# DiffProtect: Generate Adversarial Examples with Diffusion Models for Facial
Privacy Protection

Jiang Liu*, Chun Pong Lau*, Rama Chellappa
Johns Hopkins University, *Equal Contribution
{jiangliu, clau13<EMAIL_ADDRESS>
###### Abstract

The increasingly pervasive facial recognition (FR) systems raise serious
concerns about personal privacy, especially for billions of users who have
publicly shared their photos on social media. Several attempts have been made
to protect individuals from being identified by unauthorized FR systems
utilizing adversarial attacks to generate encrypted face images. However,
existing methods suffer from poor visual quality or low attack success rates,
which limit their utility. Recently, diffusion models have achieved tremendous
success in image generation. In this work, we ask: can diffusion models be
used to generate adversarial examples to improve both visual quality and
attack performance? We propose DiffProtect, which utilizes a diffusion
autoencoder to generate semantically meaningful perturbations on FR systems.
Extensive experiments demonstrate that DiffProtect produces more natural-
looking encrypted images than state-of-the-art methods while achieving
significantly higher attack success rates, _e.g_., 24.5% and 25.1% absolute
improvements on the CelebA-HQ and FFHQ datasets.

##  1 Introduction

The rise of deep neural networks has enabled the tremendous success of facial
recognition (FR) systems [5, 43, 15]. However, the widely deployed FR systems
also pose a huge threat to personal privacy as billions of users have publicly
shared their photos on social media. Through large-scale social media photo
analysis, FR systems can be used for detecting user relationships [46],
stalking victims [47], stealing identities [32], and performing massive
government surveillance [42, 17, 34]. It is urgent to develop facial privacy
protection techniques to protect individuals from unauthorized FR systems.

Figure 1: Illustration of different face encryption methods [58, 20, 45]. The
proposed DiffProtect produces natural and imperceptible changes to the input
images while achieving competitive attack success rates.

Recently, several works [3, 58, 20] proposed to use adversarial attacks to
generate encrypted face images and protect users from being identified by FR
systems. However, existing attacks on FR systems [3, 20, 27, 45, 59, 58, 61]
often suffer from poor visual quality, especially noise-based [3, 58] (Fig.
1a) and patch-based methods [27, 45] (Fig. 1b), which add unnatural and
conspicuous changes to the source images. From a user-centered perspective,
these approaches are not desirable in practice, as everyone wants to post
their best-looking photos on social media – not unattractive photos, even
though they might be encrypted for protecting personal privacy.

An ideal facial identity encryption algorithm should only create natural or
imperceptible changes to the source images. To achieve this goal, several
works [59, 20, 38, 4] attempted to generate natural-looking adversarial
examples using generative adversarial networks (GANs) [10, 25] by transferring
make-up styles [59, 20] or editing facial attributes [38, 22]. Although these
works have demonstrated promising results, the attack success rates (ASRs) of
GAN-based methods can be lower than noise-based and patch-based methods since
the output images are constrained on the learned manifold of a GAN. Moreover,
most of the GAN-based facial encryption methods [20, 59] require training the
model with a fixed victim identity. In other words, these models are target
specific and we need to retrain the model when the target identity is changed.
In addition, the visual quality of images generated by GAN-based methods is
still dissatisfying (see Fig. 1c).

Recently, diffusion models [18, 51, 50, 37, 24] have emerged as state-of-the-
art generative models that are capable of synthesizing realistic and high-
resolution images. It has been shown that diffusion models perform better than
GANs on many image generation tasks [6, 40, 37] and maintain better coverage
of the image distribution [6]. With the rise of diffusion models, a natural
question arrives: can we utilize diffusion models as better generative models
to generate adversarial examples with both high attack success rates and high
visual quality? It has been shown that diffusion models can improve
adversarial robustness [12, 39, 54, 36, 1]. However, whether the strong
generative capacity of diffusion models can be used to generate adversarial
attacks has not been explored.

To this end, we propose DiffProtect, which utilizes a pretrained diffusion
autoencoder [37] to generate adversarial images for facial privacy protection.
The overall pipeline of DiffProtect is shown in Fig. 2. We first encode an
input face image $\mathbf{I}$ into a high-level semantic code $\mathbf{z}$ and
a low-level noise code $\mathbf{x}_{T}$. We then iteratively optimize an
adversarial semantic code $\mathbf{z}_{\text{adv}}$ such that the resulting
protected image $\mathbf{I}_{p}$ generated by the conditional DDIM decoding
process [37, 50] can fool the face recognition model. In this way, we can
create semantically meaningful perturbation to the input image and utilize a
diffusion model to generate high-quality adversarial images (see Fig. 1d). We
further introduce a face semantics regularization module to encourage that
$\mathbf{I}_{\text{p}}$ and $\mathbf{I}$ share similar face semantics to
better preserve visual identity. Our extensive experiments on the CelebA-HQ
[23] and FFHQ [25] datasets show that DiffProtect produces protected face
images of high visual quality, while achieving significantly higher ASRs than
the previous best methods, _e.g_., + 24.5% absolute ASR on CelebA-HQ with
IRSE50 [19] as the victim model.

One drawback of diffusion models is the slow generation process, which
requires many evaluation steps to generate one image. This can be problematic
since we need to iteratively optimize the semantic latent code. To address
this issue, we propose an attack acceleration strategy that computes an
approximated version of the reconstructed image at each attack iteration by
running only one generative step, which drastically reduces the attack time
while maintaining competitive attack performance.

Our main contributions are summarized as follows:

  * •

We propose a novel diffusion model based attack method, termed DiffProtect,
for facial privacy protection, which crafts natural and inconspicuous
adversarial examples on face recognition systems.

  * •

We further propose a face semantics regularization module to better preserve
visual identity and a simple yet effective attack acceleration strategy to
improve attack efficiency.

  * •

Our extensive experiments on the CelebA-HQ and FFHQ datasets demonstrate that
DiffProtect produces more natural-looking encrypted images than state-of-the-
art methods while achieving competitive attack performance.

##  2 Related Work

#### Adversarial Attacks with Generative Models

While most of the existing adversarial attacks focus on optimizing additive
noises in the pixel space [11, 33, 2, 7], several works [55, 56, 21, 38, 59,
20] proposed to generate adversarial attacks with generative models, which
produce perceptually realistic adversarial examples. Wong _et al_. [55]
trained a conditional variational autoencoder (VAE) [49, 26] to generate a
variety of perturbations and utilized the learned perturbation sets to improve
model robustness and generalization. Xiao _et al_. [56] trained a conditional
GAN to directly produce adversarial examples. [21, 31, 52] generate on-
manifold adversarial examples by optimizing latent codes in the latent space
of GANs. Qiu  _et al_. [38] generated semantically realistic adversarial
examples by attribute-conditioned image editing using a GAN. To the best of
our knowledge, this is the first work that utilizes diffusion models for
generating adversarial attacks.

#### Diffusion Models and Adversarial Robustness

Diffusion models [48, 18, 35] are a family of generative models that model the
target distribution by learning a reverse generative denoising process.
Recently, diffusion models have become state-of-the-art methods that can
synthesize more realistic and high-resolution images with more stable training
process [18, 51, 50, 37, 24]. In the field of adversarial machine learning, it
has been shown that diffusion models can help to improve adversarial
robustness and achieve state-of-the-art results [12, 39, 54, 36, 1]. [12, 39,
54] used diffusion models to generate synthetic data for adversarial training.
[36, 1] exploited pretrained diffusion models as purification modules that
remove the adversarial noise in the input images for empirical [36] and
certified [1] defenses. However, it remains unknown whether the strong
generative capacity of diffusion models can be used to generate adversarial
attacks and in this work we make the first attempt in this direction.

#### Adversarial Attacks on Face Recognition

Many studies have been proposed to attack FR systems, including both poisoning
[44] and evasion [3, 20, 27, 45, 59, 58] attacks. Poisoning attacks require
injecting poisoned face images into the training sets of FR systems, which is
unlikely to achieve for individual users. Evasion attacks, especially
transferable black-box attacks, are more practical for protecting facial image
privacy, as they only require perturbing the source images to fool the FR
systems at test time. Existing attacks on FR systems [3, 20, 27, 45, 59, 58]
suffer from poor visual quality or low attack success rates, which limit their
usability in the real world. Noise-based methods such as Lowkey [3] and TIP-IM
[58] create unexplainable noise patterns on face images. Patch-based methods
such as Adv-Hat [27] and Adv-Glasses [45] add unnatural and conspicuous
patches to the source images. GAN-based methods generate more natural-looking
adversarial examples [59, 20, 38, 22], but typically have lower attack success
rates. In addition, [59, 20] drastically change the makeup styles of source
images and might be biased towards female users [20]. In contrast, the
proposed DiffProtect creates natural and imperceptible changes to the source
images and achieves competitive attack performance.

##  3 Background: Diffusion Models

Figure 2: Overview of DiffProtect. DiffProtect utilizes a diffusion
autoencoder [37], which encodes the input image as a semantic code
$\mathbf{z}$ and a stochastic code $\mathbf{x}_{T}$. We iteratively optimize
an adversarial semantic code $\mathbf{z}_{\text{adv}}$ such that the resulting
protected image $\mathbf{I}^{p}$ generated by the conditional DDIM decoding
process can fool the face recognition model.

Diffusion models [48, 18, 35] are a family of generative models that model the
target distribution by learning a reverse denoising generative process. A
diffusion model consists of two processes: (1) a forward diffusion process
that converts the input image $\mathbf{x}_{0}$ to noise map $\mathbf{x}_{T}$
by gradually adding noise in $T$ forward steps; (2) a reverse denoising
generative process that aims to recover $\mathbf{x}_{0}$ from $\mathbf{x}_{T}$
by gradually denoising in $T$ reverse steps.

A Gaussian diffusion process gradually adds Gaussian noise to the data in the
forward diffusion process:

$q(\mathbf{x}_{t}|\mathbf{x}_{t-1})=\mathcal{N}(\sqrt{1-\beta_{t}}\mathbf{x}_{t-1},\beta_{t}\mathbf{I}),$
(1)

where $\beta_{t}\ (t=1,...,T)$ are hyperparameters controlling the noise level
at each diffusion step $t$. In the Gaussian diffusion process, the noisy image
$\mathbf{x}_{t}$ also follows a Gaussian distribution given $\mathbf{x}_{0}$:

$q(\mathbf{x}_{t}|\mathbf{x}_{0})=\mathcal{N}(\sqrt{\alpha_{t}}\mathbf{x}_{0},(1-\alpha_{t})\mathbf{I}),$
(2)

where $\alpha_{t}=\prod_{s=1}^{t}(1-\beta_{s})$. The goal of a diffusion model
is to learn the reverse distribution $p(\mathbf{x}_{t-1}|\mathbf{x}_{t})$ so
that we can generate data by sampling noise map $\mathbf{x}_{T}$ from a prior
distribution, _e.g_., $\mathcal{N}(\mathbf{0},\mathbf{I})$. When the
difference between $t-1$ and $t$ is infinitesimally small, _i.e_., $T=\infty$,
$p(\mathbf{x}_{t-1}|\mathbf{x}_{t})$ can be modeled as [48, 18]:

$p(\mathbf{x}_{t-1}|\mathbf{x}_{t})=\mathcal{N}(\mathbf{\mu_{\theta}}(\mathbf{x}_{t},t),\sigma_{t}^{2}\mathbf{I}),$
(3)

where $\mu_{\theta}$ is a neural network that predicts the posterior mean
given the noisy image $\mathbf{x}_{t}$ and time step $t$. In practice, Ho _et
al_. [18] proposed to train a U-Net [41] to learn a function
$\epsilon_{\theta}(\mathbf{x}_{t},t)$ the noise that has been added to
$\mathbf{x}_{0}$ by the following reweighted loss function:

$\mathcal{L}_{\text{simple}}=\sum_{t=1}^{T}\mathbb{E}_{\mathbf{x}_{0},\mathbf{\epsilon}_{t}}\left[\left\lVert\epsilon_{t}-\epsilon_{\theta}(\mathbf{x}_{t},t)\right\rVert^{2}\right],$
(4)

where $\epsilon_{t}$ is the ground-truth noise added to $\mathbf{x}_{0}$ to
produce $\mathbf{x}_{t}$. And $\mu_{\theta}(\mathbf{x}_{t},t)$ can be obtained
by:

$\mu_{\theta}(\mathbf{x}_{t},t)=\frac{1}{\sqrt{1-\beta_{t}}}\left(\mathbf{x}_{t}-\frac{\beta_{t}}{\sqrt{1-\alpha_{t}}}\epsilon_{\theta}(\mathbf{x}_{t},t)\right).$
(5)

Song _et al_. [50] proposed Denoising Diffusion Implicit Model (DDIM) that
enjoys a deterministic generative process. DDIM has a non-Markovian forward
process:

$\leavevmode\resizebox{469.75499pt}{}{$q(\mathbf{x}_{t-1}|\mathbf{x}_{t},\mathbf{x}_{0})=\mathcal{N}\Big{(}\sqrt{\alpha_{t-1}}\mathbf{x}_{0}+\sqrt{1-\alpha_{t-1}}\frac{\mathbf{x}_{t}-\sqrt{\alpha_{t}}\mathbf{x}_{0}}{\sqrt{1-\alpha_{t}}},\mathbf{0}\Big{)}$}.$
(6)

In the reverse process, DDIM first predicts $\mathbf{x}_{0}$ given
$\mathbf{x}_{t}$:

$f_{\theta}(\mathbf{x}_{t},t)=(\mathbf{x}_{t}-\sqrt{1-\alpha_{t}}\cdot\epsilon_{\theta}(\mathbf{x}_{t},t))/\sqrt{\alpha_{t}},$
(7)

and the reverse process is given by replacing $\mathbf{x}_{0}$ with
$f_{\theta}(\mathbf{x}_{t},t)$ in Eq. 6:

$\leavevmode\resizebox{469.75499pt}{}{$\mathbf{x}_{t-1}=\sqrt{\alpha_{t-1}}\left(\frac{\mathbf{x}_{t}-\sqrt{1-\alpha_{t}}\epsilon_{\theta}(\mathbf{x}_{t},t)}{\sqrt{\alpha_{t}}}\right)+\sqrt{1-\alpha_{t-1}}\epsilon_{\theta}(\mathbf{x}_{t},t)$}.$
(8)

We can think of DDIM as an image encoder, where we can run the generative
process backward deterministically to obtain a noise map $\mathbf{x}_{T}$ that
serves as a latent variable representing $\mathbf{x}_{0}$, as well as an image
decoder, where we run the generative process (Eq. 8) to decoder
$\mathbf{x}_{0}$ from $\mathbf{x}_{T}$.

##  4 DiffProtect

###  4.1 Problem Formulation

In this section, we formulate the problem of adversarial attacks on face
recognition systems. Suppose the face images
$\mathbf{I}\in{\mathcal{I}}:=\mathbb{R}^{H\times W\times C}$ are drawn from an
underlying distribution $\mathbb{P}_{{\mathcal{I}}}$, where $H$, $W$ and $C$
are the height, width and the number of channels of the image respectively.
Let $h(\mathbf{I}):{\mathcal{I}}\rightarrow\mathbb{R}^{d}$ denote a face
recognition model which maps an input face image in ${\mathcal{I}}$ to a
feature vector in $\mathbb{R}^{d}$. An _accurate_ FR system can map two images
$\mathbf{I}_{1}$ and $\mathbf{I}_{2}$ of the same identity to features that
are close in the feature space, and to features that are far away when they
are of different identities, _i.e_.,
${\mathcal{D}}(h(\mathbf{I}_{1}),h(\mathbf{I}_{2}))\leq\tau$ when
$y_{1}=y_{2}$ and ${\mathcal{D}}(h(\mathbf{I}_{1}),h(\mathbf{I}_{2}))>\tau$
when $y_{1}\neq y_{2}$, where ${\mathcal{D}}$ is a distance function, $\tau$
is a threshold and $y_{1}$, $y_{2}$ are the identity of $\mathbf{I}_{1}$ and
$\mathbf{I}_{2}$ respectively.

In the untargeted attack or “dodging attack” setting, a successful attack
fools the face recognition system to map an adversarial image
$\mathbf{I}_{\text{adv}}$ with the same identity as $\mathbf{I}$ to a feature
that is far away from $h(\mathbf{I})$, _i.e_.,
${\mathcal{D}}(h(\mathbf{I}),h(\mathbf{I}_{\text{adv}}))>\tau$. In the
targeted attack or “impersonation attack” setting, a successful attack fools
the face recognition system to map an adversarial image
$\mathbf{I}_{\text{adv}}$ with the targeted identity to a feature that is
close to $h(\mathbf{I})$, i.e.
${\mathcal{D}}(h(\mathbf{I}),h(\mathbf{I}_{\text{adv}}))\leq\tau$. In this
work, we focus on targeted attack setting following previous work [61, 38,
20].

###  4.2 Detailed Construction

The overall pipeline of DiffProtect is shown in Fig. 2. DiffProtect consists
of a semantic encoder and a conditional DDIM that serves as a stochastic
encoder and an image decoder. An input face image is first encoded as a high-
level semantic code $\mathbf{z}$ and a stochastic code $\mathbf{x}_{T}$ that
captures low-level variations. We aim to optimize an adversarial semantic code
$\mathbf{z}_{\text{adv}}$ such that the resulting protected image
$\mathbf{I}_{p}$ generated by the conditional DDIM decoding process [37, 50]
can fool the face recognition model to protect facial privacy.

#### Semantic Encoder

The semantic encoder learns to map an input face image $\mathbf{I}$ into a
semantic latent code $\mathbf{z}=Enc(\mathbf{I})$ that captures high-level
face semantics. Manipulating $\mathbf{z}$ results in semantic changes in the
image.

#### Conditional DDIM

The conditional DDIM [37] is a DDIM model conditioned on the semantic code
$\mathbf{z}$, where we train a noise prediction network
$\epsilon_{\theta}(\mathbf{x}_{t},t,\mathbf{z})$ with $\mathbf{z}$ as an
additional input. During the decoding process, we obtain the reconstructed
image
$\mathbf{I}=\mathbf{x}_{0}=\text{DDIM}_{dec}(\mathbf{x}_{T},\mathbf{z})$, by
running the following deterministic generative process:

$p_{\theta}(\mathbf{x}_{t-1}|\mathbf{x}_{t},\mathbf{z})=\begin{cases}\mathcal{N}(f_{\theta}(\mathbf{x}_{1},1,\mathbf{z}),\mathbf{0})&\text{if
}t=1\\\
q(\mathbf{x}_{t-1}|\mathbf{x}_{t},{f}_{\theta}(\mathbf{x}_{t},t,\mathbf{z}))&\text{otherwise},\end{cases}$
(9)

where
$f_{\theta}(\mathbf{x}_{t},t,\mathbf{z})=(\mathbf{x}_{t}-\sqrt{1-\alpha_{t}}\cdot\epsilon_{\theta}(\mathbf{x}_{t},t,\mathbf{z}))/\sqrt{\alpha_{t}}$,
and $q(\cdot|\cdot,\cdot)$ is defined in Eq. 6.

During the encoding process, we obtain the stochastic code of the input image
$\mathbf{x}_{T}=\text{DDIM}_{enc}(\mathbf{I},\mathbf{z})$ by running the
deterministic generative process backward:

$\mathbf{x}_{t+1}=\sqrt{\alpha_{t+1}}{f}_{\theta}(\mathbf{x}_{t},t,\mathbf{z})+\sqrt{1-\alpha_{t+1}}\mathbf{\epsilon}_{\theta}(\mathbf{x}_{t},t,\mathbf{z}).$
(10)

$\mathbf{x}_{T}$ is encouraged to encode only the information left out by
$\mathbf{z}$, _i.e_., the stochastic details.

#### Attack Formulation

To generate a protected image $\mathbf{I}_{p}$ that can effectively fool the
face recognition systems and has a high visual quality to human eyes, we
perturb the semantic code $\mathbf{z}$ of the input image $\mathbf{I}$ to
obtain an adversarial semantic code $\mathbf{z}_{\text{adv}}$ to create
semantically meaningful perturbations. We then generate $\mathbf{I}_{p}$ by
feeding $\mathbf{z}_{\text{adv}}$ and $\mathbf{x}_{T}$ to the DDIM decoding
process:

$\mathbf{I}_{p}=\text{DDIM}_{dec}(\mathbf{x}_{T},\mathbf{z}_{\text{adv}}).$
(11)

In this way, we constrain $\mathbf{I}_{p}$ to lie on the manifold of real
image distribution to ensure that $\mathbf{I}_{p}$ has high visual quality.

Formally, for targeted privacy protection, we aim to solve the following
optimization problem:

$\min_{\mathbf{z}_{\text{adv}}}\mathcal{L}_{iden}(\mathbf{I}_{p})={\mathcal{D}}(h(\mathbf{I}_{p}),h(\mathbf{I}_{t})),\text{s.t.}\left\lVert\mathbf{z}_{\text{adv}}-\mathbf{z}\right\rVert_{\infty}<\gamma,$
(12)

where $\mathbf{I}_{t}$ is the face image of the target identity,
$\mathbf{I}_{p}$ is the protected face image generated as Eq. 11, $\gamma$ is
the attack budget, ${\mathcal{D}}$ is the cosine distance, $h$ is the face
recognition model. In practice, the user may not have access to $h$. In such a
black-box attack setting, we use surrogate models $g\in{\mathcal{A}}_{g}$ to
estimate the identity loss $\mathcal{L}_{iden}$:

$\mathcal{L}_{iden}(\mathbf{I}_{p})=\sum_{g\in{\mathcal{A}}_{g}}{\mathcal{D}}(g(\mathbf{I}_{p}),g(\mathbf{I}_{t})).$
(13)

#### Face Semantics Regularization

Although the attack strength is controlled by a small attack budget $\gamma$
in Eq. 12 to preserve the overall facial identity to human eyes, in some cases
the protected image can have different local facial features compared to the
input image in order to match the characteristics of the target image, such as
the face shape in Fig. 7, which may not be desired by some users.

To regularize the face semantics of the protected image, we propose a face
semantic consistency loss $\mathcal{L}_{sem}$ that computes the similarity
between the semantic maps of the protected image $\mathbf{I}_{p}$ and the
input image $\mathbf{I}$:

$\mathcal{L}_{sem}(\mathbf{I}_{p})=\text{CE}({\mathcal{M}}(\mathbf{I}_{p}),{\mathcal{M}}(\mathbf{I})),$
(14)

where ${\mathcal{M}}$ is a face parsing network that outputs the semantic map
of the input image, and CE is the cross-entropy loss. The optimization problem
in Eq. 12 becomes:

$\min_{\mathbf{z}_{\text{adv}}}\mathcal{L}(\mathbf{I}_{p})=\mathcal{L}_{iden}(\mathbf{I}_{p})+\lambda\cdot\mathcal{L}_{sem}(\mathbf{I}_{p}),\text{s.t.}\left\lVert\mathbf{z}_{\text{adv}}-\mathbf{z}\right\rVert_{\infty}<\gamma,$
(15)

where $\lambda$ is a hyper-parameter that controls the importance of the
semantic consistency term.

#### Attack Generation

The DiffProtect algorithm is summarized in Alg. 1. We iteratively solve Eq. 15
with projected gradient descent [33]:

$\displaystyle\mathbf{I}_{p}^{(i)}=\text{DDIM}_{dec}(\mathbf{x}_{T},\mathbf{z}_{\text{adv}}^{(i)})$
(16)
$\displaystyle\mathbf{z}_{\text{adv}}^{(i+1)}={\mathcal{P}}_{{\mathcal{S}}}\left(\mathbf{z}_{\text{adv}}^{(i)}-\eta\cdot\text{sign}\left(\nabla_{\mathbf{z}_{\text{adv}}^{(i)}}\mathcal{L}(\mathbf{I}_{p}^{(i)})\right)\right)$
(17)

where $\mathbf{z}_{\text{adv}}^{(0)}=\mathbf{z}$, $\eta$ is the attack step
size, ${\mathcal{P}}_{{\mathcal{S}}}$ is the projection onto feasible set
${\mathcal{S}}=\\{\mathbf{z}_{\text{adv}}:\left\lVert\mathbf{z}_{\text{adv}}-\mathbf{z}\right\rVert_{\infty}<\gamma\\}$.
Note that the DDIM decoding process is fully differentiable (Eq. 9) so we can
directly compute $\nabla_{\mathbf{z}_{\text{adv}}}\mathcal{L}(\mathbf{I}_{p})$
to update $\mathbf{z}_{\text{adv}}$.

Algorithm 1 DiffProtect

1:Input: $\mathbf{I}$, $N$, $\gamma$, $\eta$, $\lambda$, $T$, $Enc$,
$\epsilon_{\theta}$, $h$ or ${\mathcal{A}}_{g}$, ${\mathcal{M}}$

2:Output: protected image $\mathbf{I}_{p}$

3:$\triangleright$ Image Encoding

4:$\mathbf{z}=Enc(\mathbf{I})$,
$\mathbf{x}_{T}=\text{DDIM}_{enc}(\mathbf{I},\mathbf{z})$

5:$\triangleright$ Attack Generation

6:$\mathbf{z}_{\text{adv}}^{(0)}\leftarrow\mathbf{z}$

7:for $i=0$ to $N-1$

8:$\ \ \ \
\mathbf{I}_{p}^{(i)}=\text{DDIM}_{dec}(\mathbf{x}_{T},\mathbf{z}_{\text{adv}}^{(i)})$

9: or $\mathbf{I}_{p}^{(i)}\approx
f_{\theta}(\mathbf{x}_{t_{0}},t_{0},\mathbf{z}_{\text{adv}}^{(i)})$
$\triangleright$ DiffProtect-fast

10:$\ \ \ \
\mathcal{L}(\mathbf{I}_{p}^{(i)})=\mathcal{L}_{iden}(\mathbf{I}_{p}^{(i)})+\lambda\cdot\mathcal{L}_{sem}(\mathbf{I}_{p}^{(i)})$

11:$\ \ \ \
\mathbf{z}_{\text{adv}}^{(i+1)}={\mathcal{P}}_{{\mathcal{S}}}\left(\mathbf{z}_{\text{adv}}^{(i)}-\eta\cdot\text{sign}\left(\nabla_{\mathbf{z}_{\text{adv}}^{(i)}}\mathcal{L}(\mathbf{I}_{p}^{(i)})\right)\right)$

12:end for

13:$\mathbf{z}_{\text{adv}}\leftarrow\mathbf{z}_{\text{adv}}^{(N)}$,
$\mathbf{I}_{p}=\text{DDIM}_{dec}(\mathbf{x}_{T},\mathbf{z}_{\text{adv}})$

#### Attack Acceleration

In Eq. 16, we need to run the full DDIM decoding process to obtain
$\mathbf{I}_{p}^{(i)}$ at each attack iteration. The time complexity for
generating a protected image is ${\mathcal{O}}(T\times N)$, where $T$ is the
number of generative steps in the DDIM decoding process, $N$ is the number of
attack steps. To accelerate attack generation, we can instead compute an
approximated version of $\mathbf{I}_{p}^{(i)}$ at each attack iteration by
running only one generative step. Specifically, let $t_{0}$ be the time stamp
from which we run the generative step to estimate $\mathbf{I}_{p}^{(i)}$. We
can obtain the corresponding noise map $\mathbf{x}_{t_{0}}$ from the DDIM
encoding process and estimate $\mathbf{I}_{p}^{(i)}$ by:

$\small\mathbf{I}_{p}^{(i)}\approx
f_{\theta}(\mathbf{x}_{t_{0}},t_{0},\mathbf{z}_{\text{adv}}^{(i)})=\frac{1}{\sqrt{\alpha_{t_{0}}}}(\mathbf{x}_{t_{0}}-\sqrt{1-\alpha_{t_{0}}}\cdot\epsilon_{\theta}(\mathbf{x}_{t_{0}},t_{0},\mathbf{z}_{\text{adv}}^{(i)})).$
(18)

In this way, we can reduce the time complexity to ${\mathcal{O}}(N)$. We
denote this accelerated version of DiffProtect as DiffProtect-fast. Note that
$\mathbf{x}_{t_{0}}$ is not updated during the attack. This simple strategy
works surprisingly well as we will show in Sec. 5.2. The effect of the choice
of $t_{0}$ is shown in the supplementary materials.

Methods |  Target- specific |  Natural- looking | CelebA-HQ | FFHQ
---|---|---|---|---
ASR (%) $\uparrow$ | FID $\downarrow$ | ASR (%) $\uparrow$ | FID $\downarrow$
IRSE50 | IR152 | MobileFace | IRSE50 | IR152 | MobileFace
No attack | ✗ | ✓ | 7.3 | 3.8 | 1.1 | 0 | 4.4 | 2.5 | 5.2 | 0
PGD [33] | ✗ | ✗ | 32.6 | 19.0 | 35.6 | 39.6 | 20.1 | 14.4 | 18.8 | 38.1
MIM [7] | ✗ | ✗ | 37.4 | 31.0 | 35.5 | 69.9 | 24.5 | 23.2 | 21.4 | 62.1
TIP-IM [58] | ✗ | ✗ | 47.2 | 35.3 | 45.3 | 71.6 | 31.0 | 27.5 | 26.9 | 62.8
AMT-GAN [20] | ✓ | ✓ | 53.9 | 41.9 | 60.0 | 31.1 | 32.6 | 30.5 | 29.9 | 30.5
DiffProtect-fast $(\lambda=0)$ | ✗ | ✓ | 68.4 | 49.8 | 72.1 | 26.7 | 50.8 | 47.6 | 47.0 | 26.4
DiffProtect $(\lambda=0)$ | ✗ | ✓ | 78.4 | 60.3 | 77.9 | 27.6 | 57.7 | 54.3 | 52.9 | 26.1
DiffProtect $(\lambda=0.2)$ | ✗ | ✓ | 67.7 | 48.7 | 69.3 | 24.4 | 46.2 | 45.4 | 44.3 | 23.5

Table 1: Comparison with state-of-the-art methods on CelebA-HQ and FFHQ
datasets for targeted black-box attacks. The best performance is in bold and
the second best is underlined.

Input |  |  |  |  |  |  |
---|---|---|---|---|---|---|---
TIP-IM [58] |  |  |  |  |  |  |
AMT-GAN [20] |  |  |  |  |  |  |
DiffProtect-fast |  |  |  |  |  |  |
DiffProtect |  |  |  |  |  |  |

Figure 3: Visualizations of the protected face images generated by different
face encryption methods on CelebA-HQ.

##  5 Experiments

###  5.1 Experimental Settings

#### Dataset

We evaluate DiffProtect on two commonly used high-quality face image datasets:
CelebA-HQ [23] and FFHQ [25]. Following [20], we use a subset of 1000 face
images with different identities for each dataset.

#### Attack Setting

In this paper, we focus on black-box targeted attacks following previous work
[61, 38, 20]. We consider three popular face recognition models, including
IR152 [14], IRSE50 [19], and MobileFace [5] as the victim models. For each
model, we use the other models as the surrogate models ${\mathcal{A}}_{g}$ to
craft black-box attacks.

#### Evaluation Metrics

We use Attack Success Rate (ASR) [20, 61] to evaluate the attack performance:

$\text{ASR}=\frac{1}{K}\sum_{\mathbf{I}}\mathbbm{I}\left(\text{cos}(h(\mathbf{I}_{t}),h(\mathbf{I}_{\text{p}}))>\tau\right)\times
100\%,$ (19)

where $\mathbbm{I}$ is the indicator function, $K$ is the number of face image
$\mathbf{I}$, $\tau$ is the threshold, $\mathbf{I}_{t}$ and $\mathbf{I}_{p}$
are the target and protected face images respectively. The value of $\tau$ is
set at 0.01 False Acceptance Rate (FAR) for each victim model. In addition, we
use Frechet Inception Distance (FID) [16] to evaluate the naturalness of
protected face images.

#### Implementation Details

The architecture of DiffProtect is mainly based on Diffusion Autoencoder
(DiffAE) [37]. We use the DiffAE model trained on the FFHQ dataset with
$256\times 256$ image resolutions. The DiffAE model is fixed during attack
generation. For face semantics regularization, we use a pretrained BiSeNet
[60] trained on the CelebAMask-HQ dataset [28] as the face parsing network
${\mathcal{M}}$. We set $N=50$, $\gamma=0.03$, $\eta=2\cdot\frac{\gamma}{N}$
and $\lambda=0$ by default. We set $T=100$ for conditional DDIM encoding and
final decoding, but use five decoding steps for reconstructing
$\mathbf{I}_{p}^{(i)}$ during attack (Eq. 16) in order to save time and
memory. For DiffProtect-fast, we set $t_{o}=60$. All experiments were run on a
server with 8 Nvidia A5000 GPUs.

IRSE50 |  |
---|---|---
IR152 |  |
MobileFace |  |

(a) CelebA-HQ

(b) FFHQ

Figure 4: ASR under various defense methods.

###  5.2 Comparison with the state-of-the-art

#### Main Results

We compare DiffProtect with state-of-the-art face encryption methods,
including PGD [33], MIM [7], TIP-IM [58], and AMT-GAN [20]. The implementation
details of baseline methods can be found in the supplementary materials. Table
1 reports the quantitative results on the CelebA-HQ and FFHQ datasets. For
ASR, DiffProtect significantly outperforms previous methods by a large margin.
In addition, DiffProtect achieves the lowest FID scores, which indicates that
the encrypted images generated by DiffProtect are the most natural. We show
some examples of protected face images in Fig. 3 with $\lambda=0$. We can
observe that DiffProtect produces good-looking protected images with natural
and inconspicuous changes to the input images, such as slight changes in
facial expressions. It works well across genders, ages, and races, and in some
cases even makes the images look more attractive. Compared to TIP-IM, the
protected face images generated by DiffProtect have no obvious noise pattern
as we only perturb the semantic codes and generate the images through a
conditional DDIM. Compared to AMT-GAN, DiffProtect can better preserve image
styles and details and does not require training a target-specific model for
each identity. Our accelerated method DiffProtect-fast also achieves higher
ASRs and lower FID compared to the baselines. In addition, we can observe that
DiffProtect and DiffProtect-fast achieve similar visual quality, while
DiffProtect-fast requires 50% less computation time (more details in the
supplementary material).

#### ASR under Defenses

We further evaluate the effectiveness of DiffProtect against four adversarial
defense methods, including feature squeezing [57], median blurring [29], JPEG
compression [8], and a state-of-the-art diffusion-based defense DiffPure [36].
The implementation details of the defenses can be found in the supplementary
materials. From Fig. 4 we can see that DiffProtect still achieves higher ASR
under various defenses. In addition, DiffProtect is much more resilient to the
DiffPure defense compared to baseline methods since it generates semantically
meaningful perturbations to the input images that are hard to remove during
the diffusion denoising process of DiffPure.

###  5.3 Ablation Studies

For ablation studies, we use the CelebA dataset and MobileFace as the victim
model. We set $N=10$, $\gamma=0.02$, and $T=50$. The other settings are the
same as Sec. 5.1.

Dataset | Model | IRSE50 | IR152 | MobileFace
---|---|---|---|---
CelebA-HQ | GAN | 33.0 | 16.5 | 41.1
Diff. |  60.7 (+27.7) |  37.5 (+21.0) |  62.0 (+20.6)
FFHQ | GAN | 21.3 | 20.0 | 21.2
Diff. |  36.5 (+15.2) |  33.1 (+13.1) |  34.0 (+12.8)

Table 2: ASR (%) of GAN [53] and Diffusion [37] model.

|  |
---|---|---
|  |

(a) Input image

(b) GAN output.

(c) Diffusion output.

Figure 5: Visualizations of adversarial images generated by GAN [53] and
diffusion [37] models on CelebA-HQ.

Input Image | $\gamma=0.005$ | $\gamma=0.01$ | $\gamma=0.02$ | $\gamma=0.03$ | $\gamma=0.05$ | $\gamma=0.1$ | Target Image
---|---|---|---|---|---|---|---
|  |  |  |  |  |  |
|  |  |  |  |  |  |
$\xrightarrow[]{\ \ \ \gamma\ \text{increasing}\ \ \ }$ |  25.0%, 28.5 |  37.4%, 30.23 |  60.5%, 33.42 |  75.4%, 36.42 |  88.4%, 42.53 |  97.7%, 57.25 |

Figure 6: Visual comparisons of different attack budget $\gamma$ and the
corresponding ASR and FID.

#### GAN vs. Diffusion model

To have a fair comparison between GAN-based and Diffusion-based methods, we
re-implement our method using a GAN-based autoencoder [53] where we also
iteratively optimize the GAN latent code using the same formulation. The
implementation details can be found in the supplementary materials. The
results are summarized in Table 2. We can observe that the diffusion-based
method has much higher ASRs than the GAN-based method. From Fig. 5 we can
observe that the image quality of Diffusion model output is also visually
better than the GAN-based method. These results confirm our intuition that a
better generative model like a Diffusion model can help to improve both attack
performance and image quality.

#### Effect of Attack Budget

We show the effect of attack budget $\gamma$ in Fig. 6. We can observe that as
$\gamma$ increases, the ASR also increases; when $\gamma=0$, we have
$\text{ASR}=97.7\%$. However, the FID also goes up as $\gamma$ increases,
which indicates that the image quality becomes worse. In addition, a large
$\gamma$ can cause the protected image to lose the visual identity of the
input image. In practice, we recommend setting $\gamma\leq 0.03$ such that the
output images have high visual quality and preserve the identity of the input
images, which is confirmed by a user study using Amazon Mechanical Turk (see
the supplementary material).

#### Effect of Face Semantics Regularization

We show the effect of face semantics regularization in Fig. 7. Without the
face semantics regularization term ($\lambda=0$), the protected image can have
different local facial features compared to the input image to match the
characteristics of the target image, such as the face shape in Fig. 7 (a).
Increasing the value of $\lambda$ helps to preserve the face features of the
input images. Quantitatively, from Table 3 we can observe that increasing
$\lambda$ helps to reduce FID, which indicates better image quality but also
decreases ASR. In practice, a user can choose a value of $\lambda$ as well as
the attack budget $\gamma$ depending on their own preference.

Figure 7: Effect of Face Semantics Regularization. (a)-(d): protected image $\mathbf{I}_{p}$ generated with different $\lambda$ in Eq. 15. Increasing $\lambda$ gradually changes the face shape from a heart shape (similar to $\textbf{I}_{t}$) to a square shape (similar to I). $\lambda$ | 0 | 0.01 | 0.05 | 0.1 | 0.2 | 0.5
---|---|---|---|---|---|---
ASR (%) $\uparrow$ | 60.5 | 60.3 | 58.9 | 56.3 | 53.5 | 46.1
FID $\downarrow$ | 33.4 | 33.3 | 32.8 | 32.4 | 31.9 | 31.2
Table 3: Quantitative results of face semantics regularization with different
$\lambda$ in Eq. 15. Figure 8: Confidence scores of different methods
evaluated by commercial API Face++.

###  5.4 Evaluation on Commercial API

We further evaluate the effectiveness of AGE-FTM in the real world using a
commercial FR API Face++111https://www.faceplusplus.com/, where we compute the
confidence scores between the protected images and the target identity image.
DiffProtect achieves average confidence scores of 62.8% and 58.03% for CelebA-
HQ and FFHQ respectively, which are higher than baseline methods. This shows
that the proposed method has a satisfactory attack ability even for the
commercial API while achieving good image quality.

##  6 Conclusion

In this work, we propose DiffProtect a novel diffusion-based method for facial
privacy protection. It generates semantically meaningful perturbations to the
input images and produces adversarial images of high visual quality. Our
extensive experiments on CelebA-HQ and FFHQ demonstrate that DiffProtect
significantly outperforms previous state-of-the-art methods for both attack
performance and image quality.

## References

  * [1] Nicholas Carlini, J Zico Kolter, Florian Tramer, Krishnamurthy Dj Dvijotham, Leslie Rice, and Mingjie Sun.  (certified!!) adversarial robustness for free!  In ICLR, 2023.
  * [2] Nicholas Carlini and David Wagner.  Towards evaluating the robustness of neural networks.  In IEEE Symposium on Security and Srivacy (SP), 2017.
  * [3] Valeriia Cherepanova, Micah Goldblum, Harrison Foley, Shiyuan Duan, John Dickerson, Gavin Taylor, and Tom Goldstein.  Lowkey: Leveraging adversarial attacks to protect social media users from facial recognition.  In ICLR, 2021.
  * [4] Yunjey Choi, Minje Choi, Munyoung Kim, Jung-Woo Ha, Sunghun Kim, and Jaegul Choo.  StarGAN: Unified Generative Adversarial Networks for Multi-Domain Image-to-Image Translation.  In CVPR, 2018.
  * [5] Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou.  Arcface: Additive angular margin loss for deep face recognition.  In CVPR, 2019.
  * [6] Prafulla Dhariwal and Alexander Nichol.  Diffusion models beat gans on image synthesis.  In NeurIPS, 2021.
  * [7] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li.  Boosting adversarial attacks with momentum.  In CVPR, 2018.
  * [8] Gintare Karolina Dziugaite, Zoubin Ghahramani, and Daniel M Roy.  A study of the effect of jpg compression on adversarial images.  arXiv preprint arXiv:1608.00853, 2016.
  * [9] Gintare Karolina Dziugaite, Zoubin Ghahramani, and Daniel M Roy.  A study of the effect of jpg compression on adversarial images.  arXiv preprint arXiv:1608.00853, 2016.
  * [10] Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio.  Generative adversarial nets.  In NeurIPS, 2014.
  * [11] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and harnessing adversarial examples.  In ICLR, 2015.
  * [12] Sven Gowal, Sylvestre-Alvise Rebuffi, Olivia Wiles, Florian Stimberg, Dan A. Calian, and Timothy Mann.  Improving robustness using generated data.  arXiv preprint arXiv:2110.09468, 2021.
  * [13] Shuangchi Gu, Ping Yi, Ting Zhu, Yao Yao, and Wei Wang.  Detecting adversarial examples in deep neural networks using normalizing filters.  UMBC Student Collection, 2019.
  * [14] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.  Deep residual learning for image recognition.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016.
  * [15] Yonghao He, Dezhong Xu, Lifang Wu, Meng Jian, Shiming Xiang, and Chunhong Pan.  LFFD: A light and fast face detector for edge devices.  arXiv preprint arXiv:1904.10633, 2019.
  * [16] Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter.  Gans trained by a two time-scale update rule converge to a local nash equilibrium.  Advances in neural information processing systems, 30, 2017.
  * [17] Kashmir Hill.  The secretive company that might end privacy as we know it.  In Ethics of Data and Analytics, pages 170–177. Auerbach Publications, 2020.
  * [18] Jonathan Ho, Ajay Jain, and Pieter Abbeel.  Denoising diffusion probabilistic models.  NeurIPS, 2020.
  * [19] Jie Hu, Li Shen, and Gang Sun.  Squeeze-and-excitation networks.  In CVPR, 2018.
  * [20] Shengshan Hu, Xiaogeng Liu, Yechao Zhang, Minghui Li, Leo Yu Zhang, Hai Jin, and Libing Wu.  Protecting facial privacy: Generating adversarial identity masks via style-robust makeup transfer.  In CVPR, 2022.
  * [21] Ajil Jalal, Andrew Ilyas, Constantinos Daskalakis, and Alexandros G Dimakis.  The robust manifold defense: Adversarial training using generative models.  arXiv preprint arXiv:1712.09196, 2017.
  * [22] Shuai Jia, Bangjie Yin, Taiping Yao, Shouhong Ding, Chunhua Shen, Xiaokang Yang, and Chao Ma.  Adv-Attribute: Inconspicuous and Transferable Adversarial Attack on Face Recognition.  In NeurIPS, 2022.
  * [23] Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen.  Progressive growing of GANs for improved quality, stability, and variation.  In ICLR, 2018.
  * [24] Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine.  Elucidating the design space of diffusion-based generative models.  In NeurIPS, 2022.
  * [25] Tero Karras, Samuli Laine, and Timo Aila.  A style-based generator architecture for generative adversarial networks.  In CVPR, 2019.
  * [26] Diederik P. Kingma and Max Welling.  Auto-encoding variational bayes.  In ICLR, 2014.
  * [27] Stepan Komkov and Aleksandr Petiushko.  AdvHat: Real-world adversarial attack on ArcFace face ID system.  In ICPR, 2021.
  * [28] Cheng-Han Lee, Ziwei Liu, Lingyun Wu, and Ping Luo.  MaskGAN: Towards Diverse and Interactive Facial Image Manipulation.  In CVPR, 2020.
  * [29] Xin Li and Fuxin Li.  Adversarial examples detection in deep networks with convolutional filter statistics.  In ICCV, 2017.
  * [30] Xin Li and Fuxin Li.  Adversarial examples detection in deep networks with convolutional filter statistics.  In Proceedings of the IEEE international conference on computer vision, pages 5764–5772, 2017.
  * [31] Wei-An Lin, Chun Pong Lau, Alexander Levine, Rama Chellappa, and Soheil Feizi.  Dual Manifold Adversarial Robustness: Defense against Lp and non-Lp Adversarial Attacks.  In NeurIPS, 2020.
  * [32] Taylor Kay Lively.  Facial recognition in the US: Privacy concerns and legal developments.  rb.gy/u8i6ny.  Accessed: 2/14/2023.
  * [33] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.  Towards deep learning models resistant to adversarial attacks.  In ICLR, 2018.
  * [34] Paul Mozur and Aaron Krolik.  A surveillance net blankets China’s cities, giving police vast powers.  The New York Times, 17, 2019.
  * [35] Alexander Quinn Nichol and Prafulla Dhariwal.  Improved denoising diffusion probabilistic models.  In ICML, 2021.
  * [36] Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar.  Diffusion models for adversarial purification.  In ICML, 2022.
  * [37] Konpat Preechakul, Nattanat Chatthee, Suttisak Wizadwongsa, and Supasorn Suwajanakorn.  Diffusion autoencoders: Toward a meaningful and decodable representation.  In CVPR, 2022.
  * [38] Haonan Qiu, Chaowei Xiao, Lei Yang, Xinchen Yan, Honglak Lee, and Bo Li.  Semanticadv: Generating adversarial examples via attribute-conditioned image editing.  In ECCV, 2020.
  * [39] Sylvestre-Alvise Rebuffi, Sven Gowal, Dan A. Calian, Florian Stimberg, Olivia Wiles, and Timothy Mann.  Fixing data augmentation to improve adversarial robustness.  arXiv preprint arXiv:2103.01946, 2021.
  * [40] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer.  High-resolution image synthesis with latent diffusion models.  In CVPR, 2022.
  * [41] Olaf Ronneberger, Philipp Fischer, and Thomas Brox.  U-Net: Convolutional networks for biomedical image segmentation.  In MICCAI, 2015.
  * [42] ADAM SATARIANO.  Police use of facial recognition is accepted by british court.  The New York Times, 4, 2019.
  * [43] Florian Schroff, Dmitry Kalenichenko, and James Philbin.  FaceNet: A unified embedding for face recognition and clustering.  In CVPR, 2015.
  * [44] Shawn Shan, Emily Wenger, Jiayun Zhang, Huiying Li, Haitao Zheng, and Ben Y Zhao.  Fawkes: Protecting privacy against unauthorized deep learning models.  In 29th USENIX Security Symposium (USENIX Security 20), pages 1589–1604, 2020.
  * [45] Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K Reiter.  A general framework for adversarial examples with objectives.  ACM Transactions on Privacy and Security (TOPS), 22(3):1–30, 2019\.
  * [46] Yan Shoshitaishvili, Christopher Kruegel, and Giovanni Vigna.  Portrait of a Privacy Invasion.  Proceedings on Privacy Enhancing Technologies, 2015(1):41–60, 2015.
  * [47] Maya Shwayder.  Clearview ai’s facial-recognition app is a nightmare for stalking victims.  Digital Trends, 2020.
  * [48] Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli.  Deep unsupervised learning using nonequilibrium thermodynamics.  In ICML, 2015.
  * [49] Kihyuk Sohn, Honglak Lee, and Xinchen Yan.  Learning structured output representation using deep conditional generative models.  In NeurIPS, 2015.
  * [50] Jiaming Song, Chenlin Meng, and Stefano Ermon.  Denoising diffusion implicit models.  In ICLR, 2021.
  * [51] Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole.  Score-based generative modeling through stochastic differential equations.  arXiv preprint arXiv:2011.13456, 2020.
  * [52] David Stutz, Matthias Hein, and Bernt Schiele.  Disentangling adversarial robustness and generalization.  In CVPR, 2019.
  * [53] Tengfei Wang, Yong Zhang, Yanbo Fan, Jue Wang, and Qifeng Chen.  High-fidelity GAN inversion for image attribute editing.  In CVPR, 2022.
  * [54] Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan.  Better diffusion models further improve adversarial training.  arXiv preprint arXiv:2302.04638, 2023.
  * [55] Eric Wong and J Zico Kolter.  Learning perturbation sets for robust machine learning.  In ICLR, 2021.
  * [56] Chaowei Xiao, Bo Li, Jun-Yan Zhu, Warren He, Mingyan Liu, and Dawn Song.  Generating adversarial examples with adversarial networks.  In IJCAI, 2018.
  * [57] Weilin Xu, David Evans, and Yanjun Qi.  Feature squeezing: Detecting adversarial examples in deep neural networks.  arXiv preprint arXiv:1704.01155, 2017.
  * [58] Xiao Yang, Yinpeng Dong, Tianyu Pang, Hang Su, Jun Zhu, Yuefeng Chen, and Hui Xue.  Towards face encryption by generating adversarial identity masks.  In CVPR, 2021.
  * [59] Bangjie Yin, Wenxuan Wang, Taiping Yao, Junfeng Guo, Zelun Kong, Shouhong Ding, Jilin Li, and Cong Liu.  Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognition.  arXiv preprint arXiv:2105.03162, 2021.
  * [60] Changqian Yu, Jingbo Wang, Chao Peng, Changxin Gao, Gang Yu, and Nong Sang.  BiSeNet: Bilateral segmentation network for real-time semantic segmentation.  In ECCV, 2018.
  * [61] Yaoyao Zhong and Weihong Deng.  Towards transferable adversarial attack against deep face recognition.  IEEE Transactions on Information Forensics and Security, 16:1452–1466, 2020.

## Supplementary Material

Methods | CelebA-HQ | FFHQ
---|---|---
ASR (%) $\uparrow$ | FID $\downarrow$ | Time (s) $\downarrow$ | ASR (%) $\uparrow$ | FID $\downarrow$ | Time (s) $\downarrow$
IRSE50 | IR152 | MobileFace | IRSE50 | IR152 | MobileFace
DiffProtect-fast | 68.4 | 49.8 | 72.1 | 26.7 | 18.9 | 50.8 | 47.6 | 47.0 | 26.4 | 18.3
DiffProtect | 78.4 | 60.3 | 77.9 | 27.6 | 36.4 | 57.7 | 54.3 | 52.9 | 26.1 | 35.9

Table 4: Comparison between DiffProtect and DiffProtect-fast.

##  Appendix A DiffProtect-fast

###  A.1 Effect of $t_{0}$

In DiffProtect-fast, we run one generative step from the time stamp $t_{0}$ to
compute $\mathbf{I}_{p}^{(i)}$, instead of running the whole generative
process from $t=T$ to $t=0$ to accelerate attack generation. We show the
effect of the choice of $t_{0}$ in Fig. 9, where we use the same settings as
in the ablation studies. We can observe that when we increase $t_{0}$, ASR
first increases and then decreases, while FID first decreases and then
increases, which indicates the image quality also first increases and then
decreases. This shows that choosing $t_{0}$ at the early or late stage of the
generative process is less effective. We set $t_{0}/T=0.6$, _i.e_.,
$t_{0}=0.6\cdot T$, as this ratio achieves the highest ASR and is also a local
minimum for FID.

Figure 9: Effect of $t_{0}/T$ ratio for DiffProtect-fast.

###  A.2 Comparison with DiffProtect

We provide quantitative comparisons between DiffProtect and DiffProtect-fast
in Table 4. Compared to DiffProtect, DiffProtect-fast achieves lower ASRs, and
similar FIDs, but requires much less computation time. Note that DiffProtect-
fast also outperforms the baseline methods as shown in Table 1 of the main
paper. These results demonstrate that the attack acceleration strategy is very
effective and we can use DiffProtect-fast to achieve a trade-off between
computation time and attack success rate. In addition, by comparing the last
two rows of Figs. 10 and 11, we can observe that the protected images
generated by DiffProtect and DiffProtect-fast are visually similar.

##  Appendix B Additional Implementation Details

###  B.1 Baselines

For $l_{\infty}$ attacks such as PGD [33], MIM [7] and TIP-IM [58], the attack
budget is set to be $16/255$ with $100$ attack iterations. For MIM, the decay
factor $\mu$ is set to $1.0$. For TIP-IM, the gamma value for the MMD loss is
set to $0$ by default. For AMT-GAN [20], we use the default setting.

###  B.2 Defense methods

We evaluated our methods with four defense methods: feature squeezing [13],
JPEG compression [9], median blur [30], and adversarial purification [36]. For
feature squeezing, the bit depth is set to $3$. For JPEG compression, the
quality factor is set to $5$. For the median blur, the kernel size is set to
$7$. For adversarial purification, we set the diffusion timestep to be
$0.0075$.

###  B.3 GAN-based attack

To have a fair comparison between GAN-based and Diffusion-based methods, we
re-implement our method using an HFGI [53] model, a state-of-the-art method
that uses a high-fidelity GAN and can invert and edit high-resolution face
images effectively. HFGI consists of an encoder $E$ to encode the images and
uses a generator $G$ to edit the high-resolution face images. To craft the
GAN-based attack, we first pass the image to the encoder to get the latent
code $z=E(I)$. Then we perturb $z$ by minimizing Eq. (15) of the main paper to
obtain the adversarial latent code $z^{adv}$. Finally, we decode $z^{adv}$ to
an adversarial image using the generator $G$. We set the attack budget to
$0.1$, with step size $0.02$ in $10$ iterations.

##  Appendix C Additional Experimental Results

We show the effect of attack iterations in Table 5, where we change the number
of attack iterations $N$ and the other settings are the same as in the
ablation studies. We can observe that as $N$ increases, ASR also increases
while FID stays relatively the same. We set $N=50$ in our main experiments.

$N$ | 2 | 5 | 10 | 20 | 50
---|---|---|---|---|---
ASR (%) $\uparrow$ | 47.3 | 57.2 | 60.5 | 61.9 | 63.1
FID $\downarrow$ | 32.4 | 33.3 | 33.4 | 33.6 | 33.7
Table 5: Effect of attack iteration $N$.

##  Appendix D User Study

To further investigate the effect of different attack budgets for preserving
facial identity, we conduct a user study using Amazon Mechanical Turk (MTurk),
where we show the worker the original image $\mathbf{I}$ and the protected
image $\mathbf{I}_{p}$ generated with different attack budget $\gamma$. For
each pair of $\mathbf{I}$ and $\mathbf{I}_{p}$, the worker is asked to provide
a rating from 1 to 10 of “how likely the two face images belong to the same
person?” with 1 being “extremely unlikely” and 10 being “extremely likely”. We
randomly selected 50 images from our CelebA-HQ test set for the user study and
each pair of $\mathbf{I}$ and $\mathbf{I}_{p}$ is evaluated by ten MTurk
workers. The average ratings are shown in Table 6. We chose $\gamma=0.03$
since it achieves a high user rating as well as a high ASR (78.4%) and low FID
(27.6). In practice, a user can choose the value of $\gamma$ themselves based
on their own preferences.

$\gamma$ | 0.005 | 0.01 | 0.02 | 0.03 | 0.05 | 0.1
---|---|---|---|---|---|---
Rating $\uparrow$ | 8.9 | 8.7 | 7.9 | 7.0 | 5.5 | 4.7
Table 6: Identity similarity ratings of different $\gamma$.

##  Appendix E More Visualization Results

We provide more examples of protected face images in Figs. 10 and 11. We can
observe that DiffProtect produces good-looking protected images with natural
and inconspicuous changes to the input images, such as slight changes in
facial expressions. It works well across genders, ages, and races, and in some
cases even makes the images look more attractive. Compared to TIP-IM, the
protected face images generated by DiffProtect have no obvious noise pattern
as we only perturb the semantic codes and generate the images through a
conditional DDIM. Compared to AMT-GAN, DiffProtect can better preserve image
styles and details and does not require training a target-specific model for
each identity.

Input |  |  |  |  |  |  |
---|---|---|---|---|---|---|---
TIP-IM [58] |  |  |  |  |  |  |
AMT-GAN [20] |  |  |  |  |  |  |
DiffProtect-fast |  |  |  |  |  |  |
DiffProtect |  |  |  |  |  |  |

Figure 10: Visualizations of the protected face images generated by different
face encryption methods on CelebA-HQ.

Input |  |  |  |  |  |  |
---|---|---|---|---|---|---|---
TIP-IM [58] |  |  |  |  |  |  |
AMT-GAN [20] |  |  |  |  |  |  |
DiffProtect-fast |  |  |  |  |  |  |
DiffProtect |  |  |  |  |  |  |

Figure 11: Visualizations of the protected face images generated by different
face encryption methods on CelebA-HQ.