# PrivacyGAN: robust generative image privacy

Mariia Zameshina, Marlene Careil, Olivier Teytaud, Laurent Najman

► To cite this version:

Mariia Zameshina, Marlene Careil, Olivier Teytaud, Laurent Najman. PrivacyGAN: robust generative image privacy. 2023. hal-04248792

HAL Id: hal-04248792

https://hal.science/hal-04248792v1

Preprint submitted on 18 Oct 2023

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
# PrivacyGAN: robust generative image privacy

**Mariia Zameshina**

Univ Gustave Eiffel, CNRS, LIGM
F-77454 Marne-la-Vallee, France
mariia.zameshina@esiee.fr

**Marlene Careil**

LTCI, Telecom Paris,
Institut Polytechnique de Paris

**Olivier Teytaud**

TAO, CNRS - INRIA - LRI

**Laurent Najman**

Univ Gustave Eiffel, CNRS, LIGM
F-77454 Marne-la-Vallee, France

## Abstract

Classical techniques for protecting facial image privacy typically fall into two categories: data-poisoning methods, exemplified by Fawkes, which introduce subtle perturbations to images, or anonymization methods that generate images resembling the original only in several characteristics, such as gender, ethnicity, or facial expression.

In this study, we introduce a novel approach, PrivacyGAN, that uses the power of image generation techniques, such as VQGAN and StyleGAN, to safeguard privacy while maintaining image usability, particularly for social media applications. Drawing inspiration from Fawkes, our method entails shifting the original image within the embedding space towards a decoy image.

We evaluate our approach using privacy metrics on traditional and novel facial image datasets. Additionally, we propose new criteria for evaluating the robustness of privacy-protection methods against unknown image recognition techniques, and we demonstrate that our approach is effective even in unknown embedding transfer scenarios. We also provide a human evaluation that further proves that the modified image preserves its utility as it remains recognisable as an image of the same person by friends and family.

## 1 Introduction

Individuals often share personal photos on various social media platforms, which facilitates communication and connection with family, friends, colleagues, and customers. Unfortunately, a significant drawback of this practice is that it can sometimes be possible to identify individuals social media accounts by taking their picture in public [22] or by comparing their dating app photos to their business-related social media profiles. This is often made possible by the existence of datasets collected by scraping social media platforms. While face detection systems can be used by the government for criminal identification purposes, they also present opportunities for both internal and external misuse [28], including enabling stalkers to track their victims [8]. Consequently, sharing real facial images publicly over the internet may compromise users privacy.

Multiple initiatives are dedicated to enhancing image and video privacy on the internet. One of the prominent groups is centred around **anonymization methods**, which involve altering users pictures to resemble those of other individuals. For instance, Kim et al. [17] proposed a privacy-preserving adversarial
<figure><img src="image_2.png" /><figcaption>Figure 1: Schema for both data poisoning and generative privacy methods. We take the original image (OI) and create an image that is recognisable by human observers while being unlikely to be identified by image recognition methods using</figcaption></figure>

(i) the classic approach by adding pixel noise such that it makes the modified image in the embedding space closer to the target image than to the original image,

(ii) (our approach, PrivacyGAN): generation of visually similar but distant images in the embedding space.

protector network (PPAPNet) as an image anonymization tool. PPAPNet transforms an image into another synthetic yet realistic image while remaining immune to model inversion attacks [27]. Anonymization techniques may also preserve key characteristics such as background, emotions, and facial feature movements [11] [14] [1] [15]. These techniques are valuable when the objective is to maintain realistic appearances without the need to recognise individuals in photos or videos. Such approaches are particularly useful, for example, for maintaining anonymity while expressing opinions on video-sharing platforms. For instance, [7] achieves the objective of decorrelating the identity while retaining the perception (pose, illumination, and expression). Some of these methods change only parts of the face. As an example, in their work [20], the authors suggest utilising generative techniques to enhance images that have been intentionally blurred or have had the subject's eyes obscured beforehand.

In the overview conducted by Wenger et al. [29], the authors tackle a challenge in the design of Anti-Facial Recognition (AFR) systems: finding a balance between **privacy, utility, and usability**. They categorise AFR systems based on their target components, ranging from data collection and model training to run-time inference, all with the shared objective of thwarting successful recognition by unauthorised or unwanted models. Moreover, the authors stress the user preference for privacy tools with minimal overhead, a concept underscored by studies such as Sharif et al. [25] and Dabouei et al. [4]. These findings highlight the significance of delivering protection against image recognition systems while mitigating any adverse effects on the user experience, a goal that many present anonymization methods struggle to attain. While certain attributes of images, such as gender, ethnicity, and facial expressions, can be retained through specific anonymization techniques, the resulting modified images frequently lack practicality for users. As a result, even though these images maintain crucial visual characteristics, the individual's identity within them may undergo substantial alterations, ultimately rendering them unidentifiable to acquaintances and family members.

In an effort to achieve a balance between utility and privacy protection, another area of research focuses on **altering or obscuring facial images to maintain human recognizability while creating difficulties**
**for neural networks to decipher.** Generally, these methods involve introducing precisely crafted pixel noise, causing the neural network to misclassify the image. These pixel-level perturbations have effectively challenged diverse image recognition neural networks. The dilemma of balancing privacy maintenance with recognition assurance of data-poisoning methods like Fawkes [24] and Lowkey [3] is discussed in detail in [21].

As an alternative approach to safeguarding images against unauthorised identification while preserving their utility for the users, one can consider **adversarial examples**. [20] demonstrated that makeup transfer can be an effective means of countering various face recognition systems. However, this method has limitations, as the model's performance may be inconsistent between male and female images due to an imbalance in the makeup transfer training dataset. This method is also ineffective in cases where the face cannot be found on an image, as it is not possible to transfer makeup in this case. Additionally, some individuals may find the use of makeup transfer images unacceptable.

**In the present paper, we propose a general approach to the use of generative methods for privacy.**
We train our methods to be effective for embedding methods, on which pixel-based methods such as Fawkes used to fail. Our goal is to create images that resemble original photographs and are suitable for sharing on social media platforms, while also preventing identification by modern image recognition neural networks without using anonymization. To achieve this, we explore the effectiveness of two generative methods: a generative adversarial neural network StyleGAN [16], and the autoencoder VQGAN [6]. These generative methods are known for their realistic image generation capabilities, which adds an added layer of difficulty for neural network recognition.

By modifying facial images using generative methods, we aim to preserve their recognizability to human observers while rendering them unrecognisable to many existing image recognition neural networks. Inspired by pixel-based methods like Fawkes [24], we propose modifying the generated “private” images towards a different target image in the embedding space and evaluate the robustness of our approach against unknown image recognition neural networks. We validate our privacy methods on the Labeled Faces in the Wild (LFW) dataset [13], as well as introduce a new dataset of face crops extracted from Casual Conversations [9] to ensure their effectiveness in various environments. In Fig. 1 we present the schema of image modification using both pixel-based and generative methods.

Our proposed generative tools make subtle modifications to user images without adding pixel noise, so the resulting photos look natural and protect user privacy. Our algorithms operate within a black-box framework and demonstrate their efficacy against image recognition techniques they were not specifically trained on. We offer flexibility in selecting methods and privacy settings and conduct a comparison between our approach and existing state-of-the-art privacy protection methods, such as Fawkes.

**To sum up the claims of the present paper, we**

1. propose a novel approach to facial image privacy based on generative methods;

2. create a new privacy evaluation approach based on the percentage of dataset images that are closer in an embedding space to a modified “private” image than to an original image;

3. propose a new facial image dataset extracted from the Casual Conversations dataset [9] videos;

4. evaluate the privacy of the modified images against various embedding methods (including transfer to embeddings not used in our privacy method) and provide human evaluation of image quality for state-of-the-art and novel privacy methods.
# 2 Privacy Algorithms

## 2.1 A well-known pixel-based method: Fawkes.

Fawkes [24] is a data poisoning method that presents subtle image perturbations to the images. One of its main features is the concept of target image: by suggesting elements from a side target image, Fawkes ensures that the modified image will be recognised as another person by neural networks, thus ensuring privacy. Unlike just maximising the distance between the embedding of the original image and the modified image, this method

1. helps to keep the embedding of modified images within a valid range for a given dataset and

2. ensures that the embedding of the modified image does not stay close to its original version in the given dataset.

The idea of Fawkes is to pair each original image (OI) with a target image (TI). Then Fawkes associates to each original image a 'cloak image' (CI) which consists of noise obtained by optimising the following loss:

$$L_{Fawkes} = \|\text{emb}(TI) - \text{emb}(OI \oplus CI)\|,$$

where: OI is an original image; ⊕ is capped addition; emb is an embedding method used for cloak optimisation in order to obtain a modified “private” version of an original image; TI is a target image; the private version of OI should be labelled the same as TI by the chosen image recognition system; ρ is a parameter that caps the noise strength; CI < ρ is a cloak or a noise that should be added to OI in order for it to ensure its' privacy; OI ⊕ CI is the published rendition of OI. In our experiments, by default, we use the “high” mode of Fawkes (as mentioned in [30] and [24]), since it provides a decent level of protection, and it is possible to compare this setting of Fawkes with our methods.

## 2.2 Our proposed generative methods based on VQGAN and StyleGAN

Our proposal involves utilising generative models for privacy protection, with a focus on generating an image that closely resembles the original in visual appearance while safeguarding users against image recognition attacks. Our objective is not to anonymize the image. Another generative method that transfers makeup in order to protect facial privacy (AMT-GAN) is reviewed in the supplementary material. In this paper, we expand on the idea of target images introduced in Fawkes. We use target images to ensure that the modified version of an image is closer to the target image than the original image in the chosen embedding space. To select target images, we choose from images in the dataset that have not been used in experiments. For each specific image, we select a target image based on its distance from the original image in the chosen embedding method used for optimization. The chosen target image should be far enough from the original image to ensure effective privacy protection.

We select the loss function L based on the goal of preserving the identity of the original image (OI) for humans while ensuring that the generated image (GI) embedding is as close as possible to the distant target image embedding. For this purpose, we use the Learned Perceptual Image Patch Similarity (LPIPS) distance for the preservation of OI identity and optimise the embedding distance between the generated image (GI) and the target image (TI) to achieve the closest possible embedding.

The loss for any generated image always consists of the sum of the following parts:

1. LPIPS distance between generated and original image
2. For each of the embeddings used for optimisation, coefficient K multiplied by the mean squared distance between the modified “private” image embedding and target image embedding.

$$L_{\substack{\text{generative} \\ \text{privacy}}} = \text{LPIPS}(\text{OI}, \text{GI}) + \\ + K \times \sum_{\text{emb} \in \text{embeddings}} \| \text{emb}(\text{GI}) - \text{emb}(\text{TI}) \|.$$

The hyperparameters of the loss described are the coefficient K (i.e., weight compared to LPIPS) for the embedding distance, the learning rate, the batch size, and the number of iterations.

## 2.3 Generative Privacy Algorithm: PrivacyGAN

Here, we describe PrivacyGAN, an algorithm that we propose for creating private versions of facial images.

**Algorithm 1 PrivacyGAN: Private image generation algorithm**

**Require:** OI: Original Image

**Ensure:** GI: Generated Image

TI ← Target Image ▷ (distant from OI in the embedding space)

z ← random

G ← image generation method

K ← optimisation coefficient

chosen embeddings ← list of embedding methods for optimisation ▷ (we distance GI from OI in these embedding spaces)

**for** i in range(0, num iterations) **do**

GI ← G(z)

emb_dist ← 0

**for** emb in chosen embeddings **do**

emb_dist += ||emb(GI) - emb(TI)||

lpips_dist ← LPIPS(GI, OI)

loss ← lpips_dist + K · emb_dist

z ← update(z, loss, ∇$_{loss}$)

**return** GI

As input to the algorithm, we use an original image **OI** and a target image **TI**. The algorithm aims to produce an image **GI** which would be a “private” version of OI, unrecognisable by many image recognition neural networks. In order to do that, we are using generative methods such as StyleGAN and VQGAN. **TI** is chosen randomly among the images furthest in embedding space from OI.

The algorithm consists of an iterative optimisation process, where **num iterations** represents the number of iterations and **G** is the image generation method. In the latent space of **G**, we find a latent variable **z** and generate an image **G(z)**, which we refer to as **GI**. For each of the embedding methods in the set **chosen embeddings**, in each iteration of the algorithm, we compute the embedding distance between **GI** and **TI**, as well as the LPIPS distance [31] between images **GI** and **OI**. We use the computed distances to calculate the $L_{\text{generative privacy}}$ that we mention as ‘loss’ in the algorithm.
# 3 Evaluation Methods

## 3.1 Metrics for Privacy

In order to evaluate the privacy of generated images, it is important to determine how far the generated image is from the original in the dataset. After applying an image recognition neural network, attackers may choose to verify if the person on the image matches the top few possible results. That is why the method would work better for privacy protection if: i) the modified image would not be recognised as its original version; and ii) the original image would be far away from the modified one in the embedding space.

We ensure ii) not only by using existing evaluation methods such as Recall@k that help us to make sure that the modified “private” image is far from the original in absolute values but also by introducing a novel evaluation method that verifies the original and modified image being far in embedding space relative to the dataset size.

To measure the distance from the original image to its modified private version, we use the following privacy metrics: Recall@k and Percentage.

Recall@k for the set of query images L (which can either be original or modified images) and test images M, is defined as

$$ \text{Recall}(L, M, k) = 100 \frac{\sum_{q \in L} 1_{\text{Id}(q) \in \text{Id}(N(q, k, M))}}{\|L\|}, $$

where function Id maps the set of people's images to the set of (unique) identities of the individuals present on these images, function N(q, k, M) returns a set of k images from M that have the closest embedding to the one of the query image q.

We propose the use of a new metric, called the “Percentage”, in addition to the Recall metric, to evaluate the effectiveness of our privacy methods. The reason for introducing this new metric is to ensure that the modified image is not only far from the original image in absolute terms, as ensured by Recall@k, but also in terms of the percentage of dataset size. This provides a common privacy metric that can be used to compare the effectiveness of our methods across different dataset sizes.

Percentage is the proportion of images for each query image from the dataset L in between the query image and the closest image with the same identity from the dataset M:

$$ \text{Percentage}(L, M, k) = 100 \sum_{q \in L} \frac{\text{Between}(q, N(q, 1, M))}{\|L\| \times \|M\|}, $$

where the function Between(q₁, q₂) returns the number of images in the dataset M that have a smaller distance to the embedding of q₁ than the distance in-between the embeddings of q₁ and q₂.

## 3.2 The problem of transfer

In practical scenarios, it is crucial that privacy methods are effective against various image recognition neural networks. We optimise our privacy methods to be effective for specific embeddings, and transferring to a different embedding method can be challenging as new methods are continually emerging. It is impossible to guarantee that privacy methods will be effective against future attacks, as some methods have been broken by newer recognition neural networks [21]. To evaluate the effectiveness of our proposed methods, we conducted two sets of optimisation experiments.

The first experiment involves optimising StyleGAN and VQGAN image generation to be effective against the FaceNet embedding method. We aim to make the FaceNet embedding of the generated image
<table><caption>Table 1: Test on the LFW dataset. Evaluation for the same embedding that was used for training (no transfer): PrivacyGAN (based on VQGAN or StyleGAN) is optimised with FaceNet, tested with FaceNet, and compared to Fawkes in “high” mode (meaning: high privacy). We see that PrivacyGAN equipped with standard versions of StyleGAN and VQGAN obtains better privacy results compared to Fawkes.</caption><thead><tr><th rowspan="2"></th><th colspan="4">PrivacyGAN</th><th>Pixel-based</th></tr><tr><th>StyleGAN</th><th>StyleGAN</th><th>VQGAN</th><th>VQGAN</th><th>Fawkes</th></tr><tr><th></th><th colspan="2">-0.003_500</th><th colspan="2">-0.005_128</th><th></th></tr></thead><tbody><tr><th>Percentage</th><td>8.110</td><td>0.654</td><td><strong>14.696</strong></td><td>0.861</td><td>0.782</td></tr><tr><th>Recall@1:m.i.</th><td>1.754</td><td>22.085</td><td><strong>0.047</strong></td><td>19.242</td><td>20.521</td></tr><tr><th>Recall@1:o.i.</th><td>2.180</td><td>22.133</td><td><strong>0.332</strong></td><td>22.180</td><td>23.886</td></tr><tr><th>Recall@3: m.i.</th><td>6.114</td><td>61.564</td><td><strong>0.758</strong></td><td>54.597</td><td>56.398</td></tr><tr><th>Recall@3: o.i.</th><td>5.308</td><td>60.142</td><td><strong>0.900</strong></td><td>53.981</td><td>58.246</td></tr><tr><th>Recall@5: m.i.</th><td>8.815</td><td>77.678</td><td><strong>1.374</strong></td><td>70.711</td><td>74.502</td></tr><tr><th>Recall@5: o.i.</th><td>7.109</td><td>75.782</td><td><strong>1.327</strong></td><td>67.820</td><td>72.796</td></tr><tr><th>Recall@10: m.i.</th><td>13.365</td><td>86.256</td><td><strong>2.986</strong></td><td>79.668</td><td>83.412</td></tr><tr><th>Recall@10: o.i.</th><td>11.422</td><td>85.355</td><td><strong>2.512</strong></td><td>77.773</td><td>82.938</td></tr><tr><th>Recall@50: m.i.</th><td>32.417</td><td>94.408</td><td><strong>11.280</strong></td><td>92.227</td><td>92.986</td></tr><tr><th>Recall@50: o.i.</th><td>28.768</td><td>94.028</td><td><strong>10</strong></td><td>92.464</td><td>93.981</td></tr><tr><th>Recall@100: m.i.</th><td>43.697</td><td>96.303</td><td><strong>19.336</strong></td><td>95.166</td><td>95.592</td></tr><tr><th>Recall@100: o.i.</th><td>40.806</td><td>96.019</td><td><strong>17.062</strong></td><td>95.071</td><td>96.303</td></tr></tbody></table>

distant from that of the original image during the optimisation process. We compare our proposed methods to Fawkes, which uses the same embedding method for optimisation, in Table 1. Additionally, we aim to test the transferability of our methods to embedding methods introduced after FaceNet, which Fawkes does not prove to be effective against [21].

The second experiment involves optimising StyleGAN and VQGAN image generation using MagFace and MobileFaceNet embedding methods, which have been shown to increase the robustness of generated images. We also compare them to the makeup transfer method AMT-GAN [12]

# 4 Datasets and embeddings

## 4.1 The Labelled Faces in the Wild

The dataset [13] contains multiple images for each person, with the number of images per person varying between 1 and 530. To ensure fairness, we extract a sub-dataset from the original dataset, which includes 5 randomly chosen images per person. We exclude images of people who have less than 5 photos present in the dataset. This sub-dataset is referred to as LFW in the following sections of this paper.

## 4.2 The Casual Conversations dataset

The Casual Conversations dataset [9] comprises 45186 videos, each of which features one person. We select 997 videos and extract 5 face crops of size 456 × 456 per person present in the dataset (in case the video contains face crops of a required size).
The process of selecting these face crops is as follows:

1. We select all the time frames from the video featuring a specific person.

2. We check if, among these time frames, there are at least 5 non-consecutive (±10) time frames that satisfy the following conditions:

* they contain a face crop of a size at least 456 × 456 with a margin of size 100;

* average brightness of a time frame is at least 70. This condition is required since, among the videos in the CC dataset, there are many that were recorded in complete darkness, and it is not realistic to have such face crops as profile pictures.

3. If there are more than 5 time frames selected, we randomly choose 5 of them and add them to the dataset.

We make sure that we don't select successive frames of the video since they could contain identical face crops.

For the confounders set, we randomly choose different people's face crops that also satisfy conditions 1 and 2 and do not feature a person who was already selected for our primary dataset before.

The key difference between our novel dataset and LFW is that faces in our proposed dataset have similar backgrounds and are taken within a short timeframe, creating an additional challenge for privacy protection. That lack of variety makes this particular dataset very interesting for our research. By testing our methods on it, we are able to ensure that, even if there are many very similar photos of the same person in the dataset, the proposed privacy tools can still be effective. It is particularly important in cases where people publish their images from similar locations on different platforms over the internet. Later, we refer to this dataset as CC.

The complete code for the face crop dataset extraction will be provided at the time of publication.

## 4.3 Our proposed methods for transfer to unknown embeddings: optimising on multiple embeddings

The embedding methods that we are using in this paper are the following: FaceNet [23]; ArcFace [5]; SphereFace [18]; MagFace [19]; MobileFaceNet [2] with implementation from the FaceX-Zoo library [26]; and ResNet.152 [10] with implementation from the FaceX-Zoo library [26].

We evaluate the effectiveness of our proposed privacy methods in a black-box setting (i.e., robustness to unknown image recognition methods not used in the privacy method). We optimise the generated image for one or two embeddings from the list and then check the generated image against all the other embeddings. Thus, we make sure that our privacy methods transfer well to unknown embeddings and can be used for the privacy protection of real photos published online.

# 5 Experiments and Results

Here we define the settings and notations that we use in our experiments.

We set the hyperparameters of the generative privacy loss ($L_{generative}$) for our experiments in the following way: the learning rate to 0.01 and the batch size to 32. The only parameters that we modify from experiment to experiment are the coefficient $K$ and the number of iterations.
We have introduced the notations “o.i” and “m.i” to represent the original image and the modified image generated by any privacy-preserving algorithm, respectively. For our recall evaluation, we select either the original image (o.i. context) or the modified image (m.i. context) as the query image, where the dataset used for recognition includes modified images and confounders for the former and includes the original images and confounders for the latter.

In all metric calculations, we also use a set of confounders, which are not used as queries in our experi-
ments and are sourced from the same dataset as the original images. The number of confounders is always
less than or equal to $\frac{1}{5}$ of the number of original images. To compare privacy protection methods, we use
the average value of the transfer recall (i.e., Recall@10) for all embeddings for which the algorithm was not
optimized. Incorporating confounders in our experiments brings us closer to real-world scenarios, where
datasets may contain unrelated images that can potentially affect the experiment results.

Moreover, in order to compare VQGAN, StyleGAN, and Fawkes to one another, we use different sets of parameters chosen to match the transfer recall results. Thus, we are able to compare the generated image quality and see which of the methods generates the best images in terms of image quality for a given privacy performance (measured by recall).

Later in this section, we use the following notations: By **standard version of StyleGAN** we mean PrivacyGAN equipped with StyleGAN optimized with a coefficient $K = 0.03$ for embedding distance in the loss and 128 iterations; By **standard version of VQGAN** we mean PrivacyGAN equipped with VQGAN optimized a coefficient $K = 0.03$ for embedding distance in the loss and 1000 iterations; By StyleGAN$_{x\_y}$ / VQGAN$_{x\_y}$ we mean PrivacyGAN equipped with StyleGAN/VQGAN optimized a coefficient $K = x$ for embedding distance in the loss and $y$ iterations.

**5.1 Experiment 1: Comparing Pixel-Based and Generative Methods Optimised for**
**One Embedding on the LFW Dataset**

In Table 1, we compare standard versions of VQGAN and StyleGAN and their versions StyleGAN_0.003_500 and VQGAN_0.005_128 that we prepare specifically to match the privacy results of Fawkes. With this parametrization, they have the same transfer recall score, which allows us to compare fairly the image quality of our proposed generative methods and the state-of-the-art pixel-based method Fawkes. The transfer recall values (average values of Recall@10 for other methods from the list) are 62.16% for StyleGAN, 89.28% for StyleGAN_0.003_500, 65.49% for VQGAN, 90.07% for VQGAN_0.005_128, 90.90% for Fawkes. In order to make sure that image privacy is robust against various facial recognition systems, we study a transfer to different embedding methods (ArcFace, MagFace, SphereFace, MobileFaceNet, ResNet_152). Some results are in Table 2 (SphereFace) and in Table 3 (MagFace).

More results can be found in the supplementary material.

Examples of original images from the LFW dataset and their modifications obtained by our methods and by Fawkes are presented in Fig. 2. More examples are in the supplementary material.

Overall, from Tables 1, 2 and 3, we note that with a standard set of parameters, VQGAN and StyleGAN are much better for privacy than Fawkes. In order to match Fawkes privacy results, we need to change the VQGAN and StyleGAN parameters tenfold. While these parameter changes decrease privacy significantly, generative methods still have a disruptive effect on image quality.

It is worth noting that optimising generative methods using a single embedding method is insufficient for adequate facial image privacy protection. In the case of transferring images to MagFace (Table 3), the correct identity for the modified image is often among the top 5 possibilities. Thus, in the next subsection, we use two different embedding methods in the optimisation process to generate private image versions. Furthermore, we have observed that combining Fawkes poisoning with our proposed methods can be advantageous
<table><caption>Table 2: Evaluation in the case of transfer to another embedding on the LFW dataset: PrivacyGAN (with VQGAN or StyleGAN) are optimised with FaceNet and tested with SphereFace. Generative methods do obtain better privacy results than Fawkes, except for the versions specifically created (weakened) to have privacy results similar to Fawkes (these versions are created for comparing image quality in Table 7 in a context with equal privacy performance).</caption><thead><tr><th rowspan="3"></th><th colspan="4">PrivacyGAN</th><th>Pixel-based</th></tr><tr><th>StyleGAN</th><th>StyleGAN</th><th>VQGAN</th><th>VQGAN</th><th>Fawkes</th></tr><tr><th colspan="2">-0.003_500</th><th colspan="2">-0.005_128</th><th></th></tr></thead><tbody><tr><th>Percentage</th><td><strong>5.181</strong></td><td>1.388</td><td>5.104</td><td>1.271</td><td>1.213</td></tr><tr><th>Recall@1: m.i.</th><td>9.526</td><td>21.896</td><td><strong>8.768</strong></td><td>21.043</td><td>21.611</td></tr><tr><th>Recall@1: o.i.</th><td>9.431</td><td>22.891</td><td><strong>8.578</strong></td><td>23.223</td><td>23.791</td></tr><tr><th>Recall@3: m.i.</th><td>21.422</td><td>53.744</td><td><strong>20.142</strong></td><td>54.929</td><td>55.877</td></tr><tr><th>Recall@3: o.i.</th><td>19.621</td><td>53.744</td><td><strong>17.678</strong></td><td>54.360</td><td>56.588</td></tr><tr><th>Recall@5: m.i.</th><td>27.915</td><td>67.109</td><td><strong>26.066</strong></td><td>68.294</td><td>69.668</td></tr><tr><th>Recall@5: o.i.</th><td>24.834</td><td>66.682</td><td><strong>23.128</strong></td><td>66.777</td><td>69.100</td></tr><tr><th>Recall@10: m.i.</th><td>35.261</td><td>74.739</td><td><strong>33.175</strong></td><td>76.161</td><td>77.014</td></tr><tr><th>Recall@10: o.i.</th><td>32.322</td><td>75.308</td><td><strong>30.521</strong></td><td>74.455</td><td>77.393</td></tr><tr><th>Recall@50: m.i.</th><td>55.592</td><td>86.493</td><td><strong>53.602</strong></td><td>87.867</td><td>87.536</td></tr><tr><th>Recall@50: o.i.</th><td>53.507</td><td>87.773</td><td><strong>51.422</strong></td><td>86.967</td><td>88.673</td></tr><tr><th>Recall@100: m.i.</th><td>65.308</td><td>91.232</td><td><strong>63.697</strong></td><td>91.469</td><td>91.754</td></tr><tr><th>Recall@100: o.i.</th><td>63.744</td><td>91.896</td><td><strong>61.327</strong></td><td>91.611</td><td>91.943</td></tr></tbody></table>

for facial image privacy protection. We expand on that in supplementary material.

## 5.2 Experiment 2: Comparing StyleGAN and VQGAN Optimised with 2 Embedding Methods on the LFW Dataset

We now compare standard versions of VQGAN and StyleGAN together with other specific versions:

1. StyleGAN_0.02_500 and VQGAN_0.04_128;

2. StyleGAN_0.02_1000 and VQGAN_0.03_512.

These versions are proposed so that they have similar transfer recall scores in each pair. Specifically, average transfer recall scores for different methods are: 20.12% for StyleGAN, 32.33% for StyleGAN_0.02_500, 36.23% for StyleGAN_0.02_1000, 42.41% for VQGAN, 36.99% for VQGAN_0.03_512 and 33.07% for VQGAN_0.04_128. We create these specific versions of VQGAN and StyleGAN so that we can fairly compare the quality of the generated private images produced by the generative methods. We want to know which method produces the best image quality for a given threshold of our privacy metric. An example of an evaluation result without transfer is presented in Table 4 and for MobileFaceNet in the supplementary material.

We also study the transfer to different embedding methods. One of the results of this study (for the embedding method SphereFace) is presented in Table 5. Transfer results for other embedding methods can be found in the supplementary material.
<table><caption>Table 3: Evaluation on the LFW dataset in the case of transfer to another embedding: PrivacyGAN (with VQGAN or StyleGAN) is optimised with FaceNet and tested with MagFace. Generative methods do obtain better privacy results than Fawkes, except for the versions specifically created (weakened) to have privacy results similar to Fawkes (these versions are created for comparing image quality in Table 7 in a context with equal privacy performance). However, both Fawkes and generative methods optimised with one embedding do not transfer well to the novel embedding methods such as MagFace, while they transfer better to some other embedding methods such as SphereFace, as in Table 2.</caption><thead><tr><th rowspan="2"></th><th colspan="4">PrivacyGAN</th><th rowspan="2">Pixel-based<br>Fawkes</th></tr><tr><th>StyleGAN</th><th>StyleGAN<br>_0.003_500</th><th>VQGAN</th><th>VQGAN<br>_0.005_128</th></tr></thead><tbody><tr><th>Percentage</th><td><strong>0.767</strong></td><td>0.361</td><td>0.627</td><td>0.422</td><td>0.408</td></tr><tr><th>Recall@1: m.i.</th><td><strong>20.758</strong></td><td>24.028</td><td>24.028</td><td>24.265</td><td>24.882</td></tr><tr><th>Recall@1: o.i.</th><td><strong>21.611</strong></td><td>25.972</td><td>22.701</td><td>25.545</td><td>25.403</td></tr><tr><th>Recall@3: m.i.</th><td><strong>60.237</strong></td><td>71.848</td><td>66.493</td><td>73.744</td><td>75.403</td></tr><tr><th>Recall@3: o.i.</th><td><strong>60.142</strong></td><td>73.602</td><td>65.261</td><td>73.507</td><td>73.507</td></tr><tr><th>Recall@5: m.i.</th><td><strong>78.294</strong></td><td>96.967</td><td>86.209</td><td>98.389</td><td>98.768</td></tr><tr><th>Recall@5: o.i.</th><td><strong>76.777</strong></td><td>97.156</td><td>83.744</td><td>98.436</td><td>98.863</td></tr><tr><th>Recall@10: m.i.</th><td><strong>85.687</strong></td><td>97.962</td><td>91.043</td><td>98.863</td><td>99.194</td></tr><tr><th>Recall@10: o.i.</th><td><strong>84.313</strong></td><td>98.152</td><td>89.431</td><td>98.910</td><td>99.005</td></tr><tr><th>Recall@50: m.i.</th><td><strong>93.223</strong></td><td>99.005</td><td>95.545</td><td>99.005</td><td>99.194</td></tr><tr><th>Recall@50: o.i.</th><td><strong>92.512</strong></td><td>98.957</td><td>95.450</td><td>99.052</td><td>99.194</td></tr><tr><th>Recall@100: m.i.</th><td><strong>95.308</strong></td><td>99.052</td><td>97.062</td><td>99.100</td><td>99.194</td></tr><tr><th>Recall@100: o.i.</th><td><strong>94.976</strong></td><td>99.052</td><td>96.825</td><td>99.147</td><td>99.194</td></tr></tbody></table>
<table><caption>Table 4: Evaluation of various PrivacyGAN variants on the LFW dataset, case without transfer: Privacy-GAN (equipped with VQGAN and StyleGAN, including variants) are optimised with MagFace and Mobile-FaceNet and tested with MagFace. Lower recall means better privacy. Compared to Fawkes, results in Table 3: generative methods do get better privacy results. However, we did use MagFace in the algorithm, whereas Fawkes does not, hence the need for further validation (i.e., testing in the case of transfer to embeddings not used in the privacy algorithm), which is done, for example, in Table 5.</caption><thead><tr><th></th><th>StyleGAN</th><th>StyleGAN<br>_0.02_500</th><th>StyleGAN<br>_0.02_1000</th><th>VQGAN</th><th>VQGAN<br>_0.03_512</th><th>VQGAN<br>_0.04_128</th></tr></thead><tbody><tr><td>Percentage</td><td><strong>15.049</strong></td><td>7.909</td><td>7.264</td><td>4.910</td><td>7.472</td><td>8.307</td></tr><tr><td>Recall@1: m.i.</td><td><strong>0.095</strong></td><td>0.806</td><td>0.900</td><td>0.521</td><td>0.284</td><td><strong>0.095</strong></td></tr><tr><td>Recall@1: o.i.</td><td><strong>3.555</strong></td><td>8.768</td><td>10.521</td><td>11.185</td><td>6.588</td><td>6.919</td></tr><tr><td>Recall@3: m.i.</td><td><strong>3.270</strong></td><td>10.711</td><td>11.327</td><td>15.071</td><td>9.147</td><td>8.057</td></tr><tr><td>Recall@3: o.i.</td><td><strong>6.493</strong></td><td>17.583</td><td>20.332</td><td>23.981</td><td>14.360</td><td>14.218</td></tr><tr><td>Recall@5: m.i.</td><td><strong>5.118</strong></td><td>16.919</td><td>19.479</td><td>26.682</td><td>17.583</td><td>14.834</td></tr><tr><td>Recall@5: o.i.</td><td><strong>8.863</strong></td><td>21.943</td><td>25.071</td><td>30.664</td><td>19.147</td><td>17.867</td></tr><tr><td>Recall@10: m.i.</td><td><strong>9.242</strong></td><td>25.261</td><td>28.057</td><td>37.488</td><td>24.787</td><td>22.180</td></tr><tr><td>Recall@10: o.i.</td><td><strong>12.275</strong></td><td>28.626</td><td>32.133</td><td>40</td><td>25.972</td><td>24.929</td></tr><tr><td>Recall@50: m.i.</td><td><strong>23.649</strong></td><td>44.550</td><td>46.919</td><td>57.678</td><td>44.692</td><td>42.085</td></tr><tr><td>Recall@50: o.i.</td><td><strong>26.114</strong></td><td>48.436</td><td>50.521</td><td>60.806</td><td>46.967</td><td>44.028</td></tr><tr><td>Recall@100: m.i.</td><td><strong>31.706</strong></td><td>53.555</td><td>57.204</td><td>66.730</td><td>54.597</td><td>51.991</td></tr><tr><td>Recall@100: o.i.</td><td><strong>33.649</strong></td><td>57.393</td><td>60.332</td><td>69.052</td><td>55.450</td><td>54.028</td></tr></tbody></table>

<table><caption>Table 5: Evaluation of various PrivacyGAN variants in the case of transfer to another embedding on the LFW dataset: PrivacyGAN equipped with VQGAN or StyleGAN is optimised with MagFace and MobileFaceNet and tested with SphereFace. In this case, generative methods optimised with two embeddings obtain better results than generative methods optimised with only one embedding method in Table 2.</caption><thead><tr><th></th><th>StyleGAN</th><th>StyleGAN<br>_0.02_500</th><th>StyleGAN<br>_0.02_1000</th><th>VQGAN</th><th>VQGAN<br>_0.03_512</th></tr></thead><tbody><tr><td>Percentage</td><td><strong>12.273</strong></td><td>8.157</td><td>7.715</td><td>6.211</td><td>7.387</td></tr><tr><td>Recall@1: m.i.</td><td><strong>2.749</strong></td><td>5.118</td><td>5.735</td><td>6.682</td><td>4.787</td></tr><tr><td>Recall@1: o.i.</td><td><strong>5.261</strong></td><td>7.536</td><td>9.431</td><td>10.047</td><td>7.204</td></tr><tr><td>Recall@3: m.i.</td><td><strong>6.256</strong></td><td>11.801</td><td>12.701</td><td>14.408</td><td>12.512</td></tr><tr><td>Recall@3: o.i.</td><td><strong>9.573</strong></td><td>14.218</td><td>18.199</td><td>17.630</td><td>14.408</td></tr><tr><td>Recall@5: m.i.</td><td><strong>8.578</strong></td><td>15.924</td><td>17.109</td><td>19.289</td><td>17.536</td></tr><tr><td>Recall@5: o.i.</td><td><strong>11.848</strong></td><td>17.725</td><td>22.227</td><td>22.464</td><td>19.005</td></tr><tr><td>Recall@10: m.i.</td><td><strong>13.033</strong></td><td>20.711</td><td>22.891</td><td>26.398</td><td>24.360</td></tr><tr><td>Recall@10: o.i.</td><td><strong>15.877</strong></td><td>24.218</td><td>27.441</td><td>29.858</td><td>26.303</td></tr><tr><td>Recall@50: m.i.</td><td><strong>26.209</strong></td><td>39.858</td><td>41.943</td><td>47.441</td><td>42.749</td></tr><tr><td>Recall@50: o.i.</td><td><strong>30.379</strong></td><td>43.554</td><td>45.403</td><td>51.659</td><td>46.161</td></tr><tr><td>Recall@100: m.i.</td><td><strong>35.024</strong></td><td>49.336</td><td>50.995</td><td>57.820</td><td>52.749</td></tr><tr><td>Recall@100: o.i.</td><td><strong>39.716</strong></td><td>52.654</td><td>55.024</td><td>61.754</td><td>56.256</td></tr></tbody></table>
From the table 5 compared to 2 we can see that, in general, generative methods optimised with two embeddings transfer better to other embedding methods than generative methods optimised with only one embedding. For instance, for the unused in an optimisation process embedding SphereFace, the percentage score for StyleGAN with standard parameters optimised with 2 different embedding methods is more than 15 while it was just around 5 for one embedding method. Examples of images produced by the methods of experiment 2 are presented in Fig. 3. More of the examples can be found in the supplementary material.

<table><caption>Table 6: Evaluation in the case of a transfer to another embedding on the CC dataset: VQGAN and StyleGAN are optimised with MagFace and MobileFaceNet and tested with SphereFace. PrivacyGAN basically outperforms Fawkes while the comparison with AMT-GAN (which could be used on top of our method) depends on criteria and parameters.</caption><thead><tr><th rowspan="2"></th><th colspan="3">PrivacyGAN</th><th>Pixel-based</th><th>PrivacyGAN</th><th>Adversarial</th></tr><tr><th>VQGAN</th><th>VQGAN</th><th>VQGAN</th><th>Fawkes</th><th>StyleGAN</th><th>AMT-GAN</th></tr><tr><th></th><th>.0003_128</th><th></th><th>.004_4096</th><th></th><th>.002_1000</th><th></th></tr></thead><tbody><tr><th>Percentage</th><td>9.424</td><td>13.399</td><td>16.379</td><td>7.519</td><td><strong>17.024</strong></td><td>14.067</td></tr><tr><th>Recall@1: m.i.</th><td>17.854</td><td>9.529</td><td>5.998</td><td>23.952</td><td><strong>5.416</strong></td><td>9.328</td></tr><tr><th>Recall@1: o.i.</th><td>18.034</td><td>11.214</td><td><strong>6.800</strong></td><td>24.092</td><td>6.841</td><td>8.445</td></tr><tr><th>Recall@3: m.i.</th><td>40.702</td><td>21.364</td><td>13.561</td><td>52.979</td><td><strong>12.197</strong></td><td>19.980</td></tr><tr><th>Recall@3: o.i.</th><td>41.765</td><td>23.149</td><td>14.483</td><td>53.420</td><td><strong>14.443</strong></td><td>17.593</td></tr><tr><th>Recall@5: m.i.</th><td>48.245</td><td>26.439</td><td>17.051</td><td>61.244</td><td><strong>15.727</strong></td><td>24.293</td></tr><tr><th>Recall@5: o.i.</th><td>49.629</td><td>27.924</td><td><strong>17.994</strong></td><td>61.224</td><td>18.134</td><td>21.344</td></tr><tr><th>Recall@10: m.i.</th><td>53.220</td><td>31.515</td><td>21.143</td><td>65.055</td><td><strong>20.100</strong></td><td>29.228</td></tr><tr><th>Recall@10: o.i.</th><td>54.945</td><td>33.621</td><td><strong>22.768</strong></td><td>65.135</td><td>23.531</td><td>25.436</td></tr><tr><th>Recall@50: m.i.</th><td>64.253</td><td>44.835</td><td>34.343</td><td>72.979</td><td><strong>32.618</strong></td><td>42.086</td></tr><tr><th>Recall@50: o.i.</th><td>65.537</td><td>47.442</td><td><strong>36.068</strong></td><td>72.738</td><td>36.911</td><td>36.409</td></tr><tr><th>Recall@100: m.i.</th><td>68.726</td><td>51.675</td><td>41.484</td><td>76.108</td><td><strong>39.478</strong></td><td>49.509</td></tr><tr><th>Recall@100: o.i.</th><td>70.030</td><td>54.363</td><td>44.152</td><td>75.928</td><td>45.176</td><td><strong>42.467</strong></td></tr></tbody></table>

## 5.3 Experiment 3: Comparing StyleGAN, VQGAN, and Fawkes on the CC dataset

Here we choose the specific versions of VQGAN, StyleGAN, and Fawkes that have similar transfer recall scores in each group for the dataset CC:

1. VQGAN_0.003_128 and Fawkes;

2. StyleGAN_0.02_1000 and VQGAN_0.04_4096.

In addition, we have compared our results to those obtained with AMT-GAN. However, it is important to note that a direct comparison between our proposed methods and AMT-GAN is not possible, as AMT-GAN is unable to transfer makeup to faces that were not detected. Therefore, in cases where faces were not detected, we had to replace them with the original images, which may affect the comparability of the results. Transfer recalls for the proposed methods are the following: AMT-GAN: 49.57%, Fawkes: 79.21%, StyleGAN_0.02_1000: 24.71%, VQGAN_0.003_128: 74.76%, VQGAN_0.04_4096: 26.09%, VQGAN: 40.45%. We compare how well proposed generative and pixel-based approaches protect privacy against different embedding methods. One of the results of this study (for the embedding method SphereFace) is presented in
Table 6. Transfer results for other embedding methods can be found in the supplementary material. Examples of images produced by the methods of experiment 3 are presented in Fig. 4. More examples can be found in the supplementary material.

Using table 6, we can conclude that, despite using the CC dataset instead of LFW, generative methods prove to be effective for privacy preservation and tend to outperform both the pixel-based method Fawkes and the generative makeup transfer method AMT-GAN.

## 5.4 Human preferences for similar transfer recall

In Figs 4 and 3, we can see that, in some cases, modifying the number of iterations in optimisation and the coefficient K affects the quality of an image and its privacy protection. Therefore, to evaluate the modified image quality for different privacy methods with similar transfer recall, we conducted a human preference study. Three human raters were presented with 40 pairs of images generated by the methods discussed in section 5.3. Given two images generated by two different methods, the human rater could choose “I prefer the left one as an avatar,” “I prefer the right one as an avatar,” or “No preference.” To provide context, the human raters involved in the experiment were not paid and were not authors of the current paper. They were selected using the snowball principle, and their task was to assess the quality and similarity of the modified image to its original version. Without this assessment, we could end up with a black square instead of a privacy-protected image. The human raters did not have a degree in computer science and were not informed that the experiment related to privacy. However, the instructions provided to them, which included presenting the original image at the centre and emphasising that all images were reasonably close to it, as well as providing examples of potential use cases such as social networks, news articles, and dating websites, made it clear that assessing image similarity was an integral part of the task. The human-assessment results are presented in Table 7.

<table><thead><tr><th>Transfer recall</th><th>Avatar method 1</th><th>Avatar method 2</th><th>Human preference: success rate of 1 vs 2</th></tr></thead><tbody><tr><td colspan="4">High privacy (low recall), LFW dataset</td></tr><tr><td>32.6%</td><td>(StyleGAN_0.02_500, MagFace + MobileFaceNet)</td><td>(VQGAN_128_0.04, MagFace + MobileFaceNet)</td><td>43.75±5%</td></tr><tr><td>36.7%</td><td>(StyleGAN_0.02_1000, MagFace + MobileFaceNet)</td><td>(VQGAN_0.03_512, MagFace + MobileFaceNet)</td><td>35.37% ± 5%</td></tr><tr><td colspan="4">Low privacy (high recall), LFW dataset</td></tr><tr><td>90%</td><td>(StyleGAN_0.003_500, MagFace + MobileFaceNet)</td><td>Fawkes</td><td>87.2% ± 2%</td></tr><tr><td colspan="4">High privacy, (low recall), CC dataset</td></tr><tr><td>26.09% - 24.71%</td><td>(VQGAN_0.04_4096, MagFace + MobileFaceNet)</td><td>(StyleGAN_0.02_1000, MagFace + MobileFaceNet)</td><td>55.2% ± 3.59%</td></tr><tr><td colspan="4">Low privacy, (high recall), CC dataset</td></tr><tr><td>74.76% - 79.21%</td><td>(VQGAN_0.003_128, MagFace + MobileFaceNet)</td><td>Fawkes</td><td>51.5% ± 3.06%</td></tr></tbody></table>

Table 7: We modify the strength of different privacy-protection-algorithm perturbations until we get to similar target recall levels. We compare the quality of images, for each recall level. Text in bold font refers to human preference, for each recall level (see rightmost column).

We compared 5 different pairs of privacy-preserving methods with similar target recall values. In the low
privacy (high transfer recall) setting for both LFW and CC datasets, we were able to compare, in terms of quality, the Fawkes method with generative methods specifically modified to match Fawkes transfer recall values. When we choose FaceNet as an embedding for generative methods (StyleGAN) optimisation, the quality of the images generated by StyleGAN appears to be worse than that of Fawkes. However, when we use MagFace and MobileFaceNet as embeddings for generative methods optimisation, we obtain similar image quality results for VQGAN and Fawkes (51.5% ± 3.06%), while VQGAN has a better transfer recall (74.76% compared to 79.21%). In the high privacy (low transfer recall) setting for both the LFW and CC datasets, we were able to compare different modifications of the generative methods (VQGAN and StyleGAN) with similar transfer recall. In every case, it appears that human raters preferred VQGAN-generated images over StyleGAN-generated images.

## 5.5 Human Identification of Same-Person Images

In this section, our objective is to evaluate the effectiveness of various privacy preservation methods for their applicability on social media platforms and to determine the extent to which people can identify the person after privacy-preservation modifications by different methods, namely: VQGAN_0.005_128, AMT-GAN, and Fawkes, and the anonymization method Deep Privacy 2 [15].

The experiment is structured as follows: we begin with the original image, referred to as the “original” in the filename. We then examine privacy-preserved versions of different images of the same individual, followed by random images of different people. The central question for each image in a given set is, “Is this the same person as in the original?”.

To execute this experiment, we established a setup illustrated in Figure 5. This schema visually represents the process, illustrating the different image types involved in the human identification experiment.

We recruited 5 human evaluators, aged from 15 to 43 years, to assess pairs of images, comprising the original image and constructed using privacy-preserving methods for the same individual, as outlined in the schema in Figure 5. The results of the human study are presented in Table 8.

<table><caption>Table 8: Human face identification for various privacy preservation models. The table demonstrates that, while our method VQGAN_0.005_128, together with AMT-GAN and Fawkes, generate recognisable images, the anonymization method Deep Privacy 2 often produces images that cannot be recognised as the same person. The purpose and limitations of this experiment are further discussed in the text.</caption><thead><tr><th>Model</th><th>Accuracy for humans</th><th>99% confidence interval</th></tr></thead><tbody><tr><td>PrivacyGAN using VQGAN_0.005_128</td><td>0.796</td><td>± 0.04</td></tr><tr><td>AMT-GAN</td><td>0.829</td><td>± 0.038</td></tr><tr><td>Fawkes</td><td>0.842</td><td>± 0.037</td></tr><tr><td>Deep Privacy 2</td><td>0.187</td><td>± 0.039</td></tr></tbody></table>

From the findings presented in Table 8, we deduce that VQGAN_0.005_128, AMT-GAN, and Fawkes generate images that are similarly identifiable by human evaluators, with approximately 80% of images generated by these methods being successfully recognised as the same as the original. Conversely, the anonymization method Deep Privacy 2 frequently produces images that cannot be identified as those of the same individual. This further substantiates that while anonymization methods such as Deep Privacy 2 preserve certain attributes of images, they may fail to preserve their utility. In contrast, our method, along with other utility-focused methods, while not providing absolute protection against facial recognition, effectively
safeguards human facial images against prevalent face recognition techniques and maintains image utility for social media use.

This experiment was designed specifically to showcase that the recognisability of our method, along with AMT-GAN and Fawkes, is higher than that of anonymisation methods such as Deep Privacy 2. This explains our focus on testing just one version of PrivacyGAN. In future experiments, we intend to incorporate multiple versions of PrivacyGAN, and to involve a larger pool of human raters. This approach aims to determine which versions of PrivacyGAN perform best in terms of privacy/recall balance.

# 6 Limitations and Future Work

While generative methods are effective in safeguarding image privacy against various embedding methods, they cannot be compared to anonymization techniques. As [21] argues, it is always possible for new recognition attacks to be effective against provided data poisoning methods. However, our approach is different from anonymization, as we do not aim to provide a privacy guarantee against future attacks. Instead, our objective is to protect users against stalkers and unauthorized identification using current state-of-the-art recognition methods, while still enabling them to share their photos online, and be recognised by their family and friends. In the future, we would also like to use face enhancement as a tool for or against privacy methods, and check how much PrivacyGAN can be combined with AMT-GAN.

# 7 Conclusions

Our contributions are

1. A new approach to privacy based on inspirational generation, namely PrivacyGAN, using generative models for generating faces close to a given target. This method is orthogonal to the principles of AMT-GAN, so that our method could be used as a first step before AMT-GAN.

2. A comparison between these methods and traditional pixel-based methods, including transfer to unknown embeddings (a.k.a. robustness to unknown embeddings used for identifying people) and human raters for validating image quality.

3. A new privacy evaluation method based on the percentage of dataset images that are closer in an embedding space to a modified “private” image than to an original image.

4. A new dataset extracted from CC (more details are provided in the supplementary material). At the end, we recommend generative methods (Alg. 1), with several embeddings so that robustness and transfer to new methods are properly tested.

According to the human ratings study, Fawkes might be better than StyleGAN for generating high-quality images in the category “low privacy” (recall rate of 90%) on LFW. However, VQGAN and Fawkes have similar results in a low-privacy (74.76-79.21% as a transfer recall) setting, while VQGAN provides better privacy protection. Among the proposed generative methods, VQGAN is better than StyleGAN overall in terms of quality for a given privacy threshold (see Table 7). By the human identification study (section 5.5) we further show that, in contrast to anonymization methods, our method, along with other utility-focused methods, effectively safeguards facial image privacy against prevalent face recognition techniques while maintaining image utility for social media use.
In comparison to AMT-GAN, our method demonstrates superior privacy outcomes depending on the parameter settings, although it doesn't necessarily enhance human recognizability. While AMT-GAN excels in scenarios where recognizability is high and privacy is low, PrivacyGAN offers a broader spectrum of applications, particularly in cases where definitive facial detection is challenging, or where makeup contradicts the user's personal beliefs.
<figure><img src="image_3.png" /><figcaption>Figure 2: Experiment 1: Examples of original images from the LFW dataset and their counterparts modified by different privacy methods: StyleGAN_0.003_500, VQGAN_0.005_128, StyleGAN, VQGAN (using FaceNet as an embedding method for optimization), and Fawkes. Here we can see that, while generative methods in general add more modification to an image than Fawkes, generative methods produce realistic images and do not add pixel noise. Study based on human ratings in Table 7.</figcaption></figure>
<figure><img src="image_4.png" /><figcaption>Figure 3: Experiment 2: Examples of images from the LFW dataset modified by different privacy methods: StyleGAN, StyleGAN_0.02_500, StyleGAN_0.02_1000, VQGAN, VQGAN_0.03_512, VQGAN_0.04_128 with embedding methods MagFace and MobileFaceNet. Original and modified Fawkes image versions can be seen in Fig. 2. These images have different privacy levels and different qualities: the human rating experiment performs comparisons between images produced by methods with similar recall, i.e., similar privacy results.</figcaption></figure>
<figure><img src="image_5.png" /><figcaption>Figure 4: Experiment 3: Examples of images of volunteers modified by various privacy methods, including AMT-GAN, Fawkes and StyleGAN_0.02_1000, VQGAN_0.003_128, VQGAN_0.04_4096 optimised with embedding methods MagFace and MobileFaceNet. The different methods and parametrizations lead to different image quality/privacy results; the human rating experiments will compare the quality for methods with similar recall.</figcaption></figure>

<figure><img src="image_6.png" /><figcaption>Figure 5: Schema of the human identification experiment setup. The experiment involves comparing the original image with privacy-preserved versions of images of the same person and random images of different people to determine whether privacy-preservation methods could preserve the utility of the images modified by them: we expect human raters to recognize the original face for privacy-preserving methods, and not for anonymization methods.</figcaption></figure>
References

[1] Simone Barattin, Christos Tzelepis, Ioannis Patras, and Nicu Sebe. *Attribute-preserving face dataset anonymization via latent code optimization*. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8001–8010, 2023.

[2] Sheng Chen, Yang Liu, Xiang Gao, and Zhen Han. *Mobilefacenets: Efficient cnns for accurate real-time face verification on mobile devices*. In Chinese Conference on Biometric Recognition, pages 428–438. Springer, 2018.

[3] Valeriia Cherepanova, Micah Goldblum, Harrison Foley, Shiyuan Duan, John Dickerson, Gavin Taylor, and Tom Goldstein. *Lowkey: Leveraging adversarial attacks to protect social media users from facial recognition*. arXiv preprint arXiv:2101.07922, 2021.

[4] Ali Dabouei, Sobhan Soleymani, Jeremy Dawson, and Nasser Nasrabadi. *Fast geometrically-perturbed adversarial faces*. In 2019 IEEE Winter Conference on Applications of Computer Vision (WACV), pages 1979–1988. IEEE, 2019.

[5] Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou. *Arcface: Additive angular margin loss for deep face recognition*. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4690–4699, 2019.

[6] Patrick Esser, Robin Rombach, and Bjorn Ommer. *Taming transformers for high-resolution image synthesis*. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 12873–12883, 2021.

[7] Oran Gafni, Lior Wolf, and Yaniv Taigman. *Live face de-identification in video*. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 9378–9387, 2019.

[8] Drew Harwell. *This facial recognition website can turn anyone into a cop—or a stalker*. In Ethics of Data and Analytics, pages 63–67. Auerbach Publications, 2022.

[9] Caner Hazirbas, Joanna Bitton, Brian Dolhansky, Jacqueline Pan, Albert Gordo, and Cristian Canton Ferrer. *Towards measuring fairness in ai: the casual conversations dataset*. IEEE Transactions on Biometrics, Behavior, and Identity Science, 2021.

[10] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. *Deep residual learning for image recognition*. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016.

[11] Fabio Hellmann, Silvan Mertes, Mohamed Benouis, Alexander Hustinx, Tzung-Chien Hsieh, Cristina Conati, Peter Krawitz, and Elisabeth André. *Ganonymization: A gan-based face anonymization framework for preserving emotional expressions*. arXiv preprint arXiv:2305.02143, 2023.

[12] Shengshan Hu, Xiaogeng Liu, Yechao Zhang, Minghui Li, Leo Yu Zhang, Hai Jin, and Libing Wu. *Protecting facial privacy: generating adversarial identity masks via style-robust makeup transfer*. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 15014–15023, 2022.
[13] Gary B Huang, Marwan Mattar, Tamara Berg, and Eric Learned-Miller. *Labeled faces in the wild: A database for studying face recognition in unconstrained environments*. In Workshop on faces in 'Real-Life' Images: detection, alignment, and recognition, 2008.

[14] Håkon Hukkelås, Rudolf Mester, and Frank Lindseth. *Deepprivacy: A generative adversarial network for face anonymization*. In International symposium on visual computing, pages 565–578. Springer, 2019.

[15] Håkon Hukkelås and Frank Lindseth. *Deepprivacy2: Towards realistic full-body anonymization*. In 2023 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pages 1329–1338, 2023.

[16] Tero Karras, Samuli Laine, and Timo Aila. *A style-based generator architecture for generative adversarial networks*. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4401–4410, 2019.

[17] Taehoon Kim and Jihoon Yang. *Latent-space-level image anonymization with adversarial protector networks*. IEEE Access, 7:84992–84999, 2019.

[18] Weiyang Liu, Yandong Wen, Zhiding Yu, Ming Li, Bhiksha Raj, and Le Song. *Sphereface: Deep hypersphere embedding for face recognition*. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 212–220, 2017.

[19] Qiang Meng, Shichao Zhao, Zhida Huang, and Feng Zhou. *Magface: A universal representation for face recognition and quality assessment*. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 14225–14234, 2021.

[20] Yuying Qiu, Zhiyi Niu, Biao Song, Tinghuai Ma, Abdullah Al-Dhelaan, and Mohammed Al-Dhelaan. *A novel generative model for face privacy protection in video surveillance with utility maintenance*. Applied Sciences, 12(14):6962, 2022.

[21] Evani Radiya-Dixit and Florian Tramèr. *Data poisoning won't save you from facial recognition*. arXiv preprint arXiv:2106.14851, 2021.

[22] Ian Sample. *What is facial recognition-and how sinister is it*. The Guardian, 29, 2019.

[23] Florian Schroff, Dmitry Kalenichenko, and James Philbin. *Facenet: A unified embedding for face recognition and clustering*. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 815–823, 2015.

[24] Shawn Shan, Emily Wenger, Jiayun Zhang, Huiying Li, Haitao Zheng, and Ben Y Zhao. *Fawkes: Protecting privacy against unauthorized deep learning models*. In 29th USENIX security symposium (USENIX Security 20), pages 1589–1604, 2020.

[25] Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K Reiter. *Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition*. In Proceedings of the 2016 acm sigsac conference on computer and communications security, pages 1528–1540, 2016.

[26] Jun Wang, Yinglu Liu, Yibo Hu, Hailin Shi, and Tao Mei. *Facex-zoo: A pytorch toolbox for face recognition*. In Proceedings of the 29th ACM International Conference on Multimedia, pages 3779–3782, 2021.
[27] Kuan-Chieh Wang, Yan Fu, Ke Li, Ashish Khisti, Richard Zemel, and Alireza Makhzani. *Variational model inversion attacks*. Advances in Neural Information Processing Systems, 34:9706–9719, 2021.

[28] Thibaut Weise, Hao Li, Luc Van Gool, and Mark Pauly. *Face/off: Live facial puppetry*. In Proceedings of the 2009 ACM SIGGRAPH/Eurographics Symposium on Computer animation, pages 7–16, 2009.

[29] Emily Wenger, Shawn Shan, Haitao Zheng, and Ben Y Zhao. *Sok: Anti-facial recognition technology*. In 2023 IEEE Symposium on Security and Privacy (SP), pages 864–881. IEEE, 2023.

[30] Shawn Shan, Emily Wenger, Jiayun Zhang, Huiying Li, Haitao Zheng, and Ben Y Zhao. Fawkes: Protecting privacy against unauthorized deep learning models. In FAWKES github: https://github.com/Shawn-Shan/fawkes, 2020

[31] Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. *The unreasonable effectiveness of deep features as a perceptual metric*. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 586–595, 2018.
# A Appendix

Facial image privacy protection is a multi-objective problem combining image quality preservation and privacy robustness against various image recognition systems:

* In Section A.1, we provide the description of generative makeup transfer method AMT-GAN

* In Sections A.2-A.4, we present quantitative results (table of recall/percentage, showing privacy performance).

* Then, in Sections A.5.1-A.5.3, we present images, showing the image quality.

A human evaluation study that combines both privacy and image quality aspects is available in the main paper (Table 7, Table 8).

## A.1 Privacy algorithms: generative makeup transfer method AMT-GAN

In this paper, we compare the results of our method PrivacyGAN based on generative techniques such as StyleGAN [16] and VQGAN[6] to a method for generative makeup transfer known as AMT-GAN [12]. The objective of AMT-GAN is to produce adversarial images that incorporate the makeup style of reference images. Although AMT-GAN introduces more alterations to the original image, it confines these modifications to the makeup application areas, thus resulting in visually natural images, as demonstrated by the FID results. The authors of the method employ LPIPS [31] loss to retain image similarity to the original, which we also utilise in our paper.

In the main body of the paper, we mention that while photographs of individuals wearing makeup may look appropriate and natural to some people, there are certain drawbacks to this approach. Firstly, publishing photos with makeup may be deemed unsuitable for certain groups of individuals. Secondly, if the face in the photograph is not clearly discernible, AMT-GAN may not recognise it and may not generate a private version of the image, unlike Fawkes [24] and our method.

## A.2 Experiment 1: additional and extended tables of results

In this subsection, we present transfer results for Experiment 1. All the tables here are similar to the Table 2 except for the different choice of transfer embeddings used in recognition.

To be precise, we evaluate the transfer results of PrivacyGAN equipped with generative methods VQ-GAN and StyleGAN optimised with FaceNet[23] embedding and compare them to the transfer results of Fawkes. The criterion is the transfer to other embeddings than FaceNet, namely ArcFace[5], Mobile-FaceNet[2], and Resnet_152[10].

We also present the results of Fawkes combination with generative methods. We note that combining Fawkes poisoning with our methods can be beneficial for facial image privacy protection.

Table 9 presents results of the transfer to ArcFace embedding; Table 10 presents results of the transfer to MobileFaceNet embedding; and Table 11 presents the results of transfer to Resnet_152 embedding method.

From the results of this experiment, we conclude that generative methods optimised with one single embedding do not provide strong privacy protection, but their results are still better than the results of Fawkes.
### A.3 Experiment 2 (comparing PrivacyGAN equipped with StyleGAN and PrivacyGAN equipped with VQGAN optimised with 2 embedding methods on the LFW dataset): additional tables of results

In the main part of the article, we presented the results of Experiment 2 without transfer for embedding method MagFace in Table 4 and with transfer for embedding method SphereFace[18] in Table 5. Here we present another example without transfer for embedding method MobileFaceNet in Table 15 and with transfer for embedding methods FaceNet, ArcFace, and ResNet_152 in Tables 12, 13 and 14.

From the results of the experiment 2, we conclude that generative methods optimised with two different embeddings provide stronger privacy protection than those optimised with a single embedding method (as in experiment 1).

### A.4 Experiment 3 (comparing PrivacyGAN, AMT-GAN, and Fawkes on CC dataset): additional tables of results

In this section, we present the results of experiment 3. All the tables here are similar to Table 6 of the main paper, except for the differences in choice of transfer embeddings.

We present results for generative methods with a criterion based on transfer from MobileFaceNet and MagFace (used in our privacy algorithm) to embeddings FaceNet, ArcFace and ResNet_152 (used in the recognition) in Tables 16, 18 and 20 as well as results without transfer for embeddings MagFace and MobileFaceNet in Tables 17 and 19.

Overall, results for the *CC* dataset are similar to those for *LFW*, and generative methods remain preferable for privacy protection.

### A.5 Image examples for original and modified images using both pixel-based and generative methods

The examples in this section show that generative methods modify image features more than the pixel-based methods. Nonetheless, they have less artificial pixel noise, which is common for images protected by Fawkes. Pixel noise can be more detrimental in terms of visual quality.

#### A.5.1 Modified image examples: experiment 1

In this section, we present original images and their private versions that were obtained in the course of experiment 1 (similarly to Fig. 2). In addition, we also provide image examples for combinations of Fawkes and generative methods, namely Fawkes + StyleGAN (F+S), Fawkes + VQGAN (F+V), StyleGAN + Fawkes (S+F) and VQGAN + Fawkes (V+F). We see that adding Fawkes on top of generative methods improves image privacy, as in methods StyleGAN + Fawkes (S+F) and VQGAN + Fawkes (V+F). The mentioned image examples can be found in Figs 6, 7, 8 and 9.

#### A.5.2 Modified image examples: experiment 2

In this section, we present the original images and their private versions that were obtained during experiment 2, in addition to the images that were presented in the main paper in Fig 3. These images can be found in Figs 10, 11, 12 and 13.
<table><caption>Table 9: Evaluation on LFW dataset in the case of transfer to another embedding: VQGAN and StyleGAN are optimised with FaceNet, and all tests are performed with ArcFace. Lower recall and a higher percentage mean better privacy. As shown in Table 14 methods that are optimised for two embeddings have a better transfer recall. We see that adding Fawkes on top of generative methods improves image privacy, as in the methods StyleGAN + Fawkes (S+F) and VQGAN + Fawkes (V+F).</caption><thead><tr><th rowspan="3"></th><th colspan="4">PrivacyGAN</th><th>Pixel-based</th><th colspan="4">Combinations</th></tr><tr><th>StyleGAN</th><th>StyleGAN</th><th>VQGAN</th><th>VQGAN</th><th rowspan="2">Fawkes</th><th rowspan="2">F + S</th><th rowspan="2">F + V</th><th rowspan="2">S + F</th><th rowspan="2">V + F</th></tr><tr><th colspan="2">0.003_500</th><th colspan="2">0.005_128</th></tr></thead><tbody><tr><td>Percentage</td><td>5.052</td><td>0.917</td><td>4.931</td><td>0.984</td><td>0.936</td><td>7.612</td><td>7.855</td><td><strong>12.456</strong></td><td>10.397</td></tr><tr><td>Recall@1: m.i.</td><td>7.962</td><td>23.981</td><td>8.531</td><td>22.464</td><td>23.602</td><td>5.782</td><td>5.118</td><td><strong>2.464</strong></td><td>3.791</td></tr><tr><td>Recall@1: o.i.</td><td>8.246</td><td>24.976</td><td>10.095</td><td>24.692</td><td>24.313</td><td>6.445</td><td>7.062</td><td><strong>2.749</strong></td><td>4.408</td></tr><tr><td>Recall@3: m.i.</td><td>18.152</td><td>56.019</td><td>18.720</td><td>57.062</td><td>59.953</td><td>12.749</td><td>11.848</td><td><strong>7.346</strong></td><td>10.095</td></tr><tr><td>Recall@3: o.i.</td><td>17.536</td><td>56.730</td><td>19.858</td><td>58.578</td><td>59.431</td><td>11.991</td><td>13.175</td><td><strong>6.019</strong></td><td>8.768</td></tr><tr><td>Recall@5: m.i.</td><td>24.076</td><td>69.905</td><td>24.265</td><td>72.986</td><td>76.209</td><td>16.919</td><td>16.114</td><td><strong>10</strong></td><td>13.081</td></tr><tr><td>Recall@5: o.i.</td><td>22.038</td><td>70.379</td><td>24.929</td><td>72.559</td><td>75.877</td><td>15.782</td><td>16.445</td><td><strong>8.199</strong></td><td>11.611</td></tr><tr><td>Recall@10: m.i.</td><td>32.227</td><td>79.052</td><td>33.365</td><td>79.953</td><td>83.175</td><td>23.649</td><td>23.791</td><td><strong>13.886</strong></td><td>19.194</td></tr><tr><td>Recall@10: o.i.</td><td>30.190</td><td>78.389</td><td>33.318</td><td>79.905</td><td>83.033</td><td>21.754</td><td>22.607</td><td><strong>12.038</strong></td><td>16.635</td></tr><tr><td>Recall@50: m.i.</td><td>53.791</td><td>90.379</td><td>55.829</td><td>90.995</td><td>92.464</td><td>42.559</td><td>43.223</td><td><strong>28.436</strong></td><td>34.882</td></tr><tr><td>Recall@50: o.i.</td><td>52.701</td><td>91.185</td><td>55.924</td><td>91.469</td><td>92.227</td><td>41.706</td><td>42.607</td><td><strong>26.398</strong></td><td>31.848</td></tr><tr><td>Recall@100: m.i.</td><td>63.934</td><td>93.602</td><td>64.882</td><td>93.697</td><td>94.929</td><td>51.991</td><td>52.938</td><td><strong>37.488</strong></td><td>44.313</td></tr><tr><td>Recall@100: o.i.</td><td>63.318</td><td>94.076</td><td>65.877</td><td>94.123</td><td>94.692</td><td>51.754</td><td>53.602</td><td><strong>35.782</strong></td><td>42.607</td></tr></tbody></table>

### A.5.3 Modified image examples: experiment 3

Here, we present more image examples obtained by the procedure described in experiment 3. They are obtained the same way as images in Fig. 4. These examples are presented in Figs 14, 15 and 16.

We would also like to note that all necessary approvals were obtained for the use of images in the present paper.
<figure><img src="image_7.png" /><figcaption>Figure 6: Experiment 1: Examples of original images from the LFW dataset and their counterparts modified by different privacy methods: StyleGAN_0.003_500, VQGAN_0.005_128, StyleGAN, VQGAN (using FaceNet as an embedding method for optimisation), Fawkes, and combinations of Fawkes with generative methods. Here we can see that while generative methods in general add more modification to an image than Fawkes, generative methods produce realistic images and do not add pixel noise.</figcaption></figure>
<figure><img src="image_8.png" /><figcaption>Figure 7: Experiment 1: Examples of original images from the LFW dataset and their counterparts modified by different privacy methods: StyleGAN_0.003_500, VQGAN_0.005_128, StyleGAN, VQGAN (using FaceNet as an embedding method for optimisation), Fawkes, and combinations of Fawkes with generative methods. Here we can see that while generative methods in general add more modification to an image than Fawkes, generative methods produce realistic images and do not add pixel noise.</figcaption></figure>
<figure><img src="image_9.png" /><figcaption>Figure 8: Experiment 1: Examples of original images from the LFW dataset and their counterparts modified by different privacy methods: StyleGAN_0.003_500, VQGAN_0.005_128, StyleGAN, VQGAN (using FaceNet as an embedding method for optimisation), Fawkes, and combinations of Fawkes with generative methods. Here we can see that while generative methods in general add more modification to an image than Fawkes, generative methods produce realistic images and do not add pixel noise.</figcaption></figure>
<figure><img src="image_10.png" /><figcaption>Figure 9: Experiment 1: Examples of original images from the LFW dataset and their counterparts modified by different privacy methods: StyleGAN_0.003_500, VQGAN_0.005_128, StyleGAN, VQGAN (using FaceNet as an embedding method for optimisation), Fawkes, and combinations of Fawkes with generative methods. Here we can see that while generative methods in general add more modification to an image than Fawkes, generative methods produce realistic images and do not add pixel noise.</figcaption></figure>
<figure><img src="image_11.png" /><figcaption>Figure 10: Experiment 2: Examples of images from the LFW dataset: the original image and the image modified by different privacy methods: StyleGAN, StyleGAN_0.02_500, StyleGAN_0.02_1000, VQGAN, VQGAN_0.03_512, VQGAN_0.04_128 with embedding methods MagFace and MobileFaceNet. Here, we can see that in some cases, increasing the number of iterations in optimisation and modifying the coefficient *K* of the embedding method can affect the quality of an image while improving its privacy protection.</figcaption></figure>
<figure><img src="image_12.png" /><figcaption>Figure 11: Experiment 2: Examples of images from the LFW dataset: the original image and the image modified by different privacy methods: StyleGAN, StyleGAN_0.02_500, StyleGAN_0.02_1000, VQGAN, VQGAN_0.03_512, VQGAN_0.04_128 with embedding methods MagFace and MobileFaceNet. Here, we can see that in some cases, increasing the number of iterations in optimisation and modifying the coefficient *K* of the embedding method can affect the quality of an image while improving its privacy protection.</figcaption></figure>
<figure><img src="image_13.png" /><figcaption>Figure 12: Experiment 2: Examples of images from the LFW dataset: the original image and the image modified by different privacy methods: StyleGAN, StyleGAN_0.02_500, StyleGAN_0.02_1000, VQGAN, VQGAN_0.03_512, VQGAN_0.04_128 with embedding methods MagFace and MobileFaceNet. Here, we can see that in some cases, increasing the number of iterations in optimisation and modifying the coefficient *K* of the embedding method can affect the quality of an image while improving its privacy protection.</figcaption></figure>
<figure><img src="image_14.png" /><figcaption>Figure 13: Experiment 2: Examples of images from the LFW dataset: the original image and the image modified by different privacy methods: StyleGAN, StyleGAN_0.02_500, StyleGAN_0.02_1000, VQGAN, VQGAN_0.03_512, VQGAN_0.04_128 with embedding methods MagFace and MobileFaceNet. Here, we can see that in some cases, increasing the number of iterations in optimisation and modifying the coefficient *K* of the embedding method can affect the quality of an image while improving its privacy protection.</figcaption></figure>
<figure><img src="image_15.png" /><figcaption>Figure 14: Experiment 3: Examples of images of volunteers modified by various privacy methods, including AMT-GAN, Fawkes, StyleGAN_0.02_1000, VQGAN_0.003_128, VQGAN_0.04_4096 with embedding methods MagFace and MobileFaceNet. Here, we can see that in some cases, increasing the number of iterations in optimisation and modifying the coefficient *K* of the embedding method can affect the quality of an image while improving its privacy protection. We can also see that some images are modified more than others after applying privacy-protection methods.</figcaption></figure>
<figure><img src="image_16.png" /><figcaption>Figure 15: Experiment 3: Examples of images of volunteers modified by various privacy methods, including AMT-GAN, Fawkes, StyleGAN_0.02_1000, VQGAN_0.003_128, VQGAN_0.04_4096 with embedding methods MagFace and MobileFaceNet. Here, we can see that in some cases, increasing the number of iterations in optimisation and modifying the coefficient *K* of the embedding method can affect the quality of an image while improving its privacy protection. We can also see that some images are modified more than others after applying privacy-protection methods.</figcaption></figure>
<figure><img src="image_17.png" /><figcaption>Figure 16: Experiment 3: Examples of images of volunteers modified by various privacy methods, including AMT-GAN, Fawkes, StyleGAN_0.02_1000, VQGAN_0.003_128, VQGAN_0.04_4096 with embedding methods MagFace and MobileFaceNet. Here, we can see that in some cases, increasing the number of iterations in optimisation and modifying the coefficient $K$ of the embedding method can affect the quality of an image while improving its privacy protection. We can also see that some images are modified more than others after applying privacy-protection methods.</figcaption></figure>
<table><caption>Table 10: Evaluation on LFW dataset in the case of transfer to another embedding: VQGAN and StyleGAN are optimised with FaceNet, and recognition (for all methods) is tested with MobileFaceNet. Lower recall and a higher percentage mean better privacy. Generative methods do obtain better results than Fawkes. We can also see that adding Fawkes on top of generative methods improves image privacy, as in the methods StyleGAN + Fawkes (S+F) and VQGAN + Fawkes (V+F).</caption><thead><tr><th rowspan="2"></th><th colspan="4">PrivacyGAN</th><th>Pixel-based</th><th colspan="4">Combinations</th></tr><tr><th>StyleGAN</th><th>StyleGAN</th><th>VQGAN</th><th>VQGAN</th><th>Fawkes</th><th>F + S</th><th>F + V</th><th>S + F</th><th>V + F</th></tr></thead><tbody><tr><td>Percentage</td><td>1.226</td><td>0.446</td><td>0.947</td><td>0.454</td><td>0.454</td><td>1.875</td><td>4.359</td><td><strong>8.645</strong></td><td>5.586</td></tr><tr><td>Recall@1: m.i.</td><td>19.479</td><td>26.872</td><td>21.991</td><td>26.588</td><td>25.592</td><td>17.773</td><td><strong>1.185</strong></td><td>7.062</td><td>10.332</td></tr><tr><td>Recall@1: o.i.</td><td>19.100</td><td>26.303</td><td>21.943</td><td>26.493</td><td>26.351</td><td>19.147</td><td>12.938</td><td><strong>5.071</strong></td><td>8.910</td></tr><tr><td>Recall@3: m.i.</td><td>55.166</td><td>72.275</td><td>58.815</td><td>73.981</td><td>72.986</td><td>43.033</td><td>18.436</td><td><strong>16.825</strong></td><td>23.555</td></tr><tr><td>Recall@3: o.i.</td><td>51.090</td><td>74.692</td><td>56.682</td><td>72.701</td><td>73.697</td><td>41.517</td><td>26.161</td><td><strong>11.232</strong></td><td>19.005</td></tr><tr><td>Recall@5: m.i.</td><td>70.616</td><td>94.360</td><td>74.265</td><td>96.209</td><td>94.408</td><td>55.261</td><td>30.853</td><td><strong>22.275</strong></td><td>30.444</td></tr><tr><td>Recall@5: o.i.</td><td>64.882</td><td>93.934</td><td>71.896</td><td>95.498</td><td>93.934</td><td>51.896</td><td>31.801</td><td><strong>14.929</strong></td><td>24.550</td></tr><tr><td>Recall@10: m.i.</td><td>77.678</td><td>96.303</td><td>82.227</td><td>97.536</td><td>96.351</td><td>65.118</td><td>42.227</td><td><strong>29.052</strong></td><td>38.341</td></tr><tr><td>Recall@10: o.i.</td><td>75.024</td><td>96.066</td><td>80.379</td><td>97.156</td><td>96.019</td><td>61.848</td><td>41.185</td><td><strong>21.801</strong></td><td>33.033</td></tr><tr><td>Recall@50: m.i.</td><td>88.626</td><td>98.436</td><td>91.517</td><td>98.626</td><td>97.962</td><td>79.763</td><td>62.370</td><td><strong>48.483</strong></td><td>58.104</td></tr><tr><td>Recall@50: o.i.</td><td>87.867</td><td>98.389</td><td>90.284</td><td>98.389</td><td>97.725</td><td>79.242</td><td>61.943</td><td><strong>41.280</strong></td><td>53.460</td></tr><tr><td>Recall@100: m.i.</td><td>91.659</td><td>98.815</td><td>94.313</td><td>98.815</td><td>98.436</td><td>84.929</td><td>71.090</td><td><strong>55.735</strong></td><td>66.446</td></tr><tr><td>Recall@100: o.i.</td><td>91.754</td><td>98.673</td><td>93.223</td><td>98.768</td><td>98.152</td><td>84.408</td><td>69.716</td><td><strong>51.043</strong></td><td>62.844</td></tr></tbody></table>

<table><caption>Table 11: Evaluation on LFW dataset in the case of transfer to another embedding: VQGAN and StyleGAN are optimised with FaceNet and tested with ResNet_152. Lower recall and a higher percentage mean better privacy. The generative methods with two embeddings (see Table 13) do obtain better results, showing that using multiple embeddings increases robustness and transfer. We can also see that adding Fawkes on top of generative methods improves image privacy, as in the methods StyleGAN + Fawkes (S+F) and VQGAN + Fawkes (V+F).</caption><thead><tr><th rowspan="2"></th><th colspan="4">PrivacyGAN</th><th>Pixel-based</th><th colspan="4">Combinations</th></tr><tr><th>StyleGAN</th><th>StyleGAN</th><th>VQGAN</th><th>VQGAN</th><th>Fawkes</th><th>F + S</th><th>F + V</th><th>S + F</th><th>V + F</th></tr></thead><tbody><tr><td>Percentage</td><td>0.670</td><td>0.342</td><td>0.564</td><td>0.395</td><td>0.408</td><td>1.273</td><td>2.573</td><td><strong>6.823</strong></td><td>3.309</td></tr><tr><td>Recall@1: m.i.</td><td>20.900</td><td>25.071</td><td>23.270</td><td>26.019</td><td>25.403</td><td>17.488</td><td>8.436</td><td><strong>7.536</strong></td><td>11.896</td></tr><tr><td>Recall@1: o.i.</td><td>20.616</td><td>26.398</td><td>22.607</td><td>25.972</td><td>27.488</td><td>22.938</td><td>17.204</td><td><strong>8.957</strong></td><td>15.071</td></tr><tr><td>Recall@3: m.i.</td><td>59.526</td><td>73.128</td><td>65.592</td><td>75.545</td><td>76.351</td><td>49.573</td><td>30.000</td><td><strong>18.957</strong></td><td>34.597</td></tr><tr><td>Recall@3: o.i.</td><td>58.199</td><td>73.886</td><td>63.886</td><td>72.559</td><td>75.498</td><td>49.431</td><td>38.009</td><td><strong>17.251</strong></td><td>31.706</td></tr><tr><td>Recall@5: m.i.</td><td>78.673</td><td>97.773</td><td>87.583</td><td>98.626</td><td>98.578</td><td>66.303</td><td>45.498</td><td><strong>27.299</strong></td><td>45.924</td></tr><tr><td>Recall@5: o.i.</td><td>73.791</td><td>97.441</td><td>83.081</td><td>98.531</td><td>98.389</td><td>62.512</td><td>48.720</td><td><strong>21.706</strong></td><td>40.758</td></tr><tr><td>Recall@10: m.i.</td><td>85.972</td><td>98.483</td><td>91.801</td><td>98.863</td><td>99.005</td><td>74.976</td><td>58.483</td><td><strong>35.545</strong></td><td>56.493</td></tr><tr><td>Recall@10: o.i.</td><td>82.891</td><td>98.389</td><td>89.668</td><td>98.863</td><td>98.815</td><td>72.370</td><td>59.479</td><td><strong>30.332</strong></td><td>51.754</td></tr><tr><td>Recall@50: m.i.</td><td>94.028</td><td>99.005</td><td>97.014</td><td>99.052</td><td>99.194</td><td>87.915</td><td>78.152</td><td><strong>55.735</strong></td><td>74.123</td></tr><tr><td>Recall@50: o.i.</td><td>93.128</td><td>99.147</td><td>95.924</td><td>99.194</td><td>99.147</td><td>87.583</td><td>77.393</td><td><strong>51.469</strong></td><td>72.464</td></tr><tr><td>Recall@100: m.i.</td><td>95.877</td><td>99.100</td><td>97.867</td><td>99.100</td><td>99.194</td><td>91.659</td><td>83.744</td><td><strong>63.934</strong></td><td>80.095</td></tr><tr><td>Recall@100: o.i.</td><td>95.308</td><td>99.194</td><td>97.299</td><td>99.194</td><td>99.147</td><td>91.422</td><td>82.938</td><td><strong>60.900</strong></td><td>78.531</td></tr></tbody></table>
<table><caption>Table 12: Evaluation on LFW dataset in the case of transfer to another embedding: VQGAN and StyleGAN are optimised with MagFace and MobileFaceNet, and recognition is tested with FaceNet. Lower recall and a higher percentage mean better privacy. In this case, generative methods optimised with two embeddings obtain worse results than generative methods optimised with only one embedding method in Table 1: this is, however, not a fair comparison because we do not use FaceNet for optimisation in this experiment, while we do in Table 1.</caption><thead><tr><th></th><th>StyleGAN</th><th>StyleGAN<br>-0.02_500</th><th>StyleGAN<br>-0.02_1000</th><th>VQGAN</th><th>VQGAN<br>-0.03_512</th><th>VQGAN<br>-0.04_128</th></tr></thead><tbody><tr><td>Percentage</td><td><strong>7.849</strong></td><td>4.494</td><td>4.107</td><td>2.626</td><td>3.470</td><td>3.807</td></tr><tr><td>Recall@1: m.i.</td><td><strong>2.844</strong></td><td>6.066</td><td>6.730</td><td>8.152</td><td>6.919</td><td>6.019</td></tr><tr><td>Recall@1: o.i.</td><td><strong>4.597</strong></td><td>8.294</td><td>10.047</td><td>11.706</td><td>9.479</td><td>9.431</td></tr><tr><td>Recall@3: m.i.</td><td><strong>9.242</strong></td><td>15.640</td><td>18.009</td><td>22.701</td><td>19.242</td><td>17.536</td></tr><tr><td>Recall@3: o.i.</td><td><strong>9.668</strong></td><td>17.156</td><td>19.479</td><td>25.545</td><td>20.995</td><td>19.431</td></tr><tr><td>Recall@5: m.i.</td><td><strong>13.175</strong></td><td>22.322</td><td>25.166</td><td>32.275</td><td>27.062</td><td>24.787</td></tr><tr><td>Recall@5: o.i.</td><td><strong>13.081</strong></td><td>22.701</td><td>25.118</td><td>32.749</td><td>27.109</td><td>25.592</td></tr><tr><td>Recall@10: m.i.</td><td><strong>18.578</strong></td><td>31.564</td><td>35.118</td><td>43.175</td><td>37.725</td><td>34.408</td></tr><tr><td>Recall@10: o.i.</td><td><strong>17.725</strong></td><td>30.758</td><td>34.360</td><td>43.412</td><td>36.019</td><td>33.460</td></tr><tr><td>Recall@50: m.i.</td><td><strong>37.441</strong></td><td>54.028</td><td>57.062</td><td>67.725</td><td>60.142</td><td>57.441</td></tr><tr><td>Recall@50: o.i.</td><td><strong>35.213</strong></td><td>52.464</td><td>55.118</td><td>66.019</td><td>58.910</td><td>55.592</td></tr><tr><td>Recall@100: m.i.</td><td><strong>48.531</strong></td><td>64.882</td><td>68.436</td><td>77.109</td><td>71.137</td><td>68.104</td></tr><tr><td>Recall@100: o.i.</td><td><strong>46.351</strong></td><td>63.934</td><td>65.735</td><td>75.640</td><td>69.147</td><td>67.014</td></tr></tbody></table>

<table><caption>Table 13: Evaluation on LFW dataset in the case of transfer to another embedding: VQGAN and StyleGAN are optimised with MagFace and MobileFaceNet and recognition is tested with ResNet_152. Lower recall and a higher percentage mean better privacy. In this case, generative methods optimised with two embeddings obtain better results than generative methods optimised with only one embedding method, as in Table 10.</caption><thead><tr><th></th><th>StyleGAN</th><th>StyleGAN<br>-0.02_500</th><th>StyleGAN<br>-0.02_1000</th><th>VQGAN</th><th>VQGAN<br>-0.03_512</th><th>VQGAN<br>-0.04_128</th></tr></thead><tbody><tr><td>Percentage:</td><td><strong>5.656</strong></td><td>2.671</td><td>2.296</td><td>1.549</td><td>2.097</td><td>2.605</td></tr><tr><td>Recall@1: m.i.</td><td><strong>4.976</strong></td><td>8.294</td><td>11.422</td><td>12.322</td><td>9.526</td><td>7.630</td></tr><tr><td>Recall@1: o.i.</td><td><strong>9.289</strong></td><td>15.450</td><td>18.152</td><td>18.957</td><td>16.635</td><td>15.403</td></tr><tr><td>Recall@3: m.i.</td><td><strong>15.829</strong></td><td>28.578</td><td>32.986</td><td>37.488</td><td>31.043</td><td>28.057</td></tr><tr><td>Recall@3: o.i.</td><td><strong>19.763</strong></td><td>34.597</td><td>39.100</td><td>44.455</td><td>38.863</td><td>35.545</td></tr><tr><td>Recall@5: m.i.</td><td><strong>23.507</strong></td><td>41.327</td><td>46.445</td><td>55.687</td><td>46.161</td><td>41.469</td></tr><tr><td>Recall@5: o.i.</td><td><strong>26.114</strong></td><td>43.175</td><td>49.858</td><td>56.303</td><td>48.246</td><td>43.981</td></tr><tr><td>Recall@10: m.i.</td><td><strong>34.218</strong></td><td>52.796</td><td>58.957</td><td>68.673</td><td>59.716</td><td>54.929</td></tr><tr><td>Recall@10: o.i.</td><td><strong>34.313</strong></td><td>52.796</td><td>60.616</td><td>68.531</td><td>60.284</td><td>55.071</td></tr><tr><td>Recall@50: m.i.</td><td><strong>56.398</strong></td><td>74.123</td><td>78.104</td><td>84.692</td><td>79.763</td><td>76.540</td></tr><tr><td>Recall@50: o.i.</td><td><strong>54.929</strong></td><td>73.507</td><td>79.005</td><td>84.218</td><td>79.242</td><td>77.109</td></tr><tr><td>Recall@100: m.i.</td><td><strong>64.882</strong></td><td>81.611</td><td>84.360</td><td>89.242</td><td>85.118</td><td>82.986</td></tr><tr><td>Recall@100: o.i.</td><td><strong>63.839</strong></td><td>80.853</td><td>84.550</td><td>88.863</td><td>85.118</td><td>83.081</td></tr></tbody></table>
<table><caption>Table 14: Evaluation on LFW dataset, in the case of transfer to another embedding: VQGAN and StyleGAN are optimised with MagFace and MobileFaceNet, and recognition is tested with ArcFace. Lower recall and a higher percentage mean better privacy. In this case, generative methods optimised with two embeddings obtain better results than generative methods optimised with only one embedding method, as in Table 9.</caption><thead><tr><th></th><th>StyleGAN</th><th>StyleGAN<br>-0.02_500</th><th>StyleGAN<br>-0.02_1000</th><th>VQGAN</th><th>VQGAN<br>-0.03_512</th><th>VQGAN<br>-0.04_128</th></tr></thead><tbody><tr><td>Percentage</td><td><strong>11.993</strong></td><td>8.305</td><td>7.534</td><td>6.067</td><td>7.164</td><td>8.181</td></tr><tr><td>Recall@1: m.i.</td><td><strong>2.038</strong></td><td>4.123</td><td>4.550</td><td>6.967</td><td>4.882</td><td>4.739</td></tr><tr><td>Recall@1: o.i.</td><td><strong>3.555</strong></td><td>5.687</td><td>7.488</td><td>7.867</td><td>6.540</td><td>6.351</td></tr><tr><td>Recall@3: m.i.</td><td><strong>6.588</strong></td><td>11.754</td><td>12.370</td><td>15.640</td><td>13.270</td><td>11.232</td></tr><tr><td>Recall@3: o.i.</td><td><strong>6.919</strong></td><td>12.417</td><td>14.787</td><td>16.398</td><td>13.791</td><td>12.038</td></tr><tr><td>Recall@5: m.i.</td><td><strong>9.005</strong></td><td>16.209</td><td>17.109</td><td>20.758</td><td>19.052</td><td>16.588</td></tr><tr><td>Recall@5: o.i.</td><td><strong>9.526</strong></td><td>16.493</td><td>18.673</td><td>21.611</td><td>18.578</td><td>16.066</td></tr><tr><td>Recall@10: m.i.</td><td><strong>13.081</strong></td><td>22.844</td><td>24.976</td><td>29.384</td><td>26.066</td><td>22.417</td></tr><tr><td>Recall@10: o.i.</td><td><strong>14.171</strong></td><td>22.938</td><td>25.450</td><td>29.810</td><td>25.450</td><td>22.322</td></tr><tr><td>Recall@50: m.i.</td><td><strong>27.299</strong></td><td>41.374</td><td>43.270</td><td>51.280</td><td>44.455</td><td>41.611</td></tr><tr><td>Recall@50: o.i.</td><td><strong>28.863</strong></td><td>41.991</td><td>45.024</td><td>51.754</td><td>46.730</td><td>42.464</td></tr><tr><td>Recall@100: m.i.</td><td><strong>36.445</strong></td><td>50.806</td><td>52.986</td><td>61.137</td><td>54.360</td><td>51.232</td></tr><tr><td>Recall@100: o.i.</td><td><strong>38.910</strong></td><td>53.128</td><td>56.161</td><td>62.796</td><td>57.867</td><td>52.796</td></tr></tbody></table>

<table><caption>Table 15: Evaluation on LFW dataset: VQGAN and StyleGAN (and their variants) are optimised with MagFace and MobileFaceNet, and recognition is tested with MobileFaceNet. Generative methods do obtain better privacy than Fawkes (Table 10).</caption><thead><tr><th></th><th>StyleGAN</th><th>StyleGAN<br>-0.02_500</th><th>StyleGAN<br>-0.02_1000</th><th>VQGAN</th><th>VQGAN<br>-0.03_512</th><th>VQGAN<br>-0.04_128</th></tr></thead><tbody><tr><td>Percentage</td><td><strong>6.925</strong></td><td>3.290</td><td>3.079</td><td>2.583</td><td>3.555</td><td>4.461</td></tr><tr><td>Recall@1: m.i.</td><td><strong>0.569</strong></td><td>2.986</td><td>2.749</td><td>2.227</td><td>0.900</td><td>0.664</td></tr><tr><td>Recall@1: o.i.</td><td><strong>6.635</strong></td><td>14.739</td><td>14.976</td><td>15.782</td><td>12.654</td><td>10.379</td></tr><tr><td>Recall@3: m.i.</td><td><strong>11.090</strong></td><td>22.417</td><td>24.408</td><td>26.066</td><td>20.190</td><td>17.062</td></tr><tr><td>Recall@3: o.i.</td><td><strong>13.365</strong></td><td>30.095</td><td>32.180</td><td>34.834</td><td>26.351</td><td>22.085</td></tr><tr><td>Recall@5: m.i.</td><td><strong>18.531</strong></td><td>36.635</td><td>38.152</td><td>42.607</td><td>31.517</td><td>28.246</td></tr><tr><td>Recall@5: o.i.</td><td><strong>18.009</strong></td><td>38.578</td><td>40.379</td><td>45.308</td><td>34.550</td><td>29.289</td></tr><tr><td>Recall@10: m.i.</td><td><strong>26.682</strong></td><td>48.389</td><td>49.953</td><td>55.735</td><td>43.223</td><td>39.052</td></tr><tr><td>Recall@10: o.i.</td><td><strong>24.739</strong></td><td>48.720</td><td>49.100</td><td>54.739</td><td>44.645</td><td>38.720</td></tr><tr><td>Recall@50: m.i.</td><td><strong>47.014</strong></td><td>69.384</td><td>71.611</td><td>74.171</td><td>65.687</td><td>59.668</td></tr><tr><td>Recall@50: o.i.</td><td><strong>46.872</strong></td><td>69.716</td><td>71.991</td><td>74.597</td><td>66.919</td><td>60.427</td></tr><tr><td>Recall@100: m.i.</td><td><strong>56.682</strong></td><td>77.583</td><td>78.957</td><td>80.237</td><td>73.981</td><td>68.578</td></tr><tr><td>Recall@100: o.i.</td><td><strong>56.967</strong></td><td>76.588</td><td>79.336</td><td>80.948</td><td>75.308</td><td>69.431</td></tr></tbody></table>
<table><caption>Table 16: Evaluation on CC dataset in the case of a transfer to another embedding: VQGAN and StyleGAN are optimised with MagFace and MobileFaceNet, and recognition is tested with FaceNet. Lower recall and a higher percentage mean better privacy. We can see that generative methods' evaluation results for the CC dataset are very similar to the ones for the LFW dataset.</caption><thead><tr><th></th><th>VQGAN<br>_0.003_128</th><th>VQGAN<br>_0.04_4096</th><th>Fawkes</th><th>StyleGAN<br>_0.02_1000</th><th>AMT-GAN</th></tr></thead><tbody><tr><td>Percentage</td><td>0.697</td><td>3.975</td><td>8.312</td><td>0.715</td><td>1.633</td></tr><tr><td>Recall@1: m.i.</td><td>23.571</td><td>10.712</td><td>5.055</td><td>23.831</td><td>15.868</td></tr><tr><td>Recall@1: o.i.</td><td>24.012</td><td>15.125</td><td>8.064</td><td>24.534</td><td>16.429</td></tr><tr><td>Recall@3: m.i.</td><td>70.271</td><td>26.359</td><td>12.778</td><td>66.680</td><td>45.256</td></tr><tr><td>Recall@3: o.i.</td><td>71.274</td><td>32.177</td><td>15.527</td><td>66.800</td><td>46.319</td></tr><tr><td>Recall@5: m.i.</td><td>91.775</td><td>36.169</td><td>17.934</td><td>87.964</td><td>60.522</td></tr><tr><td>Recall@5: o.i.</td><td>91.555</td><td>39.860</td><td>20.040</td><td>84.875</td><td>60.923</td></tr><tr><td>Recall@10: m.i.</td><td>94.965</td><td>45.537</td><td>24.835</td><td>91.575</td><td>68.867</td></tr><tr><td>Recall@10: o.i.</td><td>94.905</td><td>48.265</td><td>26.239</td><td>89.950</td><td>69.829</td></tr><tr><td>Recall@50: m.i.</td><td>97.733</td><td>65.597</td><td>42.508</td><td>96.309</td><td>83.470</td></tr><tr><td>Recall@50: o.i.</td><td>97.553</td><td>66.941</td><td>45.436</td><td>95.125</td><td>84.554</td></tr><tr><td>Recall@100: m.i.</td><td>98.235</td><td>72.457</td><td>51.775</td><td>97.151</td><td>88.465</td></tr><tr><td>Recall@100: o.i.</td><td>98.195</td><td>75.125</td><td>55.486</td><td>96.670</td><td>89.749</td></tr></tbody></table>

<table><caption>Table 17: Evaluation on CC dataset, in the case without transfer to another embedding: VQGAN and StyleGAN are optimised with MagFace and MobileFaceNet, and recognition is tested with MagFace. We can see that generative methods' evaluation results for the CC dataset are very similar to the ones for the LFW dataset.</caption><thead><tr><th></th><th>VQGAN<br>_0.003_128</th><th>VQGAN<br>_0.04_4096</th><th>Fawkes</th><th>StyleGAN<br>_0.02_1000</th><th>AMT-GAN</th></tr></thead><tbody><tr><td>Percentage</td><td>2.880</td><td>14.337</td><td><strong>27.089</strong></td><td>2.507</td><td>4.201</td></tr><tr><td>Recall@1: m.i.</td><td>23.390</td><td>2.086</td><td>0.562</td><td>24.674</td><td>19.097</td></tr><tr><td>Recall@1: o.i.</td><td>21.926</td><td>5.918</td><td><strong>1.043</strong></td><td>24.995</td><td>17.031</td></tr><tr><td>Recall@3: m.i.</td><td>62.708</td><td>5.998</td><td><strong>1.143</strong></td><td>67.462</td><td>52.277</td></tr><tr><td>Recall@3: o.i.</td><td>63.129</td><td>10.973</td><td><strong>2.187</strong></td><td>67.683</td><td>49.107</td></tr><tr><td>Recall@5: m.i.</td><td>78.335</td><td>9.468</td><td><strong>1.805</strong></td><td>84.393</td><td>64.654</td></tr><tr><td>Recall@5: o.i.</td><td>78.154</td><td>13.561</td><td><strong>2.949</strong></td><td>83.952</td><td>63.149</td></tr><tr><td>Recall@10: m.i.</td><td>81.846</td><td>14.845</td><td><strong>3.230</strong></td><td>86.399</td><td>70.351</td></tr><tr><td>Recall@10: o.i.</td><td>82.046</td><td>17.553</td><td><strong>4.794</strong></td><td>86.219</td><td>68.706</td></tr><tr><td>Recall@50: m.i.</td><td>87.182</td><td>30.211</td><td><strong>9.007</strong></td><td>89.709</td><td>80.100</td></tr><tr><td>Recall@50: o.i.</td><td>87.603</td><td>31.033</td><td><strong>11.013</strong></td><td>89.749</td><td>78.495</td></tr><tr><td>Recall@100: m.i.</td><td>89.087</td><td>38.736</td><td><strong>14.203</strong></td><td>90.853</td><td>84.092</td></tr><tr><td>Recall@100: o.i.</td><td>89.348</td><td>39.238</td><td><strong>15.226</strong></td><td>90.913</td><td>82.247</td></tr></tbody></table>
<table><caption>Table 18: Evaluation on CC dataset in the case of a transfer to another embedding: VQGAN and StyleGAN are optimised with MagFace and MobileFaceNet, and recognition is tested with ArcFace. We can see that generative methods' evaluation results for the CC dataset are very similar to the ones for the LFW dataset.</caption><thead><tr><th></th><th>VQGAN<br>-0.003_128</th><th>VQGAN<br>-0.04_4096</th><th>Fawkes</th><th>StyleGAN<br>-0.02_1000</th><th>AMT-GAN</th></tr></thead><tbody><tr><td>Percentage</td><td>2.339</td><td>7.232</td><td>12.125</td><td>1.739</td><td><strong>14.657</strong></td><td>4.074</td></tr><tr><td>Recall@1: m.i.</td><td>21.184</td><td>9.188</td><td>5.115</td><td>24.453</td><td><strong>4.173</strong></td><td>15.266</td></tr><tr><td>Recall@1: o.i.</td><td>21.966</td><td>12.217</td><td><strong>6.640</strong></td><td>24.955</td><td>7.442</td><td>10.532</td></tr><tr><td>Recall@3: m.i.</td><td>55.426</td><td>22.628</td><td>11.635</td><td>63.71</td><td><strong>9.910</strong></td><td>37.733</td></tr><tr><td>Recall@3: o.i.</td><td>57.392</td><td>25.436</td><td><strong>13.260</strong></td><td>64.975</td><td>14.002</td><td>28.706</td></tr><tr><td>Recall@5: m.i.</td><td>69.468</td><td>28.445</td><td>15.165</td><td>78.034</td><td><strong>12.839</strong></td><td>48.004</td></tr><tr><td>Recall@5: o.i.</td><td>70.973</td><td>32.016</td><td><strong>16.830</strong></td><td>78.656</td><td>17.212</td><td>37.813</td></tr><tr><td>Recall@10: m.i.</td><td>75.165</td><td>35.426</td><td>19.960</td><td>81.825</td><td><strong>17.854</strong></td><td>55.366</td></tr><tr><td>Recall@10: o.i.</td><td>76.209</td><td>39.699</td><td><strong>22.487</strong></td><td>82.648</td><td>23.049</td><td>44.433</td></tr><tr><td>Recall@50: m.i.</td><td>84.072</td><td>52.879</td><td>35.807</td><td>88.104</td><td><strong>30.993</strong></td><td>70.090</td></tr><tr><td>Recall@50: o.i.</td><td>85.035</td><td>58.295</td><td>40.040</td><td>88.546</td><td><strong>38.716</strong></td><td>61.765</td></tr><tr><td>Recall@100: m.i.</td><td>87.442</td><td>61.204</td><td>44.714</td><td>90.913</td><td><strong>38.837</strong></td><td>76.670</td></tr><tr><td>Recall@100: o.i.</td><td>88.185</td><td>66.419</td><td>48.967</td><td>90.973</td><td><strong>46.620</strong></td><td>69.087</td></tr></tbody></table>

<table><caption>Table 19: Evaluation on CC dataset without transfer to another embedding: VQGAN and StyleGAN are optimised with MagFace and MobileFaceNet, and recognition is tested with MobileFaceNet. Lower recall and a higher percentage mean better privacy. We can see that generative methods evaluation results for the CC dataset are very similar to the ones for the LFW dataset.</caption><thead><tr><th></th><th>VQGAN<br>-0.003_128</th><th>VQGAN<br>-0.04_4096</th><th>Fawkes</th><th>StyleGAN<br>-0.02_1000</th><th>AMT-GAN</th></tr></thead><tbody><tr><td>Percentage</td><td>6.513</td><td>12.668</td><td><strong>20.632</strong></td><td>5.200</td><td>15.798</td><td>7.708</td></tr><tr><td>Recall@1: m.i.</td><td>20.542</td><td>7.763</td><td><strong>1.224</strong></td><td>24.313</td><td>3.972</td><td>14.664</td></tr><tr><td>Recall@1: o.i.</td><td>19.719</td><td>12.638</td><td><strong>5.155</strong></td><td>24.875</td><td>8.004</td><td>12.919</td></tr><tr><td>Recall@3: m.i.</td><td>53.440</td><td>17.673</td><td><strong>3.852</strong></td><td>60.100</td><td>9.850</td><td>36.871</td></tr><tr><td>Recall@3: o.i.</td><td>53.902</td><td>24.433</td><td><strong>10.251</strong></td><td>59.880</td><td>16.108</td><td>27.663</td></tr><tr><td>Recall@5: m.i.</td><td>63.952</td><td>22.648</td><td><strong>5.436</strong></td><td>70.812</td><td>13.159</td><td>44.835</td></tr><tr><td>Recall@5: o.i.</td><td>64.614</td><td>30.451</td><td><strong>12.417</strong></td><td>70.933</td><td>20.662</td><td>32.397</td></tr><tr><td>Recall@10: m.i.</td><td>67.643</td><td>29.027</td><td><strong>8.666</strong></td><td>74.022</td><td>18.415</td><td>50.973</td></tr><tr><td>Recall@10: o.i.</td><td>68.826</td><td>37.051</td><td><strong>16.510</strong></td><td>74.223</td><td>27.061</td><td>36.429</td></tr><tr><td>Recall@50: m.i.</td><td>74.564</td><td>43.771</td><td><strong>19.278</strong></td><td>79.539</td><td>33.280</td><td>64.092</td></tr><tr><td>Recall@50: o.i.</td><td>75.206</td><td>53.039</td><td><strong>29.027</strong></td><td>79.819</td><td>43.290</td><td>45.456</td></tr><tr><td>Recall@100: m.i.</td><td>77.733</td><td>51.013</td><td><strong>26.820</strong></td><td>82.006</td><td>41.204</td><td>69.649</td></tr><tr><td>Recall@100: o.i.</td><td>78.134</td><td>59.980</td><td><strong>37.131</strong></td><td>82.247</td><td>51.715</td><td>50.291</td></tr></tbody></table>
<table><caption>Table 20: Evaluation on CC dataset in the case of a transfer to another embedding: VQGAN and StyleGAN are optimised with MagFace + MobileFaceNet, and recognition is tested with ResNet_152. Lower recall and a higher percentage mean better privacy. We can see that generative methods' evaluation results for the CC dataset are very similar to the ones for the LFW dataset.</caption><thead><tr><th></th><th>VQGAN</th><th>VQGAN</th><th>VQGAN</th><th>Fawkes</th><th>StyleGAN</th><th>AMT-GAN</th></tr><tr><th></th><th>-0.003_128</th><th></th><th>-0.04_4096</th><th></th><th>-0.02_1000</th><th></th></tr></thead><tbody><tr><td>Percentage</td><td>3.025</td><td>4.970</td><td>6.915</td><td>2.652</td><td><strong>7.650</strong></td><td>4.518</td></tr><tr><td>Recall@1: m.i.</td><td>20.582</td><td>12.758</td><td><strong>7.783</strong></td><td>24.012</td><td>8.345</td><td>16.790</td></tr><tr><td>Recall@1: o.i.</td><td>20.602</td><td>14.584</td><td>11.033</td><td>24.754</td><td><strong>10.732</strong></td><td>15.908</td></tr><tr><td>Recall@3: m.i.</td><td>56.951</td><td>32.217</td><td><strong>20.361</strong></td><td>61.685</td><td>21.846</td><td>39.398</td></tr><tr><td>Recall@3: o.i.</td><td>56.971</td><td>33.079</td><td><strong>22.949</strong></td><td>62.347</td><td>24.092</td><td>34.303</td></tr><tr><td>Recall@5: m.i.</td><td>69.930</td><td>40.943</td><td><strong>27.021</strong></td><td>75.165</td><td>28.646</td><td>49.328</td></tr><tr><td>Recall@5: o.i.</td><td>69.629</td><td>41.083</td><td><strong>28.686</strong></td><td>74.905</td><td>30.150</td><td>41.805</td></tr><tr><td>Recall@10: m.i.</td><td>74.463</td><td>49.328</td><td><strong>35.065</strong></td><td>78.816</td><td>36.489</td><td>56.289</td></tr><tr><td>Recall@10: o.i.</td><td>74.183</td><td>49.589</td><td><strong>36.189</strong></td><td>78.696</td><td>37.232</td><td>47.141</td></tr><tr><td>Recall@50: m.i.</td><td>82.608</td><td>66.379</td><td><strong>53.521</strong></td><td>85.496</td><td>54.644</td><td>71.414</td></tr><tr><td>Recall@50: o.i.</td><td>82.508</td><td>67.041</td><td><strong>54.664</strong></td><td>85.216</td><td>56.851</td><td>59.920</td></tr><tr><td>Recall@100: m.i.</td><td>85.657</td><td>73.561</td><td>62.628</td><td>87.823</td><td><strong>62.327</strong></td><td>77.553</td></tr><tr><td>Recall@100: o.i.</td><td>85.537</td><td>73.400</td><td><strong>63.591</strong></td><td>87.803</td><td>64.754</td><td>65.236</td></tr></tbody></table>