DIP-Watermark: A Double Identity Protection Method Based on Robust Adversarial Watermark
This addresses privacy protection for individuals using FR systems, offering a novel approach to prevent identity impersonation, though it appears incremental as it builds on existing adversarial attack and watermarking techniques.
The paper tackles the privacy risks in Face Recognition (FR) systems by proposing DIP-Watermark, a method that uses adversarial watermarking to deceive unauthorized FR models while allowing trusted authorizers to verify identity via watermark extraction, achieving significant attack success rates and traceability accuracy on state-of-the-art FR models.
The wide deployment of Face Recognition (FR) systems poses privacy risks. One countermeasure is adversarial attack, deceiving unauthorized malicious FR, but it also disrupts regular identity verification of trusted authorizers, exacerbating the potential threat of identity impersonation. To address this, we propose the first double identity protection scheme based on traceable adversarial watermarking, termed DIP-Watermark. DIP-Watermark employs a one-time watermark embedding to deceive unauthorized FR models and allows authorizers to perform identity verification by extracting the watermark. Specifically, we propose an information-guided adversarial attack against FR models. The encoder embeds an identity-specific watermark into the deep feature space of the carrier, guiding recognizable features of the image to deviate from the source identity. We further adopt a collaborative meta-optimization strategy compatible with sub-tasks, which regularizes the joint optimization direction of the encoder and decoder. This strategy enhances the representation of universal carrier features, mitigating multi-objective optimization conflicts in watermarking. Experiments confirm that DIP-Watermark achieves significant attack success rates and traceability accuracy on state-of-the-art FR models, exhibiting remarkable robustness that outperforms the existing privacy protection methods using adversarial attacks and deep watermarking, or simple combinations of the two. Our work potentially opens up new insights into proactive protection for FR privacy.