Do Protective Perturbations Really Protect Portrait Privacy under Real-world Image Transformations?

2026-04-26

AI Summary

This study addresses the unclear robustness of existing pixel-level active defense methods under realistic image transformations such as scaling and compression. The authors systematically evaluate the vulnerability of multiple mainstream defense approaches—including those based on diffusion models and GANs—across diverse device-induced image transformations, revealing for the first time that their protective perturbations are easily disrupted by common image processing operations. Building on this insight, they propose a lightweight perturbation purification framework that exploits transformation-induced vulnerabilities to efficiently remove such perturbations. Experimental results demonstrate that the method significantly degrades the effectiveness of current defenses at minimal computational cost, thereby exposing substantial privacy leakage risks in real-world deployment scenarios.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Natural Language Processing: Safety and Robustness

Application Category

• Security and Privacy: Large-scale security measurements
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Responsible Web: Data and user privacy-enhancing technologies for the Web

Abstract

Proactive defense methods protect portrait images from unauthorized editing or talking face generation (TFG) by introducing pixel-level protective perturbations, and have already attracted increasing attention for privacy protection. In real-world scenarios, images inevitably undergo various transformations during cross-device display and dissemination--such as scale transformations and color compression--that directly alter pixel values. However, it remains unclear whether such pixel-level modifications affect the effectiveness of existing proactive defense methods that rely on pixel-level perturbations. To solve this problem, we conduct a systematic evaluation of representative proactive defenses under image transformation. The evaluated methods are selected to span different generation architectures such as diffusion and GAN-based models, as well as defense scopes covering both portrait and natural images, and are assessed using both qualitative and quantitative metrics for subjective and objective comparison. Experimental results indicate that defense methods based on pixel-level perturbations struggle to withstand common image transformations, posing a risk of defense failure in real-world applications. To further highlight this risk, we propose a simple yet effective purification framework by leveraging the vulnerabilities induced by real-world image transformations. Experimental results demonstrate that the proposed method can efficiently remove protective perturbations with low computational cost, highlighting previously overlooked risks to the research community.

Problem

• protective perturbations
• portrait privacy
• image transformations
• proactive defense
• privacy protection

Innovation

• protective perturbations
• image transformations
• proactive defense
• privacy protection
• purification framework