Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: Paper presents an analysis of two systems for poisoning attacks. The paper shows that perturbing facial images does not offer long term security; future systems can still recognize the once perturbed image(s).
main_review: Strengths
This is an interesting paper. The evaluation criteria and the game setup was well conducted. A large number of feature extractors were evaluated showing the problem is consistent across multiple. It is especially interesting to see how even "oblivious" systems can just wait and see to get better. Figure 5 is shows how Fawkes deteriorates over time with new extractors causing it to fail. The paper is well-written and easy to read. Ethical concerns are well documented in ethics statement.

Weaknesses
This is a strong statement "Ultimately, we believe that the only viable course of action for privacy-conscious users is to avoid posting pictures online, or to support policy and legislation that restrict the use of facial recognition (Singer, 2018; Weise & Singer, 2020; Winder, 2020)." and may not be a feasible solution to the problem, although supporting policy is certainly feasible. A more concrete solution to the problem would have strengthened the paper.

Minor point: The paper argues that it is not an arms-race, however, it can still be considered an arms race with the constraint that the defender is in a better position to win. This is arguably just a semantic difference, and a minor point.
summary_of_the_review: The paper does a good job analyzing poisoning attacks. It shows that the methods fail over time and they do not generalize to future attacks. It is in interesting paper and has value for the community to consider longer term security measures for facial recognition privacy concerns.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper points out that current data poisoning techniques cannot effiectively protect users privacy, i.e., face data, on the Internet. The authors have examined several strategies to enable modern face recognition models to defense attacks from widely used data poisoning methods. Experimental results suggest that those data poisoning attacks can be easily defensed by adaptively tuning the face recognition models or using more advanced algorithms which would be developed in the future. The main conclusion is that people should not rely on technical solutions to protect users privacy and legislation actions are what is actually needed.
main_review: ### Strengths:
1. The paper is well written and easy to follow.
2. The topic discussed in this paper is of significant importance as the rapid development of deep learning techniques nowadays also poses great threats to people's privacy, especially for the face data.
3. Extensive experiments have been conducted to statistically ascertain the authors' claims.

### Weaknesses:
From technical point of view, there is less innovation in this paper. It is widely known that adversarial attacks, either obtained in white-box or black-box manners, can be effectively guarded by robust training or by adopting a different algorithm. The experimental results are within expectation and little technical insight is gained.

summary_of_the_review: This paper has addressed an important problem that, data poisoning techniques are insufficient to protect people's privacy from modern development of face recognition models and it is of great importance to draw people's attention to the discussed topic, to potentially push any legislation actions instead of searching for technical solutions to protect users privacy. However, I think the technical contribution from this paper is limited as little new insight is provided.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: Recent works propose to protect users from facial recognition by poisoning their images before uploading them to the Internet (called poisoning "attacks"). This paper reveals the flaws of these methods by designing two effective methods (called "defenses") to defeat that protection mechanism. The first approach is adaptive defense, in which the model trainer assumes to have access to the poisoning function as a black-box. He then can collect a clean facial image dataset, create perturbed and unperturbed versions, and finetune the poisoned face recognition model to learn robust features. The second approach, called obvious defense, relies on the fact that poisoned examples do not transfer well over time to newer models. Hence, the model trainer can wait to obtain a better face recognition model and properly safely finetune it on the perturbed images. Both methods successfully defeat two poisoning attack baselines, raising awareness on the inefficiency of the poisoning-based identity protection mechanism.
main_review: ### Strengths
- This paper defines the dynamic game scenario, which is more practical than the static game scenario used in the previous poison-based identity protection works
- It proposes two defenses that can defeat the poison-based identity protection methods
- The authors propose a strategy for the model trainer to defense from poisoning attacks without sacrifying accuracy
- The authors give a good discussion on the flaws of the poison-based identity protection approach. The game is already lost, and users should not rely on the methods in that category to have a false sense of security.
- This paper has a good amount of references

### Weaknesses
- In the adaptive defense, the authors assume access to the poisoning function, which may be unrealistic. The poisoning function should be secret for a better protection,
- Obvious defense can break LowKey only once (Figure 6). There is no guarantee that robust models, like CLIP, will be popular in the future facial recognition models.

### Not a weakness of the paper itself
I agree with the section "The game is already lost": the poison-based identity protection approach is very unrealistic and has a low value.
summary_of_the_review: This paper reveals the flaws of previous works that use poison attacks to protect user identity from face recognition systems. It has some good discussions and provides two methods to break those protections. There are still some concerns about the experiments and the significance of the previous works the paper is targeting. Hence, I give it a Borderline, slightly towards Acceptance.
review_title: null

final_score: rating: 1: strong reject
review_content: summary_of_the_paper: This paper studies the effect of data poisoning in face recognition and the relation to the defense techniques. Conventionally, the poisoned data will fail the face recognition models who is trained without defense strategy. Two solutions of defense are given: oblivious trainer and adaptive trainer. The claim is that, any existing poisoning methods cannot protect the privacy of users in the face images.
main_review: + The insight of this paper is very useful for the proctecter of user face.
- It is not clear how the oblivious trainer works. 
- There is no clear presentation about the poisoning details of Flawkes and LowKeys.
- The technical novelty is very limited. Rather than fancying legislative alternative, a research paper needs to propose technical solution.

summary_of_the_review: Overall, this is a facial privacy analysis with insightful claims, but the presentation and the discussion is very confusing. Thus, we are not able to agree this argument whether is reasonable and solid. The final rating will depend on the authors’ feedback.
review_title: null

Meta-review: This paper reveals that popular data poisoning systems, Fawkes and LowKey, fail to effectively protect user privacy in facial recognition. The methods to defend against poisoning attacks are quite simple---you can either adaptively tune the face recognition models or just wait for more advanced facial recognition systems. Given these “disappointed” findings from the technical solution side, this paper further argues that legislation may be the only viable solution to prevent abuses of facial recognition.

Overall, all the reviewers highly appreciate the comprehensive and rigorous evaluations provided in this paper and enjoy reading it. The biggest concern is raised by the Reviewer 6s7m, given this work fails to discuss/compare to previous works on Facial identity anonymizing and the technical contribution is incremental. During the discussion period, all other reviewers reach a consensus that 1) facial identity anonymizing is not relevant; and 2) this work make enough contributions and is worthy to be heard by the general community; the Reviewer 6s7m still hold the opposite opinion, but is okay for accepting this paper anyway. 

In the final version, the authors should include all the clarification provided in the discussion period.
Decision: Accept (Poster)