Protego: User-Centric Pose-Invariant Privacy Protection Against Face Recognition-Induced Digital Footprint Exposure

2025-08-04

AI Summary

To mitigate privacy risks in large-scale face recognition systems—where users’ digital footprints (e.g., social posts, private images) are retrieved and linked without consent—this paper proposes a user-centric, pose-invariant 3D mask generation method. Our approach models identity via 3D facial signatures, applies pose-adaptive deformation, and incorporates dynamic masking to produce natural-looking 2D obfuscated representations. A black-box adversarial mechanism is integrated to enhance robustness, ensuring cross-pose visual consistency and temporal coherence in video sequences. Experiments across multiple black-box face recognition (FR) models demonstrate substantial reductions in retrieval accuracy; our method outperforms state-of-the-art approaches by over 2× in defense efficacy while preserving high visual fidelity and cross-modal consistency.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Multiagent Systems: Adversarial Agents

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Large-scale security measurements
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Face recognition (FR) technologies are increasingly used to power large-scale image retrieval systems, raising serious privacy concerns. Services like Clearview AI and PimEyes allow anyone to upload a facial photo and retrieve a large amount of online content associated with that person. This not only enables identity inference but also exposes their digital footprint, such as social media activity, private photos, and news reports, often without their consent. In response to this emerging threat, we propose Protego, a user-centric privacy protection method that safeguards facial images from such retrieval-based privacy intrusions. Protego encapsulates a user's 3D facial signatures into a pose-invariant 2D representation, which is dynamically deformed into a natural-looking 3D mask tailored to the pose and expression of any facial image of the user, and applied prior to online sharing. Motivated by a critical limitation of existing methods, Protego amplifies the sensitivity of FR models so that protected images cannot be matched even among themselves. Experiments show that Protego significantly reduces retrieval accuracy across a wide range of black-box FR models and performs at least 2x better than existing methods. It also offers unprecedented visual coherence, particularly in video settings where consistency and natural appearance are essential. Overall, Protego contributes to the fight against the misuse of FR for mass surveillance and unsolicited identity tracing.

Problem

• Protects facial images from retrieval-based privacy intrusions
• Encapsulates 3D facial signatures into pose-invariant 2D representations
• Reduces retrieval accuracy across black-box face recognition models

Innovation

• 3D facial signatures into 2D representation
• Dynamic 3D mask deformation for privacy
• Amplifies FR sensitivity to prevent matching