Unlearnable Faces: Privacy Protection Surviving Extraction Pipeline

2026-07-08 · Source: cs.CV updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, extended

Summary

LPID (Localized, Pipeline-coupled Identity Defense) is a novel privacy protection method. It makes publicly shared photos unlearnable by unauthorized face-recognition models. This holds true even after typical extraction pipelines. Existing "unlearnable examples" (UE) fail when attackers crop and resize faces. Their perturbations are either discarded or attenuated. LPID addresses this by confining perturbations to the extracted face region. It optimizes them through a differentiable model of the attacker's crop+resize transform. This concentrates perturbation energy in the frequency band preserved by extraction. LPID achieves attacker accuracy below 10% under crop+resize extraction on identities unseen at protection time. This significantly outperforms other methods. It maintains imperceptibility at 32.7 dB PSNR and 0.161 LPIPS.

Key takeaway

For AI Security Engineers developing facial privacy solutions, you must account for realistic attacker extraction pipelines. Existing unlearnable examples collapse under crop and resize operations, rendering them ineffective. You should adopt methods like LPID that couple perturbations directly to these transforms, ensuring protection survives image processing. This approach maintains low attacker accuracy (below 10%) even for unseen identities, offering a robust defense for user-side privacy.

Key insights

LPID ensures face privacy by crafting unlearnable perturbations robust to attacker extraction pipelines, protecting unseen identities.

Principles

• Perturbation robustness is a property of the transform, not identity.
• Coupling perturbations to extraction pipelines concentrates energy in surviving frequency bands.
• Localization to the face region is necessary but insufficient without coupling.

Method

LPID builds the attacker's differentiable crop+resize transform into the unlearnable-example objective, localizing perturbations to the face region and optimizing their generation through this transform.

In practice

• Apply LPID to protect public photos from unauthorized face recognition.
• Evaluate privacy defenses under realistic attacker extraction pipelines.
• LPID protects users whose identities are unknown at protection time.

Topics

• Facial Privacy
• Unlearnable Examples
• Face Recognition
• Data Poisoning
• Image Processing
• Adversarial Perturbations

Best for: Research Scientist, Computer Vision Engineer, AI Scientist, Machine Learning Engineer, AI Security Engineer

Related on AIssential

• Flux-Guard: Facial Identity Protection using diffusion models — Flux-Guard unifies adversarial privacy protection with generative face editing to safeguard identity against recognition systems.
• Unveiling Privacy Risks in Multi-modal Large Language Models: Task-specific Vulnerabilities and Mitigation Challenges — MLLMs pose unique privacy risks by extracting and exposing sensitive information from images and memory.
• Introducing OpenAI Privacy Filter — OpenAI's Privacy Filter offers context-aware PII detection and redaction via a small, efficient, open-weight model.
• Silent Failures in Federated Personalization of Foundation Models — Federated personalization of foundation models creates "Silent Failures" like bias and fairness collapse, undetectable due to privacy constraints.
• Privacy-Preserving Text Sanitization for Distributed Agents Collaboration via Disentangled Representations — Privacy leakage in multi-agent text collaboration extends beyond explicit identifiers to stylistic patterns, necessitating disentangled sanitization.
• Full spectrum Unlearnable Examples via Spectral Equalization — FUSE creates robust unlearnable examples by distributing unlearnability across the full frequency spectrum, countering low-pass filtering vulnerabilities.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.CV updates on arXiv.org.