Unlearnable Faces: Privacy Protection Surviving Extraction Pipeline

2026-07-07

AI Summary

This work addresses the vulnerability of publicly shared facial images to unauthorized use by face recognition models, a risk exacerbated by the failure of existing protection methods under common image processing operations such as cropping and resizing. To overcome this limitation, the authors propose LPID, a method that injects imperceptible perturbations into images prior to sharing. By modeling the face extraction pipeline as a differentiable module and concentrating perturbation energy within frequency bands preserved during typical extraction procedures, LPID significantly enhances both robustness and generalization of the defense. Experimental results demonstrate that the approach suppresses attacker recognition accuracy to below 10% across diverse attack scenarios while maintaining high visual fidelity, achieving a PSNR of 32.7 dB and an LPIPS score of 0.161.

Abstract

Unlearnable examples keep publicly shared photos from being learned by unauthorized face-recognition models. An imperceptible perturbation, added before sharing, makes any model trained on the protected photos fail on clean faces. The perturbation is crafted on the shared image, however the attacker trains on the face it extracts, cropped and resized to the recognizer input, and under this extraction the protection collapses. We propose LPID, which builds the extraction into the unlearnable-example objective. LPID confines the perturbation to the extracted face region and optimizes it through a differentiable model of the extraction, concentrating its energy in the frequency band the extraction preserves. Because this robustness is a property of the transform rather than of any identity, LPID is re-optimized per album and protects even users it has never seen. LPID attains the lowest attacker accuracy of all methods in every setting we evaluate, holding the attacker below $10\%$ under crop+resize extraction on identities unseen at protection time, while remaining imperceptible at $32.7$\,dB PSNR and $0.161$ LPIPS.

Problem

• unlearnable examples
• privacy protection
• face recognition
• extraction pipeline
• imperceptible perturbation

Innovation

• unlearnable examples
• privacy-preserving perturbation
• differentiable extraction pipeline
• frequency-aware optimization
• face recognition robustness