- Stronger white-box defense does not guarantee black-box transfer: PPGD performs well on the surrogate but degrades sharply on other BFR models.
Limitations
- Threat model restricted to pixelation-type obfuscation with no-reference BFR models
- Evaluation limited to five BFR models and one dataset pair (FFHQ training, CelebA-HQ test)
- Augmented surrogate weakens white-box defense performance
Experimental setup
Datasets: FFHQ CelebA-HQ
Benchmarks: CelebA-HQ
Metrics: FID MS-SSIM LPIPS IDS LMD mPR mIoU
Baselines: Pixelate PPGD
Builds on: PGD Perceptual PGD C&W attack
Closest papers by meaning
- Enhancing Facial Privacy Protection via Weakening Diffusion Purification (CVPR 2025 · similarity 0.91)
- Asymmetric Invertible Threat: Learning Reversible Privacy Defense for Face Recognition (NeurIPS 2026 · similarity 0.88)
- DiffAM: Diffusion-based Adversarial Makeup Transfer for Facial Privacy Protection (CVPR 2024 · similarity 0.88)
- Adversarial Robust Safeguard for Evading Deep Facial Manipulation (AAAI 2024 · similarity 0.86)
- Recoverable Facial Identity Protection via Adaptive Makeup Transfer Adversarial Attacks (AAAI 2025 · similarity 0.86)
- FaceMe: Robust Blind Face Restoration with Personal Identification (AAAI 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.