Transferable Adversarial Facial Images for Privacy Protection

Authors: minghui  li
hao  zhang
ziqi  zhou
shengshan  hu
xiaobing  pei
jiangxiong  wang
Venue: acmmm_org_ACMMM_2024_Conference
Published: 2024-04-07 16:02:26

Abstract: The success of deep face recognition (FR) systems has raised serious privacy concerns due to their ability to enable unauthorized tracking of users in the digital world. Previous studies proposed introducing imperceptible adversarial noises into face images to deceive those face recognition models, thus achieving the goal of enhancing facial privacy protection.Nevertheless, they heavily rely on user-chosen references to guide the generation of adversarial noises, and cannot simultaneously construct natural and highly transferable adversarial face images in black-box scenarios. In light of this, we present a novel face privacy protection scheme with improved transferability while maintain high visual quality. We propose shaping the entire face space directly instead of exploiting one kind of facial characteristic like makeup information to integrate adversarial noises. To achieve this goal, we first exploit global adversarial latent search to traverse the latent space of the generative model, thereby creating natural adversarial face images with high transferability. We then introduce a key landmark regularization module to preserve the visual identity information. Finally, we investigate the impacts of various kinds of latent spaces and find that $\mathcal{F}$ latent space benefits the trade-off between visual naturalness and adversarial transferability. Extensive experiments over two datasets demonstrate that our approach significantly enhances attack transferability while maintaining high visual quality, outperforming state-of-the-art methods by an average 25\% improvement in deep FR models and 10\% improvement on commercial FR APIs, including Face++, Aliyun, and Tencent.

Main paper: 
 introduction: 
 Deep face recognition (FR) systems [30, 40] have triumphed in both verification and identification scenarios and been widely applied across various domains, such as security [44] , biometrics [28] , and criminal-investigation [31] . Despite its promising prospect, FR systems pose a profound risk to individual privacy due to their capacity for large-scale surveillance [2, 46] , e.g., tracking user relationship and activities by analyzing face images from social media platforms [13, 36] . Given the opacity of these FR systems, there is an urgent need for an effective black-box approach to protect facial privacy.Recent works have attempted to protect facial privacy using noise-based adversarial examples (AEs) [32, 38, 49] by adding carefully crafted adversarial perturbations to the source face images to deceive malicious FR systems. However, the adversarial perturbations are typically constrained to the 𝑙 𝑝 norm within the pixel space, which makes adversarial face images have conspicuous discernible artifacts with poor visual quality [49] .Another solution is exploiting unrestricted adversarial examples [15, 35, 50, 61] to mislead malicious FR systems. Unlike noisebased methods, they are not confined by perturbation budgets, thereby maintaining superior image quality [4, 37, 48] . Recently proposed makeup-based approaches (e.g., AMT-GAN [15] , CLIP-2Protect [35] ) have achieved state-of-the-art performance, as they can effectively embed adversarial noises in the makeup style by using generative adversarial networks (GANs) [10, 16] or GAN inversion. However, they rely on extra user-chosen guidance, such as reference images in AMT-GAN and textual prompts in CLIP2Protect, to make adversarial noises harmoniously integrated with face characteristics. Besides, these methods excessively focus on the modification of local attributes, leading to minor effects on facial identity characteristics, resulting in limited transferability. To address the above issues, we propose the Guidance-Independent Adversarial Facial Images with Transferability (GIFT) for privacy protection, which takes a big step towards bridging the gap between visual naturalness and adversarial transferability. Firstly, we map face images to a low-dimensional manifold represented by a generative model. We then conduct adversarial latent optimization that moves along the adversarial direction. In contrast to [35] , we perform adversarial latent optimization over the global latent space called Global Adversarial Latent Search (GALS), which can control more semantic information with improved transferability. However, in the absence of extra guidance information, GALS may change the visual identity of resulting images. Therefore, we introduce a key landmark regularization (KLR) method to rectify this issue. Furthermore, we investigate the effect of diverse latent spaces on our scheme. We find that the latent space W + , which is commonly used in existing face privacy protection tasks, exhibits weaker transferability and lower perceptual image quality than the other two prevalent latent spaces W and F . Consequently, we opt for the optimal latent space F to further enhance our design. In summary, our main contributions include:• We propose a novel facial privacy protection approach using Global Adversarial Latent Search to construct natural and highly transferable adversarial face images without extra guidance information. • We reveal the limitations of W + latent space and the intriguing properties of the other two prevalent latent spaces W and F under the facial privacy protection scenario.• Extensive experiments on both face verification and identification tasks demonstrate the superiority of our approach against various deep FR models and commercial APIs. Notably, we achieved a significant improvement of 25% than existing schemes in terms of transferability. 
related work and background 2.1 facial privacy protection: 
 Recently, many works have been proposed to protect facial privacy against unauthorized FR systems [29, 42, 43] . The typical strategy involves the utilization of noise-based adversarial examples [29, 49, [57] [58] [59] [60] , where carefully crafted perturbations are added to face images to deceive malicious FR models. Oh et al. [29] proposed crafting protected face images from a game theory perspective in the white-box setting, which is impractical in real-world scenarios. Thus TIP-IM [49] introduced the idea of generating adversarial identity masks in the black-box setting. However, the perturbations are usually perceptible to humans and affect the user experience.Another strategy is to leverage unrestricted adversarial examples [4, 18, 37, 48, 52, 56] , which are not constrained by the perturbation norm in the pixel space and enjoy a better image quality [4, 37, 48] . Among these, makeup-based unrestricted adversarial examples are presented against unknown FR systems by concealing adversarial perturbations within natural makeup characteristics. Zhu et al. [61] made the first effort to utilize makeup to generate protected face images in the white-box setting. Afterwards, Adv-Makeup [50] synthesized imperceptible eye shadow over the orbital region on the face, which has limited transferability. AMT-GAN [15] generated adversarial face images with makeup transferred from reference images in a black-box manner, which has a higher attack success rate but suffers from obvious artifacts due to the conflict between the makeup transfer module and the adversarial noises. Recently, CLIP2Protect [35] traversed over the local latent space that controls the makeup style of a pre-trained generative model by using text prompts. However, all the above methods rely on guidance (e.g., text or image references) to make the adversarial noises distributed in a natural way. This is a disappointing constraint in real-world applications as the users usually have no desired target references. More importantly, the visual quality of output face images is largely affected by the references, as detailedly discussed in Section 3.2. DiffProtect [26] and Adv-Diffusion [24] employ the diffusion models [53] as the generative models and iteratively refine the latent representations of facial images, although yielding higher-quality adversarial facial images, exhibit limited attack transferability, rendering it impractical for real-world applications.GAN inversion [1, 19, 39, 41, 47] intends to invert a given face image back to a low-dimensional manifold which is expressed as a latent space of a pre-trained GAN model, such that the image can be faithfully reconstructed. As the StyleGAN [22] models trained on a high-resolution face image dataset [21] exhibit exceptional image synthesis capabilities, various GAN inversion methods have been developed using different latent spaces based on StyleGANs. Generally, there are three typical latent spaces (i.e., W [1] , W + [39] , and F [19] ). They are the trade-off design between the reconstruction quality and editability [25] . W uses a mapping network to disentangle different features with a high degree of editability. However, it has limited expressiveness which restricts the range of images that can be faithfully reconstructed. Meanwhile, W + feeds different intermediate latent vectors into each layer of the generator via AdaIN [17] , alleviating the image distortion at the expense of editability. The latent space F consists of specific features which enjoy the highest reconstruction quality but suffer from the worst editability. 
methodology 3.1 problem definition: 
 In general, FR systems can operate with two modes: face verification and face identification. For verification, the FR systems identify whether two face images correspond to the same identity. For identification, the FR systems query the face database to identify whose representation is closest to the input image. In this paper, we consider both scenarios to sufficiently demonstrate the effectiveness of our approach. As seen in Fig. 1 , if the user's source face image 𝒙 𝑠 is directly posted to social media platforms, malicious FR systems could potentially trace the relationships and activities of the user by analysing the publicly available images.With the help of facial privacy protection algorithms, users can obtain the protected face image 𝒙 𝑝 that appears indistinguishable to human (i.e., naturalness) but can deceive the FR systems (i.e., transferablility). For the malicious FR systems, 𝒙 𝑝 has the same identity as the target impersonated image 𝒙 𝑡 in both face verification and face identification. Generally, the problem can be formulated as: EQUATIONwhere D ( Existing works [15, 35] have experimentally demonstrated that the guidance of the reference image or text prompts plays an important role in maintaining the visual quality of adversarial face images during the process of generation. Without using guidance, the adversarial perturbations will be randomly generated and spread all over the face without any constraints, leading to obvious artifacts in the result images. If we simply fix the adversarial area, the noises may make the modified area extremely strange and distorted. Therefore, existing works have to use extra information to guide the distribution of adversarial noises such that they can harmonize with facial characteristics. Moreover, even with makeup information guidance, due to the incomplete disentanglement of facial attributes, the adversarial modifications concentrating on one kind of local semantics struggle to integrate seamlessly with other facial semantic information. As shown in Fig. 7 , the visual quality can still be damaged in guidancebased schemes, especially when the reference is not appropriately chosen. Note that although CLIP2Protect [35] maintains the face quality well in some cases, the background behind the face has been significantly damaged. It should be emphasized that the image's visual quality should contain not only the facial information but also the background.Besides, these methods excessively focus on local attributes, leading to minor effects on facial identity characteristics. This limitation results in limited transferability and renders them less practical for real-world applications.To address the aforementioned issues, we propose directly manipulating the entire facial space to harmoniously integrate adversarial noises, rather than solely using one kind of facial characteristic to guide the distribution of noises. In this way, all of the facial information will be adaptively assembled, including makeup characteristics, expressions, and face shape, as well as adversarial noises. In addition, by comprehensively optimizing every feature rather than excessively optimizing a particular attribute, the transferability of generated adversarial facial images is significantly improved. To this end, we first have the following observations. Observation I: Global adversarial latent search exhibits enhanced transferability. In order to maintain the naturalness of the face images 𝒙 𝑝 , CLIP2Protect [35] only optimizes the latent codes corresponding to the deep layers of StyleGAN that is associated with the makeup style. This method is essentially a kind of Local Adversarial Latent Search (LALS). Meanwhile, numerous studies [3, 23] have affirmed that the initial layers of StyleGAN control more face image attributes, such as pose, hairstyle, and face shape. Therefore, we speculate that optimizing both the deep layers and initial layers of latent codes, a.k.a, Global Adversarial Latent Search (GALS), is more beneficial to enhance the adversarial transferability, as they can control more semantic information.Fig. 6 provides a visualization example to illustrate this observation. Specifically, LALS only focuses on optimizing local single attributes, such as makeup-related features, potentially disturbing adjacent attribute distributions or those that are not incompletely decoupled, which might impact the visual effect. Moreover, the modification of one single attribute is limited, resulting in relatively smaller repercussions on the overall facial identity features compared to GALS. Conversely, GALS harmoniously refines the entire facial characteristics to sophisticatedly guide the distribution of noises along the adversarial direction in the low-dimensional manifold [6] represented as the latent space. We perform experiments to validate this observation, as shown in Fig. 2 , and find that GALS has a higher protection success rate compared to LALS in the black-box setting, indicating far better transferability than GALS.Observation II: Key landmark regularization helps ensure visual identity. Due to the absence of guidance information, our approach may result in changes of visual identity during the process of global optimization. Therefore, there is a need for a new regularization method to maintain visual identity. Intuitively, leveraging the traditional MSE is promising for aligning the protected image 𝒙 𝑝 with the source image 𝒙 𝑠 . Nevertheless, pixel-level regularization may lead to the emergence of artifacts in the face image and a reduction of adversarial effectiveness. Inspired by [26] , we introduce a method called key landmark regularization (KLR) due to their capability to achieve region-level regularization, which aligns two semantic segmentation maps of the protected image 𝒙 𝑝 and the source image 𝒙 𝑠 in the optimization process. This method ensures consistency in the distribution of facial characteristics and the overall face shape between 𝒙 𝑠 and 𝒙 𝑝 . Observation III: F latent space benefits the trade-off between visual naturalness and adversarial transferability. It is critical for a GAN inversion method to choose a good latent space that can reconstruct the face images faithfully and facilitate downstream tasks. Unfortunately, the latent space W + widely used in the existing facial privacy protection schemes has poor reconstruction quality [25] . In light of this, we explore the performance of the other two typical latent spaces, W and F . As shown in Fig. 3 and Fig. 4 , the latent space F not only exhibits the best image quality but also demonstrates strong black-box attack success rate in the black-box setting, achieving the optimal trade-off between naturalness and high adversarial transferability.Drawing inspiration from the above analysis, we propose a brandnew generative framework (GIFT) to generate guidance-independent adversarial facial images with transferability for facial privacy protection. The pipeline of our approach is depicted in Fig. 5 . We first employ GAN inversion to initialize the latent code that can faithfully reconstruct the source face image in F rather than W + [35] latent space. Then, we conduct the global adversarial latent search, which takes the protected image and the target image as inputs to adversarially optimize the latent code of the protected face image. Furthermore, we introduce a key landmark regularization to preserve the visual identity of the protected image.Latent Code Initialization: The latent code is initialized based on GAN inversion. Given a source image 𝒙 𝑠 and pre-trained encoder 𝐸 𝑏 from [19] , we first calculate the initial latent code 𝒘 𝑖𝑛𝑖 = 𝐸 𝑏 (𝒙 𝑠 ) in the F latent space. Then we optimize the latent code 𝒘 𝑖𝑛𝑖 by a reconstruction loss, which is defined as:L 𝑟𝑒𝑐 𝒘 𝑖𝑛𝑖 =L 𝑚𝑠𝑒 𝒘 𝑖𝑛𝑖 + 𝛼 L 𝑝𝑒𝑟 𝒘 𝑖𝑛𝑖 = 𝒙 𝑠 -𝐺 𝒘 𝑖𝑛𝑖 2 +𝛼 𝐹 (𝒙 𝑠 ) -𝐹 𝐺 𝒘 𝑖𝑛𝑖 2 (2)where 𝐺 refers to the pre-trained generative model, L 𝑚𝑠𝑒 and L per denote mean-squared-error (MSE) and perceptual loss, respectively. 𝛼 is the weight assigned to L 𝑝𝑒𝑟 . 𝐹 (•) represents an LPIPS [55] network used to compute the perceptual distance. As a result, we obtain the initialized latent code 𝒘 𝑓 , which can faithfully reconstruct 𝒙 𝑠 by 𝐺.Global Adversarial Latent Search: We utilize an ensemble training strategy with input diversity to search for a good adversarial optimization direction similar to [15] . We select 𝑁 pre-trained FR models {𝑓 𝑛 (•)} 𝑁 𝑛=1 which exhibit high accuracy in the public facial datasets, serving as white-box models to imitate the decision boundaries of potential target models in the black-box setting during performing global optimization. The adversarial loss is:EQUATIONwhereD (𝒙 1 , 𝒙 2 ) = 1 -cos (𝒙 1 , 𝒙 2 ) is the cosine distance, 𝑓 𝑛 (•)represents the 𝑛-th local pre-trained white-box model which maps an input face image to a feature representation. 𝑇 (•) represents the transformation function including image resizing and Gaussian noising, and 𝑝 is a predefined probability that determines whether the transformation will be applied to 𝐺 𝒘 𝑓 . Key Landmark Regularization: We first leverage a pre-trained semantic encoder from [51] to obtain the face semantic segmentation maps 𝑠𝑒𝑚 𝑠 and 𝑠𝑒𝑚 𝑝 for the source and protected image. We then take advantage of the semantic segmentation maps to regularize the optimization process, ensuring that the protected image preserves visual identity for humans. The regularization loss is defined as:EQUATIONwhere L 𝐶𝐸 (•) is the cross-entropy loss, M (•) represents the pretrained semantic encoder. The total loss is:EQUATION)where 𝜆 adv and 𝜆 sem represent the hyper-parameters. The whole optimization process is outlined in Algorithm. 1. 
experiments 4.1 experiments setup: 
 Implementation Details: We employ StyleGAN2 pre-trained on FFHQ [21] as our generative model and use the Adam optimizer in all experiments. For Latent Code Initialization, we iteratively optimize the latent code for 1200 steps with a learning rate of 0.01. During the adversarial optimization process, we traverse over the global latent space for 50 iterations with a learning rate of 0.002 to generate protected face images. We set the hyper-parameters 𝛼, 𝜆 adv and 𝜆 sem to 10, 1, 0.01, respectively. Datasets: We perform experiments for both face verification and identification tasks. Face Verification: We utilize CelebA-HQ [20] and LADN [11] as our test set. Specifically, for CelebA-HQ, we select a subset which contains 1000 images with different identities. For LADN, we divide the 332 images into 4 groups, with each group of images impersonating a target identity provided by [15] . Face Identification: we randomly select 500 images of 500 different identities in CelebA-HQ as the probe set, and the corresponding 500 images of the same identities along with the target image 𝒙 𝑝 to form the gallery set. Target Models: Following [15] , we choose various deep FR models and commercial FR APIs to evaluate the transferability of the adversarial facial images generated by GIFT in the black-box settings. Specifically, the deep FR models include MobileFace [5] , IR152 [7] , IRSE50 [14] , and FaceNet [33] and commercial FR APIs include Face++, Aliyun, and Tencent.Competitors: We compare GIFT with recent noise-based and makeup-based facial privacy protection approaches. Noised-based methods include PGD [27] , MI-FGSM [8] , TI-DIM [9] , and TIP-IM [49] . Makeup-based approaches include Adv-Makeup [50] , AMT-GAN [15] and CLIP2Protect [35] . Among these methods, TIP-IM and CLIP2Protect are regarded as the state-of-the-art (SOTA) approaches against black-box FR systems in noise-based and unrestricted settings, respectively. Notably, TIP-IM employs a multitarget objective within its optimization to discover the best image from multiple targets. To maintain fairness in the comparison, we employ a single-target variant.Evaluation Metrics: We employ different evaluation strategies to calculate the protection success rate (PSR) for the verification and identification scenarios. For verification, we identify that two face images belong to the same identity if D 𝒙 𝑝 , 𝒙 𝑠 ≥ 𝜏 and then calculate the proportion of successfully protected images in relation to all images. For identification, we report the Rank-N targeted identity success rate, which means that at least one of the top N images belongs to the target identity after ranking the distance for all images in the gallery to the given probe image. For commercial FR APIs, we directly record the confidence scores returned by FR servers. We also leverage FID [12] , PSNR (dB) and SSIM [45] to evaluate the image quality. The FID quantifies the dissimilarity between two data distributions [54] , commonly employed to assess the extent to which a generated dataset resembles one obtained from the real world. PSNR and SSIM are commonly utilized techniques for assessing the difference between two images.Evaluation on Black-box FR Models. We present experimental results of GIFT in the black-box settings on four different pretrained FR models on two public datasets under face verification and identification tasks. For face verification, we set the system threshold value at 0.01 false match rate for each FR model i.e., IRSE50 The results show that GIFT has the capability to achieve an average absolute gain of about 25% and 39% over SOTA unrestricted and noise-based facial privacy protection methods, respectively. We also provide PSR under the face identification scenario in Tab. 2. Consistently, GIFT outperforms recent methods in both Rank-1 and Rank-5 settings. Given that AMT-GAN and Adv-Makeup were initially trained for impersonating the target identity in the verification task, they have not been incorporated into Tab. 2.Evaluation on Image Quality. Tab. 3 shows the quantitative evaluations on image quality. Notably, we report the results that are averaged over 10 text prompts for CLIP2Protect. Although Adv-Makeup [50] achieves the lowest FID score, its transferability is limited due to perturbing only the eye region. Beyond Adv-Makeup, GIFT yields better FID results with the highest transferability, indicating that the adversarial face images generated by GIFT are more natural.In addition, we give a qualitative comparison of visual image quality in Fig. 7 with noise-based method TIP-IM and makeupbased unrestricted methods AMT-GAN and CLIP2Protect. TIP-IM's adversarial face images contain noticeable noise that can be easily perceived by humans. The makeup generated by AMT-GAN sometimes does not align well with the facial characteristics, resulting in artifacts on the face images. The adversarial face images generated by CLIP2Protect have an obvious "painted-on" appearance, especially when viewed at high resolution. In contrast, GIFT produces adversarial face images that look natural and effectively preserve the background content, making it applicable in practical scenarios.Evaluation on Commercial APIs. We further demonstrate the effectiveness of GIFT on commercial APIs (i.e., Face++, Aliyun, and Tencent) in face verification mode. The output of these APIs is a confidence score on a scale of 0 to 100, serving as a metric for the similarity between two images. A higher score signifies a greater degree of similarity. The training data and model parameters of these commercial APIs are undisclosed, effectively simulating scenarios in real-world face privacy protection. We present the average confidence scores for 1000 images from the CelebA-HQ dataset in Fig. 8 , demonstrating the superiority of GIFT over other competitors.In this section, we employ Grad-CAM [34] to explore why the adversarial face images generated by GIFT exhibit better transferability. We present gradient visualizations of adversarial face images generated by AMT-GAN, CLIP2Protect, and GIFT in the black-box setting compared to the target images in Fig. 9 . We can observe that the gradient responses of AMT-GAN and CLIP2Protect either concentrate on specific facial regions or focus on the background of the face image. In contrast, the gradient responses of GIFT are concentrated on the facial region, without being limited to local features, but rather covering the entire face. Therefore, the adversarial face images generated by GIFT exhibit superior performance, both on deep FR models and commercial FR APIs.The Effect of KLR: We investigate the effect of key landmark regularization on GIFT. As shown in Fig. 11 , with the absence of KLR, the visual identity of the protected face image will change.The Effect of GALS: We analyze the effect of GALS on GIFT. As depicted in Fig. 10 , compared to LALS, which only adversarially modifies the makeup style, GALS exhibits significantly better transferability.The Effect of Latent Space: We study the effect of different latent spaces on GIFT. Both Fig. 12 and Tab. 4 indicate that, although W latent space results in better adversarial transferability, the generated adversarial face images exhibit poor image quality. In contrast, F latent space maintains high transferability while achieving the best image quality. 
conclusion: 
 In this paper, focusing on protecting facial privacy against malicious FR systems, we propose GIFT, a guidance-independent generative framework to construct highly transferable adversarial facial images while maintain good visual effect. Specifically, we leverage Global Adversarial Latent Search to construct natural and highly transferable adversarial face images without extra guidance information. We further reveal the limitations of W + latent space and the intriguing properties of the other two prevalent latent spaces W and F under the facial privacy protection scenario. Extensive experiments on both face verification and identification tasks demonstrate the superiority of GIFT against various deep FR models and commercial FR APIs. 
 
 Appendix:  


Decision: This paper introduces a new face privacy protection scheme that improves the transferability of adversarial face images while preserving high visual quality. The idea is intriguing and the writing in the paper is clear. The proposed method, GIFT, demonstrates its effectiveness by achieving a 25% improvement in deep face recognition and a 10% improvement in commercial APIs. After carefully reviewing the paper and taking into account the feedback from reviewers, I recommend accepting this paper. It has the potential to provide valuable insights to the face privacy protection community. I encourage the authors to refine their work based on suggestions from all reviewers to create an even stronger version of their research.

Reviews: review: paper_summary: paper_summary: This paper presents a privacy protection method based on adversarial facial images. The authors thoroughly explore the impact of different latent spaces on protection success rates, including global/local latent spaces, $F/W/W^+$ latent spaces, ultimately achieving a significant improvement in protection success rates compared to existing methods. Additionally, the authors propose a key landmark regularization method that effectively maintains image quality.
strength_weakness: strength_weakness: The proposed method significantly surpasses existing work in terms of protection success rate, while also maintaining high image quality.
limitations: limitations: 1. The novelty is limited. The authors propose two contributions to improve the protection success rate: using the $F$ latent space instead of the $W^+$ latent space, and additionally optimizing the initial layers of StyleGAN. Clearly, both of these contributions are very incremental, resembling the adjustment of two hyperparameters on existing work.
2. There is no comparison of the runtime efficiency of different algorithms. Section 4.1 shows that 1200 iterations are required for the latent code initialization step, which seems to account for the majority of the total runtime of the proposed method. How many iterations do other methods require?
3. The results of the ablation study are not fully reported. For the role of KLR, the authors show the image quality with and without KLR, but do not report the protection success rate. For GALS, the authors report the protection success rates of GALS and LALS, but do not report the FID.
4. Many hyperparameters lack the corresponding ablation study, including $\alpha, \lambda_{adv}, \lambda_{sem}$.
5. The organization of the paper is unreasonable. Figures 3 and 4 have already shown the effects of different latent spaces, which makes Figure 12 in Section 4.4 have no new informational value.
6. Section 4.1 mentions that more details is in the supplementary material, but I couldn't find it.
paper_summary: paper_summary: This paper presents GIFT, a novel face privacy protection scheme that enhances the transferability of adversarial face images while maintaining high visual quality. Unlike previous methods that require user-chosen references, GIFT utilizes Global Adversarial Latent Search (GALS) to directly traverse the latent space of generative models, generating natural adversarial images. A key landmark regularization module is introduced to preserve visual identity. Extensive experiments show that GIFT outperforms existing methods by 25% in deep face recognition models and 10% on commercial APIs, demonstrating superior attack transferability and visual fidelity.
strength_weakness: strength_weakness: 1. The proposed method exhibits enhanced transferability which achieves 25% improvement in deep face recognition and 10% in commercial APIs, ensuring more effective adversarial images.
2. GIFT maintains natural and high-fidelity adversarial images, preserving original facial identity and suitable for real-world applications.
3. Require no extra guidance information, making it more user-friendly and practical for generating adversarial images.
4. Insightful observations are presented.
limitations: limitations: 1. The proposed framework is kind of interesting but not novel enough.
2. The framework figure in the paper is simple and lacks a detailed caption.
3. The ablation about $\lambda_{adv}$ and $\lambda_{sem}$ is absent.
paper_summary: paper_summary: The paper proposes to use adversarial perturbation to protect facial privacy by mislead the commercial face recognition systems to mis-identify their ids.
strength_weakness: strength_weakness: The ASR rate is higher than quite a few benchmark approaches.
limitations: limitations: The main performance lift is driven by the global adversarial search. However, it is unclear how many white-box models are used to designed the adversarial loss. In addition, there lacks an ablation study to show how the performance varies when different models are used. 
Figure 11 is strange since it is difficult to understand why the shape regularizer can help to generate the beard. 
Figure 6 is less useful which can only introduce confusion to the main idea.
It is also better to clarify whether the encoder is fixed or can be fine-tuned.
Overall, the approach achieves good results but contribution is incremental.