Asymmetric Invertible Threat: Learning Reversible Privacy Defense for Face Recognition

arXiv cs.CV / 5/5/2026

📰 NewsIdeas & Deep AnalysisModels & Research

共有:

Key Points

The paper argues that many existing adversarial face-privacy defenses can be weakened if an attacker learns an approximate inverse mapping that reverses or purifies the protected face representation.
It formulates the problem as an asymmetric adversarial setting where reverse manipulation becomes practical because defenses typically do not control “reversibility.”
The authors propose ARFP (Asymmetric Reversible Face Protection), which combines privacy cloaking with keyed recovery and tamper indication in one framework.
ARFP introduces key-conditioned manifold binding, restoration-aware adversarial training (using a surrogate inverse/restoration adversary), and authorized reversible restoration with nonce-based tamper signaling.
Experiments indicate ARFP increases robustness against evaluated restoration attacks while still allowing recovery when the correct key is provided, supporting the idea of key-sensitive behavior and tamper awareness.

Abstract

Face Recognition systems are widely deployed in real-world applications, but they also raise privacy concerns due to unauthorized collection and misuse of facial data. Existing adversarial privacy protection methods rely on input-space perturbations to obfuscate identity information, yet their protection can degrade when adversaries learn restoration or purification mappings that partially invert the transformation. We study this setting as an asymmetric adversarial attack, in which reverse manipulation becomes feasible because existing defense paradigms do not control reversibility. To address this problem, we propose Asymmetric Reversible Face Protection (ARFP), a restoration-aware extension of personalized face cloaking that integrates privacy protection, keyed recovery, and tamper indication in a single framework. ARFP consists of three components: Key-Conditioned Manifold Binding, which ties the protection transformation to a user-provided key; Adversarial Restoration-Aware Training, which introduces a surrogate restoration adversary during training to improve robustness against evaluated inverse purification attacks; and Authorized Reversible Restoration, which supports recovery with the correct key while providing nonce-based tamper indication. Extensive experiments under the threat models considered in this work show that ARFP improves resistance to the evaluated restoration attacks while preserving authorized recovery utility. These results provide empirical evidence of key-sensitive recovery behavior and tamper awareness in the tested settings.