Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fawkes: Image “Cloaking” for Personal Privacy

sandlab.cs.uchicago.edu

Post reply on HN
Print view View original

31–40 of 122 posts

Re: Fawkes: Image “Cloaking” for Personal Privacy

#31

Post by lallysingh »

ricksharp wrote: post #26

This might work today, but it won’t work tomorrow. This is just one side of a GAN, on the next iteration, it will be defeated. Bottom line is that if a human can recognize, then it is possible for a machine as well. Also, given that the big networks can just keep throwing more resources at it (I.e. GPT-3), it’s just a matter of increasing the network size to improve feature redundancy.

More accurately, if a human can accurately label inputs and measure outputs, it's possible for a machine. The human eye isn't the peak, just our current standard.

Re: Fawkes: Image “Cloaking” for Personal Privacy

#32

Post by gruez »

turdnagel wrote: post #27
keehun wrote: post #3

I was immediately was curious how it would protect against image compression and/or otherwise de-noising these protection pixel changes. Their paper does address this question, and for those that are interested: Even image compression cannot defeat our cloak. We use progressive JPEG [57], reportedly used by Facebook and Twitter, to compress the images in our dataset. The image quality, as standard by Independent JPEG…

How about a 1px Gaussian blur? Haven't read the paper but I had the same thought. Seems way too tenuous.

from the paper:

> However,we find that none of these transformations defeat our cloaks. The protection success rate remains 100% even when data augmentation is applied to cloaked images5. Ap-plying Gaussian blurring degrades normal accuracy by up to18% (as kernel size increases) while cloak protection success rate remains>98% (see Figure13). Adding Gaussian noise to images merely disrupts normal classification accuracy –the cloak protection success rate remains above 100% as the standard deviation of the noise distribution increases(seeFigure14). Even image compression cannot defeat our cloak.We use progressive JPEG [57], reportedly used by Facebookand Twitter, to compress the images in our dataset. The im-age quality, as standard by Independent JPEG Group [1],ranges from 5 to 95 (lower value = higher compression). As shown in Figure15, image compression decreases the pro-tection success rate, but more significantly degrades normal classification accuracy.

Re: Fawkes: Image “Cloaking” for Personal Privacy

#33

Post by hiimtroymclure »

lallysingh wrote: post #31
ricksharp wrote: post #26

This might work today, but it won’t work tomorrow. This is just one side of a GAN, on the next iteration, it will be defeated. Bottom line is that if a human can recognize, then it is possible for a machine as well. Also, given that the big networks can just keep throwing more resources at it (I.e. GPT-3), it’s just a matter of increasing the network size to improve feature redundancy.

More accurately, if a human can accurately label inputs and measure outputs, it's possible for a machine. The human eye isn't the peak, just our current standard.

its not the eye thats doing the recognition. The human brain is still more impressive than any machine

Re: Fawkes: Image “Cloaking” for Personal Privacy

#34

Post by MattGrommes »

I had a similar idea for a system to add noise to videos to prevent them from being flagged by state censorship systems. Keeping videos of abuse from being deleted from public view in cases like the Great Firewall, for example. I don't have the expertise for implementation yet but I'm glad steps are being made in this direction.

Re: Fawkes: Image “Cloaking” for Personal Privacy

#37

Post by calvinmorrison »

akersten wrote: post #8

Color me extremely skeptical. A low-pass filter will make short work of any "tiny, pixel-level" changes designed to thwart ML. After all, one of the most tell-tale identifiers (space between eyes/nose/mouth) is still plainly observable and unaltered in the "cloaked" image. If a human's neural network can correctly correlate the before/after examples, so can a computer's. They might have found an issue with some moder…

Or more simply, what if you just take a real life photo of the image and scan it back in and use the same classification techniques?

Re: Fawkes: Image “Cloaking” for Personal Privacy

#39

Post by zitterbewegung »

ricksharp wrote: post #26

This might work today, but it won’t work tomorrow. This is just one side of a GAN, on the next iteration, it will be defeated. Bottom line is that if a human can recognize, then it is possible for a machine as well. Also, given that the big networks can just keep throwing more resources at it (I.e. GPT-3), it’s just a matter of increasing the network size to improve feature redundancy.

I agree that it won't work tomorrow. To have a system that would continually work you would need to get access to an API that performs facial recognition and then continuously have the system perform queries on that system that would monitor that the facial recognition would fail.

Re: Fawkes: Image “Cloaking” for Personal Privacy

#40

Post by zelivans »

Unfortunately these days it is really difficult, borderline impossible to control what images of you are uploaded to the internet. This is discussed in the "Real World Limitations" section of the paper. Even assuming you have no identifying photos online, non-public photos are still analyzed by big companies like Google, Facebook, and Apple, who have access to them through their cloud services (e.g. photos you, your friends or family sync with Google Photos, Apple Cloud). Having just one image correlate to your identification details and you lose anonymity.
Post reply on HN