Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fawkes: Image “Cloaking” for Personal Privacy

sandlab.cs.uchicago.edu

Post reply on HN
Print view View original

101–110 of 122 posts

Re: Fawkes: Image “Cloaking” for Personal Privacy

#101

Post by annoyingnoob »

cookiecaper wrote: post #75
annoyingnoob wrote: post #58

What we really need is Fawkes face paint. A little makeup/lotion that you apply to the face. It would apply random cloaking directly to your skin. This way the cloaking is automatic and applies to images that are not under your control. I can be as careful as I want to be with my own media. That doesn't stop my wife from uploading the family photo to Facebook or a public camera capturing my image.

> What we really need is Fawkes face paint. Check out https://cvdazzle.com (archive link, because honestly I'm surprised the site is still up: http://archive.is/v39xI )

I was thinking something more subtle.

This looks creepy but effective: http://www.urmesurveillance.com/urme-prosthetic

Re: Fawkes: Image “Cloaking” for Personal Privacy

#102

Post by mindfulhack »

lykahb wrote: post #30

Once this technique gets enough attention, a detector for it will be built. Even if the face cannot be recognized, a profile with such picture may be flagged for more scrutiny. This reminds me of using TOR that hides what you visit, and yet likely puts you into a watchlist for surveillance. I think that a simpler and more robust strategy to achieve good privacy is avoid posting personal information online and social…

What you're saying points out that there are larger problems of government policy and capitalistic abuse that this software cannot solve.

However, simply not going on the Internet does not solve the problem people care about. People's desired solution is to use the Internet in a personal way and be safe - not just to be safe.

Re: Fawkes: Image “Cloaking” for Personal Privacy

#103

Post by cookiecaper »

akersten wrote: post #97
Bjartr wrote: post #93

Earlier quoted context omitted.

There's also a chance Google image search is looking at the filename of the image to get a bit more context. Does the reverse image search of the cloaked image still work if you rename it something unrelated?

Fair shake, this time I cropped the image too so that it wasn't looking at any of the boundary to identify it either. Here's the original image: https://imgur.com/a/Td4rhoy And the cloaked: https://imgur.com/a/cPCiCZo These were both saved as JPG with compression level 8/12. I searched for the cloaked crop (96.jpg) first this time: https://imgur.com/a/FSehQWO And the original crop (10.jpg) next: https://imgur.com/a/y…

The goal, afaik, is to stop facial detection software from learning to recognize you and put a face to a name, not to frustrate visual similarity searches. The images are supposed to be visually similar -- so similar that they're indistinguishable to a human viewer.

Surveillance software that purports to accurately identify a person across multiple images is not just looking for the same content with some visually insignificant modifications. It's reading your facial structure, attaching your name to it, and searching for it in every image received. Fawkes is working to defeat that specific use case, not all fuzzy matchers in general.

P.S. If you have a human assailant running a reverse image search for photos of you, I think you're well past the point that something like this could be expected to help.

Re: Fawkes: Image “Cloaking” for Personal Privacy

#104

Post by cetra3 »

angry_octet wrote: post #92
cetra3 wrote: post #81

I've tried this with facenet and it still detects the correct faces I tried without much issue: https://github.com/davidsandberg/facenet/

How many faces were in the database you tested with? Face re-ID is much simpler for a small cohort.

I was using the pretrained LFW models, but an older version (128 instead of the 512). So roughly ~6000 faces

Re: Fawkes: Image “Cloaking” for Personal Privacy

#105

Post by frandroid »

antpls wrote: post #47
sszz wrote: post #25

Earlier quoted context omitted.

This should be somewhat mitigated if you keep using different cloaking images, no?

But the model will eventually be updated to detect and process the new cloaking images. So, to stay ahead, you decide to create a model that automatically generates different cloaking images, and... The whole system is now just a GAN : https://en.wikipedia.org/wiki/Generative_adversarial_network

Not necessarily, because the changes are destructive. They can't restore what was there before, and they can't necessarily infer which image was cloaked and which was not.

Re: Fawkes: Image “Cloaking” for Personal Privacy

#107

Post by Sniffnoy »

cookiecaper wrote: post #103
akersten wrote: post #97

Earlier quoted context omitted.

Fair shake, this time I cropped the image too so that it wasn't looking at any of the boundary to identify it either. Here's the original image: https://imgur.com/a/Td4rhoy And the cloaked: https://imgur.com/a/cPCiCZo These were both saved as JPG with compression level 8/12. I searched for the cloaked crop (96.jpg) first this time: https://imgur.com/a/FSehQWO And the original crop (10.jpg) next: https://imgur.com/a/y…

The goal, afaik, is to stop facial detection software from learning to recognize you and put a face to a name, not to frustrate visual similarity searches. The images are supposed to be visually similar -- so similar that they're indistinguishable to a human viewer. Surveillance software that purports to accurately identify a person across multiple images is not just looking for the same content with some visually in…

But this suggests a way to defeat the cloak -- run your input through image similarity search, then run your facial recognition software on the hits. This won't work in full generality, not every picture is on the internet like that, but it can certainly help, I imagine.

Re: Fawkes: Image “Cloaking” for Personal Privacy

#108

Post by cookiecaper »

Sniffnoy wrote: post #107
cookiecaper wrote: post #103

Earlier quoted context omitted.

The goal, afaik, is to stop facial detection software from learning to recognize you and put a face to a name, not to frustrate visual similarity searches. The images are supposed to be visually similar -- so similar that they're indistinguishable to a human viewer. Surveillance software that purports to accurately identify a person across multiple images is not just looking for the same content with some visually in…

But this suggests a way to defeat the cloak -- run your input through image similarity search, then run your facial recognition software on the hits. This won't work in full generality, not every picture is on the internet like that, but it can certainly help, I imagine.

I think that technique probably works a lot better with high-resolution professional headshots than it does with candid photos at the family reunion, for example.

However, if someone is willing to go to that level of effort, the target probably needs to aim for something a little more forceful than tricking Facebook's autotagger.

Re: Fawkes: Image “Cloaking” for Personal Privacy

#109

Post by CGamesPlay »

StavrosK wrote: post #85
gerdesj wrote: post #82

I'm not surprised that there are loads of attacks like this. On QI recently (a TV prog in the UK) a series of images were presented showing just how asymmetric our faces are. Try taking a photo of your face or someone you know with as near symmetric lighting etc as you can manage. Now cut the image vertically and mirror each half and compare visually. Frightening isn't it? Now add fancy patterns that can be hidden wi…

Why cut and mirror? Can't you just mirror? Wouldn't this be the same as just looking at someone's face in the mirror?

No, he's not saying to flip, he's saying that the left and right halves of your face aren't symmetrical, and it's very uncanny valley if you view a portrait of a person with symmetrical left and right halves.

https://www.google.com/search?q=symmetrical+left+and+right+f...

Re: Fawkes: Image “Cloaking” for Personal Privacy

#110

Post by nl »

I have some software that does keypoint detection for gaze tracking (which is usually roughly equivalent to what facial recognition does).

My software works absolutely fine on these images - it correctly identifies all keypoints.

I would question if this works beyond the specific pieces of software they tested against.

Post reply on HN