TAFIM: Targeted Adversarial Attacks against Facial Image Manipulations
This addresses privacy and disinformation issues by protecting facial images against misuse, though it is incremental as it builds on adversarial attack techniques.
The paper tackles the problem of preventing facial image manipulation by introducing a data-driven method that embeds image-specific perturbations to cause manipulation models to output a predefined target instead of the intended manipulation, achieving robustness to compression and fast inference with a single forward pass.
Face manipulation methods can be misused to affect an individual's privacy or to spread disinformation. To this end, we introduce a novel data-driven approach that produces image-specific perturbations which are embedded in the original images. The key idea is that these protected images prevent face manipulation by causing the manipulation model to produce a predefined manipulation target (uniformly colored output image in our case) instead of the actual manipulation. In addition, we propose to leverage differentiable compression approximation, hence making generated perturbations robust to common image compression. In order to prevent against multiple manipulation methods simultaneously, we further propose a novel attention-based fusion of manipulation-specific perturbations. Compared to traditional adversarial attacks that optimize noise patterns for each image individually, our generalized model only needs a single forward pass, thus running orders of magnitude faster and allowing for easy integration in image processing stacks, even on resource-constrained devices like smartphones.