Research map / Adversarial robustness and security / Attacks on text and graphs

Asymmetric Invertible Threat: Learning Reversible Privacy Defense for Face Recognition

NeurIPS 2026 · Adversarial robustness and security › Attacks on text and graphs · approach: Diffusion-based adversarial purification · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes ARFP, a key-conditioned, restoration-aware face cloaking method that adds keyed recovery and nonce-based tamper indication, evaluated against Chameleon, Fawkes, and restoration attacks on LFW and FaceScrub.

Problem

Existing adversarial face cloaking methods assume the protected image stays protected, but adversaries can learn restoration or purification mappings that partially invert the perturbation, and the protection lacks controllable reversibility.

Approach

Combines key-conditioned affine modulation of a mask generator, adversarial training against a surrogate restoration network (minimax), authorized key-guided recovery, and a nonce-decoder for fragile tamper indication, framed as an asymmetric adversarial attack setting.

Key results

• ARFP achieves mean PSR of 95.91% across eight black-box FR models on ten FaceScrub identities.
• Under BINN restoration attack, ARFP keeps mean PSR at 91.2% versus 22.0% for Chameleon.
• Ablation: removing ARAT drops attacked PSR to 24.5%; ARFP reports PSNR 31.2 dB and SSIM 0.94 versus Chameleon 28.5 dB and 0.89.

Surprising findings

• Removing the nonce (ARR) branch slightly raises clean PSR (96.5% vs 95.9%) while lowering attacked PSR.
• Wrong-key recovery with only 1-bit key error yields PSNR 14.3 dB, showing sharp key sensitivity.

Limitations

• Evaluation limited to digital domain; print-scan robustness not tested.
• Security relies on key secrecy; lost key means unrecoverable image.
• Restoration attacks are a limited set (DiffPure, CycleGAN, BINN, Adaptive Reversal); the information-theoretic result is interpretive, not a security bound.

Experimental setup

Datasets: LFW FaceScrub MS-Celeb-1M (pretrained FR models)

Benchmarks: LFW FaceScrub

Metrics: Protection Success Rate (PSR) PSNR SSIM Bit Error Rate (BER)

Baselines: Chameleon Fawkes OPOM TIP-IM LowKey

Builds on: Chameleon Fawkes LowKey

Closest papers by meaning

• Transferable Facial Privacy Protection against Blind Face Restoration via Domain-Consistent Adversarial Obfuscation (ICML 2024 · similarity 0.88)
• Enhancing Facial Privacy Protection via Weakening Diffusion Purification (CVPR 2025 · similarity 0.87)
• Privacy-Preserving Face Recognition Using Trainable Feature Subtraction (CVPR 2024 · similarity 0.86)
• From Head to Tail: Efficient Black-box Model Inversion Attack via Long-tailed Learning (CVPR 2025 · similarity 0.85)
• Disguise without Disruption: Utility-Preserving Face De-identification (AAAI 2024 · similarity 0.85)
• DiffAM: Diffusion-based Adversarial Makeup Transfer for Facial Privacy Protection (CVPR 2024 · similarity 0.85)